1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
|
/*
* Copyright (C) 2011 Free Software Foundation, Inc.
* Author: Nikos Mavrogiannopoulos
*
* This file is part of GnuTLS.
*
* GnuTLS is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* GnuTLS is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <config.h>
#include <getpass.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <gnutls/pkcs11.h>
#include <p11common.h>
#define MIN(x,y) ((x)<(y))?(x):(y)
#define MAX_CACHE_TRIES 5
static int
pin_callback (void *user, int attempt, const char *token_url,
const char *token_label, unsigned int flags, char *pin,
size_t pin_max)
{
const char *password;
const char * desc;
int len, cache = MAX_CACHE_TRIES;
/* allow caching of PIN */
static char *cached_url = NULL;
static char cached_pin[32] = "";
if (flags & GNUTLS_PKCS11_PIN_SO)
desc = "security officer";
else
desc = "user";
if (flags & GNUTLS_PKCS11_PIN_FINAL_TRY)
{
cache = 0;
printf ("*** This is the final try before locking!\n");
}
if (flags & GNUTLS_PKCS11_PIN_COUNT_LOW)
{
cache = 0;
printf ("*** Only few tries left before locking!\n");
}
if (cache > 0 && cached_url != NULL)
{
if (strcmp (cached_url, token_url) == 0)
{
if (strlen(pin) >= sizeof(cached_pin))
{
fprintf (stderr, "Too long PIN given\n");
exit (1);
}
strcpy (pin, cached_pin);
cache--;
return 0;
}
}
printf ("Token '%s' with URL '%s' ", token_label, token_url);
printf ("requires %s PIN\n", desc);
password = getpass ("Enter PIN: ");
if (password == NULL || password[0] == 0)
{
fprintf (stderr, "No password given\n");
exit (1);
}
len = MIN (pin_max, strlen (password));
memcpy (pin, password, len);
pin[len] = 0;
/* cache */
strcpy (cached_pin, pin);
free (cached_url);
cached_url = strdup (token_url);
cache = MAX_CACHE_TRIES;
return 0;
}
static int
token_callback (void *user, const char *label, const unsigned retry)
{
char buf[32];
char *p;
if (retry > 0)
{
fprintf (stderr, "Could not find token %s\n", label);
return -1;
}
printf ("Please insert token '%s' in slot and press enter\n", label);
p = fgets (buf, sizeof (buf), stdin);
if (p==NULL) return -1;
return 0;
}
void
pkcs11_common (void)
{
gnutls_pkcs11_set_pin_function (pin_callback, NULL);
gnutls_pkcs11_set_token_function (token_callback, NULL);
}
|
