text: // Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
  // Use of this source code is governed by a BSD-style license that can be
  // found in the LICENSE file.
  
  #ifndef CHAPS_CHAPS_INTERFACE_H_
  #define CHAPS_CHAPS_INTERFACE_H_
  
  #include <string>
  #include <vector>
  
  #include <brillo/secure_blob.h>
  #include <chaps/proto_bindings/ck_structs.pb.h>
  
  #include "chaps/chaps.h"
  
  namespace chaps {
  
  // ChapsInterface provides an abstract interface closely matching the
  // bindings that would be generated by e.g. chromeos-dbus-bindings.
  // Since this is not available on linux, we need to provide the interface
  // ourselves.
  //
  // Implemented By:
  // - ChapsProxyImpl: On the Chaps client side; sends calls over IPC.
  // - ChapsServiceImpl: On the Chaps daemon side; receives and implements IPC
  //   calls.
  class ChapsInterface {
   public:
    ChapsInterface() {}
    ChapsInterface(const ChapsInterface&) = delete;
    ChapsInterface& operator=(const ChapsInterface&) = delete;
    virtual ~ChapsInterface() {}
  
    // The following methods map to PKCS #11 calls. Each method name is identical
    // to the corresponding PKCS #11 function name except for the "C_" prefix.
  
    // PKCS #11 v2.20 section 11.5 page 106.
    virtual uint32_t GetSlotList(const brillo::SecureBlob& isolate_credential,
                                 bool token_present,
                                 std::vector<uint64_t>* slot_list) = 0;
    // PKCS #11 v2.20 section 11.5 page 108.
    virtual uint32_t GetSlotInfo(const brillo::SecureBlob& isolate_credential,
                                 uint64_t slot_id,
                                 SlotInfo* slot_info) = 0;
    // PKCS #11 v2.20 section 11.5 page 109.
    virtual uint32_t GetTokenInfo(const brillo::SecureBlob& isolate_credential,
                                  uint64_t slot_id,
                                  TokenInfo* token_info) = 0;
    // PKCS #11 v2.20 section 11.5 page 111.
    virtual uint32_t GetMechanismList(
        const brillo::SecureBlob& isolate_credential,
        uint64_t slot_id,
        std::vector<uint64_t>* mechanism_list) = 0;
    // PKCS #11 v2.20 section 11.5 page 112.
    virtual uint32_t GetMechanismInfo(
        const brillo::SecureBlob& isolate_credential,
        uint64_t slot_id,
        uint64_t mechanism_type,
        MechanismInfo* mechanism_info) = 0;
    // PKCS #11 v2.20 section 11.5 page 113.
    virtual uint32_t InitToken(const brillo::SecureBlob& isolate_credential,
                               uint64_t slot_id,
                               const std::string* so_pin,
                               const std::vector<uint8_t>& label) = 0;
    // PKCS #11 v2.20 section 11.5 page 115.
    virtual uint32_t InitPIN(const brillo::SecureBlob& isolate_credential,
                             uint64_t session_id,
                             const std::string* pin) = 0;
    // PKCS #11 v2.20 section 11.5 page 116.
    virtual uint32_t SetPIN(const brillo::SecureBlob& isolate_credential,
                            uint64_t session_id,
                            const std::string* old_pin,
                            const std::string* new_pin) = 0;
    // PKCS #11 v2.20 section 11.6 page 117.
    virtual uint32_t OpenSession(const brillo::SecureBlob& isolate_credential,
                                 uint64_t slot_id,
                                 uint64_t flags,
                                 uint64_t* session) = 0;
    // PKCS #11 v2.20 section 11.6 page 118.
    virtual uint32_t CloseSession(const brillo::SecureBlob& isolate_credential,
                                  uint64_t session) = 0;
    // PKCS #11 v2.20 section 11.6 page 120.
    virtual uint32_t GetSessionInfo(const brillo::SecureBlob& isolate_credential,
                                    uint64_t session_id,
                                    SessionInfo* session_info) = 0;
    // PKCS #11 v2.20 section 11.6 page 121.
    virtual uint32_t GetOperationState(
        const brillo::SecureBlob& isolate_credential,
        uint64_t session_id,
        std::vector<uint8_t>* operation_state) = 0;
    // PKCS #11 v2.20 section 11.6 page 123.
    virtual uint32_t SetOperationState(
        const brillo::SecureBlob& isolate_credential,
        uint64_t session_id,
        const std::vector<uint8_t>& operation_state,
        uint64_t encryption_key_handle,
        uint64_t authentication_key_handle) = 0;
    // PKCS #11 v2.20 section 11.6 page 125.
    virtual uint32_t Login(const brillo::SecureBlob& isolate_credential,
                           uint64_t session_id,
                           uint64_t user_type,
                           const std::string* pin) = 0;
    // PKCS #11 v2.20 section 11.6 page 127.
    virtual uint32_t Logout(const brillo::SecureBlob& isolate_credential,
                            uint64_t session_id) = 0;
    // PKCS #11 v2.20 section 11.7 page 128.
    virtual uint32_t CreateObject(const brillo::SecureBlob& isolate_credential,
                                  uint64_t session_id,
                                  const std::vector<uint8_t>& attributes,
                                  uint64_t* new_object_handle) = 0;
    // PKCS #11 v2.20 section 11.7 page 130.
    virtual uint32_t CopyObject(const brillo::SecureBlob& isolate_credential,
                                uint64_t session_id,
                                uint64_t object_handle,
                                const std::vector<uint8_t>& attributes,
                                uint64_t* new_object_handle) = 0;
    // PKCS #11 v2.20 section 11.7 page 131.
    virtual uint32_t DestroyObject(const brillo::SecureBlob& isolate_credential,
                                   uint64_t session_id,
                                   uint64_t object_handle) = 0;
    // PKCS #11 v2.20 section 11.7 page 132.
    virtual uint32_t GetObjectSize(const brillo::SecureBlob& isolate_credential,
                                   uint64_t session_id,
                                   uint64_t object_handle,
                                   uint64_t* object_size) = 0;
    // PKCS #11 v2.20 section 11.7 page 133.
    virtual uint32_t GetAttributeValue(
        const brillo::SecureBlob& isolate_credential,
        uint64_t session_id,
        uint64_t object_handle,
        const std::vector<uint8_t>& attributes_in,
        std::vector<uint8_t>* attributes_out) = 0;
    // PKCS #11 v2.20 section 11.7 page 135.
    virtual uint32_t SetAttributeValue(
        const brillo::SecureBlob& isolate_credential,
        uint64_t session_id,
        uint64_t object_handle,
        const std::vector<uint8_t>& attributes) = 0;
    // PKCS #11 v2.20 section 11.7 page 136.
    virtual uint32_t FindObjectsInit(const brillo::SecureBlob& isolate_credential,
                                     uint64_t session_id,
                                     const std::vector<uint8_t>& attributes) = 0;
    // PKCS #11 v2.20 section 11.7 page 137.
    virtual uint32_t FindObjects(const brillo::SecureBlob& isolate_credential,
                                 uint64_t session_id,
                                 uint64_t max_object_count,
                                 std::vector<uint64_t>* object_list) = 0;
    // PKCS #11 v2.20 section 11.7 page 138.
    virtual uint32_t FindObjectsFinal(
        const brillo::SecureBlob& isolate_credential, uint64_t session_id) = 0;
    // PKCS #11 v2.20 section 11.8 page 139.
    virtual uint32_t EncryptInit(const brillo::SecureBlob& isolate_credential,
                                 uint64_t session_id,
                                 uint64_t mechanism_type,
                                 const std::vector<uint8_t>& mechanism_parameter,
                                 uint64_t key_handle) = 0;
    // PKCS #11 v2.20 section 11.8 page 140.
    virtual uint32_t Encrypt(const brillo::SecureBlob& isolate_credential,
                             uint64_t session_id,
                             const std::vector<uint8_t>& data_in,
                             uint64_t max_out_length,
                             uint64_t* actual_out_length,
                             std::vector<uint8_t>* data_out) = 0;
    // PKCS #11 v2.20 section 11.8 page 141.
    virtual uint32_t EncryptUpdate(const brillo::SecureBlob& isolate_credential,
                                   uint64_t session_id,
                                   const std::vector<uint8_t>& data_in,
                                   uint64_t max_out_length,
                                   uint64_t* actual_out_length,
                                   std::vector<uint8_t>* data_out) = 0;
    // PKCS #11 v2.20 section 11.8 page 141.
    virtual uint32_t EncryptFinal(const brillo::SecureBlob& isolate_credential,
                                  uint64_t session_id,
                                  uint64_t max_out_length,
                                  uint64_t* actual_out_length,
                                  std::vector<uint8_t>* data_out) = 0;
    // PKCS #11 v2.20 section 11.8 page 140,142: any errors terminate the active
    // encryption operation.
    virtual void EncryptCancel(const brillo::SecureBlob& isolate_credential,
                               uint64_t session_id) = 0;
    // PKCS #11 v2.20 section 11.9 page 144.
    virtual uint32_t DecryptInit(const brillo::SecureBlob& isolate_credential,
                                 uint64_t session_id,
                                 uint64_t mechanism_type,
                                 const std::vector<uint8_t>& mechanism_parameter,
                                 uint64_t key_handle) = 0;
    // PKCS #11 v2.20 section 11.9 page 145.
    virtual uint32_t Decrypt(const brillo::SecureBlob& isolate_credential,
                             uint64_t session_id,
                             const std::vector<uint8_t>& data_in,
                             uint64_t max_out_length,
                             uint64_t* actual_out_length,
                             std::vector<uint8_t>* data_out) = 0;
    // PKCS #11 v2.20 section 11.9 page 146.
    virtual uint32_t DecryptUpdate(const brillo::SecureBlob& isolate_credential,
                                   uint64_t session_id,
                                   const std::vector<uint8_t>& data_in,
                                   uint64_t max_out_length,
                                   uint64_t* actual_out_length,
                                   std::vector<uint8_t>* data_out) = 0;
    // PKCS #11 v2.20 section 11.9 page 146.
    virtual uint32_t DecryptFinal(const brillo::SecureBlob& isolate_credential,
                                  uint64_t session_id,
                                  uint64_t max_out_length,
                                  uint64_t* actual_out_length,
                                  std::vector<uint8_t>* data_out) = 0;
    // PKCS #11 v2.20 section 11.9 page 145,146: any errors terminate the active
    // decryption operation.
    virtual void DecryptCancel(const brillo::SecureBlob& isolate_credential,
                               uint64_t session_id) = 0;
    // PKCS #11 v2.20 section 11.10 page 148.
    virtual uint32_t DigestInit(
        const brillo::SecureBlob& isolate_credential,
        uint64_t session_id,
        uint64_t mechanism_type,
        const std::vector<uint8_t>& mechanism_parameter) = 0;
    // PKCS #11 v2.20 section 11.10 page 149.
    virtual uint32_t Digest(const brillo::SecureBlob& isolate_credential,
                            uint64_t session_id,
                            const std::vector<uint8_t>& data_in,
                            uint64_t max_out_length,
                            uint64_t* actual_out_length,
                            std::vector<uint8_t>* digest) = 0;
    // PKCS #11 v2.20 section 11.10 page 150.
    virtual uint32_t DigestUpdate(const brillo::SecureBlob& isolate_credential,
                                  uint64_t session_id,
                                  const std::vector<uint8_t>& data_in) = 0;
    // PKCS #11 v2.20 section 11.10 page 150.
    virtual uint32_t DigestKey(const brillo::SecureBlob& isolate_credential,
                               uint64_t session_id,
                               uint64_t key_handle) = 0;
    // PKCS #11 v2.20 section 11.10 page 151.
    virtual uint32_t DigestFinal(const brillo::SecureBlob& isolate_credential,
                                 uint64_t session_id,
                                 uint64_t max_out_length,
                                 uint64_t* actual_out_length,
                                 std::vector<uint8_t>* digest) = 0;
    // PKCS #11 v2.20 section 11.10 page 149,151: any errors terminate the active
    // digest operation.
    virtual void DigestCancel(const brillo::SecureBlob& isolate_credential,
                              uint64_t session_id) = 0;
    // PKCS #11 v2.20 section 11.11 page 152.
    virtual uint32_t SignInit(const brillo::SecureBlob& isolate_credential,
                              uint64_t session_id,
                              uint64_t mechanism_type,
                              const std::vector<uint8_t>& mechanism_parameter,
                              uint64_t key_handle) = 0;
    // PKCS #11 v2.20 section 11.11 page 153.
    virtual uint32_t Sign(const brillo::SecureBlob& isolate_credential,
                          uint64_t session_id,
                          const std::vector<uint8_t>& data,
                          uint64_t max_out_length,
                          uint64_t* actual_out_length,
                          std::vector<uint8_t>* signature) = 0;
    // PKCS #11 v2.20 section 11.11 page 154.
    virtual uint32_t SignUpdate(const brillo::SecureBlob& isolate_credential,
                                uint64_t session_id,
                                const std::vector<uint8_t>& data_part) = 0;
    // PKCS #11 v2.20 section 11.11 page 154.
    virtual uint32_t SignFinal(const brillo::SecureBlob& isolate_credential,
                               uint64_t session_id,
                               uint64_t max_out_length,
                               uint64_t* actual_out_length,
                               std::vector<uint8_t>* signature) = 0;
    // PKCS #11 v2.20 section 11.11 page 153,154: any errors terminate the active
    // signing operation.
    virtual void SignCancel(const brillo::SecureBlob& isolate_credential,
                            uint64_t session_id) = 0;
    // PKCS #11 v2.20 section 11.11 page 155.
    virtual uint32_t SignRecoverInit(
        const brillo::SecureBlob& isolate_credential,
        uint64_t session_id,
        uint64_t mechanism_type,
        const std::vector<uint8_t>& mechanism_parameter,
        uint64_t key_handle) = 0;
    // PKCS #11 v2.20 section 11.11 page 156.
    virtual uint32_t SignRecover(const brillo::SecureBlob& isolate_credential,
                                 uint64_t session_id,
                                 const std::vector<uint8_t>& data,
                                 uint64_t max_out_length,
                                 uint64_t* actual_out_length,
                                 std::vector<uint8_t>* signature) = 0;
    // PKCS #11 v2.20 section 11.12 page 157.
    virtual uint32_t VerifyInit(const brillo::SecureBlob& isolate_credential,
                                uint64_t session_id,
                                uint64_t mechanism_type,
                                const std::vector<uint8_t>& mechanism_parameter,
                                uint64_t key_handle) = 0;
    // PKCS #11 v2.20 section 11.12 page 158.
    virtual uint32_t Verify(const brillo::SecureBlob& isolate_credential,
                            uint64_t session_id,
                            const std::vector<uint8_t>& data,
                            const std::vector<uint8_t>& signature) = 0;
    // PKCS #11 v2.20 section 11.12 page 159.
    virtual uint32_t VerifyUpdate(const brillo::SecureBlob& isolate_credential,
                                  uint64_t session_id,
                                  const std::vector<uint8_t>& data_part) = 0;
    // PKCS #11 v2.20 section 11.12 page 159.
    virtual uint32_t VerifyFinal(const brillo::SecureBlob& isolate_credential,
                                 uint64_t session_id,
                                 const std::vector<uint8_t>& signature) = 0;
    // PKCS #11 v2.20 section 11.12 page 159: any errors terminate the active
    // verification operation.
    virtual void VerifyCancel(const brillo::SecureBlob& isolate_credential,
                              uint64_t session_id) = 0;
    // PKCS #11 v2.20 section 11.12 page 161.
    virtual uint32_t VerifyRecoverInit(
        const brillo::SecureBlob& isolate_credential,
        uint64_t session_id,
        uint64_t mechanism_type,
        const std::vector<uint8_t>& mechanism_parameter,
        uint64_t key_handle) = 0;
    // PKCS #11 v2.20 section 11.12 page 161.
    virtual uint32_t VerifyRecover(const brillo::SecureBlob& isolate_credential,
                                   uint64_t session_id,
                                   const std::vector<uint8_t>& signature,
                                   uint64_t max_out_length,
                                   uint64_t* actual_out_length,
                                   std::vector<uint8_t>* data) = 0;
    // PKCS #11 v2.20 section 11.13 page 163.
    virtual uint32_t DigestEncryptUpdate(
        const brillo::SecureBlob& isolate_credential,
        uint64_t session_id,
        const std::vector<uint8_t>& data_in,
        uint64_t max_out_length,
        uint64_t* actual_out_length,
        std::vector<uint8_t>* data_out) = 0;
    // PKCS #11 v2.20 section 11.13 page 165.
    virtual uint32_t DecryptDigestUpdate(
        const brillo::SecureBlob& isolate_credential,
        uint64_t session_id,
        const std::vector<uint8_t>& data_in,
        uint64_t max_out_length,
        uint64_t* actual_out_length,
        std::vector<uint8_t>* data_out) = 0;
    // PKCS #11 v2.20 section 11.13 page 169.
    virtual uint32_t SignEncryptUpdate(
        const brillo::SecureBlob& isolate_credential,
        uint64_t session_id,
        const std::vector<uint8_t>& data_in,
        uint64_t max_out_length,
        uint64_t* actual_out_length,
        std::vector<uint8_t>* data_out) = 0;
    // PKCS #11 v2.20 section 11.13 page 171.
    virtual uint32_t DecryptVerifyUpdate(
        const brillo::SecureBlob& isolate_credential,
        uint64_t session_id,
        const std::vector<uint8_t>& data_in,
        uint64_t max_out_length,
        uint64_t* actual_out_length,
        std::vector<uint8_t>* data_out) = 0;
    // PKCS #11 v2.20 section 11.14 page 175.
    virtual uint32_t GenerateKey(const brillo::SecureBlob& isolate_credential,
                                 uint64_t session_id,
                                 uint64_t mechanism_type,
                                 const std::vector<uint8_t>& mechanism_parameter,
                                 const std::vector<uint8_t>& attributes,
                                 uint64_t* key_handle) = 0;
    // PKCS #11 v2.20 section 11.14 page 176.
    virtual uint32_t GenerateKeyPair(
        const brillo::SecureBlob& isolate_credential,
        uint64_t session_id,
        uint64_t mechanism_type,
        const std::vector<uint8_t>& mechanism_parameter,
        const std::vector<uint8_t>& public_attributes,
        const std::vector<uint8_t>& private_attributes,
        uint64_t* public_key_handle,
        uint64_t* private_key_handle) = 0;
    // PKCS #11 v2.20 section 11.14 page 178.
    virtual uint32_t WrapKey(const brillo::SecureBlob& isolate_credential,
                             uint64_t session_id,
                             uint64_t mechanism_type,
                             const std::vector<uint8_t>& mechanism_parameter,
                             uint64_t wrapping_key_handle,
                             uint64_t key_handle,
                             uint64_t max_out_length,
                             uint64_t* actual_out_length,
                             std::vector<uint8_t>* wrapped_key) = 0;
    // PKCS #11 v2.20 section 11.14 page 180.
    virtual uint32_t UnwrapKey(const brillo::SecureBlob& isolate_credential,
                               uint64_t session_id,
                               uint64_t mechanism_type,
                               const std::vector<uint8_t>& mechanism_parameter,
                               uint64_t wrapping_key_handle,
                               const std::vector<uint8_t>& wrapped_key,
                               const std::vector<uint8_t>& attributes,
                               uint64_t* key_handle) = 0;
    // PKCS #11 v2.20 section 11.14 page 182.
    virtual uint32_t DeriveKey(const brillo::SecureBlob& isolate_credential,
                               uint64_t session_id,
                               uint64_t mechanism_type,
                               const std::vector<uint8_t>& mechanism_parameter,
                               uint64_t base_key_handle,
                               const std::vector<uint8_t>& attributes,
                               uint64_t* key_handle) = 0;
    // PKCS #11 v2.20 section 11.15 page 184.
    virtual uint32_t SeedRandom(const brillo::SecureBlob& isolate_credential,
                                uint64_t session_id,
                                const std::vector<uint8_t>& seed) = 0;
    // PKCS #11 v2.20 section 11.15 page 184.
    virtual uint32_t GenerateRandom(const brillo::SecureBlob& isolate_credential,
                                    uint64_t session_id,
                                    uint64_t num_bytes,
                                    std::vector<uint8_t>* random_data) = 0;
  };
  
  }  // namespace chaps
  
  #endif  // CHAPS_CHAPS_INTERFACE_H_
  