Mercurial > hg > orthanc
annotate OrthancFramework/Sources/Pkcs11.cpp @ 4888:8523078f3f4b
added new configuration to authorize C-Find for worklist independently from other C-Find
| author | Alain Mazy <am@osimis.io> |
|---|---|
| date | Fri, 18 Feb 2022 15:45:28 +0100 |
| parents | 43e613a7756b |
| children | 6eff25f70121 |
| rev | line source |
|---|---|
| 2025 | 1 /** |
| 2 * Orthanc - A Lightweight, RESTful DICOM Store | |
| 3 * Copyright (C) 2012-2016 Sebastien Jodogne, Medical Physics | |
| 4 * Department, University Hospital of Liege, Belgium | |
|
4870
43e613a7756b
upgrade to year 2022
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4831
diff
changeset
|
5 * Copyright (C) 2017-2022 Osimis S.A., Belgium |
|
43e613a7756b
upgrade to year 2022
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4831
diff
changeset
|
6 * Copyright (C) 2021-2022 Sebastien Jodogne, ICTEAM UCLouvain, Belgium |
| 2025 | 7 * |
| 8 * This program is free software: you can redistribute it and/or | |
|
4119
bf7b9edf6b81
re-licensing the OrthancFramework to LGPL, in order to license Stone of Orthanc under LGPL
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4044
diff
changeset
|
9 * modify it under the terms of the GNU Lesser General Public License |
|
bf7b9edf6b81
re-licensing the OrthancFramework to LGPL, in order to license Stone of Orthanc under LGPL
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4044
diff
changeset
|
10 * as published by the Free Software Foundation, either version 3 of |
|
bf7b9edf6b81
re-licensing the OrthancFramework to LGPL, in order to license Stone of Orthanc under LGPL
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4044
diff
changeset
|
11 * the License, or (at your option) any later version. |
| 2025 | 12 * |
| 13 * This program is distributed in the hope that it will be useful, but | |
| 14 * WITHOUT ANY WARRANTY; without even the implied warranty of | |
| 15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU | |
|
4119
bf7b9edf6b81
re-licensing the OrthancFramework to LGPL, in order to license Stone of Orthanc under LGPL
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4044
diff
changeset
|
16 * Lesser General Public License for more details. |
| 2025 | 17 * |
|
4119
bf7b9edf6b81
re-licensing the OrthancFramework to LGPL, in order to license Stone of Orthanc under LGPL
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4044
diff
changeset
|
18 * You should have received a copy of the GNU Lesser General Public |
|
bf7b9edf6b81
re-licensing the OrthancFramework to LGPL, in order to license Stone of Orthanc under LGPL
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4044
diff
changeset
|
19 * License along with this program. If not, see |
|
bf7b9edf6b81
re-licensing the OrthancFramework to LGPL, in order to license Stone of Orthanc under LGPL
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
4044
diff
changeset
|
20 * <http://www.gnu.org/licenses/>. |
| 2025 | 21 **/ |
| 22 | |
| 23 | |
| 24 #include "PrecompiledHeaders.h" | |
| 25 #include "Pkcs11.h" | |
| 26 | |
| 27 | |
| 28 #if defined(OPENSSL_NO_RSA) || defined(OPENSSL_NO_EC) || defined(OPENSSL_NO_ECDSA) || defined(OPENSSL_NO_ECDH) | |
| 29 # error OpenSSL was compiled without support for RSA, EC, ECDSA or ECDH | |
| 30 #endif | |
| 31 | |
| 32 | |
| 33 #include "Logging.h" | |
| 34 #include "OrthancException.h" | |
| 2145 | 35 #include "SystemToolbox.h" |
| 2025 | 36 |
| 37 extern "C" | |
| 38 { | |
| 2145 | 39 # include <libp11/engine.h> // This is P11's "engine.h" |
| 40 # include <libp11/libp11.h> | |
| 2025 | 41 } |
| 42 | |
| 43 #include <openssl/engine.h> | |
| 44 | |
| 45 | |
| 46 namespace Orthanc | |
| 47 { | |
| 48 namespace Pkcs11 | |
| 49 { | |
| 50 static const char* PKCS11_ENGINE_ID = "pkcs11"; | |
| 51 static const char* PKCS11_ENGINE_NAME = "PKCS#11 for Orthanc"; | |
| 52 static const ENGINE_CMD_DEFN PKCS11_ENGINE_COMMANDS[] = | |
| 53 { | |
| 54 { | |
| 55 CMD_MODULE_PATH, | |
| 56 "MODULE_PATH", | |
| 57 "Specifies the path to the PKCS#11 module shared library", | |
| 58 ENGINE_CMD_FLAG_STRING | |
| 59 }, | |
| 60 { | |
| 61 CMD_PIN, | |
| 62 "PIN", | |
| 63 "Specifies the pin code", | |
| 64 ENGINE_CMD_FLAG_STRING | |
| 65 }, | |
| 66 { | |
| 67 CMD_VERBOSE, | |
| 68 "VERBOSE", | |
| 69 "Print additional details", | |
| 70 ENGINE_CMD_FLAG_NO_INPUT | |
| 71 }, | |
| 72 { | |
| 73 CMD_LOAD_CERT_CTRL, | |
| 74 "LOAD_CERT_CTRL", | |
| 75 "Get the certificate from card", | |
| 76 ENGINE_CMD_FLAG_INTERNAL | |
| 77 }, | |
| 78 { | |
| 79 0, | |
| 80 NULL, | |
| 81 NULL, | |
| 82 0 | |
| 83 } | |
| 84 }; | |
| 85 | |
| 86 | |
| 87 static bool pkcs11Initialized_ = false; | |
| 88 static ENGINE_CTX *context_ = NULL; | |
| 89 | |
| 90 static int EngineInitialize(ENGINE* engine) | |
| 91 { | |
| 92 if (context_ == NULL) | |
| 93 { | |
| 94 return 0; | |
| 95 } | |
| 96 else | |
| 97 { | |
| 98 return pkcs11_init(context_); | |
| 99 } | |
| 100 } | |
| 101 | |
| 102 | |
| 103 static int EngineFinalize(ENGINE* engine) | |
| 104 { | |
| 105 if (context_ == NULL) | |
| 106 { | |
| 107 return 0; | |
| 108 } | |
| 109 else | |
| 110 { | |
| 111 return pkcs11_finish(context_); | |
| 112 } | |
| 113 } | |
| 114 | |
| 115 | |
| 116 static int EngineDestroy(ENGINE* engine) | |
| 117 { | |
| 118 return (context_ == NULL ? 0 : 1); | |
| 119 } | |
| 120 | |
| 121 | |
| 122 static int EngineControl(ENGINE *engine, | |
| 123 int command, | |
| 124 long i, | |
| 125 void *p, | |
| 126 void (*f) ()) | |
| 127 { | |
| 128 if (context_ == NULL) | |
| 129 { | |
| 130 return 0; | |
| 131 } | |
| 132 else | |
| 133 { | |
| 134 return pkcs11_engine_ctrl(context_, command, i, p, f); | |
| 135 } | |
| 136 } | |
| 137 | |
| 138 | |
| 139 static EVP_PKEY *EngineLoadPublicKey(ENGINE *engine, | |
| 140 const char *s_key_id, | |
| 141 UI_METHOD *ui_method, | |
| 142 void *callback_data) | |
| 143 { | |
| 144 if (context_ == NULL) | |
| 145 { | |
| 146 return 0; | |
| 147 } | |
| 148 else | |
| 149 { | |
| 150 return pkcs11_load_public_key(context_, s_key_id, ui_method, callback_data); | |
| 151 } | |
| 152 } | |
| 153 | |
| 154 | |
| 155 static EVP_PKEY *EngineLoadPrivateKey(ENGINE *engine, | |
| 156 const char *s_key_id, | |
| 157 UI_METHOD *ui_method, | |
| 158 void *callback_data) | |
| 159 { | |
| 160 if (context_ == NULL) | |
| 161 { | |
| 162 return 0; | |
| 163 } | |
| 164 else | |
| 165 { | |
| 166 return pkcs11_load_private_key(context_, s_key_id, ui_method, callback_data); | |
| 167 } | |
| 168 } | |
| 169 | |
| 170 | |
| 171 static ENGINE* LoadEngine() | |
| 172 { | |
| 173 // This function creates an engine for PKCS#11 and inspired by | |
| 174 // the "ENGINE_load_dynamic" function from OpenSSL, in file | |
| 175 // "crypto/engine/eng_dyn.c" | |
| 176 | |
| 177 ENGINE* engine = ENGINE_new(); | |
| 178 if (!engine) | |
| 179 { | |
|
2954
d924f9bb61cc
taking advantage of details in OrthancException
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
2447
diff
changeset
|
180 throw OrthancException(ErrorCode_InternalError, |
|
d924f9bb61cc
taking advantage of details in OrthancException
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
2447
diff
changeset
|
181 "Cannot create an OpenSSL engine for PKCS#11"); |
| 2025 | 182 } |
| 183 | |
| 184 // Create a PKCS#11 context using libp11 | |
| 185 context_ = pkcs11_new(); | |
| 186 if (!context_) | |
| 187 { | |
| 188 ENGINE_free(engine); | |
|
2954
d924f9bb61cc
taking advantage of details in OrthancException
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
2447
diff
changeset
|
189 throw OrthancException(ErrorCode_InternalError, |
|
d924f9bb61cc
taking advantage of details in OrthancException
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
2447
diff
changeset
|
190 "Cannot create a libp11 context for PKCS#11"); |
| 2025 | 191 } |
| 192 | |
| 193 if (!ENGINE_set_id(engine, PKCS11_ENGINE_ID) || | |
| 194 !ENGINE_set_name(engine, PKCS11_ENGINE_NAME) || | |
| 195 !ENGINE_set_cmd_defns(engine, PKCS11_ENGINE_COMMANDS) || | |
| 196 | |
| 197 // Register the callback functions | |
| 198 !ENGINE_set_init_function(engine, EngineInitialize) || | |
| 199 !ENGINE_set_finish_function(engine, EngineFinalize) || | |
| 200 !ENGINE_set_destroy_function(engine, EngineDestroy) || | |
| 201 !ENGINE_set_ctrl_function(engine, EngineControl) || | |
| 202 !ENGINE_set_load_pubkey_function(engine, EngineLoadPublicKey) || | |
| 203 !ENGINE_set_load_privkey_function(engine, EngineLoadPrivateKey) || | |
| 204 | |
| 205 !ENGINE_set_RSA(engine, PKCS11_get_rsa_method()) || | |
|
3723
cc6d4edfe8fe
fix pkcs11 compilation
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
3640
diff
changeset
|
206 |
|
cc6d4edfe8fe
fix pkcs11 compilation
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
3640
diff
changeset
|
207 #if OPENSSL_VERSION_NUMBER < 0x10100000L // OpenSSL 1.0.2 |
| 2025 | 208 !ENGINE_set_ECDSA(engine, PKCS11_get_ecdsa_method()) || |
| 209 !ENGINE_set_ECDH(engine, PKCS11_get_ecdh_method()) || | |
|
3723
cc6d4edfe8fe
fix pkcs11 compilation
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
3640
diff
changeset
|
210 #else |
| 2025 | 211 !ENGINE_set_EC(engine, PKCS11_get_ec_key_method()) || |
| 212 #endif | |
| 213 | |
| 214 // Make OpenSSL know about our PKCS#11 engine | |
| 215 !ENGINE_add(engine)) | |
| 216 { | |
| 217 pkcs11_finish(context_); | |
| 218 ENGINE_free(engine); | |
|
2954
d924f9bb61cc
taking advantage of details in OrthancException
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
2447
diff
changeset
|
219 throw OrthancException(ErrorCode_InternalError, |
|
d924f9bb61cc
taking advantage of details in OrthancException
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
2447
diff
changeset
|
220 "Cannot initialize the OpenSSL engine for PKCS#11"); |
| 2025 | 221 } |
| 222 | |
| 223 // If the "ENGINE_add" worked, it gets a structural | |
| 224 // reference. We release our just-created reference. | |
| 225 ENGINE_free(engine); | |
| 226 | |
| 227 return ENGINE_by_id(PKCS11_ENGINE_ID); | |
| 228 } | |
| 229 | |
| 230 | |
| 231 bool IsInitialized() | |
| 232 { | |
| 233 return pkcs11Initialized_; | |
| 234 } | |
| 235 | |
| 236 const char* GetEngineIdentifier() | |
| 237 { | |
| 238 return PKCS11_ENGINE_ID; | |
| 239 } | |
| 240 | |
| 241 void Initialize(const std::string& module, | |
| 242 const std::string& pin, | |
| 243 bool verbose) | |
| 244 { | |
| 245 if (pkcs11Initialized_) | |
| 246 { | |
|
2954
d924f9bb61cc
taking advantage of details in OrthancException
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
2447
diff
changeset
|
247 throw OrthancException(ErrorCode_BadSequenceOfCalls, |
|
d924f9bb61cc
taking advantage of details in OrthancException
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
2447
diff
changeset
|
248 "The PKCS#11 engine has already been initialized"); |
| 2025 | 249 } |
| 250 | |
| 251 if (module.empty() || | |
| 2145 | 252 !SystemToolbox::IsRegularFile(module)) |
| 2025 | 253 { |
|
2954
d924f9bb61cc
taking advantage of details in OrthancException
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
2447
diff
changeset
|
254 throw OrthancException( |
|
d924f9bb61cc
taking advantage of details in OrthancException
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
2447
diff
changeset
|
255 ErrorCode_InexistentFile, |
|
d924f9bb61cc
taking advantage of details in OrthancException
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
2447
diff
changeset
|
256 "The PKCS#11 module must be a path to one shared library (DLL or .so)"); |
| 2025 | 257 } |
| 258 | |
| 259 ENGINE* engine = LoadEngine(); | |
| 260 if (!engine) | |
| 261 { | |
|
2954
d924f9bb61cc
taking advantage of details in OrthancException
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
2447
diff
changeset
|
262 throw OrthancException(ErrorCode_InternalError, |
|
d924f9bb61cc
taking advantage of details in OrthancException
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
2447
diff
changeset
|
263 "Cannot create an OpenSSL engine for PKCS#11"); |
| 2025 | 264 } |
| 265 | |
| 266 if (!ENGINE_ctrl_cmd_string(engine, "MODULE_PATH", module.c_str(), 0)) | |
| 267 { | |
|
2954
d924f9bb61cc
taking advantage of details in OrthancException
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
2447
diff
changeset
|
268 throw OrthancException(ErrorCode_InternalError, |
|
d924f9bb61cc
taking advantage of details in OrthancException
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
2447
diff
changeset
|
269 "Cannot configure the OpenSSL dynamic engine for PKCS#11"); |
| 2025 | 270 } |
| 271 | |
| 272 if (verbose) | |
| 273 { | |
| 274 ENGINE_ctrl_cmd_string(engine, "VERBOSE", NULL, 0); | |
| 275 } | |
| 276 | |
| 277 if (!pin.empty() && | |
| 278 !ENGINE_ctrl_cmd_string(engine, "PIN", pin.c_str(), 0)) | |
| 279 { | |
|
2954
d924f9bb61cc
taking advantage of details in OrthancException
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
2447
diff
changeset
|
280 throw OrthancException(ErrorCode_InternalError, |
|
d924f9bb61cc
taking advantage of details in OrthancException
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
2447
diff
changeset
|
281 "Cannot set the PIN code for PKCS#11"); |
| 2025 | 282 } |
| 283 | |
| 284 if (!ENGINE_init(engine)) | |
| 285 { | |
|
2954
d924f9bb61cc
taking advantage of details in OrthancException
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
2447
diff
changeset
|
286 throw OrthancException(ErrorCode_InternalError, |
|
d924f9bb61cc
taking advantage of details in OrthancException
Sebastien Jodogne <s.jodogne@gmail.com>
parents:
2447
diff
changeset
|
287 "Cannot initialize the OpenSSL dynamic engine for PKCS#11"); |
| 2025 | 288 } |
| 289 | |
| 290 LOG(WARNING) << "The PKCS#11 engine has been successfully initialized"; | |
| 291 pkcs11Initialized_ = true; | |
| 292 } | |
| 293 | |
| 294 | |
| 295 void Finalize() | |
| 296 { | |
| 297 // Nothing to do, the unregistration of the engine is | |
| 298 // automatically done by OpenSSL | |
| 299 } | |
| 300 } | |
| 301 } |