|
2025
|
1 /**
|
|
|
2 * Orthanc - A Lightweight, RESTful DICOM Store
|
|
|
3 * Copyright (C) 2012-2016 Sebastien Jodogne, Medical Physics
|
|
|
4 * Department, University Hospital of Liege, Belgium
|
|
|
5 *
|
|
|
6 * This program is free software: you can redistribute it and/or
|
|
|
7 * modify it under the terms of the GNU General Public License as
|
|
|
8 * published by the Free Software Foundation, either version 3 of the
|
|
|
9 * License, or (at your option) any later version.
|
|
|
10 *
|
|
|
11 * In addition, as a special exception, the copyright holders of this
|
|
|
12 * program give permission to link the code of its release with the
|
|
|
13 * OpenSSL project's "OpenSSL" library (or with modified versions of it
|
|
|
14 * that use the same license as the "OpenSSL" library), and distribute
|
|
|
15 * the linked executables. You must obey the GNU General Public License
|
|
|
16 * in all respects for all of the code used other than "OpenSSL". If you
|
|
|
17 * modify file(s) with this exception, you may extend this exception to
|
|
|
18 * your version of the file(s), but you are not obligated to do so. If
|
|
|
19 * you do not wish to do so, delete this exception statement from your
|
|
|
20 * version. If you delete this exception statement from all source files
|
|
|
21 * in the program, then also delete it here.
|
|
|
22 *
|
|
|
23 * This program is distributed in the hope that it will be useful, but
|
|
|
24 * WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
25 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
|
26 * General Public License for more details.
|
|
|
27 *
|
|
|
28 * You should have received a copy of the GNU General Public License
|
|
|
29 * along with this program. If not, see <http://www.gnu.org/licenses/>.
|
|
|
30 **/
|
|
|
31
|
|
|
32
|
|
|
33 #include "PrecompiledHeaders.h"
|
|
|
34 #include "Pkcs11.h"
|
|
|
35
|
|
|
36
|
|
|
37 #if defined(OPENSSL_NO_RSA) || defined(OPENSSL_NO_EC) || defined(OPENSSL_NO_ECDSA) || defined(OPENSSL_NO_ECDH)
|
|
|
38 # error OpenSSL was compiled without support for RSA, EC, ECDSA or ECDH
|
|
|
39 #endif
|
|
|
40
|
|
|
41
|
|
|
42 #include "Logging.h"
|
|
|
43 #include "OrthancException.h"
|
|
2145
|
44 #include "SystemToolbox.h"
|
|
2025
|
45
|
|
|
46 extern "C"
|
|
|
47 {
|
|
2145
|
48 # include <libp11/engine.h> // This is P11's "engine.h"
|
|
|
49 # include <libp11/libp11.h>
|
|
2025
|
50 }
|
|
|
51
|
|
|
52 #include <openssl/engine.h>
|
|
|
53
|
|
|
54
|
|
|
55 namespace Orthanc
|
|
|
56 {
|
|
|
57 namespace Pkcs11
|
|
|
58 {
|
|
|
59 static const char* PKCS11_ENGINE_ID = "pkcs11";
|
|
|
60 static const char* PKCS11_ENGINE_NAME = "PKCS#11 for Orthanc";
|
|
|
61 static const ENGINE_CMD_DEFN PKCS11_ENGINE_COMMANDS[] =
|
|
|
62 {
|
|
|
63 {
|
|
|
64 CMD_MODULE_PATH,
|
|
|
65 "MODULE_PATH",
|
|
|
66 "Specifies the path to the PKCS#11 module shared library",
|
|
|
67 ENGINE_CMD_FLAG_STRING
|
|
|
68 },
|
|
|
69 {
|
|
|
70 CMD_PIN,
|
|
|
71 "PIN",
|
|
|
72 "Specifies the pin code",
|
|
|
73 ENGINE_CMD_FLAG_STRING
|
|
|
74 },
|
|
|
75 {
|
|
|
76 CMD_VERBOSE,
|
|
|
77 "VERBOSE",
|
|
|
78 "Print additional details",
|
|
|
79 ENGINE_CMD_FLAG_NO_INPUT
|
|
|
80 },
|
|
|
81 {
|
|
|
82 CMD_LOAD_CERT_CTRL,
|
|
|
83 "LOAD_CERT_CTRL",
|
|
|
84 "Get the certificate from card",
|
|
|
85 ENGINE_CMD_FLAG_INTERNAL
|
|
|
86 },
|
|
|
87 {
|
|
|
88 0,
|
|
|
89 NULL,
|
|
|
90 NULL,
|
|
|
91 0
|
|
|
92 }
|
|
|
93 };
|
|
|
94
|
|
|
95
|
|
|
96 static bool pkcs11Initialized_ = false;
|
|
|
97 static ENGINE_CTX *context_ = NULL;
|
|
|
98
|
|
|
99 static int EngineInitialize(ENGINE* engine)
|
|
|
100 {
|
|
|
101 if (context_ == NULL)
|
|
|
102 {
|
|
|
103 return 0;
|
|
|
104 }
|
|
|
105 else
|
|
|
106 {
|
|
|
107 return pkcs11_init(context_);
|
|
|
108 }
|
|
|
109 }
|
|
|
110
|
|
|
111
|
|
|
112 static int EngineFinalize(ENGINE* engine)
|
|
|
113 {
|
|
|
114 if (context_ == NULL)
|
|
|
115 {
|
|
|
116 return 0;
|
|
|
117 }
|
|
|
118 else
|
|
|
119 {
|
|
|
120 return pkcs11_finish(context_);
|
|
|
121 }
|
|
|
122 }
|
|
|
123
|
|
|
124
|
|
|
125 static int EngineDestroy(ENGINE* engine)
|
|
|
126 {
|
|
|
127 return (context_ == NULL ? 0 : 1);
|
|
|
128 }
|
|
|
129
|
|
|
130
|
|
|
131 static int EngineControl(ENGINE *engine,
|
|
|
132 int command,
|
|
|
133 long i,
|
|
|
134 void *p,
|
|
|
135 void (*f) ())
|
|
|
136 {
|
|
|
137 if (context_ == NULL)
|
|
|
138 {
|
|
|
139 return 0;
|
|
|
140 }
|
|
|
141 else
|
|
|
142 {
|
|
|
143 return pkcs11_engine_ctrl(context_, command, i, p, f);
|
|
|
144 }
|
|
|
145 }
|
|
|
146
|
|
|
147
|
|
|
148 static EVP_PKEY *EngineLoadPublicKey(ENGINE *engine,
|
|
|
149 const char *s_key_id,
|
|
|
150 UI_METHOD *ui_method,
|
|
|
151 void *callback_data)
|
|
|
152 {
|
|
|
153 if (context_ == NULL)
|
|
|
154 {
|
|
|
155 return 0;
|
|
|
156 }
|
|
|
157 else
|
|
|
158 {
|
|
|
159 return pkcs11_load_public_key(context_, s_key_id, ui_method, callback_data);
|
|
|
160 }
|
|
|
161 }
|
|
|
162
|
|
|
163
|
|
|
164 static EVP_PKEY *EngineLoadPrivateKey(ENGINE *engine,
|
|
|
165 const char *s_key_id,
|
|
|
166 UI_METHOD *ui_method,
|
|
|
167 void *callback_data)
|
|
|
168 {
|
|
|
169 if (context_ == NULL)
|
|
|
170 {
|
|
|
171 return 0;
|
|
|
172 }
|
|
|
173 else
|
|
|
174 {
|
|
|
175 return pkcs11_load_private_key(context_, s_key_id, ui_method, callback_data);
|
|
|
176 }
|
|
|
177 }
|
|
|
178
|
|
|
179
|
|
|
180 static ENGINE* LoadEngine()
|
|
|
181 {
|
|
|
182 // This function creates an engine for PKCS#11 and inspired by
|
|
|
183 // the "ENGINE_load_dynamic" function from OpenSSL, in file
|
|
|
184 // "crypto/engine/eng_dyn.c"
|
|
|
185
|
|
|
186 ENGINE* engine = ENGINE_new();
|
|
|
187 if (!engine)
|
|
|
188 {
|
|
|
189 LOG(ERROR) << "Cannot create an OpenSSL engine for PKCS#11";
|
|
|
190 throw OrthancException(ErrorCode_InternalError);
|
|
|
191 }
|
|
|
192
|
|
|
193 // Create a PKCS#11 context using libp11
|
|
|
194 context_ = pkcs11_new();
|
|
|
195 if (!context_)
|
|
|
196 {
|
|
|
197 LOG(ERROR) << "Cannot create a libp11 context for PKCS#11";
|
|
|
198 ENGINE_free(engine);
|
|
|
199 throw OrthancException(ErrorCode_InternalError);
|
|
|
200 }
|
|
|
201
|
|
|
202 if (!ENGINE_set_id(engine, PKCS11_ENGINE_ID) ||
|
|
|
203 !ENGINE_set_name(engine, PKCS11_ENGINE_NAME) ||
|
|
|
204 !ENGINE_set_cmd_defns(engine, PKCS11_ENGINE_COMMANDS) ||
|
|
|
205
|
|
|
206 // Register the callback functions
|
|
|
207 !ENGINE_set_init_function(engine, EngineInitialize) ||
|
|
|
208 !ENGINE_set_finish_function(engine, EngineFinalize) ||
|
|
|
209 !ENGINE_set_destroy_function(engine, EngineDestroy) ||
|
|
|
210 !ENGINE_set_ctrl_function(engine, EngineControl) ||
|
|
|
211 !ENGINE_set_load_pubkey_function(engine, EngineLoadPublicKey) ||
|
|
|
212 !ENGINE_set_load_privkey_function(engine, EngineLoadPrivateKey) ||
|
|
|
213
|
|
|
214 !ENGINE_set_RSA(engine, PKCS11_get_rsa_method()) ||
|
|
|
215 !ENGINE_set_ECDSA(engine, PKCS11_get_ecdsa_method()) ||
|
|
|
216 !ENGINE_set_ECDH(engine, PKCS11_get_ecdh_method()) ||
|
|
|
217
|
|
|
218 #if OPENSSL_VERSION_NUMBER >= 0x10100002L
|
|
|
219 !ENGINE_set_EC(engine, PKCS11_get_ec_key_method()) ||
|
|
|
220 #endif
|
|
|
221
|
|
|
222 // Make OpenSSL know about our PKCS#11 engine
|
|
|
223 !ENGINE_add(engine))
|
|
|
224 {
|
|
|
225 LOG(ERROR) << "Cannot initialize the OpenSSL engine for PKCS#11";
|
|
|
226 pkcs11_finish(context_);
|
|
|
227 ENGINE_free(engine);
|
|
|
228 throw OrthancException(ErrorCode_InternalError);
|
|
|
229 }
|
|
|
230
|
|
|
231 // If the "ENGINE_add" worked, it gets a structural
|
|
|
232 // reference. We release our just-created reference.
|
|
|
233 ENGINE_free(engine);
|
|
|
234
|
|
|
235 return ENGINE_by_id(PKCS11_ENGINE_ID);
|
|
|
236 }
|
|
|
237
|
|
|
238
|
|
|
239 bool IsInitialized()
|
|
|
240 {
|
|
|
241 return pkcs11Initialized_;
|
|
|
242 }
|
|
|
243
|
|
|
244 const char* GetEngineIdentifier()
|
|
|
245 {
|
|
|
246 return PKCS11_ENGINE_ID;
|
|
|
247 }
|
|
|
248
|
|
|
249 void Initialize(const std::string& module,
|
|
|
250 const std::string& pin,
|
|
|
251 bool verbose)
|
|
|
252 {
|
|
|
253 if (pkcs11Initialized_)
|
|
|
254 {
|
|
|
255 LOG(ERROR) << "The PKCS#11 engine has already been initialized";
|
|
|
256 throw OrthancException(ErrorCode_BadSequenceOfCalls);
|
|
|
257 }
|
|
|
258
|
|
|
259 if (module.empty() ||
|
|
2145
|
260 !SystemToolbox::IsRegularFile(module))
|
|
2025
|
261 {
|
|
|
262 LOG(ERROR) << "The PKCS#11 module must be a path to one shared library (DLL or .so)";
|
|
|
263 throw OrthancException(ErrorCode_InexistentFile);
|
|
|
264 }
|
|
|
265
|
|
|
266 ENGINE* engine = LoadEngine();
|
|
|
267 if (!engine)
|
|
|
268 {
|
|
|
269 LOG(ERROR) << "Cannot create an OpenSSL engine for PKCS#11";
|
|
|
270 throw OrthancException(ErrorCode_InternalError);
|
|
|
271 }
|
|
|
272
|
|
|
273 if (!ENGINE_ctrl_cmd_string(engine, "MODULE_PATH", module.c_str(), 0))
|
|
|
274 {
|
|
|
275 LOG(ERROR) << "Cannot configure the OpenSSL dynamic engine for PKCS#11";
|
|
|
276 throw OrthancException(ErrorCode_InternalError);
|
|
|
277 }
|
|
|
278
|
|
|
279 if (verbose)
|
|
|
280 {
|
|
|
281 ENGINE_ctrl_cmd_string(engine, "VERBOSE", NULL, 0);
|
|
|
282 }
|
|
|
283
|
|
|
284 if (!pin.empty() &&
|
|
|
285 !ENGINE_ctrl_cmd_string(engine, "PIN", pin.c_str(), 0))
|
|
|
286 {
|
|
|
287 LOG(ERROR) << "Cannot set the PIN code for PKCS#11";
|
|
|
288 throw OrthancException(ErrorCode_InternalError);
|
|
|
289 }
|
|
|
290
|
|
|
291 if (!ENGINE_init(engine))
|
|
|
292 {
|
|
|
293 LOG(ERROR) << "Cannot initialize the OpenSSL dynamic engine for PKCS#11";
|
|
|
294 throw OrthancException(ErrorCode_InternalError);
|
|
|
295 }
|
|
|
296
|
|
|
297 LOG(WARNING) << "The PKCS#11 engine has been successfully initialized";
|
|
|
298 pkcs11Initialized_ = true;
|
|
|
299 }
|
|
|
300
|
|
|
301
|
|
|
302 void Finalize()
|
|
|
303 {
|
|
|
304 // Nothing to do, the unregistration of the engine is
|
|
|
305 // automatically done by OpenSSL
|
|
|
306 }
|
|
|
307 }
|
|
|
308 }
|
