Skip to content

Commit cc9d83f

Browse files
alonblalonbl
committed
softhsm2-util: support import certificate
The softhsm2-util already support importing keys, why not also import certificates? Useful for test scripts that require both keys and certificates. Add --import-type <type> parameter, depreciate the --aes parameter. Signed-off-by: Alon Bar-Lev <[email protected]>
1 parent a181dae commit cc9d83f

5 files changed

+300
-29
lines changed

‎src/bin/util/softhsm2-util-botan.cpp

+51
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,9 @@
4747
#include <botan/bigint.h>
4848
#include <botan/der_enc.h>
4949
#include <botan/oids.h>
50+
#include <botan/der_enc.h>
51+
#include <botan/x509cert.h>
52+
#include <botan/x509_dn.h>
5053

5154
// Init Botan
5255
void crypto_init()
@@ -207,6 +210,53 @@ int crypto_import_key_pair
207210
return result;
208211
}
209212

213+
int crypto_import_certificate
214+
(
215+
CK_SESSION_HANDLE hSession,
216+
char* filePath,
217+
char* label,
218+
char* objID,
219+
size_t objIDLen
220+
)
221+
{
222+
Botan::X509_Certificate cert(filePath);
223+
std::vector<uint8_t> blob = cert.BER_encode();
224+
std::vector<uint8_t> name = cert.subject_dn().BER_encode();
225+
std::vector<uint8_t> issuer = cert.issuer_dn().BER_encode();
226+
227+
std::vector<uint8_t> serial;
228+
Botan::DER_Encoder der(serial);
229+
der.encode(Botan::BigInt::decode(cert.serial_number()));
230+
231+
CK_OBJECT_CLASS certClass = CKO_CERTIFICATE;
232+
CK_CERTIFICATE_TYPE certType = CKC_X_509;
233+
CK_BBOOL ckTrue = CK_TRUE, ckFalse = CK_FALSE, ckToken = CK_TRUE;
234+
CK_ATTRIBUTE certTemplate[] = {
235+
{ CKA_CLASS, &certClass, sizeof(certClass) },
236+
{ CKA_CERTIFICATE_TYPE, &certType, sizeof(certType) },
237+
{ CKA_LABEL, label, strlen(label) },
238+
{ CKA_ID, objID, objIDLen },
239+
{ CKA_TOKEN, &ckToken, sizeof(ckToken) },
240+
{ CKA_PRIVATE, &ckFalse, sizeof(ckTrue) },
241+
{ CKA_VALUE, &*blob.begin(), (CK_ULONG)blob.size() },
242+
{ CKA_SUBJECT, &*name.begin(), (CK_ULONG)name.size() },
243+
{ CKA_ISSUER, &*issuer.begin(), (CK_ULONG)issuer.size() },
244+
{ CKA_SERIAL_NUMBER, &*serial.begin(), (CK_ULONG)serial.size() }
245+
};
246+
247+
CK_OBJECT_HANDLE hCert;
248+
CK_RV rv = p11->C_CreateObject(hSession, certTemplate, 10, &hCert);
249+
if (rv != CKR_OK)
250+
{
251+
fprintf(stderr, "ERROR: Could not save the certificate in the token.\n");
252+
return 1;
253+
}
254+
255+
printf("The certificate has been imported.\n");
256+
257+
return 0;
258+
}
259+
210260
// Read the key from file
211261
Botan::Private_Key* crypto_read_file(char* filePath, char* filePIN)
212262
{
@@ -833,4 +883,5 @@ void crypto_free_eddsa(eddsa_key_material_t* keyMat)
833883
if (keyMat->bigA) free(keyMat->bigA);
834884
free(keyMat);
835885
}
886+
836887
#endif

‎src/bin/util/softhsm2-util-ossl.cpp

+80
Original file line numberDiff line numberDiff line change
@@ -216,6 +216,86 @@ int crypto_import_key_pair
216216
return result;
217217
}
218218

219+
int crypto_import_certificate
220+
(
221+
CK_SESSION_HANDLE hSession,
222+
char* filePath,
223+
char* label,
224+
char* objID,
225+
size_t objIDLen
226+
)
227+
{
228+
BIO* in = NULL;
229+
230+
if (!(in = BIO_new_file(filePath, "rb")))
231+
{
232+
fprintf(stderr, "ERROR: Could open the PKCS#8 file: %s\n", filePath);
233+
return 1;
234+
}
235+
236+
X509* x509 = PEM_read_bio_X509(in, NULL, NULL, NULL);
237+
BIO_free(in);
238+
239+
if (!x509)
240+
{
241+
fprintf(stderr, "ERROR: Could not read the certificate file.\n");
242+
return 1;
243+
}
244+
245+
int blobSize = i2d_X509(x509, NULL);
246+
CK_BYTE_PTR blob = (CK_BYTE_PTR)malloc(blobSize);
247+
CK_BYTE_PTR p;
248+
p = blob;
249+
blobSize = i2d_X509(x509, &p);
250+
251+
int nameSize = i2d_X509_NAME(X509_get_subject_name(x509), NULL);
252+
CK_BYTE_PTR name = (CK_BYTE_PTR)malloc(nameSize);
253+
p = name;
254+
nameSize = i2d_X509_NAME(X509_get_subject_name(x509), &p);
255+
256+
int issuerSize = i2d_X509_NAME(X509_get_issuer_name(x509), NULL);
257+
CK_BYTE_PTR issuer = (CK_BYTE_PTR)malloc(issuerSize);
258+
p = issuer;
259+
issuerSize = i2d_X509_NAME(X509_get_issuer_name(x509), &p);
260+
261+
int serialSize = i2d_ASN1_INTEGER(X509_get_serialNumber(x509), NULL);
262+
CK_BYTE_PTR serial = (CK_BYTE_PTR)malloc(serialSize);
263+
p = serial;
264+
serialSize = i2d_ASN1_INTEGER(X509_get_serialNumber(x509), &p);
265+
266+
CK_OBJECT_CLASS certClass = CKO_CERTIFICATE;
267+
CK_CERTIFICATE_TYPE certType = CKC_X_509;
268+
CK_BBOOL ckTrue = CK_TRUE, ckFalse = CK_FALSE, ckToken = CK_TRUE;
269+
CK_ATTRIBUTE certTemplate[] = {
270+
{ CKA_CLASS, &certClass, sizeof(certClass) },
271+
{ CKA_CERTIFICATE_TYPE, &certType, sizeof(certType) },
272+
{ CKA_LABEL, label, strlen(label) },
273+
{ CKA_ID, objID, objIDLen },
274+
{ CKA_TOKEN, &ckToken, sizeof(ckToken) },
275+
{ CKA_PRIVATE, &ckFalse, sizeof(ckTrue) },
276+
{ CKA_VALUE, blob, (CK_ULONG)blobSize },
277+
{ CKA_SUBJECT, name, (CK_ULONG)nameSize },
278+
{ CKA_ISSUER, issuer, (CK_ULONG)issuerSize },
279+
{ CKA_SERIAL_NUMBER, serial, (CK_ULONG)serialSize }
280+
};
281+
282+
CK_OBJECT_HANDLE hCert;
283+
CK_RV rv = p11->C_CreateObject(hSession, certTemplate, 10, &hCert);
284+
free(issuer);
285+
free(name);
286+
free(blob);
287+
X509_free(x509);
288+
if (rv != CKR_OK)
289+
{
290+
fprintf(stderr, "ERROR: Could not save the certificate in the token.\n");
291+
return 1;
292+
}
293+
294+
printf("The certificate has been imported.\n");
295+
296+
return 0;
297+
}
298+
219299
// Read the key from file
220300
EVP_PKEY* crypto_read_file(char* filePath, char* filePIN)
221301
{

‎src/bin/util/softhsm2-util.1

+21-17
Original file line numberDiff line numberDiff line change
@@ -20,27 +20,23 @@ softhsm2-util \- support tool for libsofthsm2
2020
.PP
2121
.B softhsm2-util \-\-import
2222
.I path
23+
.RB [ \-\-import-type
24+
.IR type ]
25+
\\
26+
.ti +0.7i
2327
.RB [ \-\-file-pin
2428
.IR PIN ]
2529
.B \-\-token
2630
.I label
31+
.RB [ \-\-pin
32+
.I PIN]
33+
.B [\-\-no\-public\-key]
2734
\\
2835
.ti +0.7i
29-
.RB [ \-\-pin
30-
.I PIN
31-
.B \-\-no\-public\-key]
3236
.B \-\-label
3337
.I text
3438
.B \-\-id
3539
.I hex
36-
.PP
37-
.B softhsm2-util \-\-import
38-
.I path
39-
.B \-\-aes
40-
.B \-\-token
41-
.I label
42-
\\
43-
.ti +0.7i
4440
.RB [ \-\-pin
4541
.I PIN]
4642
.B \-\-label
@@ -125,11 +121,11 @@ Any content in token will be erased.
125121
Show the help information.
126122
.TP
127123
.B \-\-import \fIpath\fR
128-
Import a key pair from the given
124+
Import an object from the given
129125
.IR path .
130-
The file must be in PKCS#8-format.
131126
.br
132127
Use with
128+
.BR \-\-import-type,
133129
.BR \-\-slot
134130
or
135131
.BR \-\-token
@@ -141,10 +137,6 @@ or
141137
.BR \-\-label ,
142138
and
143139
.BR \-\-id .
144-
.br
145-
Can also be used with
146-
.BR \-\-aes
147-
to use file as is and import it as AES.
148140
.TP
149141
.B \-\-init-token
150142
Initialize the token at a given slot, token label or token serial.
@@ -183,8 +175,20 @@ print the default PKCS#11 library.
183175
Show the version info.
184176
.SH OPTIONS
185177
.TP
178+
.B \-\-import-type \fItype\fR
179+
Import object type, \fItype\fR may be one of:
180+
.RS
181+
.IP keypair\ [default]
182+
The file must be in PKCS#8 PEM format.
183+
.IP aes
184+
The file must be in binary format.
185+
.IP cert
186+
The file must be in X509 PEM format.
187+
.RE
188+
.TP
186189
.B \-\-aes
187190
Used to tell import to use file as is and import it as AES.
191+
Deprecated, use \fI--import-type aes\fR instead.
188192
.TP
189193
.B \-\-file-pin \fIPIN\fR
190194
The

0 commit comments

Comments
 (0)