1/* This Source Code Form is subject to the terms of the Mozilla Public
2 * License, v. 2.0. If a copy of the MPL was not distributed with this
3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
45use crate::{
6 error::*,
7 pk11::slot::{generate_random, get_internal_slot},
8 util::{map_nss_secstatus, ScopedPtr},
9};
10use std::{
11 ops::Deref,
12 os::raw::{c_int, c_uchar, c_uint, c_void},
13 ptr,
14};
1516scoped_ptr!(SymKey, nss_sys::PK11SymKey, nss_sys::PK11_FreeSymKey);
17scoped_ptr!(
18 PrivateKey,
19 nss_sys::SECKEYPrivateKey,
20 nss_sys::SECKEY_DestroyPrivateKey
21);
22scoped_ptr!(
23 PublicKey,
24 nss_sys::SECKEYPublicKey,
25 nss_sys::SECKEY_DestroyPublicKey
26);
27scoped_ptr!(
28 GenericObject,
29 nss_sys::PK11GenericObject,
30 nss_sys::PK11_DestroyGenericObject
31);
3233scoped_ptr!(
34 Certificate,
35 nss_sys::CERTCertificate,
36 nss_sys::CERT_DestroyCertificate
37);
3839scoped_ptr!(Context, nss_sys::PK11Context, pk11_destroy_context_true);
40scoped_ptr!(Slot, nss_sys::PK11SlotInfo, nss_sys::PK11_FreeSlot);
4142scoped_ptr!(
43 AlgorithmID,
44 nss_sys::SECAlgorithmID,
45 secoid_destroy_algorithm_id_true
46);
4748#[inline]
49unsafe fn secoid_destroy_algorithm_id_true(alg_id: *mut nss_sys::SECAlgorithmID) {
50 nss_sys::SECOID_DestroyAlgorithmID(alg_id, nss_sys::PR_TRUE);
51}
5253#[inline]
54unsafe fn pk11_destroy_context_true(context: *mut nss_sys::PK11Context) {
55 nss_sys::PK11_DestroyContext(context, nss_sys::PR_TRUE);
56}
5758// Trait for types that have PCKS#11 attributes that are readable. See
59// https://searchfox.org/mozilla-central/rev/8ed8474757695cdae047150a0eaf94a5f1c96dbe/security/nss/lib/pk11wrap/pk11pub.h#842-864
60/// # Safety
61/// Unsafe since it needs to call [`nss_sys::PK11_ReadRawAttribute`] which is
62/// a C NSS function, and thus inherently unsafe to call
63pub(crate) unsafe trait Pkcs11Object: ScopedPtr {
64const PK11_OBJECT_TYPE: nss_sys::PK11ObjectType;
65fn read_raw_attribute(
66&self,
67 attribute_type: nss_sys::CK_ATTRIBUTE_TYPE,
68 ) -> Result<ScopedSECItem> {
69let mut out_sec = ScopedSECItem::empty(nss_sys::SECItemType::siBuffer);
70 map_nss_secstatus(|| unsafe {
71 nss_sys::PK11_ReadRawAttribute(
72Self::PK11_OBJECT_TYPE as u32,
73self.as_mut_ptr() as *mut c_void,
74 attribute_type,
75 out_sec.as_mut_ref(),
76 )
77 })?;
78Ok(out_sec)
79 }
80}
8182unsafe impl Pkcs11Object for GenericObject {
83const PK11_OBJECT_TYPE: nss_sys::PK11ObjectType = nss_sys::PK11ObjectType::PK11_TypeGeneric;
84}
85unsafe impl Pkcs11Object for PrivateKey {
86const PK11_OBJECT_TYPE: nss_sys::PK11ObjectType = nss_sys::PK11ObjectType::PK11_TypePrivKey;
87}
88unsafe impl Pkcs11Object for PublicKey {
89const PK11_OBJECT_TYPE: nss_sys::PK11ObjectType = nss_sys::PK11ObjectType::PK11_TypePubKey;
90}
91unsafe impl Pkcs11Object for SymKey {
92const PK11_OBJECT_TYPE: nss_sys::PK11ObjectType = nss_sys::PK11ObjectType::PK11_TypeSymKey;
93}
9495// From https://developer.mozilla.org/en-US/docs/Mozilla/Projects/NSS/NSS_API_Guidelines#Thread_Safety:
96// "Data structures that are read only, like SECKEYPublicKeys or PK11SymKeys, need not be protected."
97unsafe impl Send for PrivateKey {}
98unsafe impl Send for PublicKey {}
99100impl PrivateKey {
101pub fn convert_to_public_key(&self) -> Result<PublicKey> {
102Ok(unsafe { PublicKey::from_ptr(nss_sys::SECKEY_ConvertToPublicKey(self.as_mut_ptr()))? })
103 }
104105// To protect against key ID collisions, PrivateKeyFromPrivateKeyTemplate
106 // generates a random ID for each key. The given template must contain an
107 // attribute slot for a key ID, but it must consist of a null pointer and have a
108 // length of 0.
109pub(crate) fn from_private_key_template(
110mut template: Vec<nss_sys::CK_ATTRIBUTE>,
111 ) -> Result<Self> {
112// Generate a random 160-bit object ID. This ID must be unique.
113let mut obj_id_buf = vec![0u8; 160 / 8];
114 generate_random(&mut obj_id_buf)?;
115let mut obj_id = nss_sys::SECItem {
116 type_: nss_sys::SECItemType::siBuffer as u32,
117 data: obj_id_buf.as_ptr() as *mut c_uchar,
118 len: c_uint::try_from(obj_id_buf.len())?,
119 };
120let slot = get_internal_slot()?;
121let mut pre_existing_key = unsafe {
122 nss_sys::PK11_FindKeyByKeyID(slot.as_mut_ptr(), &mut obj_id, std::ptr::null_mut())
123 };
124if !pre_existing_key.is_null() {
125// Note that we can't just call SECKEY_DestroyPrivateKey here because that
126 // will destroy the PKCS#11 object that is backing a preexisting key (that
127 // we still have a handle on somewhere else in memory). If that object were
128 // destroyed, cryptographic operations performed by that other key would
129 // fail.
130unsafe {
131 destroy_private_key_without_destroying_pkcs11_object(pre_existing_key);
132 }
133// Try again with a new ID (but only once - collisions are very unlikely).
134generate_random(&mut obj_id_buf)?;
135 pre_existing_key = unsafe {
136 nss_sys::PK11_FindKeyByKeyID(slot.as_mut_ptr(), &mut obj_id, std::ptr::null_mut())
137 };
138if !pre_existing_key.is_null() {
139unsafe {
140 destroy_private_key_without_destroying_pkcs11_object(pre_existing_key);
141 }
142return Err(ErrorKind::InternalError.into());
143 }
144 }
145let template_len = c_int::try_from(template.len())?;
146let id_attr: &mut nss_sys::CK_ATTRIBUTE = template
147 .iter_mut()
148 .find(|&&mut attr| {
149 attr.type_ == (nss_sys::CKA_ID as nss_sys::CK_ATTRIBUTE_TYPE)
150 && attr.pValue.is_null()
151 && attr.ulValueLen == 0
152})
153 .ok_or(ErrorKind::InternalError)?;
154 id_attr.pValue = obj_id_buf.as_mut_ptr() as *mut c_void;
155 id_attr.ulValueLen = nss_sys::CK_ULONG::try_from(obj_id_buf.len())?;
156// We use `PK11_CreateGenericObject` instead of `PK11_CreateManagedGenericObject`
157 // to leak the reference on purpose because `PK11_FindKeyByKeyID` will take
158 // ownership of it.
159let _obj = unsafe {
160 GenericObject::from_ptr(nss_sys::PK11_CreateGenericObject(
161 slot.as_mut_ptr(),
162 template.as_mut_ptr(),
163 template_len,
164 nss_sys::PR_FALSE,
165 ))?
166};
167// Have NSS translate the object to a private key.
168Ok(unsafe {
169 PrivateKey::from_ptr(nss_sys::PK11_FindKeyByKeyID(
170 slot.as_mut_ptr(),
171&mut obj_id,
172 std::ptr::null_mut(),
173 ))?
174})
175 }
176}
177178// This is typically used by functions receiving a pointer to an `out SECItem`,
179// where we allocate the struct, but NSS allocates the elements it points to.
180pub(crate) struct ScopedSECItem {
181 wrapped: nss_sys::SECItem,
182}
183184impl ScopedSECItem {
185pub(crate) fn empty(r#type: nss_sys::SECItemType) -> Self {
186 ScopedSECItem {
187 wrapped: nss_sys::SECItem {
188 type_: r#type as u32,
189 data: ptr::null_mut(),
190 len: 0,
191 },
192 }
193 }
194195pub(crate) fn as_mut_ref(&mut self) -> &mut nss_sys::SECItem {
196&mut self.wrapped
197 }
198}
199200impl Deref for ScopedSECItem {
201type Target = nss_sys::SECItem;
202#[inline]
203fn deref(&self) -> &nss_sys::SECItem {
204&self.wrapped
205 }
206}
207208impl Drop for ScopedSECItem {
209fn drop(&mut self) {
210unsafe {
211// PR_FALSE asks the NSS allocator not to free the SECItem
212 // itself, and just the pointee of `self.wrapped.data`.
213nss_sys::SECITEM_FreeItem(&mut self.wrapped, nss_sys::PR_FALSE);
214 }
215 }
216}
217218// This helper function will release the memory backing a SECKEYPrivateKey and
219// any resources acquired in its creation. It will leave the backing PKCS#11
220// object untouched, however. This should only be called from
221// PrivateKeyFromPrivateKeyTemplate.
222// From: https://searchfox.org/mozilla-central/rev/444ee13e14fe30451651c0f62b3979c76766ada4/dom/crypto/CryptoKey.cpp#80
223unsafe fn destroy_private_key_without_destroying_pkcs11_object(
224 key: *mut nss_sys::SECKEYPrivateKey,
225) {
226assert!(!key.is_null());
227 nss_sys::PK11_FreeSlot((*key).pkcs11Slot);
228 nss_sys::PORT_FreeArena((*key).arena, nss_sys::PR_TRUE);
229}