Changes between Version 3 and Version 4 of revisionSoftwareXCA

Timestamp:

May 3, 2017, 10:37:23 AM (7 years ago)

Author:

aaraujo

Comment:

--

revisionSoftwareXCA

@@ -136 +136 @@
 
 
-
-
-
-
+'''https://github.com/open-eid/browser-token-signing/blob/master/common/esteid_sign.c'''
+{{{
+int EstEID_signHash(char **signature, unsigned int *signatureLength, CK_SLOT_ID slotID, EstEID_Map cert, const char *hash, unsigned int hashLength, EstEID_PINPromptData pinPromptData) {
+        CK_SESSION_HANDLE session = 0L;
+        CK_RV loginResult = CKR_FUNCTION_CANCELED;
+        char *name;
+        char message[1024];
+        int remainingTries = -1;
+        int attempt = 0, blocked = FALSE;
+        int isPinPad;
+    unsigned int privateKeyIndex;
+#ifdef _WIN32
+        EstEID_PINPromptDataEx pinPromptDataEx;
+#endif
+
+
+        LOG_LOCATION;
+
+        if (EstEID_CK_failure("C_OpenSession", fl->C_OpenSession(slotID, CKF_SERIAL_SESSION, NULL_PTR, NULL_PTR, &session))) return FAILURE;
+
+        name = EstEID_getFullNameWithPersonalCode(cert);
+    privateKeyIndex = (unsigned)atoi(EstEID_mapGet(cert, "privateKeyIndex"));
+    remainingTries = EstEID_getRemainingTries(slotID);
+        for (attempt = 0;; attempt++) {
+                if (remainingTries == -1)
+                        CLOSE_SESSION_AND_RETURN(FAILURE);
+                if (!remainingTries || blocked) {
+                        sprintf(EstEID_error, "C_Login error: %s (%li)", pkcs11_error_message(CKR_PIN_LOCKED), CKR_PIN_LOCKED);
+                        pinPromptData.alertFunction(pinPromptData.nativeWindowHandle, l10n("PIN2 blocked, cannot sign!"));
+                        CLOSE_SESSION_AND_RETURN(FAILURE);
+                }
+                if (remainingTries < 3 || attempt) {
+                        sprintf(message, "%s%s %i", (attempt ? l10n("Incorrect PIN2! ") : ""), l10n("Tries left:"), remainingTries);
+                }
+                else {
+                        message[0] = 0;
+                }
+                isPinPad = EstEID_isPinPad(slotID);
+                if(!isPinPad) {
+                        // Simple card reader
+                        char *pin = pinPromptData.promptFunction(pinPromptData.nativeWindowHandle, name, message, (unsigned)atoi(EstEID_mapGet(cert, "minPinLen")), isPinPad);
+                        if (!pin || strlen(pin) == 0) {
+                                free(pin);
+                                setUserCancelErrorCodeAndMessage();
+                                CLOSE_SESSION_AND_RETURN(FAILURE);
+                        }
+                        loginResult = fl->C_Login(session, CKU_USER, (unsigned char *)pin, strlen(pin));
+                        free(pin);
+                }
+                else {
+                        // PIN pad                      
+#ifdef _WIN32
+                        EstEID_log("creating pinpad dialog UI thread");
+                        pinpad_thread_result = -1;
+                        FAIL_IF_THREAD_ERROR("CreateMutex", (pinpad_thread_mutex = CreateMutex(NULL, FALSE, NULL)));
+#else
+                        EstEID_log("creating pinpad worker thread");
+                        pinpad_thread_result = -1;
+                        FAIL_IF_PTHREAD_ERROR("pthread_mutex_init", pthread_mutex_init(&pinpad_thread_mutex, NULL));
+                        FAIL_IF_PTHREAD_ERROR("pthread_cond_init", pthread_cond_init(&pinpad_thread_condition, NULL));
+                        pthread_t pinpad_thread;
+                        EstEID_PINPadThreadData threadData;
+                        threadData.session = session;
+                        threadData.result = CKR_OK;
+#endif
+                        EstEID_log("thread launched");
+#ifdef _WIN32
+                        /*
+                        NB! Due to Firefox for Windows specific behaviour C_Login() is launched from main thread
+                        and UI code is running in separate thread if running on Windows.
+                        */
+                        pinPromptDataEx.pinPromptData = pinPromptData;
+                        pinPromptDataEx.message = message;
+                        pinPromptDataEx.name = name;
+                        CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)&EstEID_pinPadLogin, (LPVOID)&pinPromptDataEx, 0, NULL);
+                        loginResult = fl->C_Login(session, CKU_USER, NULL, 0);
+                        //closePinPadModalSheet();
+#else
+                        FAIL_IF_PTHREAD_ERROR("pthread_create", pthread_create(&pinpad_thread, NULL, EstEID_pinPadLogin, (void*)&threadData));
+                        pinPromptData.promptFunction(pinPromptData.nativeWindowHandle, name, message, 0, isPinPad);
+                        loginResult = threadData.result;
+#endif
+                        EstEID_log("pinpad sheet/dialog closed");
+                        if (loginResult == CKR_FUNCTION_CANCELED) {
+                                setUserCancelErrorCodeAndMessage();
+                                CLOSE_SESSION_AND_RETURN(FAILURE);
+                        }
+                }
+                EstEID_log("loginResult = %s", pkcs11_error_message(loginResult));
+                switch (loginResult) {
+                        case CKR_PIN_LOCKED:
+                                blocked = TRUE;
+                        case CKR_PIN_INCORRECT:
+                remainingTries--;
+                        case CKR_PIN_INVALID:
+                        case CKR_PIN_LEN_RANGE:
+                                EstEID_log("this was attempt %i, loginResult causes to run next round", attempt);
+                                continue;
+                        default:
+                                if (EstEID_CK_failure("C_Login", loginResult)) CLOSE_SESSION_AND_RETURN(FAILURE);
+                }
+                break; // Login successful - correct PIN supplied
+        }
+
+        return EstEID_RealSign(session, signature, signatureLength, hash, hashLength, name, privateKeyIndex);
+}
+
+
+int EstEID_RealSign(CK_SESSION_HANDLE session, char **signature, unsigned int *signatureLength, const char *hash, unsigned int hashLength, char* name, unsigned int privateKeyIndex) {
+        CK_ULONG objectCount;
+        unsigned int hashWithPaddingLength = 0;
+        char *hashWithPadding;
+        CK_MECHANISM mechanism = {CKM_RSA_PKCS, 0, 0};
+        CK_OBJECT_CLASS objectClass = CKO_PRIVATE_KEY;
+        CK_ATTRIBUTE searchAttribute = {CKA_CLASS, &objectClass, sizeof(objectClass)};
+
+    unsigned int max = privateKeyIndex + 1;
+    CK_OBJECT_HANDLE privateKeyHandle[max];
+
+        if (EstEID_CK_failure("C_FindObjectsInit", fl->C_FindObjectsInit(session, &searchAttribute, 1))) CLOSE_SESSION_AND_RETURN(FAILURE);
+
+        if (EstEID_CK_failure("C_FindObjects", fl->C_FindObjects(session, privateKeyHandle, max, &objectCount))) CLOSE_SESSION_AND_RETURN(FAILURE);
+        if (EstEID_CK_failure("C_FindObjectsFinal", fl->C_FindObjectsFinal(session))) CLOSE_SESSION_AND_RETURN(FAILURE);
+
+        if (objectCount == 0) CLOSE_SESSION_AND_RETURN(FAILURE); // todo ?? set error message
+    EstEID_log("found %i private keys in slot, using key in position %i", objectCount, privateKeyIndex);
+
+    if (EstEID_CK_failure("C_SignInit", fl->C_SignInit(session, &mechanism, privateKeyHandle[privateKeyIndex]))) CLOSE_SESSION_AND_RETURN(FAILURE);
+
+        hashWithPadding = EstEID_addPadding(hash, hashLength, &hashWithPaddingLength);
+        if (hashWithPadding) { // This is additional safeguard, as digest length is checked already before calling EstEID_addPadding()
+                CK_ULONG len;
+                if (EstEID_CK_failure("C_Sign", fl->C_Sign(session, (CK_BYTE_PTR)hashWithPadding, hashWithPaddingLength, NULL, &len))) {
+                        free(hashWithPadding);
+                        CLOSE_SESSION_AND_RETURN(FAILURE);
+                }
+                *signature = (char *)malloc(len);
+                if (EstEID_CK_failure("C_Sign", fl->C_Sign(session, (CK_BYTE_PTR)hashWithPadding, hashWithPaddingLength, (CK_BYTE_PTR) * signature, &len))) {
+                        free(hashWithPadding);
+                        CLOSE_SESSION_AND_RETURN(FAILURE);
+                }
+                *signatureLength = len;
+                free(hashWithPadding);
+        }
+
+        if (session) {
+                if (EstEID_CK_failure("C_CloseSession", fl->C_CloseSession(session))) {
+                        return FAILURE;
+                }
+        }
+
+        if(name) {
+                free(name);
+        }
+
+        if (!hashWithPaddingLength) { // This is additional safeguard, as digest length is checked already before calling EstEID_addPadding()
+                EstEID_log("will not sign due to incorrect incoming message digest length");
+                return FAILURE;
+        }
+        EstEID_log("successfully signed");
+        return SUCCESS;
+}
+
+
+
+}}}
+
+
+
+
+