Skip to content

Commit 69c54ec

Browse files
alonblalonbl
committed
softhsm2-util: support import certificate
The softhsm2-util already support importing keys, why not also import certificates? Useful for test scripts that require both keys and certificates. Add --import-type <type> parameter, depreciate the --aes parameter. Signed-off-by: Alon Bar-Lev <alon.barlev@gmail.com>
1 parent a181dae commit 69c54ec

File tree

5 files changed

+302
-29
lines changed

5 files changed

+302
-29
lines changed

‎src/bin/util/softhsm2-util-botan.cpp‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,9 @@
4747
#include <botan/bigint.h>
4848
#include <botan/der_enc.h>
4949
#include <botan/oids.h>
50+
#include <botan/der_enc.h>
51+
#include <botan/x509cert.h>
52+
#include <botan/pkix_types.h>
5053

5154
// Init Botan
5255
void crypto_init()
@@ -833,4 +836,53 @@ void crypto_free_eddsa(eddsa_key_material_t* keyMat)
833836
if (keyMat->bigA) free(keyMat->bigA);
834837
free(keyMat);
835838
}
839+
840+
// Import a key pair from given path
841+
int crypto_import_certificate
842+
(
843+
CK_SESSION_HANDLE hSession,
844+
char* filePath,
845+
char* label,
846+
char* objID,
847+
size_t objIDLen
848+
)
849+
{
850+
Botan::X509_Certificate cert(filePath);
851+
std::vector<uint8_t> blob = cert.BER_encode();
852+
std::vector<uint8_t> name = cert.subject_dn().BER_encode();
853+
std::vector<uint8_t> issuer = cert.issuer_dn().BER_encode();
854+
855+
std::vector<uint8_t> serial;
856+
Botan::DER_Encoder der(serial);
857+
der.encode(Botan::BigInt::decode(cert.serial_number()));
858+
859+
CK_OBJECT_CLASS certClass = CKO_CERTIFICATE;
860+
CK_CERTIFICATE_TYPE certType = CKC_X_509;
861+
CK_BBOOL ckTrue = CK_TRUE, ckFalse = CK_FALSE, ckToken = CK_TRUE;
862+
CK_ATTRIBUTE certTemplate[] = {
863+
{ CKA_CLASS, &certClass, sizeof(certClass) },
864+
{ CKA_CERTIFICATE_TYPE, &certType, sizeof(certType) },
865+
{ CKA_LABEL, label, strlen(label) },
866+
{ CKA_ID, objID, objIDLen },
867+
{ CKA_TOKEN, &ckToken, sizeof(ckToken) },
868+
{ CKA_PRIVATE, &ckFalse, sizeof(ckTrue) },
869+
{ CKA_VALUE, &*blob.begin(), (CK_ULONG)blob.size() },
870+
{ CKA_SUBJECT, &*name.begin(), (CK_ULONG)name.size() },
871+
{ CKA_ISSUER, &*issuer.begin(), (CK_ULONG)issuer.size() },
872+
{ CKA_SERIAL_NUMBER, &*serial.begin(), (CK_ULONG)serial.size() }
873+
};
874+
875+
CK_OBJECT_HANDLE hCert;
876+
CK_RV rv = p11->C_CreateObject(hSession, certTemplate, 10, &hCert);
877+
if (rv != CKR_OK)
878+
{
879+
fprintf(stderr, "ERROR: Could not save the certificate in the token.\n");
880+
return 1;
881+
}
882+
883+
printf("The certificate has been imported.\n");
884+
885+
return 0;
886+
}
887+
836888
#endif

‎src/bin/util/softhsm2-util-ossl.cpp‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -990,4 +990,85 @@ void crypto_free_eddsa(eddsa_key_material_t* keyMat)
990990
free(keyMat);
991991
}
992992

993+
// Import a key pair from given path
994+
int crypto_import_certificate
995+
(
996+
CK_SESSION_HANDLE hSession,
997+
char* filePath,
998+
char* label,
999+
char* objID,
1000+
size_t objIDLen
1001+
)
1002+
{
1003+
BIO* in = NULL;
1004+
1005+
if (!(in = BIO_new_file(filePath, "rb")))
1006+
{
1007+
fprintf(stderr, "ERROR: Could open the PKCS#8 file: %s\n", filePath);
1008+
return 1;
1009+
}
1010+
1011+
X509* x509 = PEM_read_bio_X509(in, NULL, NULL, NULL);
1012+
BIO_free(in);
1013+
1014+
if (!x509)
1015+
{
1016+
fprintf(stderr, "ERROR: Could not read the certificate file.\n");
1017+
return 1;
1018+
}
1019+
1020+
int blobSize = i2d_X509(x509, NULL);
1021+
CK_BYTE_PTR blob = (CK_BYTE_PTR)malloc(blobSize);
1022+
CK_BYTE_PTR p;
1023+
p = blob;
1024+
blobSize = i2d_X509(x509, &p);
1025+
1026+
int nameSize = i2d_X509_NAME(X509_get_subject_name(x509), NULL);
1027+
CK_BYTE_PTR name = (CK_BYTE_PTR)malloc(nameSize);
1028+
p = name;
1029+
nameSize = i2d_X509_NAME(X509_get_subject_name(x509), &p);
1030+
1031+
int issuerSize = i2d_X509_NAME(X509_get_issuer_name(x509), NULL);
1032+
CK_BYTE_PTR issuer = (CK_BYTE_PTR)malloc(issuerSize);
1033+
p = issuer;
1034+
issuerSize = i2d_X509_NAME(X509_get_issuer_name(x509), &p);
1035+
1036+
int serialSize = i2d_ASN1_INTEGER(X509_get_serialNumber(x509), NULL);
1037+
CK_BYTE_PTR serial = (CK_BYTE_PTR)malloc(serialSize);
1038+
p = serial;
1039+
serialSize = i2d_ASN1_INTEGER(X509_get_serialNumber(x509), &p);
1040+
1041+
CK_OBJECT_CLASS certClass = CKO_CERTIFICATE;
1042+
CK_CERTIFICATE_TYPE certType = CKC_X_509;
1043+
CK_BBOOL ckTrue = CK_TRUE, ckFalse = CK_FALSE, ckToken = CK_TRUE;
1044+
CK_ATTRIBUTE certTemplate[] = {
1045+
{ CKA_CLASS, &certClass, sizeof(certClass) },
1046+
{ CKA_CERTIFICATE_TYPE, &certType, sizeof(certType) },
1047+
{ CKA_LABEL, label, strlen(label) },
1048+
{ CKA_ID, objID, objIDLen },
1049+
{ CKA_TOKEN, &ckToken, sizeof(ckToken) },
1050+
{ CKA_PRIVATE, &ckFalse, sizeof(ckTrue) },
1051+
{ CKA_VALUE, blob, (CK_ULONG)blobSize },
1052+
{ CKA_SUBJECT, name, (CK_ULONG)nameSize },
1053+
{ CKA_ISSUER, issuer, (CK_ULONG)issuerSize },
1054+
{ CKA_SERIAL_NUMBER, serial, (CK_ULONG)serialSize }
1055+
};
1056+
1057+
CK_OBJECT_HANDLE hCert;
1058+
CK_RV rv = p11->C_CreateObject(hSession, certTemplate, 10, &hCert);
1059+
free(issuer);
1060+
free(name);
1061+
free(blob);
1062+
X509_free(x509);
1063+
if (rv != CKR_OK)
1064+
{
1065+
fprintf(stderr, "ERROR: Could not save the certificate in the token.\n");
1066+
return 1;
1067+
}
1068+
1069+
printf("The certificate has been imported.\n");
1070+
1071+
return 0;
1072+
}
1073+
9931074
#endif

‎src/bin/util/softhsm2-util.1‎

Lines changed: 21 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -20,27 +20,23 @@ softhsm2-util \- support tool for libsofthsm2
2020
.PP
2121
.B softhsm2-util \-\-import
2222
.I path
23+
.RB [ \-\-import-type
24+
.IR type ]
25+
\\
26+
.ti +0.7i
2327
.RB [ \-\-file-pin
2428
.IR PIN ]
2529
.B \-\-token
2630
.I label
31+
.RB [ \-\-pin
32+
.I PIN]
33+
.B [\-\-no\-public\-key]
2734
\\
2835
.ti +0.7i
29-
.RB [ \-\-pin
30-
.I PIN
31-
.B \-\-no\-public\-key]
3236
.B \-\-label
3337
.I text
3438
.B \-\-id
3539
.I hex
36-
.PP
37-
.B softhsm2-util \-\-import
38-
.I path
39-
.B \-\-aes
40-
.B \-\-token
41-
.I label
42-
\\
43-
.ti +0.7i
4440
.RB [ \-\-pin
4541
.I PIN]
4642
.B \-\-label
@@ -125,11 +121,11 @@ Any content in token will be erased.
125121
Show the help information.
126122
.TP
127123
.B \-\-import \fIpath\fR
128-
Import a key pair from the given
124+
Import an object from the given
129125
.IR path .
130-
The file must be in PKCS#8-format.
131126
.br
132127
Use with
128+
.BR \-\-import-type,
133129
.BR \-\-slot
134130
or
135131
.BR \-\-token
@@ -141,10 +137,6 @@ or
141137
.BR \-\-label ,
142138
and
143139
.BR \-\-id .
144-
.br
145-
Can also be used with
146-
.BR \-\-aes
147-
to use file as is and import it as AES.
148140
.TP
149141
.B \-\-init-token
150142
Initialize the token at a given slot, token label or token serial.
@@ -183,8 +175,20 @@ print the default PKCS#11 library.
183175
Show the version info.
184176
.SH OPTIONS
185177
.TP
178+
.B \-\-import-type \fItype\fR
179+
Import object type, \fItype\fR may be one of:
180+
.RS
181+
.IP keypair\ [default]
182+
The file must be in PKCS#8 PEM format.
183+
.IP aes
184+
The file must be in binary format.
185+
.IP cert
186+
The file must be in X509 PEM format.
187+
.RE
188+
.TP
186189
.B \-\-aes
187190
Used to tell import to use file as is and import it as AES.
191+
Deprecated, use \fI--import-type aes\fR instead.
188192
.TP
189193
.B \-\-file-pin \fIPIN\fR
190194
The

0 commit comments

Comments
 (0)