blob: d15a5825dc2d07f43f46fb38c0e10a3e054fc712 [file] [log] [blame]
// Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifndef ENTD_PKCS11_H_
#define ENTD_PKCS11_H_
#include <string>
#include <vector>
#include <base/basictypes.h>
#include <base/scoped_ptr.h>
#include <chromeos/utility.h>
#include <v8.h>
#include "entd/js_object_wrapper.h"
namespace entd {
class Certificate;
class CSR;
class CertificateHandler;
class SlotHandler;
class SlotObject;
class Pkcs11;
// Implementation class for interfacing with pkcs11 devices,
// including generation of Certificate Service Requests (CSR)
// with a hidden private key (e.g. stored in a TPM), and
// storage of encrypted Certificates in a device associated
// with a public/private key pair.
// Pure Interface class for defining PKCS11 slot handlers
class SlotHandler {
virtual ~SlotHandler() {}
virtual bool Initialize() = 0;
virtual bool SetUserPin(const std::string& pin) = 0;
virtual bool SetKeyIdentifier(const std::string& label,
const std::string& keyid) = 0;
virtual bool BuildSlotObject(const std::string& label) = 0;
virtual bool GenerateKeyPair(const std::string& label,
const std::string& passphrase) = 0;
virtual bool AddPrivateKey(const std::string& label,
const std::string& subject,
const chromeos::Blob& key) = 0;
virtual bool AddCertificate(const std::string& label,
const chromeos::Blob& cert,
const std::string& subject) = 0;
virtual bool ReadObjectsFromSlot(Pkcs11* pkcs11) = 0;
virtual bool RemoveObjects(const std::string& label) = 0;
virtual std::string GetKeyIdentifier(const std::string& label) const = 0;
virtual std::string GetPassphrase(const std::string& label) const = 0;
virtual std::string GetPublicKey(const std::string& label) const = 0;
virtual std::vector<std::string> GetObjectNames() const = 0;
// Pure Interface class for defining certificate handlers.
class CertificateHandler {
CertificateHandler() : slot_handler_(NULL) {}
virtual ~CertificateHandler() {}
virtual bool Initialize() = 0;
virtual bool BuildCSR(const std::string& label,
const std::string& subject,
std::string* csr) = 0;
virtual bool BuildCertificate(const std::string& content,
chromeos::Blob* certificate,
std::string* subject) = 0;
// SetSlotHandler() is called from Pkcs11::Initialize with its
// SlotHandler implementation for the benefit of certificate handlers
// that need access to the slot handler (e.g. for encryption).
void SetSlotHandler(SlotHandler* slot_handler) {
slot_handler_ = slot_handler;
SlotHandler* slot_handler() { return slot_handler_; }
SlotHandler* slot_handler_;
// Pkcs11 JavaScript Interface class.
// This class wraps a V8 singleton object to handle the PKCS11 interface.
class Pkcs11 : public JSObjectWrapper<Pkcs11> {
virtual ~Pkcs11();
// Initialize the instance (Must be called before using other methods.)
// Returns false if initialization fails fatally, in which case you should
// discard the object. May return true without fully initializing the
// object in the case that the requisite crypto libraries fail to
// initialize.
// If that happens IsReady() will return false. You should then
// invoke InitializeCrypto() later, before invoking any other functions.
virtual bool Initialize();
// Initialize the chosen crypto mode. Returns true if it is able to
// initialize crypto, false otherwise. You may call this multiple times.
// It's a no-op if crypto is already loaded, but will retry initialization
// if not.
bool InitializeCrypto();
// True if the crypto has been properly set up and the object is ready to
// use.
bool IsReady() { return handlers_ready_; }
// Adds slot_object to "pkcs11.slots"
bool AddJSSlotObject(const SlotObject* slot_object);
bool RemoveJSSlotObject(const std::string& label);
// JSObjectWrapper functions
static const char* GetClassName() { return "pkcs11"; }
static void SetTemplateBindings(
v8::Handle<v8::ObjectTemplate> template_object);
// Accessors for V8 callbacks
CertificateHandler* certificate_handler() {
return certificate_handler_.get();
SlotHandler* slot_handler() {
return slot_handler_.get();
// globals
static bool enable_opencryptoki;
scoped_ptr<CertificateHandler> certificate_handler_;
scoped_ptr<SlotHandler> slot_handler_;
bool handlers_ready_;
} // namespace entd
#endif // ENTD_PKCS11_H_