/*

 * Copyright(c) 2005-2006 Alon Bar-Lev.  All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer.

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in the

 *    documentation and/or other materials provided with the distribution.

 *

 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR

 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,

 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES(INCLUDING, BUT

 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

 *(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 */

#ifdef ENABLE_PKCS11

#include <string.h>

#include <unistd.h>

#include <sys/wait.h>

#include <errno.h>

#include <pkcs11-helper-1.0/pkcs11h-certificate.h>

#include <pkcs11-helper-1.0/pkcs11h-openssl.h>

#include "openssl/pem.h"

#include "misc.h"

#include "buffer.h"

#include "xmalloc.h"

#include "log.h"

#include "pkcs11.h"

static char *

ssh_from_x509(X509 *);

static time_t

mytime(void)

{

	return time(NULL);

}

static void

mysleep(const unsigned long usec)

{

	usleep((unsigned)usec);

}

static int

mygettimeofday(struct timeval *tv)

{

	return gettimeofday(tv, NULL);

}

static pkcs11h_engine_system_t s_pkcs11h_sys_engine = {

	xmalloc,

	xfree,

	mytime,

	mysleep,

	mygettimeofday

};

static LogLevel

pkcs11_msg_pkcs112openssh(const unsigned flags)

{

	LogLevel openssh_flags;

	switch (flags) {

	case PKCS11H_LOG_DEBUG2:

		openssh_flags = SYSLOG_LEVEL_DEBUG3;

		break;

	case PKCS11H_LOG_DEBUG1:

		openssh_flags = SYSLOG_LEVEL_DEBUG2;

		break;

	case PKCS11H_LOG_INFO:

		openssh_flags = SYSLOG_LEVEL_INFO;

		break;

	case PKCS11H_LOG_WARN:

		openssh_flags = SYSLOG_LEVEL_ERROR;

		break;

	case PKCS11H_LOG_ERROR:

		openssh_flags = SYSLOG_LEVEL_FATAL;

		break;

	default:

		openssh_flags = SYSLOG_LEVEL_FATAL;

		break;

	}

	return openssh_flags;

}

static unsigned

pkcs11_msg_openssh2pkcs11(const LogLevel flags)

{

	unsigned pkcs11_flags;

	switch (flags) {

	case SYSLOG_LEVEL_DEBUG3:

		pkcs11_flags = PKCS11H_LOG_DEBUG2;

		break;

	case SYSLOG_LEVEL_DEBUG2:

		pkcs11_flags = PKCS11H_LOG_DEBUG1;

		break;

	case SYSLOG_LEVEL_INFO:

		pkcs11_flags = PKCS11H_LOG_INFO;

		break;

	case SYSLOG_LEVEL_ERROR:

		pkcs11_flags = PKCS11H_LOG_WARN;

		break;

	case SYSLOG_LEVEL_FATAL:

		pkcs11_flags = PKCS11H_LOG_ERROR;

		break;

	default:

		pkcs11_flags = PKCS11H_LOG_ERROR;

		break;

	}

	return pkcs11_flags;

}

/* ARGSUSED */

static void

pkcs11_openssh_log(void *const global_data, unsigned flags,

	const char *const format, va_list args)

{

	do_log(pkcs11_msg_pkcs112openssh(flags), format, args);

}

/* ARGSUSED */

static PKCS11H_BOOL

pkcs11_ssh_token_prompt(void *const global_data,

	void *const user_data,

	const pkcs11h_token_id_t token, IN const unsigned retry)

{

	return ask_permission("Please insert token '%s'", token->display);

}

/* ARGSUSED */

static PKCS11H_BOOL

_pkcs11_ssh_pin_prompt(void *const global_data,

	void *const user_data, const pkcs11h_token_id_t token,

	const unsigned retry, char *const pin, const size_t pin_max)

{

	char prompt[1024];

	char *passphrase = NULL;

	PKCS11H_BOOL ret = FALSE;

	if (snprintf(prompt, sizeof(prompt), "Please enter PIN for token '%s': ",

		token->display) < 0)

		goto cleanup;

	passphrase = read_passphrase(prompt, RP_ALLOW_EOF);

	if (passphrase == NULL || strlen(passphrase) == 0 ||

		strlen(passphrase) > pin_max-1)

		goto cleanup;

	strlcpy(pin, passphrase, pin_max);

	bzero(passphrase, strlen(passphrase));

	ret = TRUE;

cleanup:

	if (passphrase != NULL)

		xfree(passphrase);

	return ret;

}

static int

pkcs11_convert_to_ssh_key(const pkcs11h_certificate_id_t certificate_id, Key **const key,

	char **const comment, const int pin_cache_period)

{

	pkcs11h_certificate_t certificate = NULL;

	pkcs11h_certificate_id_t certificate_id_new = NULL;

	pkcs11h_openssl_session_t openssl_session = NULL;

	Key *internal_key = NULL;

	char *internal_comment = NULL;

	RSA *rsa = NULL;

	size_t temp;

	CK_RV rv = CKR_OK;

	*key = NULL;

	*comment = NULL;

	debug3("PKCS#11: pkcs11_convert_to_ssh_key - entered - certificate=%p, "

		"key=%p, comment=%p, pin_cache_period=%d", (void *) certificate,

		(void *) key, (void *) comment, pin_cache_period);

	if ((rv = pkcs11h_certificate_create(certificate_id, NULL,

		PKCS11H_PROMPT_MASK_ALLOW_ALL, pin_cache_period,

		&certificate)) != CKR_OK) {

		error("PKCS#11: Cannot get certificate %ld-'%s'", rv,

			pkcs11h_getMessage(rv));

		goto cleanup;

	}

	/*

	 * New certificate_id is constructed from certificate

	 * blob so that it will contian the proper description.

	 */

	if ((rv = pkcs11h_certificate_getCertificateBlob(certificate,

				NULL, &temp)) != CKR_OK) {

		error("PKCS#11: Cannot get certificate blob %ld-'%s'", rv,

			pkcs11h_getMessage(rv));

		goto cleanup;

	}

	if ((rv = pkcs11h_certificate_getCertificateId(certificate,

		&certificate_id_new)) != CKR_OK) {

		error("PKCS#11: Cannot get certificate_id %ld-'%s'", rv,

			pkcs11h_getMessage(rv));

		goto cleanup;

	}

	if ((internal_comment = xstrdup(certificate_id_new->displayName)) == NULL) {

		error("PKCS#11: Memory allocation error");

		goto cleanup;

	}

	if ((openssl_session =

			pkcs11h_openssl_createSession(certificate)) == NULL) {

		error("PKCS#11: Cannot initialize openssl session");

		goto cleanup;

	}

	/*

	 * will be release by openssl_session

	 */

	certificate = NULL;

	if ((rsa = pkcs11h_openssl_session_getRSA(openssl_session)) == NULL) {

		error("PKCS#11: Unable get rsa object");

		goto cleanup;

	}

	internal_key = key_new_private(KEY_UNSPEC);

	internal_key->flags |= KEY_FLAG_EXT;

	internal_key->rsa = rsa;

	rsa = NULL;

	internal_key->type = KEY_RSA;

	*key = internal_key;

	internal_key = NULL;

	*comment = internal_comment;

	internal_comment = NULL;

cleanup:

	if (internal_key != NULL) {

		key_free(internal_key);

		internal_key = NULL;

	}

	if (internal_comment != NULL) {

		xfree(internal_comment);

		internal_comment = NULL;

	}

	if (rsa != NULL) {

		RSA_free (rsa);

		rsa = NULL;

	}

	if (openssl_session != NULL) {

		pkcs11h_openssl_freeSession(openssl_session);

		openssl_session = NULL;

	}

	if (certificate_id_new != NULL) {

		pkcs11h_certificate_freeCertificateId(certificate_id_new);

		certificate_id_new = NULL;

	}

	if (certificate != NULL) {

		pkcs11h_certificate_freeCertificate(certificate);

		certificate = NULL;

	}

	debug3("PKCS#11: pkcs11_convert_to_ssh_key - return *key=%p", (void *) *key);

	return *key != NULL;

}

int

pkcs11_initialize(const int protected_authentication, const int pin_cache_period)

{

	CK_RV rv = CKR_FUNCTION_FAILED;

	debug3("PKCS#11: pkcs11_initialize - entered protected_authentication=%d, "

		"pin_cache_period=%d", protected_authentication, pin_cache_period);

	if ((rv = pkcs11h_engine_setSystem(&s_pkcs11h_sys_engine)) != CKR_OK) {

		error("PKCS#11: Cannot set system engine %ld-'%s'", rv,

			pkcs11h_getMessage(rv));

		goto cleanup;

	}

	if ((rv = pkcs11h_initialize()) != CKR_OK) {

		error("PKCS#11: Cannot initialize %ld-'%s'", rv,

			pkcs11h_getMessage(rv));

		goto cleanup;

	}

	if ((rv = pkcs11h_setLogHook(pkcs11_openssh_log, NULL)) != CKR_OK) {

		error("PKCS#11: Cannot set hooks %ld-'%s'", rv,

			pkcs11h_getMessage(rv));

		goto cleanup;

	}

	pkcs11h_setLogLevel(pkcs11_msg_openssh2pkcs11(get_log_level ()));

	if ((rv = pkcs11h_setTokenPromptHook(pkcs11_ssh_token_prompt,

		NULL)) != CKR_OK) {

		error("PKCS#11: Cannot set hooks %ld-'%s'", rv,

			pkcs11h_getMessage(rv));

		goto cleanup;

	}

	if ((rv = pkcs11h_setPINPromptHook(_pkcs11_ssh_pin_prompt,

		NULL)) != CKR_OK) {

		error("PKCS#11: Cannot set hooks %ld-'%s'", rv,

			pkcs11h_getMessage(rv));

		goto cleanup;

	}

	if ((rv = pkcs11h_setProtectedAuthentication(protected_authentication)) !=

		CKR_OK) {

		error("PKCS#11: Cannot set protected authentication mode %ld-'%s'",

			rv, pkcs11h_getMessage(rv));

		goto cleanup;

	}

	if ((rv = pkcs11h_setPINCachePeriod(pin_cache_period)) != CKR_OK) {

		error("PKCS#11: Cannot set PIN cache period %ld-'%s'", rv,

			pkcs11h_getMessage(rv));

		goto cleanup;

	}

	rv = CKR_OK;

cleanup:

	debug3("PKCS#11: pkcs11_initialize - return rv=%ld-'%s'",

		rv, pkcs11h_getMessage(rv));

	return rv == CKR_OK;

}

void

pkcs11_terminate(void)

{

	debug3("PKCS#11: pkcs11_terminate - entered");

	pkcs11h_terminate();

	debug3("PKCS#11: pkcs11_terminate - return");

}

void

pkcs11_free_provider(pkcs11_provider *const provider) {

	if (provider != NULL) {

		if (provider->provider != NULL)

			xfree(provider->provider);

		xfree(provider);

	}

}

pkcs11_provider *

pkcs11_parse_provider(const char *const info)

{

	pkcs11_provider *provider = NULL;

	pkcs11_provider *ret = NULL;

	char *split[4];

	char *s = NULL;

	char *p;

	int i;

	if (info == NULL)

		goto cleanup;

	if ((provider = (pkcs11_provider *) xmalloc(sizeof(*provider))) == NULL)

		goto cleanup;

	memset(provider, 0, sizeof(*provider));

	memset(split, 0, sizeof(split));

	if ((s=xstrdup(info)) == NULL)

		goto cleanup;

	p = s;

	i=0;

	while(i<4 && p != NULL) {

		char *t;

		if ((t = strchr(p, ':')) != NULL)

			*t = '\x0';

		split[i++] = p;

		if (t != NULL)

			p = t+1;

		else

			p = NULL;

	}

	/*

	 * provider[:protected_authentication[:private_mode[:cert_is_private]]]

	 * string:1|0:hex:1|0

	 */

	if (split[0] != NULL)

		provider->provider = xstrdup(split[0]);

	if (split[1] != NULL)

		provider->protected_authentication = atoi(split[1]) != 0;

	if (split[2] != NULL)

		sscanf(split[2], "%x", &provider->private_mode);

	if (split[3] != NULL)

		provider->cert_is_private = atoi(split[3]) != 0;

	if (provider->provider == NULL || strlen(provider->provider) == 0)

		goto cleanup;

	ret = provider;

	provider = NULL;

cleanup:

	if (s != NULL)

		xfree(s);

	if (provider != NULL)

		pkcs11_free_provider(provider);

	return ret;

}

int

pkcs11_add_provider(const pkcs11_provider *const provider)

{

	CK_RV rv = CKR_OK;

	debug3("PKCS#11: pkcs11_add_provider - entered - provider='%s', "

		"protected_authentication=%d, private_mode='%08x', cert_is_private=%d",

		provider->provider, provider->protected_authentication ? 1 : 0,

		provider->private_mode,	provider->cert_is_private ? 1 : 0);

	debug("PKCS#11: Adding PKCS#11 provider '%s'", provider->provider);

	if (rv == CKR_OK &&

		(rv = pkcs11h_addProvider(provider->provider, provider->provider,

			provider->protected_authentication, provider->private_mode,

				PKCS11H_SLOTEVENT_METHOD_AUTO,

				0, provider->cert_is_private)) != CKR_OK) {

		error("PKCS#11: Cannot initialize provider '%s' %ld-'%s'",

			provider->provider, rv, pkcs11h_getMessage(rv));

	}

	debug3("PKCS#11: pkcs11_add_provider - return rv=%ld-'%s'",

		rv, pkcs11h_getMessage(rv));

	return rv == CKR_OK;

}

pkcs11_id *

pkcs11_id_new(void)

{

	pkcs11_id *id = (pkcs11_id *) xmalloc(sizeof(*id));

	if (id != NULL) {

		memset(id, 0, sizeof(*id));

		id->pin_cache_period = PKCS11H_PIN_CACHE_INFINITE;

	}

	return id;

}

void

pkcs11_id_free(pkcs11_id *const id)

{

	if (id != NULL)

		xfree(id);

}

int

pkcs11_get_key(const pkcs11_id *const id, Key **const key,

	char **const comment)

{

	pkcs11h_certificate_id_t certificate_id = NULL;

	CK_RV rv = CKR_OK;

	debug3("PKCS#11: pkcs11_get_key - entered - id=%p, key=%p, "

		"comment=%p", (const void *) id, (void *) key, (void *) comment);

	debug3("PKCS#11: pkcs11_get_key - id - id=%s, "

		"pin_cache_period=%d, cert_file=%s",

		id->id, id->pin_cache_period, id->cert_file);

	if (pkcs11h_certificate_deserializeCertificateId(&certificate_id, id->id)) {

		error("PKCS#11: Cannot deserialize id %ld-'%s'", rv,

			pkcs11h_getMessage(rv));

		goto cleanup;

	}

	if (id->cert_file != NULL && id->cert_file[0] != '\x0') {

		X509 *x509 = NULL;

		unsigned char *p = NULL;

		unsigned char *certificate_blob = NULL;

		size_t certificate_blob_size = 0;

		int size;

		FILE *fp = NULL;

		if ((fp = fopen(id->cert_file, "r")) == NULL) {

			error("PKCS#11: Cannot open file '%s'", id->cert_file);

			goto cleanup1;

		}

		if (!PEM_read_X509(fp, &x509, NULL, 0)) {

			x509 = NULL;

			error("PKCS#11: Cannot read PEM from file '%s'", id->cert_file);

			goto cleanup1;

		}

		if ((size = i2d_X509(x509, NULL)) < 0) {

			error("PKCS#11: Cannot read decode certificate");

			goto cleanup1;

		}

		certificate_blob_size = (size_t)size;

		if ((certificate_blob =

				(unsigned char *) xmalloc(certificate_blob_size)) == NULL) {

			error("PKCS#11: Cannot allocate memory");

			goto cleanup1;

		}

		/*

		 * i2d_X509 increments p!!!

		 */

		p = certificate_blob;

		if ((size = i2d_X509(x509, &p)) < 0) {

			error("PKCS#11: Cannot read decode certificate");

			goto cleanup1;

		}

		certificate_blob_size = (size_t)size;

		if (pkcs11h_certificate_setCertificateIdCertificateBlob

			(certificate_id, certificate_blob, certificate_blob_size)

			!= CKR_OK) {

			error("PKCS#11: Cannot set certificate blob %ld-'%s'", rv,

				pkcs11h_getMessage(rv));

			goto cleanup1;

		}

	cleanup1:

		if (x509 != NULL) {

			X509_free(x509);

			x509 = NULL;

		}

		if (certificate_blob != NULL) {

			xfree(certificate_blob);

			certificate_blob = NULL;

		}

		if (fp != NULL) {

			fclose(fp);

			fp = NULL;

		}

	}

	pkcs11_convert_to_ssh_key(certificate_id, key, comment, id->pin_cache_period);

cleanup:

	if (certificate_id != NULL) {

		pkcs11h_certificate_freeCertificateId(certificate_id);

		certificate_id = NULL;

	}

	debug3("PKCS#11: pkcs11_get_key - return rv=%ld, *key=%p", rv, ( void *) *key);

	return *key != NULL;

}

int

pkcs11_get_keys(Key ***const keys, char ***const comments)

{

#define PKCS11_MAX_KEYS 10

	Key **internal_keys = NULL;

	char **internal_comments = NULL;

	pkcs11h_certificate_id_list_t user_certificates = NULL;

	pkcs11h_certificate_id_list_t current = NULL;

	CK_RV rv = CKR_FUNCTION_FAILED;

	int i;

	debug3("PKCS#11: pkcs11_get_keys - entered - sshkey=%p, "

		"comment=%p",

		(void *) keys, (void *) comments);

	*keys = NULL;

	*comments = NULL;

	if((internal_keys = (Key **) xcalloc(sizeof(*internal_keys), PKCS11_MAX_KEYS+1)) == NULL) {

		rv = CKR_HOST_MEMORY;

		goto cleanup;

	}

	if((internal_comments = (char **) xcalloc(sizeof(*internal_comments), PKCS11_MAX_KEYS+1)) == NULL) {

		rv = CKR_HOST_MEMORY;

		goto cleanup;

	}

	memset(internal_keys, 0, (PKCS11_MAX_KEYS+1)*sizeof(*internal_keys));

	memset(internal_comments, 0, (PKCS11_MAX_KEYS+1)*sizeof(*internal_comments));

	if ((rv = pkcs11h_certificate_enumCertificateIds(

		PKCS11H_ENUM_METHOD_CACHE_EXIST, NULL,

		PKCS11H_PROMPT_MASK_ALLOW_ALL, NULL,

		&user_certificates)) != CKR_OK) {

		error("PKCS#11: Cannot enumerate certificates %ld-'%s'", rv,

			pkcs11h_getMessage(rv));

		goto cleanup;

	}

	i = 0;

	for (current = user_certificates; current != NULL && i<PKCS11_MAX_KEYS;

		current = current->next) {

		if (pkcs11_convert_to_ssh_key(current->certificate_id, &internal_keys[i],

			&internal_comments[i], PKCS11H_PIN_CACHE_INFINITE)) {

			i++;

		}

	}

	*keys = internal_keys;

	internal_keys = NULL;

	*comments = internal_comments;

	internal_comments = NULL;

	rv = CKR_OK;

cleanup:

	if (user_certificates != NULL) {

		pkcs11h_certificate_freeCertificateIdList(user_certificates);

		user_certificates = NULL;

	}

	if (internal_keys != NULL) {

		Key **t = internal_keys;

		while (*t != NULL) {

			key_free(*t);

			t++;

		}

		xfree(internal_keys);

	}

	if (internal_comments != NULL) {

		char **t = internal_comments;

		while (*t != NULL) {

			xfree(*t);

			t++;

		}

		xfree(internal_comments);

	}

	debug3("PKCS#11: pkcs11_get_keys - return rv=%ld, *keys=%p", rv, (void *) *keys);

	return *keys != NULL;

#undef PKCS11_MAX_KEYS

}

void

pkcs11_show_ids(void)

{

	pkcs11h_certificate_id_list_t user_certificates = NULL;

	pkcs11h_certificate_id_list_t current = NULL;

	CK_RV rv = CKR_FUNCTION_FAILED;

	if ((rv = pkcs11h_certificate_enumCertificateIds(

		PKCS11H_ENUM_METHOD_CACHE_EXIST, NULL,

		PKCS11H_PROMPT_MASK_ALLOW_ALL, NULL,

		&user_certificates)) != CKR_OK) {

		error("PKCS#11: Cannot enumerate certificates %ld-'%s'", rv,

			pkcs11h_getMessage(rv));

		goto cleanup;

	}

	for (current = user_certificates; current != NULL;

		current = current->next) {

		pkcs11h_certificate_t certificate = NULL;

		X509 *x509 = NULL;

		BIO *bio = NULL;

		char dn[1024] = { 0 };

		char serial[1024] = { 0 };

		char *ser = NULL;

		char *ssh_key = NULL;

		size_t ser_len = 0;

		int n;

		if ((rv = pkcs11h_certificate_serializeCertificateId(NULL,

			&ser_len, current->certificate_id)) != CKR_OK) {

			error("PKCS#11: Cannot serialize certificate id "

				"certificates %ld-'%s'", rv,

				pkcs11h_getMessage(rv));

			goto cleanup1;

		}

		if ((ser = (char *) xmalloc(ser_len)) == NULL) {

			error("PKCS#11: Cannot allocate memory");

			goto cleanup1;

		}

		if ((rv = pkcs11h_certificate_serializeCertificateId(ser,

			&ser_len, current->certificate_id)) != CKR_OK) {

			error("PKCS#11: Cannot serialize certificate "

				"id certificates %ld-'%s'",

				rv, pkcs11h_getMessage(rv));

			goto cleanup1;

		}

		if ((rv = pkcs11h_certificate_create(current->certificate_id,

			NULL, PKCS11H_PROMPT_MASK_ALLOW_ALL,

			PKCS11H_PIN_CACHE_INFINITE, &certificate)) != CKR_OK) {

			error("PKCS#11: Cannot create certificate %ld-'%s'", rv,

				pkcs11h_getMessage(rv));

			goto cleanup1;

		}

		if ((x509 = pkcs11h_openssl_getX509(certificate)) == NULL) {

			error("PKCS#11: Cannot get X509");

			goto cleanup1;

		}

		X509_NAME_oneline(X509_get_subject_name(x509), dn, sizeof(dn));

		if ((bio = BIO_new(BIO_s_mem())) == NULL) {

			error("PKCS#11: Cannot create BIO");

			goto cleanup1;

		}

		i2a_ASN1_INTEGER(bio, X509_get_serialNumber(x509));

		n = BIO_read(bio, serial, sizeof(serial) - 1);

		if (n < 0)

			serial[0] = '\x0';

		else

			serial[n] = 0;

		printf(("\n"

				"********************************************\n"

				"IDENTITY:\n"

				"       DN:             %s\n"

				"       Serial:         %s\n"

				"       Serialized id:  %s\n"

				"\n" "       Certificate:\n"), dn, serial, ser);

		PEM_write_X509(stdout, x509);

		if ((ssh_key = ssh_from_x509(x509)) != NULL) {

			printf(("\n" "        SSH:\n" "%s\n"), ssh_key);

			xfree(ssh_key);

		}

	cleanup1:

		if (x509 != NULL) {

			X509_free(x509);

			x509 = NULL;

		}

		if (bio != NULL) {

			BIO_free_all(bio);

			bio = NULL;

		}

		if (certificate != NULL) {

			pkcs11h_certificate_freeCertificate(certificate);

			certificate = NULL;

		}

		if (ser != NULL) {

			xfree(ser);

			ser = NULL;

		}

	}

cleanup:

	if (user_certificates != NULL) {

		pkcs11h_certificate_freeCertificateIdList(user_certificates);

		user_certificates = NULL;

	}

}

static char *

ssh_from_x509(X509 * x509)

{

	Buffer b;

	EVP_PKEY *pubkey = NULL;

	BIO *bio = NULL, *bio2 = NULL, *bio64 = NULL;

	char *ret = NULL;

	size_t retsize = 0;

	char *p;

	int n;

	const char *keyname = "ssh-rsa";

	int ok = 0;

	buffer_init(&b);

	if ((pubkey = X509_get_pubkey(x509)) == NULL)

		goto cleanup;

	if ((bio64 = BIO_new(BIO_f_base64())) == NULL)

		goto cleanup;

	if ((bio = BIO_new(BIO_s_mem())) == NULL)

		goto cleanup;

	if ((bio2 = BIO_push(bio64, bio)) == NULL)

		goto cleanup;

	if (pubkey->type != EVP_PKEY_RSA)

		goto cleanup;

	buffer_put_cstring(&b, keyname);

	buffer_put_bignum2(&b, pubkey->pkey.rsa->e);

	buffer_put_bignum2(&b, pubkey->pkey.rsa->n);

	if (BIO_write(bio2, buffer_ptr(&b), buffer_len(&b)) == -1)

		goto cleanup;

	if (BIO_flush(bio2) == -1)

		goto cleanup;

	if ((n = BIO_read(bio, NULL, 10*1024)) == -1)

		goto cleanup;

	retsize = n+1+strlen(keyname)+1;	/* including null terminate and keyname prefix */

	if ((ret = (char *) xmalloc(retsize)) == NULL)

		goto cleanup;

	snprintf (ret, retsize, "%s ", keyname);

	if ((n = BIO_read(bio, ret+strlen(ret), n)) == -1)

		goto cleanup;

	ret[retsize-1] = '\0';

	while ((p = strchr(ret, '\n')) != NULL)

		memmove(p, p + 1, strlen(p));

	while ((p = strchr(ret, '\r')) != NULL)

		memmove(p, p + 1, strlen(p));

	ok = 1;

cleanup:

	if (bio != NULL) {

		BIO_free_all(bio);

		bio = NULL;

	}

	if (pubkey != NULL) {

		EVP_PKEY_free(pubkey);

		pubkey = NULL;

	}

	buffer_free(&b);

	if (!ok) {

		if (ret != NULL) {

			xfree(ret);

			ret = NULL;

		}

	}

	return ret;

}

#endif /* ENABLE_PKCS11 */

/*

 * Copyright (c) 2005-2006 Alon Bar-Lev.  All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer.

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in the

 *    documentation and/or other materials provided with the distribution.

 *

 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR

 * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES

 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.

 * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,

 * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,

 * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY

 * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

 * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

 * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 */

#ifndef SSH_PKCS11_H

#define SSH_PKCS11_H

#ifdef ENABLE_PKCS11

#include "key.h"

typedef struct {

	char *provider;

	int protected_authentication;

	unsigned private_mode;

	int cert_is_private;

} pkcs11_provider;

typedef struct {

	char *id;

	int pin_cache_period;

	char *cert_file;

} pkcs11_id;

int

pkcs11_initialize(const int, const int);

void

pkcs11_terminate(void);

void

pkcs11_free_provider(pkcs11_provider *const);

pkcs11_provider *

pkcs11_parse_provider(const char *const);

int

pkcs11_add_provider(const pkcs11_provider *const);

pkcs11_id *

pkcs11_id_new(void);

void

pkcs11_id_free(pkcs11_id *const);

int

pkcs11_get_key(const pkcs11_id *const, Key **const, char **const);

int

pkcs11_get_keys(Key ***const, char ***const);

void

pkcs11_show_ids(void);

#endif /* ENABLE_PKCS11 */

#endif /* OPENSSH_PKCS11_H */