ffi-pkcs11 0.2.0

checksums.yaml

@@ -0,0 +1,7 @@
+---
+SHA1:
+  metadata.gz: cd6f4b5ce9c4b6b6fe51184c11b052bfb278b1e8
+  data.tar.gz: c12881078bb7be5e5b68762e6a73a7faad9732bc
+SHA512:
+  metadata.gz: 770748cb742be5064d4043ef88b61bf15cb38cec59bc1af3e0a8084d07305f3436d5da23d08b41983185b872dc92a87c16f9e056a8f47bc6a2d499ea97686909
+  data.tar.gz: 5242f88b5094743287650c56c49903de2bc2be684d8cf3eb70345a0f2ecfa8c4ce53a5c0dd4b8810bbbfaf9a8388f8d6df18c083b2fa0c53fe95b6dc4d73e46d

data/.gitignore

@@ -0,0 +1,9 @@
+/.bundle/
+/.yardoc
+/Gemfile.lock
+/_yardoc/
+/coverage/
+/doc/
+/pkg/
+/spec/reports/
+/tmp/

data/.rspec

@@ -0,0 +1,2 @@
+--format documentation
+--color

data/Gemfile

@@ -0,0 +1,4 @@
+source 'https://rubygems.org'
+
+# Specify your gem's dependencies in ffi-pkcs11.gemspec
+gemspec

data/LICENSE.md

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2017 Vincent Touchard
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

data/README.md

@@ -0,0 +1,51 @@
+# FFI::Pkcs11
+
+Minimalistic Ruby FFI bindings for using a "Cryptoki" (PKCS11) library.
+
+## Installation
+
+Add this line to your application's Gemfile:
+
+```ruby
+gem 'ffi-pkcs11'
+```
+
+And then execute:
+
+    $ bundle
+
+Or install it yourself as:
+
+    $ gem install ffi-pkcs11
+
+## Usage
+
+### Low-level API
+
+In order to use a PKCS11 function, one should prefix the function with the `Pkcs11` module name e.g.
+
+```ruby
+result = Pkcs11.C_Initialize(nil)
+if result == Pkcs11::CKR_OK
+[...]
+```	
+
+### High-level API
+
+Coming soon (TM).
+
+## Development
+
+After checking out the repo, run `bin/setup` to install dependencies. Then, run `bin/rspec` to run the tests. You can also run `bin/console` for an interactive prompt that will allow you to experiment.
+
+The tests are using a software-only PKCS11 implementation [SoftHSM](https://wiki.opendnssec.org/display/SoftHSMDOCS/SoftHSM+Documentation+v2).
+
+It is initialized using the following command:
+`softhsm2-util --init-token --slot 0 --id 0x00  --label 'zero' --pin 1234 --so-pin 5678`
+
+To install this gem onto your local machine, run `bundle exec rake install`. To release a new version, update the version number in `version.rb`, and then run `bundle exec rake release`, which will create a git tag for the version, push git commits and tags, and push the `.gem` file to [rubygems.org](https://rubygems.org).
+
+## Contributing
+
+Bug reports and pull requests are welcome on GitHub at https://github.com/touchardv/ffi-pkcs11.
+

data/Rakefile

@@ -0,0 +1,6 @@
+require "bundler/gem_tasks"
+require "rspec/core/rake_task"
+
+RSpec::Core::RakeTask.new(:spec)
+
+task :default => :spec

data/bin/console

@@ -0,0 +1,7 @@
+#!/usr/bin/env ruby
+
+require "bundler/setup"
+require "pkcs11"
+
+require "pry"
+Pry.start

data/bin/rspec

@@ -0,0 +1,17 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+#
+# This file was generated by Bundler.
+#
+# The application 'rspec' is installed as part of a gem, and
+# this file is here to facilitate running it.
+#
+
+require "pathname"
+ENV["BUNDLE_GEMFILE"] ||= File.expand_path("../../Gemfile",
+  Pathname.new(__FILE__).realpath)
+
+require "rubygems"
+require "bundler/setup"
+
+load Gem.bin_path("rspec-core", "rspec")

data/bin/setup

@@ -0,0 +1,8 @@
+#!/usr/bin/env bash
+set -euo pipefail
+IFS=$'\n\t'
+set -vx
+
+bundle install
+
+# Do any other automated setup that you need to do here

data/ffi-pkcs11.gemspec

@@ -0,0 +1,27 @@
+# coding: utf-8
+lib = File.expand_path('../lib', __FILE__)
+$LOAD_PATH.unshift(lib) unless $LOAD_PATH.include?(lib)
+require 'ffi-pkcs11/version'
+
+Gem::Specification.new do |spec|
+  spec.name          = "ffi-pkcs11"
+  spec.version       = Pkcs11::VERSION
+  spec.authors       = ["Vincent Touchard"]
+  spec.email         = ["touchardv@gmail.com"]
+
+  spec.summary       = %q{Minimalistic Ruby FFI bindings for using a "Cryptoki" (PKCS11) library.}
+  spec.homepage      = "https://github.com/touchardv/ffi-pkcs11"
+
+  spec.files         = `git ls-files -z`.split("\x0").reject do |f|
+    f.match(%r{^(test|spec|features)/})
+  end
+  spec.bindir        = "exe"
+  spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
+  spec.require_paths = ["lib"]
+
+  spec.add_runtime_dependency "ffi", "~> 1.9"
+  spec.add_development_dependency "bundler", "~> 1.13"
+  spec.add_development_dependency "pry-byebug"
+  spec.add_development_dependency "rake", "~> 10.0"
+  spec.add_development_dependency "rspec", "~> 3.0"
+end

data/lib/ffi-pkcs11.rb

@@ -0,0 +1,6 @@
+require "ffi-pkcs11/version"
+
+require 'ffi-pkcs11/error'
+require 'ffi-pkcs11/return_value'
+require 'ffi-pkcs11/functions'
+require 'ffi-pkcs11/session'

data/lib/ffi-pkcs11/error.rb

@@ -0,0 +1,4 @@
+module Pkcs11
+  class Error < StandardError
+  end
+end

data/lib/ffi-pkcs11/functions.rb

@@ -0,0 +1,75 @@
+require 'ffi'
+
+module Pkcs11
+  extend FFI::Library
+
+  ffi_lib 'cryptoki'
+
+  typedef :ulong, :CK_RV
+
+  CKS_RO_PUBLIC_SESSION = 0
+  CKS_RO_USER_FUNCTIONS = 1
+  CKS_RW_PUBLIC_SESSION = 2
+  CKS_RW_USER_FUNCTIONS = 3
+  CKS_RW_SO_FUNCTIONS =  4
+
+  class CK_SESSION_INFO < FFI::Struct
+    layout :slot_id, :ulong,
+      :state, :ulong,
+      :flags, :ulong,
+      :u_device_error, :ulong
+  end
+
+  enum :CK_ATTRIBUTE_TYPE, [
+    :CKA_CLASS,  0x00000000,
+    :CKA_TOKEN,  0x00000001,
+    :CKA_PRIVATE,  0x00000002,
+    :CKA_LABEL,  0x00000003
+  ]
+
+  class CK_ATTRIBUTE < FFI::Struct
+    layout :type, :CK_ATTRIBUTE_TYPE,
+      :value, :pointer,
+      :value_len, :ulong
+  end
+
+  CKF_RW_SESSION = 0x00000002
+  CKF_SERIAL_SESSION = 0x00000004
+
+  CKM_MD5 = 0x00000210
+  CKM_SHA_1 = 0x00000220
+  CKM_VENDOR_DEFINED = 0x80000000
+
+  CKU_SO = 0
+  CKU_USER = 1
+  CKU_CONTEXT_SPECIFIC = 2
+
+  def self.import_function(function_name, *args)
+    function_symbol = "native_#{function_name}".to_sym
+    attach_function(function_symbol, function_name, *args)
+
+    self.class.send(:define_method, function_name) do |*arguments|
+      result = send(function_symbol, *arguments)
+      ReturnValue[result]
+    end
+  end
+
+  import_function :C_Initialize, [:pointer], :CK_RV
+  import_function :C_Finalize, [:pointer], :CK_RV
+
+  import_function :C_GetSlotList, [:bool, :pointer, :pointer], :CK_RV
+
+  import_function :C_GetSessionInfo, [:ulong, :pointer], :CK_RV
+  import_function :C_OpenSession, [:ulong, :ulong, :pointer, :pointer, :pointer], :CK_RV
+  import_function :C_CloseSession, [:ulong], :CK_RV
+
+  import_function :C_Login, [:ulong, :ulong, :string, :ulong], :CK_RV
+  import_function :C_Logout, [:ulong], :CK_RV
+
+  import_function :C_FindObjectsInit, [:ulong, :pointer, :ulong], :CK_RV
+  import_function :C_FindObjects, [:ulong, :pointer, :ulong, :pointer], :CK_RV
+  import_function :C_FindObjectsFinal, [:ulong], :CK_RV
+
+  import_function :C_DigestInit, [:ulong, :pointer], :CK_RV
+  import_function :C_Digest, [:ulong, :pointer, :ulong, :pointer, :pointer], :CK_RV
+end

data/lib/ffi-pkcs11/return_value.rb

@@ -0,0 +1,158 @@
+module Pkcs11
+  RETURN_VALUES = {}
+
+  class ReturnValue
+    attr_reader :result
+
+    def self.[](result)
+      if RETURN_VALUES.has_key? result
+        RETURN_VALUES[result]
+      elsif result >= CKR_VENDOR_DEFINED.result
+        ReturnValue.new(result, :CKR_VENDOR_DEFINED)
+      else
+        raise "Unknown CKR result: #{result}"
+      end
+    end
+
+    def ok?
+      @result == 0
+    end
+
+    def inspect
+      to_s
+    end
+
+    def to_s
+      if @symbol == :CKR_VENDOR_DEFINED
+        "#{@symbol}_#{sprintf('0x%x', @result)}"
+      else
+        @symbol.to_s
+      end
+    end
+
+    private
+
+    def initialize(result, symbol)
+      @result = result
+      @symbol = symbol
+    end
+  end
+
+  def self.define_code(symbol, result)
+    return_value = ReturnValue.new(result, symbol)
+    self.const_set symbol, return_value
+
+    RETURN_VALUES[result] = return_value
+  end
+
+  define_code :CKR_OK,                                0x00000000
+  define_code :CKR_CANCEL,                            0x00000001
+  define_code :CKR_HOST_MEMORY,                       0x00000002
+  define_code :CKR_SLOT_ID_INVALID,                   0x00000003
+
+  define_code :CKR_GENERAL_ERROR,                     0x00000005
+  define_code :CKR_FUNCTION_FAILED,                   0x00000006
+
+  define_code :CKR_ARGUMENTS_BAD,                     0x00000007
+  define_code :CKR_NO_EVENT,                          0x00000008
+  define_code :CKR_NEED_TO_CREATE_THREADS,            0x00000009
+  define_code :CKR_CANT_LOCK,                         0x0000000A
+
+  define_code :CKR_ATTRIBUTE_READ_ONLY,               0x00000010
+  define_code :CKR_ATTRIBUTE_SENSITIVE,               0x00000011
+  define_code :CKR_ATTRIBUTE_TYPE_INVALID,            0x00000012
+  define_code :CKR_ATTRIBUTE_result_INVALID,           0x00000013
+  define_code :CKR_DATA_INVALID,                      0x00000020
+  define_code :CKR_DATA_LEN_RANGE,                    0x00000021
+  define_code :CKR_DEVICE_ERROR,                      0x00000030
+  define_code :CKR_DEVICE_MEMORY,                     0x00000031
+  define_code :CKR_DEVICE_REMOVED,                    0x00000032
+  define_code :CKR_ENCRYPTED_DATA_INVALID,            0x00000040
+  define_code :CKR_ENCRYPTED_DATA_LEN_RANGE,          0x00000041
+  define_code :CKR_FUNCTION_CANCELED,                 0x00000050
+  define_code :CKR_FUNCTION_NOT_PARALLEL,             0x00000051
+
+  define_code :CKR_FUNCTION_NOT_SUPPORTED,            0x00000054
+
+  define_code :CKR_KEY_HANDLE_INVALID,                0x00000060
+
+  define_code :CKR_KEY_SIZE_RANGE,                    0x00000062
+  define_code :CKR_KEY_TYPE_INCONSISTENT,             0x00000063
+
+  define_code :CKR_KEY_NOT_NEEDED,                    0x00000064
+  define_code :CKR_KEY_CHANGED,                       0x00000065
+  define_code :CKR_KEY_NEEDED,                        0x00000066
+  define_code :CKR_KEY_INDIGESTIBLE,                  0x00000067
+  define_code :CKR_KEY_FUNCTION_NOT_PERMITTED,        0x00000068
+  define_code :CKR_KEY_NOT_WRAPPABLE,                 0x00000069
+  define_code :CKR_KEY_UNEXTRACTABLE,                 0x0000006A
+
+  define_code :CKR_MECHANISM_INVALID,                 0x00000070
+  define_code :CKR_MECHANISM_PARAM_INVALID,           0x00000071
+
+  define_code :CKR_OBJECT_HANDLE_INVALID,             0x00000082
+  define_code :CKR_OPERATION_ACTIVE,                  0x00000090
+  define_code :CKR_OPERATION_NOT_INITIALIZED,         0x00000091
+  define_code :CKR_PIN_INCORRECT,                     0x000000A0
+  define_code :CKR_PIN_INVALID,                       0x000000A1
+  define_code :CKR_PIN_LEN_RANGE,                     0x000000A2
+
+  define_code :CKR_PIN_EXPIRED,                       0x000000A3
+  define_code :CKR_PIN_LOCKED,                        0x000000A4
+
+  define_code :CKR_SESSION_CLOSED,                    0x000000B0
+  define_code :CKR_SESSION_COUNT,                     0x000000B1
+  define_code :CKR_SESSION_HANDLE_INVALID,            0x000000B3
+  define_code :CKR_SESSION_PARALLEL_NOT_SUPPORTED,    0x000000B4
+  define_code :CKR_SESSION_READ_ONLY,                 0x000000B5
+  define_code :CKR_SESSION_EXISTS,                    0x000000B6
+
+  define_code :CKR_SESSION_READ_ONLY_EXISTS,          0x000000B7
+  define_code :CKR_SESSION_READ_WRITE_SO_EXISTS,      0x000000B8
+
+  define_code :CKR_SIGNATURE_INVALID,                 0x000000C0
+  define_code :CKR_SIGNATURE_LEN_RANGE,               0x000000C1
+  define_code :CKR_TEMPLATE_INCOMPLETE,               0x000000D0
+  define_code :CKR_TEMPLATE_INCONSISTENT,             0x000000D1
+  define_code :CKR_TOKEN_NOT_PRESENT,                 0x000000E0
+  define_code :CKR_TOKEN_NOT_RECOGNIZED,              0x000000E1
+  define_code :CKR_TOKEN_WRITE_PROTECTED,             0x000000E2
+  define_code :CKR_UNWRAPPING_KEY_HANDLE_INVALID,     0x000000F0
+  define_code :CKR_UNWRAPPING_KEY_SIZE_RANGE,         0x000000F1
+  define_code :CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT,  0x000000F2
+  define_code :CKR_USER_ALREADY_LOGGED_IN,            0x00000100
+  define_code :CKR_USER_NOT_LOGGED_IN,                0x00000101
+  define_code :CKR_USER_PIN_NOT_INITIALIZED,          0x00000102
+  define_code :CKR_USER_TYPE_INVALID,                 0x00000103
+
+  define_code :CKR_USER_ANOTHER_ALREADY_LOGGED_IN,    0x00000104
+  define_code :CKR_USER_TOO_MANY_TYPES,               0x00000105
+
+  define_code :CKR_WRAPPED_KEY_INVALID,               0x00000110
+  define_code :CKR_WRAPPED_KEY_LEN_RANGE,             0x00000112
+  define_code :CKR_WRAPPING_KEY_HANDLE_INVALID,       0x00000113
+  define_code :CKR_WRAPPING_KEY_SIZE_RANGE,           0x00000114
+  define_code :CKR_WRAPPING_KEY_TYPE_INCONSISTENT,    0x00000115
+  define_code :CKR_RANDOM_SEED_NOT_SUPPORTED,         0x00000120
+
+  define_code :CKR_RANDOM_NO_RNG,                     0x00000121
+
+  define_code :CKR_DOMAIN_PARAMS_INVALID,             0x00000130
+
+  define_code :CKR_BUFFER_TOO_SMALL,                  0x00000150
+  define_code :CKR_SAVED_STATE_INVALID,               0x00000160
+  define_code :CKR_INFORMATION_SENSITIVE,             0x00000170
+  define_code :CKR_STATE_UNSAVEABLE,                  0x00000180
+
+  define_code :CKR_CRYPTOKI_NOT_INITIALIZED,          0x00000190
+  define_code :CKR_CRYPTOKI_ALREADY_INITIALIZED,      0x00000191
+  define_code :CKR_MUTEX_BAD,                         0x000001A0
+  define_code :CKR_MUTEX_NOT_LOCKED,                  0x000001A1
+
+  define_code :CKR_NEW_PIN_MODE,                      0x000001B0
+  define_code :CKR_NEXT_OTP,                          0x000001B1
+
+  define_code :CKR_FUNCTION_REJECTED,                 0x00000200
+
+  define_code :CKR_VENDOR_DEFINED,                    0x80000000
+end

data/lib/ffi-pkcs11/session.rb

@@ -0,0 +1,64 @@
+module Pkcs11
+  class Session
+    def initialize
+      @session_pointer = FFI::MemoryPointer.new(:ulong)
+      @session_pointer.write_ulong(0)
+    end
+
+    def close
+      result = Pkcs11.C_CloseSession(session_handle)
+      check result
+
+      @session_pointer.write_ulong(0)
+    end
+
+    def closed?
+      @session_pointer.read_ulong == 0
+    end
+
+    def login(pin)
+      result = Pkcs11.C_Login(session_handle, Pkcs11::CKU_USER, pin, pin.size)
+      check result
+      if block_given?
+        begin
+          yield self
+        ensure
+          logout
+        end
+      end
+    end
+
+    def logout
+      result = Pkcs11::C_Logout(session_handle)
+      check result
+    end
+
+    def open(slot, flags = default_flags)
+      result = Pkcs11.C_OpenSession(slot,
+                                    flags,
+                                    nil, nil, @session_pointer)
+      check result
+      if block_given?
+        begin
+          yield self
+        ensure
+          close
+        end
+      end
+    end
+
+    def session_handle
+      @session_pointer.read_ulong
+    end
+
+    private
+
+    def check(result)
+      raise Pkcs11::Error.new(result.to_s) unless result == Pkcs11::CKR_OK
+    end
+
+    def default_flags
+      Pkcs11::CKF_RW_SESSION | Pkcs11::CKF_SERIAL_SESSION
+    end
+  end
+end

data/lib/ffi-pkcs11/version.rb

@@ -0,0 +1,3 @@
+module Pkcs11
+  VERSION = "0.2.0"
+end

metadata

@@ -0,0 +1,129 @@
+--- !ruby/object:Gem::Specification
+name: ffi-pkcs11
+version: !ruby/object:Gem::Version
+  version: 0.2.0
+platform: ruby
+authors:
+- Vincent Touchard
+autorequire: 
+bindir: exe
+cert_chain: []
+date: 2017-10-09 00:00:00.000000000 Z
+dependencies:
+- !ruby/object:Gem::Dependency
+  name: ffi
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.9'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.9'
+- !ruby/object:Gem::Dependency
+  name: bundler
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.13'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.13'
+- !ruby/object:Gem::Dependency
+  name: pry-byebug
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '0'
+- !ruby/object:Gem::Dependency
+  name: rake
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '10.0'
+- !ruby/object:Gem::Dependency
+  name: rspec
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+  type: :development
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '3.0'
+description: 
+email:
+- touchardv@gmail.com
+executables: []
+extensions: []
+extra_rdoc_files: []
+files:
+- ".gitignore"
+- ".rspec"
+- Gemfile
+- LICENSE.md
+- README.md
+- Rakefile
+- bin/console
+- bin/rspec
+- bin/setup
+- ffi-pkcs11.gemspec
+- lib/ffi-pkcs11.rb
+- lib/ffi-pkcs11/error.rb
+- lib/ffi-pkcs11/functions.rb
+- lib/ffi-pkcs11/return_value.rb
+- lib/ffi-pkcs11/session.rb
+- lib/ffi-pkcs11/version.rb
+homepage: https://github.com/touchardv/ffi-pkcs11
+licenses: []
+metadata: {}
+post_install_message: 
+rdoc_options: []
+require_paths:
+- lib
+required_ruby_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+required_rubygems_version: !ruby/object:Gem::Requirement
+  requirements:
+  - - ">="
+    - !ruby/object:Gem::Version
+      version: '0'
+requirements: []
+rubyforge_project: 
+rubygems_version: 2.6.13
+signing_key: 
+specification_version: 4
+summary: Minimalistic Ruby FFI bindings for using a "Cryptoki" (PKCS11) library.
+test_files: []