17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
5b8bf75cbSkrishna * Common Development and Distribution License (the "License").
6b8bf75cbSkrishna * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
217c478bd9Sstevel@tonic-gate /*
2232e0ab73SMisaki Miyashita * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
237c478bd9Sstevel@tonic-gate */
247c478bd9Sstevel@tonic-gate
259d1587b4SJohn Levon /*
269d1587b4SJohn Levon * Copyright (c) 2018, Joyent, Inc.
279d1587b4SJohn Levon */
287c478bd9Sstevel@tonic-gate
297c478bd9Sstevel@tonic-gate #include <fcntl.h>
307c478bd9Sstevel@tonic-gate #include <stdio.h>
317c478bd9Sstevel@tonic-gate #include <stdlib.h>
327c478bd9Sstevel@tonic-gate #include <strings.h>
337c478bd9Sstevel@tonic-gate #include <unistd.h>
347c478bd9Sstevel@tonic-gate #include <locale.h>
357c478bd9Sstevel@tonic-gate #include <libgen.h>
367c478bd9Sstevel@tonic-gate #include <sys/types.h>
377c478bd9Sstevel@tonic-gate #include <zone.h>
387c478bd9Sstevel@tonic-gate #include <sys/crypto/ioctladmin.h>
397c478bd9Sstevel@tonic-gate #include <cryptoutil.h>
407c478bd9Sstevel@tonic-gate #include "cryptoadm.h"
417c478bd9Sstevel@tonic-gate
427c478bd9Sstevel@tonic-gate #define REQ_ARG_CNT 2
437c478bd9Sstevel@tonic-gate
447c478bd9Sstevel@tonic-gate /* subcommand index */
457c478bd9Sstevel@tonic-gate enum subcommand_index {
467c478bd9Sstevel@tonic-gate CRYPTO_LIST,
477c478bd9Sstevel@tonic-gate CRYPTO_DISABLE,
487c478bd9Sstevel@tonic-gate CRYPTO_ENABLE,
497c478bd9Sstevel@tonic-gate CRYPTO_INSTALL,
507c478bd9Sstevel@tonic-gate CRYPTO_UNINSTALL,
517c478bd9Sstevel@tonic-gate CRYPTO_UNLOAD,
527c478bd9Sstevel@tonic-gate CRYPTO_REFRESH,
537c478bd9Sstevel@tonic-gate CRYPTO_START,
547c478bd9Sstevel@tonic-gate CRYPTO_STOP,
557c478bd9Sstevel@tonic-gate CRYPTO_HELP };
567c478bd9Sstevel@tonic-gate
577c478bd9Sstevel@tonic-gate /*
580a85b835SDaniel Anderson * TRANSLATION_NOTE
597c478bd9Sstevel@tonic-gate * Command keywords are not to be translated.
607c478bd9Sstevel@tonic-gate */
617c478bd9Sstevel@tonic-gate static char *cmd_table[] = {
627c478bd9Sstevel@tonic-gate "list",
637c478bd9Sstevel@tonic-gate "disable",
647c478bd9Sstevel@tonic-gate "enable",
657c478bd9Sstevel@tonic-gate "install",
667c478bd9Sstevel@tonic-gate "uninstall",
677c478bd9Sstevel@tonic-gate "unload",
687c478bd9Sstevel@tonic-gate "refresh",
697c478bd9Sstevel@tonic-gate "start",
707c478bd9Sstevel@tonic-gate "stop",
717c478bd9Sstevel@tonic-gate "--help" };
727c478bd9Sstevel@tonic-gate
737c478bd9Sstevel@tonic-gate /* provider type */
747c478bd9Sstevel@tonic-gate enum provider_type_index {
757c478bd9Sstevel@tonic-gate PROV_UEF_LIB,
767c478bd9Sstevel@tonic-gate PROV_KEF_SOFT,
777c478bd9Sstevel@tonic-gate PROV_KEF_HARD,
787c478bd9Sstevel@tonic-gate METASLOT,
797c478bd9Sstevel@tonic-gate PROV_BADNAME };
807c478bd9Sstevel@tonic-gate
817c478bd9Sstevel@tonic-gate typedef struct {
827c478bd9Sstevel@tonic-gate char cp_name[MAXPATHLEN];
837c478bd9Sstevel@tonic-gate enum provider_type_index cp_type;
847c478bd9Sstevel@tonic-gate } cryptoadm_provider_t;
857c478bd9Sstevel@tonic-gate
867c478bd9Sstevel@tonic-gate /*
870a85b835SDaniel Anderson * TRANSLATION_NOTE
887c478bd9Sstevel@tonic-gate * Operand keywords are not to be translated.
897c478bd9Sstevel@tonic-gate */
907c478bd9Sstevel@tonic-gate static const char *KN_PROVIDER = "provider=";
917c478bd9Sstevel@tonic-gate static const char *KN_MECH = "mechanism=";
927c478bd9Sstevel@tonic-gate static const char *KN_ALL = "all";
937c478bd9Sstevel@tonic-gate static const char *KN_TOKEN = "token=";
947c478bd9Sstevel@tonic-gate static const char *KN_SLOT = "slot=";
957c478bd9Sstevel@tonic-gate static const char *KN_DEFAULT_KS = "default-keystore";
967c478bd9Sstevel@tonic-gate static const char *KN_AUTO_KEY_MIGRATE = "auto-key-migrate";
977c478bd9Sstevel@tonic-gate
987c478bd9Sstevel@tonic-gate /* static variables */
997c478bd9Sstevel@tonic-gate static boolean_t allflag = B_FALSE;
1007c478bd9Sstevel@tonic-gate static boolean_t rndflag = B_FALSE;
1017c478bd9Sstevel@tonic-gate static mechlist_t *mecharglist = NULL;
1027c478bd9Sstevel@tonic-gate
1037c478bd9Sstevel@tonic-gate /* static functions */
1047c478bd9Sstevel@tonic-gate static void usage(void);
1057c478bd9Sstevel@tonic-gate static int get_provider_type(char *);
1067c478bd9Sstevel@tonic-gate static int process_mech_operands(int, char **, boolean_t);
1077c478bd9Sstevel@tonic-gate static int do_list(int, char **);
1087c478bd9Sstevel@tonic-gate static int do_disable(int, char **);
1097c478bd9Sstevel@tonic-gate static int do_enable(int, char **);
1107c478bd9Sstevel@tonic-gate static int do_install(int, char **);
1117c478bd9Sstevel@tonic-gate static int do_uninstall(int, char **);
1127c478bd9Sstevel@tonic-gate static int do_unload(int, char **);
1137c478bd9Sstevel@tonic-gate static int do_refresh(int);
1147c478bd9Sstevel@tonic-gate static int do_start(int);
1157c478bd9Sstevel@tonic-gate static int do_stop(int);
1167c478bd9Sstevel@tonic-gate static int list_simple_for_all(boolean_t);
1177c478bd9Sstevel@tonic-gate static int list_mechlist_for_all(boolean_t);
1187c478bd9Sstevel@tonic-gate static int list_policy_for_all(void);
1197c478bd9Sstevel@tonic-gate
1207c478bd9Sstevel@tonic-gate int
main(int argc,char * argv[])1217c478bd9Sstevel@tonic-gate main(int argc, char *argv[])
1227c478bd9Sstevel@tonic-gate {
1237c478bd9Sstevel@tonic-gate char *subcmd;
1247c478bd9Sstevel@tonic-gate int cmdnum;
1257c478bd9Sstevel@tonic-gate int cmd_index = 0;
1267c478bd9Sstevel@tonic-gate int rc = SUCCESS;
1277c478bd9Sstevel@tonic-gate
1287c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, "");
1297c478bd9Sstevel@tonic-gate
1307c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN) /* Should be defined by cc -D */
1317c478bd9Sstevel@tonic-gate #define TEXT_DOMAIN "SYS_TEST" /* Use this only if it weren't */
1327c478bd9Sstevel@tonic-gate #endif
1337c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN);
1347c478bd9Sstevel@tonic-gate
1357c478bd9Sstevel@tonic-gate cryptodebug_init(basename(argv[0]));
1367c478bd9Sstevel@tonic-gate
1377c478bd9Sstevel@tonic-gate if (argc < REQ_ARG_CNT) {
1387c478bd9Sstevel@tonic-gate usage();
1397c478bd9Sstevel@tonic-gate return (ERROR_USAGE);
1407c478bd9Sstevel@tonic-gate }
1417c478bd9Sstevel@tonic-gate
1427c478bd9Sstevel@tonic-gate /* get the subcommand index */
1437c478bd9Sstevel@tonic-gate cmd_index = 0;
1447c478bd9Sstevel@tonic-gate subcmd = argv[1];
1457c478bd9Sstevel@tonic-gate cmdnum = sizeof (cmd_table)/sizeof (cmd_table[0]);
1467c478bd9Sstevel@tonic-gate
1477c478bd9Sstevel@tonic-gate while ((cmd_index < cmdnum) &&
1487c478bd9Sstevel@tonic-gate (strcmp(subcmd, cmd_table[cmd_index]) != 0)) {
1497c478bd9Sstevel@tonic-gate cmd_index++;
1507c478bd9Sstevel@tonic-gate }
1517c478bd9Sstevel@tonic-gate if (cmd_index >= cmdnum) {
1527c478bd9Sstevel@tonic-gate usage();
1537c478bd9Sstevel@tonic-gate return (ERROR_USAGE);
1547c478bd9Sstevel@tonic-gate }
1557c478bd9Sstevel@tonic-gate
1567c478bd9Sstevel@tonic-gate /* do the subcommand */
1577c478bd9Sstevel@tonic-gate switch (cmd_index) {
1587c478bd9Sstevel@tonic-gate case CRYPTO_LIST:
1597c478bd9Sstevel@tonic-gate rc = do_list(argc, argv);
1607c478bd9Sstevel@tonic-gate break;
1617c478bd9Sstevel@tonic-gate case CRYPTO_DISABLE:
1627c478bd9Sstevel@tonic-gate rc = do_disable(argc, argv);
1637c478bd9Sstevel@tonic-gate break;
1647c478bd9Sstevel@tonic-gate case CRYPTO_ENABLE:
1657c478bd9Sstevel@tonic-gate rc = do_enable(argc, argv);
1667c478bd9Sstevel@tonic-gate break;
1677c478bd9Sstevel@tonic-gate case CRYPTO_INSTALL:
1687c478bd9Sstevel@tonic-gate rc = do_install(argc, argv);
1697c478bd9Sstevel@tonic-gate break;
1707c478bd9Sstevel@tonic-gate case CRYPTO_UNINSTALL:
1717c478bd9Sstevel@tonic-gate rc = do_uninstall(argc, argv);
1727c478bd9Sstevel@tonic-gate break;
1737c478bd9Sstevel@tonic-gate case CRYPTO_UNLOAD:
1747c478bd9Sstevel@tonic-gate rc = do_unload(argc, argv);
1757c478bd9Sstevel@tonic-gate break;
1767c478bd9Sstevel@tonic-gate case CRYPTO_REFRESH:
1777c478bd9Sstevel@tonic-gate rc = do_refresh(argc);
1787c478bd9Sstevel@tonic-gate break;
1797c478bd9Sstevel@tonic-gate case CRYPTO_START:
1807c478bd9Sstevel@tonic-gate rc = do_start(argc);
1817c478bd9Sstevel@tonic-gate break;
1827c478bd9Sstevel@tonic-gate case CRYPTO_STOP:
1837c478bd9Sstevel@tonic-gate rc = do_stop(argc);
1847c478bd9Sstevel@tonic-gate break;
1857c478bd9Sstevel@tonic-gate case CRYPTO_HELP:
1867c478bd9Sstevel@tonic-gate usage();
1877c478bd9Sstevel@tonic-gate rc = SUCCESS;
1887c478bd9Sstevel@tonic-gate break;
1897c478bd9Sstevel@tonic-gate default: /* should not come here */
1907c478bd9Sstevel@tonic-gate usage();
1917c478bd9Sstevel@tonic-gate rc = ERROR_USAGE;
1927c478bd9Sstevel@tonic-gate break;
1937c478bd9Sstevel@tonic-gate }
1947c478bd9Sstevel@tonic-gate return (rc);
1957c478bd9Sstevel@tonic-gate }
1967c478bd9Sstevel@tonic-gate
1977c478bd9Sstevel@tonic-gate
1987c478bd9Sstevel@tonic-gate static void
usage(void)1997c478bd9Sstevel@tonic-gate usage(void)
2007c478bd9Sstevel@tonic-gate {
2017c478bd9Sstevel@tonic-gate /*
2020a85b835SDaniel Anderson * TRANSLATION_NOTE
2037c478bd9Sstevel@tonic-gate * Command usage is not to be translated. Only the word "Usage:"
2047c478bd9Sstevel@tonic-gate * along with localized expressions indicating what kind of value
2057c478bd9Sstevel@tonic-gate * is expected for arguments.
2067c478bd9Sstevel@tonic-gate */
2077c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("Usage:\n"));
2087c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
2097c478bd9Sstevel@tonic-gate " cryptoadm list [-mpv] [provider=<%s> | metaslot]"
2107c478bd9Sstevel@tonic-gate " [mechanism=<%s>]\n",
2117c478bd9Sstevel@tonic-gate gettext("provider-name"), gettext("mechanism-list"));
2127c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
2137c478bd9Sstevel@tonic-gate " cryptoadm disable provider=<%s>"
2147c478bd9Sstevel@tonic-gate " mechanism=<%s> | random | all\n",
2157c478bd9Sstevel@tonic-gate gettext("provider-name"), gettext("mechanism-list"));
2167c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
2177c478bd9Sstevel@tonic-gate " cryptoadm disable metaslot"
2187c478bd9Sstevel@tonic-gate " [auto-key-migrate] [mechanism=<%s>]\n",
2197c478bd9Sstevel@tonic-gate gettext("mechanism-list"));
2207c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
2217c478bd9Sstevel@tonic-gate " cryptoadm enable provider=<%s>"
2227c478bd9Sstevel@tonic-gate " mechanism=<%s> | random | all\n",
2237c478bd9Sstevel@tonic-gate gettext("provider-name"), gettext("mechanism-list"));
2247c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
2257c478bd9Sstevel@tonic-gate " cryptoadm enable metaslot [mechanism=<%s>]"
2267c478bd9Sstevel@tonic-gate " [[token=<%s>] [slot=<%s>]"
2277c478bd9Sstevel@tonic-gate " | [default-keystore]] | [auto-key-migrate]\n",
2287c478bd9Sstevel@tonic-gate gettext("mechanism-list"), gettext("token-label"),
2297c478bd9Sstevel@tonic-gate gettext("slot-description"));
2307c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
2317c478bd9Sstevel@tonic-gate " cryptoadm install provider=<%s>\n",
2327c478bd9Sstevel@tonic-gate gettext("provider-name"));
2337c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
2347c478bd9Sstevel@tonic-gate " cryptoadm install provider=<%s> [mechanism=<%s>]\n",
2357c478bd9Sstevel@tonic-gate gettext("provider-name"), gettext("mechanism-list"));
2367c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
2377c478bd9Sstevel@tonic-gate " cryptoadm uninstall provider=<%s>\n",
2387c478bd9Sstevel@tonic-gate gettext("provider-name"));
2397c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
2407c478bd9Sstevel@tonic-gate " cryptoadm unload provider=<%s>\n",
2417c478bd9Sstevel@tonic-gate gettext("provider-name"));
2427c478bd9Sstevel@tonic-gate (void) fprintf(stderr,
2437c478bd9Sstevel@tonic-gate " cryptoadm refresh\n"
2447c478bd9Sstevel@tonic-gate " cryptoadm start\n"
2457c478bd9Sstevel@tonic-gate " cryptoadm stop\n"
2467c478bd9Sstevel@tonic-gate " cryptoadm --help\n");
2477c478bd9Sstevel@tonic-gate }
2487c478bd9Sstevel@tonic-gate
2497c478bd9Sstevel@tonic-gate
2507c478bd9Sstevel@tonic-gate /*
2517c478bd9Sstevel@tonic-gate * Get the provider type. This function returns
2527c478bd9Sstevel@tonic-gate * - PROV_UEF_LIB if provname contains an absolute path name
2531b22764fSDaniel OpenSolaris Anderson * - PROV_KEF_SOFT if provname is a base name only (e.g., "aes").
2547c478bd9Sstevel@tonic-gate * - PROV_KEF_HARD if provname contains one slash only and the slash is not
2551b22764fSDaniel OpenSolaris Anderson * the 1st character (e.g., "mca/0").
2560a85b835SDaniel Anderson * - PROV_BADNAME otherwise.
2577c478bd9Sstevel@tonic-gate */
2587c478bd9Sstevel@tonic-gate static int
get_provider_type(char * provname)2597c478bd9Sstevel@tonic-gate get_provider_type(char *provname)
2607c478bd9Sstevel@tonic-gate {
2617c478bd9Sstevel@tonic-gate char *pslash1;
2627c478bd9Sstevel@tonic-gate char *pslash2;
2637c478bd9Sstevel@tonic-gate
2647c478bd9Sstevel@tonic-gate if (provname == NULL) {
2657c478bd9Sstevel@tonic-gate return (FAILURE);
2667c478bd9Sstevel@tonic-gate }
2677c478bd9Sstevel@tonic-gate
2687c478bd9Sstevel@tonic-gate if (provname[0] == '/') {
2697c478bd9Sstevel@tonic-gate return (PROV_UEF_LIB);
2707c478bd9Sstevel@tonic-gate } else if ((pslash1 = strchr(provname, SEP_SLASH)) == NULL) {
2717c478bd9Sstevel@tonic-gate /* no slash */
2727c478bd9Sstevel@tonic-gate return (PROV_KEF_SOFT);
2737c478bd9Sstevel@tonic-gate } else {
2747c478bd9Sstevel@tonic-gate pslash2 = strrchr(provname, SEP_SLASH);
2757c478bd9Sstevel@tonic-gate if (pslash1 == pslash2) {
2767c478bd9Sstevel@tonic-gate return (PROV_KEF_HARD);
2777c478bd9Sstevel@tonic-gate } else {
2787c478bd9Sstevel@tonic-gate return (PROV_BADNAME);
2797c478bd9Sstevel@tonic-gate }
2807c478bd9Sstevel@tonic-gate }
2817c478bd9Sstevel@tonic-gate }
2827c478bd9Sstevel@tonic-gate
2837c478bd9Sstevel@tonic-gate /*
2847c478bd9Sstevel@tonic-gate * Get the provider structure. This function returns NULL if no valid
2857c478bd9Sstevel@tonic-gate * provider= is found in argv[], otherwise a cryptoadm_provider_t is returned.
2867c478bd9Sstevel@tonic-gate * If provider= is found but has no argument, then a cryptoadm_provider_t
2877c478bd9Sstevel@tonic-gate * with cp_type = PROV_BADNAME is returned.
2887c478bd9Sstevel@tonic-gate */
2897c478bd9Sstevel@tonic-gate static cryptoadm_provider_t *
get_provider(int argc,char ** argv)2907c478bd9Sstevel@tonic-gate get_provider(int argc, char **argv)
2917c478bd9Sstevel@tonic-gate {
2921b22764fSDaniel OpenSolaris Anderson int c = 0;
2931b22764fSDaniel OpenSolaris Anderson boolean_t found = B_FALSE;
2941b22764fSDaniel OpenSolaris Anderson cryptoadm_provider_t *provider = NULL;
2951b22764fSDaniel OpenSolaris Anderson char *provstr = NULL, *savstr;
2961b22764fSDaniel OpenSolaris Anderson boolean_t is_metaslot = B_FALSE;
2977c478bd9Sstevel@tonic-gate
2987c478bd9Sstevel@tonic-gate while (!found && ++c < argc) {
2997c478bd9Sstevel@tonic-gate if (strncmp(argv[c], METASLOT_KEYWORD,
3007c478bd9Sstevel@tonic-gate strlen(METASLOT_KEYWORD)) == 0) {
3017c478bd9Sstevel@tonic-gate is_metaslot = B_TRUE;
3027c478bd9Sstevel@tonic-gate found = B_TRUE;
3037c478bd9Sstevel@tonic-gate } else if (strncmp(argv[c], KN_PROVIDER,
3047c478bd9Sstevel@tonic-gate strlen(KN_PROVIDER)) == 0 &&
3057c478bd9Sstevel@tonic-gate strlen(argv[c]) > strlen(KN_PROVIDER)) {
3067c478bd9Sstevel@tonic-gate if ((provstr = strdup(argv[c])) == NULL) {
3077c478bd9Sstevel@tonic-gate int err = errno;
3087c478bd9Sstevel@tonic-gate /*
3090a85b835SDaniel Anderson * TRANSLATION_NOTE
3107c478bd9Sstevel@tonic-gate * "get_provider" is a function name and should
3117c478bd9Sstevel@tonic-gate * not be translated.
3127c478bd9Sstevel@tonic-gate */
3137c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, "get_provider: %s.",
3147c478bd9Sstevel@tonic-gate strerror(err));
3157c478bd9Sstevel@tonic-gate return (NULL);
3167c478bd9Sstevel@tonic-gate }
3177c478bd9Sstevel@tonic-gate found = B_TRUE;
3187c478bd9Sstevel@tonic-gate }
3197c478bd9Sstevel@tonic-gate }
3207c478bd9Sstevel@tonic-gate if (!found)
3217c478bd9Sstevel@tonic-gate return (NULL);
3227c478bd9Sstevel@tonic-gate
3237c478bd9Sstevel@tonic-gate provider = malloc(sizeof (cryptoadm_provider_t));
3247c478bd9Sstevel@tonic-gate if (provider == NULL) {
3257c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("out of memory."));
3267c478bd9Sstevel@tonic-gate if (provstr) {
3277c478bd9Sstevel@tonic-gate free(provstr);
3287c478bd9Sstevel@tonic-gate }
3297c478bd9Sstevel@tonic-gate return (NULL);
3307c478bd9Sstevel@tonic-gate }
3317c478bd9Sstevel@tonic-gate
3327c478bd9Sstevel@tonic-gate if (is_metaslot) {
3337c478bd9Sstevel@tonic-gate (void) strlcpy(provider->cp_name, METASLOT_KEYWORD,
3347c478bd9Sstevel@tonic-gate strlen(METASLOT_KEYWORD));
3357c478bd9Sstevel@tonic-gate provider->cp_type = METASLOT;
3367c478bd9Sstevel@tonic-gate } else {
3377c478bd9Sstevel@tonic-gate
3387c478bd9Sstevel@tonic-gate savstr = provstr;
3397c478bd9Sstevel@tonic-gate (void) strtok(provstr, "=");
3407c478bd9Sstevel@tonic-gate provstr = strtok(NULL, "=");
3417c478bd9Sstevel@tonic-gate if (provstr == NULL) {
3427c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("bad provider name."));
3437c478bd9Sstevel@tonic-gate provider->cp_type = PROV_BADNAME;
3447c478bd9Sstevel@tonic-gate free(savstr);
3457c478bd9Sstevel@tonic-gate return (provider);
3467c478bd9Sstevel@tonic-gate }
3477c478bd9Sstevel@tonic-gate
3487c478bd9Sstevel@tonic-gate (void) strlcpy(provider->cp_name, provstr,
3497c478bd9Sstevel@tonic-gate sizeof (provider->cp_name));
3507c478bd9Sstevel@tonic-gate provider->cp_type = get_provider_type(provider->cp_name);
3517c478bd9Sstevel@tonic-gate
3527c478bd9Sstevel@tonic-gate free(savstr);
3537c478bd9Sstevel@tonic-gate }
3547c478bd9Sstevel@tonic-gate return (provider);
3557c478bd9Sstevel@tonic-gate }
3567c478bd9Sstevel@tonic-gate
3577c478bd9Sstevel@tonic-gate /*
3587c478bd9Sstevel@tonic-gate * Process the "feature" operands.
3597c478bd9Sstevel@tonic-gate *
3607c478bd9Sstevel@tonic-gate * "argc" and "argv" contain values specified on the command line.
3617c478bd9Sstevel@tonic-gate * All other arguments are used for returning parsing results.
3627c478bd9Sstevel@tonic-gate * If any of these arguments are NULL, that keyword is not expected,
3637c478bd9Sstevel@tonic-gate * and FAILURE will be returned.
3647c478bd9Sstevel@tonic-gate */
3657c478bd9Sstevel@tonic-gate static int
process_metaslot_operands(int argc,char ** argv,char ** meta_ks_token,char ** meta_ks_slot,boolean_t * use_default,boolean_t * auto_key_migrate_flag)3667c478bd9Sstevel@tonic-gate process_metaslot_operands(int argc, char **argv, char **meta_ks_token,
3677c478bd9Sstevel@tonic-gate char **meta_ks_slot, boolean_t *use_default,
3687c478bd9Sstevel@tonic-gate boolean_t *auto_key_migrate_flag)
3697c478bd9Sstevel@tonic-gate {
3707c478bd9Sstevel@tonic-gate int c = 2;
3717c478bd9Sstevel@tonic-gate int rc = SUCCESS;
3727c478bd9Sstevel@tonic-gate
3737c478bd9Sstevel@tonic-gate while (++c < argc) {
3747c478bd9Sstevel@tonic-gate if ((strncmp(argv[c], KN_MECH, strlen(KN_MECH)) == 0) &&
3757c478bd9Sstevel@tonic-gate strlen(argv[c]) > strlen(KN_MECH)) {
3767c478bd9Sstevel@tonic-gate
3777c478bd9Sstevel@tonic-gate /* process mechanism operands */
3787c478bd9Sstevel@tonic-gate if ((rc = process_mech_operands(argc, argv, B_TRUE))
3797c478bd9Sstevel@tonic-gate != SUCCESS) {
3807c478bd9Sstevel@tonic-gate goto finish;
3817c478bd9Sstevel@tonic-gate }
3827c478bd9Sstevel@tonic-gate
3837c478bd9Sstevel@tonic-gate } else if ((strncmp(argv[c], KN_TOKEN,
3847c478bd9Sstevel@tonic-gate strlen(KN_TOKEN)) == 0) &&
3857c478bd9Sstevel@tonic-gate strlen(argv[c]) > strlen(KN_TOKEN)) {
3867c478bd9Sstevel@tonic-gate if ((meta_ks_token) && (strtok(argv[c], "=") != NULL)) {
3877c478bd9Sstevel@tonic-gate char *tmp;
3887c478bd9Sstevel@tonic-gate if ((tmp = strtok(NULL, "=")) != NULL) {
3897c478bd9Sstevel@tonic-gate *meta_ks_token = strdup(tmp);
3907c478bd9Sstevel@tonic-gate } else {
3917c478bd9Sstevel@tonic-gate return (FAILURE);
3927c478bd9Sstevel@tonic-gate }
3937c478bd9Sstevel@tonic-gate } else {
3947c478bd9Sstevel@tonic-gate return (FAILURE);
3957c478bd9Sstevel@tonic-gate }
3967c478bd9Sstevel@tonic-gate
3977c478bd9Sstevel@tonic-gate } else if ((strncmp(argv[c], KN_SLOT,
3987c478bd9Sstevel@tonic-gate strlen(KN_SLOT)) == 0) &&
3997c478bd9Sstevel@tonic-gate strlen(argv[c]) > strlen(KN_SLOT)) {
4007c478bd9Sstevel@tonic-gate
4017c478bd9Sstevel@tonic-gate if ((meta_ks_slot) && (strtok(argv[c], "=") != NULL)) {
4027c478bd9Sstevel@tonic-gate char *tmp;
4037c478bd9Sstevel@tonic-gate if ((tmp = strtok(NULL, "=")) != NULL) {
4047c478bd9Sstevel@tonic-gate *meta_ks_slot = strdup(tmp);
4057c478bd9Sstevel@tonic-gate } else {
4067c478bd9Sstevel@tonic-gate return (FAILURE);
4077c478bd9Sstevel@tonic-gate }
4087c478bd9Sstevel@tonic-gate } else {
4097c478bd9Sstevel@tonic-gate return (FAILURE);
4107c478bd9Sstevel@tonic-gate }
4117c478bd9Sstevel@tonic-gate
4127c478bd9Sstevel@tonic-gate } else if (strncmp(argv[c], KN_DEFAULT_KS,
4137c478bd9Sstevel@tonic-gate strlen(KN_DEFAULT_KS)) == 0) {
4147c478bd9Sstevel@tonic-gate
4157c478bd9Sstevel@tonic-gate if (use_default) {
4167c478bd9Sstevel@tonic-gate *use_default = B_TRUE;
4177c478bd9Sstevel@tonic-gate } else {
4187c478bd9Sstevel@tonic-gate return (FAILURE);
4197c478bd9Sstevel@tonic-gate }
4207c478bd9Sstevel@tonic-gate } else if (strncmp(argv[c], KN_AUTO_KEY_MIGRATE,
4217c478bd9Sstevel@tonic-gate strlen(KN_AUTO_KEY_MIGRATE)) == 0) {
4227c478bd9Sstevel@tonic-gate
4237c478bd9Sstevel@tonic-gate if (auto_key_migrate_flag) {
4247c478bd9Sstevel@tonic-gate *auto_key_migrate_flag = B_TRUE;
4257c478bd9Sstevel@tonic-gate } else {
4267c478bd9Sstevel@tonic-gate return (FAILURE);
4277c478bd9Sstevel@tonic-gate }
4287c478bd9Sstevel@tonic-gate } else {
4297c478bd9Sstevel@tonic-gate return (FAILURE);
4307c478bd9Sstevel@tonic-gate }
4317c478bd9Sstevel@tonic-gate }
4327c478bd9Sstevel@tonic-gate finish:
4337c478bd9Sstevel@tonic-gate return (rc);
4347c478bd9Sstevel@tonic-gate }
4357c478bd9Sstevel@tonic-gate
4367c478bd9Sstevel@tonic-gate /*
4377c478bd9Sstevel@tonic-gate * Process the "feature" operands.
4387c478bd9Sstevel@tonic-gate */
4397c478bd9Sstevel@tonic-gate static int
process_feature_operands(int argc,char ** argv)4407c478bd9Sstevel@tonic-gate process_feature_operands(int argc, char **argv)
4417c478bd9Sstevel@tonic-gate {
4427c478bd9Sstevel@tonic-gate int c = 2;
4437c478bd9Sstevel@tonic-gate
4447c478bd9Sstevel@tonic-gate while (++c < argc) {
4457c478bd9Sstevel@tonic-gate if (strcmp(argv[c], KN_ALL) == 0) {
4467c478bd9Sstevel@tonic-gate allflag = B_TRUE;
4477c478bd9Sstevel@tonic-gate rndflag = B_TRUE; /* all includes random also. */
4487c478bd9Sstevel@tonic-gate } else if (strcmp(argv[c], RANDOM) == 0) {
4497c478bd9Sstevel@tonic-gate rndflag = B_TRUE;
4507c478bd9Sstevel@tonic-gate }
4517c478bd9Sstevel@tonic-gate }
4527c478bd9Sstevel@tonic-gate return (SUCCESS);
4537c478bd9Sstevel@tonic-gate }
4547c478bd9Sstevel@tonic-gate
4557c478bd9Sstevel@tonic-gate /*
4567c478bd9Sstevel@tonic-gate * Process the mechanism operands for the disable, enable and install
4577c478bd9Sstevel@tonic-gate * subcommands. This function sets the static variable allflag to be B_TRUE
4587c478bd9Sstevel@tonic-gate * if the keyword "all" is specified, otherwise builds a link list of the
4597c478bd9Sstevel@tonic-gate * mechanism operands and save it in the static variable mecharglist.
4607c478bd9Sstevel@tonic-gate *
4617c478bd9Sstevel@tonic-gate * This function returns
4621b22764fSDaniel OpenSolaris Anderson * ERROR_USAGE: mechanism operand is missing.
4631b22764fSDaniel OpenSolaris Anderson * FAILURE: out of memory.
4641b22764fSDaniel OpenSolaris Anderson * SUCCESS: otherwise.
4657c478bd9Sstevel@tonic-gate */
4667c478bd9Sstevel@tonic-gate static int
process_mech_operands(int argc,char ** argv,boolean_t quiet)4677c478bd9Sstevel@tonic-gate process_mech_operands(int argc, char **argv, boolean_t quiet)
4687c478bd9Sstevel@tonic-gate {
4691b22764fSDaniel OpenSolaris Anderson mechlist_t *pmech;
4701b22764fSDaniel OpenSolaris Anderson mechlist_t *pcur = NULL;
4711b22764fSDaniel OpenSolaris Anderson mechlist_t *phead = NULL;
4721b22764fSDaniel OpenSolaris Anderson boolean_t found = B_FALSE;
4731b22764fSDaniel OpenSolaris Anderson char *mechliststr = NULL;
4741b22764fSDaniel OpenSolaris Anderson char *curmech = NULL;
4751b22764fSDaniel OpenSolaris Anderson int c = -1;
4761b22764fSDaniel OpenSolaris Anderson int rc = SUCCESS;
4777c478bd9Sstevel@tonic-gate
4787c478bd9Sstevel@tonic-gate while (!found && ++c < argc) {
4797c478bd9Sstevel@tonic-gate if ((strncmp(argv[c], KN_MECH, strlen(KN_MECH)) == 0) &&
4807c478bd9Sstevel@tonic-gate strlen(argv[c]) > strlen(KN_MECH)) {
4817c478bd9Sstevel@tonic-gate found = B_TRUE;
4827c478bd9Sstevel@tonic-gate }
4837c478bd9Sstevel@tonic-gate }
4847c478bd9Sstevel@tonic-gate if (!found) {
4857c478bd9Sstevel@tonic-gate if (!quiet)
4867c478bd9Sstevel@tonic-gate /*
4870a85b835SDaniel Anderson * TRANSLATION_NOTE
4887c478bd9Sstevel@tonic-gate * "mechanism" could be either a literal keyword
4897c478bd9Sstevel@tonic-gate * and hence not to be translated, or a descriptive
4907c478bd9Sstevel@tonic-gate * word and translatable. A choice was made to
4917c478bd9Sstevel@tonic-gate * view it as a literal keyword.
4927c478bd9Sstevel@tonic-gate */
4937c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR,
4941b22764fSDaniel OpenSolaris Anderson gettext("the %s operand is missing.\n"),
4951b22764fSDaniel OpenSolaris Anderson "mechanism");
4967c478bd9Sstevel@tonic-gate return (ERROR_USAGE);
4977c478bd9Sstevel@tonic-gate }
4987c478bd9Sstevel@tonic-gate (void) strtok(argv[c], "=");
4997c478bd9Sstevel@tonic-gate mechliststr = strtok(NULL, "=");
5007c478bd9Sstevel@tonic-gate
5017c478bd9Sstevel@tonic-gate if (strcmp(mechliststr, "all") == 0) {
5027c478bd9Sstevel@tonic-gate allflag = B_TRUE;
5037c478bd9Sstevel@tonic-gate mecharglist = NULL;
5047c478bd9Sstevel@tonic-gate return (SUCCESS);
5057c478bd9Sstevel@tonic-gate }
5067c478bd9Sstevel@tonic-gate
5077c478bd9Sstevel@tonic-gate curmech = strtok(mechliststr, ",");
5087c478bd9Sstevel@tonic-gate do {
5097c478bd9Sstevel@tonic-gate if ((pmech = create_mech(curmech)) == NULL) {
5107c478bd9Sstevel@tonic-gate rc = FAILURE;
5117c478bd9Sstevel@tonic-gate break;
5127c478bd9Sstevel@tonic-gate } else {
5137c478bd9Sstevel@tonic-gate if (phead == NULL) {
5147c478bd9Sstevel@tonic-gate phead = pcur = pmech;
5157c478bd9Sstevel@tonic-gate } else {
5167c478bd9Sstevel@tonic-gate pcur->next = pmech;
5177c478bd9Sstevel@tonic-gate pcur = pmech;
5187c478bd9Sstevel@tonic-gate }
5197c478bd9Sstevel@tonic-gate }
5207c478bd9Sstevel@tonic-gate } while ((curmech = strtok(NULL, ",")) != NULL);
5217c478bd9Sstevel@tonic-gate
5227c478bd9Sstevel@tonic-gate if (rc == FAILURE) {
5237c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("out of memory."));
5247c478bd9Sstevel@tonic-gate free_mechlist(phead);
5257c478bd9Sstevel@tonic-gate } else {
5267c478bd9Sstevel@tonic-gate mecharglist = phead;
5277c478bd9Sstevel@tonic-gate rc = SUCCESS;
5287c478bd9Sstevel@tonic-gate }
5297c478bd9Sstevel@tonic-gate return (rc);
5307c478bd9Sstevel@tonic-gate }
5317c478bd9Sstevel@tonic-gate
5327c478bd9Sstevel@tonic-gate
5337c478bd9Sstevel@tonic-gate
5347c478bd9Sstevel@tonic-gate /*
5351b22764fSDaniel OpenSolaris Anderson * The top level function for the "cryptoadm list" subcommand and options.
5367c478bd9Sstevel@tonic-gate */
5377c478bd9Sstevel@tonic-gate static int
do_list(int argc,char ** argv)5387c478bd9Sstevel@tonic-gate do_list(int argc, char **argv)
5397c478bd9Sstevel@tonic-gate {
5401b22764fSDaniel OpenSolaris Anderson boolean_t mflag = B_FALSE;
5411b22764fSDaniel OpenSolaris Anderson boolean_t pflag = B_FALSE;
5421b22764fSDaniel OpenSolaris Anderson boolean_t vflag = B_FALSE;
543*ef150c2bSRichard Lowe int ch;
5441b22764fSDaniel OpenSolaris Anderson cryptoadm_provider_t *prov = NULL;
5451b22764fSDaniel OpenSolaris Anderson int rc = SUCCESS;
5467c478bd9Sstevel@tonic-gate
5477c478bd9Sstevel@tonic-gate argc -= 1;
5487c478bd9Sstevel@tonic-gate argv += 1;
5497c478bd9Sstevel@tonic-gate
5507c478bd9Sstevel@tonic-gate if (argc == 1) {
5517c478bd9Sstevel@tonic-gate rc = list_simple_for_all(B_FALSE);
5527c478bd9Sstevel@tonic-gate goto out;
5537c478bd9Sstevel@tonic-gate }
5547c478bd9Sstevel@tonic-gate
5557c478bd9Sstevel@tonic-gate /*
5561b22764fSDaniel OpenSolaris Anderson * cryptoadm list [-v] [-m] [-p] [provider=<>] [mechanism=<>]
5577c478bd9Sstevel@tonic-gate */
5587c478bd9Sstevel@tonic-gate if (argc > 5) {
5597c478bd9Sstevel@tonic-gate usage();
5607c478bd9Sstevel@tonic-gate return (rc);
5617c478bd9Sstevel@tonic-gate }
5627c478bd9Sstevel@tonic-gate
5637c478bd9Sstevel@tonic-gate while ((ch = getopt(argc, argv, "mpv")) != EOF) {
5647c478bd9Sstevel@tonic-gate switch (ch) {
5657c478bd9Sstevel@tonic-gate case 'm':
5667c478bd9Sstevel@tonic-gate mflag = B_TRUE;
5677c478bd9Sstevel@tonic-gate if (pflag) {
5687c478bd9Sstevel@tonic-gate rc = ERROR_USAGE;
5697c478bd9Sstevel@tonic-gate }
5707c478bd9Sstevel@tonic-gate break;
5717c478bd9Sstevel@tonic-gate case 'p':
5727c478bd9Sstevel@tonic-gate pflag = B_TRUE;
5737c478bd9Sstevel@tonic-gate if (mflag || vflag) {
5747c478bd9Sstevel@tonic-gate rc = ERROR_USAGE;
5757c478bd9Sstevel@tonic-gate }
5767c478bd9Sstevel@tonic-gate break;
5777c478bd9Sstevel@tonic-gate case 'v':
5787c478bd9Sstevel@tonic-gate vflag = B_TRUE;
5797c478bd9Sstevel@tonic-gate if (pflag)
5807c478bd9Sstevel@tonic-gate rc = ERROR_USAGE;
5817c478bd9Sstevel@tonic-gate break;
5827c478bd9Sstevel@tonic-gate default:
5837c478bd9Sstevel@tonic-gate rc = ERROR_USAGE;
5847c478bd9Sstevel@tonic-gate break;
5857c478bd9Sstevel@tonic-gate }
5867c478bd9Sstevel@tonic-gate }
5877c478bd9Sstevel@tonic-gate
5887c478bd9Sstevel@tonic-gate if (rc == ERROR_USAGE) {
5897c478bd9Sstevel@tonic-gate usage();
5907c478bd9Sstevel@tonic-gate return (rc);
5917c478bd9Sstevel@tonic-gate }
5927c478bd9Sstevel@tonic-gate
5937c478bd9Sstevel@tonic-gate if ((rc = process_feature_operands(argc, argv)) != SUCCESS) {
5947c478bd9Sstevel@tonic-gate goto out;
5957c478bd9Sstevel@tonic-gate }
5967c478bd9Sstevel@tonic-gate
5977c478bd9Sstevel@tonic-gate prov = get_provider(argc, argv);
5987c478bd9Sstevel@tonic-gate
5997c478bd9Sstevel@tonic-gate if (mflag || vflag) {
6007c478bd9Sstevel@tonic-gate if (argc > 0) {
6017c478bd9Sstevel@tonic-gate rc = process_mech_operands(argc, argv, B_TRUE);
6027c478bd9Sstevel@tonic-gate if (rc == FAILURE)
6037c478bd9Sstevel@tonic-gate goto out;
6047c478bd9Sstevel@tonic-gate /* "-m" is implied when a mechanism list is given */
6057c478bd9Sstevel@tonic-gate if (mecharglist != NULL || allflag)
6067c478bd9Sstevel@tonic-gate mflag = B_TRUE;
6077c478bd9Sstevel@tonic-gate }
6087c478bd9Sstevel@tonic-gate }
6097c478bd9Sstevel@tonic-gate
6107c478bd9Sstevel@tonic-gate if (prov == NULL) {
6117c478bd9Sstevel@tonic-gate if (mflag) {
6127c478bd9Sstevel@tonic-gate rc = list_mechlist_for_all(vflag);
6137c478bd9Sstevel@tonic-gate } else if (pflag) {
6147c478bd9Sstevel@tonic-gate rc = list_policy_for_all();
6157c478bd9Sstevel@tonic-gate } else if (vflag) {
6167c478bd9Sstevel@tonic-gate rc = list_simple_for_all(vflag);
6177c478bd9Sstevel@tonic-gate }
6187c478bd9Sstevel@tonic-gate } else if (prov->cp_type == METASLOT) {
6197c478bd9Sstevel@tonic-gate if ((!mflag) && (!vflag) && (!pflag)) {
6207c478bd9Sstevel@tonic-gate /* no flag is specified, just list metaslot status */
6217c478bd9Sstevel@tonic-gate rc = list_metaslot_info(mflag, vflag, mecharglist);
6227c478bd9Sstevel@tonic-gate } else if (mflag || vflag) {
6237c478bd9Sstevel@tonic-gate rc = list_metaslot_info(mflag, vflag, mecharglist);
6247c478bd9Sstevel@tonic-gate } else if (pflag) {
6257c478bd9Sstevel@tonic-gate rc = list_metaslot_policy();
6267c478bd9Sstevel@tonic-gate } else {
6277c478bd9Sstevel@tonic-gate /* error message */
6287c478bd9Sstevel@tonic-gate usage();
6297c478bd9Sstevel@tonic-gate rc = ERROR_USAGE;
6307c478bd9Sstevel@tonic-gate }
6317c478bd9Sstevel@tonic-gate } else if (prov->cp_type == PROV_BADNAME) {
6327c478bd9Sstevel@tonic-gate usage();
6337c478bd9Sstevel@tonic-gate rc = ERROR_USAGE;
6347c478bd9Sstevel@tonic-gate goto out;
6357c478bd9Sstevel@tonic-gate } else { /* do the listing for a provider only */
6361b22764fSDaniel OpenSolaris Anderson char *provname = prov->cp_name;
6371b22764fSDaniel OpenSolaris Anderson
6387c478bd9Sstevel@tonic-gate if (mflag || vflag) {
6397c478bd9Sstevel@tonic-gate if (vflag)
6407c478bd9Sstevel@tonic-gate (void) printf(gettext("Provider: %s\n"),
6411b22764fSDaniel OpenSolaris Anderson provname);
6427c478bd9Sstevel@tonic-gate switch (prov->cp_type) {
6437c478bd9Sstevel@tonic-gate case PROV_UEF_LIB:
6441b22764fSDaniel OpenSolaris Anderson rc = list_mechlist_for_lib(provname,
6451b22764fSDaniel OpenSolaris Anderson mecharglist, NULL, B_FALSE, vflag, mflag);
6467c478bd9Sstevel@tonic-gate break;
6477c478bd9Sstevel@tonic-gate case PROV_KEF_SOFT:
6481b22764fSDaniel OpenSolaris Anderson rc = list_mechlist_for_soft(provname,
649d616ad8eSHai-May Chao NULL, NULL);
6507c478bd9Sstevel@tonic-gate break;
6517c478bd9Sstevel@tonic-gate case PROV_KEF_HARD:
6521b22764fSDaniel OpenSolaris Anderson rc = list_mechlist_for_hard(provname);
6537c478bd9Sstevel@tonic-gate break;
6547c478bd9Sstevel@tonic-gate default: /* should not come here */
6557c478bd9Sstevel@tonic-gate rc = FAILURE;
6567c478bd9Sstevel@tonic-gate break;
6577c478bd9Sstevel@tonic-gate }
6587c478bd9Sstevel@tonic-gate } else if (pflag) {
6597c478bd9Sstevel@tonic-gate switch (prov->cp_type) {
6607c478bd9Sstevel@tonic-gate case PROV_UEF_LIB:
6611b22764fSDaniel OpenSolaris Anderson rc = list_policy_for_lib(provname);
6627c478bd9Sstevel@tonic-gate break;
6637c478bd9Sstevel@tonic-gate case PROV_KEF_SOFT:
6647c478bd9Sstevel@tonic-gate if (getzoneid() == GLOBAL_ZONEID) {
6651b22764fSDaniel OpenSolaris Anderson rc = list_policy_for_soft(provname,
666d616ad8eSHai-May Chao NULL, NULL);
6677c478bd9Sstevel@tonic-gate } else {
6687c478bd9Sstevel@tonic-gate /*
6690a85b835SDaniel Anderson * TRANSLATION_NOTE
6707c478bd9Sstevel@tonic-gate * "global" is keyword and not to
6717c478bd9Sstevel@tonic-gate * be translated.
6727c478bd9Sstevel@tonic-gate */
6737c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
6747c478bd9Sstevel@tonic-gate "policy information for kernel "
6757c478bd9Sstevel@tonic-gate "providers is available "
6767c478bd9Sstevel@tonic-gate "in the %s zone only"), "global");
6777c478bd9Sstevel@tonic-gate rc = FAILURE;
6787c478bd9Sstevel@tonic-gate }
6797c478bd9Sstevel@tonic-gate break;
6807c478bd9Sstevel@tonic-gate case PROV_KEF_HARD:
6817c478bd9Sstevel@tonic-gate if (getzoneid() == GLOBAL_ZONEID) {
6827c478bd9Sstevel@tonic-gate rc = list_policy_for_hard(
683d616ad8eSHai-May Chao provname, NULL, NULL, NULL);
6847c478bd9Sstevel@tonic-gate } else {
6857c478bd9Sstevel@tonic-gate /*
6860a85b835SDaniel Anderson * TRANSLATION_NOTE
6877c478bd9Sstevel@tonic-gate * "global" is keyword and not to
6887c478bd9Sstevel@tonic-gate * be translated.
6897c478bd9Sstevel@tonic-gate */
6907c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
6917c478bd9Sstevel@tonic-gate "policy information for kernel "
6927c478bd9Sstevel@tonic-gate "providers is available "
6937c478bd9Sstevel@tonic-gate "in the %s zone only"), "global");
6947c478bd9Sstevel@tonic-gate rc = FAILURE;
6957c478bd9Sstevel@tonic-gate }
6967c478bd9Sstevel@tonic-gate
6977c478bd9Sstevel@tonic-gate break;
6987c478bd9Sstevel@tonic-gate default: /* should not come here */
6997c478bd9Sstevel@tonic-gate rc = FAILURE;
7007c478bd9Sstevel@tonic-gate break;
7017c478bd9Sstevel@tonic-gate }
7027c478bd9Sstevel@tonic-gate } else {
7037c478bd9Sstevel@tonic-gate /* error message */
7047c478bd9Sstevel@tonic-gate usage();
7057c478bd9Sstevel@tonic-gate rc = ERROR_USAGE;
7067c478bd9Sstevel@tonic-gate }
7077c478bd9Sstevel@tonic-gate }
7087c478bd9Sstevel@tonic-gate
7097c478bd9Sstevel@tonic-gate out:
7107c478bd9Sstevel@tonic-gate if (prov != NULL)
7117c478bd9Sstevel@tonic-gate free(prov);
7127c478bd9Sstevel@tonic-gate
7137c478bd9Sstevel@tonic-gate if (mecharglist != NULL)
7147c478bd9Sstevel@tonic-gate free_mechlist(mecharglist);
7157c478bd9Sstevel@tonic-gate return (rc);
7167c478bd9Sstevel@tonic-gate }
7177c478bd9Sstevel@tonic-gate
7187c478bd9Sstevel@tonic-gate
7197c478bd9Sstevel@tonic-gate /*
7201b22764fSDaniel OpenSolaris Anderson * The top level function for the "cryptoadm disable" subcommand.
7217c478bd9Sstevel@tonic-gate */
7227c478bd9Sstevel@tonic-gate static int
do_disable(int argc,char ** argv)7237c478bd9Sstevel@tonic-gate do_disable(int argc, char **argv)
7247c478bd9Sstevel@tonic-gate {
7257c478bd9Sstevel@tonic-gate cryptoadm_provider_t *prov = NULL;
7261b22764fSDaniel OpenSolaris Anderson int rc = SUCCESS;
7271b22764fSDaniel OpenSolaris Anderson boolean_t auto_key_migrate_flag = B_FALSE;
7287c478bd9Sstevel@tonic-gate
7297c478bd9Sstevel@tonic-gate if ((argc < 3) || (argc > 5)) {
7307c478bd9Sstevel@tonic-gate usage();
7317c478bd9Sstevel@tonic-gate return (ERROR_USAGE);
7327c478bd9Sstevel@tonic-gate }
7337c478bd9Sstevel@tonic-gate
7347c478bd9Sstevel@tonic-gate prov = get_provider(argc, argv);
7357c478bd9Sstevel@tonic-gate if (prov == NULL) {
7367c478bd9Sstevel@tonic-gate usage();
7377c478bd9Sstevel@tonic-gate return (ERROR_USAGE);
7387c478bd9Sstevel@tonic-gate }
7397c478bd9Sstevel@tonic-gate if (prov->cp_type == PROV_BADNAME) {
7407c478bd9Sstevel@tonic-gate return (FAILURE);
7417c478bd9Sstevel@tonic-gate }
7427c478bd9Sstevel@tonic-gate
7437c478bd9Sstevel@tonic-gate if ((rc = process_feature_operands(argc, argv)) != SUCCESS) {
7447c478bd9Sstevel@tonic-gate goto out;
7457c478bd9Sstevel@tonic-gate }
7467c478bd9Sstevel@tonic-gate
7477c478bd9Sstevel@tonic-gate /*
7487c478bd9Sstevel@tonic-gate * If allflag or rndflag has already been set there is no reason to
7497c478bd9Sstevel@tonic-gate * process mech=
7507c478bd9Sstevel@tonic-gate */
7517c478bd9Sstevel@tonic-gate if (prov->cp_type == METASLOT) {
7527c478bd9Sstevel@tonic-gate if ((argc > 3) &&
7537c478bd9Sstevel@tonic-gate (rc = process_metaslot_operands(argc, argv,
7547c478bd9Sstevel@tonic-gate NULL, NULL, NULL, &auto_key_migrate_flag)) != SUCCESS) {
7557c478bd9Sstevel@tonic-gate usage();
7567c478bd9Sstevel@tonic-gate return (rc);
7577c478bd9Sstevel@tonic-gate }
7587c478bd9Sstevel@tonic-gate } else if (!allflag && !rndflag &&
7591b22764fSDaniel OpenSolaris Anderson (rc = process_mech_operands(argc, argv, B_FALSE)) != SUCCESS) {
7607c478bd9Sstevel@tonic-gate return (rc);
7617c478bd9Sstevel@tonic-gate }
7627c478bd9Sstevel@tonic-gate
7637c478bd9Sstevel@tonic-gate switch (prov->cp_type) {
7647c478bd9Sstevel@tonic-gate case METASLOT:
7657c478bd9Sstevel@tonic-gate rc = disable_metaslot(mecharglist, allflag,
7667c478bd9Sstevel@tonic-gate auto_key_migrate_flag);
7677c478bd9Sstevel@tonic-gate break;
7687c478bd9Sstevel@tonic-gate case PROV_UEF_LIB:
7697c478bd9Sstevel@tonic-gate rc = disable_uef_lib(prov->cp_name, rndflag, allflag,
7707c478bd9Sstevel@tonic-gate mecharglist);
7717c478bd9Sstevel@tonic-gate break;
7727c478bd9Sstevel@tonic-gate case PROV_KEF_SOFT:
7737c478bd9Sstevel@tonic-gate if (rndflag && !allflag) {
7747c478bd9Sstevel@tonic-gate if ((mecharglist = create_mech(RANDOM)) == NULL) {
7757c478bd9Sstevel@tonic-gate rc = FAILURE;
7767c478bd9Sstevel@tonic-gate break;
7777c478bd9Sstevel@tonic-gate }
7787c478bd9Sstevel@tonic-gate }
7797c478bd9Sstevel@tonic-gate if (getzoneid() == GLOBAL_ZONEID) {
7807c478bd9Sstevel@tonic-gate rc = disable_kef_software(prov->cp_name, rndflag,
7817c478bd9Sstevel@tonic-gate allflag, mecharglist);
7827c478bd9Sstevel@tonic-gate } else {
7837c478bd9Sstevel@tonic-gate /*
7840a85b835SDaniel Anderson * TRANSLATION_NOTE
7857c478bd9Sstevel@tonic-gate * "disable" could be either a literal keyword
7867c478bd9Sstevel@tonic-gate * and hence not to be translated, or a verb and
7877c478bd9Sstevel@tonic-gate * translatable. A choice was made to view it as
7887c478bd9Sstevel@tonic-gate * a literal keyword. "global" is keyword and not
7897c478bd9Sstevel@tonic-gate * to be translated.
7907c478bd9Sstevel@tonic-gate */
7917c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("%1$s for kernel "
7927c478bd9Sstevel@tonic-gate "providers is supported in the %2$s zone only"),
7937c478bd9Sstevel@tonic-gate "disable", "global");
7947c478bd9Sstevel@tonic-gate rc = FAILURE;
7957c478bd9Sstevel@tonic-gate }
7967c478bd9Sstevel@tonic-gate break;
7977c478bd9Sstevel@tonic-gate case PROV_KEF_HARD:
7987c478bd9Sstevel@tonic-gate if (rndflag && !allflag) {
7997c478bd9Sstevel@tonic-gate if ((mecharglist = create_mech(RANDOM)) == NULL) {
8007c478bd9Sstevel@tonic-gate rc = FAILURE;
8017c478bd9Sstevel@tonic-gate break;
8027c478bd9Sstevel@tonic-gate }
8037c478bd9Sstevel@tonic-gate }
8047c478bd9Sstevel@tonic-gate if (getzoneid() == GLOBAL_ZONEID) {
8057c478bd9Sstevel@tonic-gate rc = disable_kef_hardware(prov->cp_name, rndflag,
8067c478bd9Sstevel@tonic-gate allflag, mecharglist);
8077c478bd9Sstevel@tonic-gate } else {
8087c478bd9Sstevel@tonic-gate /*
8090a85b835SDaniel Anderson * TRANSLATION_NOTE
8107c478bd9Sstevel@tonic-gate * "disable" could be either a literal keyword
8117c478bd9Sstevel@tonic-gate * and hence not to be translated, or a verb and
8127c478bd9Sstevel@tonic-gate * translatable. A choice was made to view it as
8137c478bd9Sstevel@tonic-gate * a literal keyword. "global" is keyword and not
8147c478bd9Sstevel@tonic-gate * to be translated.
8157c478bd9Sstevel@tonic-gate */
8167c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("%1$s for kernel "
8177c478bd9Sstevel@tonic-gate "providers is supported in the %2$s zone only"),
8187c478bd9Sstevel@tonic-gate "disable", "global");
8197c478bd9Sstevel@tonic-gate rc = FAILURE;
8207c478bd9Sstevel@tonic-gate }
8217c478bd9Sstevel@tonic-gate break;
8227c478bd9Sstevel@tonic-gate default: /* should not come here */
8237c478bd9Sstevel@tonic-gate rc = FAILURE;
8247c478bd9Sstevel@tonic-gate break;
8257c478bd9Sstevel@tonic-gate }
8267c478bd9Sstevel@tonic-gate
8277c478bd9Sstevel@tonic-gate out:
8287c478bd9Sstevel@tonic-gate free(prov);
8297c478bd9Sstevel@tonic-gate if (mecharglist != NULL) {
8307c478bd9Sstevel@tonic-gate free_mechlist(mecharglist);
8317c478bd9Sstevel@tonic-gate }
8327c478bd9Sstevel@tonic-gate return (rc);
8337c478bd9Sstevel@tonic-gate }
8347c478bd9Sstevel@tonic-gate
8357c478bd9Sstevel@tonic-gate
8367c478bd9Sstevel@tonic-gate /*
8371b22764fSDaniel OpenSolaris Anderson * The top level function for the "cryptoadm enable" subcommand.
8387c478bd9Sstevel@tonic-gate */
8397c478bd9Sstevel@tonic-gate static int
do_enable(int argc,char ** argv)8407c478bd9Sstevel@tonic-gate do_enable(int argc, char **argv)
8417c478bd9Sstevel@tonic-gate {
8421b22764fSDaniel OpenSolaris Anderson cryptoadm_provider_t *prov = NULL;
8431b22764fSDaniel OpenSolaris Anderson int rc = SUCCESS;
8441b22764fSDaniel OpenSolaris Anderson char *alt_token = NULL, *alt_slot = NULL;
8451b22764fSDaniel OpenSolaris Anderson boolean_t use_default = B_FALSE;
8461b22764fSDaniel OpenSolaris Anderson boolean_t auto_key_migrate_flag = B_FALSE;
8477c478bd9Sstevel@tonic-gate
8487c478bd9Sstevel@tonic-gate if ((argc < 3) || (argc > 6)) {
8497c478bd9Sstevel@tonic-gate usage();
8507c478bd9Sstevel@tonic-gate return (ERROR_USAGE);
8517c478bd9Sstevel@tonic-gate }
8527c478bd9Sstevel@tonic-gate
8537c478bd9Sstevel@tonic-gate prov = get_provider(argc, argv);
8547c478bd9Sstevel@tonic-gate if (prov == NULL) {
8557c478bd9Sstevel@tonic-gate usage();
8567c478bd9Sstevel@tonic-gate return (ERROR_USAGE);
8577c478bd9Sstevel@tonic-gate }
8587c478bd9Sstevel@tonic-gate if ((prov->cp_type != METASLOT) && (argc != 4)) {
8597c478bd9Sstevel@tonic-gate usage();
8607c478bd9Sstevel@tonic-gate return (ERROR_USAGE);
8617c478bd9Sstevel@tonic-gate }
8627c478bd9Sstevel@tonic-gate if (prov->cp_type == PROV_BADNAME) {
8637c478bd9Sstevel@tonic-gate rc = FAILURE;
8647c478bd9Sstevel@tonic-gate goto out;
8657c478bd9Sstevel@tonic-gate }
8667c478bd9Sstevel@tonic-gate
8677c478bd9Sstevel@tonic-gate
8687c478bd9Sstevel@tonic-gate if (prov->cp_type == METASLOT) {
8697c478bd9Sstevel@tonic-gate if ((rc = process_metaslot_operands(argc, argv, &alt_token,
8707c478bd9Sstevel@tonic-gate &alt_slot, &use_default, &auto_key_migrate_flag))
8717c478bd9Sstevel@tonic-gate != SUCCESS) {
8727c478bd9Sstevel@tonic-gate usage();
8737c478bd9Sstevel@tonic-gate goto out;
8747c478bd9Sstevel@tonic-gate }
8757c478bd9Sstevel@tonic-gate if ((alt_slot || alt_token) && use_default) {
8767c478bd9Sstevel@tonic-gate usage();
8777c478bd9Sstevel@tonic-gate rc = FAILURE;
8787c478bd9Sstevel@tonic-gate goto out;
8797c478bd9Sstevel@tonic-gate }
8807c478bd9Sstevel@tonic-gate } else {
8817c478bd9Sstevel@tonic-gate if ((rc = process_feature_operands(argc, argv)) != SUCCESS) {
8827c478bd9Sstevel@tonic-gate goto out;
8837c478bd9Sstevel@tonic-gate }
8847c478bd9Sstevel@tonic-gate
8857c478bd9Sstevel@tonic-gate /*
8867c478bd9Sstevel@tonic-gate * If allflag or rndflag has already been set there is
8877c478bd9Sstevel@tonic-gate * no reason to process mech=
8887c478bd9Sstevel@tonic-gate */
8897c478bd9Sstevel@tonic-gate if (!allflag && !rndflag &&
8907c478bd9Sstevel@tonic-gate (rc = process_mech_operands(argc, argv, B_FALSE))
8917c478bd9Sstevel@tonic-gate != SUCCESS) {
8927c478bd9Sstevel@tonic-gate goto out;
8937c478bd9Sstevel@tonic-gate }
8947c478bd9Sstevel@tonic-gate }
8957c478bd9Sstevel@tonic-gate
8967c478bd9Sstevel@tonic-gate switch (prov->cp_type) {
8977c478bd9Sstevel@tonic-gate case METASLOT:
8987c478bd9Sstevel@tonic-gate rc = enable_metaslot(alt_token, alt_slot, use_default,
8997c478bd9Sstevel@tonic-gate mecharglist, allflag, auto_key_migrate_flag);
9007c478bd9Sstevel@tonic-gate break;
9017c478bd9Sstevel@tonic-gate case PROV_UEF_LIB:
9027c478bd9Sstevel@tonic-gate rc = enable_uef_lib(prov->cp_name, rndflag, allflag,
9037c478bd9Sstevel@tonic-gate mecharglist);
9047c478bd9Sstevel@tonic-gate break;
9057c478bd9Sstevel@tonic-gate case PROV_KEF_SOFT:
9067c478bd9Sstevel@tonic-gate case PROV_KEF_HARD:
9077c478bd9Sstevel@tonic-gate if (rndflag && !allflag) {
9087c478bd9Sstevel@tonic-gate if ((mecharglist = create_mech(RANDOM)) == NULL) {
9097c478bd9Sstevel@tonic-gate rc = FAILURE;
9107c478bd9Sstevel@tonic-gate break;
9117c478bd9Sstevel@tonic-gate }
9127c478bd9Sstevel@tonic-gate }
9137c478bd9Sstevel@tonic-gate if (getzoneid() == GLOBAL_ZONEID) {
9147c478bd9Sstevel@tonic-gate rc = enable_kef(prov->cp_name, rndflag, allflag,
9157c478bd9Sstevel@tonic-gate mecharglist);
9167c478bd9Sstevel@tonic-gate } else {
9177c478bd9Sstevel@tonic-gate /*
9180a85b835SDaniel Anderson * TRANSLATION_NOTE
9197c478bd9Sstevel@tonic-gate * "enable" could be either a literal keyword
9207c478bd9Sstevel@tonic-gate * and hence not to be translated, or a verb and
9217c478bd9Sstevel@tonic-gate * translatable. A choice was made to view it as
9227c478bd9Sstevel@tonic-gate * a literal keyword. "global" is keyword and not
9237c478bd9Sstevel@tonic-gate * to be translated.
9247c478bd9Sstevel@tonic-gate */
9257c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("%1$s for kernel "
9267c478bd9Sstevel@tonic-gate "providers is supported in the %2$s zone only"),
9277c478bd9Sstevel@tonic-gate "enable", "global");
9287c478bd9Sstevel@tonic-gate rc = FAILURE;
9297c478bd9Sstevel@tonic-gate }
9307c478bd9Sstevel@tonic-gate break;
9317c478bd9Sstevel@tonic-gate default: /* should not come here */
9327c478bd9Sstevel@tonic-gate rc = FAILURE;
9337c478bd9Sstevel@tonic-gate break;
9347c478bd9Sstevel@tonic-gate }
9357c478bd9Sstevel@tonic-gate out:
9367c478bd9Sstevel@tonic-gate free(prov);
9377c478bd9Sstevel@tonic-gate if (mecharglist != NULL) {
9387c478bd9Sstevel@tonic-gate free_mechlist(mecharglist);
9397c478bd9Sstevel@tonic-gate }
9407c478bd9Sstevel@tonic-gate if (alt_token != NULL) {
9417c478bd9Sstevel@tonic-gate free(alt_token);
9427c478bd9Sstevel@tonic-gate }
9437c478bd9Sstevel@tonic-gate if (alt_slot != NULL) {
9447c478bd9Sstevel@tonic-gate free(alt_slot);
9457c478bd9Sstevel@tonic-gate }
9467c478bd9Sstevel@tonic-gate return (rc);
9477c478bd9Sstevel@tonic-gate }
9487c478bd9Sstevel@tonic-gate
9497c478bd9Sstevel@tonic-gate
9507c478bd9Sstevel@tonic-gate
9517c478bd9Sstevel@tonic-gate /*
9521b22764fSDaniel OpenSolaris Anderson * The top level function for the "cryptoadm install" subcommand.
9537c478bd9Sstevel@tonic-gate */
9547c478bd9Sstevel@tonic-gate static int
do_install(int argc,char ** argv)9557c478bd9Sstevel@tonic-gate do_install(int argc, char **argv)
9567c478bd9Sstevel@tonic-gate {
9571b22764fSDaniel OpenSolaris Anderson cryptoadm_provider_t *prov = NULL;
9587c478bd9Sstevel@tonic-gate int rc;
9597c478bd9Sstevel@tonic-gate
9607c478bd9Sstevel@tonic-gate if (argc < 3) {
9617c478bd9Sstevel@tonic-gate usage();
9627c478bd9Sstevel@tonic-gate return (ERROR_USAGE);
9637c478bd9Sstevel@tonic-gate }
9647c478bd9Sstevel@tonic-gate
9657c478bd9Sstevel@tonic-gate prov = get_provider(argc, argv);
9667c478bd9Sstevel@tonic-gate if (prov == NULL ||
9677c478bd9Sstevel@tonic-gate prov->cp_type == PROV_BADNAME || prov->cp_type == PROV_KEF_HARD) {
9687c478bd9Sstevel@tonic-gate /*
9690a85b835SDaniel Anderson * TRANSLATION_NOTE
9707c478bd9Sstevel@tonic-gate * "install" could be either a literal keyword and hence
9717c478bd9Sstevel@tonic-gate * not to be translated, or a verb and translatable. A
9727c478bd9Sstevel@tonic-gate * choice was made to view it as a literal keyword.
9737c478bd9Sstevel@tonic-gate */
9747c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR,
9757c478bd9Sstevel@tonic-gate gettext("bad provider name for %s."), "install");
9767c478bd9Sstevel@tonic-gate rc = FAILURE;
9777c478bd9Sstevel@tonic-gate goto out;
9787c478bd9Sstevel@tonic-gate }
9797c478bd9Sstevel@tonic-gate
9807c478bd9Sstevel@tonic-gate if (prov->cp_type == PROV_UEF_LIB) {
9817c478bd9Sstevel@tonic-gate rc = install_uef_lib(prov->cp_name);
9827c478bd9Sstevel@tonic-gate goto out;
9837c478bd9Sstevel@tonic-gate }
9847c478bd9Sstevel@tonic-gate
9857c478bd9Sstevel@tonic-gate /* It is the PROV_KEF_SOFT type now */
9867c478bd9Sstevel@tonic-gate
9877c478bd9Sstevel@tonic-gate /* check if there are mechanism operands */
9887c478bd9Sstevel@tonic-gate if (argc < 4) {
9897c478bd9Sstevel@tonic-gate /*
9900a85b835SDaniel Anderson * TRANSLATION_NOTE
9917c478bd9Sstevel@tonic-gate * "mechanism" could be either a literal keyword and hence
9927c478bd9Sstevel@tonic-gate * not to be translated, or a descriptive word and
9937c478bd9Sstevel@tonic-gate * translatable. A choice was made to view it as a literal
9947c478bd9Sstevel@tonic-gate * keyword.
9957c478bd9Sstevel@tonic-gate */
9967c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR,
9977c478bd9Sstevel@tonic-gate gettext("need %s operands for installing a"
9987c478bd9Sstevel@tonic-gate " kernel software provider."), "mechanism");
9997c478bd9Sstevel@tonic-gate rc = ERROR_USAGE;
10007c478bd9Sstevel@tonic-gate goto out;
10017c478bd9Sstevel@tonic-gate }
10027c478bd9Sstevel@tonic-gate
10037c478bd9Sstevel@tonic-gate if ((rc = process_mech_operands(argc, argv, B_FALSE)) != SUCCESS) {
10047c478bd9Sstevel@tonic-gate goto out;
10057c478bd9Sstevel@tonic-gate }
10067c478bd9Sstevel@tonic-gate
10077c478bd9Sstevel@tonic-gate if (allflag == B_TRUE) {
10087c478bd9Sstevel@tonic-gate /*
10090a85b835SDaniel Anderson * TRANSLATION_NOTE
10107c478bd9Sstevel@tonic-gate * "all", "mechanism", and "install" are all keywords and
10117c478bd9Sstevel@tonic-gate * not to be translated.
10127c478bd9Sstevel@tonic-gate */
10137c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR,
10147c478bd9Sstevel@tonic-gate gettext("can not use the %1$s keyword for %2$s "
10157c478bd9Sstevel@tonic-gate "in the %3$s subcommand."), "all", "mechanism", "install");
10167c478bd9Sstevel@tonic-gate rc = ERROR_USAGE;
10177c478bd9Sstevel@tonic-gate goto out;
10187c478bd9Sstevel@tonic-gate }
10197c478bd9Sstevel@tonic-gate
10207c478bd9Sstevel@tonic-gate if (getzoneid() == GLOBAL_ZONEID) {
10217c478bd9Sstevel@tonic-gate rc = install_kef(prov->cp_name, mecharglist);
10227c478bd9Sstevel@tonic-gate } else {
10237c478bd9Sstevel@tonic-gate /*
10240a85b835SDaniel Anderson * TRANSLATION_NOTE
10257c478bd9Sstevel@tonic-gate * "install" could be either a literal keyword and hence
10267c478bd9Sstevel@tonic-gate * not to be translated, or a verb and translatable. A
10277c478bd9Sstevel@tonic-gate * choice was made to view it as a literal keyword.
10287c478bd9Sstevel@tonic-gate * "global" is keyword and not to be translated.
10297c478bd9Sstevel@tonic-gate */
10307c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("%1$s for kernel providers "
10317c478bd9Sstevel@tonic-gate "is supported in the %2$s zone only"), "install", "global");
10327c478bd9Sstevel@tonic-gate rc = FAILURE;
10337c478bd9Sstevel@tonic-gate }
10347c478bd9Sstevel@tonic-gate out:
10357c478bd9Sstevel@tonic-gate free(prov);
10367c478bd9Sstevel@tonic-gate return (rc);
10377c478bd9Sstevel@tonic-gate }
10387c478bd9Sstevel@tonic-gate
10397c478bd9Sstevel@tonic-gate
10407c478bd9Sstevel@tonic-gate
10417c478bd9Sstevel@tonic-gate /*
10421b22764fSDaniel OpenSolaris Anderson * The top level function for the "cryptoadm uninstall" subcommand.
10437c478bd9Sstevel@tonic-gate */
10447c478bd9Sstevel@tonic-gate static int
do_uninstall(int argc,char ** argv)10457c478bd9Sstevel@tonic-gate do_uninstall(int argc, char **argv)
10467c478bd9Sstevel@tonic-gate {
10471b22764fSDaniel OpenSolaris Anderson cryptoadm_provider_t *prov = NULL;
10487c478bd9Sstevel@tonic-gate int rc = SUCCESS;
10497c478bd9Sstevel@tonic-gate
10507c478bd9Sstevel@tonic-gate if (argc != 3) {
10517c478bd9Sstevel@tonic-gate usage();
10527c478bd9Sstevel@tonic-gate return (ERROR_USAGE);
10537c478bd9Sstevel@tonic-gate }
10547c478bd9Sstevel@tonic-gate
10557c478bd9Sstevel@tonic-gate prov = get_provider(argc, argv);
10567c478bd9Sstevel@tonic-gate if (prov == NULL ||
10577c478bd9Sstevel@tonic-gate prov->cp_type == PROV_BADNAME || prov->cp_type == PROV_KEF_HARD) {
10587c478bd9Sstevel@tonic-gate /*
10590a85b835SDaniel Anderson * TRANSLATION_NOTE
10607c478bd9Sstevel@tonic-gate * "uninstall" could be either a literal keyword and hence
10617c478bd9Sstevel@tonic-gate * not to be translated, or a verb and translatable. A
10627c478bd9Sstevel@tonic-gate * choice was made to view it as a literal keyword.
10637c478bd9Sstevel@tonic-gate */
10647c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR,
10657c478bd9Sstevel@tonic-gate gettext("bad provider name for %s."), "uninstall");
10667c478bd9Sstevel@tonic-gate free(prov);
10677c478bd9Sstevel@tonic-gate return (FAILURE);
10687c478bd9Sstevel@tonic-gate }
10697c478bd9Sstevel@tonic-gate
10707c478bd9Sstevel@tonic-gate if (prov->cp_type == PROV_UEF_LIB) {
10717c478bd9Sstevel@tonic-gate rc = uninstall_uef_lib(prov->cp_name);
10721b22764fSDaniel OpenSolaris Anderson
10737c478bd9Sstevel@tonic-gate } else if (prov->cp_type == PROV_KEF_SOFT) {
10747c478bd9Sstevel@tonic-gate if (getzoneid() == GLOBAL_ZONEID) {
10751b22764fSDaniel OpenSolaris Anderson /* unload and remove from kcf.conf */
10767c478bd9Sstevel@tonic-gate rc = uninstall_kef(prov->cp_name);
10777c478bd9Sstevel@tonic-gate } else {
10787c478bd9Sstevel@tonic-gate /*
10790a85b835SDaniel Anderson * TRANSLATION_NOTE
10807c478bd9Sstevel@tonic-gate * "uninstall" could be either a literal keyword and
10817c478bd9Sstevel@tonic-gate * hence not to be translated, or a verb and
10827c478bd9Sstevel@tonic-gate * translatable. A choice was made to view it as a
10837c478bd9Sstevel@tonic-gate * literal keyword. "global" is keyword and not to
10847c478bd9Sstevel@tonic-gate * be translated.
10857c478bd9Sstevel@tonic-gate */
10867c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("%1$s for kernel "
10877c478bd9Sstevel@tonic-gate "providers is supported in the %2$s zone only"),
10887c478bd9Sstevel@tonic-gate "uninstall", "global");
10897c478bd9Sstevel@tonic-gate rc = FAILURE;
10907c478bd9Sstevel@tonic-gate }
10917c478bd9Sstevel@tonic-gate }
10927c478bd9Sstevel@tonic-gate
10937c478bd9Sstevel@tonic-gate free(prov);
10947c478bd9Sstevel@tonic-gate return (rc);
10957c478bd9Sstevel@tonic-gate }
10967c478bd9Sstevel@tonic-gate
10977c478bd9Sstevel@tonic-gate
10987c478bd9Sstevel@tonic-gate /*
10991b22764fSDaniel OpenSolaris Anderson * The top level function for the "cryptoadm unload" subcommand.
11007c478bd9Sstevel@tonic-gate */
11017c478bd9Sstevel@tonic-gate static int
do_unload(int argc,char ** argv)11027c478bd9Sstevel@tonic-gate do_unload(int argc, char **argv)
11037c478bd9Sstevel@tonic-gate {
11041b22764fSDaniel OpenSolaris Anderson cryptoadm_provider_t *prov = NULL;
11051b22764fSDaniel OpenSolaris Anderson entry_t *pent = NULL;
11061b22764fSDaniel OpenSolaris Anderson boolean_t in_kernel = B_FALSE;
11071b22764fSDaniel OpenSolaris Anderson int rc = SUCCESS;
11081b22764fSDaniel OpenSolaris Anderson char *provname = NULL;
11097c478bd9Sstevel@tonic-gate
11107c478bd9Sstevel@tonic-gate if (argc != 3) {
11117c478bd9Sstevel@tonic-gate usage();
11127c478bd9Sstevel@tonic-gate return (ERROR_USAGE);
11137c478bd9Sstevel@tonic-gate }
11147c478bd9Sstevel@tonic-gate
11157c478bd9Sstevel@tonic-gate /* check if it is a kernel software provider */
11167c478bd9Sstevel@tonic-gate prov = get_provider(argc, argv);
11177c478bd9Sstevel@tonic-gate if (prov == NULL) {
11187c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR,
11197c478bd9Sstevel@tonic-gate gettext("unable to determine provider name."));
11207c478bd9Sstevel@tonic-gate goto out;
11217c478bd9Sstevel@tonic-gate }
11221b22764fSDaniel OpenSolaris Anderson provname = prov->cp_name;
11237c478bd9Sstevel@tonic-gate if (prov->cp_type != PROV_KEF_SOFT) {
11247c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR,
11257c478bd9Sstevel@tonic-gate gettext("%s is not a valid kernel software provider."),
11261b22764fSDaniel OpenSolaris Anderson provname);
11277c478bd9Sstevel@tonic-gate rc = FAILURE;
11287c478bd9Sstevel@tonic-gate goto out;
11297c478bd9Sstevel@tonic-gate }
11307c478bd9Sstevel@tonic-gate
11317c478bd9Sstevel@tonic-gate if (getzoneid() != GLOBAL_ZONEID) {
11327c478bd9Sstevel@tonic-gate /*
11330a85b835SDaniel Anderson * TRANSLATION_NOTE
11347c478bd9Sstevel@tonic-gate * "unload" could be either a literal keyword and hence
11357c478bd9Sstevel@tonic-gate * not to be translated, or a verb and translatable.
11367c478bd9Sstevel@tonic-gate * A choice was made to view it as a literal keyword.
11377c478bd9Sstevel@tonic-gate * "global" is keyword and not to be translated.
11387c478bd9Sstevel@tonic-gate */
11397c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("%1$s for kernel providers "
11407c478bd9Sstevel@tonic-gate "is supported in the %2$s zone only"), "unload", "global");
11417c478bd9Sstevel@tonic-gate rc = FAILURE;
11427c478bd9Sstevel@tonic-gate goto out;
11437c478bd9Sstevel@tonic-gate }
11447c478bd9Sstevel@tonic-gate
11451b22764fSDaniel OpenSolaris Anderson if (check_kernel_for_soft(provname, NULL, &in_kernel) == FAILURE) {
11461b22764fSDaniel OpenSolaris Anderson cryptodebug("internal error");
11471b22764fSDaniel OpenSolaris Anderson rc = FAILURE;
11481b22764fSDaniel OpenSolaris Anderson goto out;
11491b22764fSDaniel OpenSolaris Anderson } else if (in_kernel == B_FALSE) {
11507c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR,
11511b22764fSDaniel OpenSolaris Anderson gettext("provider %s is not loaded or does not exist."),
11521b22764fSDaniel OpenSolaris Anderson provname);
11537c478bd9Sstevel@tonic-gate rc = FAILURE;
11547c478bd9Sstevel@tonic-gate goto out;
11557c478bd9Sstevel@tonic-gate }
11561b22764fSDaniel OpenSolaris Anderson
11571b22764fSDaniel OpenSolaris Anderson /* Get kcf.conf entry. If none, build a new entry */
1158d616ad8eSHai-May Chao if ((pent = getent_kef(provname, NULL, NULL)) == NULL) {
11591b22764fSDaniel OpenSolaris Anderson if ((pent = create_entry(provname)) == NULL) {
11601b22764fSDaniel OpenSolaris Anderson cryptoerror(LOG_STDERR, gettext("out of memory."));
11611b22764fSDaniel OpenSolaris Anderson rc = FAILURE;
11621b22764fSDaniel OpenSolaris Anderson goto out;
11631b22764fSDaniel OpenSolaris Anderson }
11641b22764fSDaniel OpenSolaris Anderson }
11657c478bd9Sstevel@tonic-gate
11667c478bd9Sstevel@tonic-gate /* If it is unloaded already, return */
11671b22764fSDaniel OpenSolaris Anderson if (!pent->load) { /* unloaded already */
11687c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR,
11691b22764fSDaniel OpenSolaris Anderson gettext("failed to unload %s."), provname);
11707c478bd9Sstevel@tonic-gate rc = FAILURE;
11717c478bd9Sstevel@tonic-gate goto out;
11721b22764fSDaniel OpenSolaris Anderson } else if (unload_kef_soft(provname) != FAILURE) {
11731b22764fSDaniel OpenSolaris Anderson /* Mark as unloaded in kcf.conf */
11741b22764fSDaniel OpenSolaris Anderson pent->load = B_FALSE;
11751b22764fSDaniel OpenSolaris Anderson rc = update_kcfconf(pent, MODIFY_MODE);
11761b22764fSDaniel OpenSolaris Anderson } else {
11777c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR,
11781b22764fSDaniel OpenSolaris Anderson gettext("failed to unload %s."), provname);
11797c478bd9Sstevel@tonic-gate rc = FAILURE;
11807c478bd9Sstevel@tonic-gate }
11817c478bd9Sstevel@tonic-gate out:
11827c478bd9Sstevel@tonic-gate free(prov);
11831b22764fSDaniel OpenSolaris Anderson free_entry(pent);
11847c478bd9Sstevel@tonic-gate return (rc);
11857c478bd9Sstevel@tonic-gate }
11867c478bd9Sstevel@tonic-gate
11877c478bd9Sstevel@tonic-gate
11887c478bd9Sstevel@tonic-gate
11897c478bd9Sstevel@tonic-gate /*
11901b22764fSDaniel OpenSolaris Anderson * The top level function for the "cryptoadm refresh" subcommand.
11917c478bd9Sstevel@tonic-gate */
11927c478bd9Sstevel@tonic-gate static int
do_refresh(int argc)11937c478bd9Sstevel@tonic-gate do_refresh(int argc)
11947c478bd9Sstevel@tonic-gate {
11957c478bd9Sstevel@tonic-gate if (argc != 2) {
11967c478bd9Sstevel@tonic-gate usage();
11977c478bd9Sstevel@tonic-gate return (ERROR_USAGE);
11987c478bd9Sstevel@tonic-gate }
11997c478bd9Sstevel@tonic-gate
12001b22764fSDaniel OpenSolaris Anderson if (getzoneid() == GLOBAL_ZONEID) {
12011b22764fSDaniel OpenSolaris Anderson return (refresh());
12021b22764fSDaniel OpenSolaris Anderson } else { /* non-global zone */
12031b22764fSDaniel OpenSolaris Anderson /*
12041b22764fSDaniel OpenSolaris Anderson * Note: in non-global zone, this must silently return SUCCESS
12051b22764fSDaniel OpenSolaris Anderson * due to integration with SMF, for "svcadm refresh cryptosvc"
12061b22764fSDaniel OpenSolaris Anderson */
12077c478bd9Sstevel@tonic-gate return (SUCCESS);
12081b22764fSDaniel OpenSolaris Anderson }
12097c478bd9Sstevel@tonic-gate }
12107c478bd9Sstevel@tonic-gate
12117c478bd9Sstevel@tonic-gate
12127c478bd9Sstevel@tonic-gate /*
12131b22764fSDaniel OpenSolaris Anderson * The top level function for the "cryptoadm start" subcommand.
12146ea3c060SGarrett D'Amore * This used to start up kcfd, but now all it does is load up the
12156ea3c060SGarrett D'Amore * initial providers.
12167c478bd9Sstevel@tonic-gate */
12177c478bd9Sstevel@tonic-gate static int
do_start(int argc)12187c478bd9Sstevel@tonic-gate do_start(int argc)
12197c478bd9Sstevel@tonic-gate {
12207c478bd9Sstevel@tonic-gate if (argc != 2) {
12217c478bd9Sstevel@tonic-gate usage();
12227c478bd9Sstevel@tonic-gate return (ERROR_USAGE);
12237c478bd9Sstevel@tonic-gate }
12247c478bd9Sstevel@tonic-gate
12256ea3c060SGarrett D'Amore return (do_refresh(argc));
12267c478bd9Sstevel@tonic-gate }
12277c478bd9Sstevel@tonic-gate
12287c478bd9Sstevel@tonic-gate /*
12291b22764fSDaniel OpenSolaris Anderson * The top level function for the "cryptoadm stop" subcommand.
12306ea3c060SGarrett D'Amore * This no longer does anything useful, but we leave it here
12316ea3c060SGarrett D'Amore * for compatibility.
12327c478bd9Sstevel@tonic-gate */
12337c478bd9Sstevel@tonic-gate static int
do_stop(int argc)12347c478bd9Sstevel@tonic-gate do_stop(int argc)
12357c478bd9Sstevel@tonic-gate {
12367c478bd9Sstevel@tonic-gate if (argc != 2) {
12377c478bd9Sstevel@tonic-gate usage();
12387c478bd9Sstevel@tonic-gate return (ERROR_USAGE);
12397c478bd9Sstevel@tonic-gate }
12407c478bd9Sstevel@tonic-gate
12416ea3c060SGarrett D'Amore return (SUCCESS);
12427c478bd9Sstevel@tonic-gate }
12437c478bd9Sstevel@tonic-gate
12447c478bd9Sstevel@tonic-gate
12457c478bd9Sstevel@tonic-gate
12467c478bd9Sstevel@tonic-gate /*
12471b22764fSDaniel OpenSolaris Anderson * Print a list all the the providers.
12481b22764fSDaniel OpenSolaris Anderson * Called for "cryptoadm list" or "cryptoadm list -v" (no -m or -p).
12497c478bd9Sstevel@tonic-gate */
12507c478bd9Sstevel@tonic-gate static int
list_simple_for_all(boolean_t verbose)12517c478bd9Sstevel@tonic-gate list_simple_for_all(boolean_t verbose)
12527c478bd9Sstevel@tonic-gate {
12531b22764fSDaniel OpenSolaris Anderson uentrylist_t *pliblist = NULL;
12541b22764fSDaniel OpenSolaris Anderson uentrylist_t *plibptr = NULL;
12551b22764fSDaniel OpenSolaris Anderson entry_t *pent = NULL;
12567c478bd9Sstevel@tonic-gate crypto_get_dev_list_t *pdevlist_kernel = NULL;
12571b22764fSDaniel OpenSolaris Anderson int rc = SUCCESS;
12581b22764fSDaniel OpenSolaris Anderson int i;
12597c478bd9Sstevel@tonic-gate
12607c478bd9Sstevel@tonic-gate /* get user-level providers */
12617c478bd9Sstevel@tonic-gate (void) printf(gettext("\nUser-level providers:\n"));
12627c478bd9Sstevel@tonic-gate if (get_pkcs11conf_info(&pliblist) != SUCCESS) {
12637c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
12647c478bd9Sstevel@tonic-gate "failed to retrieve the list of user-level providers."));
12651b22764fSDaniel OpenSolaris Anderson rc = FAILURE;
12667c478bd9Sstevel@tonic-gate }
12671b22764fSDaniel OpenSolaris Anderson
12681b22764fSDaniel OpenSolaris Anderson for (plibptr = pliblist; plibptr != NULL; plibptr = plibptr->next) {
1269d616ad8eSHai-May Chao /* skip metaslot and fips-140 entry */
1270d616ad8eSHai-May Chao if ((strcmp(plibptr->puent->name, METASLOT_KEYWORD) != 0) &&
1271d616ad8eSHai-May Chao (strcmp(plibptr->puent->name, FIPS_KEYWORD) != 0)) {
12727c478bd9Sstevel@tonic-gate (void) printf(gettext("Provider: %s\n"),
12737c478bd9Sstevel@tonic-gate plibptr->puent->name);
12747c478bd9Sstevel@tonic-gate if (verbose) {
12757c478bd9Sstevel@tonic-gate (void) list_mechlist_for_lib(
12767c478bd9Sstevel@tonic-gate plibptr->puent->name, mecharglist, NULL,
12777c478bd9Sstevel@tonic-gate B_FALSE, verbose, B_FALSE);
12787c478bd9Sstevel@tonic-gate (void) printf("\n");
12797c478bd9Sstevel@tonic-gate }
12807c478bd9Sstevel@tonic-gate }
12817c478bd9Sstevel@tonic-gate }
12827c478bd9Sstevel@tonic-gate free_uentrylist(pliblist);
12837c478bd9Sstevel@tonic-gate
12847c478bd9Sstevel@tonic-gate /* get kernel software providers */
12857c478bd9Sstevel@tonic-gate (void) printf(gettext("\nKernel software providers:\n"));
12867c478bd9Sstevel@tonic-gate
12877c478bd9Sstevel@tonic-gate if (getzoneid() == GLOBAL_ZONEID) {
12881b22764fSDaniel OpenSolaris Anderson /* get kernel software providers from kernel ioctl */
12891b22764fSDaniel OpenSolaris Anderson crypto_get_soft_list_t *psoftlist_kernel = NULL;
12901b22764fSDaniel OpenSolaris Anderson uint_t sl_soft_count;
12911b22764fSDaniel OpenSolaris Anderson char *psoftname;
12921b22764fSDaniel OpenSolaris Anderson entrylist_t *pdevlist_conf = NULL;
12931b22764fSDaniel OpenSolaris Anderson entrylist_t *psoftlist_conf = NULL;
12941b22764fSDaniel OpenSolaris Anderson
12951b22764fSDaniel OpenSolaris Anderson if (get_soft_list(&psoftlist_kernel) == FAILURE) {
12961b22764fSDaniel OpenSolaris Anderson cryptoerror(LOG_ERR, gettext("Failed to retrieve the "
12971b22764fSDaniel OpenSolaris Anderson "software provider list from kernel."));
12981b22764fSDaniel OpenSolaris Anderson rc = FAILURE;
12991b22764fSDaniel OpenSolaris Anderson } else {
13001b22764fSDaniel OpenSolaris Anderson sl_soft_count = psoftlist_kernel->sl_soft_count;
13017c478bd9Sstevel@tonic-gate
1302d616ad8eSHai-May Chao if (get_kcfconf_info(&pdevlist_conf, &psoftlist_conf)
1303d616ad8eSHai-May Chao == FAILURE) {
13041b22764fSDaniel OpenSolaris Anderson cryptoerror(LOG_ERR,
13051b22764fSDaniel OpenSolaris Anderson "failed to retrieve the providers' "
13061b22764fSDaniel OpenSolaris Anderson "information from file kcf.conf - %s.",
13071b22764fSDaniel OpenSolaris Anderson _PATH_KCF_CONF);
13081b22764fSDaniel OpenSolaris Anderson rc = FAILURE;
13097c478bd9Sstevel@tonic-gate } else {
13101b22764fSDaniel OpenSolaris Anderson
13111b22764fSDaniel OpenSolaris Anderson for (i = 0,
13121b22764fSDaniel OpenSolaris Anderson psoftname = psoftlist_kernel->sl_soft_names;
13131b22764fSDaniel OpenSolaris Anderson i < sl_soft_count;
13141b22764fSDaniel OpenSolaris Anderson ++i, psoftname += strlen(psoftname) + 1) {
13151b22764fSDaniel OpenSolaris Anderson pent = getent_kef(psoftname,
1316d616ad8eSHai-May Chao pdevlist_conf, psoftlist_conf);
13171b22764fSDaniel OpenSolaris Anderson (void) printf("\t%s%s\n", psoftname,
13181b22764fSDaniel OpenSolaris Anderson (pent == NULL) || (pent->load) ?
13191b22764fSDaniel OpenSolaris Anderson "" : gettext(" (inactive)"));
13201b22764fSDaniel OpenSolaris Anderson }
13211b22764fSDaniel OpenSolaris Anderson free_entrylist(pdevlist_conf);
13221b22764fSDaniel OpenSolaris Anderson free_entrylist(psoftlist_conf);
13237c478bd9Sstevel@tonic-gate }
13241b22764fSDaniel OpenSolaris Anderson free(psoftlist_kernel);
13257c478bd9Sstevel@tonic-gate }
13267c478bd9Sstevel@tonic-gate
13277c478bd9Sstevel@tonic-gate } else {
13287c478bd9Sstevel@tonic-gate /* kcf.conf not there in non-global zone, use /dev/cryptoadm */
13291b22764fSDaniel OpenSolaris Anderson entrylist_t *pdevlist_zone = NULL;
13301b22764fSDaniel OpenSolaris Anderson entrylist_t *psoftlist_zone = NULL;
13311b22764fSDaniel OpenSolaris Anderson entrylist_t *ptr;
13327c478bd9Sstevel@tonic-gate
13337c478bd9Sstevel@tonic-gate if (get_admindev_info(&pdevlist_zone, &psoftlist_zone) !=
13347c478bd9Sstevel@tonic-gate SUCCESS) {
13357c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR,
13367c478bd9Sstevel@tonic-gate gettext("failed to retrieve the "
13377c478bd9Sstevel@tonic-gate "list of kernel software providers.\n"));
13381b22764fSDaniel OpenSolaris Anderson rc = FAILURE;
13397c478bd9Sstevel@tonic-gate }
13407c478bd9Sstevel@tonic-gate
13417c478bd9Sstevel@tonic-gate ptr = psoftlist_zone;
13427c478bd9Sstevel@tonic-gate while (ptr != NULL) {
13437c478bd9Sstevel@tonic-gate (void) printf("\t%s\n", ptr->pent->name);
13447c478bd9Sstevel@tonic-gate ptr = ptr->next;
13457c478bd9Sstevel@tonic-gate }
13467c478bd9Sstevel@tonic-gate
13477c478bd9Sstevel@tonic-gate free_entrylist(pdevlist_zone);
13487c478bd9Sstevel@tonic-gate free_entrylist(psoftlist_zone);
13497c478bd9Sstevel@tonic-gate }
13507c478bd9Sstevel@tonic-gate
13517c478bd9Sstevel@tonic-gate /* get kernel hardware providers */
13527c478bd9Sstevel@tonic-gate (void) printf(gettext("\nKernel hardware providers:\n"));
13537c478bd9Sstevel@tonic-gate if (get_dev_list(&pdevlist_kernel) == FAILURE) {
13547c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("failed to retrieve "
13557c478bd9Sstevel@tonic-gate "the list of kernel hardware providers.\n"));
13561b22764fSDaniel OpenSolaris Anderson rc = FAILURE;
13577c478bd9Sstevel@tonic-gate } else {
13587c478bd9Sstevel@tonic-gate for (i = 0; i < pdevlist_kernel->dl_dev_count; i++) {
13597c478bd9Sstevel@tonic-gate (void) printf("\t%s/%d\n",
13607c478bd9Sstevel@tonic-gate pdevlist_kernel->dl_devs[i].le_dev_name,
13617c478bd9Sstevel@tonic-gate pdevlist_kernel->dl_devs[i].le_dev_instance);
13627c478bd9Sstevel@tonic-gate }
13637c478bd9Sstevel@tonic-gate }
13647c478bd9Sstevel@tonic-gate free(pdevlist_kernel);
13657c478bd9Sstevel@tonic-gate
13661b22764fSDaniel OpenSolaris Anderson return (rc);
13677c478bd9Sstevel@tonic-gate }
13687c478bd9Sstevel@tonic-gate
13697c478bd9Sstevel@tonic-gate
13707c478bd9Sstevel@tonic-gate
13717c478bd9Sstevel@tonic-gate /*
13727c478bd9Sstevel@tonic-gate * List all the providers. And for each provider, list the mechanism list.
13731b22764fSDaniel OpenSolaris Anderson * Called for "cryptoadm list -m" or "cryptoadm list -mv" .
13747c478bd9Sstevel@tonic-gate */
13757c478bd9Sstevel@tonic-gate static int
list_mechlist_for_all(boolean_t verbose)13767c478bd9Sstevel@tonic-gate list_mechlist_for_all(boolean_t verbose)
13777c478bd9Sstevel@tonic-gate {
13781b22764fSDaniel OpenSolaris Anderson crypto_get_dev_list_t *pdevlist_kernel = NULL;
13791b22764fSDaniel OpenSolaris Anderson uentrylist_t *pliblist = NULL;
13801b22764fSDaniel OpenSolaris Anderson uentrylist_t *plibptr = NULL;
13811b22764fSDaniel OpenSolaris Anderson entry_t *pent = NULL;
13821b22764fSDaniel OpenSolaris Anderson mechlist_t *pmechlist = NULL;
13831b22764fSDaniel OpenSolaris Anderson char provname[MAXNAMELEN];
13841b22764fSDaniel OpenSolaris Anderson char devname[MAXNAMELEN];
13851b22764fSDaniel OpenSolaris Anderson int inst_num;
13861b22764fSDaniel OpenSolaris Anderson int count;
13871b22764fSDaniel OpenSolaris Anderson int i;
13881b22764fSDaniel OpenSolaris Anderson int rv;
13891b22764fSDaniel OpenSolaris Anderson int rc = SUCCESS;
13907c478bd9Sstevel@tonic-gate
13917c478bd9Sstevel@tonic-gate /* get user-level providers */
13927c478bd9Sstevel@tonic-gate (void) printf(gettext("\nUser-level providers:\n"));
13937c478bd9Sstevel@tonic-gate /*
13940a85b835SDaniel Anderson * TRANSLATION_NOTE
13957c478bd9Sstevel@tonic-gate * Strictly for appearance's sake, this line should be as long as
13967c478bd9Sstevel@tonic-gate * the length of the translated text above.
13977c478bd9Sstevel@tonic-gate */
13987c478bd9Sstevel@tonic-gate (void) printf(gettext("=====================\n"));
13997c478bd9Sstevel@tonic-gate if (get_pkcs11conf_info(&pliblist) != SUCCESS) {
14007c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("failed to retrieve "
14017c478bd9Sstevel@tonic-gate "the list of user-level providers.\n"));
14027c478bd9Sstevel@tonic-gate rc = FAILURE;
14037c478bd9Sstevel@tonic-gate }
14047c478bd9Sstevel@tonic-gate
14057c478bd9Sstevel@tonic-gate plibptr = pliblist;
14067c478bd9Sstevel@tonic-gate while (plibptr != NULL) {
1407d616ad8eSHai-May Chao /* skip metaslot and fips-140 entry */
1408d616ad8eSHai-May Chao if ((strcmp(plibptr->puent->name, METASLOT_KEYWORD) != 0) &&
1409d616ad8eSHai-May Chao (strcmp(plibptr->puent->name, FIPS_KEYWORD) != 0)) {
14107c478bd9Sstevel@tonic-gate (void) printf(gettext("\nProvider: %s\n"),
14117c478bd9Sstevel@tonic-gate plibptr->puent->name);
14127c478bd9Sstevel@tonic-gate rv = list_mechlist_for_lib(plibptr->puent->name,
14137c478bd9Sstevel@tonic-gate mecharglist, NULL, B_FALSE, verbose, B_TRUE);
14147c478bd9Sstevel@tonic-gate if (rv == FAILURE) {
14157c478bd9Sstevel@tonic-gate rc = FAILURE;
14167c478bd9Sstevel@tonic-gate }
14177c478bd9Sstevel@tonic-gate }
14187c478bd9Sstevel@tonic-gate plibptr = plibptr->next;
14197c478bd9Sstevel@tonic-gate }
14207c478bd9Sstevel@tonic-gate free_uentrylist(pliblist);
14217c478bd9Sstevel@tonic-gate
14227c478bd9Sstevel@tonic-gate /* get kernel software providers */
14237c478bd9Sstevel@tonic-gate (void) printf(gettext("\nKernel software providers:\n"));
14241b22764fSDaniel OpenSolaris Anderson
14257c478bd9Sstevel@tonic-gate /*
14260a85b835SDaniel Anderson * TRANSLATION_NOTE
14277c478bd9Sstevel@tonic-gate * Strictly for appearance's sake, this line should be as long as
14287c478bd9Sstevel@tonic-gate * the length of the translated text above.
14297c478bd9Sstevel@tonic-gate */
14307c478bd9Sstevel@tonic-gate (void) printf(gettext("==========================\n"));
14317c478bd9Sstevel@tonic-gate if (getzoneid() == GLOBAL_ZONEID) {
14321b22764fSDaniel OpenSolaris Anderson /* get kernel software providers from kernel ioctl */
14331b22764fSDaniel OpenSolaris Anderson crypto_get_soft_list_t *psoftlist_kernel = NULL;
14341b22764fSDaniel OpenSolaris Anderson uint_t sl_soft_count;
14351b22764fSDaniel OpenSolaris Anderson char *psoftname;
14361b22764fSDaniel OpenSolaris Anderson int i;
14371b22764fSDaniel OpenSolaris Anderson entrylist_t *pdevlist_conf = NULL;
14381b22764fSDaniel OpenSolaris Anderson entrylist_t *psoftlist_conf = NULL;
14391b22764fSDaniel OpenSolaris Anderson
14401b22764fSDaniel OpenSolaris Anderson if (get_soft_list(&psoftlist_kernel) == FAILURE) {
14411b22764fSDaniel OpenSolaris Anderson cryptoerror(LOG_ERR, gettext("Failed to retrieve the "
14421b22764fSDaniel OpenSolaris Anderson "software provider list from kernel."));
14431b22764fSDaniel OpenSolaris Anderson return (FAILURE);
14441b22764fSDaniel OpenSolaris Anderson }
14451b22764fSDaniel OpenSolaris Anderson sl_soft_count = psoftlist_kernel->sl_soft_count;
14461b22764fSDaniel OpenSolaris Anderson
1447d616ad8eSHai-May Chao if (get_kcfconf_info(&pdevlist_conf, &psoftlist_conf)
1448d616ad8eSHai-May Chao == FAILURE) {
14491b22764fSDaniel OpenSolaris Anderson cryptoerror(LOG_ERR,
14501b22764fSDaniel OpenSolaris Anderson "failed to retrieve the providers' "
14511b22764fSDaniel OpenSolaris Anderson "information from file kcf.conf - %s.",
14521b22764fSDaniel OpenSolaris Anderson _PATH_KCF_CONF);
14531b22764fSDaniel OpenSolaris Anderson free(psoftlist_kernel);
14541b22764fSDaniel OpenSolaris Anderson return (FAILURE);
14557c478bd9Sstevel@tonic-gate }
14567c478bd9Sstevel@tonic-gate
14571b22764fSDaniel OpenSolaris Anderson for (i = 0, psoftname = psoftlist_kernel->sl_soft_names;
14581b22764fSDaniel OpenSolaris Anderson i < sl_soft_count;
14591b22764fSDaniel OpenSolaris Anderson ++i, psoftname += strlen(psoftname) + 1) {
14601b22764fSDaniel OpenSolaris Anderson pent = getent_kef(psoftname, pdevlist_conf,
1461d616ad8eSHai-May Chao psoftlist_conf);
14621b22764fSDaniel OpenSolaris Anderson if ((pent == NULL) || (pent->load)) {
14631b22764fSDaniel OpenSolaris Anderson rv = list_mechlist_for_soft(psoftname,
1464d616ad8eSHai-May Chao NULL, NULL);
14651b22764fSDaniel OpenSolaris Anderson if (rv == FAILURE) {
14661b22764fSDaniel OpenSolaris Anderson rc = FAILURE;
14677c478bd9Sstevel@tonic-gate }
14687c478bd9Sstevel@tonic-gate } else {
14691b22764fSDaniel OpenSolaris Anderson (void) printf(gettext("%s: (inactive)\n"),
14701b22764fSDaniel OpenSolaris Anderson psoftname);
14717c478bd9Sstevel@tonic-gate }
14727c478bd9Sstevel@tonic-gate }
14737c478bd9Sstevel@tonic-gate
14741b22764fSDaniel OpenSolaris Anderson free(psoftlist_kernel);
14757c478bd9Sstevel@tonic-gate free_entrylist(pdevlist_conf);
14767c478bd9Sstevel@tonic-gate free_entrylist(psoftlist_conf);
14771b22764fSDaniel OpenSolaris Anderson
14787c478bd9Sstevel@tonic-gate } else {
14797c478bd9Sstevel@tonic-gate /* kcf.conf not there in non-global zone, use /dev/cryptoadm */
14801b22764fSDaniel OpenSolaris Anderson entrylist_t *pdevlist_zone = NULL;
14811b22764fSDaniel OpenSolaris Anderson entrylist_t *psoftlist_zone = NULL;
14821b22764fSDaniel OpenSolaris Anderson entrylist_t *ptr;
14837c478bd9Sstevel@tonic-gate
14847c478bd9Sstevel@tonic-gate if (get_admindev_info(&pdevlist_zone, &psoftlist_zone) !=
14857c478bd9Sstevel@tonic-gate SUCCESS) {
14867c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("failed to retrieve "
14877c478bd9Sstevel@tonic-gate "the list of kernel software providers.\n"));
14887c478bd9Sstevel@tonic-gate rc = FAILURE;
14897c478bd9Sstevel@tonic-gate }
14907c478bd9Sstevel@tonic-gate
14911b22764fSDaniel OpenSolaris Anderson for (ptr = psoftlist_zone; ptr != NULL; ptr = ptr->next) {
14921b22764fSDaniel OpenSolaris Anderson rv = list_mechlist_for_soft(ptr->pent->name,
1493d616ad8eSHai-May Chao pdevlist_zone, psoftlist_zone);
14947c478bd9Sstevel@tonic-gate if (rv == FAILURE) {
14957c478bd9Sstevel@tonic-gate (void) printf(gettext(
14967c478bd9Sstevel@tonic-gate "%s: failed to get the mechanism list.\n"),
14977c478bd9Sstevel@tonic-gate ptr->pent->name);
14987c478bd9Sstevel@tonic-gate rc = FAILURE;
14997c478bd9Sstevel@tonic-gate }
15007c478bd9Sstevel@tonic-gate }
15017c478bd9Sstevel@tonic-gate
15027c478bd9Sstevel@tonic-gate free_entrylist(pdevlist_zone);
15037c478bd9Sstevel@tonic-gate free_entrylist(psoftlist_zone);
15047c478bd9Sstevel@tonic-gate }
15057c478bd9Sstevel@tonic-gate
15067c478bd9Sstevel@tonic-gate /* Get kernel hardware providers and their mechanism lists */
15077c478bd9Sstevel@tonic-gate (void) printf(gettext("\nKernel hardware providers:\n"));
15087c478bd9Sstevel@tonic-gate /*
15090a85b835SDaniel Anderson * TRANSLATION_NOTE
15107c478bd9Sstevel@tonic-gate * Strictly for appearance's sake, this line should be as long as
15117c478bd9Sstevel@tonic-gate * the length of the translated text above.
15127c478bd9Sstevel@tonic-gate */
15137c478bd9Sstevel@tonic-gate (void) printf(gettext("==========================\n"));
15147c478bd9Sstevel@tonic-gate if (get_dev_list(&pdevlist_kernel) != SUCCESS) {
15157c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("failed to retrieve "
15167c478bd9Sstevel@tonic-gate "the list of hardware providers.\n"));
15177c478bd9Sstevel@tonic-gate return (FAILURE);
15187c478bd9Sstevel@tonic-gate }
15197c478bd9Sstevel@tonic-gate
15207c478bd9Sstevel@tonic-gate for (i = 0; i < pdevlist_kernel->dl_dev_count; i++) {
15217c478bd9Sstevel@tonic-gate (void) strlcpy(devname,
15227c478bd9Sstevel@tonic-gate pdevlist_kernel->dl_devs[i].le_dev_name, MAXNAMELEN);
15237c478bd9Sstevel@tonic-gate inst_num = pdevlist_kernel->dl_devs[i].le_dev_instance;
15247c478bd9Sstevel@tonic-gate count = pdevlist_kernel->dl_devs[i].le_mechanism_count;
15257c478bd9Sstevel@tonic-gate (void) snprintf(provname, sizeof (provname), "%s/%d", devname,
15267c478bd9Sstevel@tonic-gate inst_num);
15277c478bd9Sstevel@tonic-gate if (get_dev_info(devname, inst_num, count, &pmechlist) ==
15287c478bd9Sstevel@tonic-gate SUCCESS) {
15297c478bd9Sstevel@tonic-gate (void) filter_mechlist(&pmechlist, RANDOM);
15307c478bd9Sstevel@tonic-gate print_mechlist(provname, pmechlist);
15317c478bd9Sstevel@tonic-gate free_mechlist(pmechlist);
15327c478bd9Sstevel@tonic-gate } else {
15337c478bd9Sstevel@tonic-gate (void) printf(gettext("%s: failed to get the mechanism"
15347c478bd9Sstevel@tonic-gate " list.\n"), provname);
15357c478bd9Sstevel@tonic-gate rc = FAILURE;
15367c478bd9Sstevel@tonic-gate }
15377c478bd9Sstevel@tonic-gate }
15387c478bd9Sstevel@tonic-gate free(pdevlist_kernel);
15397c478bd9Sstevel@tonic-gate return (rc);
15407c478bd9Sstevel@tonic-gate }
15417c478bd9Sstevel@tonic-gate
15427c478bd9Sstevel@tonic-gate
15437c478bd9Sstevel@tonic-gate /*
15447c478bd9Sstevel@tonic-gate * List all the providers. And for each provider, list the policy information.
15451b22764fSDaniel OpenSolaris Anderson * Called for "cryptoadm list -p".
15467c478bd9Sstevel@tonic-gate */
15477c478bd9Sstevel@tonic-gate static int
list_policy_for_all(void)15487c478bd9Sstevel@tonic-gate list_policy_for_all(void)
15497c478bd9Sstevel@tonic-gate {
15501b22764fSDaniel OpenSolaris Anderson crypto_get_dev_list_t *pdevlist_kernel = NULL;
15511b22764fSDaniel OpenSolaris Anderson uentrylist_t *pliblist = NULL;
15521b22764fSDaniel OpenSolaris Anderson entrylist_t *pdevlist_conf = NULL;
15531b22764fSDaniel OpenSolaris Anderson entrylist_t *psoftlist_conf = NULL;
15541b22764fSDaniel OpenSolaris Anderson entrylist_t *ptr = NULL;
15551b22764fSDaniel OpenSolaris Anderson entrylist_t *phead = NULL;
15561b22764fSDaniel OpenSolaris Anderson boolean_t found = B_FALSE;
15571b22764fSDaniel OpenSolaris Anderson char provname[MAXNAMELEN];
15581b22764fSDaniel OpenSolaris Anderson int i;
15591b22764fSDaniel OpenSolaris Anderson int rc = SUCCESS;
15607c478bd9Sstevel@tonic-gate
15617c478bd9Sstevel@tonic-gate /* Get user-level providers */
15627c478bd9Sstevel@tonic-gate (void) printf(gettext("\nUser-level providers:\n"));
15637c478bd9Sstevel@tonic-gate /*
15640a85b835SDaniel Anderson * TRANSLATION_NOTE
15657c478bd9Sstevel@tonic-gate * Strictly for appearance's sake, this line should be as long as
15667c478bd9Sstevel@tonic-gate * the length of the translated text above.
15677c478bd9Sstevel@tonic-gate */
15687c478bd9Sstevel@tonic-gate (void) printf(gettext("=====================\n"));
15697c478bd9Sstevel@tonic-gate if (get_pkcs11conf_info(&pliblist) == FAILURE) {
15707c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("failed to retrieve "
15717c478bd9Sstevel@tonic-gate "the list of user-level providers.\n"));
15721b22764fSDaniel OpenSolaris Anderson rc = FAILURE;
15737c478bd9Sstevel@tonic-gate } else {
15741b22764fSDaniel OpenSolaris Anderson uentrylist_t *plibptr = pliblist;
15751b22764fSDaniel OpenSolaris Anderson
15767c478bd9Sstevel@tonic-gate while (plibptr != NULL) {
1577d616ad8eSHai-May Chao /* skip metaslot and fips-140 entry */
1578d616ad8eSHai-May Chao if ((strcmp(plibptr->puent->name,
1579d616ad8eSHai-May Chao METASLOT_KEYWORD) != 0) &&
1580d616ad8eSHai-May Chao (strcmp(plibptr->puent->name,
1581d616ad8eSHai-May Chao FIPS_KEYWORD) != 0)) {
15827c478bd9Sstevel@tonic-gate if (print_uef_policy(plibptr->puent)
15837c478bd9Sstevel@tonic-gate == FAILURE) {
15847c478bd9Sstevel@tonic-gate rc = FAILURE;
15857c478bd9Sstevel@tonic-gate }
15867c478bd9Sstevel@tonic-gate }
15877c478bd9Sstevel@tonic-gate plibptr = plibptr->next;
15887c478bd9Sstevel@tonic-gate }
15897c478bd9Sstevel@tonic-gate free_uentrylist(pliblist);
15907c478bd9Sstevel@tonic-gate }
15917c478bd9Sstevel@tonic-gate
15927c478bd9Sstevel@tonic-gate /* kernel software providers */
15937c478bd9Sstevel@tonic-gate (void) printf(gettext("\nKernel software providers:\n"));
15947c478bd9Sstevel@tonic-gate /*
15950a85b835SDaniel Anderson * TRANSLATION_NOTE
15967c478bd9Sstevel@tonic-gate * Strictly for appearance's sake, this line should be as long as
15977c478bd9Sstevel@tonic-gate * the length of the translated text above.
15987c478bd9Sstevel@tonic-gate */
15997c478bd9Sstevel@tonic-gate (void) printf(gettext("==========================\n"));
16007c478bd9Sstevel@tonic-gate
16011b22764fSDaniel OpenSolaris Anderson /* Get all entries from the kernel */
16027c478bd9Sstevel@tonic-gate if (getzoneid() == GLOBAL_ZONEID) {
16031b22764fSDaniel OpenSolaris Anderson /* get kernel software providers from kernel ioctl */
16041b22764fSDaniel OpenSolaris Anderson crypto_get_soft_list_t *psoftlist_kernel = NULL;
16051b22764fSDaniel OpenSolaris Anderson uint_t sl_soft_count;
16061b22764fSDaniel OpenSolaris Anderson char *psoftname;
16071b22764fSDaniel OpenSolaris Anderson int i;
16081b22764fSDaniel OpenSolaris Anderson
16091b22764fSDaniel OpenSolaris Anderson if (get_soft_list(&psoftlist_kernel) == FAILURE) {
16101b22764fSDaniel OpenSolaris Anderson cryptoerror(LOG_ERR, gettext("Failed to retrieve the "
16111b22764fSDaniel OpenSolaris Anderson "software provider list from kernel."));
16121b22764fSDaniel OpenSolaris Anderson rc = FAILURE;
16131b22764fSDaniel OpenSolaris Anderson } else {
16141b22764fSDaniel OpenSolaris Anderson sl_soft_count = psoftlist_kernel->sl_soft_count;
16157c478bd9Sstevel@tonic-gate
16161b22764fSDaniel OpenSolaris Anderson for (i = 0, psoftname = psoftlist_kernel->sl_soft_names;
16171b22764fSDaniel OpenSolaris Anderson i < sl_soft_count;
16181b22764fSDaniel OpenSolaris Anderson ++i, psoftname += strlen(psoftname) + 1) {
16191b22764fSDaniel OpenSolaris Anderson (void) list_policy_for_soft(psoftname,
1620d616ad8eSHai-May Chao pdevlist_conf, psoftlist_conf);
16211b22764fSDaniel OpenSolaris Anderson }
16221b22764fSDaniel OpenSolaris Anderson free(psoftlist_kernel);
16237c478bd9Sstevel@tonic-gate }
16247c478bd9Sstevel@tonic-gate
16257c478bd9Sstevel@tonic-gate } else {
16267c478bd9Sstevel@tonic-gate /* kcf.conf not there in non-global zone, no policy info */
16277c478bd9Sstevel@tonic-gate
16287c478bd9Sstevel@tonic-gate /*
16290a85b835SDaniel Anderson * TRANSLATION_NOTE
16307c478bd9Sstevel@tonic-gate * "global" is keyword and not to be translated.
16317c478bd9Sstevel@tonic-gate */
16327c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
16337c478bd9Sstevel@tonic-gate "policy information for kernel software providers is "
16347c478bd9Sstevel@tonic-gate "available in the %s zone only"), "global");
16357c478bd9Sstevel@tonic-gate }
16367c478bd9Sstevel@tonic-gate
16377c478bd9Sstevel@tonic-gate /* Kernel hardware providers */
16387c478bd9Sstevel@tonic-gate (void) printf(gettext("\nKernel hardware providers:\n"));
16397c478bd9Sstevel@tonic-gate /*
16400a85b835SDaniel Anderson * TRANSLATION_NOTE
16417c478bd9Sstevel@tonic-gate * Strictly for appearance's sake, this line should be as long as
16427c478bd9Sstevel@tonic-gate * the length of the translated text above.
16437c478bd9Sstevel@tonic-gate */
16447c478bd9Sstevel@tonic-gate (void) printf(gettext("==========================\n"));
16457c478bd9Sstevel@tonic-gate
16467c478bd9Sstevel@tonic-gate if (getzoneid() != GLOBAL_ZONEID) {
16477c478bd9Sstevel@tonic-gate /*
16480a85b835SDaniel Anderson * TRANSLATION_NOTE
16497c478bd9Sstevel@tonic-gate * "global" is keyword and not to be translated.
16507c478bd9Sstevel@tonic-gate */
16517c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
16527c478bd9Sstevel@tonic-gate "policy information for kernel hardware providers is "
16537c478bd9Sstevel@tonic-gate "available in the %s zone only"), "global");
16547c478bd9Sstevel@tonic-gate return (FAILURE);
16557c478bd9Sstevel@tonic-gate }
16567c478bd9Sstevel@tonic-gate
16577c478bd9Sstevel@tonic-gate /* Get the hardware provider list from kernel */
16587c478bd9Sstevel@tonic-gate if (get_dev_list(&pdevlist_kernel) != SUCCESS) {
16597c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
16607c478bd9Sstevel@tonic-gate "failed to retrieve the list of hardware providers.\n"));
16617c478bd9Sstevel@tonic-gate return (FAILURE);
16627c478bd9Sstevel@tonic-gate }
16637c478bd9Sstevel@tonic-gate
1664d616ad8eSHai-May Chao if (get_kcfconf_info(&pdevlist_conf, &psoftlist_conf) == FAILURE) {
16651b22764fSDaniel OpenSolaris Anderson cryptoerror(LOG_ERR, "failed to retrieve the providers' "
16661b22764fSDaniel OpenSolaris Anderson "information from file kcf.conf - %s.",
16671b22764fSDaniel OpenSolaris Anderson _PATH_KCF_CONF);
16681b22764fSDaniel OpenSolaris Anderson return (FAILURE);
16691b22764fSDaniel OpenSolaris Anderson }
16701b22764fSDaniel OpenSolaris Anderson
16711b22764fSDaniel OpenSolaris Anderson
16727c478bd9Sstevel@tonic-gate /*
16737c478bd9Sstevel@tonic-gate * For each hardware provider from kernel, check if it has an entry
16747c478bd9Sstevel@tonic-gate * in the config file. If it has an entry, print out the policy from
16757c478bd9Sstevel@tonic-gate * config file and remove the entry from the hardware provider list
16767c478bd9Sstevel@tonic-gate * of the config file. If it does not have an entry in the config
16777c478bd9Sstevel@tonic-gate * file, no mechanisms of it have been disabled. But, we still call
16787c478bd9Sstevel@tonic-gate * list_policy_for_hard() to account for the "random" feature.
16797c478bd9Sstevel@tonic-gate */
16807c478bd9Sstevel@tonic-gate for (i = 0; i < pdevlist_kernel->dl_dev_count; i++) {
16817c478bd9Sstevel@tonic-gate (void) snprintf(provname, sizeof (provname), "%s/%d",
16827c478bd9Sstevel@tonic-gate pdevlist_kernel->dl_devs[i].le_dev_name,
16837c478bd9Sstevel@tonic-gate pdevlist_kernel->dl_devs[i].le_dev_instance);
16841b22764fSDaniel OpenSolaris Anderson
16857c478bd9Sstevel@tonic-gate found = B_FALSE;
16867c478bd9Sstevel@tonic-gate phead = ptr = pdevlist_conf;
16877c478bd9Sstevel@tonic-gate while (!found && ptr) {
16887c478bd9Sstevel@tonic-gate if (strcmp(ptr->pent->name, provname) == 0) {
16897c478bd9Sstevel@tonic-gate found = B_TRUE;
16907c478bd9Sstevel@tonic-gate } else {
16917c478bd9Sstevel@tonic-gate phead = ptr;
16927c478bd9Sstevel@tonic-gate ptr = ptr->next;
16937c478bd9Sstevel@tonic-gate }
16947c478bd9Sstevel@tonic-gate }
16957c478bd9Sstevel@tonic-gate
16967c478bd9Sstevel@tonic-gate if (found) {
16971b22764fSDaniel OpenSolaris Anderson (void) list_policy_for_hard(ptr->pent->name,
1698d616ad8eSHai-May Chao pdevlist_conf, psoftlist_conf, pdevlist_kernel);
16997c478bd9Sstevel@tonic-gate if (phead == ptr) {
17007c478bd9Sstevel@tonic-gate pdevlist_conf = pdevlist_conf->next;
17017c478bd9Sstevel@tonic-gate } else {
17027c478bd9Sstevel@tonic-gate phead->next = ptr->next;
17037c478bd9Sstevel@tonic-gate }
17047c478bd9Sstevel@tonic-gate free_entry(ptr->pent);
17057c478bd9Sstevel@tonic-gate free(ptr);
17067c478bd9Sstevel@tonic-gate } else {
17071b22764fSDaniel OpenSolaris Anderson (void) list_policy_for_hard(provname, pdevlist_conf,
1708d616ad8eSHai-May Chao psoftlist_conf, pdevlist_kernel);
17097c478bd9Sstevel@tonic-gate }
17107c478bd9Sstevel@tonic-gate }
17117c478bd9Sstevel@tonic-gate
17127c478bd9Sstevel@tonic-gate /*
17137c478bd9Sstevel@tonic-gate * If there are still entries left in the pdevlist_conf list from
17147c478bd9Sstevel@tonic-gate * the config file, these providers must have been detached.
17157c478bd9Sstevel@tonic-gate * Should print out their policy information also.
17167c478bd9Sstevel@tonic-gate */
17171b22764fSDaniel OpenSolaris Anderson for (ptr = pdevlist_conf; ptr != NULL; ptr = ptr->next) {
17181b22764fSDaniel OpenSolaris Anderson print_kef_policy(ptr->pent->name, ptr->pent, B_FALSE, B_TRUE);
17197c478bd9Sstevel@tonic-gate }
17207c478bd9Sstevel@tonic-gate
17217c478bd9Sstevel@tonic-gate free_entrylist(pdevlist_conf);
17221b22764fSDaniel OpenSolaris Anderson free_entrylist(psoftlist_conf);
17237c478bd9Sstevel@tonic-gate free(pdevlist_kernel);
17247c478bd9Sstevel@tonic-gate
17257c478bd9Sstevel@tonic-gate return (rc);
17267c478bd9Sstevel@tonic-gate }
1727