@@ -3,6 +3,10 @@ Copyright (C) 2002-2005 OpenVPN Solutions LLC <info@openvpn.net>

 $Id$

+2005.10.xx -- Version 2.1-beta5

+

+* More PKCS#11 additions/changes (Alon Bar-Lev).

+

 2005.10.17 -- Version 2.1-beta4

 * Fixed bug introduced in 2.1-beta3 where management

@@ -25,7 +25,7 @@ dnl Process this file with autoconf to produce a configure script.

 AC_PREREQ(2.50)

-AC_INIT([OpenVPN], [2.1_beta4], [openvpn-users@lists.sourceforge.net], [openvpn])

+AC_INIT([OpenVPN], [2.1_beta5], [openvpn-users@lists.sourceforge.net], [openvpn])

 AM_CONFIG_HEADER(config.h)

 AC_CONFIG_SRCDIR(syshead.h)

@@ -111,15 +111,16 @@ context_init_1 (struct context *c)

   /* Certificate password input */

   if (c->options.key_pass_file)

     pem_password_setup (c->options.key_pass_file);

+#endif

 #if defined(ENABLE_PKCS11)

   {

     int i;

+    init_pkcs11 (c->options.pkcs11_pin_cache_period);

     for (i=0;i<MAX_PARMS && c->options.pkcs11_providers[i] != NULL;i++)

      add_pkcs11 (c->options.pkcs11_providers[i], c->options.pkcs11_sign_mode[i]);

   }

 #endif

-#endif

 #if P2MP

   /* Auth user/pass input */

@@ -232,13 +233,11 @@ uninit_static (void)

 #ifdef USE_CRYPTO

   free_ssl_lib ();

+#endif

-#ifdef USE_SSL

 #ifdef ENABLE_PKCS11

   free_pkcs11 ();

 #endif

-#endif

-#endif

 #if defined(MEASURE_TLS_HANDSHAKE_STATS) && defined(USE_CRYPTO) && defined(USE_SSL)

   show_tls_performance_stats ();

@@ -375,6 +374,11 @@ possibly_become_daemon (const struct options *options, const bool first_time)

 	msg (M_ERR, "daemon() failed");

       if (options->log)

 	set_std_files_to_null (true);

+

+#if defined(ENABLE_PKCS11)

+      fork_fix_pkcs11 ();

+#endif

+

       ret = true;

     }

   return ret;

@@ -425,24 +425,6 @@ static const char usage_message[] =

   "--key file      : Local private key in .pem format.\n"

   "--pkcs12 file   : PKCS#12 file containing local private key, local certificate\n"

   "                  and optionally the root CA certificate.\n"

-#ifdef ENABLE_PKCS11

-  "--pkcs11-providers provider ... : PKCS#11 provider to load.\n"

-  "--pkcs11-sign-mode mode ... : PKCS#11 signature method.\n"

-  "                              auto    : Try  to determind automatically (default).\n"

-  "                              recover : Use SignRecover.\n"

-  "                              sign    : Use Sign.\n"

-  "--pkcs11-slot-type method   : Slot locate method:\n"

-  "                              id      : By slot id (numeric [prov#:]slot#).\n"

-  "                              name    : By slot name.\n"

-  "                              label   : By the card label that resides in slot.\n"

-  "--pkcs11-slot name          : The slot name.\n"

-  "--pkcs11-id-type method     : Certificate and key locate method:\n"

-  "                              id      : By the object id (hex format).\n"

-  "                              label   : By the object label (string).\n"

-  "                              subject : By certificate subject (String).\n"

-  "--pkcs11-id name            : The object name.\n"

-  "--pkcs11-protected-authentication : Use PKCS#11 protected authentication path.\n"

-#endif

 #ifdef WIN32

   "--cryptoapicert select-string : Load the certificate and private key from the\n"

   "                  Windows Certificate System Store.\n"

@@ -479,7 +461,29 @@ static const char usage_message[] =

   "--ns-cert-type t: Require that peer certificate was signed with an explicit\n"

   "                  nsCertType designation t = 'client' | 'server'.\n"

 #endif				/* USE_SSL */

+#ifdef ENABLE_PKCS11

   "\n"

+  "PKCS#11 Options:\n"

+  "--pkcs11-providers provider ... : PKCS#11 provider to load.\n"

+  "--pkcs11-sign-mode mode ... : PKCS#11 signature method.\n"

+  "                              auto    : Try  to determind automatically (default).\n"

+  "                              recover : Use SignRecover.\n"

+  "                              sign    : Use Sign.\n"

+  "--pkcs11-slot-type method   : Slot locate method:\n"

+  "                              id      : By slot id (numeric [prov#:]slot#).\n"

+  "                              name    : By slot name.\n"

+  "                              label   : By the card label that resides in slot.\n"

+  "--pkcs11-slot name          : The slot name.\n"

+  "--pkcs11-id-type method     : Certificate and key locate method:\n"

+  "                              id      : By the object id (hex format).\n"

+  "                              label   : By the object label (string).\n"

+  "                              subject : By certificate subject (String).\n"

+  "--pkcs11-id name            : The object name.\n"

+  "--pkcs11-pin-cache seconds  : Number of seconds to cache PIN. The default is -1\n"

+  "                              cache until token removed.\n"

+  "--pkcs11-protected-authentication : Use PKCS#11 protected authentication path.\n"

+#endif			/* ENABLE_PKCS11 */

+ "\n"

   "SSL Library information:\n"

   "--show-ciphers  : Show cipher algorithms to use with --cipher option.\n"

   "--show-digests  : Show message digest algorithms to use with --auth option.\n"

@@ -554,14 +558,12 @@ static const char usage_message[] =

   "--dev tunX|tapX : tun/tap device\n"

   "--dev-type dt   : Device type.  See tunnel options above for details.\n"

 #endif

-#ifdef USE_SSL

 #ifdef ENABLE_PKCS11

   "\n"

-  "PKCS#11 specific:\n"

+  "PKCS#11 standalone options:\n"

   "--show-pkcs11-slots provider        : Show PKCS#11 provider available slots.\n"

   "--show-pkcs11-objects provider slot : Show PKCS#11 token objects.\n" 

-#endif

-#endif

+#endif				/* ENABLE_PKCS11 */

  ;

 #endif /* !ENABLE_SMALL */

@@ -646,11 +648,12 @@ init_options (struct options *o)

   o->renegotiate_seconds = 3600;

   o->handshake_window = 60;

   o->transition_window = 3600;

-#ifdef ENABLE_PKCS11

-  o->pkcs11_protected_authentication = false;

-#endif

 #endif

 #endif

+#ifdef ENABLE_PKCS11

+  o->pkcs11_pin_cache_period = -1;

+  o->pkcs11_protected_authentication = false;

+#endif			/* ENABLE_PKCS11 */

 }

 void

@@ -1178,23 +1181,6 @@ show_settings (const struct options *o)

   SHOW_STR (cert_file);

   SHOW_STR (priv_key_file);

   SHOW_STR (pkcs12_file);

-#ifdef ENABLE_PKCS11

-  {

-    int i;

-    for (i=0;i<MAX_PARMS && o->pkcs11_providers[i] != NULL;i++)

-      SHOW_PARM (pkcs11_providers, o->pkcs11_providers[i], "%s");

-  }

-  {

-    int i;

-    for (i=0;i<MAX_PARMS && o->pkcs11_sign_mode[i] != NULL;i++)

-      SHOW_PARM (pkcs11_sign_mode, o->pkcs11_sign_mode[i], "%s");

-  }

-  SHOW_STR (pkcs11_slot_type);

-  SHOW_STR (pkcs11_slot);

-  SHOW_STR (pkcs11_id_type);

-  SHOW_STR (pkcs11_id);

-  SHOW_BOOL (pkcs11_protected_authentication);

-#endif

 #ifdef WIN32

   SHOW_STR (cryptoapi_cert);

 #endif

@@ -1220,6 +1206,25 @@ show_settings (const struct options *o)

 #endif

 #endif

+#ifdef ENABLE_PKCS11

+  {

+    int i;

+    for (i=0;i<MAX_PARMS && o->pkcs11_providers[i] != NULL;i++)

+      SHOW_PARM (pkcs11_providers, o->pkcs11_providers[i], "%s");

+  }

+  {

+    int i;

+    for (i=0;i<MAX_PARMS && o->pkcs11_sign_mode[i] != NULL;i++)

+      SHOW_PARM (pkcs11_sign_mode, o->pkcs11_sign_mode[i], "%s");

+  }

+  SHOW_STR (pkcs11_slot_type);

+  SHOW_STR (pkcs11_slot);

+  SHOW_STR (pkcs11_id_type);

+  SHOW_STR (pkcs11_id);

+  SHOW_INT (pkcs11_pin_cache_period);

+  SHOW_BOOL (pkcs11_protected_authentication);

+#endif			/* ENABLE_PKCS11 */

+

 #if P2MP

   show_p2mp_parms (o);

 #endif

@@ -1702,11 +1707,6 @@ options_postprocess (struct options *options, bool first_time)

 	notnull (options->pkcs11_id, "PKCS#11 id (--pkcs11-id)");

-	if (options->pkcs11_protected_authentication && options->key_pass_file != NULL)

-	  msg(M_USAGE, "Parameter --askpass cannot be used when --pkcs11-protected-authentication is also specified.");

-	if (!options->pkcs11_protected_authentication && options->key_pass_file == NULL)

-	  msg (M_USAGE, "Please specify one of --askpass or --pkcs11-protected-autentication options.");

-

 	if (options->cert_file)

 	  msg(M_USAGE, "Parameter --cert cannot be used when --pkcs11-provider is also specified.");

 	if (options->priv_key_file)

@@ -4733,83 +4733,6 @@ add_option (struct options *options,

       VERIFY_PERMISSION (OPT_P_GENERAL);

       options->cert_file = p[1];

     }

-#ifdef ENABLE_PKCS11

-  else if (streq (p[0], "show-pkcs11-slots") && p[1])

-    {

-      char *module =  p[i++];

-      VERIFY_PERMISSION (OPT_P_GENERAL);

-      show_pkcs11_slots (M_INFO|M_NOPREFIX, M_WARN|M_NOPREFIX, module);

-      openvpn_exit (OPENVPN_EXIT_STATUS_GOOD); /* exit point */

-    }

-  else if (streq (p[0], "show-pkcs11-objects") && p[1] && p[2])

-    {

-      char *provider =  p[i++];

-      char *slot = p[i++];

-      struct gc_arena gc = gc_new ();

-      struct buffer pass_prompt = alloc_buf_gc (128, &gc);

-      char pin[256];

-

-      VERIFY_PERMISSION (OPT_P_GENERAL);

-

-      buf_printf (&pass_prompt, "PIN:");

-

-      if (!get_console_input (BSTR (&pass_prompt), false, pin, sizeof (pin)))

-        msg (M_FATAL, "Cannot read password from stdin");

-      

-      gc_free (&gc);

-      

-      show_pkcs11_objects (M_INFO|M_NOPREFIX, M_WARN|M_NOPREFIX, provider, slot, pin);

-      openvpn_exit (OPENVPN_EXIT_STATUS_GOOD); /* exit point */

-    }

-  else if (streq (p[0], "pkcs11-providers") && p[1])

-    {

-      int j;

-      

-      VERIFY_PERMISSION (OPT_P_GENERAL);

-

-      for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j, ++i)

-      	options->pkcs11_providers[j-1] = p[j];

-    }

-  else if (streq (p[0], "pkcs11-sign-mode") && p[1])

-    {

-      int j;

-      

-      VERIFY_PERMISSION (OPT_P_GENERAL);

-

-      for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j, ++i)

-      	options->pkcs11_sign_mode[j-1] = p[j];

-    }

-  else if (streq (p[0], "pkcs11-slot-type") && p[1])

-    {

-      ++i;

-      VERIFY_PERMISSION (OPT_P_GENERAL);

-      options->pkcs11_slot_type = p[1];

-    }

-  else if (streq (p[0], "pkcs11-slot") && p[1])

-    {

-      ++i;

-      VERIFY_PERMISSION (OPT_P_GENERAL);

-      options->pkcs11_slot = p[1];

-    }

-  else if (streq (p[0], "pkcs11-id-type") && p[1])

-    {

-      ++i;

-      VERIFY_PERMISSION (OPT_P_GENERAL);

-      options->pkcs11_id_type = p[1];

-    }

-  else if (streq (p[0], "pkcs11-id") && p[1])

-    {

-      ++i;

-      VERIFY_PERMISSION (OPT_P_GENERAL);

-      options->pkcs11_id = p[1];

-    }

-  else if (streq (p[0], "pkcs11-protected-authentication"))

-    {

-      ++i;

-      VERIFY_PERMISSION (OPT_P_GENERAL);

-      options->pkcs11_protected_authentication = true;

-    }

-#endif

 #ifdef WIN32

   else if (streq (p[0], "cryptoapicert") && p[1])

     {

@@ -4968,6 +4891,89 @@ add_option (struct options *options,

     }

 #endif /* USE_SSL */

 #endif /* USE_CRYPTO */

+#ifdef ENABLE_PKCS11

+  else if (streq (p[0], "show-pkcs11-slots") && p[1])

+    {

+      char *module =  p[i++];

+      VERIFY_PERMISSION (OPT_P_GENERAL);

+      show_pkcs11_slots (M_INFO|M_NOPREFIX, M_WARN|M_NOPREFIX, module);

+      openvpn_exit (OPENVPN_EXIT_STATUS_GOOD); /* exit point */

+    }

+  else if (streq (p[0], "show-pkcs11-objects") && p[1] && p[2])

+    {

+      char *provider =  p[i++];

+      char *slot = p[i++];

+      struct gc_arena gc = gc_new ();

+      struct buffer pass_prompt = alloc_buf_gc (128, &gc);

+      char pin[256];

+

+      VERIFY_PERMISSION (OPT_P_GENERAL);

+

+      buf_printf (&pass_prompt, "PIN:");

+

+      if (!get_console_input (BSTR (&pass_prompt), false, pin, sizeof (pin)))

+        msg (M_FATAL, "Cannot read password from stdin");

+      

+      gc_free (&gc);

+      

+      show_pkcs11_objects (M_INFO|M_NOPREFIX, M_WARN|M_NOPREFIX, provider, slot, pin);

+      openvpn_exit (OPENVPN_EXIT_STATUS_GOOD); /* exit point */

+    }

+  else if (streq (p[0], "pkcs11-providers") && p[1])

+    {

+      int j;

+      

+      VERIFY_PERMISSION (OPT_P_GENERAL);

+

+      for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j, ++i)

+      	options->pkcs11_providers[j-1] = p[j];

+    }

+  else if (streq (p[0], "pkcs11-sign-mode") && p[1])

+    {

+      int j;

+      

+      VERIFY_PERMISSION (OPT_P_GENERAL);

+

+      for (j = 1; j < MAX_PARMS && p[j] != NULL; ++j, ++i)

+      	options->pkcs11_sign_mode[j-1] = p[j];

+    }

+  else if (streq (p[0], "pkcs11-slot-type") && p[1])

+    {

+      ++i;

+      VERIFY_PERMISSION (OPT_P_GENERAL);

+      options->pkcs11_slot_type = p[1];

+    }

+  else if (streq (p[0], "pkcs11-slot") && p[1])

+    {

+      ++i;

+      VERIFY_PERMISSION (OPT_P_GENERAL);

+      options->pkcs11_slot = p[1];

+    }

+  else if (streq (p[0], "pkcs11-id-type") && p[1])

+    {

+      ++i;

+      VERIFY_PERMISSION (OPT_P_GENERAL);

+      options->pkcs11_id_type = p[1];

+    }

+  else if (streq (p[0], "pkcs11-id") && p[1])

+    {

+      ++i;

+      VERIFY_PERMISSION (OPT_P_GENERAL);

+      options->pkcs11_id = p[1];

+    }

+   else if (streq (p[0], "pkcs11-pin-cache") && p[1])

+    {

+      ++i;

+      VERIFY_PERMISSION (OPT_P_GENERAL);

+      options->pkcs11_pin_cache_period = atoi (p[1]);

+    }

+  else if (streq (p[0], "pkcs11-protected-authentication"))

+    {

+      ++i;

+      VERIFY_PERMISSION (OPT_P_GENERAL);

+      options->pkcs11_protected_authentication = true;

+    }

+#endif

 #ifdef TUNSETPERSIST

   else if (streq (p[0], "rmtun"))

     {

@@ -385,6 +385,7 @@ struct options

   const char *pkcs11_slot;

   const char *pkcs11_id_type;

   const char *pkcs11_id;

+  int pkcs11_pin_cache_period;

   bool pkcs11_protected_authentication;

 #ifdef WIN32

   const char *cryptoapi_cert;

@@ -58,6 +58,12 @@

 #include "pkcs11.h"

 /*===========================================

+ * MACROS

+ */

+

+#define snprintf openvpn_snprintf

+

+/*===========================================

  * Constants

  */

@@ -78,6 +84,25 @@

  * Types

  */

+typedef bool (*pkcs11_hook_card_prompt_t)(

+	IN const void *pData,

+	IN const char * const szLabel

+);

+

+typedef bool (*pkcs11_hook_pin_prompt_t)(

+	IN const void *pData,

+	IN const char * const szLabel,

+	OUT char * const szPIN,

+	IN const size_t nMaxPIN

+);

+	

+typedef struct pkcs11_hooks_s {

+	void *card_prompt_data;

+	void *pin_prompt_data;

+	pkcs11_hook_card_prompt_t card_prompt;

+	pkcs11_hook_pin_prompt_t pin_prompt;

+} *pkcs11_hooks_t;

+

 typedef struct pkcs11_provider_s {

 	struct pkcs11_provider_s *next;

@@ -91,27 +116,39 @@ typedef struct pkcs11_provider_s {

 	CK_FUNCTION_LIST_PTR f;

 	bool fShouldFinalize;

 	char *szSignMode;

+

 } *pkcs11_provider_t;

 typedef struct pkcs11_session_s {

 	pkcs11_provider_t provider;

+	bool fProtectedAuthentication;

+

+	char szLabel[sizeof (((CK_TOKEN_INFO *)NULL)->label)+1];

+	CK_CHAR serialNumber[sizeof (((CK_TOKEN_INFO *)NULL)->serialNumber)];

+	

 	unsigned char *certificate;

-	int certificate_size;

+	size_t certificate_size;

 	unsigned char *certificate_id;

-	int certificate_id_size;

-

-	char *szPIN;

-	bool fLoginFailed;

+	size_t certificate_id_size;

 	CK_SLOT_ID slot;

 	bool fKeySignRecover;

 	CK_SESSION_HANDLE session;

 	CK_OBJECT_HANDLE key;

+

+	time_t timePINExpire;

 } *pkcs11_session_t;

+typedef struct pkcs11_data_s {

+	bool fInitialized;

+	int nPINCachePeriod;

+	pkcs11_provider_t providers;

+	pkcs11_hooks_t hooks;

+} *pkcs11_data_t;

+

 /*===========================================

  * Low level prototypes

  */

@@ -121,14 +158,14 @@ void

 _fixupFixedString (

 	IN const char * const szSource,

 	OUT char * const szTarget,			/* MUST BE >= nLength+1 */

-	IN const int nLength				/* FIXED STRING LENGTH */

+	IN const size_t nLength				/* FIXED STRING LENGTH */

 );

 static

 void

 _hexToBinary (

 	IN const char * const szSource,

 	OUT unsigned char * const target,

-	IN OUT int * const target_size

+	IN OUT size_t * const target_size

 );

 static

 CK_RV

@@ -154,11 +191,21 @@ _pkcs11_getObjectById (

 	IN const pkcs11_session_t pkcs11_session,

 	IN const CK_OBJECT_CLASS class,

 	IN const unsigned char * const id,

-	IN const int id_size,

+	IN const size_t id_size,

 	OUT CK_OBJECT_HANDLE * const handle

 );

 static

 CK_RV

+_pkcs11_setSessionTokenInfo (

+	IN const pkcs11_session_t pkcs11_session

+);

+static

+CK_RV

+_pkcs11_resetSlot (

+	IN const pkcs11_session_t pkcs11_session

+);

+static

+CK_RV

 _pkcs11_loadCertificate (

 	IN const pkcs11_session_t pkcs11_session,

 	IN const char * const szIdType,

@@ -173,15 +220,66 @@ static

 bool

 _isBetterCertificate (

 	IN const unsigned char * const pCurrent,

-	IN const int nCurrentSize,

+	IN const size_t nCurrentSize,

 	IN const unsigned char * const pNew,

-	IN const int nNewSize

+	IN const size_t nNewSize

+);

+static

+CK_RV

+_pkcs11_validateSession (

+	IN const pkcs11_session_t pkcs11_session

+);

+static

+CK_RV

+_pkcs11_login (

+	IN const pkcs11_session_t pkcs11_session

+);

+static

+CK_RV

+_pkcs11_logout (

+	IN const pkcs11_session_t pkcs11_session

 );

 /*=========================================

  * Simplified functions prototypes

  */

-

+static

+bool

+_pkcs11_hooks_card_prompt_default (

+	IN const void *pData,

+	IN const char * const szLabel

+);

+static

+bool

+_pkcs11_hooks_pin_prompt_default (

+	IN const void *pData,

+	IN const char * const szLabel,

+	OUT char * const szPIN,

+	IN const size_t nMaxPIN

+);

+static

+CK_RV

+pkcs11_initialize ();

+static

+CK_RV

+pkcs11_terminate ();

+static

+CK_RV

+pkcs11_setCardPromptHook (

+	IN const pkcs11_hook_card_prompt_t hook,

+	IN void * const pData

+);

+static

+CK_RV

+pkcs11_setPINPromptHook (

+	IN const pkcs11_hook_pin_prompt_t hook,

+	IN void * const pData

+);

+static

+CK_RV

+pkcs11_setPINCachePeriod (

+	IN const int nPINCachePeriod

+);

 static

 CK_RV

 pkcs11_addProvider (

@@ -190,7 +288,7 @@ pkcs11_addProvider (

 );

 static

 CK_RV

-pkcs11_finalize ();

+pkcs11_forkFixup ();

 static

 CK_RV

 pkcs11_createSession (

@@ -198,7 +296,6 @@ pkcs11_createSession (

 	IN const char * const szSlot,

 	IN const char * const szIdType,

 	IN const char * const szId,

-	IN const char * const szPIN,

 	IN const bool fProtectedAuthentication,

 	OUT pkcs11_session_t * const pkcs11_session

 );

@@ -209,23 +306,13 @@ pkcs11_freeSession (

 );

 static

 CK_RV

-pkcs11_login (

-	IN const pkcs11_session_t pkcs11_session

-);

-static

-CK_RV

-pkcs11_logout (

-	IN const pkcs11_session_t pkcs11_session

-);

-static

-CK_RV

 pkcs11_sign (

 	IN const pkcs11_session_t pkcs11_session,

 	IN const CK_MECHANISM_TYPE mech_type,

 	IN const unsigned char * const source,

-	IN const int source_size,

+	IN const size_t source_size,

 	OUT unsigned char * const target,

-	IN OUT int * const target_size

+	IN OUT size_t * const target_size

 );

 static

 CK_RV

@@ -233,9 +320,9 @@ pkcs11_signRecover (

 	IN const pkcs11_session_t pkcs11_session,

 	IN const CK_MECHANISM_TYPE mech_type,

 	IN const unsigned char * const source,

-	IN const int source_size,

+	IN const size_t source_size,

 	OUT unsigned char * const target,

-	IN OUT int * const target_size

+	IN OUT size_t * const target_size

 );

 static

 CK_RV

@@ -243,16 +330,16 @@ pkcs11_decrypt (

 	IN const pkcs11_session_t pkcs11_session,

 	IN const CK_MECHANISM_TYPE mech_type,

 	IN const unsigned char * const source,

-	IN const int source_size,

+	IN const size_t source_size,

 	OUT unsigned char * const target,

-	IN OUT int * const target_size

+	IN OUT size_t * const target_size

 );

 static

 CK_RV

 pkcs11_getCertificate (

 	IN const pkcs11_session_t pkcs11_session,

-	OUT char * const certificate,

-	IN OUT int * const certificate_size

+	OUT unsigned char * const certificate,

+	IN OUT size_t * const certificate_size

 );

 static

 char *

@@ -264,7 +351,7 @@ pkcs11_getMessage (

  * Static data

  */

-static pkcs11_provider_t pkcs11_provider = NULL;

+static pkcs11_data_t pkcs11_data = NULL;

 /*==========================================

  * Internal utility functions

@@ -275,7 +362,7 @@ void

 _fixupFixedString (

 	IN const char * const szSource,

 	OUT char * const szTarget,			/* MUST BE >= nLength+1 */

-	IN const int nLength				/* FIXED STRING LENGTH */

+	IN const size_t nLength				/* FIXED STRING LENGTH */

 ) {

 	char *p;

@@ -297,9 +384,9 @@ void

 _hexToBinary (

 	IN const char * const szSource,

 	OUT unsigned char * const target,

-	IN OUT int * const target_size

+	IN OUT size_t * const target_size

 ) {

-	int target_max_size;

+	size_t target_max_size;

 	const char *p;

 	char buf[3] = {'\0', '\0', '\0'};

 	int i = 0;

@@ -317,7 +404,7 @@ _hexToBinary (

 			buf[i%2] = *p;

 			if ((i%2) == 1) {

-				int v;

+				unsigned v;

 				sscanf (buf, "%x", &v);

 				target[*target_size] = v & 0xff;

 				(*target_size)++;

@@ -333,9 +420,9 @@ static

 bool

 _isBetterCertificate (

 	IN const unsigned char * const pCurrent,

-	IN const int nCurrentSize,

+	IN const size_t nCurrentSize,

 	IN const unsigned char * const pNew,

-	IN const int nNewSize

+	IN const size_t nNewSize

 ) {

 	/*

 	 * This function compare the notBefore

@@ -427,7 +514,7 @@ _pkcs11_getSlotById (

 	}

 	for (

-		i=0, provider=pkcs11_provider;

+		i=0, provider=pkcs11_data->providers;

 		i < provider_number && provider != NULL;

 		i++, provider = provider->next

 	);

@@ -453,9 +540,6 @@ _pkcs11_getSlotByName (

 	IN const pkcs11_session_t pkcs11_session,

 	IN const char * const szName

 ) {

-	CK_SLOT_ID slots[1024];

-	CK_ULONG slotnum;

-	CK_SLOT_ID s;

 	CK_RV rv;

 	pkcs11_provider_t provider;

@@ -465,13 +549,16 @@ _pkcs11_getSlotByName (

 	ASSERT (szName!=NULL);

 	for (

-		provider = pkcs11_provider;

+		provider = pkcs11_data->providers;

 		(

 			provider != NULL &&

 			!fFound

 		);

 		provider = provider->next

 	) {

+		CK_SLOT_ID slots[1024];

+		CK_ULONG slotnum;

+

 		if (!provider->fEnabled) {

 			continue;

 		}

@@ -484,6 +571,8 @@ _pkcs11_getSlotByName (

 				&slotnum

 			)) == CKR_OK

 		) {

+			CK_SLOT_ID s;

+

 			for (s=0;!fFound && s<slotnum;s++) {

 				CK_SLOT_INFO info;

@@ -496,7 +585,7 @@ _pkcs11_getSlotByName (

 					char szCurrentName[sizeof (info.slotDescription)+1];

 					_fixupFixedString (

-						info.slotDescription,

+						(char *)info.slotDescription,

 						szCurrentName,

 						sizeof (info.slotDescription)

 					);

@@ -520,9 +609,6 @@ _pkcs11_getSlotByLabel (

 	IN const pkcs11_session_t pkcs11_session,

 	IN const char * const szLabel

 ) {

-	CK_SLOT_ID slots[1024];

-	CK_ULONG slotnum;

-	CK_SLOT_ID s;

 	CK_RV rv;

 	pkcs11_provider_t provider;

@@ -532,13 +618,16 @@ _pkcs11_getSlotByLabel (

 	ASSERT (szLabel!=NULL);

 	for (

-		provider = pkcs11_provider;

+		provider = pkcs11_data->providers;

 		(

 			provider != NULL &&

 			!fFound

 		);

 		provider = provider->next

 	) {

+		CK_SLOT_ID slots[1024];

+		CK_ULONG slotnum;

+

 		if (!provider->fEnabled) {

 			continue;

 		}

@@ -551,6 +640,8 @@ _pkcs11_getSlotByLabel (

 				&slotnum

 			)) == CKR_OK

 		) {

+			CK_SLOT_ID s;

+

 			for (s=0;!fFound && s<slotnum;s++) {

 				CK_TOKEN_INFO info;

@@ -563,7 +654,7 @@ _pkcs11_getSlotByLabel (

 					char szCurrentLabel[sizeof (info.label)+1];

 					_fixupFixedString (

-						info.label,

+						(char *)info.label,

 						szCurrentLabel,

 						sizeof (info.label)

 					);

@@ -583,16 +674,105 @@ _pkcs11_getSlotByLabel (

 static

 CK_RV

+_pkcs11_setSessionTokenInfo (

+	IN const pkcs11_session_t pkcs11_session

+) {

+	CK_TOKEN_INFO info;

+	CK_RV rv;

+

+	ASSERT (pkcs11_session!=NULL);

+

+	if (

+		(rv = pkcs11_session->provider->f->C_GetTokenInfo (

+			pkcs11_session->slot,

+			&info

+		)) == CKR_OK

+	) {

+		_fixupFixedString (

+			(char *)info.label,

+			pkcs11_session->szLabel,

+			sizeof (info.label)

+		);

+		

+		memmove (

+			pkcs11_session->serialNumber,

+			info.serialNumber,

+			sizeof (pkcs11_session->serialNumber)

+		);

+	}

+

+	return rv;

+}

+

+static

+CK_RV

+_pkcs11_resetSlot (

+	IN const pkcs11_session_t pkcs11_session

+) {

+	CK_SLOT_ID slots[1024];

+	CK_ULONG slotnum;

+	CK_RV rv;

+	bool fFound = false;

+	bool fCancel = false;

+

+	ASSERT (pkcs11_session!=NULL);

+

+	do {

+		slotnum = sizeof (slots) / sizeof (CK_SLOT_ID);

+		if (

+			(rv = pkcs11_session->provider->f->C_GetSlotList (

+				TRUE,

+				slots,

+				&slotnum

+			)) == CKR_OK

+		) {

+			CK_SLOT_ID s;

+

+			for (s=0;!fFound && s<slotnum;s++) {

+				CK_TOKEN_INFO info;

+

+				if (

+					(rv = pkcs11_session->provider->f->C_GetTokenInfo (

+						slots[s],

+						&info

+					)) == CKR_OK

+				) {

+					if (

+						!memcmp (

+							pkcs11_session->serialNumber,

+							info.serialNumber,