include/gnutls/pkcs11.h

0001 /*
0002  * Copyright (C) 2010-2012 Free Software Foundation, Inc.
0003  * Copyright (C) 2016-2018 Red Hat, Inc.
0004  *
0005  * Author: Nikos Mavrogiannopoulos
0006  *
0007  * This file is part of GnuTLS.
0008  *
0009  * The GnuTLS is free software; you can redistribute it and/or
0010  * modify it under the terms of the GNU Lesser General Public License
0011  * as published by the Free Software Foundation; either version 2.1 of
0012  * the License, or (at your option) any later version.
0013  *
0014  * This library is distributed in the hope that it will be useful, but
0015  * WITHOUT ANY WARRANTY; without even the implied warranty of
0016  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
0017  * Lesser General Public License for more details.
0018  *
0019  * You should have received a copy of the GNU Lesser General Public License
0020  * along with this program.  If not, see <https://www.gnu.org/licenses/>
0021  *
0022  */
0023
0024 #ifndef GNUTLS_PKCS11_H
0025 #define GNUTLS_PKCS11_H
0026
0027 #include <stdarg.h>
0028 #include <gnutls/gnutls.h>
0029 #include <gnutls/x509.h>
0030
0031 #ifdef __cplusplus
0032 extern "C" {
0033 #endif
0034
0035 #define GNUTLS_PKCS11_MAX_PIN_LEN 256
0036
0037 /**
0038  * gnutls_pkcs11_token_callback_t:
0039  * @userdata: user-controlled data from gnutls_pkcs11_set_token_function().
0040  * @label: token label.
0041  * @retry: retry counter, initially 0.
0042  *
0043  * Token callback function. The callback will be used to ask the user
0044  * to re-insert the token with given (null terminated) label.  The
0045  * callback should return zero if token has been inserted by user and
0046  * a negative error code otherwise.  It might be called multiple times
0047  * if the token is not detected and the retry counter will be
0048  * increased.
0049  *
0050  * Returns: %GNUTLS_E_SUCCESS (0) on success or a negative error code
0051  * on error.
0052  *
0053  * Since: 2.12.0
0054  **/
0055 typedef int (*gnutls_pkcs11_token_callback_t)(void *const userdata,
0056                           const char *const label,
0057                           unsigned retry);
0058
0059 struct gnutls_pkcs11_obj_st;
0060 typedef struct gnutls_pkcs11_obj_st *gnutls_pkcs11_obj_t;
0061
0062 #define GNUTLS_PKCS11_FLAG_MANUAL 0 /* Manual loading of libraries */
0063 #define GNUTLS_PKCS11_FLAG_AUTO \
0064     1 /* Automatically load libraries by reading /etc/gnutls/pkcs11.conf */
0065 #define GNUTLS_PKCS11_FLAG_AUTO_TRUSTED \
0066     (1                              \
0067      << 1) /* Automatically load trusted libraries by reading /etc/gnutls/pkcs11.conf */
0068
0069 /* pkcs11.conf format:
0070  * load = /lib/xxx-pkcs11.so
0071  * load = /lib/yyy-pkcs11.so
0072  */
0073
0074 int gnutls_pkcs11_init(unsigned int flags, const char *deprecated_config_file);
0075 int gnutls_pkcs11_reinit(void);
0076 void gnutls_pkcs11_deinit(void);
0077 void gnutls_pkcs11_set_token_function(gnutls_pkcs11_token_callback_t fn,
0078                       void *userdata);
0079
0080 void gnutls_pkcs11_set_pin_function(gnutls_pin_callback_t fn, void *userdata);
0081
0082 gnutls_pin_callback_t gnutls_pkcs11_get_pin_function(void **userdata);
0083
0084 int gnutls_pkcs11_add_provider(const char *name, const char *params);
0085 int gnutls_pkcs11_obj_init(gnutls_pkcs11_obj_t *obj);
0086 void gnutls_pkcs11_obj_set_pin_function(gnutls_pkcs11_obj_t obj,
0087                     gnutls_pin_callback_t fn,
0088                     void *userdata);
0089
0090 /**
0091  * gnutls_pkcs11_obj_flags:
0092  * @GNUTLS_PKCS11_OBJ_FLAG_LOGIN: Force login in the token for the operation (seek+store).
0093  * @GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED: object marked as trusted (seek+store).
0094  * @GNUTLS_PKCS11_OBJ_FLAG_MARK_SENSITIVE: object is explicitly marked as sensitive -unexportable (store).
0095  * @GNUTLS_PKCS11_OBJ_FLAG_LOGIN_SO: force login as a security officer in the token for the operation (seek+store).
0096  * @GNUTLS_PKCS11_OBJ_FLAG_MARK_PRIVATE: marked as private -requires PIN to access (store).
0097  * @GNUTLS_PKCS11_OBJ_FLAG_MARK_NOT_PRIVATE: marked as not private (store).
0098  * @GNUTLS_PKCS11_OBJ_FLAG_RETRIEVE_ANY: When retrieving an object, do not set any requirements (store).
0099  * @GNUTLS_PKCS11_OBJ_FLAG_RETRIEVE_TRUSTED: When retrieving an object, only retrieve the marked as trusted (alias to %GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED).
0100  *   In gnutls_pkcs11_crt_is_known() it implies %GNUTLS_PKCS11_OBJ_FLAG_RETRIEVE_COMPARE if %GNUTLS_PKCS11_OBJ_FLAG_COMPARE_KEY is not given.
0101  * @GNUTLS_PKCS11_OBJ_FLAG_MARK_DISTRUSTED: When writing an object, mark it as distrusted (store).
0102  * @GNUTLS_PKCS11_OBJ_FLAG_RETRIEVE_DISTRUSTED: When retrieving an object, only retrieve the marked as distrusted (seek).
0103  * @GNUTLS_PKCS11_OBJ_FLAG_COMPARE: When checking an object's presence, fully compare it before returning any result (seek).
0104  * @GNUTLS_PKCS11_OBJ_FLAG_COMPARE_KEY: When checking an object's presence, compare the key before returning any result (seek).
0105  * @GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE: The object must be present in a marked as trusted module (seek).
0106  * @GNUTLS_PKCS11_OBJ_FLAG_MARK_CA: Mark the object as a CA (seek+store).
0107  * @GNUTLS_PKCS11_OBJ_FLAG_MARK_KEY_WRAP: Mark the generated key pair as wrapping and unwrapping keys (store).
0108  * @GNUTLS_PKCS11_OBJ_FLAG_OVERWRITE_TRUSTMOD_EXT: When an issuer is requested, override its extensions with the ones present in the trust module (seek).
0109  * @GNUTLS_PKCS11_OBJ_FLAG_MARK_ALWAYS_AUTH: Mark the key pair as requiring authentication (pin entry) before every operation (seek+store).
0110  * @GNUTLS_PKCS11_OBJ_FLAG_MARK_EXTRACTABLE: Mark the key pair as being extractable (store).
0111  * @GNUTLS_PKCS11_OBJ_FLAG_NEVER_EXTRACTABLE: If set, the object was never marked as extractable (store).
0112  * @GNUTLS_PKCS11_OBJ_FLAG_CRT: When searching, restrict to certificates only (seek).
0113  * @GNUTLS_PKCS11_OBJ_FLAG_PUBKEY: When searching, restrict to public key objects only (seek).
0114  * @GNUTLS_PKCS11_OBJ_FLAG_PRIVKEY: When searching, restrict to private key objects only (seek).
0115  * @GNUTLS_PKCS11_OBJ_FLAG_NO_STORE_PUBKEY: When generating a keypair don't store the public key (store).
0116  * @GNUTLS_PKCS11_OBJ_FLAG_MARK_NOT_SENSITIVE: object marked as not sensitive -exportable (store).
0117  *
0118  * Enumeration of different PKCS #11 object flags. Some flags are used
0119  * to mark objects when storing, while others are also used while seeking
0120  * or retrieving objects.
0121  */
0122 typedef enum gnutls_pkcs11_obj_flags {
0123     GNUTLS_PKCS11_OBJ_FLAG_LOGIN = (1 << 0),
0124     GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED = (1 << 1),
0125     GNUTLS_PKCS11_OBJ_FLAG_MARK_SENSITIVE = (1 << 2),
0126     GNUTLS_PKCS11_OBJ_FLAG_LOGIN_SO = (1 << 3),
0127     GNUTLS_PKCS11_OBJ_FLAG_MARK_PRIVATE = (1 << 4),
0128     GNUTLS_PKCS11_OBJ_FLAG_MARK_NOT_PRIVATE = (1 << 5),
0129     GNUTLS_PKCS11_OBJ_FLAG_RETRIEVE_ANY = (1 << 6),
0130     GNUTLS_PKCS11_OBJ_FLAG_RETRIEVE_TRUSTED =
0131         GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED,
0132     GNUTLS_PKCS11_OBJ_FLAG_MARK_DISTRUSTED = (1 << 8),
0133     GNUTLS_PKCS11_OBJ_FLAG_RETRIEVE_DISTRUSTED =
0134         GNUTLS_PKCS11_OBJ_FLAG_MARK_DISTRUSTED,
0135     GNUTLS_PKCS11_OBJ_FLAG_COMPARE = (1 << 9),
0136     GNUTLS_PKCS11_OBJ_FLAG_PRESENT_IN_TRUSTED_MODULE = (1 << 10),
0137     GNUTLS_PKCS11_OBJ_FLAG_MARK_CA = (1 << 11),
0138     GNUTLS_PKCS11_OBJ_FLAG_MARK_KEY_WRAP = (1 << 12),
0139     GNUTLS_PKCS11_OBJ_FLAG_COMPARE_KEY = (1 << 13),
0140     GNUTLS_PKCS11_OBJ_FLAG_OVERWRITE_TRUSTMOD_EXT = (1 << 14),
0141     GNUTLS_PKCS11_OBJ_FLAG_MARK_ALWAYS_AUTH = (1 << 15),
0142     GNUTLS_PKCS11_OBJ_FLAG_MARK_EXTRACTABLE = (1 << 16),
0143     GNUTLS_PKCS11_OBJ_FLAG_NEVER_EXTRACTABLE = (1 << 17),
0144     GNUTLS_PKCS11_OBJ_FLAG_CRT = (1 << 18),
0145     GNUTLS_PKCS11_OBJ_FLAG_WITH_PRIVKEY = (1 << 19),
0146     GNUTLS_PKCS11_OBJ_FLAG_PUBKEY = (1 << 20),
0147     GNUTLS_PKCS11_OBJ_FLAG_NO_STORE_PUBKEY = GNUTLS_PKCS11_OBJ_FLAG_PUBKEY,
0148     GNUTLS_PKCS11_OBJ_FLAG_PRIVKEY = (1 << 21),
0149     GNUTLS_PKCS11_OBJ_FLAG_MARK_NOT_SENSITIVE = (1 << 22),
0150     /* flags 1<<29 and later are reserved - see pkcs11_int.h */
0151 } gnutls_pkcs11_obj_flags;
0152
0153 #define gnutls_pkcs11_obj_attr_t gnutls_pkcs11_obj_flags
0154
0155 /**
0156  * gnutls_pkcs11_url_type_t:
0157  * @GNUTLS_PKCS11_URL_GENERIC: A generic-purpose URL.
0158  * @GNUTLS_PKCS11_URL_LIB: A URL that specifies the library used as well.
0159  * @GNUTLS_PKCS11_URL_LIB_VERSION: A URL that specifies the library and its version.
0160  *
0161  * Enumeration of different URL extraction flags.
0162  */
0163 typedef enum {
0164     GNUTLS_PKCS11_URL_GENERIC, /* URL specifies the object on token level */
0165     GNUTLS_PKCS11_URL_LIB, /* URL specifies the object on module level */
0166     GNUTLS_PKCS11_URL_LIB_VERSION /* URL specifies the object on module and version level */
0167 } gnutls_pkcs11_url_type_t;
0168
0169 int gnutls_pkcs11_obj_import_url(gnutls_pkcs11_obj_t obj, const char *url,
0170                  unsigned int flags
0171                  /* GNUTLS_PKCS11_OBJ_FLAG_* */);
0172 int gnutls_pkcs11_obj_export_url(gnutls_pkcs11_obj_t obj,
0173                  gnutls_pkcs11_url_type_t detailed, char **url);
0174 void gnutls_pkcs11_obj_deinit(gnutls_pkcs11_obj_t obj);
0175
0176 int gnutls_pkcs11_obj_export(gnutls_pkcs11_obj_t obj, void *output_data,
0177                  size_t *output_data_size);
0178 int gnutls_pkcs11_obj_export2(gnutls_pkcs11_obj_t obj, gnutls_datum_t *out);
0179
0180 int gnutls_pkcs11_obj_export3(gnutls_pkcs11_obj_t obj,
0181                   gnutls_x509_crt_fmt_t fmt, gnutls_datum_t *out);
0182
0183 int gnutls_pkcs11_get_raw_issuer(const char *url, gnutls_x509_crt_t cert,
0184                  gnutls_datum_t *issuer,
0185                  gnutls_x509_crt_fmt_t fmt, unsigned int flags);
0186
0187 int gnutls_pkcs11_get_raw_issuer_by_dn(const char *url,
0188                        const gnutls_datum_t *dn,
0189                        gnutls_datum_t *issuer,
0190                        gnutls_x509_crt_fmt_t fmt,
0191                        unsigned int flags);
0192
0193 int gnutls_pkcs11_get_raw_issuer_by_subject_key_id(
0194     const char *url, const gnutls_datum_t *dn, const gnutls_datum_t *spki,
0195     gnutls_datum_t *issuer, gnutls_x509_crt_fmt_t fmt, unsigned int flags);
0196
0197 unsigned gnutls_pkcs11_crt_is_known(const char *url, gnutls_x509_crt_t cert,
0198                     unsigned int flags);
0199
0200 #if 0
0201 /* for documentation */
0202 int gnutls_pkcs11_copy_x509_crt(const char *token_url,
0203                 gnutls_x509_crt_t crt,
0204                 const char *label, unsigned int flags
0205                 /* GNUTLS_PKCS11_OBJ_FLAG_* */ );
0206
0207 int gnutls_pkcs11_copy_x509_privkey(const char *token_url,
0208                     gnutls_x509_privkey_t key,
0209                     const char *label,
0210                     unsigned int key_usage, unsigned int flags);
0211 int
0212 gnutls_pkcs11_privkey_generate2(const char *url, gnutls_pk_algorithm_t pk,
0213                 unsigned int bits, const char *label,
0214                 gnutls_x509_crt_fmt_t fmt,
0215                 gnutls_datum_t * pubkey, unsigned int flags);
0216 int
0217 gnutls_pkcs11_privkey_generate(const char *url, gnutls_pk_algorithm_t pk,
0218                    unsigned int bits, const char *label,
0219                    unsigned int flags);
0220 #endif
0221
0222 int gnutls_pkcs11_copy_pubkey(const char *token_url, gnutls_pubkey_t crt,
0223                   const char *label, const gnutls_datum_t *cid,
0224                   unsigned int key_usage, unsigned int flags);
0225
0226 #define gnutls_pkcs11_copy_x509_crt(url, crt, label, flags) \
0227     gnutls_pkcs11_copy_x509_crt2(url, crt, label, NULL, flags)
0228
0229 int gnutls_pkcs11_copy_x509_crt2(const char *token_url, gnutls_x509_crt_t crt,
0230                  const char *label, const gnutls_datum_t *id,
0231                  unsigned int flags
0232                  /* GNUTLS_PKCS11_OBJ_FLAG_* */);
0233
0234 #define gnutls_pkcs11_copy_x509_privkey(url, key, label, usage, flags) \
0235     gnutls_pkcs11_copy_x509_privkey2(url, key, label, NULL, usage, flags)
0236 int gnutls_pkcs11_copy_x509_privkey2(const char *token_url,
0237                      gnutls_x509_privkey_t key,
0238                      const char *label,
0239                      const gnutls_datum_t *cid,
0240                      unsigned int key_usage
0241                      /*GNUTLS_KEY_* */,
0242                      unsigned int flags
0243                      /* GNUTLS_PKCS11_OBJ_FLAG_* */
0244 );
0245
0246 int gnutls_pkcs11_delete_url(const char *object_url, unsigned int flags
0247                  /* GNUTLS_PKCS11_OBJ_FLAG_* */);
0248
0249 int gnutls_pkcs11_copy_secret_key(const char *token_url, gnutls_datum_t *key,
0250                   const char *label,
0251                   unsigned int key_usage
0252                   /* GNUTLS_KEY_* */,
0253                   unsigned int flags
0254                   /* GNUTLS_PKCS11_OBJ_FLAG_* */);
0255
0256 /**
0257  * gnutls_pkcs11_obj_info_t:
0258  * @GNUTLS_PKCS11_OBJ_ID_HEX: The object ID in hex. Null-terminated text.
0259  * @GNUTLS_PKCS11_OBJ_LABEL: The object label. Null-terminated text.
0260  * @GNUTLS_PKCS11_OBJ_TOKEN_LABEL: The token's label. Null-terminated text.
0261  * @GNUTLS_PKCS11_OBJ_TOKEN_SERIAL: The token's serial number. Null-terminated text.
0262  * @GNUTLS_PKCS11_OBJ_TOKEN_MANUFACTURER: The token's manufacturer. Null-terminated text.
0263  * @GNUTLS_PKCS11_OBJ_TOKEN_MODEL: The token's model. Null-terminated text.
0264  * @GNUTLS_PKCS11_OBJ_ID: The object ID. Raw bytes.
0265  * @GNUTLS_PKCS11_OBJ_LIBRARY_VERSION: The library's version. Null-terminated text.
0266  * @GNUTLS_PKCS11_OBJ_LIBRARY_DESCRIPTION: The library's description. Null-terminated text.
0267  * @GNUTLS_PKCS11_OBJ_LIBRARY_MANUFACTURER: The library's manufacturer name. Null-terminated text.
0268  *
0269  * Enumeration of several object information types.
0270  */
0271 typedef enum {
0272     GNUTLS_PKCS11_OBJ_ID_HEX = 1,
0273     GNUTLS_PKCS11_OBJ_LABEL,
0274     GNUTLS_PKCS11_OBJ_TOKEN_LABEL,
0275     GNUTLS_PKCS11_OBJ_TOKEN_SERIAL,
0276     GNUTLS_PKCS11_OBJ_TOKEN_MANUFACTURER,
0277     GNUTLS_PKCS11_OBJ_TOKEN_MODEL,
0278     GNUTLS_PKCS11_OBJ_ID,
0279     /* the pkcs11 provider library info  */
0280     GNUTLS_PKCS11_OBJ_LIBRARY_VERSION,
0281     GNUTLS_PKCS11_OBJ_LIBRARY_DESCRIPTION,
0282     GNUTLS_PKCS11_OBJ_LIBRARY_MANUFACTURER
0283 } gnutls_pkcs11_obj_info_t;
0284
0285 int gnutls_pkcs11_obj_get_ptr(gnutls_pkcs11_obj_t obj, void **ptr,
0286                   void **session, void **ohandle,
0287                   unsigned long *slot_id, unsigned int flags);
0288
0289 int gnutls_pkcs11_obj_get_info(gnutls_pkcs11_obj_t obj,
0290                    gnutls_pkcs11_obj_info_t itype, void *output,
0291                    size_t *output_size);
0292 int gnutls_pkcs11_obj_set_info(gnutls_pkcs11_obj_t obj,
0293                    gnutls_pkcs11_obj_info_t itype, const void *data,
0294                    size_t data_size, unsigned flags);
0295
0296 #define GNUTLS_PKCS11_OBJ_ATTR_CRT_ALL GNUTLS_PKCS11_OBJ_FLAG_CRT
0297 #define GNUTLS_PKCS11_OBJ_ATTR_MATCH 0 /* always match the given URL */
0298 #define GNUTLS_PKCS11_OBJ_ATTR_ALL 0 /* match everything! */
0299 #define GNUTLS_PKCS11_OBJ_ATTR_CRT_TRUSTED \
0300     (GNUTLS_PKCS11_OBJ_FLAG_CRT | GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED)
0301 #define GNUTLS_PKCS11_OBJ_ATTR_CRT_WITH_PRIVKEY \
0302     (GNUTLS_PKCS11_OBJ_FLAG_CRT | GNUTLS_PKCS11_OBJ_FLAG_WITH_PRIVKEY)
0303 #define GNUTLS_PKCS11_OBJ_ATTR_CRT_TRUSTED_CA                          \
0304     (GNUTLS_PKCS11_OBJ_FLAG_CRT | GNUTLS_PKCS11_OBJ_FLAG_MARK_CA | \
0305      GNUTLS_PKCS11_OBJ_FLAG_MARK_TRUSTED)
0306 #define GNUTLS_PKCS11_OBJ_ATTR_PUBKEY GNUTLS_PKCS11_OBJ_FLAG_PUBKEY
0307 #define GNUTLS_PKCS11_OBJ_ATTR_PRIVKEY GNUTLS_PKCS11_OBJ_FLAG_PRIVKEY
0308
0309 /**
0310  * gnutls_pkcs11_token_info_t:
0311  * @GNUTLS_PKCS11_TOKEN_LABEL: The token's label (string)
0312  * @GNUTLS_PKCS11_TOKEN_SERIAL: The token's serial number (string)
0313  * @GNUTLS_PKCS11_TOKEN_MANUFACTURER: The token's manufacturer (string)
0314  * @GNUTLS_PKCS11_TOKEN_MODEL: The token's model (string)
0315  * @GNUTLS_PKCS11_TOKEN_MODNAME: The token's module name (string - since 3.4.3). This value is
0316  *   unavailable for providers which were manually loaded.
0317  *
0318  * Enumeration of types for retrieving token information.
0319  */
0320 typedef enum {
0321     GNUTLS_PKCS11_TOKEN_LABEL,
0322     GNUTLS_PKCS11_TOKEN_SERIAL,
0323     GNUTLS_PKCS11_TOKEN_MANUFACTURER,
0324     GNUTLS_PKCS11_TOKEN_MODEL,
0325     GNUTLS_PKCS11_TOKEN_MODNAME
0326 } gnutls_pkcs11_token_info_t;
0327
0328 /**
0329  * gnutls_pkcs11_obj_type_t:
0330  * @GNUTLS_PKCS11_OBJ_UNKNOWN: Unknown PKCS11 object.
0331  * @GNUTLS_PKCS11_OBJ_X509_CRT: X.509 certificate.
0332  * @GNUTLS_PKCS11_OBJ_PUBKEY: Public key.
0333  * @GNUTLS_PKCS11_OBJ_PRIVKEY: Private key.
0334  * @GNUTLS_PKCS11_OBJ_SECRET_KEY: Secret key.
0335  * @GNUTLS_PKCS11_OBJ_DATA: Data object.
0336  * @GNUTLS_PKCS11_OBJ_X509_CRT_EXTENSION: X.509 certificate extension (supported by p11-kit trust module only).
0337  *
0338  * Enumeration of object types.
0339  */
0340 typedef enum {
0341     GNUTLS_PKCS11_OBJ_UNKNOWN,
0342     GNUTLS_PKCS11_OBJ_X509_CRT,
0343     GNUTLS_PKCS11_OBJ_PUBKEY,
0344     GNUTLS_PKCS11_OBJ_PRIVKEY,
0345     GNUTLS_PKCS11_OBJ_SECRET_KEY,
0346     GNUTLS_PKCS11_OBJ_DATA,
0347     GNUTLS_PKCS11_OBJ_X509_CRT_EXTENSION
0348 } gnutls_pkcs11_obj_type_t;
0349
0350 int gnutls_pkcs11_token_init(const char *token_url, const char *so_pin,
0351                  const char *label);
0352
0353 int gnutls_pkcs11_token_get_ptr(const char *url, void **ptr,
0354                 unsigned long *slot_id, unsigned int flags);
0355
0356 int gnutls_pkcs11_token_get_mechanism(const char *url, unsigned int idx,
0357                       unsigned long *mechanism);
0358
0359 unsigned gnutls_pkcs11_token_check_mechanism(const char *url,
0360                          unsigned long mechanism, void *ptr,
0361                          unsigned psize, unsigned flags);
0362
0363 int gnutls_pkcs11_token_set_pin(const char *token_url, const char *oldpin,
0364                 const char *newpin,
0365                 unsigned int flags /*gnutls_pin_flag_t */);
0366
0367 int gnutls_pkcs11_token_get_url(unsigned int seq,
0368                 gnutls_pkcs11_url_type_t detailed, char **url);
0369 int gnutls_pkcs11_token_get_info(const char *url,
0370                  gnutls_pkcs11_token_info_t ttype, void *output,
0371                  size_t *output_size);
0372
0373 #define GNUTLS_PKCS11_TOKEN_HW 1
0374 #define GNUTLS_PKCS11_TOKEN_TRUSTED (1 << 1) /* p11-kit trusted */
0375 #define GNUTLS_PKCS11_TOKEN_RNG (1 << 2) /* CKF_RNG */
0376 #define GNUTLS_PKCS11_TOKEN_LOGIN_REQUIRED (1 << 3) /* CKF_LOGIN_REQUIRED */
0377 #define GNUTLS_PKCS11_TOKEN_PROTECTED_AUTHENTICATION_PATH \
0378     (1 << 4) /* CKF_PROTECTED_AUTHENTICATION_PATH */
0379 #define GNUTLS_PKCS11_TOKEN_INITIALIZED (1 << 5) /* CKF_TOKEN_INITIALIZED */
0380 #define GNUTLS_PKCS11_TOKEN_USER_PIN_COUNT_LOW \
0381     (1 << 6) /* CKF_USER_PIN_COUNT_LOW */
0382 #define GNUTLS_PKCS11_TOKEN_USER_PIN_FINAL_TRY \
0383     (1 << 7) /* CKF_USER_PIN_FINAL_TRY */
0384 #define GNUTLS_PKCS11_TOKEN_USER_PIN_LOCKED (1 << 8) /* CKF_USER_PIN_LOCKED */
0385 #define GNUTLS_PKCS11_TOKEN_SO_PIN_COUNT_LOW (1 << 9) /* CKF_SO_PIN_COUNT_LOW */
0386 #define GNUTLS_PKCS11_TOKEN_SO_PIN_FINAL_TRY \
0387     (1 << 10) /* CKF_SO_PIN_FINAL_TRY */
0388 #define GNUTLS_PKCS11_TOKEN_SO_PIN_LOCKED (1 << 11) /* CKF_SO_PIN_LOCKED */
0389 #define GNUTLS_PKCS11_TOKEN_USER_PIN_INITIALIZED \
0390     (1 << 12) /* CKF_USER_PIN_INITIALIZED */
0391 #define GNUTLS_PKCS11_TOKEN_ERROR_STATE (1 << 13) /* CKF_ERROR_STATE */
0392
0393 int gnutls_pkcs11_token_get_flags(const char *url, unsigned int *flags);
0394
0395 #define gnutls_pkcs11_obj_list_import_url(p_list, n_list, url, attrs, flags) \
0396     gnutls_pkcs11_obj_list_import_url3(p_list, n_list, url, attrs | flags)
0397 #define gnutls_pkcs11_obj_list_import_url2(p_list, n_list, url, attrs, flags) \
0398     gnutls_pkcs11_obj_list_import_url4(p_list, n_list, url, attrs | flags)
0399
0400 int gnutls_pkcs11_obj_list_import_url3(gnutls_pkcs11_obj_t *p_list,
0401                        unsigned int *const n_list,
0402                        const char *url, unsigned int flags
0403                        /* GNUTLS_PKCS11_OBJ_FLAG_* */
0404 );
0405
0406 int gnutls_pkcs11_obj_list_import_url4(gnutls_pkcs11_obj_t **p_list,
0407                        unsigned int *n_list, const char *url,
0408                        unsigned int flags
0409                        /* GNUTLS_PKCS11_OBJ_FLAG_* */
0410 );
0411
0412 int gnutls_x509_crt_import_pkcs11(gnutls_x509_crt_t crt,
0413                   gnutls_pkcs11_obj_t pkcs11_crt);
0414
0415 gnutls_pkcs11_obj_type_t gnutls_pkcs11_obj_get_type(gnutls_pkcs11_obj_t obj);
0416 const char *gnutls_pkcs11_type_get_name(gnutls_pkcs11_obj_type_t type);
0417
0418 int gnutls_pkcs11_obj_get_exts(gnutls_pkcs11_obj_t obj,
0419                    struct gnutls_x509_ext_st **exts,
0420                    unsigned int *exts_size, unsigned int flags);
0421
0422 int gnutls_pkcs11_obj_get_flags(gnutls_pkcs11_obj_t obj, unsigned int *oflags);
0423 char *gnutls_pkcs11_obj_flags_get_str(unsigned int flags);
0424
0425 int gnutls_x509_crt_list_import_pkcs11(gnutls_x509_crt_t *certs,
0426                        unsigned int cert_max,
0427                        gnutls_pkcs11_obj_t *const objs,
0428                        unsigned int flags
0429                        /* must be zero */);
0430
0431 /* private key functions...*/
0432 int gnutls_pkcs11_privkey_init(gnutls_pkcs11_privkey_t *key);
0433
0434 int gnutls_pkcs11_privkey_cpy(gnutls_pkcs11_privkey_t dst,
0435                   gnutls_pkcs11_privkey_t src);
0436
0437 void gnutls_pkcs11_privkey_set_pin_function(gnutls_pkcs11_privkey_t key,
0438                         gnutls_pin_callback_t fn,
0439                         void *userdata);
0440 void gnutls_pkcs11_privkey_deinit(gnutls_pkcs11_privkey_t key);
0441 int gnutls_pkcs11_privkey_get_pk_algorithm(gnutls_pkcs11_privkey_t key,
0442                        unsigned int *bits);
0443 int gnutls_pkcs11_privkey_get_info(gnutls_pkcs11_privkey_t pkey,
0444                    gnutls_pkcs11_obj_info_t itype, void *output,
0445                    size_t *output_size);
0446
0447 int gnutls_pkcs11_privkey_import_url(gnutls_pkcs11_privkey_t pkey,
0448                      const char *url, unsigned int flags);
0449
0450 int gnutls_pkcs11_privkey_export_url(gnutls_pkcs11_privkey_t key,
0451                      gnutls_pkcs11_url_type_t detailed,
0452                      char **url);
0453 unsigned gnutls_pkcs11_privkey_status(gnutls_pkcs11_privkey_t key);
0454
0455 #define gnutls_pkcs11_privkey_generate(url, pk, bits, label, flags)          \
0456     gnutls_pkcs11_privkey_generate3(url, pk, bits, label, NULL, 0, NULL, \
0457                     0, flags)
0458
0459 #define gnutls_pkcs11_privkey_generate2(url, pk, bits, label, fmt, pubkey, \
0460                     flags)                             \
0461     gnutls_pkcs11_privkey_generate3(url, pk, bits, label, NULL, fmt,   \
0462                     pubkey, 0, flags)
0463
0464 int gnutls_pkcs11_privkey_generate3(const char *url, gnutls_pk_algorithm_t pk,
0465                     unsigned int bits, const char *label,
0466                     const gnutls_datum_t *cid,
0467                     gnutls_x509_crt_fmt_t fmt,
0468                     gnutls_datum_t *pubkey,
0469                     unsigned int key_usage, unsigned int flags);
0470
0471 int gnutls_pkcs11_privkey_export_pubkey(gnutls_pkcs11_privkey_t pkey,
0472                     gnutls_x509_crt_fmt_t fmt,
0473                     gnutls_datum_t *pubkey,
0474                     unsigned int flags);
0475
0476 int gnutls_pkcs11_token_get_random(const char *token_url, void *data,
0477                    size_t len);
0478
0479 int gnutls_pkcs11_copy_attached_extension(const char *token_url,
0480                       gnutls_x509_crt_t crt,
0481                       gnutls_datum_t *data,
0482                       const char *label,
0483                       unsigned int flags);
0484
0485 #define gnutls_x509_crt_import_pkcs11_url gnutls_x509_crt_import_url
0486
0487 #ifdef __cplusplus
0488 }
0489 #endif
0490
0491 #endif /* GNUTLS_PKCS11_H */