Further tweaks and cleanup for functions dealing with PKCS#11 attributes

 * Check that the size is correct when looking for a boolean
   or a ulong.
 * Make sure that the length is not the invalid negative ulong.
 * Functions for dumping out attribute contents
 * Make it possible to use attributes in hash tables

1 files changed, 755 insertions, 40 deletions

diff --git a/common/attrs.c b/common/attrs.c
index dd91afc..ab1bc59 100644
--- a/common/attrs.c
+++ b/common/attrs.c
@@ -36,22 +36,26 @@
 #include "config.h"
 
 #include "attrs.h"
+#include "buffer.h"
 #include "compat.h"
 #include "debug.h"
+#include "pkcs11.h"
+#include "pkcs11x.h"
 
 #include <assert.h>
 #include <stdarg.h>
+#include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 
-CK_BBOOL
-p11_attrs_is_empty (CK_ATTRIBUTE *attrs)
+bool
+p11_attrs_is_empty (const CK_ATTRIBUTE *attrs)
 {
 	return (attrs == NULL || attrs->type == CKA_INVALID);
 }
 
 CK_ULONG
-p11_attrs_count (CK_ATTRIBUTE *attrs)
+p11_attrs_count (const CK_ATTRIBUTE *attrs)
 {
 	CK_ULONG count;
 
@@ -169,7 +173,7 @@ template_generator (void *state)
 
 CK_ATTRIBUTE *
 p11_attrs_buildn (CK_ATTRIBUTE *attrs,
-                  CK_ATTRIBUTE *add,
+                  const CK_ATTRIBUTE *add,
                   CK_ULONG count)
 {
 	return attrs_build (attrs, count, true, template_generator, &add);
@@ -187,7 +191,7 @@ p11_attrs_take (CK_ATTRIBUTE *attrs,
 }
 
 CK_ATTRIBUTE *
-p11_attrs_dup (CK_ATTRIBUTE *attrs)
+p11_attrs_dup (const CK_ATTRIBUTE *attrs)
 {
 	CK_ULONG count;
 
@@ -224,7 +228,116 @@ p11_attrs_findn (CK_ATTRIBUTE *attrs,
 	return NULL;
 }
 
-CK_BBOOL
+bool
+p11_attrs_find_bool (CK_ATTRIBUTE *attrs,
+                     CK_ATTRIBUTE_TYPE type,
+                     CK_BBOOL *value)
+{
+	CK_ULONG i;
+
+	for (i = 0; !p11_attrs_is_empty (attrs + i); i++) {
+		if (attrs[i].type == type &&
+		    attrs[i].ulValueLen == sizeof (CK_BBOOL) &&
+		    attrs[i].pValue != NULL) {
+			*value = *((CK_BBOOL *)attrs[i].pValue);
+			return true;
+		}
+	}
+
+	return false;
+}
+
+bool
+p11_attrs_findn_bool (CK_ATTRIBUTE *attrs,
+                      CK_ULONG count,
+                      CK_ATTRIBUTE_TYPE type,
+                      CK_BBOOL *value)
+{
+	CK_ULONG i;
+
+	for (i = 0; i < count; i++) {
+		if (attrs[i].type == type &&
+		    attrs[i].ulValueLen == sizeof (CK_BBOOL) &&
+		    attrs[i].pValue != NULL) {
+			*value = *((CK_BBOOL *)attrs[i].pValue);
+			return true;
+		}
+	}
+
+	return false;
+}
+
+bool
+p11_attrs_find_ulong (CK_ATTRIBUTE *attrs,
+                      CK_ATTRIBUTE_TYPE type,
+                      CK_ULONG *value)
+{
+	CK_ULONG i;
+
+	for (i = 0; !p11_attrs_is_empty (attrs + i); i++) {
+		if (attrs[i].type == type &&
+		    attrs[i].ulValueLen == sizeof (CK_ULONG) &&
+		    attrs[i].pValue != NULL) {
+			*value = *((CK_ULONG *)attrs[i].pValue);
+			return true;
+		}
+	}
+
+	return false;
+}
+
+bool
+p11_attrs_findn_ulong (CK_ATTRIBUTE *attrs,
+                       CK_ULONG count,
+                       CK_ATTRIBUTE_TYPE type,
+                       CK_ULONG *value)
+{
+	CK_ULONG i;
+
+	for (i = 0; i < count; i++) {
+		if (attrs[i].type == type &&
+		    attrs[i].ulValueLen == sizeof (CK_ULONG) &&
+		    attrs[i].pValue != NULL) {
+			*value = *((CK_ULONG *)attrs[i].pValue);
+			return true;
+		}
+	}
+
+	return false;
+}
+
+CK_ATTRIBUTE *
+p11_attrs_find_valid (CK_ATTRIBUTE *attrs,
+                      CK_ATTRIBUTE_TYPE type)
+{
+	CK_ULONG i;
+
+	for (i = 0; !p11_attrs_is_empty (attrs + i); i++) {
+		if (attrs[i].type == type &&
+		    attrs[i].ulValueLen != (CK_ULONG)-1)
+			return attrs + i;
+	}
+
+	return NULL;
+}
+
+CK_ATTRIBUTE *
+p11_attrs_findn_valid (CK_ATTRIBUTE *attrs,
+                       CK_ULONG count,
+                       CK_ATTRIBUTE_TYPE type)
+{
+	CK_ULONG i;
+
+	for (i = 0; i < count; i++) {
+		if (attrs[i].type == type &&
+		    attrs[i].ulValueLen != (CK_ULONG)-1)
+			return attrs + i;
+	}
+
+	return NULL;
+}
+
+bool
 p11_attrs_remove (CK_ATTRIBUTE *attrs,
                   CK_ATTRIBUTE_TYPE type)
 {
@@ -238,73 +351,675 @@ p11_attrs_remove (CK_ATTRIBUTE *attrs,
 	}
 
 	if (i == count)
-		return CK_FALSE;
+		return false;
 
 	if (attrs[i].pValue)
 		free (attrs[i].pValue);
 
 	memmove (attrs + i, attrs + i + 1, (count - (i + 1)) * sizeof (CK_ATTRIBUTE));
 	attrs[count - 1].type = CKA_INVALID;
-	return CK_TRUE;
+	return true;
 }
 
-CK_BBOOL
-p11_attrs_match (CK_ATTRIBUTE *attrs,
-                 CK_ATTRIBUTE *match)
+bool
+p11_attrs_match (const CK_ATTRIBUTE *attrs,
+                 const CK_ATTRIBUTE *match)
 {
 	CK_ATTRIBUTE *attr;
 
 	for (; !p11_attrs_is_empty (match); match++) {
-		attr = p11_attrs_find (attrs, match->type);
+		attr = p11_attrs_find ((CK_ATTRIBUTE *)attrs, match->type);
 		if (!attr)
-			return CK_FALSE;
+			return false;
 		if (!p11_attr_equal (attr, match))
-			return CK_FALSE;
+			return false;
 	}
 
-	return CK_TRUE;
+	return true;
 }
 
-CK_BBOOL
-p11_attrs_matchn (CK_ATTRIBUTE *attrs,
-                  CK_ATTRIBUTE *match,
+bool
+p11_attrs_matchn (const CK_ATTRIBUTE *attrs,
+                  const CK_ATTRIBUTE *match,
                   CK_ULONG count)
 {
 	CK_ATTRIBUTE *attr;
 	CK_ULONG i;
 
 	for (i = 0; i < count; i++) {
-		attr = p11_attrs_find (attrs, match[i].type);
+		attr = p11_attrs_find ((CK_ATTRIBUTE *)attrs, match[i].type);
 		if (!attr)
-			return CK_FALSE;
+			return false;
 		if (!p11_attr_equal (attr, match + i))
-			return CK_FALSE;
+			return false;
 	}
 
-	return CK_TRUE;
+	return true;
+
+}
+
+
+bool
+p11_attr_match_value (const CK_ATTRIBUTE *attr,
+                      const void *value,
+                      ssize_t length)
+{
+	if (length < 0)
+		length = strlen (value);
+	return (attr != NULL &&
+	        attr->ulValueLen == length &&
+	        (attr->pValue == value ||
+	         (attr->pValue && value &&
+	          memcmp (attr->pValue, value, attr->ulValueLen) == 0)));
+}
+
+bool
+p11_attr_equal (const void *v1,
+                const void *v2)
+{
+	const CK_ATTRIBUTE *one = v1;
+	const CK_ATTRIBUTE *two = v2;
+
+	return (one == two ||
+		(one && two && one->type == two->type &&
+		 p11_attr_match_value (one, two->pValue, two->ulValueLen)));
+}
+
+unsigned int
+p11_attr_hash (const void *data)
+{
+	const CK_ATTRIBUTE *attr = data;
+	unsigned int hash = (unsigned int)attr->type;
+	const char *p, *end;
+
+	for (p = attr->pValue, end = p + attr->ulValueLen ; p != NULL && p != end; p++)
+		hash = (hash << 5) - hash + *p;
+
+	return hash;
+}
+
+static void
+buffer_append_printf (p11_buffer *buffer,
+                      const char *format,
+                      ...)
+{
+	char *string;
+	va_list va;
+
+	va_start (va, format);
+	if (vasprintf (&string, format, va) < 0)
+		return_if_reached ();
+	va_end (va);
 
+	p11_buffer_add (buffer, string, -1);
+	free (string);
+}
+
+static bool
+attribute_is_ulong_of_type (const CK_ATTRIBUTE *attr,
+                            CK_ULONG type)
+{
+	if (attr->type != type)
+		return false;
+	if (attr->ulValueLen != sizeof (CK_ULONG))
+		return false;
+	if (!attr->pValue)
+		return false;
+	return true;
+}
+
+static bool
+attribute_is_trust_value (const CK_ATTRIBUTE *attr)
+{
+	switch (attr->type) {
+	case CKA_TRUST_DIGITAL_SIGNATURE:
+	case CKA_TRUST_NON_REPUDIATION:
+	case CKA_TRUST_KEY_ENCIPHERMENT:
+	case CKA_TRUST_DATA_ENCIPHERMENT:
+	case CKA_TRUST_KEY_AGREEMENT:
+	case CKA_TRUST_KEY_CERT_SIGN:
+	case CKA_TRUST_CRL_SIGN:
+	case CKA_TRUST_SERVER_AUTH:
+	case CKA_TRUST_CLIENT_AUTH:
+	case CKA_TRUST_CODE_SIGNING:
+	case CKA_TRUST_EMAIL_PROTECTION:
+	case CKA_TRUST_IPSEC_END_SYSTEM:
+	case CKA_TRUST_IPSEC_TUNNEL:
+	case CKA_TRUST_IPSEC_USER:
+	case CKA_TRUST_TIME_STAMPING:
+		break;
+	default:
+		return false;
+	}
+
+	return attribute_is_ulong_of_type (attr, attr->type);
+}
+
+static bool
+attribute_is_sensitive (const CK_ATTRIBUTE *attr)
+{
+	/*
+	 * Don't print any just attribute, since they may contain
+	 * sensitive data
+	 */
+
+	switch (attr->type) {
+	#define X(x) case x: return false;
+	X (CKA_CLASS)
+	X (CKA_TOKEN)
+	X (CKA_PRIVATE)
+	X (CKA_LABEL)
+	X (CKA_APPLICATION)
+	X (CKA_OBJECT_ID)
+	X (CKA_CERTIFICATE_TYPE)
+	X (CKA_ISSUER)
+	X (CKA_SERIAL_NUMBER)
+	X (CKA_AC_ISSUER)
+	X (CKA_OWNER)
+	X (CKA_ATTR_TYPES)
+	X (CKA_TRUSTED)
+	X (CKA_CERTIFICATE_CATEGORY)
+	X (CKA_JAVA_MIDP_SECURITY_DOMAIN)
+	X (CKA_URL)
+	X (CKA_HASH_OF_SUBJECT_PUBLIC_KEY)
+	X (CKA_HASH_OF_ISSUER_PUBLIC_KEY)
+	X (CKA_CHECK_VALUE)
+	X (CKA_KEY_TYPE)
+	X (CKA_SUBJECT)
+	X (CKA_ID)
+	X (CKA_SENSITIVE)
+	X (CKA_ENCRYPT)
+	X (CKA_DECRYPT)
+	X (CKA_WRAP)
+	X (CKA_UNWRAP)
+	X (CKA_SIGN)
+	X (CKA_SIGN_RECOVER)
+	X (CKA_VERIFY)
+	X (CKA_VERIFY_RECOVER)
+	X (CKA_DERIVE)
+	X (CKA_START_DATE)
+	X (CKA_END_DATE)
+	X (CKA_MODULUS_BITS)
+	X (CKA_PRIME_BITS)
+	/* X (CKA_SUBPRIME_BITS) */
+	/* X (CKA_SUB_PRIME_BITS) */
+	X (CKA_VALUE_BITS)
+	X (CKA_VALUE_LEN)
+	X (CKA_EXTRACTABLE)
+	X (CKA_LOCAL)
+	X (CKA_NEVER_EXTRACTABLE)
+	X (CKA_ALWAYS_SENSITIVE)
+	X (CKA_KEY_GEN_MECHANISM)
+	X (CKA_MODIFIABLE)
+	X (CKA_SECONDARY_AUTH)
+	X (CKA_AUTH_PIN_FLAGS)
+	X (CKA_ALWAYS_AUTHENTICATE)
+	X (CKA_WRAP_WITH_TRUSTED)
+	X (CKA_WRAP_TEMPLATE)
+	X (CKA_UNWRAP_TEMPLATE)
+	X (CKA_HW_FEATURE_TYPE)
+	X (CKA_RESET_ON_INIT)
+	X (CKA_HAS_RESET)
+	X (CKA_PIXEL_X)
+	X (CKA_PIXEL_Y)
+	X (CKA_RESOLUTION)
+	X (CKA_CHAR_ROWS)
+	X (CKA_CHAR_COLUMNS)
+	X (CKA_COLOR)
+	X (CKA_BITS_PER_PIXEL)
+	X (CKA_CHAR_SETS)
+	X (CKA_ENCODING_METHODS)
+	X (CKA_MIME_TYPES)
+	X (CKA_MECHANISM_TYPE)
+	X (CKA_REQUIRED_CMS_ATTRIBUTES)
+	X (CKA_DEFAULT_CMS_ATTRIBUTES)
+	X (CKA_SUPPORTED_CMS_ATTRIBUTES)
+	X (CKA_ALLOWED_MECHANISMS)
+	X (CKA_X_ASSERTION_TYPE)
+	X (CKA_X_CERTIFICATE_VALUE)
+	X (CKA_X_PURPOSE)
+	X (CKA_X_PEER)
+	X (CKA_X_DISTRUSTED)
+	X (CKA_X_CRITICAL)
+	X (CKA_NETSCAPE_URL)
+	X (CKA_NETSCAPE_EMAIL)
+	X (CKA_NETSCAPE_SMIME_INFO)
+	X (CKA_NETSCAPE_SMIME_TIMESTAMP)
+	X (CKA_NETSCAPE_PKCS8_SALT)
+	X (CKA_NETSCAPE_PASSWORD_CHECK)
+	X (CKA_NETSCAPE_EXPIRES)
+	X (CKA_NETSCAPE_KRL)
+	X (CKA_NETSCAPE_PQG_COUNTER)
+	X (CKA_NETSCAPE_PQG_SEED)
+	X (CKA_NETSCAPE_PQG_H)
+	X (CKA_NETSCAPE_PQG_SEED_BITS)
+	X (CKA_NETSCAPE_MODULE_SPEC)
+	X (CKA_TRUST_DIGITAL_SIGNATURE)
+	X (CKA_TRUST_NON_REPUDIATION)
+	X (CKA_TRUST_KEY_ENCIPHERMENT)
+	X (CKA_TRUST_DATA_ENCIPHERMENT)
+	X (CKA_TRUST_KEY_AGREEMENT)
+	X (CKA_TRUST_KEY_CERT_SIGN)
+	X (CKA_TRUST_CRL_SIGN)
+	X (CKA_TRUST_SERVER_AUTH)
+	X (CKA_TRUST_CLIENT_AUTH)
+	X (CKA_TRUST_CODE_SIGNING)
+	X (CKA_TRUST_EMAIL_PROTECTION)
+	X (CKA_TRUST_IPSEC_END_SYSTEM)
+	X (CKA_TRUST_IPSEC_TUNNEL)
+	X (CKA_TRUST_IPSEC_USER)
+	X (CKA_TRUST_TIME_STAMPING)
+	X (CKA_TRUST_STEP_UP_APPROVED)
+	X (CKA_CERT_SHA1_HASH)
+	X (CKA_CERT_MD5_HASH)
+	#undef X
+	}
+
+	return true;
+}
+
+static void
+format_class (p11_buffer *buffer,
+              CK_OBJECT_CLASS klass)
+{
+	const char *string = NULL;
+
+	switch (klass) {
+	#define X(x) case x: string = #x; break;
+	X (CKO_DATA)
+	X (CKO_CERTIFICATE)
+	X (CKO_PUBLIC_KEY)
+	X (CKO_PRIVATE_KEY)
+	X (CKO_SECRET_KEY)
+	X (CKO_HW_FEATURE)
+	X (CKO_DOMAIN_PARAMETERS)
+	X (CKO_MECHANISM)
+	X (CKO_X_TRUST_ASSERTION)
+	X (CKO_X_CERTIFICATE_EXTENSION)
+	X (CKO_NETSCAPE_CRL)
+	X (CKO_NETSCAPE_SMIME)
+	X (CKO_NETSCAPE_TRUST)
+	X (CKO_NETSCAPE_BUILTIN_ROOT_LIST)
+	X (CKO_NETSCAPE_NEWSLOT)
+	X (CKO_NETSCAPE_DELSLOT)
+	#undef X
+	}
+
+	if (string != NULL)
+		p11_buffer_add (buffer, string, -1);
+	else
+		buffer_append_printf (buffer, "0x%08lX", klass);
+}
+
+static void
+format_assertion_type (p11_buffer *buffer,
+                       CK_X_ASSERTION_TYPE type)
+{
+	const char *string = NULL;
+
+	switch (type) {
+	#define X(x) case x: string = #x; break;
+	X (CKT_X_DISTRUSTED_CERTIFICATE)
+	X (CKT_X_PINNED_CERTIFICATE)
+	X (CKT_X_ANCHORED_CERTIFICATE)
+	#undef X
+	}
+
+	if (string != NULL)
+		p11_buffer_add (buffer, string, -1);
+	else
+		buffer_append_printf (buffer, "0x%08lX", type);
+}
+
+static void
+format_key_type (p11_buffer *buffer,
+                 CK_KEY_TYPE type)
+{
+	const char *string = NULL;
+
+	switch (type) {
+	#define X(x) case x: string = #x; break;
+	X (CKK_RSA)
+	X (CKK_DSA)
+	X (CKK_DH)
+	/* X (CKK_ECDSA) */
+	X (CKK_EC)
+	X (CKK_X9_42_DH)
+	X (CKK_KEA)
+	X (CKK_GENERIC_SECRET)
+	X (CKK_RC2)
+	X (CKK_RC4)
+	X (CKK_DES)
+	X (CKK_DES2)
+	X (CKK_DES3)
+	X (CKK_CAST)
+	X (CKK_CAST3)
+	X (CKK_CAST128)
+	X (CKK_RC5)
+	X (CKK_IDEA)
+	X (CKK_SKIPJACK)
+	X (CKK_BATON)
+	X (CKK_JUNIPER)
+	X (CKK_CDMF)
+	X (CKK_AES)
+	X (CKK_BLOWFISH)
+	X (CKK_TWOFISH)
+	X (CKK_NETSCAPE_PKCS8)
+	#undef X
+	}
+
+	if (string != NULL)
+		p11_buffer_add (buffer, string, -1);
+	else
+		buffer_append_printf (buffer, "0x%08lX", type);
+}
+
+static void
+format_certificate_type (p11_buffer *buffer,
+                         CK_CERTIFICATE_TYPE type)
+{
+	const char *string = NULL;
+
+	switch (type) {
+	#define X(x) case x: string = #x; break;
+	X (CKC_X_509)
+	X (CKC_X_509_ATTR_CERT)
+	X (CKC_WTLS)
+	}
+
+	if (string != NULL)
+		p11_buffer_add (buffer, string, -1);
+	else
+		buffer_append_printf (buffer, "0x%08lX", type);
+}
+
+static void
+format_trust_value (p11_buffer *buffer,
+                    CK_TRUST trust)
+{
+	const char *string = NULL;
+
+	switch (trust) {
+	#define X(x) case x: string = #x; break;
+	X (CKT_NETSCAPE_TRUSTED)
+	X (CKT_NETSCAPE_TRUSTED_DELEGATOR)
+	X (CKT_NETSCAPE_UNTRUSTED)
+	X (CKT_NETSCAPE_MUST_VERIFY)
+	X (CKT_NETSCAPE_TRUST_UNKNOWN)
+	}
+
+	if (string != NULL)
+		p11_buffer_add (buffer, string, -1);
+	else
+		buffer_append_printf (buffer, "0x%08lX", trust);
+}
+
+static void
+format_certificate_category (p11_buffer *buffer,
+                             CK_ULONG category)
+{
+	const char *string = NULL;
+
+	switch (category) {
+	case 0:
+		string = "unspecified";
+		break;
+	case 1:
+		string = "token-user";
+		break;
+	case 2:
+		string = "authority";
+		break;
+	case 3:
+		string = "other-entry";
+		break;
+	}
+
+	if (string != NULL)
+		buffer_append_printf (buffer, "%lu (%s)", category, string);
+	else
+		buffer_append_printf (buffer, "%lu", category);
+}
+
+static void
+format_attribute_type (p11_buffer *buffer,
+                       CK_ULONG type)
+{
+	const char *string = NULL;
+
+	switch (type) {
+	#define X(x) case x: string = #x; break;
+	X (CKA_CLASS)
+	X (CKA_TOKEN)
+	X (CKA_PRIVATE)
+	X (CKA_LABEL)
+	X (CKA_APPLICATION)
+	X (CKA_VALUE)
+	X (CKA_OBJECT_ID)
+	X (CKA_CERTIFICATE_TYPE)
+	X (CKA_ISSUER)
+	X (CKA_SERIAL_NUMBER)
+	X (CKA_AC_ISSUER)
+	X (CKA_OWNER)
+	X (CKA_ATTR_TYPES)
+	X (CKA_TRUSTED)
+	X (CKA_CERTIFICATE_CATEGORY)
+	X (CKA_JAVA_MIDP_SECURITY_DOMAIN)
+	X (CKA_URL)
+	X (CKA_HASH_OF_SUBJECT_PUBLIC_KEY)
+	X (CKA_HASH_OF_ISSUER_PUBLIC_KEY)
+	X (CKA_CHECK_VALUE)
+	X (CKA_KEY_TYPE)
+	X (CKA_SUBJECT)
+	X (CKA_ID)
+	X (CKA_SENSITIVE)
+	X (CKA_ENCRYPT)
+	X (CKA_DECRYPT)
+	X (CKA_WRAP)
+	X (CKA_UNWRAP)
+	X (CKA_SIGN)
+	X (CKA_SIGN_RECOVER)
+	X (CKA_VERIFY)
+	X (CKA_VERIFY_RECOVER)
+	X (CKA_DERIVE)
+	X (CKA_START_DATE)
+	X (CKA_END_DATE)
+	X (CKA_MODULUS)
+	X (CKA_MODULUS_BITS)
+	X (CKA_PUBLIC_EXPONENT)
+	X (CKA_PRIVATE_EXPONENT)
+	X (CKA_PRIME_1)
+	X (CKA_PRIME_2)
+	X (CKA_EXPONENT_1)
+	X (CKA_EXPONENT_2)
+	X (CKA_COEFFICIENT)
+	X (CKA_PRIME)
+	X (CKA_SUBPRIME)
+	X (CKA_BASE)
+	X (CKA_PRIME_BITS)
+	/* X (CKA_SUBPRIME_BITS) */
+	/* X (CKA_SUB_PRIME_BITS) */
+	X (CKA_VALUE_BITS)
+	X (CKA_VALUE_LEN)
+	X (CKA_EXTRACTABLE)
+	X (CKA_LOCAL)
+	X (CKA_NEVER_EXTRACTABLE)
+	X (CKA_ALWAYS_SENSITIVE)
+	X (CKA_KEY_GEN_MECHANISM)
+	X (CKA_MODIFIABLE)
+	X (CKA_ECDSA_PARAMS)
+	/* X (CKA_EC_PARAMS) */
+	X (CKA_EC_POINT)
+	X (CKA_SECONDARY_AUTH)
+	X (CKA_AUTH_PIN_FLAGS)
+	X (CKA_ALWAYS_AUTHENTICATE)
+	X (CKA_WRAP_WITH_TRUSTED)
+	X (CKA_WRAP_TEMPLATE)
+	X (CKA_UNWRAP_TEMPLATE)
+	X (CKA_HW_FEATURE_TYPE)
+	X (CKA_RESET_ON_INIT)
+	X (CKA_HAS_RESET)
+	X (CKA_PIXEL_X)
+	X (CKA_PIXEL_Y)
+	X (CKA_RESOLUTION)
+	X (CKA_CHAR_ROWS)
+	X (CKA_CHAR_COLUMNS)
+	X (CKA_COLOR)
+	X (CKA_BITS_PER_PIXEL)
+	X (CKA_CHAR_SETS)
+	X (CKA_ENCODING_METHODS)
+	X (CKA_MIME_TYPES)
+	X (CKA_MECHANISM_TYPE)
+	X (CKA_REQUIRED_CMS_ATTRIBUTES)
+	X (CKA_DEFAULT_CMS_ATTRIBUTES)
+	X (CKA_SUPPORTED_CMS_ATTRIBUTES)
+	X (CKA_ALLOWED_MECHANISMS)
+	X (CKA_X_ASSERTION_TYPE)
+	X (CKA_X_CERTIFICATE_VALUE)
+	X (CKA_X_PURPOSE)
+	X (CKA_X_PEER)
+	X (CKA_X_DISTRUSTED)
+	X (CKA_X_CRITICAL)
+	X (CKA_NETSCAPE_URL)
+	X (CKA_NETSCAPE_EMAIL)
+	X (CKA_NETSCAPE_SMIME_INFO)
+	X (CKA_NETSCAPE_SMIME_TIMESTAMP)
+	X (CKA_NETSCAPE_PKCS8_SALT)
+	X (CKA_NETSCAPE_PASSWORD_CHECK)
+	X (CKA_NETSCAPE_EXPIRES)
+	X (CKA_NETSCAPE_KRL)
+	X (CKA_NETSCAPE_PQG_COUNTER)
+	X (CKA_NETSCAPE_PQG_SEED)
+	X (CKA_NETSCAPE_PQG_H)
+	X (CKA_NETSCAPE_PQG_SEED_BITS)
+	X (CKA_NETSCAPE_MODULE_SPEC)
+	X (CKA_TRUST_DIGITAL_SIGNATURE)
+	X (CKA_TRUST_NON_REPUDIATION)
+	X (CKA_TRUST_KEY_ENCIPHERMENT)
+	X (CKA_TRUST_DATA_ENCIPHERMENT)
+	X (CKA_TRUST_KEY_AGREEMENT)
+	X (CKA_TRUST_KEY_CERT_SIGN)
+	X (CKA_TRUST_CRL_SIGN)
+	X (CKA_TRUST_SERVER_AUTH)
+	X (CKA_TRUST_CLIENT_AUTH)
+	X (CKA_TRUST_CODE_SIGNING)
+	X (CKA_TRUST_EMAIL_PROTECTION)
+	X (CKA_TRUST_IPSEC_END_SYSTEM)
+	X (CKA_TRUST_IPSEC_TUNNEL)
+	X (CKA_TRUST_IPSEC_USER)
+	X (CKA_TRUST_TIME_STAMPING)
+	X (CKA_TRUST_STEP_UP_APPROVED)
+	X (CKA_CERT_SHA1_HASH)
+	X (CKA_CERT_MD5_HASH)
+	#undef X
+	}
+
+	if (string != NULL)
+		p11_buffer_add (buffer, string, -1);
+	else
+		buffer_append_printf (buffer, "CKA_0x%08lX", type);
+}
+
+static void
+format_some_bytes (p11_buffer *buffer,
+                   void *bytes,
+                   CK_ULONG length)
+{
+	unsigned char ch;
+	const unsigned char *data = bytes;
+	CK_ULONG i;
+
+	if (bytes == NULL) {
+		p11_buffer_add (buffer, "NULL", -1);
+		return;
+	}
+
+	p11_buffer_add (buffer, "\"", 1);
+	for (i = 0; i < length && i < 128; i++) {
+		ch = data[i];
+		if (ch == '\t')
+			p11_buffer_add (buffer, "\\t", -1);
+		else if (ch == '\n')
+			p11_buffer_add (buffer, "\\n", -1);
+		else if (ch == '\r')
+			p11_buffer_add (buffer, "\\r", -1);
+		else if (ch >= 32 && ch < 127)
+			p11_buffer_add (buffer, &ch, 1);
+		else
+			buffer_append_printf (buffer, "\\x%02x", ch);
+	}
+
+	if (i < length)
+		buffer_append_printf (buffer, "...");
+	p11_buffer_add (buffer, "\"", 1);
+}
+
+static void
+format_attribute (p11_buffer *buffer,
+                  const CK_ATTRIBUTE *attr)
+{
+	p11_buffer_add (buffer, "{ ", -1);
+	format_attribute_type (buffer, attr->type);
+	p11_buffer_add (buffer, " = ", -1);
+	if (attr->ulValueLen == CKA_INVALID) {
+		buffer_append_printf (buffer, "(-1) INVALID");
+	} else if (attribute_is_ulong_of_type (attr, CKA_CLASS)) {
+		format_class (buffer, *((CK_OBJECT_CLASS *)attr->pValue));
+	} else if (attribute_is_ulong_of_type (attr, CKA_X_ASSERTION_TYPE)) {
+		format_assertion_type (buffer, *((CK_X_ASSERTION_TYPE *)attr->pValue));
+	} else if (attribute_is_ulong_of_type (attr, CKA_CERTIFICATE_TYPE)) {
+		format_certificate_type (buffer, *((CK_CERTIFICATE_TYPE *)attr->pValue));
+	} else if (attribute_is_ulong_of_type (attr, CKA_CERTIFICATE_CATEGORY)) {
+		format_certificate_category (buffer, *((CK_ULONG *)attr->pValue));
+	} else if (attribute_is_ulong_of_type (attr, CKA_KEY_TYPE)) {
+		format_key_type (buffer, *((CK_KEY_TYPE *)attr->pValue));
+	} else if (attribute_is_trust_value (attr)) {
+		format_trust_value (buffer, *((CK_TRUST *)attr->pValue));
+	} else if (attribute_is_sensitive (attr)) {
+		buffer_append_printf (buffer, "(%lu) NOT-PRINTED", attr->ulValueLen);
+	} else {
+		buffer_append_printf (buffer, "(%lu) ", attr->ulValueLen);
+		format_some_bytes (buffer, attr->pValue, attr->ulValueLen);
+	}
+	p11_buffer_add (buffer, " }", -1);
+}
+
+static void
+format_attributes (p11_buffer *buffer,
+                   const CK_ATTRIBUTE *attrs)
+{
+	CK_BBOOL first = CK_TRUE;
+	int count, i;
+
+	count = p11_attrs_count (attrs);
+	buffer_append_printf (buffer, "(%d) [", count);
+	for (i = 0; i < count; i++) {
+		if (first)
+			p11_buffer_add (buffer, " ", 1);
+		else
+			p11_buffer_add (buffer, ", ", 2);
+		first = CK_FALSE;
+		format_attribute (buffer, attrs + i);
+	}
+	p11_buffer_add (buffer, " ]", -1);
 }
 
-CK_BBOOL
-p11_attr_match_boolean (CK_ATTRIBUTE *attr,
-                        CK_BBOOL value)
+char *
+p11_attrs_to_string (const CK_ATTRIBUTE *attrs)
 {
-	return (attr->ulValueLen == sizeof (value) &&
-	        attr->pValue != NULL &&
-	        memcmp (attr->pValue, &value, sizeof (value)) == 0);
+	p11_buffer buffer;
+	if (!p11_buffer_init_null (&buffer, 128))
+		return_val_if_reached (NULL);
+	format_attributes (&buffer, attrs);
+	return p11_buffer_steal (&buffer, NULL);
 }
 
-CK_BBOOL
-p11_attr_equal (CK_ATTRIBUTE *one,
-                CK_ATTRIBUTE *two)
+char *
+p11_attr_to_string (const CK_ATTRIBUTE *attr)
 {
-	if (one == two)
-		return CK_TRUE;
-	if (!one || !two || one->type != two->type || one->ulValueLen != two->ulValueLen)
-		return CK_FALSE;
-	if (one->pValue == two->pValue)
-		return TRUE;
-	if (!one->pValue || !two->pValue)
-		return FALSE;
-	return memcmp (one->pValue, two->pValue, one->ulValueLen) == 0;
+	p11_buffer buffer;
+	if (!p11_buffer_init_null (&buffer, 32))
+		return_val_if_reached (NULL);
+	format_attribute (&buffer, attr);
+	return p11_buffer_steal (&buffer, NULL);
 }