java - 在JNA中创建对象C_CreateObject时发生奇怪的事情[PKCS11]

我正在制作JNA PKCS11包装器，并且在令牌中创建对象时发生了一件奇怪的事情（已使用CKO_DATA和CKO_CERTIFICATE测试）。在大多数情况下，结果为CKR_TEMPLATE_INCONSISTENT，可以在尝试几次后创建对象。也许您知道会发生什么。

JNA接口和结构，

NativeLong C_CreateObject(final NativeLong hSession, final CK_ATTRIBUTE[] pTemplate, final NativeLong ulCount, final IntByReference phObject);

public class CK_ATTRIBUTE extends Structure {
    public NativeLong type;
    public Pointer pValue;
    public NativeLong ulValueLen;

    public static class ByReference extends CK_ATTRIBUTE implements Structure.ByReference {
    }

    public static class ByValue extends CK_ATTRIBUTE implements Structure.ByValue {
    }

    public CK_ATTRIBUTE() {
        setAlignType(ALIGN_NONE);
    }

    @Override
    protected List<String> getFieldOrder() {
        return Arrays.asList(new String[] { "type", "pValue", "ulValueLen" });
    }
}

包装纸

public class Attribute {
    private final CKA cka;
    private final byte[] data;

    public Attribute(final CKA cka, final byte[] data) {
        this.cka = cka;
        this.data = data.clone();
    }

    public CKA getCKA() {
        return cka;
    }

    public byte[] getData() {
        return data;
    }
}

public static CK_ATTRIBUTE[] createNativeAttributes(final List<Attribute> attributes) {
    final CK_ATTRIBUTE[] nativeAttributes = (CK_ATTRIBUTE[]) new CK_ATTRIBUTE().toArray(attributes.size());
    for (int i = 0; i < attributes.size(); i++) {
        final Attribute attribute = attributes.get(i);
        nativeAttributes[i].type = attribute.getCKA().getValue();
        final int len = attribute.getData().length;
        final Pointer pointer = new Memory(len);
        nativeAttributes[i].pValue = pointer;
        pointer.write(0, attribute.getData(), 0, len);
        nativeAttributes[i].ulValueLen = new NativeLong(len);
    }
    return nativeAttributes;
}

public NativeLong createObject(final NativeLong hSession, final CK_ATRIBUTE[] pTemplate) throws CryptokiException {
    if (hSession == null) {
        throw new IllegalArgumentException("hSession cannot be null");
    }
    if (pTemplate == null || pTemplate.length == 0) {
       throw new IllegalArgumentException("pTemplate cannot be empty");
    }
    final IntByReference phObject = new IntByReference(0);
    generateException(cryptoki.C_CreateObject(hSession, pTemplate, new NativeLong(pTemplate.length), phObject));
    return new NativeLong(phObject.getValue());
}

测试摘要

// create CKO_DATA
final List<Attribute> attributes = new ArrayList<>();
attributes.add(new Attribute(CKA.CLASS, new byte[] { CKO.DATA.getValue().byteValue() }));
attributes.add(new Attribute(CKA.TOKEN, new byte[] { Cryptoki.CK_TRUE }));
attributes.add(new Attribute(CKA.APPLICATION, "My Application".getBytes()));
attributes.add(new Attribute(CKA.VALUE, new byte[] { 0x01, 0x02, 0x03, 0x04 }));
attributes.add(new Attribute(CKA.LABEL, "Test Label".getBytes()));
final CK_ATTRIBUTE[] pTemplate = CryptokiWrapper.createNativeAttributes(attributes);
final NativeLong hObject = wrapper.createObject(hSessionRW, pTemplate);

// create CKO_CERTIFICATE
final CertificateFactory certificateFactory = CertificateFactory.getInstance("X.509");
try (final InputStream inputStream = new FileInputStream("src/main/resources/test.cer")) {
    final X509Certificate x509Certificate = (X509Certificate) certificateFactory.generateCertificate(inputStream);
    final List<Attribute> attributes = new ArrayList<>();
    attributes.add(new Attribute(CKA.CLASS, new byte[] { CKO.CERTIFICATE.getValue().byteValue() }));
    attributes.add(new Attribute(CKA.CERTIFICATE_TYPE, new byte[] { CKC.X_509.getValue().byteValue() }));
    attributes.add(new Attribute(CKA.TOKEN, new byte[] { Cryptoki.CK_TRUE }));
    attributes.add(new Attribute(CKA.LABEL, "Test Cert".getBytes()));
    attributes.add(new Attribute(CKA.SUBJECT, x509Certificate.getSubjectDN().getName().getBytes()));
    attributes.add(new Attribute(CKA.ID, new byte[] { 0x01, 0x02 }));
            attributes.add(new Attribute(CKA.VALUE, x509Certificate.getEncoded()));
    final CK_ATTRIBUTE[] pTemplate = CryptokiWrapper.createNativeAttributes(attributes);
    final NativeLong hObject = wrapper.createObject(hSessionRW, pTemplate);
}

如果以调试模式运行应用程序并设置一些断点，则成功的可能性会更高。

注意，所有代码都在单个线程下运行。

最佳答案

最后，我找出了这个问题的原因，

 attributes.add(new Attribute(CKA.CLASS, new byte[] {  CKO.DATA.getValue().byteValue() }));

这行是错误的，CKO_DATA的值为0x00000000，表示它是一个32位整数，所以它的长度是4，并且该值是一个字节数组；经过一些测试，该值是一个小端序。

有时成功执行方法的原因是，有时序列在内存中为00 00 00 00，并且适合该方法的要求，尤其是在调试模式下。