/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 *
 * Copyright 2020 Joyent, Inc.
 */

#include <fcntl.h>
#include <strings.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/sha1.h>
#include <sys/md5.h>
#include <sys/sysmacros.h>
#include <security/cryptoki.h>
#include "softGlobal.h"
#include "softKeys.h"
#include "softKeystore.h"
#include "softMAC.h"
#include "softObject.h"
#include "softSession.h"
#include "softSSL.h"

/*
 * This files contains the implementation of the following PKCS#11
 * mechanisms needed by SSL:
 * CKM_SSL3_MASTER_KEY_DERIVE
 * CKM_SSL3_MASTER_KEY_DERIVE_DH
 * CKM_SSL3_KEY_AND_DERIVE
 * CKM_TLS_MASTER_KEY_DERIVE
 * CKM_TLS_MASTER_KEY_DERIVE_DH
 * CKM_TLS_KEY_AND_DERIVE
 *
 * SSL refers to common functions between SSL v3.0 and SSL v3.1 (a.k.a TLS.)
 */

#define	MAX_KEYBLOCK	160	/* should be plenty for all known cipherspecs */

#define	MAX_DEFAULT_ATTRS	10	/* Enough for major applicarions */

static	char *ssl3_const_vals[] = {
	"A",
	"BB",
	"CCC",
	"DDDD",
	"EEEEE",
	"FFFFFF",
	"GGGGGGG",
	"HHHHHHHH",
	"IIIIIIIII",
	"JJJJJJJJJJ",
};
static	uint_t ssl3_const_lens[] = { 1, 2, 3, 4, 5, 6, 7, 8, 9, 10};

static uchar_t TLS_MASTER_SECRET_LABEL[] = {"master secret"};
#define	TLS_MASTER_SECRET_LABEL_LEN	13

static uchar_t TLS_KEY_EXPANSION_LABEL[] = {"key expansion"};
#define	TLS_KEY_EXPANSION_LABEL_LEN	13

static uchar_t TLS_CLIENT_KEY_LABEL[] = {"client write key"};
#define	TLS_CLIENT_KEY_LABEL_LEN	16

static uchar_t TLS_SERVER_KEY_LABEL[] = {"server write key"};
#define	TLS_SERVER_KEY_LABEL_LEN	16

static uchar_t TLS_IV_BLOCK_LABEL[] = {"IV block"};
#define	TLS_IV_BLOCK_LABEL_LEN	8

static void P_MD5(uchar_t *, uint_t, uchar_t *, uint_t, uchar_t *, uint_t,
    uchar_t *, uint_t, uchar_t *, uint_t, boolean_t);
static void P_SHA1(uchar_t *, uint_t, uchar_t *, uint_t, uchar_t *, uint_t,
    uchar_t *, uint_t, uchar_t *, uint_t, boolean_t);

static CK_RV soft_add_derived_key(CK_ATTRIBUTE_PTR, CK_ULONG,
    CK_OBJECT_HANDLE_PTR, soft_session_t *, soft_object_t *);
static void soft_delete_derived_key(soft_session_t *, soft_object_t *);
static void soft_ssl_weaken_key(CK_MECHANISM_PTR, uchar_t *, uint_t,
    uchar_t *, uint_t, uchar_t *, uint_t, uchar_t *, boolean_t);

/*
 * soft_ssl3_churn()
 * Called for derivation of the master secret from the pre-master secret,
 * and for the derivation of the key_block in an SSL3 handshake
 * result is assumed to be larger than rounds * MD5_HASH_SIZE.
 */
static void
soft_ssl3_churn(uchar_t *secret, uint_t secretlen, uchar_t *rand1,
    uint_t rand1len, uchar_t *rand2, uint_t rand2len, int rounds,
    uchar_t *result)
{
	SHA1_CTX sha1_ctx;
	MD5_CTX	md5_ctx;
	uchar_t sha1_digest[SHA1_HASH_SIZE];
	int i;
	uchar_t *ms = result;
	for (i = 0; i < rounds; i++) {
		SHA1Init(&sha1_ctx);
		SHA1Update(&sha1_ctx, (const uint8_t *)ssl3_const_vals[i],
		    ssl3_const_lens[i]);
		SHA1Update(&sha1_ctx, secret, secretlen);
		SHA1Update(&sha1_ctx, rand1, rand1len);
		SHA1Update(&sha1_ctx, rand2, rand2len);
		SHA1Final(sha1_digest, &sha1_ctx);

		MD5Init(&md5_ctx);
		MD5Update(&md5_ctx, secret, secretlen);
		MD5Update(&md5_ctx, sha1_digest, SHA1_HASH_SIZE);
		MD5Final(ms, &md5_ctx);
		ms += MD5_HASH_SIZE;
	}
}

/*
 * This TLS generic Pseudo Random Function expands a triplet
 * {secret, label, seed} into any arbitrary length string of pseudo
 * random bytes.
 * Here, it is called for the derivation of the master secret from the
 * pre-master secret, and for the derivation of the key_block in a TLS
 * handshake
 */
static void
soft_tls_prf(uchar_t *secret, uint_t secretlen, uchar_t *label, uint_t labellen,
    uchar_t *rand1, uint_t rand1len, uchar_t *rand2, uint_t rand2len,
    uchar_t *result, uint_t resultlen)
{
	uchar_t *S1, *S2;
	uchar_t md5_digested_key[MD5_HASH_SIZE];
	uchar_t sha1_digested_key[SHA1_HASH_SIZE];
	uint_t L_S, L_S1, L_S2;

	/* secret is NULL for IV's in exportable ciphersuites */
	if (secret == NULL) {
		L_S = 0;
		L_S2 = L_S1 = 0;
		S1 = NULL;
		S2 = NULL;
		goto do_P_HASH;
	}

	L_S = roundup(secretlen, 2) / 2;
	L_S1 = L_S;
	L_S2 = L_S;
	S1 = secret;
	S2 = secret + (secretlen / 2);	/* Possible overlap of S1 and S2. */

	/* Reduce the half secrets if bigger than the HASH's block size */
	if (L_S > MD5_HMAC_BLOCK_SIZE) {
		MD5_CTX	md5_ctx;
		SHA1_CTX sha1_ctx;

		MD5Init(&md5_ctx);
		MD5Update(&md5_ctx, S1, L_S);
		MD5Final(md5_digested_key, &md5_ctx);
		S1 = md5_digested_key;
		L_S1 = MD5_HASH_SIZE;

		SHA1Init(&sha1_ctx);
		SHA1Update(&sha1_ctx, S2, L_S);
		SHA1Final(sha1_digested_key, &sha1_ctx);
		S2 = sha1_digested_key;
		L_S2 = SHA1_HASH_SIZE;
	}

	/*
	 * PRF(secret, label, seed) = P_MD5(S1, label + seed) XOR
	 *				P_SHA-1(S2, label + seed);
	 * the 'seed' here is rand1 + rand2
	 */
do_P_HASH:
	/* The first one writes directly to the result */
	P_MD5(S1, L_S1, label, labellen, rand1, rand1len, rand2, rand2len,
	    result, resultlen, B_FALSE);

	/* The second one XOR's with the result. */
	P_SHA1(S2, L_S2, label, labellen, rand1, rand1len, rand2, rand2len,
	    result, resultlen, B_TRUE);
}

/*
 * These two expansion routines are very similar. (they can merge one day).
 * They implement the P_HASH() function for MD5 and for SHA1, as defined in
 * RFC2246:
 *
 *	P_hash(secret, seed) = HMAC_hash(secret, A(1) + seed) +
 *				HMAC_hash(secret, A(2) + seed) +
 *				HMAC_hash(secret, A(3) + seed) + ...
 * Where + indicates concatenation.
 * A() is defined as:
 *	A(0) = seed
 *	A(i) = HMAC_hash(secret, A(i-1))
 *
 * The seed is the concatenation of 'babel', 'rand1', and 'rand2'.
 */
static void
P_MD5(uchar_t *secret, uint_t secretlen, uchar_t *label, uint_t labellen,
    uchar_t *rand1, uint_t rand1len, uchar_t *rand2, uint_t rand2len,
    uchar_t *result, uint_t resultlen, boolean_t xor_it)
{
	uint32_t md5_ipad[MD5_HMAC_INTS_PER_BLOCK];
	uint32_t md5_opad[MD5_HMAC_INTS_PER_BLOCK];
	uchar_t	md5_hmac[MD5_HASH_SIZE];
	uchar_t	A[MD5_HASH_SIZE];
	md5_hc_ctx_t md5_hmac_ctx;
	uchar_t *res, *cur;
	uint_t left = resultlen;
	int i;

	/* good compilers will leverage the aligment */
	bzero(md5_ipad, MD5_HMAC_BLOCK_SIZE);
	bzero(md5_opad, MD5_HMAC_BLOCK_SIZE);

	if (secretlen > 0) {
		bcopy(secret, md5_ipad, secretlen);
		bcopy(secret, md5_opad, secretlen);
	}

	/* A(1) = HMAC_MD5(secret, rand1 + rand2) */
	md5_hmac_ctx_init(&md5_hmac_ctx, md5_ipad, md5_opad);
	SOFT_MAC_UPDATE(MD5, &md5_hmac_ctx, label, labellen);
	SOFT_MAC_UPDATE(MD5, &md5_hmac_ctx, rand1, rand1len);
	SOFT_MAC_UPDATE(MD5, &md5_hmac_ctx, rand2, rand2len);
	SOFT_MAC_FINAL(MD5, &md5_hmac_ctx, A);

	if (xor_it) {
		res = md5_hmac;
		cur = result;
	} else {
		res = result;
	}

	while (left > 0) {
		/*
		 * Compute HMAC_MD5(secret, A(i) + seed);
		 * The secret is already expanded in the ictx and octx, so
		 * we can call the SOFT_MAC_INIT_CTX() directly.
		 */
		SOFT_MAC_INIT_CTX(MD5, &md5_hmac_ctx, md5_ipad, md5_opad,
		    MD5_HMAC_BLOCK_SIZE);
		SOFT_MAC_UPDATE(MD5, &md5_hmac_ctx, A, MD5_HASH_SIZE);
		SOFT_MAC_UPDATE(MD5, &md5_hmac_ctx, label, labellen);
		SOFT_MAC_UPDATE(MD5, &md5_hmac_ctx, rand1, rand1len);
		SOFT_MAC_UPDATE(MD5, &md5_hmac_ctx, rand2, rand2len);

		if (left > MD5_HASH_SIZE) {
			SOFT_MAC_FINAL(MD5, &md5_hmac_ctx, res);
			if (xor_it) {
				for (i = 0; i < MD5_HASH_SIZE; i++) {
					*cur ^= res[i];
					cur++;
				}
			} else {
				res += MD5_HASH_SIZE;
			}
			left -= MD5_HASH_SIZE;
		} else {
			SOFT_MAC_FINAL(MD5, &md5_hmac_ctx, md5_hmac);
			if (xor_it) {
				for (i = 0; i < left; i++) {
					*cur ^= md5_hmac[i];
					cur++;
				}
			} else {
				bcopy(md5_hmac, res, left);
			}
			break;
		}
		/* A(i) = HMAC_MD5(secret, A(i-1) */
		SOFT_MAC_INIT_CTX(MD5, &md5_hmac_ctx, md5_ipad, md5_opad,
		    MD5_HMAC_BLOCK_SIZE);
		SOFT_MAC_UPDATE(MD5, &md5_hmac_ctx, A, MD5_HASH_SIZE);
		SOFT_MAC_FINAL(MD5, &md5_hmac_ctx, A);
	}
}
static void
P_SHA1(uchar_t *secret, uint_t secretlen, uchar_t *label, uint_t labellen,
    uchar_t *rand1, uint_t rand1len, uchar_t *rand2, uint_t rand2len,
    uchar_t *result, uint_t resultlen, boolean_t xor_it)
{
	uint32_t sha1_ipad[SHA1_HMAC_INTS_PER_BLOCK];
	uint32_t sha1_opad[SHA1_HMAC_INTS_PER_BLOCK];
	uchar_t	sha1_hmac[SHA1_HASH_SIZE];
	uchar_t	A[SHA1_HASH_SIZE];
	sha1_hc_ctx_t sha1_hmac_ctx;
	uchar_t *res, *cur;
	uint_t left = resultlen;
	int i;

	/* good compilers will leverage the aligment */
	bzero(sha1_ipad, SHA1_HMAC_BLOCK_SIZE);
	bzero(sha1_opad, SHA1_HMAC_BLOCK_SIZE);

	if (secretlen > 0) {
		bcopy(secret, sha1_ipad, secretlen);
		bcopy(secret, sha1_opad, secretlen);
	}

	/* A(1) = HMAC_SHA1(secret, rand1 + rand2) */
	sha1_hmac_ctx_init(&sha1_hmac_ctx, sha1_ipad, sha1_opad);
	SOFT_MAC_UPDATE(SHA1, &sha1_hmac_ctx, label, labellen);
	SOFT_MAC_UPDATE(SHA1, &sha1_hmac_ctx, rand1, rand1len);
	SOFT_MAC_UPDATE(SHA1, &sha1_hmac_ctx, rand2, rand2len);
	SOFT_MAC_FINAL(SHA1, &sha1_hmac_ctx, A);

	if (xor_it) {
		res = sha1_hmac;
		cur = result;
	} else {
		res = result;
	}

	while (left > 0) {
		/*
		 * Compute HMAC_SHA1(secret, A(i) + seed);
		 * The secret is already expanded in the ictx and octx, so
		 * we can call the SOFT_MAC_INIT_CTX() directly.
		 */
		SOFT_MAC_INIT_CTX(SHA1, &sha1_hmac_ctx,
		    (const uchar_t *)sha1_ipad, (const uchar_t *)sha1_opad,
		    SHA1_HMAC_BLOCK_SIZE);
		SOFT_MAC_UPDATE(SHA1, &sha1_hmac_ctx, A, SHA1_HASH_SIZE);
		SOFT_MAC_UPDATE(SHA1, &sha1_hmac_ctx, label, labellen);
		SOFT_MAC_UPDATE(SHA1, &sha1_hmac_ctx, rand1, rand1len);
		SOFT_MAC_UPDATE(SHA1, &sha1_hmac_ctx, rand2, rand2len);

		if (left > SHA1_HASH_SIZE) {
			SOFT_MAC_FINAL(SHA1, &sha1_hmac_ctx, res);
			if (xor_it) {
				for (i = 0; i < SHA1_HASH_SIZE; i++) {
					*cur ^= res[i];
					cur++;
				}
			} else {
				res += SHA1_HASH_SIZE;
			}
			left -= SHA1_HASH_SIZE;
		} else {
			SOFT_MAC_FINAL(SHA1, &sha1_hmac_ctx, sha1_hmac);
			if (xor_it) {
				for (i = 0; i < left; i++) {
					*cur ^= sha1_hmac[i];
					cur++;
				}
			} else {
				bcopy(sha1_hmac, res, left);
			}
			break;
		}
		/* A(i) = HMAC_SHA1(secret, A(i-1) */
		SOFT_MAC_INIT_CTX(SHA1, &sha1_hmac_ctx,
		    (const uchar_t *)sha1_ipad, (const uchar_t *)sha1_opad,
		    SHA1_HMAC_BLOCK_SIZE);
		SOFT_MAC_UPDATE(SHA1, &sha1_hmac_ctx, A, SHA1_HASH_SIZE);
		SOFT_MAC_FINAL(SHA1, &sha1_hmac_ctx, A);
	}
}

/* This function handles the call from C_DeriveKey for CKM_TLS_PRF */
CK_RV
derive_tls_prf(CK_TLS_PRF_PARAMS_PTR param, soft_object_t *basekey_p)
{

	if (param->pOutput == NULL || param->pulOutputLen == 0)
		return (CKR_BUFFER_TOO_SMALL);

	(void) soft_tls_prf(OBJ_SEC_VALUE(basekey_p),
	    OBJ_SEC_VALUE_LEN(basekey_p), param->pLabel, param->ulLabelLen,
	    param->pSeed, param->ulSeedLen, NULL, 0, param->pOutput,
	    *param->pulOutputLen);

	return (CKR_OK);
}


/*
 * soft_ssl_master_key_derive()
 *
 * Arguments:
 * . session_p
 * . mech_p:	key derivation mechanism. the mechanism parameter carries the
 *		client and master random from the Hello handshake messages.
 * . basekey_p: The pre-master secret key.
 * . pTemplate & ulAttributeCount: Any extra attributes for the key to be
 *		created.
 * . phKey:	store for handle to the derived key.
 *
 * Description:
 *	Derive the SSL master secret from the pre-master secret, the client
 *	and server random.
 *	In SSL 3.0, master_secret =
 *	    MD5(pre_master_secret + SHA('A' + pre_master_secret +
 *	        ClientHello.random + ServerHello.random)) +
 *	    MD5(pre_master_secret + SHA('BB' + pre_master_secret +
 *	        ClientHello.random + ServerHello.random)) +
 *	    MD5(pre_master_secret + SHA('CCC' + pre_master_secret +
 *	        ClientHello.random + ServerHello.random));
 *
 *	In TLS 1.0 (a.k.a. SSL 3.1), master_secret =
 *	    PRF(pre_master_secret, "master secret",
 *		ClientHello.random + ServerHello.random)
 */
CK_RV
soft_ssl_master_key_derive(soft_session_t *sp, CK_MECHANISM_PTR mech,
    soft_object_t *basekey_p, CK_ATTRIBUTE_PTR pTemplate,
    CK_ULONG ulAttributeCount, CK_OBJECT_HANDLE_PTR phKey)
{
	uchar_t	*pmsecret = OBJ_SEC_VALUE(basekey_p);
#ifdef	__sparcv9
	/* LINTED */
	uint_t pmlen = (uint_t)OBJ_SEC_VALUE_LEN(basekey_p);
#else	/* __sparcv9 */
	uint_t pmlen = OBJ_SEC_VALUE_LEN(basekey_p);
#endif	/* __sparcv9 */
	CK_SSL3_MASTER_KEY_DERIVE_PARAMS *mkd_params;
	CK_SSL3_RANDOM_DATA *random_data;
	CK_VERSION_PTR	pVersion;
	uchar_t	ssl_master_secret[48];
	CK_OBJECT_CLASS class = CKO_SECRET_KEY;
	CK_KEY_TYPE keyType = CKK_GENERIC_SECRET;
	CK_BBOOL true = TRUE;
	CK_ATTRIBUTE obj_tmpl[MAX_DEFAULT_ATTRS];
	CK_ATTRIBUTE_PTR new_tmpl;
	CK_ULONG newattrcount;
	boolean_t new_tmpl_allocated = B_FALSE, is_tls = B_FALSE;
	ulong_t i;
	CK_RV rv = CKR_OK;
	uint_t ClientRandomLen, ServerRandomLen;

	/* Check the validity of the mechanism's parameter */

	mkd_params = (CK_SSL3_MASTER_KEY_DERIVE_PARAMS *)mech->pParameter;

	if (mkd_params == NULL ||
	    mech->ulParameterLen != sizeof (CK_SSL3_MASTER_KEY_DERIVE_PARAMS))
		return (CKR_MECHANISM_PARAM_INVALID);

	pVersion = mkd_params->pVersion;

	switch (mech->mechanism) {
	case CKM_TLS_MASTER_KEY_DERIVE:
		is_tls = B_TRUE;
	/* FALLTHRU */
	case CKM_SSL3_MASTER_KEY_DERIVE:
		/* Invalid pre-master key length. What else to return? */
		if (pmlen != 48)
			return (CKR_ARGUMENTS_BAD);

		/* Get the SSL version number from the premaster secret */
		if (pVersion == NULL_PTR)
			return (CKR_MECHANISM_PARAM_INVALID);

		bcopy(pmsecret, pVersion, sizeof (CK_VERSION));

		break;
	case CKM_TLS_MASTER_KEY_DERIVE_DH:
		is_tls = B_TRUE;
	/* FALLTHRU */
	case CKM_SSL3_MASTER_KEY_DERIVE_DH:
		if (pVersion != NULL_PTR)
			return (CKR_MECHANISM_PARAM_INVALID);
	}

	random_data = &mkd_params->RandomInfo;
#ifdef	__sparcv9
	/* LINTED */
	ClientRandomLen = (uint_t)random_data->ulClientRandomLen;
	/* LINTED */
	ServerRandomLen = (uint_t)random_data->ulServerRandomLen;
#else	/* __sparcv9 */
	ClientRandomLen = random_data->ulClientRandomLen;
	ServerRandomLen = random_data->ulServerRandomLen;
#endif	/* __sparcv9 */

	if (random_data->pClientRandom == NULL_PTR || ClientRandomLen == 0 ||
	    random_data->pServerRandom == NULL_PTR || ServerRandomLen == 0) {
		return (CKR_MECHANISM_PARAM_INVALID);
	}

	/* Now the actual secret derivation */
	if (!is_tls) {
		soft_ssl3_churn(pmsecret, pmlen, random_data->pClientRandom,
		    ClientRandomLen, random_data->pServerRandom,
		    ServerRandomLen, 3, ssl_master_secret);
	} else {
		soft_tls_prf(pmsecret, pmlen, TLS_MASTER_SECRET_LABEL,
		    TLS_MASTER_SECRET_LABEL_LEN, random_data->pClientRandom,
		    ClientRandomLen, random_data->pServerRandom,
		    ServerRandomLen, ssl_master_secret, 48);
	}

	/*
	 * The object creation attributes need to be in one contiguous
	 * array. In addition to the attrs from the application supplied
	 * pTemplates, We need to add the class, type, value, valuelen and
	 * CKA_DERIVE.
	 * In the most likely case, the application passes between zero and
	 * handful of attributes, We optimize for that case by allocating
	 * the new template on the stack. Oherwise we malloc() it.
	 */

	newattrcount = ulAttributeCount + 4;
	if (newattrcount > MAX_DEFAULT_ATTRS) {
		new_tmpl = malloc(sizeof (CK_ATTRIBUTE) * newattrcount);

		if (new_tmpl == NULL)
			return (CKR_HOST_MEMORY);

		new_tmpl_allocated = B_TRUE;
	} else
		new_tmpl = obj_tmpl;

	/*
	 * Fill in the new template.
	 * We put the attributes contributed by the mechanism first
	 * so that they override the application supplied ones.
	 */
	new_tmpl[0].type = CKA_CLASS;
	new_tmpl[0].pValue = &class;
	new_tmpl[0].ulValueLen = sizeof (class);
	new_tmpl[1].type = CKA_KEY_TYPE;
	new_tmpl[1].pValue = &keyType;
	new_tmpl[1].ulValueLen = sizeof (keyType);
	new_tmpl[2].type = CKA_DERIVE;
	new_tmpl[2].pValue = &true;
	new_tmpl[2].ulValueLen = sizeof (true);
	new_tmpl[3].type = CKA_VALUE;
	new_tmpl[3].pValue = ssl_master_secret;
	new_tmpl[3].ulValueLen = 48;

	/* Any attributes left? */
	if (ulAttributeCount > 0) {

		/* Validate the default class and type attributes */
		for (i = 0; i < ulAttributeCount; i++) {
			/* The caller is responsible for proper alignment */
			if ((pTemplate[i].type == CKA_CLASS) &&
			    (*((CK_OBJECT_CLASS *)pTemplate[i].pValue) !=
			    CKO_SECRET_KEY)) {
				rv = CKR_TEMPLATE_INCONSISTENT;
				goto out;
			}
			if ((pTemplate[i].type == CKA_KEY_TYPE) &&
			    (*((CK_KEY_TYPE *)pTemplate[i].pValue) !=
			    CKK_GENERIC_SECRET)) {
				rv = CKR_TEMPLATE_INCONSISTENT;
				goto out;
			}
		}
		bcopy(pTemplate, &new_tmpl[4],
		    ulAttributeCount * sizeof (CK_ATTRIBUTE));
	}

	rv = soft_add_derived_key(new_tmpl, newattrcount, phKey, sp, basekey_p);
out:
	if (new_tmpl_allocated)
		free(new_tmpl);

	return (rv);
}

/*
 * soft_ssl3_key_and_mac_derive()
 *
 * Arguments:
 * . session_p
 * . mech_p:	key derivation mechanism. the mechanism parameter carries the
 *		client and mastter random from the Hello handshake messages,
 *		the specification of the key and IV sizes, and the location
 *		for the resulting keys and IVs.
 * . basekey_p: The master secret key.
 * . pTemplate & ulAttributeCount: Any extra attributes for the key to be
 *		created.
 *
 * Description:
 *	Derive the SSL key material (Client and server MAC secrets, symmetric
 *	keys and IVs), from the master secret and the client
 *	and server random.
 *	First a keyblock is generated usining the following formula:
 *	key_block =
 *		MD5(master_secret + SHA(`A' + master_secret +
 *					ServerHello.random +
 *					ClientHello.random)) +
 *		MD5(master_secret + SHA(`BB' + master_secret +
 *					ServerHello.random +
 *					ClientHello.random)) +
 *		MD5(master_secret + SHA(`CCC' + master_secret +
 *					ServerHello.random +
 *					ClientHello.random)) + [...];
 *
 *	In TLS 1.0 (a.k.a. SSL 3.1), key_block =
 *	    PRF(master_secret, "key expansion",
 *		ServerHello.random + ClientHello.random)
 *
 *	Then the keys materials are taken from the keyblock.
 */

CK_RV
soft_ssl_key_and_mac_derive(soft_session_t *sp, CK_MECHANISM_PTR mech,
    soft_object_t *basekey_p, CK_ATTRIBUTE_PTR pTemplate,
    CK_ULONG ulAttributeCount)
{
	uchar_t	*msecret = OBJ_SEC_VALUE(basekey_p);
#ifdef	__sparcv9
	/* LINTED */
	uint_t mslen = (uint_t)OBJ_SEC_VALUE_LEN(basekey_p);
#else	/* __sparcv9 */
	uint_t mslen = OBJ_SEC_VALUE_LEN(basekey_p);
#endif	/* __sparcv9 */
	CK_SSL3_KEY_MAT_PARAMS *km_params;
	CK_SSL3_RANDOM_DATA *random_data;
	CK_SSL3_KEY_MAT_OUT *kmo;
	uchar_t key_block[MAX_KEYBLOCK], *kb, *export_keys = NULL;
	CK_OBJECT_CLASS class = CKO_SECRET_KEY;
	CK_KEY_TYPE keyType = CKK_GENERIC_SECRET;
	CK_BBOOL true = TRUE;
	CK_ATTRIBUTE obj_tmpl[MAX_DEFAULT_ATTRS];
	CK_ATTRIBUTE_PTR new_tmpl;
	ulong_t newattrcount, mac_key_bytes, secret_key_bytes, iv_bytes;
	ulong_t extra_attr_count;
	uint_t size;
	int rounds, n = 0;
	boolean_t new_tmpl_allocated = B_FALSE, isExport;
	CK_RV rv = CKR_OK;
	uint_t ClientRandomLen, ServerRandomLen;

	/* Check the validity of the mechanism's parameter */

	km_params = (CK_SSL3_KEY_MAT_PARAMS *)mech->pParameter;

	if (km_params == NULL ||
	    mech->ulParameterLen != sizeof (CK_SSL3_KEY_MAT_PARAMS) ||
	    (kmo = km_params->pReturnedKeyMaterial) == NULL)
		return (CKR_MECHANISM_PARAM_INVALID);

	isExport = (km_params->bIsExport == TRUE);

	random_data = &km_params->RandomInfo;
#ifdef	__sparcv9
	/* LINTED */
	ClientRandomLen = (uint_t)random_data->ulClientRandomLen;
	/* LINTED */
	ServerRandomLen = (uint_t)random_data->ulServerRandomLen;
#else	/* __sparcv9 */
	ClientRandomLen = random_data->ulClientRandomLen;
	ServerRandomLen = random_data->ulServerRandomLen;
#endif	/* __sparcv9 */

	if (random_data->pClientRandom == NULL_PTR || ClientRandomLen == 0 ||
	    random_data->pServerRandom == NULL_PTR || ServerRandomLen == 0) {
		return (CKR_MECHANISM_PARAM_INVALID);
	}

	mac_key_bytes = km_params->ulMacSizeInBits / 8;
	secret_key_bytes = km_params->ulKeySizeInBits / 8;
	iv_bytes = km_params->ulIVSizeInBits / 8;

	if ((iv_bytes > 0) &&
	    ((kmo->pIVClient == NULL) || (kmo->pIVServer == NULL)))
		return (CKR_MECHANISM_PARAM_INVALID);

	/*
	 * For exportable ciphersuites, the IV's aren't taken from the
	 * key block. They are directly derived from the client and
	 * server random data.
	 * For SSL3.0:
	 *	client_write_IV = MD5(ClientHello.random + ServerHello.random);
	 *	server_write_IV = MD5(ServerHello.random + ClientHello.random);
	 * For TLS1.0:
	 *	iv_block = PRF("", "IV block", client_random +
	 *			server_random)[0..15]
	 *	client_write_IV = iv_block[0..7]
	 *	server_write_IV = iv_block[8..15]
	 */
	if ((isExport) && (iv_bytes > 0)) {

		if (mech->mechanism == CKM_SSL3_KEY_AND_MAC_DERIVE) {
			MD5_CTX	exp_md5_ctx;

			if (iv_bytes > MD5_HASH_SIZE)
				return (CKR_MECHANISM_PARAM_INVALID);

			MD5Init(&exp_md5_ctx);
			MD5Update(&exp_md5_ctx, random_data->pClientRandom,
			    ClientRandomLen);
			MD5Update(&exp_md5_ctx, random_data->pServerRandom,
			    ServerRandomLen);

			/* there's room in key_block. use it */
			MD5Final(key_block, &exp_md5_ctx);
			bcopy(key_block, kmo->pIVClient, iv_bytes);

			MD5Init(&exp_md5_ctx);
			MD5Update(&exp_md5_ctx, random_data->pServerRandom,
			    ServerRandomLen);
			MD5Update(&exp_md5_ctx, random_data->pClientRandom,
			    ClientRandomLen);
			MD5Final(key_block, &exp_md5_ctx);
			bcopy(key_block, kmo->pIVServer, iv_bytes);
		} else {
			uchar_t	iv_block[16];

			if (iv_bytes != 8)
				return (CKR_MECHANISM_PARAM_INVALID);

			soft_tls_prf(NULL, 0, TLS_IV_BLOCK_LABEL,
			    TLS_IV_BLOCK_LABEL_LEN,
			    random_data->pClientRandom, ClientRandomLen,
			    random_data->pServerRandom, ServerRandomLen,
			    iv_block, 16);
			bcopy(iv_block, kmo->pIVClient, 8);
			bcopy(iv_block + 8, kmo->pIVServer, 8);
		}
		/* so we won't allocate a key_block bigger than needed */
		iv_bytes = 0;
	}

	/* Now the actual secret derivation */

#ifdef	__sparcv9
	/* LINTED */
	size = (uint_t)((mac_key_bytes + secret_key_bytes + iv_bytes) * 2);
#else	/* __sparcv9 */
	size = (mac_key_bytes + secret_key_bytes + iv_bytes) * 2;
#endif	/* __sparcv9 */

	/* Need to handle this better */
	if (size > MAX_KEYBLOCK)
		return (CKR_MECHANISM_PARAM_INVALID);

	rounds = howmany(size, MD5_HASH_SIZE);

	kb = key_block;

	if (mech->mechanism == CKM_SSL3_KEY_AND_MAC_DERIVE) {
		soft_ssl3_churn(msecret, mslen, random_data->pServerRandom,
		    ServerRandomLen, random_data->pClientRandom,
		    ClientRandomLen, rounds, kb);
	} else {
		soft_tls_prf(msecret, mslen, TLS_KEY_EXPANSION_LABEL,
		    TLS_KEY_EXPANSION_LABEL_LEN,
		    random_data->pServerRandom, ServerRandomLen,
		    random_data->pClientRandom, ClientRandomLen,
		    kb, size);
	}

	/* Now create the objects */

	kmo->hClientMacSecret = CK_INVALID_HANDLE;
	kmo->hServerMacSecret = CK_INVALID_HANDLE;
	kmo->hClientKey = CK_INVALID_HANDLE;
	kmo->hServerKey = CK_INVALID_HANDLE;

	/* First the MAC secrets */
	if (mac_key_bytes > 0) {
		obj_tmpl[0].type = CKA_CLASS;
		obj_tmpl[0].pValue = &class;	/* CKO_SECRET_KEY */
		obj_tmpl[0].ulValueLen = sizeof (class);
		obj_tmpl[1].type = CKA_KEY_TYPE;
		obj_tmpl[1].pValue = &keyType;	/* CKK_GENERIC_SECRET */
		obj_tmpl[1].ulValueLen = sizeof (keyType);
		obj_tmpl[2].type = CKA_DERIVE;
		obj_tmpl[2].pValue = &true;
		obj_tmpl[2].ulValueLen = sizeof (true);
		obj_tmpl[3].type = CKA_SIGN;
		obj_tmpl[3].pValue = &true;
		obj_tmpl[3].ulValueLen = sizeof (true);
		obj_tmpl[4].type = CKA_VERIFY;
		obj_tmpl[4].pValue = &true;
		obj_tmpl[4].ulValueLen = sizeof (true);
		obj_tmpl[5].type = CKA_VALUE;
		obj_tmpl[5].pValue = kb;
		obj_tmpl[5].ulValueLen = mac_key_bytes;

		rv = soft_add_derived_key(obj_tmpl, 6,
		    &(kmo->hClientMacSecret), sp, basekey_p);

		if (rv != CKR_OK)
			goto out_err;

		kb += mac_key_bytes;

		obj_tmpl[5].pValue = kb;
		rv = soft_add_derived_key(obj_tmpl, 6,
		    &(kmo->hServerMacSecret), sp, basekey_p);

		if (rv != CKR_OK)
			goto out_err;

		kb += mac_key_bytes;
	}

	/* Then the symmetric ciphers keys */

	extra_attr_count = (secret_key_bytes == 0) ? 6 : 5;
	newattrcount = ulAttributeCount + extra_attr_count;
	if (newattrcount > MAX_DEFAULT_ATTRS) {
		new_tmpl = malloc(sizeof (CK_ATTRIBUTE) * newattrcount);

		if (new_tmpl == NULL)
			return (CKR_HOST_MEMORY);

		new_tmpl_allocated = B_TRUE;
	} else
		new_tmpl = obj_tmpl;

	new_tmpl[n].type = CKA_CLASS;
	new_tmpl[n].pValue = &class;	/* CKO_SECRET_KEY */
	new_tmpl[n].ulValueLen = sizeof (class);
	++n;
	/*
	 * The keyType comes from the application's template, and depends
	 * on the ciphersuite. The only exception is authentication only
	 * ciphersuites which do not use cipher keys.
	 */
	if (secret_key_bytes == 0) {
		new_tmpl[n].type = CKA_KEY_TYPE;
		new_tmpl[n].pValue = &keyType;	/* CKK_GENERIC_SECRET */
		new_tmpl[n].ulValueLen = sizeof (keyType);
		n++;
	}
	new_tmpl[n].type = CKA_DERIVE;
	new_tmpl[n].pValue = &true;
	new_tmpl[n].ulValueLen = sizeof (true);
	n++;
	new_tmpl[n].type = CKA_ENCRYPT;
	new_tmpl[n].pValue = &true;
	new_tmpl[n].ulValueLen = sizeof (true);
	n++;
	new_tmpl[n].type = CKA_DECRYPT;
	new_tmpl[n].pValue = &true;
	new_tmpl[n].ulValueLen = sizeof (true);
	n++;
	new_tmpl[n].type = CKA_VALUE;
	new_tmpl[n].pValue = NULL;
	new_tmpl[n].ulValueLen = 0;

	if (secret_key_bytes > 0) {
		if (isExport) {
			if (secret_key_bytes > MD5_HASH_SIZE) {
				rv = CKR_MECHANISM_PARAM_INVALID;
				goto out_err;
			}
			if ((export_keys = malloc(2 * MD5_HASH_SIZE)) == NULL) {
				rv = CKR_HOST_MEMORY;
				goto out_err;
			}
#ifdef	__sparcv9
			/* LINTED */
			soft_ssl_weaken_key(mech, kb, (uint_t)secret_key_bytes,
			    random_data->pClientRandom, ClientRandomLen,
			    random_data->pServerRandom, ServerRandomLen,
			    export_keys, B_TRUE);
#else	/* __sparcv9 */
			soft_ssl_weaken_key(mech, kb, secret_key_bytes,
			    random_data->pClientRandom, ClientRandomLen,
			    random_data->pServerRandom, ServerRandomLen,
			    export_keys, B_TRUE);
#endif	/* __sparcv9 */
			new_tmpl[n].pValue = export_keys;
			new_tmpl[n].ulValueLen = MD5_HASH_SIZE;
		} else {
			new_tmpl[n].pValue = kb;
			new_tmpl[n].ulValueLen = secret_key_bytes;
		}
	}

	if (ulAttributeCount > 0)
		bcopy(pTemplate, &new_tmpl[extra_attr_count],
		    ulAttributeCount * sizeof (CK_ATTRIBUTE));

	rv = soft_add_derived_key(new_tmpl, newattrcount,
	    &(kmo->hClientKey), sp, basekey_p);

	if (rv != CKR_OK)
		goto out_err;

	kb += secret_key_bytes;

	if (secret_key_bytes > 0) {
		if (isExport) {
#ifdef	__sparcv9
			/* LINTED */
			soft_ssl_weaken_key(mech, kb, (uint_t)secret_key_bytes,
			    random_data->pServerRandom, ServerRandomLen,
			    random_data->pClientRandom, ClientRandomLen,
			    export_keys + MD5_HASH_SIZE, B_FALSE);
#else	/* __sparcv9 */
			soft_ssl_weaken_key(mech, kb, secret_key_bytes,
			    random_data->pServerRandom, ServerRandomLen,
			    random_data->pClientRandom, ClientRandomLen,
			    export_keys + MD5_HASH_SIZE, B_FALSE);
#endif	/* __sparcv9 */
			new_tmpl[n].pValue = export_keys + MD5_HASH_SIZE;
		} else
			new_tmpl[n].pValue = kb;
	}

	rv = soft_add_derived_key(new_tmpl, newattrcount,
	    &(kmo->hServerKey), sp, basekey_p);

	if (rv != CKR_OK)
		goto out_err;

	kb += secret_key_bytes;

	/* Finally, the IVs */
	if (iv_bytes > 0) {
		bcopy(kb, kmo->pIVClient, iv_bytes);
		kb += iv_bytes;
		bcopy(kb, kmo->pIVServer, iv_bytes);
	}

	if (new_tmpl_allocated)
		free(new_tmpl);

	freezero(export_keys, 2 * MD5_HASH_SIZE);

	return (rv);

out_err:
	if (kmo->hClientMacSecret != CK_INVALID_HANDLE) {
		(void) soft_delete_derived_key(sp,
		    (soft_object_t *)(kmo->hClientMacSecret));
		kmo->hClientMacSecret = CK_INVALID_HANDLE;
	}
	if (kmo->hServerMacSecret != CK_INVALID_HANDLE) {
		(void) soft_delete_derived_key(sp,
		    (soft_object_t *)(kmo->hServerMacSecret));
		kmo->hServerMacSecret = CK_INVALID_HANDLE;
	}
	if (kmo->hClientKey != CK_INVALID_HANDLE) {
		(void) soft_delete_derived_key(sp,
		    (soft_object_t *)(kmo->hClientKey));
		kmo->hClientKey = CK_INVALID_HANDLE;
	}
	if (kmo->hServerKey != CK_INVALID_HANDLE) {
		(void) soft_delete_derived_key(sp,
		    (soft_object_t *)(kmo->hServerKey));
		kmo->hServerKey = CK_INVALID_HANDLE;
	}

	if (new_tmpl_allocated)
		free(new_tmpl);

	freezero(export_keys, 2 * MD5_HASH_SIZE);

	return (rv);
}

/*
 * Add the derived key to the session, and, if it's a token object,
 * write it to the token.
 */
static CK_RV
soft_add_derived_key(CK_ATTRIBUTE_PTR tmpl, CK_ULONG attrcount,
    CK_OBJECT_HANDLE_PTR phKey, soft_session_t *sp, soft_object_t *basekey_p)
{
	CK_RV rv;
	soft_object_t *secret_key;

	if ((secret_key = calloc(1, sizeof (soft_object_t))) == NULL) {
		return (CKR_HOST_MEMORY);
	}

	if (((rv = soft_build_secret_key_object(tmpl, attrcount, secret_key,
	    SOFT_CREATE_OBJ_INT, 0, (CK_KEY_TYPE)~0UL)) != CKR_OK) ||
	    ((rv = soft_pin_expired_check(secret_key)) != CKR_OK) ||
	    ((rv = soft_object_write_access_check(sp, secret_key)) != CKR_OK)) {

		free(secret_key);
		return (rv);
	}

	/* Set the sensitivity and extractability attributes as a needed */
	soft_derive_enforce_flags(basekey_p, secret_key);

	/* Initialize the rest of stuffs in soft_object_t. */
	(void) pthread_mutex_init(&secret_key->object_mutex, NULL);
	secret_key->magic_marker = SOFTTOKEN_OBJECT_MAGIC;

	/* ... and, if it needs to persist, write on the token */
	if (IS_TOKEN_OBJECT(secret_key)) {
		secret_key->session_handle = CK_INVALID_HANDLE;
		soft_add_token_object_to_slot(secret_key);
		rv = soft_put_object_to_keystore(secret_key);
		if (rv != CKR_OK) {
			soft_delete_token_object(secret_key, B_FALSE, B_FALSE);
			return (rv);
		}
		*phKey = set_objecthandle(secret_key);

		return (CKR_OK);
	}

	/* Add the new object to the session's object list. */
	soft_add_object_to_session(secret_key, sp);
	secret_key->session_handle = sp->handle;

	*phKey = set_objecthandle(secret_key);

	return (rv);
}

/*
 * Delete the derived key from the session, and, if it's a token object,
 * remove it from the token.
 */
static void
soft_delete_derived_key(soft_session_t *sp, soft_object_t *key)
{
	/* session_handle is the creating session. It's NULL for token objs */

	if (IS_TOKEN_OBJECT(key))
		soft_delete_token_object(key, B_FALSE, B_FALSE);
	else
		soft_delete_object(sp, key, B_FALSE, B_FALSE);
}

/*
 * soft_ssl_weaken_key()
 * Reduce the key length to an exportable size.
 * For SSL3.0:
 *	final_client_write_key = MD5(client_write_key +
 *                                ClientHello.random +
 *                                ServerHello.random);
 *	final_server_write_key = MD5(server_write_key +
 *                                ServerHello.random +
 *                                ClientHello.random);
 * For TLS1.0:
 *	final_client_write_key = PRF(SecurityParameters.client_write_key,
 *				    "client write key",
 *				    SecurityParameters.client_random +
 *				    SecurityParameters.server_random)[0..15];
 *	final_server_write_key = PRF(SecurityParameters.server_write_key,
 *				    "server write key",
 *				    SecurityParameters.client_random +
 *				    SecurityParameters.server_random)[0..15];
 */
static void
soft_ssl_weaken_key(CK_MECHANISM_PTR mech, uchar_t *secret, uint_t secretlen,
    uchar_t *rand1, uint_t rand1len, uchar_t *rand2, uint_t rand2len,
    uchar_t *result, boolean_t isclient)
{
	MD5_CTX exp_md5_ctx;
	uchar_t *label;
	uint_t labellen;

	if (mech->mechanism == CKM_SSL3_KEY_AND_MAC_DERIVE) {
		MD5Init(&exp_md5_ctx);
		MD5Update(&exp_md5_ctx, secret, secretlen);
		MD5Update(&exp_md5_ctx, rand1, rand1len);
		MD5Update(&exp_md5_ctx, rand2, rand2len);
		MD5Final(result, &exp_md5_ctx);
	} else {
		if (isclient) {
			label = TLS_CLIENT_KEY_LABEL;
			labellen = TLS_CLIENT_KEY_LABEL_LEN;
			soft_tls_prf(secret, secretlen, label, labellen,
			    rand1, rand1len, rand2, rand2len, result, 16);
		} else {
			label = TLS_SERVER_KEY_LABEL;
			labellen = TLS_SERVER_KEY_LABEL_LEN;
			soft_tls_prf(secret, secretlen, label, labellen,
			    rand2, rand2len, rand1, rand1len, result, 16);
		}
	}
}