35 #ifdef CONFIG_CONSERVE_MEMORY
36 #define MAX_USER_OBJECTS 4
38 #define MAX_USER_OBJECTS 32
44 #define USERDATA_BUFFERSIZE 1024
48 #define MAX_USERINDEX_SIZE ( ( 16 + ( KEYID_SIZE * 2 ) + \
49 CRYPT_MAX_TEXTSIZE + 8 ) * MAX_USER_OBJECTS )
56 "Security officer", 16,
57 "<<<PRIMARYSO_USER>>>",
"<<<TETRAGRAMMATON>>>",
63 #define PRIMARYSO_PASSWORD "zeroised"
64 #define PRIMARYSO_ALTPASSWORD "zeroized"
65 #define PRIMARYSO_PASSWORD_LENGTH 8
89 char userFilePath[ MAX_PATH_LENGTH + 8 ];
90 int userFilePathLen,
status;
93 assert(
isReadPtr( fileName, fileNameLen ) );
102 status = fileBuildCryptlibPath( userFilePath, MAX_PATH_LENGTH,
103 &userFilePathLen, fileName, fileNameLen,
114 createInfo.strArg1 = userFilePath;
129 char userFileName[ 16 + 8 ];
137 userFileNameLen =
sprintf_s( userFileName, 16,
"u%06x", fileRef );
138 return( openKeyset( iUserKeyset, userFileName, userFileNameLen,
150 return( openKeyset( iIndexKeyset,
"index", 5, options ) );
158 IN_BUFFER( userIdLength )
const void *userID,
168 assert(
isReadPtr( userID, userIdLength ) );
169 assert(
isReadPtr( password, passwordLength ) );
178 &msgData, CRYPT_IATTRIBUTE_USERID );
187 &setkeyInfo, isPrivateKey ? \
208 const int noUserIndexEntries,
213 int i, iterationCount;
224 for( i = 0, iterationCount = 0;
225 i < noUserIndexEntries && \
227 i++, iterationCount++ )
235 !memcmp( userIndexPtr->userID,
id, idLength ) )
236 return( userIndexPtr );
241 !memcmp( userIndexPtr->creatorID,
id, idLength ) )
242 return( userIndexPtr );
247 !memcmp( userIndexPtr->userName,
id, idLength ) )
248 return( userIndexPtr );
255 ENSURES_N( iterationCount < FAILSAFE_ITERATIONS_LARGE );
266 const int noUserIndexEntries,
270 int newFileRef, i, iterationCount;
274 assert(
isWritePtr( fileRef,
sizeof(
int ) ) );
280 for( i = 0, iterationCount = 0;
281 i < noUserIndexEntries && \
283 i++, iterationCount++ )
288 ENSURES_N( iterationCount < FAILSAFE_ITERATIONS_LARGE );
289 if( i >= noUserIndexEntries )
297 userIndexPtr = &userIndex[ i ];
324 for( i = 0; i < noUserIndexEntries; i++ )
326 if( userIndex[ i ].fileRef == newFileRef )
329 if( i >= MAX_USER_OBJECTS )
332 ENSURES_N( newFileRef < MAX_USER_OBJECTS );
333 *fileRef = newFileRef;
335 return( userIndexPtr );
343 const int noUserIndexEntries,
354 REQUIRES( noUserIndexEntries > 0 && \
358 *userIndexPtrPtr = NULL;
361 if( findUser( userIndex, noUserIndexEntries,
USERID_NAME,
362 userFileInfo->userName, userFileInfo->userNameLength ) != NULL )
368 for( iterationCount = 0;
382 CRYPT_IATTRIBUTE_RANDOM_NONCE );
385 ENSURES( iterationCount < FAILSAFE_ITERATIONS_LARGE );
389 if( userIndexPtr == NULL )
391 userFileInfo->fileRef = fileRef;
421 readSequence( stream, NULL );
426 readCharacterString( stream, userIndexEntry.userName,
435 memcpy( userIndexPtr, &userIndexEntry,
sizeof(
USER_FILE_INFO ) );
446 int i, iterationCount,
status;
455 status = dynCreate( &userIndexDB, iIndexKeyset,
456 CRYPT_IATTRIBUTE_USERINDEX );
460 for( i = 0, iterationCount = 0;
462 stell( &stream ) <
dynLength( userIndexDB ) && \
464 i++, iterationCount++ )
466 status = readIndexEntry( &stream, &userIndex[ i ] );
468 ENSURES( iterationCount < FAILSAFE_ITERATIONS_LARGE );
469 sMemDisconnect( &stream );
470 dynDestroy( &userIndexDB );
473 if( i > maxUserObjects )
482 static
int writeUserIndexEntry(
INOUT STREAM *stream,
488 writeSequence( stream, 2 * sizeofObject(
KEYID_SIZE ) + \
493 writeCharacterString( stream, userIndexPtr->userName,
503 const int noUserIndexEntries )
508 int userIndexDataLength, i, iterationCount, status =
CRYPT_OK;
514 REQUIRES( noUserIndexEntries > 0 && \
520 for( i = 0, iterationCount = 0;
523 i++, iterationCount++ )
526 status = writeUserIndexEntry( &stream, &userIndex[ i ] );
528 ENSURES( iterationCount < FAILSAFE_ITERATIONS_LARGE );
529 userIndexDataLength = stell( &stream );
530 sMemDisconnect( &stream );
537 &msgData, CRYPT_IATTRIBUTE_USERINDEX ) );
557 IN_BUFFER( userDataLength )
const void *userData,
564 assert(
isReadPtr( userData, userDataLength ) );
572 sMemConnect( &stream, userData, userDataLength );
573 readSequence( &stream, NULL );
575 userFileInfoPtr->type = enumValue;
580 status = readCharacterString( &stream, userFileInfoPtr->userName,
582 &userFileInfoPtr->userNameLength,
584 sMemDisconnect( &stream );
590 static
int writeUserData(
OUT_BUFFER( userDataMaxLength, \
591 *userDataLength )
void *userData,
600 assert(
isWritePtr( userData, userDataMaxLength ) );
601 assert(
isWritePtr( userDataLength,
sizeof(
int ) ) );
604 REQUIRES( userDataMaxLength > 0 && \
608 memset( userData, 0,
min( 16, userDataMaxLength ) );
612 sMemOpen( &stream, userData, userDataMaxLength );
617 writeOctetString( &stream, userFileInfo->userID,
KEYID_SIZE,
619 writeOctetString( &stream, userFileInfo->creatorID,
KEYID_SIZE,
621 status = writeCharacterString( &stream, userFileInfo->userName,
625 *userDataLength = stell( &stream );
626 sMemDisconnect( &stream );
636 IN_BUFFER( userDataLength )
const void *userData,
643 assert(
isReadPtr( userData, userDataLength ) );
651 &msgData, CRYPT_IATTRIBUTE_USERINFO );
658 &msgData, CRYPT_IATTRIBUTE_USERID );
669 CHECK_RETVAL STDC_NONNULL_ARG( ( 1 ) ) \
670 static int getCheckUserInfo( INOUT USER_FILE_INFO *userFileInfoPtr,
680 void *hashDataPtr, *signaturePtr;
694 status = dynCreate( &userDataDB, iUserKeyset,
695 CRYPT_IATTRIBUTE_USERINFO );
706 readSequence( &stream, NULL );
707 readUniversal( &stream );
708 readConstructed( &stream, NULL, 0 );
709 readSequence( &stream, NULL );
710 readUniversal( &stream );
711 readSet( &stream, NULL );
712 readAlgoID( &stream, &hashAlgo );
713 readSequence( &stream, NULL );
714 readUniversal( &stream );
715 readConstructed( &stream, NULL, 0 );
716 status = readGenericHole( &stream, &hashDataLength, 16,
DEFAULT_TAG );
719 sMemDisconnect( &stream );
720 dynDestroy( &userDataDB );
723 hashDataPtr = sMemBufPtr( &stream );
726 status = readUserData( userFileInfoPtr, hashDataPtr, hashDataLength );
729 sMemDisconnect( &stream );
730 dynDestroy( &userDataDB );
741 dynDestroy( &userDataDB );
742 sMemDisconnect( &stream );
749 dynDestroy( &userDataDB );
752 sMemDisconnect( &stream );
757 status = readSet( &stream, &signatureLength );
758 signaturePtr = sMemBufPtr( &stream );
759 sMemDisconnect( &stream );
767 status = soFileRef = \
768 findUserIndexEntry(
USERID_USERID, userFileInfoPtr->creatorID,
771 status = openUserKeyset( &iUserKeyset, soFileRef,
779 userFileInfoPtr->creatorID,
KEYID_SIZE, NULL, 0,
791 status = iCryptCheckSignatureEx( signaturePtr, signatureLength,
819 return( &primarySOInfo );
830 int userInfoLength,
status;
838 memset( userInfoBuffer,
'*', 16 );
844 status = envelopeSign( userInfoBuffer, userInfoLength,
855 static
int sigCheckUserData(
void )
878 assert(
isReadPtr( password, passwordLength ) );
897 (
int * ) &actionPerms,
898 CRYPT_IATTRIBUTE_ACTIONPERMS );
906 status = addKey( iUserKeyset, createInfo.
cryptHandle,
908 passwordLength,
TRUE );
915 userInfoPtr->iCryptContext = createInfo.
cryptHandle;
926 IN_BUFFER( passwordLength )
const char *password,
938 assert(
isReadPtr( password, passwordLength ) );
956 (
int * ) &actionPerms,
957 CRYPT_IATTRIBUTE_ACTIONPERMS );
965 status = addKey( iUserKeyset, createInfo.
cryptHandle,
967 passwordLength,
FALSE );
983 IN_BUFFER( passwordLength )
const char *password,
992 assert(
isReadPtr( password, passwordLength ) );
1008 memcpy( &userIndex, &userInfoPtr->userFileInfo,
1021 userInfoPtr->iKeyset = iUserKeyset;
1024 status = createSOKey( iUserKeyset, userInfoPtr, password,
1028 &userDataLength, userInfoPtr );
1030 status = commitUserData( iUserKeyset, userInfoPtr, userData,
1038 ( void ) zeroiseUsers( userInfoPtr );
1061 assert(
isReadPtr( password, passwordLen ) );
1081 char userFilePath[ MAX_PATH_LENGTH + 1 + 8 ];
1082 int userFilePathLen, i, iterationCount,
status;
1088 for( i = 0, iterationCount = 0;
1091 i++, iterationCount++ )
1093 char userFileName[ 16 + 8 ];
1096 sprintf_s( userFileName, 16,
"u%06x", userIndex[ i ].fileRef );
1097 status = fileBuildCryptlibPath( userFilePath, MAX_PATH_LENGTH,
1098 &userFilePathLen, userFileName,
1099 strlen( userFileName ),
1103 userFilePath[ userFilePathLen ] =
'\0';
1104 fileErase( userFilePath );
1107 ENSURES( iterationCount < FAILSAFE_ITERATIONS_LARGE );
1110 status = fileBuildCryptlibPath( userFilePath, MAX_PATH_LENGTH,
1111 &userFilePathLen,
"index", 5,
1115 userFilePath[ userFilePathLen ] =
'\0';
1116 fileErase( userFilePath );
1124 static
int createUserKeyset(
INOUT USER_INFO *defaultUserInfoPtr,
1136 status = openIndexKeyset( &iIndexKeyset, CRYPT_IKEYOPT_EXCLUSIVEACCESS );
1141 status = createUserEntry( &userIndexPtr,
1142 defaultUserInfoPtr->userIndexPtr,
1151 status = openUserKeyset( &iUserKeyset, userFileInfo->
fileRef,
1162 status = writeUserIndex( iIndexKeyset, defaultUserInfoPtr->userIndexPtr,
1182 IN_BUFFER( passwordLength )
const char *password,
1190 assert(
isReadPtr( password, passwordLength ) );
1198 USER_FILE_INFO dummyUserInfo = { 0 }, *userFileInfoPtr = &dummyUserInfo;
1201 ( void ) readUserData( userFileInfoPtr,
"", 0 );
1202 ( void ) signUserData( 0, &userInfo, 0 );
1203 ( void ) sigCheckUserData();
1204 ( void ) createSOKey( 0, &userInfo,
"", 0 );
1205 ( void ) createUserKeyset( &userInfo, &userInfo );
1220 if( userFileInfo->
fileRef == -1 )
1222 status = createPrimarySoUser( userInfoPtr, password,
1229 status = openUserKeyset( &iUserKeyset, userFileInfo->
fileRef,
1251 int initUserIndex(
OUT_OPT_PTR void **userIndexPtrPtr )
1257 assert(
isWritePtr( userIndexPtrPtr,
sizeof(
void * ) ) );
1260 *userIndexPtrPtr = NULL;
1271 status = openIndexKeyset( &iIndexKeyset, CRYPT_IKEYOPT_EXCLUSIVEACCESS );
1285 DEBUG_DIAG((
"Couldn't read user index, assuming zeroised state" ));
1287 DEBUG_PRINT((
"User index read failed with status %d.\n", status ));
1297 char userFilePath[ MAX_PATH_LENGTH + 1 + 8 ];
1298 int userFilePathLen;
1300 status = fileBuildCryptlibPath( userFilePath, MAX_PATH_LENGTH,
1301 &userFilePathLen,
"index", 5,
1305 userFilePath[ userFilePathLen ] =
'\0';
1306 fileErase( userFilePath );
1316 if( ( userIndexInfo =
clAlloc(
"initUserIndex", \
1320 status = noEntries = readIndex( iIndexKeyset, userIndexInfo->
userIndex,
1325 clFree(
"initUserIndex", userIndexInfo );
1329 *userIndexPtrPtr = userIndexInfo;
1335 void endUserIndex(
INOUT void *userIndexPtr )
1342 clFree(
"endUserIndex", userIndexInfo );