1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  *
21  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
22  */
23 /*
24  * Copyright 2010 Nexenta Systems, Inc.  All rights reserved.
25  * Copyright 2014, OmniTI Computer Consulting, Inc. All rights reserved.
26  * Copyright 2018, Joyent, Inc.
27  */
28 
29 #ifndef _CRYPTOUTIL_H
30 #define	_CRYPTOUTIL_H
31 
32 #ifdef __cplusplus
33 extern "C" {
34 #endif
35 
36 #include <sys/types.h>
37 #include <syslog.h>
38 #include <security/cryptoki.h>
39 #include <sys/param.h>
40 
41 #define	LOG_STDERR	-1
42 #define	SUCCESS		0
43 #define	FAILURE		1
44 #define	MECH_ID_HEX_LEN	11	/* length of mechanism id in hex form */
45 
46 #define	_PATH_PKCS11_CONF	"/etc/crypto/pkcs11.conf"
47 #define	_PATH_KCF_CONF		"/etc/crypto/kcf.conf"
48 #define	_PATH_KCFD_LOCK		"/var/run/kcfd.lock"
49 
50 /* $ISA substitution for parsing pkcs11.conf data */
51 #define	PKCS11_ISA	"/$ISA/"
52 #if defined(_LP64)
53 #define	PKCS11_ISA_DIR	"/64/"
54 #else	/* !_LP64 */
55 #define	PKCS11_ISA_DIR	"/"
56 #endif
57 
58 /* keywords and delimiters for parsing configuration files */
59 #define	SEP_COLON	":"
60 #define	SEP_SEMICOLON	";"
61 #define	SEP_EQUAL	"="
62 #define	SEP_COMMA	","
63 #define	METASLOT_KEYWORD	"metaslot"
64 #define	FIPS_KEYWORD	"fips-140"
65 #define	EF_DISABLED	"disabledlist="
66 #define	EF_ENABLED	"enabledlist="
67 #define	EF_NORANDOM	"NO_RANDOM"
68 #define	METASLOT_TOKEN	"metaslot_token="
69 #define	METASLOT_SLOT	"metaslot_slot="
70 #define	METASLOT_STATUS	"metaslot_status="
71 #define	EF_FIPS_STATUS	"fips_status="
72 #define	METASLOT_AUTO_KEY_MIGRATE	"metaslot_auto_key_migrate="
73 #define	ENABLED_KEYWORD		"enabled"
74 #define	DISABLED_KEYWORD	"disabled"
75 #define	SLOT_DESCRIPTION_SIZE	64
76 #define	TOKEN_LABEL_SIZE	32
77 #define	TOKEN_MANUFACTURER_SIZE	32
78 #define	TOKEN_SERIAL_SIZE	16
79 #define	CRYPTO_FIPS_MODE_DISABLED	0
80 #define	CRYPTO_FIPS_MODE_ENABLED	1
81 
82 /*
83  * Define the following softtoken values that are used by softtoken
84  * library, cryptoadm and pktool command.
85  */
86 #define	SOFT_SLOT_DESCRIPTION	\
87 			"Sun Crypto Softtoken            " \
88 			"                                "
89 #define	SOFT_TOKEN_LABEL	"Sun Software PKCS#11 softtoken  "
90 #define	SOFT_TOKEN_SERIAL	"                "
91 #define	SOFT_MANUFACTURER_ID	"Sun Microsystems, Inc.          "
92 #define	SOFT_DEFAULT_PIN	"changeme"
93 
94 typedef char libname_t[MAXPATHLEN];
95 typedef char midstr_t[MECH_ID_HEX_LEN];
96 
97 typedef struct umechlist {
98 	midstr_t		name;	/* mechanism name in hex form */
99 	struct umechlist	*next;
100 } umechlist_t;
101 
102 typedef struct uentry {
103 	libname_t	name;
104 	boolean_t	flag_norandom; /* TRUE if random is disabled */
105 	boolean_t	flag_enabledlist; /* TRUE if an enabledlist */
106 	umechlist_t	*policylist; /* disabledlist or enabledlist */
107 	boolean_t	flag_metaslot_enabled; /* TRUE if metaslot's enabled */
108 	boolean_t	flag_metaslot_auto_key_migrate;
109 	CK_UTF8CHAR	metaslot_ks_slot[SLOT_DESCRIPTION_SIZE + 1];
110 	CK_UTF8CHAR	metaslot_ks_token[TOKEN_LABEL_SIZE + 1];
111 	int		count;
112 	boolean_t	flag_fips_enabled;
113 } uentry_t;
114 
115 typedef struct uentrylist {
116 	uentry_t	*puent;
117 	struct uentrylist	*next;
118 } uentrylist_t;
119 
120 /* Return codes for pkcs11_parse_uri() */
121 #define	PK11_URI_OK		0
122 #define	PK11_URI_INVALID	1
123 #define	PK11_MALLOC_ERROR	2
124 #define	PK11_URI_VALUE_OVERFLOW	3
125 #define	PK11_NOT_PKCS11_URI	4
126 
127 /*
128  * There is no limit for the attribute length in the spec. 256 bytes should be
129  * enough for the object name.
130  */
131 #define	PK11_MAX_OBJECT_LEN		256
132 /*
133  * CKA_ID is of type "byte array" which can be of arbitrary length. 256 bytes
134  * should be sufficient though.
135  */
136 #define	PK11_MAX_ID_LEN			256
137 
138 /* Structure for the PKCS#11 URI. */
139 typedef struct pkcs11_uri_t {
140 	/* CKA_LABEL attribute to the C_FindObjectsInit function. */
141 	CK_UTF8CHAR_PTR	object;
142 	/*
143 	 * CKA_CLASS attribute to the C_FindObjectsInit function. The
144 	 * "objecttype" URI attribute can have a value one of "private",
145 	 * "public", "cert", "secretkey", and "data". The "objecttype" field can
146 	 * have a value of CKO_PUBLIC_KEY, CKO_PRIVATE_KEY, CKO_CERTIFICATE,
147 	 * CKO_SECRET_KEY, and CKO_DATA. This attribute cannot be empty in the
148 	 * URI.
149 	 */
150 	CK_ULONG	objecttype;
151 	/* CKO_DATA is 0 so we need this flag. Not part of the URI itself. */
152 	boolean_t	objecttype_present;
153 	/*
154 	 * Token, manufufacturer, serial and model are of fixed size length in
155 	 * the specification. We allocate memory on the fly to distinguish
156 	 * between an attribute not present and an empty value. We check for
157 	 * overflows. We always terminate the string with '\0' even when that is
158 	 * not used in the PKCS#11's CK_TOKEN_INFO structure (fields are padded
159 	 * with spaces).
160 	 */
161 	/* Token label from CK_TOKEN_INFO. */
162 	CK_UTF8CHAR_PTR	token;
163 	/* ManufacturerID from CK_TOKEN_INFO. */
164 	CK_UTF8CHAR_PTR	manuf;
165 	/* SerialNumber from CK_TOKEN_INFO. */
166 	CK_CHAR_PTR	serial;
167 	/* Model from CK_TOKEN_INFO. */
168 	CK_UTF8CHAR_PTR	model;
169 	/* This is a byte array, we need a length parameter as well. */
170 	CK_BYTE_PTR	id;
171 	int		id_len;
172 	/*
173 	 * Location of the file with a token PIN. Application can overload this,
174 	 * eg. "/bin/askpass|" may mean to read the PIN from a command. However,
175 	 * the pkcs11_parse_uri() function does not interpret this field in any
176 	 * way.
177 	 */
178 	char		*pinfile;
179 } pkcs11_uri_t;
180 
181 extern void cryptodebug(const char *fmt, ...);
182 extern void cryptoerror(int priority, const char *fmt, ...);
183 extern void cryptodebug_init(const char *prefix);
184 extern void cryptoerror_off();
185 extern void cryptoerror_on();
186 
187 extern const char *pkcs11_mech2str(CK_MECHANISM_TYPE mech);
188 extern CK_RV pkcs11_str2mech(char *mech_str, CK_MECHANISM_TYPE_PTR mech);
189 
190 extern int get_pkcs11conf_info(uentrylist_t **);
191 extern umechlist_t *create_umech(char *);
192 extern void free_umechlist(umechlist_t *);
193 extern void free_uentrylist(uentrylist_t *);
194 extern void free_uentry(uentry_t *);
195 extern uentry_t *getent_uef(char *);
196 
197 extern void tohexstr(uchar_t *bytes, size_t blen, char *hexstr, size_t hexlen);
198 extern int hexstr_to_bytes(char *hexstr, size_t hexlen, uchar_t **bytes,
199     size_t *blen);
200 extern CK_RV pkcs11_mech2keytype(CK_MECHANISM_TYPE mech_type,
201     CK_KEY_TYPE *ktype);
202 extern CK_RV pkcs11_mech2keygen(CK_MECHANISM_TYPE mech_type,
203     CK_MECHANISM_TYPE *gen_mech);
204 extern char *pkcs11_strerror(CK_RV rv);
205 
206 extern int
207 get_metaslot_info(boolean_t  *status_enabled, boolean_t *migrate_enabled,
208     char **objectstore_slot_info, char **objectstore_token_info);
209 
210 extern char *get_fullpath(char *dir, char *filepath);
211 extern int str2lifetime(char *ltimestr, uint32_t *ltime);
212 
213 extern char *pkcs11_default_token(void);
214 extern int pkcs11_get_pass(char *token_name, char **pdata, size_t *psize,
215     size_t min_psize, boolean_t with_confirmation);
216 
217 extern int pkcs11_seed_urandom(void *sbuf, size_t slen);
218 extern int pkcs11_get_random(void *dbuf, size_t dlen);
219 extern int pkcs11_get_urandom(void *dbuf, size_t dlen);
220 extern int pkcs11_get_nzero_urandom(void *dbuf, size_t dlen);
221 extern int pkcs11_read_data(char *filename, void **dbuf, size_t *dlen);
222 
223 extern int open_nointr(const char *path, int oflag, ...);
224 extern ssize_t readn_nointr(int fd, void *dbuf, size_t dlen);
225 extern ssize_t writen_nointr(int fd, void *dbuf, size_t dlen);
226 extern int update_conf(char *conf_file, char *entry);
227 
228 extern int pkcs11_parse_uri(const char *str, pkcs11_uri_t *uri);
229 extern void pkcs11_free_uri(pkcs11_uri_t *uri);
230 
231 extern CK_RV crypto2pkcs11_error_number(uint_t);
232 
233 #ifdef __cplusplus
234 }
235 #endif
236 
237 #endif /* _CRYPTOUTIL_H */
238