17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate  * CDDL HEADER START
37c478bd9Sstevel@tonic-gate  *
47c478bd9Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
5b8bf75cbSkrishna  * Common Development and Distribution License (the "License").
6b8bf75cbSkrishna  * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate  *
87c478bd9Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate  * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate  * and limitations under the License.
127c478bd9Sstevel@tonic-gate  *
137c478bd9Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate  *
197c478bd9Sstevel@tonic-gate  * CDDL HEADER END
207c478bd9Sstevel@tonic-gate  */
217c478bd9Sstevel@tonic-gate /*
2232e0ab73SMisaki Miyashita  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
237c478bd9Sstevel@tonic-gate  */
247c478bd9Sstevel@tonic-gate 
259d1587b4SJohn Levon /*
269d1587b4SJohn Levon  * Copyright (c) 2018, Joyent, Inc.
279d1587b4SJohn Levon  */
287c478bd9Sstevel@tonic-gate 
297c478bd9Sstevel@tonic-gate #include <fcntl.h>
307c478bd9Sstevel@tonic-gate #include <stdio.h>
317c478bd9Sstevel@tonic-gate #include <stdlib.h>
327c478bd9Sstevel@tonic-gate #include <strings.h>
337c478bd9Sstevel@tonic-gate #include <unistd.h>
347c478bd9Sstevel@tonic-gate #include <locale.h>
357c478bd9Sstevel@tonic-gate #include <libgen.h>
367c478bd9Sstevel@tonic-gate #include <sys/types.h>
377c478bd9Sstevel@tonic-gate #include <zone.h>
387c478bd9Sstevel@tonic-gate #include <sys/crypto/ioctladmin.h>
397c478bd9Sstevel@tonic-gate #include <cryptoutil.h>
407c478bd9Sstevel@tonic-gate #include "cryptoadm.h"
417c478bd9Sstevel@tonic-gate 
427c478bd9Sstevel@tonic-gate #define	REQ_ARG_CNT	2
437c478bd9Sstevel@tonic-gate 
447c478bd9Sstevel@tonic-gate /* subcommand index */
457c478bd9Sstevel@tonic-gate enum subcommand_index {
467c478bd9Sstevel@tonic-gate 	CRYPTO_LIST,
477c478bd9Sstevel@tonic-gate 	CRYPTO_DISABLE,
487c478bd9Sstevel@tonic-gate 	CRYPTO_ENABLE,
497c478bd9Sstevel@tonic-gate 	CRYPTO_INSTALL,
507c478bd9Sstevel@tonic-gate 	CRYPTO_UNINSTALL,
517c478bd9Sstevel@tonic-gate 	CRYPTO_UNLOAD,
527c478bd9Sstevel@tonic-gate 	CRYPTO_REFRESH,
537c478bd9Sstevel@tonic-gate 	CRYPTO_START,
547c478bd9Sstevel@tonic-gate 	CRYPTO_STOP,
557c478bd9Sstevel@tonic-gate 	CRYPTO_HELP };
567c478bd9Sstevel@tonic-gate 
577c478bd9Sstevel@tonic-gate /*
580a85b835SDaniel Anderson  * TRANSLATION_NOTE
597c478bd9Sstevel@tonic-gate  * Command keywords are not to be translated.
607c478bd9Sstevel@tonic-gate  */
617c478bd9Sstevel@tonic-gate static char *cmd_table[] = {
627c478bd9Sstevel@tonic-gate 	"list",
637c478bd9Sstevel@tonic-gate 	"disable",
647c478bd9Sstevel@tonic-gate 	"enable",
657c478bd9Sstevel@tonic-gate 	"install",
667c478bd9Sstevel@tonic-gate 	"uninstall",
677c478bd9Sstevel@tonic-gate 	"unload",
687c478bd9Sstevel@tonic-gate 	"refresh",
697c478bd9Sstevel@tonic-gate 	"start",
707c478bd9Sstevel@tonic-gate 	"stop",
717c478bd9Sstevel@tonic-gate 	"--help" };
727c478bd9Sstevel@tonic-gate 
737c478bd9Sstevel@tonic-gate /* provider type */
747c478bd9Sstevel@tonic-gate enum provider_type_index {
757c478bd9Sstevel@tonic-gate 	PROV_UEF_LIB,
767c478bd9Sstevel@tonic-gate 	PROV_KEF_SOFT,
777c478bd9Sstevel@tonic-gate 	PROV_KEF_HARD,
787c478bd9Sstevel@tonic-gate 	METASLOT,
797c478bd9Sstevel@tonic-gate 	PROV_BADNAME };
807c478bd9Sstevel@tonic-gate 
817c478bd9Sstevel@tonic-gate typedef struct {
827c478bd9Sstevel@tonic-gate 	char cp_name[MAXPATHLEN];
837c478bd9Sstevel@tonic-gate 	enum provider_type_index cp_type;
847c478bd9Sstevel@tonic-gate } cryptoadm_provider_t;
857c478bd9Sstevel@tonic-gate 
867c478bd9Sstevel@tonic-gate /*
870a85b835SDaniel Anderson  * TRANSLATION_NOTE
887c478bd9Sstevel@tonic-gate  * Operand keywords are not to be translated.
897c478bd9Sstevel@tonic-gate  */
907c478bd9Sstevel@tonic-gate static const char *KN_PROVIDER = "provider=";
917c478bd9Sstevel@tonic-gate static const char *KN_MECH = "mechanism=";
927c478bd9Sstevel@tonic-gate static const char *KN_ALL = "all";
937c478bd9Sstevel@tonic-gate static const char *KN_TOKEN = "token=";
947c478bd9Sstevel@tonic-gate static const char *KN_SLOT = "slot=";
957c478bd9Sstevel@tonic-gate static const char *KN_DEFAULT_KS = "default-keystore";
967c478bd9Sstevel@tonic-gate static const char *KN_AUTO_KEY_MIGRATE = "auto-key-migrate";
977c478bd9Sstevel@tonic-gate 
987c478bd9Sstevel@tonic-gate /* static variables */
997c478bd9Sstevel@tonic-gate static boolean_t	allflag = B_FALSE;
1007c478bd9Sstevel@tonic-gate static boolean_t	rndflag = B_FALSE;
1017c478bd9Sstevel@tonic-gate static mechlist_t	*mecharglist = NULL;
1027c478bd9Sstevel@tonic-gate 
1037c478bd9Sstevel@tonic-gate /* static functions */
1047c478bd9Sstevel@tonic-gate static void usage(void);
1057c478bd9Sstevel@tonic-gate static int get_provider_type(char *);
1067c478bd9Sstevel@tonic-gate static int process_mech_operands(int, char **, boolean_t);
1077c478bd9Sstevel@tonic-gate static int do_list(int, char **);
1087c478bd9Sstevel@tonic-gate static int do_disable(int, char **);
1097c478bd9Sstevel@tonic-gate static int do_enable(int, char **);
1107c478bd9Sstevel@tonic-gate static int do_install(int, char **);
1117c478bd9Sstevel@tonic-gate static int do_uninstall(int, char **);
1127c478bd9Sstevel@tonic-gate static int do_unload(int, char **);
1137c478bd9Sstevel@tonic-gate static int do_refresh(int);
1147c478bd9Sstevel@tonic-gate static int do_start(int);
1157c478bd9Sstevel@tonic-gate static int do_stop(int);
1167c478bd9Sstevel@tonic-gate static int list_simple_for_all(boolean_t);
1177c478bd9Sstevel@tonic-gate static int list_mechlist_for_all(boolean_t);
1187c478bd9Sstevel@tonic-gate static int list_policy_for_all(void);
1197c478bd9Sstevel@tonic-gate 
1207c478bd9Sstevel@tonic-gate int
main(int argc,char * argv[])1217c478bd9Sstevel@tonic-gate main(int argc, char *argv[])
1227c478bd9Sstevel@tonic-gate {
1237c478bd9Sstevel@tonic-gate 	char	*subcmd;
1247c478bd9Sstevel@tonic-gate 	int	cmdnum;
1257c478bd9Sstevel@tonic-gate 	int	cmd_index = 0;
1267c478bd9Sstevel@tonic-gate 	int	rc = SUCCESS;
1277c478bd9Sstevel@tonic-gate 
1287c478bd9Sstevel@tonic-gate 	(void) setlocale(LC_ALL, "");
1297c478bd9Sstevel@tonic-gate 
1307c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN)	/* Should be defined by cc -D */
1317c478bd9Sstevel@tonic-gate #define	TEXT_DOMAIN "SYS_TEST"	/* Use this only if it weren't */
1327c478bd9Sstevel@tonic-gate #endif
1337c478bd9Sstevel@tonic-gate 	(void) textdomain(TEXT_DOMAIN);
1347c478bd9Sstevel@tonic-gate 
1357c478bd9Sstevel@tonic-gate 	cryptodebug_init(basename(argv[0]));
1367c478bd9Sstevel@tonic-gate 
1377c478bd9Sstevel@tonic-gate 	if (argc < REQ_ARG_CNT) {
1387c478bd9Sstevel@tonic-gate 		usage();
1397c478bd9Sstevel@tonic-gate 		return (ERROR_USAGE);
1407c478bd9Sstevel@tonic-gate 	}
1417c478bd9Sstevel@tonic-gate 
1427c478bd9Sstevel@tonic-gate 	/* get the subcommand index */
1437c478bd9Sstevel@tonic-gate 	cmd_index = 0;
1447c478bd9Sstevel@tonic-gate 	subcmd = argv[1];
1457c478bd9Sstevel@tonic-gate 	cmdnum = sizeof (cmd_table)/sizeof (cmd_table[0]);
1467c478bd9Sstevel@tonic-gate 
1477c478bd9Sstevel@tonic-gate 	while ((cmd_index < cmdnum) &&
1487c478bd9Sstevel@tonic-gate 	    (strcmp(subcmd, cmd_table[cmd_index]) != 0)) {
1497c478bd9Sstevel@tonic-gate 		cmd_index++;
1507c478bd9Sstevel@tonic-gate 	}
1517c478bd9Sstevel@tonic-gate 	if (cmd_index >= cmdnum) {
1527c478bd9Sstevel@tonic-gate 		usage();
1537c478bd9Sstevel@tonic-gate 		return (ERROR_USAGE);
1547c478bd9Sstevel@tonic-gate 	}
1557c478bd9Sstevel@tonic-gate 
1567c478bd9Sstevel@tonic-gate 	/* do the subcommand */
1577c478bd9Sstevel@tonic-gate 	switch (cmd_index) {
1587c478bd9Sstevel@tonic-gate 	case CRYPTO_LIST:
1597c478bd9Sstevel@tonic-gate 		rc = do_list(argc, argv);
1607c478bd9Sstevel@tonic-gate 		break;
1617c478bd9Sstevel@tonic-gate 	case CRYPTO_DISABLE:
1627c478bd9Sstevel@tonic-gate 		rc = do_disable(argc, argv);
1637c478bd9Sstevel@tonic-gate 		break;
1647c478bd9Sstevel@tonic-gate 	case CRYPTO_ENABLE:
1657c478bd9Sstevel@tonic-gate 		rc = do_enable(argc, argv);
1667c478bd9Sstevel@tonic-gate 		break;
1677c478bd9Sstevel@tonic-gate 	case CRYPTO_INSTALL:
1687c478bd9Sstevel@tonic-gate 		rc = do_install(argc, argv);
1697c478bd9Sstevel@tonic-gate 		break;
1707c478bd9Sstevel@tonic-gate 	case CRYPTO_UNINSTALL:
1717c478bd9Sstevel@tonic-gate 		rc = do_uninstall(argc, argv);
1727c478bd9Sstevel@tonic-gate 		break;
1737c478bd9Sstevel@tonic-gate 	case CRYPTO_UNLOAD:
1747c478bd9Sstevel@tonic-gate 		rc = do_unload(argc, argv);
1757c478bd9Sstevel@tonic-gate 		break;
1767c478bd9Sstevel@tonic-gate 	case CRYPTO_REFRESH:
1777c478bd9Sstevel@tonic-gate 		rc = do_refresh(argc);
1787c478bd9Sstevel@tonic-gate 		break;
1797c478bd9Sstevel@tonic-gate 	case CRYPTO_START:
1807c478bd9Sstevel@tonic-gate 		rc = do_start(argc);
1817c478bd9Sstevel@tonic-gate 		break;
1827c478bd9Sstevel@tonic-gate 	case CRYPTO_STOP:
1837c478bd9Sstevel@tonic-gate 		rc = do_stop(argc);
1847c478bd9Sstevel@tonic-gate 		break;
1857c478bd9Sstevel@tonic-gate 	case CRYPTO_HELP:
1867c478bd9Sstevel@tonic-gate 		usage();
1877c478bd9Sstevel@tonic-gate 		rc = SUCCESS;
1887c478bd9Sstevel@tonic-gate 		break;
1897c478bd9Sstevel@tonic-gate 	default: /* should not come here */
1907c478bd9Sstevel@tonic-gate 		usage();
1917c478bd9Sstevel@tonic-gate 		rc = ERROR_USAGE;
1927c478bd9Sstevel@tonic-gate 		break;
1937c478bd9Sstevel@tonic-gate 	}
1947c478bd9Sstevel@tonic-gate 	return (rc);
1957c478bd9Sstevel@tonic-gate }
1967c478bd9Sstevel@tonic-gate 
1977c478bd9Sstevel@tonic-gate 
1987c478bd9Sstevel@tonic-gate static void
usage(void)1997c478bd9Sstevel@tonic-gate usage(void)
2007c478bd9Sstevel@tonic-gate {
2017c478bd9Sstevel@tonic-gate 	/*
2020a85b835SDaniel Anderson 	 * TRANSLATION_NOTE
2037c478bd9Sstevel@tonic-gate 	 * Command usage is not to be translated.  Only the word "Usage:"
2047c478bd9Sstevel@tonic-gate 	 * along with localized expressions indicating what kind of value
2057c478bd9Sstevel@tonic-gate 	 * is expected for arguments.
2067c478bd9Sstevel@tonic-gate 	 */
2077c478bd9Sstevel@tonic-gate 	(void) fprintf(stderr, gettext("Usage:\n"));
2087c478bd9Sstevel@tonic-gate 	(void) fprintf(stderr,
2097c478bd9Sstevel@tonic-gate 	    "  cryptoadm list [-mpv] [provider=<%s> | metaslot]"
2107c478bd9Sstevel@tonic-gate 	    " [mechanism=<%s>]\n",
2117c478bd9Sstevel@tonic-gate 	    gettext("provider-name"), gettext("mechanism-list"));
2127c478bd9Sstevel@tonic-gate 	(void) fprintf(stderr,
2137c478bd9Sstevel@tonic-gate 	    "  cryptoadm disable provider=<%s>"
2147c478bd9Sstevel@tonic-gate 	    " mechanism=<%s> | random | all\n",
2157c478bd9Sstevel@tonic-gate 	    gettext("provider-name"), gettext("mechanism-list"));
2167c478bd9Sstevel@tonic-gate 	(void) fprintf(stderr,
2177c478bd9Sstevel@tonic-gate 	    "  cryptoadm disable metaslot"
2187c478bd9Sstevel@tonic-gate 	    " [auto-key-migrate] [mechanism=<%s>]\n",
2197c478bd9Sstevel@tonic-gate 	    gettext("mechanism-list"));
2207c478bd9Sstevel@tonic-gate 	(void) fprintf(stderr,
2217c478bd9Sstevel@tonic-gate 	    "  cryptoadm enable provider=<%s>"
2227c478bd9Sstevel@tonic-gate 	    " mechanism=<%s> | random | all\n",
2237c478bd9Sstevel@tonic-gate 	    gettext("provider-name"), gettext("mechanism-list"));
2247c478bd9Sstevel@tonic-gate 	(void) fprintf(stderr,
2257c478bd9Sstevel@tonic-gate 	    "  cryptoadm enable metaslot [mechanism=<%s>]"
2267c478bd9Sstevel@tonic-gate 	    " [[token=<%s>] [slot=<%s>]"
2277c478bd9Sstevel@tonic-gate 	    " | [default-keystore]] | [auto-key-migrate]\n",
2287c478bd9Sstevel@tonic-gate 	    gettext("mechanism-list"), gettext("token-label"),
2297c478bd9Sstevel@tonic-gate 	    gettext("slot-description"));
2307c478bd9Sstevel@tonic-gate 	(void) fprintf(stderr,
2317c478bd9Sstevel@tonic-gate 	    "  cryptoadm install provider=<%s>\n",
2327c478bd9Sstevel@tonic-gate 	    gettext("provider-name"));
2337c478bd9Sstevel@tonic-gate 	(void) fprintf(stderr,
2347c478bd9Sstevel@tonic-gate 	    "  cryptoadm install provider=<%s> [mechanism=<%s>]\n",
2357c478bd9Sstevel@tonic-gate 	    gettext("provider-name"), gettext("mechanism-list"));
2367c478bd9Sstevel@tonic-gate 	(void) fprintf(stderr,
2377c478bd9Sstevel@tonic-gate 	    "  cryptoadm uninstall provider=<%s>\n",
2387c478bd9Sstevel@tonic-gate 	    gettext("provider-name"));
2397c478bd9Sstevel@tonic-gate 	(void) fprintf(stderr,
2407c478bd9Sstevel@tonic-gate 	    "  cryptoadm unload provider=<%s>\n",
2417c478bd9Sstevel@tonic-gate 	    gettext("provider-name"));
2427c478bd9Sstevel@tonic-gate 	(void) fprintf(stderr,
2437c478bd9Sstevel@tonic-gate 	    "  cryptoadm refresh\n"
2447c478bd9Sstevel@tonic-gate 	    "  cryptoadm start\n"
2457c478bd9Sstevel@tonic-gate 	    "  cryptoadm stop\n"
2467c478bd9Sstevel@tonic-gate 	    "  cryptoadm --help\n");
2477c478bd9Sstevel@tonic-gate }
2487c478bd9Sstevel@tonic-gate 
2497c478bd9Sstevel@tonic-gate 
2507c478bd9Sstevel@tonic-gate /*
2517c478bd9Sstevel@tonic-gate  * Get the provider type.  This function returns
2527c478bd9Sstevel@tonic-gate  * - PROV_UEF_LIB if provname contains an absolute path name
2531b22764fSDaniel OpenSolaris Anderson  * - PROV_KEF_SOFT if provname is a base name only (e.g., "aes").
2547c478bd9Sstevel@tonic-gate  * - PROV_KEF_HARD if provname contains one slash only and the slash is not
2551b22764fSDaniel OpenSolaris Anderson  *	the 1st character (e.g., "mca/0").
2560a85b835SDaniel Anderson  * - PROV_BADNAME otherwise.
2577c478bd9Sstevel@tonic-gate  */
2587c478bd9Sstevel@tonic-gate static int
get_provider_type(char * provname)2597c478bd9Sstevel@tonic-gate get_provider_type(char *provname)
2607c478bd9Sstevel@tonic-gate {
2617c478bd9Sstevel@tonic-gate 	char *pslash1;
2627c478bd9Sstevel@tonic-gate 	char *pslash2;
2637c478bd9Sstevel@tonic-gate 
2647c478bd9Sstevel@tonic-gate 	if (provname == NULL) {
2657c478bd9Sstevel@tonic-gate 		return (FAILURE);
2667c478bd9Sstevel@tonic-gate 	}
2677c478bd9Sstevel@tonic-gate 
2687c478bd9Sstevel@tonic-gate 	if (provname[0] == '/') {
2697c478bd9Sstevel@tonic-gate 		return (PROV_UEF_LIB);
2707c478bd9Sstevel@tonic-gate 	} else if ((pslash1 = strchr(provname, SEP_SLASH)) == NULL) {
2717c478bd9Sstevel@tonic-gate 		/* no slash */
2727c478bd9Sstevel@tonic-gate 		return (PROV_KEF_SOFT);
2737c478bd9Sstevel@tonic-gate 	} else {
2747c478bd9Sstevel@tonic-gate 		pslash2 = strrchr(provname, SEP_SLASH);
2757c478bd9Sstevel@tonic-gate 		if (pslash1 == pslash2) {
2767c478bd9Sstevel@tonic-gate 			return (PROV_KEF_HARD);
2777c478bd9Sstevel@tonic-gate 		} else {
2787c478bd9Sstevel@tonic-gate 			return (PROV_BADNAME);
2797c478bd9Sstevel@tonic-gate 		}
2807c478bd9Sstevel@tonic-gate 	}
2817c478bd9Sstevel@tonic-gate }
2827c478bd9Sstevel@tonic-gate 
2837c478bd9Sstevel@tonic-gate /*
2847c478bd9Sstevel@tonic-gate  * Get the provider structure.  This function returns NULL if no valid
2857c478bd9Sstevel@tonic-gate  * provider= is found in argv[], otherwise a cryptoadm_provider_t is returned.
2867c478bd9Sstevel@tonic-gate  * If provider= is found but has no argument, then a cryptoadm_provider_t
2877c478bd9Sstevel@tonic-gate  * with cp_type = PROV_BADNAME is returned.
2887c478bd9Sstevel@tonic-gate  */
2897c478bd9Sstevel@tonic-gate static cryptoadm_provider_t *
get_provider(int argc,char ** argv)2907c478bd9Sstevel@tonic-gate get_provider(int argc, char **argv)
2917c478bd9Sstevel@tonic-gate {
2921b22764fSDaniel OpenSolaris Anderson 	int			c = 0;
2931b22764fSDaniel OpenSolaris Anderson 	boolean_t		found = B_FALSE;
2941b22764fSDaniel OpenSolaris Anderson 	cryptoadm_provider_t	*provider = NULL;
2951b22764fSDaniel OpenSolaris Anderson 	char			*provstr = NULL, *savstr;
2961b22764fSDaniel OpenSolaris Anderson 	boolean_t		is_metaslot = B_FALSE;
2977c478bd9Sstevel@tonic-gate 
2987c478bd9Sstevel@tonic-gate 	while (!found && ++c < argc) {
2997c478bd9Sstevel@tonic-gate 		if (strncmp(argv[c], METASLOT_KEYWORD,
3007c478bd9Sstevel@tonic-gate 		    strlen(METASLOT_KEYWORD)) == 0) {
3017c478bd9Sstevel@tonic-gate 			is_metaslot = B_TRUE;
3027c478bd9Sstevel@tonic-gate 			found = B_TRUE;
3037c478bd9Sstevel@tonic-gate 		} else if (strncmp(argv[c], KN_PROVIDER,
3047c478bd9Sstevel@tonic-gate 		    strlen(KN_PROVIDER)) == 0 &&
3057c478bd9Sstevel@tonic-gate 		    strlen(argv[c]) > strlen(KN_PROVIDER)) {
3067c478bd9Sstevel@tonic-gate 			if ((provstr = strdup(argv[c])) == NULL) {
3077c478bd9Sstevel@tonic-gate 				int err = errno;
3087c478bd9Sstevel@tonic-gate 				/*
3090a85b835SDaniel Anderson 				 * TRANSLATION_NOTE
3107c478bd9Sstevel@tonic-gate 				 * "get_provider" is a function name and should
3117c478bd9Sstevel@tonic-gate 				 * not be translated.
3127c478bd9Sstevel@tonic-gate 				 */
3137c478bd9Sstevel@tonic-gate 				cryptoerror(LOG_STDERR, "get_provider: %s.",
3147c478bd9Sstevel@tonic-gate 				    strerror(err));
3157c478bd9Sstevel@tonic-gate 				return (NULL);
3167c478bd9Sstevel@tonic-gate 			}
3177c478bd9Sstevel@tonic-gate 			found = B_TRUE;
3187c478bd9Sstevel@tonic-gate 		}
3197c478bd9Sstevel@tonic-gate 	}
3207c478bd9Sstevel@tonic-gate 	if (!found)
3217c478bd9Sstevel@tonic-gate 		return (NULL);
3227c478bd9Sstevel@tonic-gate 
3237c478bd9Sstevel@tonic-gate 	provider = malloc(sizeof (cryptoadm_provider_t));
3247c478bd9Sstevel@tonic-gate 	if (provider == NULL) {
3257c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("out of memory."));
3267c478bd9Sstevel@tonic-gate 		if (provstr) {
3277c478bd9Sstevel@tonic-gate 			free(provstr);
3287c478bd9Sstevel@tonic-gate 		}
3297c478bd9Sstevel@tonic-gate 		return (NULL);
3307c478bd9Sstevel@tonic-gate 	}
3317c478bd9Sstevel@tonic-gate 
3327c478bd9Sstevel@tonic-gate 	if (is_metaslot) {
3337c478bd9Sstevel@tonic-gate 		(void) strlcpy(provider->cp_name, METASLOT_KEYWORD,
3347c478bd9Sstevel@tonic-gate 		    strlen(METASLOT_KEYWORD));
3357c478bd9Sstevel@tonic-gate 		provider->cp_type = METASLOT;
3367c478bd9Sstevel@tonic-gate 	} else {
3377c478bd9Sstevel@tonic-gate 
3387c478bd9Sstevel@tonic-gate 		savstr = provstr;
3397c478bd9Sstevel@tonic-gate 		(void) strtok(provstr, "=");
3407c478bd9Sstevel@tonic-gate 		provstr = strtok(NULL, "=");
3417c478bd9Sstevel@tonic-gate 		if (provstr == NULL) {
3427c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext("bad provider name."));
3437c478bd9Sstevel@tonic-gate 			provider->cp_type = PROV_BADNAME;
3447c478bd9Sstevel@tonic-gate 			free(savstr);
3457c478bd9Sstevel@tonic-gate 			return (provider);
3467c478bd9Sstevel@tonic-gate 		}
3477c478bd9Sstevel@tonic-gate 
3487c478bd9Sstevel@tonic-gate 		(void) strlcpy(provider->cp_name, provstr,
3497c478bd9Sstevel@tonic-gate 		    sizeof (provider->cp_name));
3507c478bd9Sstevel@tonic-gate 		provider->cp_type = get_provider_type(provider->cp_name);
3517c478bd9Sstevel@tonic-gate 
3527c478bd9Sstevel@tonic-gate 		free(savstr);
3537c478bd9Sstevel@tonic-gate 	}
3547c478bd9Sstevel@tonic-gate 	return (provider);
3557c478bd9Sstevel@tonic-gate }
3567c478bd9Sstevel@tonic-gate 
3577c478bd9Sstevel@tonic-gate /*
3587c478bd9Sstevel@tonic-gate  * Process the "feature" operands.
3597c478bd9Sstevel@tonic-gate  *
3607c478bd9Sstevel@tonic-gate  * "argc" and "argv" contain values specified on the command line.
3617c478bd9Sstevel@tonic-gate  * All other arguments are used for returning parsing results.
3627c478bd9Sstevel@tonic-gate  * If any of these arguments are NULL, that keyword is not expected,
3637c478bd9Sstevel@tonic-gate  * and FAILURE will be returned.
3647c478bd9Sstevel@tonic-gate  */
3657c478bd9Sstevel@tonic-gate static int
process_metaslot_operands(int argc,char ** argv,char ** meta_ks_token,char ** meta_ks_slot,boolean_t * use_default,boolean_t * auto_key_migrate_flag)3667c478bd9Sstevel@tonic-gate process_metaslot_operands(int argc, char **argv, char **meta_ks_token,
3677c478bd9Sstevel@tonic-gate     char **meta_ks_slot, boolean_t *use_default,
3687c478bd9Sstevel@tonic-gate     boolean_t *auto_key_migrate_flag)
3697c478bd9Sstevel@tonic-gate {
3707c478bd9Sstevel@tonic-gate 	int c = 2;
3717c478bd9Sstevel@tonic-gate 	int rc = SUCCESS;
3727c478bd9Sstevel@tonic-gate 
3737c478bd9Sstevel@tonic-gate 	while (++c < argc) {
3747c478bd9Sstevel@tonic-gate 		if ((strncmp(argv[c], KN_MECH, strlen(KN_MECH)) == 0) &&
3757c478bd9Sstevel@tonic-gate 		    strlen(argv[c]) > strlen(KN_MECH)) {
3767c478bd9Sstevel@tonic-gate 
3777c478bd9Sstevel@tonic-gate 			/* process mechanism operands */
3787c478bd9Sstevel@tonic-gate 			if ((rc = process_mech_operands(argc, argv, B_TRUE))
3797c478bd9Sstevel@tonic-gate 			    != SUCCESS) {
3807c478bd9Sstevel@tonic-gate 				goto finish;
3817c478bd9Sstevel@tonic-gate 			}
3827c478bd9Sstevel@tonic-gate 
3837c478bd9Sstevel@tonic-gate 		} else if ((strncmp(argv[c], KN_TOKEN,
3847c478bd9Sstevel@tonic-gate 		    strlen(KN_TOKEN)) == 0) &&
3857c478bd9Sstevel@tonic-gate 		    strlen(argv[c]) > strlen(KN_TOKEN)) {
3867c478bd9Sstevel@tonic-gate 			if ((meta_ks_token) && (strtok(argv[c], "=") != NULL)) {
3877c478bd9Sstevel@tonic-gate 				char *tmp;
3887c478bd9Sstevel@tonic-gate 				if ((tmp = strtok(NULL, "=")) != NULL) {
3897c478bd9Sstevel@tonic-gate 					*meta_ks_token = strdup(tmp);
3907c478bd9Sstevel@tonic-gate 				} else {
3917c478bd9Sstevel@tonic-gate 					return (FAILURE);
3927c478bd9Sstevel@tonic-gate 				}
3937c478bd9Sstevel@tonic-gate 			} else {
3947c478bd9Sstevel@tonic-gate 				return (FAILURE);
3957c478bd9Sstevel@tonic-gate 			}
3967c478bd9Sstevel@tonic-gate 
3977c478bd9Sstevel@tonic-gate 		} else if ((strncmp(argv[c], KN_SLOT,
3987c478bd9Sstevel@tonic-gate 		    strlen(KN_SLOT)) == 0) &&
3997c478bd9Sstevel@tonic-gate 		    strlen(argv[c]) > strlen(KN_SLOT)) {
4007c478bd9Sstevel@tonic-gate 
4017c478bd9Sstevel@tonic-gate 			if ((meta_ks_slot) && (strtok(argv[c], "=") != NULL)) {
4027c478bd9Sstevel@tonic-gate 				char *tmp;
4037c478bd9Sstevel@tonic-gate 				if ((tmp = strtok(NULL, "=")) != NULL) {
4047c478bd9Sstevel@tonic-gate 					*meta_ks_slot = strdup(tmp);
4057c478bd9Sstevel@tonic-gate 				} else {
4067c478bd9Sstevel@tonic-gate 					return (FAILURE);
4077c478bd9Sstevel@tonic-gate 				}
4087c478bd9Sstevel@tonic-gate 			} else {
4097c478bd9Sstevel@tonic-gate 				return (FAILURE);
4107c478bd9Sstevel@tonic-gate 			}
4117c478bd9Sstevel@tonic-gate 
4127c478bd9Sstevel@tonic-gate 		} else if (strncmp(argv[c], KN_DEFAULT_KS,
4137c478bd9Sstevel@tonic-gate 		    strlen(KN_DEFAULT_KS)) == 0) {
4147c478bd9Sstevel@tonic-gate 
4157c478bd9Sstevel@tonic-gate 			if (use_default) {
4167c478bd9Sstevel@tonic-gate 				*use_default = B_TRUE;
4177c478bd9Sstevel@tonic-gate 			} else {
4187c478bd9Sstevel@tonic-gate 				return (FAILURE);
4197c478bd9Sstevel@tonic-gate 			}
4207c478bd9Sstevel@tonic-gate 		} else if (strncmp(argv[c], KN_AUTO_KEY_MIGRATE,
4217c478bd9Sstevel@tonic-gate 		    strlen(KN_AUTO_KEY_MIGRATE)) == 0) {
4227c478bd9Sstevel@tonic-gate 
4237c478bd9Sstevel@tonic-gate 			if (auto_key_migrate_flag) {
4247c478bd9Sstevel@tonic-gate 				*auto_key_migrate_flag = B_TRUE;
4257c478bd9Sstevel@tonic-gate 			} else {
4267c478bd9Sstevel@tonic-gate 				return (FAILURE);
4277c478bd9Sstevel@tonic-gate 			}
4287c478bd9Sstevel@tonic-gate 		} else {
4297c478bd9Sstevel@tonic-gate 			return (FAILURE);
4307c478bd9Sstevel@tonic-gate 		}
4317c478bd9Sstevel@tonic-gate 	}
4327c478bd9Sstevel@tonic-gate finish:
4337c478bd9Sstevel@tonic-gate 	return (rc);
4347c478bd9Sstevel@tonic-gate }
4357c478bd9Sstevel@tonic-gate 
4367c478bd9Sstevel@tonic-gate /*
4377c478bd9Sstevel@tonic-gate  * Process the "feature" operands.
4387c478bd9Sstevel@tonic-gate  */
4397c478bd9Sstevel@tonic-gate static int
process_feature_operands(int argc,char ** argv)4407c478bd9Sstevel@tonic-gate process_feature_operands(int argc, char **argv)
4417c478bd9Sstevel@tonic-gate {
4427c478bd9Sstevel@tonic-gate 	int c = 2;
4437c478bd9Sstevel@tonic-gate 
4447c478bd9Sstevel@tonic-gate 	while (++c < argc) {
4457c478bd9Sstevel@tonic-gate 		if (strcmp(argv[c], KN_ALL) == 0) {
4467c478bd9Sstevel@tonic-gate 			allflag = B_TRUE;
4477c478bd9Sstevel@tonic-gate 			rndflag = B_TRUE; /* all includes random also. */
4487c478bd9Sstevel@tonic-gate 		} else if (strcmp(argv[c], RANDOM) == 0) {
4497c478bd9Sstevel@tonic-gate 			rndflag = B_TRUE;
4507c478bd9Sstevel@tonic-gate 		}
4517c478bd9Sstevel@tonic-gate 	}
4527c478bd9Sstevel@tonic-gate 	return (SUCCESS);
4537c478bd9Sstevel@tonic-gate }
4547c478bd9Sstevel@tonic-gate 
4557c478bd9Sstevel@tonic-gate /*
4567c478bd9Sstevel@tonic-gate  * Process the mechanism operands for the disable, enable and install
4577c478bd9Sstevel@tonic-gate  * subcommands.  This function sets the static variable allflag to be B_TRUE
4587c478bd9Sstevel@tonic-gate  * if the keyword "all" is specified, otherwise builds a link list of the
4597c478bd9Sstevel@tonic-gate  * mechanism operands and save it in the static variable mecharglist.
4607c478bd9Sstevel@tonic-gate  *
4617c478bd9Sstevel@tonic-gate  * This function returns
4621b22764fSDaniel OpenSolaris Anderson  *	ERROR_USAGE: mechanism operand is missing.
4631b22764fSDaniel OpenSolaris Anderson  *	FAILURE: out of memory.
4641b22764fSDaniel OpenSolaris Anderson  *	SUCCESS: otherwise.
4657c478bd9Sstevel@tonic-gate  */
4667c478bd9Sstevel@tonic-gate static int
process_mech_operands(int argc,char ** argv,boolean_t quiet)4677c478bd9Sstevel@tonic-gate process_mech_operands(int argc, char **argv, boolean_t quiet)
4687c478bd9Sstevel@tonic-gate {
4691b22764fSDaniel OpenSolaris Anderson 	mechlist_t	*pmech;
4701b22764fSDaniel OpenSolaris Anderson 	mechlist_t	*pcur = NULL;
4711b22764fSDaniel OpenSolaris Anderson 	mechlist_t	*phead = NULL;
4721b22764fSDaniel OpenSolaris Anderson 	boolean_t	found = B_FALSE;
4731b22764fSDaniel OpenSolaris Anderson 	char		*mechliststr = NULL;
4741b22764fSDaniel OpenSolaris Anderson 	char		*curmech = NULL;
4751b22764fSDaniel OpenSolaris Anderson 	int		c = -1;
4761b22764fSDaniel OpenSolaris Anderson 	int		rc = SUCCESS;
4777c478bd9Sstevel@tonic-gate 
4787c478bd9Sstevel@tonic-gate 	while (!found && ++c < argc) {
4797c478bd9Sstevel@tonic-gate 		if ((strncmp(argv[c], KN_MECH, strlen(KN_MECH)) == 0) &&
4807c478bd9Sstevel@tonic-gate 		    strlen(argv[c]) > strlen(KN_MECH)) {
4817c478bd9Sstevel@tonic-gate 			found = B_TRUE;
4827c478bd9Sstevel@tonic-gate 		}
4837c478bd9Sstevel@tonic-gate 	}
4847c478bd9Sstevel@tonic-gate 	if (!found) {
4857c478bd9Sstevel@tonic-gate 		if (!quiet)
4867c478bd9Sstevel@tonic-gate 			/*
4870a85b835SDaniel Anderson 			 * TRANSLATION_NOTE
4887c478bd9Sstevel@tonic-gate 			 * "mechanism" could be either a literal keyword
4897c478bd9Sstevel@tonic-gate 			 * and hence not to be translated, or a descriptive
4907c478bd9Sstevel@tonic-gate 			 * word and translatable.  A choice was made to
4917c478bd9Sstevel@tonic-gate 			 * view it as a literal keyword.
4927c478bd9Sstevel@tonic-gate 			 */
4937c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_STDERR,
4941b22764fSDaniel OpenSolaris Anderson 			    gettext("the %s operand is missing.\n"),
4951b22764fSDaniel OpenSolaris Anderson 			    "mechanism");
4967c478bd9Sstevel@tonic-gate 		return (ERROR_USAGE);
4977c478bd9Sstevel@tonic-gate 	}
4987c478bd9Sstevel@tonic-gate 	(void) strtok(argv[c], "=");
4997c478bd9Sstevel@tonic-gate 	mechliststr = strtok(NULL, "=");
5007c478bd9Sstevel@tonic-gate 
5017c478bd9Sstevel@tonic-gate 	if (strcmp(mechliststr, "all") == 0) {
5027c478bd9Sstevel@tonic-gate 		allflag = B_TRUE;
5037c478bd9Sstevel@tonic-gate 		mecharglist = NULL;
5047c478bd9Sstevel@tonic-gate 		return (SUCCESS);
5057c478bd9Sstevel@tonic-gate 	}
5067c478bd9Sstevel@tonic-gate 
5077c478bd9Sstevel@tonic-gate 	curmech = strtok(mechliststr, ",");
5087c478bd9Sstevel@tonic-gate 	do {
5097c478bd9Sstevel@tonic-gate 		if ((pmech = create_mech(curmech)) == NULL) {
5107c478bd9Sstevel@tonic-gate 			rc = FAILURE;
5117c478bd9Sstevel@tonic-gate 			break;
5127c478bd9Sstevel@tonic-gate 		} else {
5137c478bd9Sstevel@tonic-gate 			if (phead == NULL) {
5147c478bd9Sstevel@tonic-gate 				phead = pcur = pmech;
5157c478bd9Sstevel@tonic-gate 			} else {
5167c478bd9Sstevel@tonic-gate 				pcur->next = pmech;
5177c478bd9Sstevel@tonic-gate 				pcur = pmech;
5187c478bd9Sstevel@tonic-gate 			}
5197c478bd9Sstevel@tonic-gate 		}
5207c478bd9Sstevel@tonic-gate 	} while ((curmech = strtok(NULL, ",")) != NULL);
5217c478bd9Sstevel@tonic-gate 
5227c478bd9Sstevel@tonic-gate 	if (rc == FAILURE) {
5237c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("out of memory."));
5247c478bd9Sstevel@tonic-gate 		free_mechlist(phead);
5257c478bd9Sstevel@tonic-gate 	} else {
5267c478bd9Sstevel@tonic-gate 		mecharglist = phead;
5277c478bd9Sstevel@tonic-gate 		rc = SUCCESS;
5287c478bd9Sstevel@tonic-gate 	}
5297c478bd9Sstevel@tonic-gate 	return (rc);
5307c478bd9Sstevel@tonic-gate }
5317c478bd9Sstevel@tonic-gate 
5327c478bd9Sstevel@tonic-gate 
5337c478bd9Sstevel@tonic-gate 
5347c478bd9Sstevel@tonic-gate /*
5351b22764fSDaniel OpenSolaris Anderson  * The top level function for the "cryptoadm list" subcommand and options.
5367c478bd9Sstevel@tonic-gate  */
5377c478bd9Sstevel@tonic-gate static int
do_list(int argc,char ** argv)5387c478bd9Sstevel@tonic-gate do_list(int argc, char **argv)
5397c478bd9Sstevel@tonic-gate {
5401b22764fSDaniel OpenSolaris Anderson 	boolean_t		mflag = B_FALSE;
5411b22764fSDaniel OpenSolaris Anderson 	boolean_t		pflag = B_FALSE;
5421b22764fSDaniel OpenSolaris Anderson 	boolean_t		vflag = B_FALSE;
543*ef150c2bSRichard Lowe 	int			ch;
5441b22764fSDaniel OpenSolaris Anderson 	cryptoadm_provider_t	*prov = NULL;
5451b22764fSDaniel OpenSolaris Anderson 	int			rc = SUCCESS;
5467c478bd9Sstevel@tonic-gate 
5477c478bd9Sstevel@tonic-gate 	argc -= 1;
5487c478bd9Sstevel@tonic-gate 	argv += 1;
5497c478bd9Sstevel@tonic-gate 
5507c478bd9Sstevel@tonic-gate 	if (argc == 1) {
5517c478bd9Sstevel@tonic-gate 		rc = list_simple_for_all(B_FALSE);
5527c478bd9Sstevel@tonic-gate 		goto out;
5537c478bd9Sstevel@tonic-gate 	}
5547c478bd9Sstevel@tonic-gate 
5557c478bd9Sstevel@tonic-gate 	/*
5561b22764fSDaniel OpenSolaris Anderson 	 * cryptoadm list [-v] [-m] [-p] [provider=<>] [mechanism=<>]
5577c478bd9Sstevel@tonic-gate 	 */
5587c478bd9Sstevel@tonic-gate 	if (argc > 5) {
5597c478bd9Sstevel@tonic-gate 		usage();
5607c478bd9Sstevel@tonic-gate 		return (rc);
5617c478bd9Sstevel@tonic-gate 	}
5627c478bd9Sstevel@tonic-gate 
5637c478bd9Sstevel@tonic-gate 	while ((ch = getopt(argc, argv, "mpv")) != EOF) {
5647c478bd9Sstevel@tonic-gate 		switch (ch) {
5657c478bd9Sstevel@tonic-gate 		case 'm':
5667c478bd9Sstevel@tonic-gate 			mflag = B_TRUE;
5677c478bd9Sstevel@tonic-gate 			if (pflag) {
5687c478bd9Sstevel@tonic-gate 				rc = ERROR_USAGE;
5697c478bd9Sstevel@tonic-gate 			}
5707c478bd9Sstevel@tonic-gate 			break;
5717c478bd9Sstevel@tonic-gate 		case 'p':
5727c478bd9Sstevel@tonic-gate 			pflag = B_TRUE;
5737c478bd9Sstevel@tonic-gate 			if (mflag || vflag) {
5747c478bd9Sstevel@tonic-gate 				rc = ERROR_USAGE;
5757c478bd9Sstevel@tonic-gate 			}
5767c478bd9Sstevel@tonic-gate 			break;
5777c478bd9Sstevel@tonic-gate 		case 'v':
5787c478bd9Sstevel@tonic-gate 			vflag = B_TRUE;
5797c478bd9Sstevel@tonic-gate 			if (pflag)
5807c478bd9Sstevel@tonic-gate 				rc = ERROR_USAGE;
5817c478bd9Sstevel@tonic-gate 			break;
5827c478bd9Sstevel@tonic-gate 		default:
5837c478bd9Sstevel@tonic-gate 			rc = ERROR_USAGE;
5847c478bd9Sstevel@tonic-gate 			break;
5857c478bd9Sstevel@tonic-gate 		}
5867c478bd9Sstevel@tonic-gate 	}
5877c478bd9Sstevel@tonic-gate 
5887c478bd9Sstevel@tonic-gate 	if (rc == ERROR_USAGE) {
5897c478bd9Sstevel@tonic-gate 		usage();
5907c478bd9Sstevel@tonic-gate 		return (rc);
5917c478bd9Sstevel@tonic-gate 	}
5927c478bd9Sstevel@tonic-gate 
5937c478bd9Sstevel@tonic-gate 	if ((rc = process_feature_operands(argc, argv)) != SUCCESS) {
5947c478bd9Sstevel@tonic-gate 		goto out;
5957c478bd9Sstevel@tonic-gate 	}
5967c478bd9Sstevel@tonic-gate 
5977c478bd9Sstevel@tonic-gate 	prov = get_provider(argc, argv);
5987c478bd9Sstevel@tonic-gate 
5997c478bd9Sstevel@tonic-gate 	if (mflag || vflag) {
6007c478bd9Sstevel@tonic-gate 		if (argc > 0) {
6017c478bd9Sstevel@tonic-gate 			rc = process_mech_operands(argc, argv, B_TRUE);
6027c478bd9Sstevel@tonic-gate 			if (rc == FAILURE)
6037c478bd9Sstevel@tonic-gate 				goto out;
6047c478bd9Sstevel@tonic-gate 			/* "-m" is implied when a mechanism list is given */
6057c478bd9Sstevel@tonic-gate 			if (mecharglist != NULL || allflag)
6067c478bd9Sstevel@tonic-gate 				mflag = B_TRUE;
6077c478bd9Sstevel@tonic-gate 		}
6087c478bd9Sstevel@tonic-gate 	}
6097c478bd9Sstevel@tonic-gate 
6107c478bd9Sstevel@tonic-gate 	if (prov == NULL) {
6117c478bd9Sstevel@tonic-gate 		if (mflag) {
6127c478bd9Sstevel@tonic-gate 			rc = list_mechlist_for_all(vflag);
6137c478bd9Sstevel@tonic-gate 		} else if (pflag) {
6147c478bd9Sstevel@tonic-gate 			rc = list_policy_for_all();
6157c478bd9Sstevel@tonic-gate 		} else if (vflag) {
6167c478bd9Sstevel@tonic-gate 			rc = list_simple_for_all(vflag);
6177c478bd9Sstevel@tonic-gate 		}
6187c478bd9Sstevel@tonic-gate 	} else if (prov->cp_type == METASLOT) {
6197c478bd9Sstevel@tonic-gate 		if ((!mflag) && (!vflag) && (!pflag)) {
6207c478bd9Sstevel@tonic-gate 			/* no flag is specified, just list metaslot status */
6217c478bd9Sstevel@tonic-gate 			rc = list_metaslot_info(mflag, vflag, mecharglist);
6227c478bd9Sstevel@tonic-gate 		} else if (mflag || vflag) {
6237c478bd9Sstevel@tonic-gate 			rc = list_metaslot_info(mflag, vflag, mecharglist);
6247c478bd9Sstevel@tonic-gate 		} else if (pflag) {
6257c478bd9Sstevel@tonic-gate 			rc = list_metaslot_policy();
6267c478bd9Sstevel@tonic-gate 		} else {
6277c478bd9Sstevel@tonic-gate 			/* error message */
6287c478bd9Sstevel@tonic-gate 			usage();
6297c478bd9Sstevel@tonic-gate 			rc = ERROR_USAGE;
6307c478bd9Sstevel@tonic-gate 		}
6317c478bd9Sstevel@tonic-gate 	} else if (prov->cp_type == PROV_BADNAME) {
6327c478bd9Sstevel@tonic-gate 		usage();
6337c478bd9Sstevel@tonic-gate 		rc = ERROR_USAGE;
6347c478bd9Sstevel@tonic-gate 		goto out;
6357c478bd9Sstevel@tonic-gate 	} else { /* do the listing for a provider only */
6361b22764fSDaniel OpenSolaris Anderson 		char	*provname = prov->cp_name;
6371b22764fSDaniel OpenSolaris Anderson 
6387c478bd9Sstevel@tonic-gate 		if (mflag || vflag) {
6397c478bd9Sstevel@tonic-gate 			if (vflag)
6407c478bd9Sstevel@tonic-gate 				(void) printf(gettext("Provider: %s\n"),
6411b22764fSDaniel OpenSolaris Anderson 				    provname);
6427c478bd9Sstevel@tonic-gate 			switch (prov->cp_type) {
6437c478bd9Sstevel@tonic-gate 			case PROV_UEF_LIB:
6441b22764fSDaniel OpenSolaris Anderson 				rc = list_mechlist_for_lib(provname,
6451b22764fSDaniel OpenSolaris Anderson 				    mecharglist, NULL, B_FALSE, vflag, mflag);
6467c478bd9Sstevel@tonic-gate 				break;
6477c478bd9Sstevel@tonic-gate 			case PROV_KEF_SOFT:
6481b22764fSDaniel OpenSolaris Anderson 				rc = list_mechlist_for_soft(provname,
649d616ad8eSHai-May Chao 				    NULL, NULL);
6507c478bd9Sstevel@tonic-gate 				break;
6517c478bd9Sstevel@tonic-gate 			case PROV_KEF_HARD:
6521b22764fSDaniel OpenSolaris Anderson 				rc = list_mechlist_for_hard(provname);
6537c478bd9Sstevel@tonic-gate 				break;
6547c478bd9Sstevel@tonic-gate 			default: /* should not come here */
6557c478bd9Sstevel@tonic-gate 				rc = FAILURE;
6567c478bd9Sstevel@tonic-gate 				break;
6577c478bd9Sstevel@tonic-gate 			}
6587c478bd9Sstevel@tonic-gate 		} else if (pflag) {
6597c478bd9Sstevel@tonic-gate 			switch (prov->cp_type) {
6607c478bd9Sstevel@tonic-gate 			case PROV_UEF_LIB:
6611b22764fSDaniel OpenSolaris Anderson 				rc = list_policy_for_lib(provname);
6627c478bd9Sstevel@tonic-gate 				break;
6637c478bd9Sstevel@tonic-gate 			case PROV_KEF_SOFT:
6647c478bd9Sstevel@tonic-gate 				if (getzoneid() == GLOBAL_ZONEID) {
6651b22764fSDaniel OpenSolaris Anderson 					rc = list_policy_for_soft(provname,
666d616ad8eSHai-May Chao 					    NULL, NULL);
6677c478bd9Sstevel@tonic-gate 				} else {
6687c478bd9Sstevel@tonic-gate 					/*
6690a85b835SDaniel Anderson 					 * TRANSLATION_NOTE
6707c478bd9Sstevel@tonic-gate 					 * "global" is keyword and not to
6717c478bd9Sstevel@tonic-gate 					 * be translated.
6727c478bd9Sstevel@tonic-gate 					 */
6737c478bd9Sstevel@tonic-gate 					cryptoerror(LOG_STDERR, gettext(
6747c478bd9Sstevel@tonic-gate 					    "policy information for kernel "
6757c478bd9Sstevel@tonic-gate 					    "providers is available "
6767c478bd9Sstevel@tonic-gate 					    "in the %s zone only"), "global");
6777c478bd9Sstevel@tonic-gate 					rc = FAILURE;
6787c478bd9Sstevel@tonic-gate 				}
6797c478bd9Sstevel@tonic-gate 				break;
6807c478bd9Sstevel@tonic-gate 			case PROV_KEF_HARD:
6817c478bd9Sstevel@tonic-gate 				if (getzoneid() == GLOBAL_ZONEID) {
6827c478bd9Sstevel@tonic-gate 					rc = list_policy_for_hard(
683d616ad8eSHai-May Chao 					    provname, NULL, NULL, NULL);
6847c478bd9Sstevel@tonic-gate 				} else {
6857c478bd9Sstevel@tonic-gate 					/*
6860a85b835SDaniel Anderson 					 * TRANSLATION_NOTE
6877c478bd9Sstevel@tonic-gate 					 * "global" is keyword and not to
6887c478bd9Sstevel@tonic-gate 					 * be translated.
6897c478bd9Sstevel@tonic-gate 					 */
6907c478bd9Sstevel@tonic-gate 					cryptoerror(LOG_STDERR, gettext(
6917c478bd9Sstevel@tonic-gate 					    "policy information for kernel "
6927c478bd9Sstevel@tonic-gate 					    "providers is available "
6937c478bd9Sstevel@tonic-gate 					    "in the %s zone only"), "global");
6947c478bd9Sstevel@tonic-gate 					rc = FAILURE;
6957c478bd9Sstevel@tonic-gate 				}
6967c478bd9Sstevel@tonic-gate 
6977c478bd9Sstevel@tonic-gate 				break;
6987c478bd9Sstevel@tonic-gate 			default: /* should not come here */
6997c478bd9Sstevel@tonic-gate 				rc = FAILURE;
7007c478bd9Sstevel@tonic-gate 				break;
7017c478bd9Sstevel@tonic-gate 			}
7027c478bd9Sstevel@tonic-gate 		} else {
7037c478bd9Sstevel@tonic-gate 			/* error message */
7047c478bd9Sstevel@tonic-gate 			usage();
7057c478bd9Sstevel@tonic-gate 			rc = ERROR_USAGE;
7067c478bd9Sstevel@tonic-gate 		}
7077c478bd9Sstevel@tonic-gate 	}
7087c478bd9Sstevel@tonic-gate 
7097c478bd9Sstevel@tonic-gate out:
7107c478bd9Sstevel@tonic-gate 	if (prov != NULL)
7117c478bd9Sstevel@tonic-gate 		free(prov);
7127c478bd9Sstevel@tonic-gate 
7137c478bd9Sstevel@tonic-gate 	if (mecharglist != NULL)
7147c478bd9Sstevel@tonic-gate 		free_mechlist(mecharglist);
7157c478bd9Sstevel@tonic-gate 	return (rc);
7167c478bd9Sstevel@tonic-gate }
7177c478bd9Sstevel@tonic-gate 
7187c478bd9Sstevel@tonic-gate 
7197c478bd9Sstevel@tonic-gate /*
7201b22764fSDaniel OpenSolaris Anderson  * The top level function for the "cryptoadm disable" subcommand.
7217c478bd9Sstevel@tonic-gate  */
7227c478bd9Sstevel@tonic-gate static int
do_disable(int argc,char ** argv)7237c478bd9Sstevel@tonic-gate do_disable(int argc, char **argv)
7247c478bd9Sstevel@tonic-gate {
7257c478bd9Sstevel@tonic-gate 	cryptoadm_provider_t	*prov = NULL;
7261b22764fSDaniel OpenSolaris Anderson 	int			rc = SUCCESS;
7271b22764fSDaniel OpenSolaris Anderson 	boolean_t		auto_key_migrate_flag = B_FALSE;
7287c478bd9Sstevel@tonic-gate 
7297c478bd9Sstevel@tonic-gate 	if ((argc < 3) || (argc > 5)) {
7307c478bd9Sstevel@tonic-gate 		usage();
7317c478bd9Sstevel@tonic-gate 		return (ERROR_USAGE);
7327c478bd9Sstevel@tonic-gate 	}
7337c478bd9Sstevel@tonic-gate 
7347c478bd9Sstevel@tonic-gate 	prov = get_provider(argc, argv);
7357c478bd9Sstevel@tonic-gate 	if (prov == NULL) {
7367c478bd9Sstevel@tonic-gate 		usage();
7377c478bd9Sstevel@tonic-gate 		return (ERROR_USAGE);
7387c478bd9Sstevel@tonic-gate 	}
7397c478bd9Sstevel@tonic-gate 	if (prov->cp_type == PROV_BADNAME) {
7407c478bd9Sstevel@tonic-gate 		return (FAILURE);
7417c478bd9Sstevel@tonic-gate 	}
7427c478bd9Sstevel@tonic-gate 
7437c478bd9Sstevel@tonic-gate 	if ((rc = process_feature_operands(argc, argv)) != SUCCESS) {
7447c478bd9Sstevel@tonic-gate 		goto out;
7457c478bd9Sstevel@tonic-gate 	}
7467c478bd9Sstevel@tonic-gate 
7477c478bd9Sstevel@tonic-gate 	/*
7487c478bd9Sstevel@tonic-gate 	 * If allflag or rndflag has already been set there is no reason to
7497c478bd9Sstevel@tonic-gate 	 * process mech=
7507c478bd9Sstevel@tonic-gate 	 */
7517c478bd9Sstevel@tonic-gate 	if (prov->cp_type == METASLOT) {
7527c478bd9Sstevel@tonic-gate 		if ((argc > 3) &&
7537c478bd9Sstevel@tonic-gate 		    (rc = process_metaslot_operands(argc, argv,
7547c478bd9Sstevel@tonic-gate 		    NULL, NULL, NULL, &auto_key_migrate_flag)) != SUCCESS) {
7557c478bd9Sstevel@tonic-gate 			usage();
7567c478bd9Sstevel@tonic-gate 			return (rc);
7577c478bd9Sstevel@tonic-gate 		}
7587c478bd9Sstevel@tonic-gate 	} else if (!allflag && !rndflag &&
7591b22764fSDaniel OpenSolaris Anderson 	    (rc = process_mech_operands(argc, argv, B_FALSE)) != SUCCESS) {
7607c478bd9Sstevel@tonic-gate 			return (rc);
7617c478bd9Sstevel@tonic-gate 	}
7627c478bd9Sstevel@tonic-gate 
7637c478bd9Sstevel@tonic-gate 	switch (prov->cp_type) {
7647c478bd9Sstevel@tonic-gate 	case METASLOT:
7657c478bd9Sstevel@tonic-gate 		rc = disable_metaslot(mecharglist, allflag,
7667c478bd9Sstevel@tonic-gate 		    auto_key_migrate_flag);
7677c478bd9Sstevel@tonic-gate 		break;
7687c478bd9Sstevel@tonic-gate 	case PROV_UEF_LIB:
7697c478bd9Sstevel@tonic-gate 		rc = disable_uef_lib(prov->cp_name, rndflag, allflag,
7707c478bd9Sstevel@tonic-gate 		    mecharglist);
7717c478bd9Sstevel@tonic-gate 		break;
7727c478bd9Sstevel@tonic-gate 	case PROV_KEF_SOFT:
7737c478bd9Sstevel@tonic-gate 		if (rndflag && !allflag) {
7747c478bd9Sstevel@tonic-gate 			if ((mecharglist = create_mech(RANDOM)) == NULL) {
7757c478bd9Sstevel@tonic-gate 				rc = FAILURE;
7767c478bd9Sstevel@tonic-gate 				break;
7777c478bd9Sstevel@tonic-gate 			}
7787c478bd9Sstevel@tonic-gate 		}
7797c478bd9Sstevel@tonic-gate 		if (getzoneid() == GLOBAL_ZONEID) {
7807c478bd9Sstevel@tonic-gate 			rc = disable_kef_software(prov->cp_name, rndflag,
7817c478bd9Sstevel@tonic-gate 			    allflag, mecharglist);
7827c478bd9Sstevel@tonic-gate 		} else {
7837c478bd9Sstevel@tonic-gate 			/*
7840a85b835SDaniel Anderson 			 * TRANSLATION_NOTE
7857c478bd9Sstevel@tonic-gate 			 * "disable" could be either a literal keyword
7867c478bd9Sstevel@tonic-gate 			 * and hence not to be translated, or a verb and
7877c478bd9Sstevel@tonic-gate 			 * translatable.  A choice was made to view it as
7887c478bd9Sstevel@tonic-gate 			 * a literal keyword.  "global" is keyword and not
7897c478bd9Sstevel@tonic-gate 			 * to be translated.
7907c478bd9Sstevel@tonic-gate 			 */
7917c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext("%1$s for kernel "
7927c478bd9Sstevel@tonic-gate 			    "providers is supported in the %2$s zone only"),
7937c478bd9Sstevel@tonic-gate 			    "disable", "global");
7947c478bd9Sstevel@tonic-gate 			rc = FAILURE;
7957c478bd9Sstevel@tonic-gate 		}
7967c478bd9Sstevel@tonic-gate 		break;
7977c478bd9Sstevel@tonic-gate 	case PROV_KEF_HARD:
7987c478bd9Sstevel@tonic-gate 		if (rndflag && !allflag) {
7997c478bd9Sstevel@tonic-gate 			if ((mecharglist = create_mech(RANDOM)) == NULL) {
8007c478bd9Sstevel@tonic-gate 				rc = FAILURE;
8017c478bd9Sstevel@tonic-gate 				break;
8027c478bd9Sstevel@tonic-gate 			}
8037c478bd9Sstevel@tonic-gate 		}
8047c478bd9Sstevel@tonic-gate 		if (getzoneid() == GLOBAL_ZONEID) {
8057c478bd9Sstevel@tonic-gate 			rc = disable_kef_hardware(prov->cp_name, rndflag,
8067c478bd9Sstevel@tonic-gate 			    allflag, mecharglist);
8077c478bd9Sstevel@tonic-gate 		} else {
8087c478bd9Sstevel@tonic-gate 			/*
8090a85b835SDaniel Anderson 			 * TRANSLATION_NOTE
8107c478bd9Sstevel@tonic-gate 			 * "disable" could be either a literal keyword
8117c478bd9Sstevel@tonic-gate 			 * and hence not to be translated, or a verb and
8127c478bd9Sstevel@tonic-gate 			 * translatable.  A choice was made to view it as
8137c478bd9Sstevel@tonic-gate 			 * a literal keyword.  "global" is keyword and not
8147c478bd9Sstevel@tonic-gate 			 * to be translated.
8157c478bd9Sstevel@tonic-gate 			 */
8167c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext("%1$s for kernel "
8177c478bd9Sstevel@tonic-gate 			    "providers is supported in the %2$s zone only"),
8187c478bd9Sstevel@tonic-gate 			    "disable", "global");
8197c478bd9Sstevel@tonic-gate 			rc = FAILURE;
8207c478bd9Sstevel@tonic-gate 		}
8217c478bd9Sstevel@tonic-gate 		break;
8227c478bd9Sstevel@tonic-gate 	default: /* should not come here */
8237c478bd9Sstevel@tonic-gate 		rc = FAILURE;
8247c478bd9Sstevel@tonic-gate 		break;
8257c478bd9Sstevel@tonic-gate 	}
8267c478bd9Sstevel@tonic-gate 
8277c478bd9Sstevel@tonic-gate out:
8287c478bd9Sstevel@tonic-gate 	free(prov);
8297c478bd9Sstevel@tonic-gate 	if (mecharglist != NULL) {
8307c478bd9Sstevel@tonic-gate 		free_mechlist(mecharglist);
8317c478bd9Sstevel@tonic-gate 	}
8327c478bd9Sstevel@tonic-gate 	return (rc);
8337c478bd9Sstevel@tonic-gate }
8347c478bd9Sstevel@tonic-gate 
8357c478bd9Sstevel@tonic-gate 
8367c478bd9Sstevel@tonic-gate /*
8371b22764fSDaniel OpenSolaris Anderson  * The top level function for the "cryptoadm enable" subcommand.
8387c478bd9Sstevel@tonic-gate  */
8397c478bd9Sstevel@tonic-gate static int
do_enable(int argc,char ** argv)8407c478bd9Sstevel@tonic-gate do_enable(int argc, char **argv)
8417c478bd9Sstevel@tonic-gate {
8421b22764fSDaniel OpenSolaris Anderson 	cryptoadm_provider_t	*prov = NULL;
8431b22764fSDaniel OpenSolaris Anderson 	int			rc = SUCCESS;
8441b22764fSDaniel OpenSolaris Anderson 	char 			*alt_token = NULL, *alt_slot = NULL;
8451b22764fSDaniel OpenSolaris Anderson 	boolean_t		use_default = B_FALSE;
8461b22764fSDaniel OpenSolaris Anderson 	boolean_t		auto_key_migrate_flag = B_FALSE;
8477c478bd9Sstevel@tonic-gate 
8487c478bd9Sstevel@tonic-gate 	if ((argc < 3) || (argc > 6)) {
8497c478bd9Sstevel@tonic-gate 		usage();
8507c478bd9Sstevel@tonic-gate 		return (ERROR_USAGE);
8517c478bd9Sstevel@tonic-gate 	}
8527c478bd9Sstevel@tonic-gate 
8537c478bd9Sstevel@tonic-gate 	prov = get_provider(argc, argv);
8547c478bd9Sstevel@tonic-gate 	if (prov == NULL) {
8557c478bd9Sstevel@tonic-gate 		usage();
8567c478bd9Sstevel@tonic-gate 		return (ERROR_USAGE);
8577c478bd9Sstevel@tonic-gate 	}
8587c478bd9Sstevel@tonic-gate 	if ((prov->cp_type != METASLOT) && (argc != 4)) {
8597c478bd9Sstevel@tonic-gate 		usage();
8607c478bd9Sstevel@tonic-gate 		return (ERROR_USAGE);
8617c478bd9Sstevel@tonic-gate 	}
8627c478bd9Sstevel@tonic-gate 	if (prov->cp_type == PROV_BADNAME) {
8637c478bd9Sstevel@tonic-gate 		rc = FAILURE;
8647c478bd9Sstevel@tonic-gate 		goto out;
8657c478bd9Sstevel@tonic-gate 	}
8667c478bd9Sstevel@tonic-gate 
8677c478bd9Sstevel@tonic-gate 
8687c478bd9Sstevel@tonic-gate 	if (prov->cp_type == METASLOT) {
8697c478bd9Sstevel@tonic-gate 		if ((rc = process_metaslot_operands(argc, argv, &alt_token,
8707c478bd9Sstevel@tonic-gate 		    &alt_slot, &use_default, &auto_key_migrate_flag))
8717c478bd9Sstevel@tonic-gate 		    != SUCCESS) {
8727c478bd9Sstevel@tonic-gate 			usage();
8737c478bd9Sstevel@tonic-gate 			goto out;
8747c478bd9Sstevel@tonic-gate 		}
8757c478bd9Sstevel@tonic-gate 		if ((alt_slot || alt_token) && use_default) {
8767c478bd9Sstevel@tonic-gate 			usage();
8777c478bd9Sstevel@tonic-gate 			rc = FAILURE;
8787c478bd9Sstevel@tonic-gate 			goto out;
8797c478bd9Sstevel@tonic-gate 		}
8807c478bd9Sstevel@tonic-gate 	} else {
8817c478bd9Sstevel@tonic-gate 		if ((rc = process_feature_operands(argc, argv)) != SUCCESS) {
8827c478bd9Sstevel@tonic-gate 			goto out;
8837c478bd9Sstevel@tonic-gate 		}
8847c478bd9Sstevel@tonic-gate 
8857c478bd9Sstevel@tonic-gate 		/*
8867c478bd9Sstevel@tonic-gate 		 * If allflag or rndflag has already been set there is
8877c478bd9Sstevel@tonic-gate 		 * no reason to process mech=
8887c478bd9Sstevel@tonic-gate 		 */
8897c478bd9Sstevel@tonic-gate 		if (!allflag && !rndflag &&
8907c478bd9Sstevel@tonic-gate 		    (rc = process_mech_operands(argc, argv, B_FALSE))
8917c478bd9Sstevel@tonic-gate 		    != SUCCESS) {
8927c478bd9Sstevel@tonic-gate 			goto out;
8937c478bd9Sstevel@tonic-gate 		}
8947c478bd9Sstevel@tonic-gate 	}
8957c478bd9Sstevel@tonic-gate 
8967c478bd9Sstevel@tonic-gate 	switch (prov->cp_type) {
8977c478bd9Sstevel@tonic-gate 	case METASLOT:
8987c478bd9Sstevel@tonic-gate 		rc = enable_metaslot(alt_token, alt_slot, use_default,
8997c478bd9Sstevel@tonic-gate 		    mecharglist, allflag, auto_key_migrate_flag);
9007c478bd9Sstevel@tonic-gate 		break;
9017c478bd9Sstevel@tonic-gate 	case PROV_UEF_LIB:
9027c478bd9Sstevel@tonic-gate 		rc = enable_uef_lib(prov->cp_name, rndflag, allflag,
9037c478bd9Sstevel@tonic-gate 		    mecharglist);
9047c478bd9Sstevel@tonic-gate 		break;
9057c478bd9Sstevel@tonic-gate 	case PROV_KEF_SOFT:
9067c478bd9Sstevel@tonic-gate 	case PROV_KEF_HARD:
9077c478bd9Sstevel@tonic-gate 		if (rndflag && !allflag) {
9087c478bd9Sstevel@tonic-gate 			if ((mecharglist = create_mech(RANDOM)) == NULL) {
9097c478bd9Sstevel@tonic-gate 				rc = FAILURE;
9107c478bd9Sstevel@tonic-gate 				break;
9117c478bd9Sstevel@tonic-gate 			}
9127c478bd9Sstevel@tonic-gate 		}
9137c478bd9Sstevel@tonic-gate 		if (getzoneid() == GLOBAL_ZONEID) {
9147c478bd9Sstevel@tonic-gate 			rc = enable_kef(prov->cp_name, rndflag, allflag,
9157c478bd9Sstevel@tonic-gate 			    mecharglist);
9167c478bd9Sstevel@tonic-gate 		} else {
9177c478bd9Sstevel@tonic-gate 			/*
9180a85b835SDaniel Anderson 			 * TRANSLATION_NOTE
9197c478bd9Sstevel@tonic-gate 			 * "enable" could be either a literal keyword
9207c478bd9Sstevel@tonic-gate 			 * and hence not to be translated, or a verb and
9217c478bd9Sstevel@tonic-gate 			 * translatable.  A choice was made to view it as
9227c478bd9Sstevel@tonic-gate 			 * a literal keyword.  "global" is keyword and not
9237c478bd9Sstevel@tonic-gate 			 * to be translated.
9247c478bd9Sstevel@tonic-gate 			 */
9257c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext("%1$s for kernel "
9267c478bd9Sstevel@tonic-gate 			    "providers is supported in the %2$s zone only"),
9277c478bd9Sstevel@tonic-gate 			    "enable", "global");
9287c478bd9Sstevel@tonic-gate 			rc = FAILURE;
9297c478bd9Sstevel@tonic-gate 		}
9307c478bd9Sstevel@tonic-gate 		break;
9317c478bd9Sstevel@tonic-gate 	default: /* should not come here */
9327c478bd9Sstevel@tonic-gate 		rc = FAILURE;
9337c478bd9Sstevel@tonic-gate 		break;
9347c478bd9Sstevel@tonic-gate 	}
9357c478bd9Sstevel@tonic-gate out:
9367c478bd9Sstevel@tonic-gate 	free(prov);
9377c478bd9Sstevel@tonic-gate 	if (mecharglist != NULL) {
9387c478bd9Sstevel@tonic-gate 		free_mechlist(mecharglist);
9397c478bd9Sstevel@tonic-gate 	}
9407c478bd9Sstevel@tonic-gate 	if (alt_token != NULL) {
9417c478bd9Sstevel@tonic-gate 		free(alt_token);
9427c478bd9Sstevel@tonic-gate 	}
9437c478bd9Sstevel@tonic-gate 	if (alt_slot != NULL) {
9447c478bd9Sstevel@tonic-gate 		free(alt_slot);
9457c478bd9Sstevel@tonic-gate 	}
9467c478bd9Sstevel@tonic-gate 	return (rc);
9477c478bd9Sstevel@tonic-gate }
9487c478bd9Sstevel@tonic-gate 
9497c478bd9Sstevel@tonic-gate 
9507c478bd9Sstevel@tonic-gate 
9517c478bd9Sstevel@tonic-gate /*
9521b22764fSDaniel OpenSolaris Anderson  * The top level function for the "cryptoadm install" subcommand.
9537c478bd9Sstevel@tonic-gate  */
9547c478bd9Sstevel@tonic-gate static int
do_install(int argc,char ** argv)9557c478bd9Sstevel@tonic-gate do_install(int argc, char **argv)
9567c478bd9Sstevel@tonic-gate {
9571b22764fSDaniel OpenSolaris Anderson 	cryptoadm_provider_t	*prov = NULL;
9587c478bd9Sstevel@tonic-gate 	int	rc;
9597c478bd9Sstevel@tonic-gate 
9607c478bd9Sstevel@tonic-gate 	if (argc < 3) {
9617c478bd9Sstevel@tonic-gate 		usage();
9627c478bd9Sstevel@tonic-gate 		return (ERROR_USAGE);
9637c478bd9Sstevel@tonic-gate 	}
9647c478bd9Sstevel@tonic-gate 
9657c478bd9Sstevel@tonic-gate 	prov = get_provider(argc, argv);
9667c478bd9Sstevel@tonic-gate 	if (prov == NULL ||
9677c478bd9Sstevel@tonic-gate 	    prov->cp_type == PROV_BADNAME || prov->cp_type == PROV_KEF_HARD) {
9687c478bd9Sstevel@tonic-gate 		/*
9690a85b835SDaniel Anderson 		 * TRANSLATION_NOTE
9707c478bd9Sstevel@tonic-gate 		 * "install" could be either a literal keyword and hence
9717c478bd9Sstevel@tonic-gate 		 * not to be translated, or a verb and translatable.  A
9727c478bd9Sstevel@tonic-gate 		 * choice was made to view it as a literal keyword.
9737c478bd9Sstevel@tonic-gate 		 */
9747c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
9757c478bd9Sstevel@tonic-gate 		    gettext("bad provider name for %s."), "install");
9767c478bd9Sstevel@tonic-gate 		rc = FAILURE;
9777c478bd9Sstevel@tonic-gate 		goto out;
9787c478bd9Sstevel@tonic-gate 	}
9797c478bd9Sstevel@tonic-gate 
9807c478bd9Sstevel@tonic-gate 	if (prov->cp_type == PROV_UEF_LIB) {
9817c478bd9Sstevel@tonic-gate 		rc = install_uef_lib(prov->cp_name);
9827c478bd9Sstevel@tonic-gate 		goto out;
9837c478bd9Sstevel@tonic-gate 	}
9847c478bd9Sstevel@tonic-gate 
9857c478bd9Sstevel@tonic-gate 	/* It is the PROV_KEF_SOFT type now  */
9867c478bd9Sstevel@tonic-gate 
9877c478bd9Sstevel@tonic-gate 	/* check if there are mechanism operands */
9887c478bd9Sstevel@tonic-gate 	if (argc < 4) {
9897c478bd9Sstevel@tonic-gate 		/*
9900a85b835SDaniel Anderson 		 * TRANSLATION_NOTE
9917c478bd9Sstevel@tonic-gate 		 * "mechanism" could be either a literal keyword and hence
9927c478bd9Sstevel@tonic-gate 		 * not to be translated, or a descriptive word and
9937c478bd9Sstevel@tonic-gate 		 * translatable.  A choice was made to view it as a literal
9947c478bd9Sstevel@tonic-gate 		 * keyword.
9957c478bd9Sstevel@tonic-gate 		 */
9967c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
9977c478bd9Sstevel@tonic-gate 		    gettext("need %s operands for installing a"
9987c478bd9Sstevel@tonic-gate 		    " kernel software provider."), "mechanism");
9997c478bd9Sstevel@tonic-gate 		rc = ERROR_USAGE;
10007c478bd9Sstevel@tonic-gate 		goto out;
10017c478bd9Sstevel@tonic-gate 	}
10027c478bd9Sstevel@tonic-gate 
10037c478bd9Sstevel@tonic-gate 	if ((rc = process_mech_operands(argc, argv, B_FALSE)) != SUCCESS) {
10047c478bd9Sstevel@tonic-gate 		goto out;
10057c478bd9Sstevel@tonic-gate 	}
10067c478bd9Sstevel@tonic-gate 
10077c478bd9Sstevel@tonic-gate 	if (allflag == B_TRUE) {
10087c478bd9Sstevel@tonic-gate 		/*
10090a85b835SDaniel Anderson 		 * TRANSLATION_NOTE
10107c478bd9Sstevel@tonic-gate 		 * "all", "mechanism", and "install" are all keywords and
10117c478bd9Sstevel@tonic-gate 		 * not to be translated.
10127c478bd9Sstevel@tonic-gate 		 */
10137c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
10147c478bd9Sstevel@tonic-gate 		    gettext("can not use the %1$s keyword for %2$s "
10157c478bd9Sstevel@tonic-gate 		    "in the %3$s subcommand."), "all", "mechanism", "install");
10167c478bd9Sstevel@tonic-gate 		rc = ERROR_USAGE;
10177c478bd9Sstevel@tonic-gate 		goto out;
10187c478bd9Sstevel@tonic-gate 	}
10197c478bd9Sstevel@tonic-gate 
10207c478bd9Sstevel@tonic-gate 	if (getzoneid() == GLOBAL_ZONEID) {
10217c478bd9Sstevel@tonic-gate 		rc = install_kef(prov->cp_name, mecharglist);
10227c478bd9Sstevel@tonic-gate 	} else {
10237c478bd9Sstevel@tonic-gate 		/*
10240a85b835SDaniel Anderson 		 * TRANSLATION_NOTE
10257c478bd9Sstevel@tonic-gate 		 * "install" could be either a literal keyword and hence
10267c478bd9Sstevel@tonic-gate 		 * not to be translated, or a verb and translatable.  A
10277c478bd9Sstevel@tonic-gate 		 * choice was made to view it as a literal keyword.
10287c478bd9Sstevel@tonic-gate 		 * "global" is keyword and not to be translated.
10297c478bd9Sstevel@tonic-gate 		 */
10307c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("%1$s for kernel providers "
10317c478bd9Sstevel@tonic-gate 		    "is supported in the %2$s zone only"), "install", "global");
10327c478bd9Sstevel@tonic-gate 		rc = FAILURE;
10337c478bd9Sstevel@tonic-gate 	}
10347c478bd9Sstevel@tonic-gate out:
10357c478bd9Sstevel@tonic-gate 	free(prov);
10367c478bd9Sstevel@tonic-gate 	return (rc);
10377c478bd9Sstevel@tonic-gate }
10387c478bd9Sstevel@tonic-gate 
10397c478bd9Sstevel@tonic-gate 
10407c478bd9Sstevel@tonic-gate 
10417c478bd9Sstevel@tonic-gate /*
10421b22764fSDaniel OpenSolaris Anderson  * The top level function for the "cryptoadm uninstall" subcommand.
10437c478bd9Sstevel@tonic-gate  */
10447c478bd9Sstevel@tonic-gate static int
do_uninstall(int argc,char ** argv)10457c478bd9Sstevel@tonic-gate do_uninstall(int argc, char **argv)
10467c478bd9Sstevel@tonic-gate {
10471b22764fSDaniel OpenSolaris Anderson 	cryptoadm_provider_t	*prov = NULL;
10487c478bd9Sstevel@tonic-gate 	int	rc = SUCCESS;
10497c478bd9Sstevel@tonic-gate 
10507c478bd9Sstevel@tonic-gate 	if (argc != 3) {
10517c478bd9Sstevel@tonic-gate 		usage();
10527c478bd9Sstevel@tonic-gate 		return (ERROR_USAGE);
10537c478bd9Sstevel@tonic-gate 	}
10547c478bd9Sstevel@tonic-gate 
10557c478bd9Sstevel@tonic-gate 	prov = get_provider(argc, argv);
10567c478bd9Sstevel@tonic-gate 	if (prov == NULL ||
10577c478bd9Sstevel@tonic-gate 	    prov->cp_type == PROV_BADNAME || prov->cp_type == PROV_KEF_HARD) {
10587c478bd9Sstevel@tonic-gate 		/*
10590a85b835SDaniel Anderson 		 * TRANSLATION_NOTE
10607c478bd9Sstevel@tonic-gate 		 * "uninstall" could be either a literal keyword and hence
10617c478bd9Sstevel@tonic-gate 		 * not to be translated, or a verb and translatable.  A
10627c478bd9Sstevel@tonic-gate 		 * choice was made to view it as a literal keyword.
10637c478bd9Sstevel@tonic-gate 		 */
10647c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
10657c478bd9Sstevel@tonic-gate 		    gettext("bad provider name for %s."), "uninstall");
10667c478bd9Sstevel@tonic-gate 		free(prov);
10677c478bd9Sstevel@tonic-gate 		return (FAILURE);
10687c478bd9Sstevel@tonic-gate 	}
10697c478bd9Sstevel@tonic-gate 
10707c478bd9Sstevel@tonic-gate 	if (prov->cp_type == PROV_UEF_LIB) {
10717c478bd9Sstevel@tonic-gate 		rc = uninstall_uef_lib(prov->cp_name);
10721b22764fSDaniel OpenSolaris Anderson 
10737c478bd9Sstevel@tonic-gate 	} else if (prov->cp_type == PROV_KEF_SOFT) {
10747c478bd9Sstevel@tonic-gate 		if (getzoneid() == GLOBAL_ZONEID) {
10751b22764fSDaniel OpenSolaris Anderson 			/* unload and remove from kcf.conf */
10767c478bd9Sstevel@tonic-gate 			rc = uninstall_kef(prov->cp_name);
10777c478bd9Sstevel@tonic-gate 		} else {
10787c478bd9Sstevel@tonic-gate 			/*
10790a85b835SDaniel Anderson 			 * TRANSLATION_NOTE
10807c478bd9Sstevel@tonic-gate 			 * "uninstall" could be either a literal keyword and
10817c478bd9Sstevel@tonic-gate 			 * hence not to be translated, or a verb and
10827c478bd9Sstevel@tonic-gate 			 * translatable.  A choice was made to view it as a
10837c478bd9Sstevel@tonic-gate 			 * literal keyword.  "global" is keyword and not to
10847c478bd9Sstevel@tonic-gate 			 * be translated.
10857c478bd9Sstevel@tonic-gate 			 */
10867c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext("%1$s for kernel "
10877c478bd9Sstevel@tonic-gate 			    "providers is supported in the %2$s zone only"),
10887c478bd9Sstevel@tonic-gate 			    "uninstall", "global");
10897c478bd9Sstevel@tonic-gate 			rc = FAILURE;
10907c478bd9Sstevel@tonic-gate 		}
10917c478bd9Sstevel@tonic-gate 	}
10927c478bd9Sstevel@tonic-gate 
10937c478bd9Sstevel@tonic-gate 	free(prov);
10947c478bd9Sstevel@tonic-gate 	return (rc);
10957c478bd9Sstevel@tonic-gate }
10967c478bd9Sstevel@tonic-gate 
10977c478bd9Sstevel@tonic-gate 
10987c478bd9Sstevel@tonic-gate /*
10991b22764fSDaniel OpenSolaris Anderson  * The top level function for the "cryptoadm unload" subcommand.
11007c478bd9Sstevel@tonic-gate  */
11017c478bd9Sstevel@tonic-gate static int
do_unload(int argc,char ** argv)11027c478bd9Sstevel@tonic-gate do_unload(int argc, char **argv)
11037c478bd9Sstevel@tonic-gate {
11041b22764fSDaniel OpenSolaris Anderson 	cryptoadm_provider_t	*prov = NULL;
11051b22764fSDaniel OpenSolaris Anderson 	entry_t			*pent = NULL;
11061b22764fSDaniel OpenSolaris Anderson 	boolean_t		in_kernel = B_FALSE;
11071b22764fSDaniel OpenSolaris Anderson 	int			rc = SUCCESS;
11081b22764fSDaniel OpenSolaris Anderson 	char			*provname = NULL;
11097c478bd9Sstevel@tonic-gate 
11107c478bd9Sstevel@tonic-gate 	if (argc != 3) {
11117c478bd9Sstevel@tonic-gate 		usage();
11127c478bd9Sstevel@tonic-gate 		return (ERROR_USAGE);
11137c478bd9Sstevel@tonic-gate 	}
11147c478bd9Sstevel@tonic-gate 
11157c478bd9Sstevel@tonic-gate 	/* check if it is a kernel software provider */
11167c478bd9Sstevel@tonic-gate 	prov = get_provider(argc, argv);
11177c478bd9Sstevel@tonic-gate 	if (prov == NULL) {
11187c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
11197c478bd9Sstevel@tonic-gate 		    gettext("unable to determine provider name."));
11207c478bd9Sstevel@tonic-gate 		goto out;
11217c478bd9Sstevel@tonic-gate 	}
11221b22764fSDaniel OpenSolaris Anderson 	provname = prov->cp_name;
11237c478bd9Sstevel@tonic-gate 	if (prov->cp_type != PROV_KEF_SOFT) {
11247c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
11257c478bd9Sstevel@tonic-gate 		    gettext("%s is not a valid kernel software provider."),
11261b22764fSDaniel OpenSolaris Anderson 		    provname);
11277c478bd9Sstevel@tonic-gate 		rc = FAILURE;
11287c478bd9Sstevel@tonic-gate 		goto out;
11297c478bd9Sstevel@tonic-gate 	}
11307c478bd9Sstevel@tonic-gate 
11317c478bd9Sstevel@tonic-gate 	if (getzoneid() != GLOBAL_ZONEID) {
11327c478bd9Sstevel@tonic-gate 		/*
11330a85b835SDaniel Anderson 		 * TRANSLATION_NOTE
11347c478bd9Sstevel@tonic-gate 		 * "unload" could be either a literal keyword and hence
11357c478bd9Sstevel@tonic-gate 		 * not to be translated, or a verb and translatable.
11367c478bd9Sstevel@tonic-gate 		 * A choice was made to view it as a literal keyword.
11377c478bd9Sstevel@tonic-gate 		 * "global" is keyword and not to be translated.
11387c478bd9Sstevel@tonic-gate 		 */
11397c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("%1$s for kernel providers "
11407c478bd9Sstevel@tonic-gate 		    "is supported in the %2$s zone only"), "unload", "global");
11417c478bd9Sstevel@tonic-gate 		rc = FAILURE;
11427c478bd9Sstevel@tonic-gate 		goto out;
11437c478bd9Sstevel@tonic-gate 	}
11447c478bd9Sstevel@tonic-gate 
11451b22764fSDaniel OpenSolaris Anderson 	if (check_kernel_for_soft(provname, NULL, &in_kernel) == FAILURE) {
11461b22764fSDaniel OpenSolaris Anderson 		cryptodebug("internal error");
11471b22764fSDaniel OpenSolaris Anderson 		rc = FAILURE;
11481b22764fSDaniel OpenSolaris Anderson 		goto out;
11491b22764fSDaniel OpenSolaris Anderson 	} else if (in_kernel == B_FALSE) {
11507c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
11511b22764fSDaniel OpenSolaris Anderson 		    gettext("provider %s is not loaded or does not exist."),
11521b22764fSDaniel OpenSolaris Anderson 		    provname);
11537c478bd9Sstevel@tonic-gate 		rc = FAILURE;
11547c478bd9Sstevel@tonic-gate 		goto out;
11557c478bd9Sstevel@tonic-gate 	}
11561b22764fSDaniel OpenSolaris Anderson 
11571b22764fSDaniel OpenSolaris Anderson 	/* Get kcf.conf entry.  If none, build a new entry */
1158d616ad8eSHai-May Chao 	if ((pent = getent_kef(provname, NULL, NULL)) == NULL) {
11591b22764fSDaniel OpenSolaris Anderson 		if ((pent = create_entry(provname)) == NULL) {
11601b22764fSDaniel OpenSolaris Anderson 			cryptoerror(LOG_STDERR, gettext("out of memory."));
11611b22764fSDaniel OpenSolaris Anderson 			rc = FAILURE;
11621b22764fSDaniel OpenSolaris Anderson 			goto out;
11631b22764fSDaniel OpenSolaris Anderson 		}
11641b22764fSDaniel OpenSolaris Anderson 	}
11657c478bd9Sstevel@tonic-gate 
11667c478bd9Sstevel@tonic-gate 	/* If it is unloaded already, return  */
11671b22764fSDaniel OpenSolaris Anderson 	if (!pent->load) { /* unloaded already */
11687c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
11691b22764fSDaniel OpenSolaris Anderson 		    gettext("failed to unload %s."), provname);
11707c478bd9Sstevel@tonic-gate 		rc = FAILURE;
11717c478bd9Sstevel@tonic-gate 		goto out;
11721b22764fSDaniel OpenSolaris Anderson 	} else if (unload_kef_soft(provname) != FAILURE) {
11731b22764fSDaniel OpenSolaris Anderson 		/* Mark as unloaded in kcf.conf */
11741b22764fSDaniel OpenSolaris Anderson 		pent->load = B_FALSE;
11751b22764fSDaniel OpenSolaris Anderson 		rc = update_kcfconf(pent, MODIFY_MODE);
11761b22764fSDaniel OpenSolaris Anderson 	} else {
11777c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
11781b22764fSDaniel OpenSolaris Anderson 		    gettext("failed to unload %s."), provname);
11797c478bd9Sstevel@tonic-gate 		rc = FAILURE;
11807c478bd9Sstevel@tonic-gate 	}
11817c478bd9Sstevel@tonic-gate out:
11827c478bd9Sstevel@tonic-gate 	free(prov);
11831b22764fSDaniel OpenSolaris Anderson 	free_entry(pent);
11847c478bd9Sstevel@tonic-gate 	return (rc);
11857c478bd9Sstevel@tonic-gate }
11867c478bd9Sstevel@tonic-gate 
11877c478bd9Sstevel@tonic-gate 
11887c478bd9Sstevel@tonic-gate 
11897c478bd9Sstevel@tonic-gate /*
11901b22764fSDaniel OpenSolaris Anderson  * The top level function for the "cryptoadm refresh" subcommand.
11917c478bd9Sstevel@tonic-gate  */
11927c478bd9Sstevel@tonic-gate static int
do_refresh(int argc)11937c478bd9Sstevel@tonic-gate do_refresh(int argc)
11947c478bd9Sstevel@tonic-gate {
11957c478bd9Sstevel@tonic-gate 	if (argc != 2) {
11967c478bd9Sstevel@tonic-gate 		usage();
11977c478bd9Sstevel@tonic-gate 		return (ERROR_USAGE);
11987c478bd9Sstevel@tonic-gate 	}
11997c478bd9Sstevel@tonic-gate 
12001b22764fSDaniel OpenSolaris Anderson 	if (getzoneid() == GLOBAL_ZONEID) {
12011b22764fSDaniel OpenSolaris Anderson 		return (refresh());
12021b22764fSDaniel OpenSolaris Anderson 	} else { /* non-global zone */
12031b22764fSDaniel OpenSolaris Anderson 		/*
12041b22764fSDaniel OpenSolaris Anderson 		 * Note:  in non-global zone, this must silently return SUCCESS
12051b22764fSDaniel OpenSolaris Anderson 		 * due to integration with SMF, for "svcadm refresh cryptosvc"
12061b22764fSDaniel OpenSolaris Anderson 		 */
12077c478bd9Sstevel@tonic-gate 		return (SUCCESS);
12081b22764fSDaniel OpenSolaris Anderson 	}
12097c478bd9Sstevel@tonic-gate }
12107c478bd9Sstevel@tonic-gate 
12117c478bd9Sstevel@tonic-gate 
12127c478bd9Sstevel@tonic-gate /*
12131b22764fSDaniel OpenSolaris Anderson  * The top level function for the "cryptoadm start" subcommand.
12146ea3c060SGarrett D'Amore  * This used to start up kcfd, but now all it does is load up the
12156ea3c060SGarrett D'Amore  * initial providers.
12167c478bd9Sstevel@tonic-gate  */
12177c478bd9Sstevel@tonic-gate static int
do_start(int argc)12187c478bd9Sstevel@tonic-gate do_start(int argc)
12197c478bd9Sstevel@tonic-gate {
12207c478bd9Sstevel@tonic-gate 	if (argc != 2) {
12217c478bd9Sstevel@tonic-gate 		usage();
12227c478bd9Sstevel@tonic-gate 		return (ERROR_USAGE);
12237c478bd9Sstevel@tonic-gate 	}
12247c478bd9Sstevel@tonic-gate 
12256ea3c060SGarrett D'Amore 	return (do_refresh(argc));
12267c478bd9Sstevel@tonic-gate }
12277c478bd9Sstevel@tonic-gate 
12287c478bd9Sstevel@tonic-gate /*
12291b22764fSDaniel OpenSolaris Anderson  * The top level function for the "cryptoadm stop" subcommand.
12306ea3c060SGarrett D'Amore  * This no longer does anything useful, but we leave it here
12316ea3c060SGarrett D'Amore  * for compatibility.
12327c478bd9Sstevel@tonic-gate  */
12337c478bd9Sstevel@tonic-gate static int
do_stop(int argc)12347c478bd9Sstevel@tonic-gate do_stop(int argc)
12357c478bd9Sstevel@tonic-gate {
12367c478bd9Sstevel@tonic-gate 	if (argc != 2) {
12377c478bd9Sstevel@tonic-gate 		usage();
12387c478bd9Sstevel@tonic-gate 		return (ERROR_USAGE);
12397c478bd9Sstevel@tonic-gate 	}
12407c478bd9Sstevel@tonic-gate 
12416ea3c060SGarrett D'Amore 	return (SUCCESS);
12427c478bd9Sstevel@tonic-gate }
12437c478bd9Sstevel@tonic-gate 
12447c478bd9Sstevel@tonic-gate 
12457c478bd9Sstevel@tonic-gate 
12467c478bd9Sstevel@tonic-gate /*
12471b22764fSDaniel OpenSolaris Anderson  * Print a list all the the providers.
12481b22764fSDaniel OpenSolaris Anderson  * Called for "cryptoadm list" or "cryptoadm list -v" (no -m or -p).
12497c478bd9Sstevel@tonic-gate  */
12507c478bd9Sstevel@tonic-gate static int
list_simple_for_all(boolean_t verbose)12517c478bd9Sstevel@tonic-gate list_simple_for_all(boolean_t verbose)
12527c478bd9Sstevel@tonic-gate {
12531b22764fSDaniel OpenSolaris Anderson 	uentrylist_t		*pliblist = NULL;
12541b22764fSDaniel OpenSolaris Anderson 	uentrylist_t		*plibptr = NULL;
12551b22764fSDaniel OpenSolaris Anderson 	entry_t			*pent = NULL;
12567c478bd9Sstevel@tonic-gate 	crypto_get_dev_list_t	*pdevlist_kernel = NULL;
12571b22764fSDaniel OpenSolaris Anderson 	int			rc = SUCCESS;
12581b22764fSDaniel OpenSolaris Anderson 	int			i;
12597c478bd9Sstevel@tonic-gate 
12607c478bd9Sstevel@tonic-gate 	/* get user-level providers */
12617c478bd9Sstevel@tonic-gate 	(void) printf(gettext("\nUser-level providers:\n"));
12627c478bd9Sstevel@tonic-gate 	if (get_pkcs11conf_info(&pliblist) != SUCCESS) {
12637c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext(
12647c478bd9Sstevel@tonic-gate 		    "failed to retrieve the list of user-level providers."));
12651b22764fSDaniel OpenSolaris Anderson 		rc = FAILURE;
12667c478bd9Sstevel@tonic-gate 	}
12671b22764fSDaniel OpenSolaris Anderson 
12681b22764fSDaniel OpenSolaris Anderson 	for (plibptr = pliblist; plibptr != NULL; plibptr = plibptr->next) {
1269d616ad8eSHai-May Chao 		/* skip metaslot and fips-140 entry */
1270d616ad8eSHai-May Chao 		if ((strcmp(plibptr->puent->name, METASLOT_KEYWORD) != 0) &&
1271d616ad8eSHai-May Chao 		    (strcmp(plibptr->puent->name, FIPS_KEYWORD) != 0)) {
12727c478bd9Sstevel@tonic-gate 			(void) printf(gettext("Provider: %s\n"),
12737c478bd9Sstevel@tonic-gate 			    plibptr->puent->name);
12747c478bd9Sstevel@tonic-gate 			if (verbose) {
12757c478bd9Sstevel@tonic-gate 				(void) list_mechlist_for_lib(
12767c478bd9Sstevel@tonic-gate 				    plibptr->puent->name, mecharglist, NULL,
12777c478bd9Sstevel@tonic-gate 				    B_FALSE, verbose, B_FALSE);
12787c478bd9Sstevel@tonic-gate 				(void) printf("\n");
12797c478bd9Sstevel@tonic-gate 			}
12807c478bd9Sstevel@tonic-gate 		}
12817c478bd9Sstevel@tonic-gate 	}
12827c478bd9Sstevel@tonic-gate 	free_uentrylist(pliblist);
12837c478bd9Sstevel@tonic-gate 
12847c478bd9Sstevel@tonic-gate 	/* get kernel software providers */
12857c478bd9Sstevel@tonic-gate 	(void) printf(gettext("\nKernel software providers:\n"));
12867c478bd9Sstevel@tonic-gate 
12877c478bd9Sstevel@tonic-gate 	if (getzoneid() == GLOBAL_ZONEID) {
12881b22764fSDaniel OpenSolaris Anderson 		/* get kernel software providers from kernel ioctl */
12891b22764fSDaniel OpenSolaris Anderson 		crypto_get_soft_list_t		*psoftlist_kernel = NULL;
12901b22764fSDaniel OpenSolaris Anderson 		uint_t				sl_soft_count;
12911b22764fSDaniel OpenSolaris Anderson 		char				*psoftname;
12921b22764fSDaniel OpenSolaris Anderson 		entrylist_t			*pdevlist_conf = NULL;
12931b22764fSDaniel OpenSolaris Anderson 		entrylist_t			*psoftlist_conf = NULL;
12941b22764fSDaniel OpenSolaris Anderson 
12951b22764fSDaniel OpenSolaris Anderson 		if (get_soft_list(&psoftlist_kernel) == FAILURE) {
12961b22764fSDaniel OpenSolaris Anderson 			cryptoerror(LOG_ERR, gettext("Failed to retrieve the "
12971b22764fSDaniel OpenSolaris Anderson 			    "software provider list from kernel."));
12981b22764fSDaniel OpenSolaris Anderson 			rc = FAILURE;
12991b22764fSDaniel OpenSolaris Anderson 		} else {
13001b22764fSDaniel OpenSolaris Anderson 			sl_soft_count = psoftlist_kernel->sl_soft_count;
13017c478bd9Sstevel@tonic-gate 
1302d616ad8eSHai-May Chao 			if (get_kcfconf_info(&pdevlist_conf, &psoftlist_conf)
1303d616ad8eSHai-May Chao 			    == FAILURE) {
13041b22764fSDaniel OpenSolaris Anderson 				cryptoerror(LOG_ERR,
13051b22764fSDaniel OpenSolaris Anderson 				    "failed to retrieve the providers' "
13061b22764fSDaniel OpenSolaris Anderson 				    "information from file kcf.conf - %s.",
13071b22764fSDaniel OpenSolaris Anderson 				    _PATH_KCF_CONF);
13081b22764fSDaniel OpenSolaris Anderson 				rc = FAILURE;
13097c478bd9Sstevel@tonic-gate 			} else {
13101b22764fSDaniel OpenSolaris Anderson 
13111b22764fSDaniel OpenSolaris Anderson 				for (i = 0,
13121b22764fSDaniel OpenSolaris Anderson 				    psoftname = psoftlist_kernel->sl_soft_names;
13131b22764fSDaniel OpenSolaris Anderson 				    i < sl_soft_count;
13141b22764fSDaniel OpenSolaris Anderson 				    ++i, psoftname += strlen(psoftname) + 1) {
13151b22764fSDaniel OpenSolaris Anderson 					pent = getent_kef(psoftname,
1316d616ad8eSHai-May Chao 					    pdevlist_conf, psoftlist_conf);
13171b22764fSDaniel OpenSolaris Anderson 					(void) printf("\t%s%s\n", psoftname,
13181b22764fSDaniel OpenSolaris Anderson 					    (pent == NULL) || (pent->load) ?
13191b22764fSDaniel OpenSolaris Anderson 					    "" : gettext(" (inactive)"));
13201b22764fSDaniel OpenSolaris Anderson 				}
13211b22764fSDaniel OpenSolaris Anderson 				free_entrylist(pdevlist_conf);
13221b22764fSDaniel OpenSolaris Anderson 				free_entrylist(psoftlist_conf);
13237c478bd9Sstevel@tonic-gate 			}
13241b22764fSDaniel OpenSolaris Anderson 			free(psoftlist_kernel);
13257c478bd9Sstevel@tonic-gate 		}
13267c478bd9Sstevel@tonic-gate 
13277c478bd9Sstevel@tonic-gate 	} else {
13287c478bd9Sstevel@tonic-gate 		/* kcf.conf not there in non-global zone, use /dev/cryptoadm */
13291b22764fSDaniel OpenSolaris Anderson 		entrylist_t	*pdevlist_zone = NULL;
13301b22764fSDaniel OpenSolaris Anderson 		entrylist_t	*psoftlist_zone = NULL;
13311b22764fSDaniel OpenSolaris Anderson 		entrylist_t	*ptr;
13327c478bd9Sstevel@tonic-gate 
13337c478bd9Sstevel@tonic-gate 		if (get_admindev_info(&pdevlist_zone, &psoftlist_zone) !=
13347c478bd9Sstevel@tonic-gate 		    SUCCESS) {
13357c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_STDERR,
13367c478bd9Sstevel@tonic-gate 			    gettext("failed to retrieve the "
13377c478bd9Sstevel@tonic-gate 			    "list of kernel software providers.\n"));
13381b22764fSDaniel OpenSolaris Anderson 			rc = FAILURE;
13397c478bd9Sstevel@tonic-gate 		}
13407c478bd9Sstevel@tonic-gate 
13417c478bd9Sstevel@tonic-gate 		ptr = psoftlist_zone;
13427c478bd9Sstevel@tonic-gate 		while (ptr != NULL) {
13437c478bd9Sstevel@tonic-gate 			(void) printf("\t%s\n", ptr->pent->name);
13447c478bd9Sstevel@tonic-gate 			ptr = ptr->next;
13457c478bd9Sstevel@tonic-gate 		}
13467c478bd9Sstevel@tonic-gate 
13477c478bd9Sstevel@tonic-gate 		free_entrylist(pdevlist_zone);
13487c478bd9Sstevel@tonic-gate 		free_entrylist(psoftlist_zone);
13497c478bd9Sstevel@tonic-gate 	}
13507c478bd9Sstevel@tonic-gate 
13517c478bd9Sstevel@tonic-gate 	/* get kernel hardware providers */
13527c478bd9Sstevel@tonic-gate 	(void) printf(gettext("\nKernel hardware providers:\n"));
13537c478bd9Sstevel@tonic-gate 	if (get_dev_list(&pdevlist_kernel) == FAILURE) {
13547c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("failed to retrieve "
13557c478bd9Sstevel@tonic-gate 		    "the list of kernel hardware providers.\n"));
13561b22764fSDaniel OpenSolaris Anderson 		rc = FAILURE;
13577c478bd9Sstevel@tonic-gate 	} else {
13587c478bd9Sstevel@tonic-gate 		for (i = 0; i < pdevlist_kernel->dl_dev_count; i++) {
13597c478bd9Sstevel@tonic-gate 			(void) printf("\t%s/%d\n",
13607c478bd9Sstevel@tonic-gate 			    pdevlist_kernel->dl_devs[i].le_dev_name,
13617c478bd9Sstevel@tonic-gate 			    pdevlist_kernel->dl_devs[i].le_dev_instance);
13627c478bd9Sstevel@tonic-gate 		}
13637c478bd9Sstevel@tonic-gate 	}
13647c478bd9Sstevel@tonic-gate 	free(pdevlist_kernel);
13657c478bd9Sstevel@tonic-gate 
13661b22764fSDaniel OpenSolaris Anderson 	return (rc);
13677c478bd9Sstevel@tonic-gate }
13687c478bd9Sstevel@tonic-gate 
13697c478bd9Sstevel@tonic-gate 
13707c478bd9Sstevel@tonic-gate 
13717c478bd9Sstevel@tonic-gate /*
13727c478bd9Sstevel@tonic-gate  * List all the providers. And for each provider, list the mechanism list.
13731b22764fSDaniel OpenSolaris Anderson  * Called for "cryptoadm list -m" or "cryptoadm list -mv" .
13747c478bd9Sstevel@tonic-gate  */
13757c478bd9Sstevel@tonic-gate static int
list_mechlist_for_all(boolean_t verbose)13767c478bd9Sstevel@tonic-gate list_mechlist_for_all(boolean_t verbose)
13777c478bd9Sstevel@tonic-gate {
13781b22764fSDaniel OpenSolaris Anderson 	crypto_get_dev_list_t	*pdevlist_kernel = NULL;
13791b22764fSDaniel OpenSolaris Anderson 	uentrylist_t		*pliblist = NULL;
13801b22764fSDaniel OpenSolaris Anderson 	uentrylist_t		*plibptr = NULL;
13811b22764fSDaniel OpenSolaris Anderson 	entry_t			*pent = NULL;
13821b22764fSDaniel OpenSolaris Anderson 	mechlist_t		*pmechlist = NULL;
13831b22764fSDaniel OpenSolaris Anderson 	char			provname[MAXNAMELEN];
13841b22764fSDaniel OpenSolaris Anderson 	char			devname[MAXNAMELEN];
13851b22764fSDaniel OpenSolaris Anderson 	int			inst_num;
13861b22764fSDaniel OpenSolaris Anderson 	int			count;
13871b22764fSDaniel OpenSolaris Anderson 	int			i;
13881b22764fSDaniel OpenSolaris Anderson 	int			rv;
13891b22764fSDaniel OpenSolaris Anderson 	int			rc = SUCCESS;
13907c478bd9Sstevel@tonic-gate 
13917c478bd9Sstevel@tonic-gate 	/* get user-level providers */
13927c478bd9Sstevel@tonic-gate 	(void) printf(gettext("\nUser-level providers:\n"));
13937c478bd9Sstevel@tonic-gate 	/*
13940a85b835SDaniel Anderson 	 * TRANSLATION_NOTE
13957c478bd9Sstevel@tonic-gate 	 * Strictly for appearance's sake, this line should be as long as
13967c478bd9Sstevel@tonic-gate 	 * the length of the translated text above.
13977c478bd9Sstevel@tonic-gate 	 */
13987c478bd9Sstevel@tonic-gate 	(void) printf(gettext("=====================\n"));
13997c478bd9Sstevel@tonic-gate 	if (get_pkcs11conf_info(&pliblist) != SUCCESS) {
14007c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("failed to retrieve "
14017c478bd9Sstevel@tonic-gate 		    "the list of user-level providers.\n"));
14027c478bd9Sstevel@tonic-gate 		rc = FAILURE;
14037c478bd9Sstevel@tonic-gate 	}
14047c478bd9Sstevel@tonic-gate 
14057c478bd9Sstevel@tonic-gate 	plibptr = pliblist;
14067c478bd9Sstevel@tonic-gate 	while (plibptr != NULL) {
1407d616ad8eSHai-May Chao 		/* skip metaslot and fips-140 entry */
1408d616ad8eSHai-May Chao 		if ((strcmp(plibptr->puent->name, METASLOT_KEYWORD) != 0) &&
1409d616ad8eSHai-May Chao 		    (strcmp(plibptr->puent->name, FIPS_KEYWORD) != 0)) {
14107c478bd9Sstevel@tonic-gate 			(void) printf(gettext("\nProvider: %s\n"),
14117c478bd9Sstevel@tonic-gate 			    plibptr->puent->name);
14127c478bd9Sstevel@tonic-gate 			rv = list_mechlist_for_lib(plibptr->puent->name,
14137c478bd9Sstevel@tonic-gate 			    mecharglist, NULL, B_FALSE, verbose, B_TRUE);
14147c478bd9Sstevel@tonic-gate 			if (rv == FAILURE) {
14157c478bd9Sstevel@tonic-gate 				rc = FAILURE;
14167c478bd9Sstevel@tonic-gate 			}
14177c478bd9Sstevel@tonic-gate 		}
14187c478bd9Sstevel@tonic-gate 		plibptr = plibptr->next;
14197c478bd9Sstevel@tonic-gate 	}
14207c478bd9Sstevel@tonic-gate 	free_uentrylist(pliblist);
14217c478bd9Sstevel@tonic-gate 
14227c478bd9Sstevel@tonic-gate 	/* get kernel software providers */
14237c478bd9Sstevel@tonic-gate 	(void) printf(gettext("\nKernel software providers:\n"));
14241b22764fSDaniel OpenSolaris Anderson 
14257c478bd9Sstevel@tonic-gate 	/*
14260a85b835SDaniel Anderson 	 * TRANSLATION_NOTE
14277c478bd9Sstevel@tonic-gate 	 * Strictly for appearance's sake, this line should be as long as
14287c478bd9Sstevel@tonic-gate 	 * the length of the translated text above.
14297c478bd9Sstevel@tonic-gate 	 */
14307c478bd9Sstevel@tonic-gate 	(void) printf(gettext("==========================\n"));
14317c478bd9Sstevel@tonic-gate 	if (getzoneid() == GLOBAL_ZONEID) {
14321b22764fSDaniel OpenSolaris Anderson 		/* get kernel software providers from kernel ioctl */
14331b22764fSDaniel OpenSolaris Anderson 		crypto_get_soft_list_t		*psoftlist_kernel = NULL;
14341b22764fSDaniel OpenSolaris Anderson 		uint_t				sl_soft_count;
14351b22764fSDaniel OpenSolaris Anderson 		char				*psoftname;
14361b22764fSDaniel OpenSolaris Anderson 		int				i;
14371b22764fSDaniel OpenSolaris Anderson 		entrylist_t			*pdevlist_conf = NULL;
14381b22764fSDaniel OpenSolaris Anderson 		entrylist_t			*psoftlist_conf = NULL;
14391b22764fSDaniel OpenSolaris Anderson 
14401b22764fSDaniel OpenSolaris Anderson 		if (get_soft_list(&psoftlist_kernel) == FAILURE) {
14411b22764fSDaniel OpenSolaris Anderson 			cryptoerror(LOG_ERR, gettext("Failed to retrieve the "
14421b22764fSDaniel OpenSolaris Anderson 			    "software provider list from kernel."));
14431b22764fSDaniel OpenSolaris Anderson 			return (FAILURE);
14441b22764fSDaniel OpenSolaris Anderson 		}
14451b22764fSDaniel OpenSolaris Anderson 		sl_soft_count = psoftlist_kernel->sl_soft_count;
14461b22764fSDaniel OpenSolaris Anderson 
1447d616ad8eSHai-May Chao 		if (get_kcfconf_info(&pdevlist_conf, &psoftlist_conf)
1448d616ad8eSHai-May Chao 		    == FAILURE) {
14491b22764fSDaniel OpenSolaris Anderson 			cryptoerror(LOG_ERR,
14501b22764fSDaniel OpenSolaris Anderson 			    "failed to retrieve the providers' "
14511b22764fSDaniel OpenSolaris Anderson 			    "information from file kcf.conf - %s.",
14521b22764fSDaniel OpenSolaris Anderson 			    _PATH_KCF_CONF);
14531b22764fSDaniel OpenSolaris Anderson 			free(psoftlist_kernel);
14541b22764fSDaniel OpenSolaris Anderson 			return (FAILURE);
14557c478bd9Sstevel@tonic-gate 		}
14567c478bd9Sstevel@tonic-gate 
14571b22764fSDaniel OpenSolaris Anderson 		for (i = 0, psoftname = psoftlist_kernel->sl_soft_names;
14581b22764fSDaniel OpenSolaris Anderson 		    i < sl_soft_count;
14591b22764fSDaniel OpenSolaris Anderson 		    ++i, psoftname += strlen(psoftname) + 1) {
14601b22764fSDaniel OpenSolaris Anderson 			pent = getent_kef(psoftname, pdevlist_conf,
1461d616ad8eSHai-May Chao 			    psoftlist_conf);
14621b22764fSDaniel OpenSolaris Anderson 			if ((pent == NULL) || (pent->load)) {
14631b22764fSDaniel OpenSolaris Anderson 				rv = list_mechlist_for_soft(psoftname,
1464d616ad8eSHai-May Chao 				    NULL, NULL);
14651b22764fSDaniel OpenSolaris Anderson 				if (rv == FAILURE) {
14661b22764fSDaniel OpenSolaris Anderson 					rc = FAILURE;
14677c478bd9Sstevel@tonic-gate 				}
14687c478bd9Sstevel@tonic-gate 			} else {
14691b22764fSDaniel OpenSolaris Anderson 				(void) printf(gettext("%s: (inactive)\n"),
14701b22764fSDaniel OpenSolaris Anderson 				    psoftname);
14717c478bd9Sstevel@tonic-gate 			}
14727c478bd9Sstevel@tonic-gate 		}
14737c478bd9Sstevel@tonic-gate 
14741b22764fSDaniel OpenSolaris Anderson 		free(psoftlist_kernel);
14757c478bd9Sstevel@tonic-gate 		free_entrylist(pdevlist_conf);
14767c478bd9Sstevel@tonic-gate 		free_entrylist(psoftlist_conf);
14771b22764fSDaniel OpenSolaris Anderson 
14787c478bd9Sstevel@tonic-gate 	} else {
14797c478bd9Sstevel@tonic-gate 		/* kcf.conf not there in non-global zone, use /dev/cryptoadm */
14801b22764fSDaniel OpenSolaris Anderson 		entrylist_t	*pdevlist_zone = NULL;
14811b22764fSDaniel OpenSolaris Anderson 		entrylist_t	*psoftlist_zone = NULL;
14821b22764fSDaniel OpenSolaris Anderson 		entrylist_t	*ptr;
14837c478bd9Sstevel@tonic-gate 
14847c478bd9Sstevel@tonic-gate 		if (get_admindev_info(&pdevlist_zone, &psoftlist_zone) !=
14857c478bd9Sstevel@tonic-gate 		    SUCCESS) {
14867c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext("failed to retrieve "
14877c478bd9Sstevel@tonic-gate 			    "the list of kernel software providers.\n"));
14887c478bd9Sstevel@tonic-gate 			rc = FAILURE;
14897c478bd9Sstevel@tonic-gate 		}
14907c478bd9Sstevel@tonic-gate 
14911b22764fSDaniel OpenSolaris Anderson 		for (ptr = psoftlist_zone; ptr != NULL; ptr = ptr->next) {
14921b22764fSDaniel OpenSolaris Anderson 			rv = list_mechlist_for_soft(ptr->pent->name,
1493d616ad8eSHai-May Chao 			    pdevlist_zone, psoftlist_zone);
14947c478bd9Sstevel@tonic-gate 			if (rv == FAILURE) {
14957c478bd9Sstevel@tonic-gate 				(void) printf(gettext(
14967c478bd9Sstevel@tonic-gate 				    "%s: failed to get the mechanism list.\n"),
14977c478bd9Sstevel@tonic-gate 				    ptr->pent->name);
14987c478bd9Sstevel@tonic-gate 				rc = FAILURE;
14997c478bd9Sstevel@tonic-gate 			}
15007c478bd9Sstevel@tonic-gate 		}
15017c478bd9Sstevel@tonic-gate 
15027c478bd9Sstevel@tonic-gate 		free_entrylist(pdevlist_zone);
15037c478bd9Sstevel@tonic-gate 		free_entrylist(psoftlist_zone);
15047c478bd9Sstevel@tonic-gate 	}
15057c478bd9Sstevel@tonic-gate 
15067c478bd9Sstevel@tonic-gate 	/* Get kernel hardware providers and their mechanism lists */
15077c478bd9Sstevel@tonic-gate 	(void) printf(gettext("\nKernel hardware providers:\n"));
15087c478bd9Sstevel@tonic-gate 	/*
15090a85b835SDaniel Anderson 	 * TRANSLATION_NOTE
15107c478bd9Sstevel@tonic-gate 	 * Strictly for appearance's sake, this line should be as long as
15117c478bd9Sstevel@tonic-gate 	 * the length of the translated text above.
15127c478bd9Sstevel@tonic-gate 	 */
15137c478bd9Sstevel@tonic-gate 	(void) printf(gettext("==========================\n"));
15147c478bd9Sstevel@tonic-gate 	if (get_dev_list(&pdevlist_kernel) != SUCCESS) {
15157c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("failed to retrieve "
15167c478bd9Sstevel@tonic-gate 		    "the list of hardware providers.\n"));
15177c478bd9Sstevel@tonic-gate 		return (FAILURE);
15187c478bd9Sstevel@tonic-gate 	}
15197c478bd9Sstevel@tonic-gate 
15207c478bd9Sstevel@tonic-gate 	for (i = 0; i < pdevlist_kernel->dl_dev_count; i++) {
15217c478bd9Sstevel@tonic-gate 		(void) strlcpy(devname,
15227c478bd9Sstevel@tonic-gate 		    pdevlist_kernel->dl_devs[i].le_dev_name, MAXNAMELEN);
15237c478bd9Sstevel@tonic-gate 		inst_num = pdevlist_kernel->dl_devs[i].le_dev_instance;
15247c478bd9Sstevel@tonic-gate 		count = pdevlist_kernel->dl_devs[i].le_mechanism_count;
15257c478bd9Sstevel@tonic-gate 		(void) snprintf(provname, sizeof (provname), "%s/%d", devname,
15267c478bd9Sstevel@tonic-gate 		    inst_num);
15277c478bd9Sstevel@tonic-gate 		if (get_dev_info(devname, inst_num, count, &pmechlist) ==
15287c478bd9Sstevel@tonic-gate 		    SUCCESS) {
15297c478bd9Sstevel@tonic-gate 			(void) filter_mechlist(&pmechlist, RANDOM);
15307c478bd9Sstevel@tonic-gate 			print_mechlist(provname, pmechlist);
15317c478bd9Sstevel@tonic-gate 			free_mechlist(pmechlist);
15327c478bd9Sstevel@tonic-gate 		} else {
15337c478bd9Sstevel@tonic-gate 			(void) printf(gettext("%s: failed to get the mechanism"
15347c478bd9Sstevel@tonic-gate 			    " list.\n"), provname);
15357c478bd9Sstevel@tonic-gate 			rc = FAILURE;
15367c478bd9Sstevel@tonic-gate 		}
15377c478bd9Sstevel@tonic-gate 	}
15387c478bd9Sstevel@tonic-gate 	free(pdevlist_kernel);
15397c478bd9Sstevel@tonic-gate 	return (rc);
15407c478bd9Sstevel@tonic-gate }
15417c478bd9Sstevel@tonic-gate 
15427c478bd9Sstevel@tonic-gate 
15437c478bd9Sstevel@tonic-gate /*
15447c478bd9Sstevel@tonic-gate  * List all the providers. And for each provider, list the policy information.
15451b22764fSDaniel OpenSolaris Anderson  * Called for "cryptoadm list -p".
15467c478bd9Sstevel@tonic-gate  */
15477c478bd9Sstevel@tonic-gate static int
list_policy_for_all(void)15487c478bd9Sstevel@tonic-gate list_policy_for_all(void)
15497c478bd9Sstevel@tonic-gate {
15501b22764fSDaniel OpenSolaris Anderson 	crypto_get_dev_list_t	*pdevlist_kernel = NULL;
15511b22764fSDaniel OpenSolaris Anderson 	uentrylist_t		*pliblist = NULL;
15521b22764fSDaniel OpenSolaris Anderson 	entrylist_t		*pdevlist_conf = NULL;
15531b22764fSDaniel OpenSolaris Anderson 	entrylist_t		*psoftlist_conf = NULL;
15541b22764fSDaniel OpenSolaris Anderson 	entrylist_t		*ptr = NULL;
15551b22764fSDaniel OpenSolaris Anderson 	entrylist_t		*phead = NULL;
15561b22764fSDaniel OpenSolaris Anderson 	boolean_t		found = B_FALSE;
15571b22764fSDaniel OpenSolaris Anderson 	char			provname[MAXNAMELEN];
15581b22764fSDaniel OpenSolaris Anderson 	int			i;
15591b22764fSDaniel OpenSolaris Anderson 	int			rc = SUCCESS;
15607c478bd9Sstevel@tonic-gate 
15617c478bd9Sstevel@tonic-gate 	/* Get user-level providers */
15627c478bd9Sstevel@tonic-gate 	(void) printf(gettext("\nUser-level providers:\n"));
15637c478bd9Sstevel@tonic-gate 	/*
15640a85b835SDaniel Anderson 	 * TRANSLATION_NOTE
15657c478bd9Sstevel@tonic-gate 	 * Strictly for appearance's sake, this line should be as long as
15667c478bd9Sstevel@tonic-gate 	 * the length of the translated text above.
15677c478bd9Sstevel@tonic-gate 	 */
15687c478bd9Sstevel@tonic-gate 	(void) printf(gettext("=====================\n"));
15697c478bd9Sstevel@tonic-gate 	if (get_pkcs11conf_info(&pliblist) == FAILURE) {
15707c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("failed to retrieve "
15717c478bd9Sstevel@tonic-gate 		    "the list of user-level providers.\n"));
15721b22764fSDaniel OpenSolaris Anderson 		rc = FAILURE;
15737c478bd9Sstevel@tonic-gate 	} else {
15741b22764fSDaniel OpenSolaris Anderson 		uentrylist_t	*plibptr = pliblist;
15751b22764fSDaniel OpenSolaris Anderson 
15767c478bd9Sstevel@tonic-gate 		while (plibptr != NULL) {
1577d616ad8eSHai-May Chao 			/* skip metaslot and fips-140 entry */
1578d616ad8eSHai-May Chao 			if ((strcmp(plibptr->puent->name,
1579d616ad8eSHai-May Chao 			    METASLOT_KEYWORD) != 0) &&
1580d616ad8eSHai-May Chao 			    (strcmp(plibptr->puent->name,
1581d616ad8eSHai-May Chao 			    FIPS_KEYWORD) != 0)) {
15827c478bd9Sstevel@tonic-gate 				if (print_uef_policy(plibptr->puent)
15837c478bd9Sstevel@tonic-gate 				    == FAILURE) {
15847c478bd9Sstevel@tonic-gate 					rc = FAILURE;
15857c478bd9Sstevel@tonic-gate 				}
15867c478bd9Sstevel@tonic-gate 			}
15877c478bd9Sstevel@tonic-gate 			plibptr = plibptr->next;
15887c478bd9Sstevel@tonic-gate 		}
15897c478bd9Sstevel@tonic-gate 		free_uentrylist(pliblist);
15907c478bd9Sstevel@tonic-gate 	}
15917c478bd9Sstevel@tonic-gate 
15927c478bd9Sstevel@tonic-gate 	/* kernel software providers */
15937c478bd9Sstevel@tonic-gate 	(void) printf(gettext("\nKernel software providers:\n"));
15947c478bd9Sstevel@tonic-gate 	/*
15950a85b835SDaniel Anderson 	 * TRANSLATION_NOTE
15967c478bd9Sstevel@tonic-gate 	 * Strictly for appearance's sake, this line should be as long as
15977c478bd9Sstevel@tonic-gate 	 * the length of the translated text above.
15987c478bd9Sstevel@tonic-gate 	 */
15997c478bd9Sstevel@tonic-gate 	(void) printf(gettext("==========================\n"));
16007c478bd9Sstevel@tonic-gate 
16011b22764fSDaniel OpenSolaris Anderson 	/* Get all entries from the kernel */
16027c478bd9Sstevel@tonic-gate 	if (getzoneid() == GLOBAL_ZONEID) {
16031b22764fSDaniel OpenSolaris Anderson 		/* get kernel software providers from kernel ioctl */
16041b22764fSDaniel OpenSolaris Anderson 		crypto_get_soft_list_t		*psoftlist_kernel = NULL;
16051b22764fSDaniel OpenSolaris Anderson 		uint_t				sl_soft_count;
16061b22764fSDaniel OpenSolaris Anderson 		char				*psoftname;
16071b22764fSDaniel OpenSolaris Anderson 		int				i;
16081b22764fSDaniel OpenSolaris Anderson 
16091b22764fSDaniel OpenSolaris Anderson 		if (get_soft_list(&psoftlist_kernel) == FAILURE) {
16101b22764fSDaniel OpenSolaris Anderson 			cryptoerror(LOG_ERR, gettext("Failed to retrieve the "
16111b22764fSDaniel OpenSolaris Anderson 			    "software provider list from kernel."));
16121b22764fSDaniel OpenSolaris Anderson 			rc = FAILURE;
16131b22764fSDaniel OpenSolaris Anderson 		} else {
16141b22764fSDaniel OpenSolaris Anderson 			sl_soft_count = psoftlist_kernel->sl_soft_count;
16157c478bd9Sstevel@tonic-gate 
16161b22764fSDaniel OpenSolaris Anderson 			for (i = 0, psoftname = psoftlist_kernel->sl_soft_names;
16171b22764fSDaniel OpenSolaris Anderson 			    i < sl_soft_count;
16181b22764fSDaniel OpenSolaris Anderson 			    ++i, psoftname += strlen(psoftname) + 1) {
16191b22764fSDaniel OpenSolaris Anderson 				(void) list_policy_for_soft(psoftname,
1620d616ad8eSHai-May Chao 				    pdevlist_conf, psoftlist_conf);
16211b22764fSDaniel OpenSolaris Anderson 			}
16221b22764fSDaniel OpenSolaris Anderson 			free(psoftlist_kernel);
16237c478bd9Sstevel@tonic-gate 		}
16247c478bd9Sstevel@tonic-gate 
16257c478bd9Sstevel@tonic-gate 	} else {
16267c478bd9Sstevel@tonic-gate 		/* kcf.conf not there in non-global zone, no policy info */
16277c478bd9Sstevel@tonic-gate 
16287c478bd9Sstevel@tonic-gate 		/*
16290a85b835SDaniel Anderson 		 * TRANSLATION_NOTE
16307c478bd9Sstevel@tonic-gate 		 * "global" is keyword and not to be translated.
16317c478bd9Sstevel@tonic-gate 		 */
16327c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext(
16337c478bd9Sstevel@tonic-gate 		    "policy information for kernel software providers is "
16347c478bd9Sstevel@tonic-gate 		    "available in the %s zone only"), "global");
16357c478bd9Sstevel@tonic-gate 	}
16367c478bd9Sstevel@tonic-gate 
16377c478bd9Sstevel@tonic-gate 	/* Kernel hardware providers */
16387c478bd9Sstevel@tonic-gate 	(void) printf(gettext("\nKernel hardware providers:\n"));
16397c478bd9Sstevel@tonic-gate 	/*
16400a85b835SDaniel Anderson 	 * TRANSLATION_NOTE
16417c478bd9Sstevel@tonic-gate 	 * Strictly for appearance's sake, this line should be as long as
16427c478bd9Sstevel@tonic-gate 	 * the length of the translated text above.
16437c478bd9Sstevel@tonic-gate 	 */
16447c478bd9Sstevel@tonic-gate 	(void) printf(gettext("==========================\n"));
16457c478bd9Sstevel@tonic-gate 
16467c478bd9Sstevel@tonic-gate 	if (getzoneid() != GLOBAL_ZONEID) {
16477c478bd9Sstevel@tonic-gate 		/*
16480a85b835SDaniel Anderson 		 * TRANSLATION_NOTE
16497c478bd9Sstevel@tonic-gate 		 * "global" is keyword and not to be translated.
16507c478bd9Sstevel@tonic-gate 		 */
16517c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext(
16527c478bd9Sstevel@tonic-gate 		    "policy information for kernel hardware providers is "
16537c478bd9Sstevel@tonic-gate 		    "available in the %s zone only"), "global");
16547c478bd9Sstevel@tonic-gate 		return (FAILURE);
16557c478bd9Sstevel@tonic-gate 	}
16567c478bd9Sstevel@tonic-gate 
16577c478bd9Sstevel@tonic-gate 	/* Get the hardware provider list from kernel */
16587c478bd9Sstevel@tonic-gate 	if (get_dev_list(&pdevlist_kernel) != SUCCESS) {
16597c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext(
16607c478bd9Sstevel@tonic-gate 		    "failed to retrieve the list of hardware providers.\n"));
16617c478bd9Sstevel@tonic-gate 		return (FAILURE);
16627c478bd9Sstevel@tonic-gate 	}
16637c478bd9Sstevel@tonic-gate 
1664d616ad8eSHai-May Chao 	if (get_kcfconf_info(&pdevlist_conf, &psoftlist_conf) == FAILURE) {
16651b22764fSDaniel OpenSolaris Anderson 		cryptoerror(LOG_ERR, "failed to retrieve the providers' "
16661b22764fSDaniel OpenSolaris Anderson 		    "information from file kcf.conf - %s.",
16671b22764fSDaniel OpenSolaris Anderson 		    _PATH_KCF_CONF);
16681b22764fSDaniel OpenSolaris Anderson 		return (FAILURE);
16691b22764fSDaniel OpenSolaris Anderson 	}
16701b22764fSDaniel OpenSolaris Anderson 
16711b22764fSDaniel OpenSolaris Anderson 
16727c478bd9Sstevel@tonic-gate 	/*
16737c478bd9Sstevel@tonic-gate 	 * For each hardware provider from kernel, check if it has an entry
16747c478bd9Sstevel@tonic-gate 	 * in the config file.  If it has an entry, print out the policy from
16757c478bd9Sstevel@tonic-gate 	 * config file and remove the entry from the hardware provider list
16767c478bd9Sstevel@tonic-gate 	 * of the config file.  If it does not have an entry in the config
16777c478bd9Sstevel@tonic-gate 	 * file, no mechanisms of it have been disabled. But, we still call
16787c478bd9Sstevel@tonic-gate 	 * list_policy_for_hard() to account for the "random" feature.
16797c478bd9Sstevel@tonic-gate 	 */
16807c478bd9Sstevel@tonic-gate 	for (i = 0; i < pdevlist_kernel->dl_dev_count; i++) {
16817c478bd9Sstevel@tonic-gate 		(void) snprintf(provname, sizeof (provname), "%s/%d",
16827c478bd9Sstevel@tonic-gate 		    pdevlist_kernel->dl_devs[i].le_dev_name,
16837c478bd9Sstevel@tonic-gate 		    pdevlist_kernel->dl_devs[i].le_dev_instance);
16841b22764fSDaniel OpenSolaris Anderson 
16857c478bd9Sstevel@tonic-gate 		found = B_FALSE;
16867c478bd9Sstevel@tonic-gate 		phead = ptr = pdevlist_conf;
16877c478bd9Sstevel@tonic-gate 		while (!found && ptr) {
16887c478bd9Sstevel@tonic-gate 			if (strcmp(ptr->pent->name, provname) == 0) {
16897c478bd9Sstevel@tonic-gate 				found = B_TRUE;
16907c478bd9Sstevel@tonic-gate 			} else {
16917c478bd9Sstevel@tonic-gate 				phead = ptr;
16927c478bd9Sstevel@tonic-gate 				ptr = ptr->next;
16937c478bd9Sstevel@tonic-gate 			}
16947c478bd9Sstevel@tonic-gate 		}
16957c478bd9Sstevel@tonic-gate 
16967c478bd9Sstevel@tonic-gate 		if (found) {
16971b22764fSDaniel OpenSolaris Anderson 			(void) list_policy_for_hard(ptr->pent->name,
1698d616ad8eSHai-May Chao 			    pdevlist_conf, psoftlist_conf, pdevlist_kernel);
16997c478bd9Sstevel@tonic-gate 			if (phead == ptr) {
17007c478bd9Sstevel@tonic-gate 				pdevlist_conf = pdevlist_conf->next;
17017c478bd9Sstevel@tonic-gate 			} else {
17027c478bd9Sstevel@tonic-gate 				phead->next = ptr->next;
17037c478bd9Sstevel@tonic-gate 			}
17047c478bd9Sstevel@tonic-gate 			free_entry(ptr->pent);
17057c478bd9Sstevel@tonic-gate 			free(ptr);
17067c478bd9Sstevel@tonic-gate 		} else {
17071b22764fSDaniel OpenSolaris Anderson 			(void) list_policy_for_hard(provname, pdevlist_conf,
1708d616ad8eSHai-May Chao 			    psoftlist_conf, pdevlist_kernel);
17097c478bd9Sstevel@tonic-gate 		}
17107c478bd9Sstevel@tonic-gate 	}
17117c478bd9Sstevel@tonic-gate 
17127c478bd9Sstevel@tonic-gate 	/*
17137c478bd9Sstevel@tonic-gate 	 * If there are still entries left in the pdevlist_conf list from
17147c478bd9Sstevel@tonic-gate 	 * the config file, these providers must have been detached.
17157c478bd9Sstevel@tonic-gate 	 * Should print out their policy information also.
17167c478bd9Sstevel@tonic-gate 	 */
17171b22764fSDaniel OpenSolaris Anderson 	for (ptr = pdevlist_conf; ptr != NULL; ptr = ptr->next) {
17181b22764fSDaniel OpenSolaris Anderson 		print_kef_policy(ptr->pent->name, ptr->pent, B_FALSE, B_TRUE);
17197c478bd9Sstevel@tonic-gate 	}
17207c478bd9Sstevel@tonic-gate 
17217c478bd9Sstevel@tonic-gate 	free_entrylist(pdevlist_conf);
17221b22764fSDaniel OpenSolaris Anderson 	free_entrylist(psoftlist_conf);
17237c478bd9Sstevel@tonic-gate 	free(pdevlist_kernel);
17247c478bd9Sstevel@tonic-gate 
17257c478bd9Sstevel@tonic-gate 	return (rc);
17267c478bd9Sstevel@tonic-gate }
1727