17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate  * CDDL HEADER START
37c478bd9Sstevel@tonic-gate  *
47c478bd9Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
5c197cb9dShylee  * Common Development and Distribution License (the "License").
6c197cb9dShylee  * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate  *
87c478bd9Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate  * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate  * and limitations under the License.
127c478bd9Sstevel@tonic-gate  *
137c478bd9Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate  *
197c478bd9Sstevel@tonic-gate  * CDDL HEADER END
207c478bd9Sstevel@tonic-gate  */
2154da5c1fSjk /* Portions Copyright 2005 Richard Lowe */
227c478bd9Sstevel@tonic-gate /*
237b79d846SDina K Nimeh  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
247c478bd9Sstevel@tonic-gate  * Use is subject to license terms.
2533f5ff17SMilan Jurik  * Copyright 2012 Milan Jurik. All rights reserved.
267c478bd9Sstevel@tonic-gate  */
277c478bd9Sstevel@tonic-gate 
287c478bd9Sstevel@tonic-gate /*
297c478bd9Sstevel@tonic-gate  * decrypt.c
307c478bd9Sstevel@tonic-gate  *
317c478bd9Sstevel@tonic-gate  * Implements encrypt(1) and decrypt(1) commands
327c478bd9Sstevel@tonic-gate  *
337c478bd9Sstevel@tonic-gate  * One binary performs both encrypt/decrypt operation.
347c478bd9Sstevel@tonic-gate  *
35b54157c1Sda  * Usage:
36b54157c1Sda  *  -a algorithm mechanism name without CKM_ prefix. Case
37b54157c1Sda  *               does not matter
38b54157c1Sda  *  -k keyfile   file containing key data. If not specified user is
39b54157c1Sda  *               prompted to enter key. key length > 0 is required
40b54157c1Sda  *  -i infile    input file to encrypt/decrypt. If omitted, stdin used.
41b54157c1Sda  *  -o outfile   output file to encrypt/decrypt. If omitted, stdout used.
42b54157c1Sda  *               if infile & outfile are same, a temp file is used for
43b54157c1Sda  *               output and infile is replaced with this file after
44b54157c1Sda  *               operation is complete
45b54157c1Sda  *  -l           Display the list of  algorithms
46b54157c1Sda  *  -v           Display verbose information
47b54157c1Sda  *  -T tokenspec Specify a PKCS#11 token (optionally used with -K)
48b54157c1Sda  *  -K keylabel  Specify the symmetric PKCS#11 token key label
497c478bd9Sstevel@tonic-gate  *
507c478bd9Sstevel@tonic-gate  * Implementation notes:
51b54157c1Sda  *   IV data - It is generated by random bytes equal to one block size.
527c478bd9Sstevel@tonic-gate  *
53b54157c1Sda  *   Encrypted output format -
54b54157c1Sda  *   - Output format version number (1) - 4 bytes in network byte order.
55b54157c1Sda  *   - Iterations used in key gen function, 4 bytes in network byte order.
56b54157c1Sda  *   - IV ('ivlen' bytes).  Length is algorithm-dependent (see mech_aliases)
577c478bd9Sstevel@tonic-gate  *   - Salt data used in key gen (16 bytes)
58b54157c1Sda  *   - Cipher text data (remainder of the file)
597c478bd9Sstevel@tonic-gate  */
607c478bd9Sstevel@tonic-gate 
617c478bd9Sstevel@tonic-gate #include <stdio.h>
627c478bd9Sstevel@tonic-gate #include <stdlib.h>
637c478bd9Sstevel@tonic-gate #include <unistd.h>
647c478bd9Sstevel@tonic-gate #include <errno.h>
657c478bd9Sstevel@tonic-gate #include <fcntl.h>
667c478bd9Sstevel@tonic-gate #include <ctype.h>
677c478bd9Sstevel@tonic-gate #include <strings.h>
687c478bd9Sstevel@tonic-gate #include <libintl.h>
697c478bd9Sstevel@tonic-gate #include <libgen.h>
707c478bd9Sstevel@tonic-gate #include <locale.h>
717c478bd9Sstevel@tonic-gate #include <limits.h>
727c478bd9Sstevel@tonic-gate #include <sys/types.h>
737c478bd9Sstevel@tonic-gate #include <sys/stat.h>
747c478bd9Sstevel@tonic-gate #include <netinet/in.h>
757c478bd9Sstevel@tonic-gate #include <security/cryptoki.h>
767c478bd9Sstevel@tonic-gate #include <cryptoutil.h>
77c197cb9dShylee #include <kmfapi.h>
787c478bd9Sstevel@tonic-gate 
79f2728256SKrishna Yenduri /*
80f2728256SKrishna Yenduri  * Buffer size for reading file. This is given a rather high value
81f2728256SKrishna Yenduri  * to get better performance when a hardware provider is present.
82f2728256SKrishna Yenduri  */
83f2728256SKrishna Yenduri #define	BUFFERSIZE	(1024 * 64)
847c478bd9Sstevel@tonic-gate #define	BLOCKSIZE	(128)		/* Largest guess for block size */
85f2728256SKrishna Yenduri #define	PROGRESSSIZE	(1024 * 40)	/* stdin progress indicator size */
867c478bd9Sstevel@tonic-gate 
877c478bd9Sstevel@tonic-gate #define	SUNW_ENCRYPT_FILE_VERSION 1
887c478bd9Sstevel@tonic-gate 
897c478bd9Sstevel@tonic-gate /*
907c478bd9Sstevel@tonic-gate  * Exit Status codes
917c478bd9Sstevel@tonic-gate  */
927c478bd9Sstevel@tonic-gate #ifndef EXIT_SUCCESS
937c478bd9Sstevel@tonic-gate #define	EXIT_SUCCESS	0	/* No errors */
947c478bd9Sstevel@tonic-gate #define	EXIT_FAILURE	1	/* All errors except usage */
957c478bd9Sstevel@tonic-gate #endif /* EXIT_SUCCESS */
967c478bd9Sstevel@tonic-gate 
977c478bd9Sstevel@tonic-gate #define	EXIT_USAGE	2	/* usage/syntax error */
987c478bd9Sstevel@tonic-gate 
997c478bd9Sstevel@tonic-gate #define	ENCRYPT_NAME	"encrypt"	/* name of encrypt command */
100c197cb9dShylee #define	ENCRYPT_OPTIONS "a:T:K:k:i:o:lv"	/* options for encrypt */
1017c478bd9Sstevel@tonic-gate #define	DECRYPT_NAME	"decrypt"	/* name of decrypt command */
102c197cb9dShylee #define	DECRYPT_OPTIONS "a:T:K:k:i:o:lv"	/* options for decrypt */
1037c478bd9Sstevel@tonic-gate 
1047c478bd9Sstevel@tonic-gate /*
1057c478bd9Sstevel@tonic-gate  * Structure containing info for encrypt/decrypt
1067c478bd9Sstevel@tonic-gate  * command
1077c478bd9Sstevel@tonic-gate  */
1087c478bd9Sstevel@tonic-gate struct CommandInfo {
1097c478bd9Sstevel@tonic-gate 	char		*name;		/* name of the command */
1107c478bd9Sstevel@tonic-gate 	char		*options;	/* command line options */
1117c478bd9Sstevel@tonic-gate 	CK_FLAGS	flags;
1127c478bd9Sstevel@tonic-gate 	CK_ATTRIBUTE_TYPE type;		/* type of command */
1137c478bd9Sstevel@tonic-gate 
1147c478bd9Sstevel@tonic-gate 	/* function pointers for various operations */
1157c478bd9Sstevel@tonic-gate 	CK_RV	(*Init)(CK_SESSION_HANDLE, CK_MECHANISM_PTR, CK_OBJECT_HANDLE);
1167c478bd9Sstevel@tonic-gate 	CK_RV	(*Update)(CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_BYTE_PTR,
1177c478bd9Sstevel@tonic-gate 		CK_ULONG_PTR);
1187c478bd9Sstevel@tonic-gate 	CK_RV	(*Crypt)(CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_BYTE_PTR,
1197c478bd9Sstevel@tonic-gate 		CK_ULONG_PTR);
1207c478bd9Sstevel@tonic-gate 	CK_RV	(*Final)(CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG_PTR);
1217c478bd9Sstevel@tonic-gate };
1227c478bd9Sstevel@tonic-gate 
1237c478bd9Sstevel@tonic-gate static struct CommandInfo encrypt_cmd = {
1247c478bd9Sstevel@tonic-gate 	ENCRYPT_NAME,
1257c478bd9Sstevel@tonic-gate 	ENCRYPT_OPTIONS,
1267c478bd9Sstevel@tonic-gate 	CKF_ENCRYPT,
1277c478bd9Sstevel@tonic-gate 	CKA_ENCRYPT,
1287c478bd9Sstevel@tonic-gate 	C_EncryptInit,
1297c478bd9Sstevel@tonic-gate 	C_EncryptUpdate,
1307c478bd9Sstevel@tonic-gate 	C_Encrypt,
1317c478bd9Sstevel@tonic-gate 	C_EncryptFinal
1327c478bd9Sstevel@tonic-gate };
1337c478bd9Sstevel@tonic-gate 
1347c478bd9Sstevel@tonic-gate static struct CommandInfo decrypt_cmd = {
1357c478bd9Sstevel@tonic-gate 	DECRYPT_NAME,
1367c478bd9Sstevel@tonic-gate 	DECRYPT_OPTIONS,
1377c478bd9Sstevel@tonic-gate 	CKF_DECRYPT,
1387c478bd9Sstevel@tonic-gate 	CKA_DECRYPT,
1397c478bd9Sstevel@tonic-gate 	C_DecryptInit,
1407c478bd9Sstevel@tonic-gate 	C_DecryptUpdate,
1417c478bd9Sstevel@tonic-gate 	C_Decrypt,
1427c478bd9Sstevel@tonic-gate 	C_DecryptFinal
1437c478bd9Sstevel@tonic-gate };
1447c478bd9Sstevel@tonic-gate 
1457c478bd9Sstevel@tonic-gate struct mech_alias {
1467c478bd9Sstevel@tonic-gate 	CK_MECHANISM_TYPE type;
1477c478bd9Sstevel@tonic-gate 	char *alias;
1487c478bd9Sstevel@tonic-gate 	CK_ULONG keysize_min;
1497c478bd9Sstevel@tonic-gate 	CK_ULONG keysize_max;
1507c478bd9Sstevel@tonic-gate 	int keysize_unit;
1517c478bd9Sstevel@tonic-gate 	int ivlen;
1527c478bd9Sstevel@tonic-gate 	boolean_t available;
1537c478bd9Sstevel@tonic-gate };
1547c478bd9Sstevel@tonic-gate 
1557c478bd9Sstevel@tonic-gate #define	MECH_ALIASES_COUNT 4
1567c478bd9Sstevel@tonic-gate 
1577c478bd9Sstevel@tonic-gate static struct mech_alias mech_aliases[] = {
1587c478bd9Sstevel@tonic-gate 	{ CKM_AES_CBC_PAD, "aes", ULONG_MAX, 0L, 8, 16, B_FALSE },
1597c478bd9Sstevel@tonic-gate 	{ CKM_RC4, "arcfour", ULONG_MAX, 0L, 1, 0, B_FALSE },
1607c478bd9Sstevel@tonic-gate 	{ CKM_DES_CBC_PAD, "des", 8, 8, 8, 8, B_FALSE },
1617c478bd9Sstevel@tonic-gate 	{ CKM_DES3_CBC_PAD, "3des", 24, 24, 8, 8, B_FALSE },
1627c478bd9Sstevel@tonic-gate };
1637c478bd9Sstevel@tonic-gate 
1647c478bd9Sstevel@tonic-gate static CK_BBOOL truevalue = TRUE;
1657c478bd9Sstevel@tonic-gate static CK_BBOOL falsevalue = FALSE;
1667c478bd9Sstevel@tonic-gate 
1677c478bd9Sstevel@tonic-gate static boolean_t aflag = B_FALSE; /* -a <algorithm> flag, required */
1687c478bd9Sstevel@tonic-gate static boolean_t kflag = B_FALSE; /* -k <keyfile> flag */
1697c478bd9Sstevel@tonic-gate static boolean_t iflag = B_FALSE; /* -i <infile> flag, use stdin if absent */
1707c478bd9Sstevel@tonic-gate static boolean_t oflag = B_FALSE; /* -o <outfile> flag, use stdout if absent */
1717c478bd9Sstevel@tonic-gate static boolean_t lflag = B_FALSE; /* -l flag (list) */
1727c478bd9Sstevel@tonic-gate static boolean_t vflag = B_FALSE; /* -v flag (verbose) */
173b54157c1Sda static boolean_t Tflag = B_FALSE; /* -T flag (tokenspec) */
174b54157c1Sda static boolean_t Kflag = B_FALSE; /* -K flag (keylabel) */
1757c478bd9Sstevel@tonic-gate 
176b54157c1Sda static char *keyfile = NULL;	 /* name of keyfile */
177b54157c1Sda static char *inputfile = NULL;	 /* name of input file */
178b54157c1Sda static char *outputfile = NULL;	 /* name of output file */
179b54157c1Sda static char *token_label = NULL; /* name of PKCS#11 token */
180b54157c1Sda static char *key_label = NULL;   /* name of PKCS#11 token key label */
1817c478bd9Sstevel@tonic-gate 
1827c478bd9Sstevel@tonic-gate static int status_pos = 0; /* current position of progress bar element */
1837c478bd9Sstevel@tonic-gate 
1847c478bd9Sstevel@tonic-gate /*
1857c478bd9Sstevel@tonic-gate  * function prototypes
1867c478bd9Sstevel@tonic-gate  */
1877c478bd9Sstevel@tonic-gate static void usage(struct CommandInfo *cmd);
1887c478bd9Sstevel@tonic-gate static int execute_cmd(struct CommandInfo *cmd, char *algo_str);
1897c478bd9Sstevel@tonic-gate static int crypt_multipart(struct CommandInfo *cmd, CK_SESSION_HANDLE hSession,
19054da5c1fSjk 	int infd, int outfd, off_t insize);
1917c478bd9Sstevel@tonic-gate 
1927c478bd9Sstevel@tonic-gate int
main(int argc,char ** argv)1937c478bd9Sstevel@tonic-gate main(int argc, char **argv)
1947c478bd9Sstevel@tonic-gate {
1957c478bd9Sstevel@tonic-gate 
1967c478bd9Sstevel@tonic-gate 	extern char *optarg;
1977c478bd9Sstevel@tonic-gate 	extern int optind;
1987c478bd9Sstevel@tonic-gate 	char *optstr;
199*ef150c2bSRichard Lowe 	int c;			/* current getopts flag */
2007c478bd9Sstevel@tonic-gate 	char *algo_str = NULL;	/* algorithm string */
2017c478bd9Sstevel@tonic-gate 	struct CommandInfo *cmd;
2027c478bd9Sstevel@tonic-gate 	char *cmdname;		/* name of command */
2037c478bd9Sstevel@tonic-gate 	boolean_t errflag = B_FALSE;
2047c478bd9Sstevel@tonic-gate 
2057c478bd9Sstevel@tonic-gate 	(void) setlocale(LC_ALL, "");
206b54157c1Sda #if !defined(TEXT_DOMAIN)	/* Should be defined by cc -D */
2077c478bd9Sstevel@tonic-gate #define	TEXT_DOMAIN "SYS_TEST"	/* Use this only if it weren't */
2087c478bd9Sstevel@tonic-gate #endif
2097c478bd9Sstevel@tonic-gate 	(void) textdomain(TEXT_DOMAIN);
2107c478bd9Sstevel@tonic-gate 
2117c478bd9Sstevel@tonic-gate 	/*
2127c478bd9Sstevel@tonic-gate 	 * Based on command name, determine
2137c478bd9Sstevel@tonic-gate 	 * type of command.
2147c478bd9Sstevel@tonic-gate 	 */
2157c478bd9Sstevel@tonic-gate 	cmdname = basename(argv[0]);
2167c478bd9Sstevel@tonic-gate 
2177c478bd9Sstevel@tonic-gate 	cryptodebug_init(cmdname);
2187c478bd9Sstevel@tonic-gate 
2197c478bd9Sstevel@tonic-gate 	if (strcmp(cmdname, encrypt_cmd.name) == 0) {
2207c478bd9Sstevel@tonic-gate 		cmd = &encrypt_cmd;
2217c478bd9Sstevel@tonic-gate 	} else if (strcmp(cmdname, decrypt_cmd.name) == 0) {
2227c478bd9Sstevel@tonic-gate 		cmd = &decrypt_cmd;
2237c478bd9Sstevel@tonic-gate 	} else {
2247c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext(
2257c478bd9Sstevel@tonic-gate 		    "command name must be either encrypt or decrypt"));
2267c478bd9Sstevel@tonic-gate 		exit(EXIT_USAGE);
2277c478bd9Sstevel@tonic-gate 	}
2287c478bd9Sstevel@tonic-gate 
2297c478bd9Sstevel@tonic-gate 	optstr = cmd->options;
2307c478bd9Sstevel@tonic-gate 
2317c478bd9Sstevel@tonic-gate 	/* Parse command line arguments */
2327c478bd9Sstevel@tonic-gate 	while (!errflag && (c = getopt(argc, argv, optstr)) != -1) {
2337c478bd9Sstevel@tonic-gate 
2347c478bd9Sstevel@tonic-gate 		switch (c) {
2357c478bd9Sstevel@tonic-gate 		case 'a':
2367c478bd9Sstevel@tonic-gate 			aflag = B_TRUE;
2377c478bd9Sstevel@tonic-gate 			algo_str = optarg;
2387c478bd9Sstevel@tonic-gate 			break;
2397c478bd9Sstevel@tonic-gate 		case 'k':
2407c478bd9Sstevel@tonic-gate 			kflag = B_TRUE;
2417c478bd9Sstevel@tonic-gate 			keyfile = optarg;
2427c478bd9Sstevel@tonic-gate 			break;
243c197cb9dShylee 		case 'T':
244c197cb9dShylee 			Tflag = B_TRUE;
245c197cb9dShylee 			token_label = optarg;
246c197cb9dShylee 			break;
247c197cb9dShylee 		case 'K':
248c197cb9dShylee 			Kflag = B_TRUE;
249c197cb9dShylee 			key_label = optarg;
250c197cb9dShylee 			break;
2517c478bd9Sstevel@tonic-gate 		case 'i':
2527c478bd9Sstevel@tonic-gate 			iflag = B_TRUE;
2537c478bd9Sstevel@tonic-gate 			inputfile = optarg;
2547c478bd9Sstevel@tonic-gate 			break;
2557c478bd9Sstevel@tonic-gate 		case 'o':
2567c478bd9Sstevel@tonic-gate 			oflag = B_TRUE;
2577c478bd9Sstevel@tonic-gate 			outputfile = optarg;
2587c478bd9Sstevel@tonic-gate 			break;
2597c478bd9Sstevel@tonic-gate 		case 'l':
2607c478bd9Sstevel@tonic-gate 			lflag = B_TRUE;
2617c478bd9Sstevel@tonic-gate 			break;
2627c478bd9Sstevel@tonic-gate 		case 'v':
2637c478bd9Sstevel@tonic-gate 			vflag = B_TRUE;
2647c478bd9Sstevel@tonic-gate 			break;
2657c478bd9Sstevel@tonic-gate 		default:
2667c478bd9Sstevel@tonic-gate 			errflag = B_TRUE;
2677c478bd9Sstevel@tonic-gate 		}
2687c478bd9Sstevel@tonic-gate 	}
2697c478bd9Sstevel@tonic-gate 
2707c478bd9Sstevel@tonic-gate 	if (errflag || (!aflag && !lflag) || (lflag && argc > 2) ||
271c197cb9dShylee 	    (kflag && Kflag) || (Tflag && !Kflag) ||
2727c478bd9Sstevel@tonic-gate 	    (optind < argc)) {
2737c478bd9Sstevel@tonic-gate 		usage(cmd);
2747c478bd9Sstevel@tonic-gate 		exit(EXIT_USAGE);
2757c478bd9Sstevel@tonic-gate 	}
2767c478bd9Sstevel@tonic-gate 
2777c478bd9Sstevel@tonic-gate 	return (execute_cmd(cmd, algo_str));
2787c478bd9Sstevel@tonic-gate }
2797c478bd9Sstevel@tonic-gate 
2807c478bd9Sstevel@tonic-gate /*
2817c478bd9Sstevel@tonic-gate  * usage message
2827c478bd9Sstevel@tonic-gate  */
2837c478bd9Sstevel@tonic-gate static void
usage(struct CommandInfo * cmd)2847c478bd9Sstevel@tonic-gate usage(struct CommandInfo *cmd)
2857c478bd9Sstevel@tonic-gate {
286c197cb9dShylee 	(void) fprintf(stderr, gettext("Usage:\n"));
2877c478bd9Sstevel@tonic-gate 	if (cmd->type == CKA_ENCRYPT) {
288c197cb9dShylee 		(void) fprintf(stderr, gettext("  encrypt -l\n"));
289c197cb9dShylee 		(void) fprintf(stderr, gettext("  encrypt -a <algorithm> "
290c197cb9dShylee 		    "[-v] [-k <keyfile> | -K <keylabel> [-T <tokenspec>]] "
291c197cb9dShylee 		    "[-i <infile>] [-o <outfile>]\n"));
292c197cb9dShylee 
2937c478bd9Sstevel@tonic-gate 	} else {
294c197cb9dShylee 		(void) fprintf(stderr, gettext("  decrypt -l\n"));
295c197cb9dShylee 		(void) fprintf(stderr, gettext("  decrypt -a <algorithm> "
296c197cb9dShylee 		    "[-v] [-k <keyfile> | -K <keylabel> [-T <tokenspec>]] "
297c197cb9dShylee 		    "[-i <infile>] [-o <outfile>]\n"));
2987c478bd9Sstevel@tonic-gate 	}
2997c478bd9Sstevel@tonic-gate }
3007c478bd9Sstevel@tonic-gate 
3017c478bd9Sstevel@tonic-gate /*
3027c478bd9Sstevel@tonic-gate  * Print out list of algorithms in default and verbose mode
3037c478bd9Sstevel@tonic-gate  */
3047c478bd9Sstevel@tonic-gate static void
algorithm_list()3057c478bd9Sstevel@tonic-gate algorithm_list()
3067c478bd9Sstevel@tonic-gate {
3077c478bd9Sstevel@tonic-gate 	int mech;
3087c478bd9Sstevel@tonic-gate 
3097c478bd9Sstevel@tonic-gate 	(void) printf(gettext("Algorithm       Keysize:  Min   Max (bits)\n"
3107c478bd9Sstevel@tonic-gate 	    "------------------------------------------\n"));
3117c478bd9Sstevel@tonic-gate 
3127c478bd9Sstevel@tonic-gate 	for (mech = 0; mech < MECH_ALIASES_COUNT; mech++) {
3137c478bd9Sstevel@tonic-gate 
3147c478bd9Sstevel@tonic-gate 		if (mech_aliases[mech].available == B_FALSE)
3157c478bd9Sstevel@tonic-gate 			continue;
3167c478bd9Sstevel@tonic-gate 
3177c478bd9Sstevel@tonic-gate 		(void) printf("%-15s", mech_aliases[mech].alias);
3187c478bd9Sstevel@tonic-gate 
3197c478bd9Sstevel@tonic-gate 		if (mech_aliases[mech].keysize_min != UINT_MAX &&
3207c478bd9Sstevel@tonic-gate 		    mech_aliases[mech].keysize_max != 0)
3217c478bd9Sstevel@tonic-gate 			(void) printf("         %5lu %5lu\n",
3227c478bd9Sstevel@tonic-gate 			    (mech_aliases[mech].keysize_min *
32330a5e8faSwyllys 			    mech_aliases[mech].keysize_unit),
3247c478bd9Sstevel@tonic-gate 			    (mech_aliases[mech].keysize_max *
32530a5e8faSwyllys 			    mech_aliases[mech].keysize_unit));
3267c478bd9Sstevel@tonic-gate 		else
3277c478bd9Sstevel@tonic-gate 			(void) printf("\n");
3287c478bd9Sstevel@tonic-gate 
3297c478bd9Sstevel@tonic-gate 	}
3307c478bd9Sstevel@tonic-gate }
3317c478bd9Sstevel@tonic-gate 
332c197cb9dShylee /*
333c197cb9dShylee  * This function will login into the token with the provided password and
334c197cb9dShylee  * find the token key object with the specified keytype and keylabel.
335c197cb9dShylee  */
336c197cb9dShylee static int
get_token_key(CK_SESSION_HANDLE hSession,CK_KEY_TYPE keytype,char * keylabel,CK_BYTE * password,int password_len,CK_OBJECT_HANDLE * keyobj)337c197cb9dShylee get_token_key(CK_SESSION_HANDLE hSession, CK_KEY_TYPE keytype,
338c197cb9dShylee     char *keylabel, CK_BYTE *password, int password_len,
339c197cb9dShylee     CK_OBJECT_HANDLE *keyobj)
340c197cb9dShylee {
341c197cb9dShylee 	CK_RV	rv;
342c197cb9dShylee 	CK_ATTRIBUTE pTmpl[10];
343c197cb9dShylee 	CK_OBJECT_CLASS class = CKO_SECRET_KEY;
344c197cb9dShylee 	CK_BBOOL true = 1;
345c197cb9dShylee 	CK_BBOOL is_token = 1;
346c197cb9dShylee 	CK_ULONG key_obj_count = 1;
347c197cb9dShylee 	int i;
348c197cb9dShylee 	CK_KEY_TYPE ckKeyType = keytype;
349c197cb9dShylee 
350c197cb9dShylee 
351c197cb9dShylee 	rv = C_Login(hSession, CKU_USER, (CK_UTF8CHAR_PTR)password,
352c197cb9dShylee 	    (CK_ULONG)password_len);
353c197cb9dShylee 	if (rv != CKR_OK) {
354c197cb9dShylee 		(void) fprintf(stderr, "Cannot login to the token."
355c197cb9dShylee 		    " error = %s\n", pkcs11_strerror(rv));
356c197cb9dShylee 		return (-1);
357c197cb9dShylee 	}
358c197cb9dShylee 
359c197cb9dShylee 	i = 0;
360c197cb9dShylee 	pTmpl[i].type = CKA_TOKEN;
361c197cb9dShylee 	pTmpl[i].pValue = &is_token;
362c197cb9dShylee 	pTmpl[i].ulValueLen = sizeof (CK_BBOOL);
363c197cb9dShylee 	i++;
364c197cb9dShylee 
365c197cb9dShylee 	pTmpl[i].type = CKA_CLASS;
366c197cb9dShylee 	pTmpl[i].pValue = &class;
367c197cb9dShylee 	pTmpl[i].ulValueLen = sizeof (class);
368c197cb9dShylee 	i++;
369c197cb9dShylee 
370c197cb9dShylee 	pTmpl[i].type = CKA_LABEL;
371c197cb9dShylee 	pTmpl[i].pValue = keylabel;
372c197cb9dShylee 	pTmpl[i].ulValueLen = strlen(keylabel);
373c197cb9dShylee 	i++;
374c197cb9dShylee 
375c197cb9dShylee 	pTmpl[i].type = CKA_KEY_TYPE;
376c197cb9dShylee 	pTmpl[i].pValue = &ckKeyType;
377c197cb9dShylee 	pTmpl[i].ulValueLen = sizeof (ckKeyType);
378c197cb9dShylee 	i++;
379c197cb9dShylee 
380c197cb9dShylee 	pTmpl[i].type = CKA_PRIVATE;
381c197cb9dShylee 	pTmpl[i].pValue = &true;
382c197cb9dShylee 	pTmpl[i].ulValueLen = sizeof (true);
383c197cb9dShylee 	i++;
384c197cb9dShylee 
385c197cb9dShylee 	rv = C_FindObjectsInit(hSession, pTmpl, i);
386c197cb9dShylee 	if (rv != CKR_OK) {
387c197cb9dShylee 		goto out;
388c197cb9dShylee 	}
389c197cb9dShylee 
390c197cb9dShylee 	rv = C_FindObjects(hSession, keyobj, 1, &key_obj_count);
391c197cb9dShylee 
392c197cb9dShylee 	(void) C_FindObjectsFinal(hSession);
393c197cb9dShylee 
394c197cb9dShylee out:
395c197cb9dShylee 	if (rv != CKR_OK) {
396c197cb9dShylee 		(void) fprintf(stderr,
397c197cb9dShylee 		    "Cannot retrieve key object. error = %s\n",
398c197cb9dShylee 		    pkcs11_strerror(rv));
399c197cb9dShylee 		return (-1);
400c197cb9dShylee 	}
401c197cb9dShylee 
402c197cb9dShylee 	if (key_obj_count == 0) {
403c197cb9dShylee 		(void) fprintf(stderr, "Cannot find the key object.\n");
404c197cb9dShylee 		return (-1);
405c197cb9dShylee 	}
406c197cb9dShylee 
407c197cb9dShylee 	return (0);
408c197cb9dShylee }
409c197cb9dShylee 
4107c478bd9Sstevel@tonic-gate 
4117c478bd9Sstevel@tonic-gate /*
4127c478bd9Sstevel@tonic-gate  * Execute the command.
4137c478bd9Sstevel@tonic-gate  *   cmd - command pointing to type of operation.
4147c478bd9Sstevel@tonic-gate  *   algo_str - alias of the algorithm passed.
4157c478bd9Sstevel@tonic-gate  */
4167c478bd9Sstevel@tonic-gate static int
execute_cmd(struct CommandInfo * cmd,char * algo_str)4177c478bd9Sstevel@tonic-gate execute_cmd(struct CommandInfo *cmd, char *algo_str)
4187c478bd9Sstevel@tonic-gate {
4197c478bd9Sstevel@tonic-gate 	CK_RV rv;
4207c478bd9Sstevel@tonic-gate 	CK_ULONG slotcount;
4217c478bd9Sstevel@tonic-gate 	CK_SLOT_ID slotID;
4227c478bd9Sstevel@tonic-gate 	CK_SLOT_ID_PTR pSlotList = NULL;
4237c478bd9Sstevel@tonic-gate 	CK_MECHANISM_TYPE mech_type = 0;
4247c478bd9Sstevel@tonic-gate 	CK_MECHANISM_INFO info, kg_info;
4257c478bd9Sstevel@tonic-gate 	CK_MECHANISM mech;
4267c478bd9Sstevel@tonic-gate 	CK_SESSION_HANDLE hSession = CK_INVALID_HANDLE;
4277c478bd9Sstevel@tonic-gate 	CK_BYTE_PTR	pkeydata = NULL;
4281c9bd843Sdinak 	CK_BYTE		salt[CK_PKCS5_PBKD2_SALT_SIZE];
4297c478bd9Sstevel@tonic-gate 	CK_ULONG	keysize = 0;
4307c478bd9Sstevel@tonic-gate 	int i, slot, mek;		/* index variables */
4317c478bd9Sstevel@tonic-gate 	int status;
4327c478bd9Sstevel@tonic-gate 	struct stat	insbuf;		/* stat buf for infile */
4337c478bd9Sstevel@tonic-gate 	struct stat	outsbuf;	/* stat buf for outfile */
4347c478bd9Sstevel@tonic-gate 	char	tmpnam[PATH_MAX];	/* tmp file name */
4357c478bd9Sstevel@tonic-gate 	CK_OBJECT_HANDLE key = (CK_OBJECT_HANDLE) 0;
4367c478bd9Sstevel@tonic-gate 	int infd = 0;			/* input file, stdin default */
4377c478bd9Sstevel@tonic-gate 	int outfd = 1;			/* output file, stdout default */
4387c478bd9Sstevel@tonic-gate 	char *outfilename = NULL;
4397c478bd9Sstevel@tonic-gate 	boolean_t errflag = B_TRUE;
4407c478bd9Sstevel@tonic-gate 	boolean_t inoutsame = B_FALSE;	/* if both input & output are same */
4419a2817adSValerie Bubb Fenwick 	boolean_t leavefilealone = B_FALSE;
4427c478bd9Sstevel@tonic-gate 	CK_BYTE_PTR	pivbuf = NULL_PTR;
4437c478bd9Sstevel@tonic-gate 	CK_ULONG	ivlen = 0L;
444b54157c1Sda 	int		mech_match = 0;
445b54157c1Sda 	uint32_t	iterations = CK_PKCS5_PBKD2_ITERATIONS;
4467c478bd9Sstevel@tonic-gate 	CK_ULONG	keylen;
447b54157c1Sda 	uint32_t	version = SUNW_ENCRYPT_FILE_VERSION;
4487c478bd9Sstevel@tonic-gate 	CK_KEY_TYPE keytype;
449c197cb9dShylee 	KMF_RETURN kmfrv;
450c197cb9dShylee 	CK_SLOT_ID token_slot_id;
4517c478bd9Sstevel@tonic-gate 
4527c478bd9Sstevel@tonic-gate 	if (aflag) {
4537c478bd9Sstevel@tonic-gate 		/* Determine if algorithm is valid */
4547c478bd9Sstevel@tonic-gate 		for (mech_match = 0; mech_match < MECH_ALIASES_COUNT;
45530a5e8faSwyllys 		    mech_match++) {
4567c478bd9Sstevel@tonic-gate 			if (strcmp(algo_str,
4577c478bd9Sstevel@tonic-gate 			    mech_aliases[mech_match].alias) == 0) {
4587c478bd9Sstevel@tonic-gate 				mech_type = mech_aliases[mech_match].type;
4597c478bd9Sstevel@tonic-gate 				break;
4607c478bd9Sstevel@tonic-gate 			}
4617c478bd9Sstevel@tonic-gate 		}
4627c478bd9Sstevel@tonic-gate 
4637c478bd9Sstevel@tonic-gate 		if (mech_match == MECH_ALIASES_COUNT) {
4647c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_STDERR,
4657c478bd9Sstevel@tonic-gate 			    gettext("unknown algorithm -- %s"), algo_str);
4667c478bd9Sstevel@tonic-gate 			return (EXIT_FAILURE);
4677c478bd9Sstevel@tonic-gate 		}
4687c478bd9Sstevel@tonic-gate 
4697c478bd9Sstevel@tonic-gate 		/*
470c197cb9dShylee 		 * Process keyfile or get the token pin if -K is specified.
4717c478bd9Sstevel@tonic-gate 		 *
4727c478bd9Sstevel@tonic-gate 		 * If a keyfile is provided, get the key data from
4737c478bd9Sstevel@tonic-gate 		 * the file. Otherwise, prompt for a passphrase. The
4747c478bd9Sstevel@tonic-gate 		 * passphrase is used as the key data.
4757c478bd9Sstevel@tonic-gate 		 */
476c197cb9dShylee 		if (Kflag) {
477c197cb9dShylee 			/* get the pin of the token */
478c197cb9dShylee 			if (token_label == NULL || !strlen(token_label)) {
4791c9bd843Sdinak 				token_label = pkcs11_default_token();
480c197cb9dShylee 			}
481c197cb9dShylee 
4821c9bd843Sdinak 			status = pkcs11_get_pass(token_label,
4831c9bd843Sdinak 			    (char **)&pkeydata, (size_t *)&keysize, 0, B_FALSE);
484c197cb9dShylee 		} else if (kflag) {
485c197cb9dShylee 			/* get the key file */
4861c9bd843Sdinak 			status = pkcs11_read_data(keyfile, (void **)&pkeydata,
4871c9bd843Sdinak 			    (size_t *)&keysize);
4887c478bd9Sstevel@tonic-gate 		} else {
489c197cb9dShylee 			/* get the key from input */
4901c9bd843Sdinak 			status = pkcs11_get_pass(NULL, (char **)&pkeydata,
491c545f712SDina K Nimeh 			    (size_t *)&keysize, 0,
492c545f712SDina K Nimeh 			    (cmd->type == CKA_ENCRYPT) ? B_TRUE : B_FALSE);
4937c478bd9Sstevel@tonic-gate 		}
4947c478bd9Sstevel@tonic-gate 
495a7e661a2SAnthony Scarpino 		if (status != 0 || keysize == 0L) {
496c197cb9dShylee 			cryptoerror(LOG_STDERR,
497c545f712SDina K Nimeh 			    kflag ? gettext("invalid key.") :
498c545f712SDina K Nimeh 			    gettext("invalid passphrase."));
4997c478bd9Sstevel@tonic-gate 			return (EXIT_FAILURE);
5007c478bd9Sstevel@tonic-gate 		}
5017c478bd9Sstevel@tonic-gate 	}
5027c478bd9Sstevel@tonic-gate 
5037c478bd9Sstevel@tonic-gate 	bzero(salt, sizeof (salt));
5047c478bd9Sstevel@tonic-gate 	/* Initialize pkcs */
505c197cb9dShylee 	rv = C_Initialize(NULL);
506c197cb9dShylee 	if (rv != CKR_OK && rv != CKR_CRYPTOKI_ALREADY_INITIALIZED) {
5077c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("failed to initialize "
5087c478bd9Sstevel@tonic-gate 		    "PKCS #11 framework: %s"), pkcs11_strerror(rv));
5097c478bd9Sstevel@tonic-gate 		goto cleanup;
5107c478bd9Sstevel@tonic-gate 	}
5117c478bd9Sstevel@tonic-gate 
5127c478bd9Sstevel@tonic-gate 	/* Get slot count */
5137c478bd9Sstevel@tonic-gate 	rv = C_GetSlotList(0, NULL_PTR, &slotcount);
5147c478bd9Sstevel@tonic-gate 	if (rv != CKR_OK || slotcount == 0) {
5157c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext(
5167c478bd9Sstevel@tonic-gate 		    "failed to find any cryptographic provider,"
5177c478bd9Sstevel@tonic-gate 		    "please check with your system administrator: %s"),
5187c478bd9Sstevel@tonic-gate 		    pkcs11_strerror(rv));
5197c478bd9Sstevel@tonic-gate 		goto cleanup;
5207c478bd9Sstevel@tonic-gate 	}
5217c478bd9Sstevel@tonic-gate 
5227c478bd9Sstevel@tonic-gate 	/* Found at least one slot, allocate memory for slot list */
5237c478bd9Sstevel@tonic-gate 	pSlotList = malloc(slotcount * sizeof (CK_SLOT_ID));
5247c478bd9Sstevel@tonic-gate 	if (pSlotList == NULL_PTR) {
5257c478bd9Sstevel@tonic-gate 		int err = errno;
5267c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("malloc: %s"), strerror(err));
5277c478bd9Sstevel@tonic-gate 		goto cleanup;
5287c478bd9Sstevel@tonic-gate 	}
5297c478bd9Sstevel@tonic-gate 
5307c478bd9Sstevel@tonic-gate 	/* Get the list of slots */
5317c478bd9Sstevel@tonic-gate 	if ((rv = C_GetSlotList(0, pSlotList, &slotcount)) != CKR_OK) {
5327c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext(
5337c478bd9Sstevel@tonic-gate 		    "failed to find any cryptographic provider,"
5347c478bd9Sstevel@tonic-gate 		    "please check with your system administrator: %s"),
5357c478bd9Sstevel@tonic-gate 		    pkcs11_strerror(rv));
5367c478bd9Sstevel@tonic-gate 		goto cleanup;
5377c478bd9Sstevel@tonic-gate 	}
5387c478bd9Sstevel@tonic-gate 
5397c478bd9Sstevel@tonic-gate 	if (lflag) {
5407c478bd9Sstevel@tonic-gate 
5417c478bd9Sstevel@tonic-gate 		/* Iterate through slots */
5427c478bd9Sstevel@tonic-gate 		for (slot = 0; slot < slotcount; slot++) {
5437c478bd9Sstevel@tonic-gate 
5447c478bd9Sstevel@tonic-gate 			/* Iterate through each mechanism */
5457c478bd9Sstevel@tonic-gate 			for (mek = 0; mek < MECH_ALIASES_COUNT; mek++) {
5467c478bd9Sstevel@tonic-gate 				rv = C_GetMechanismInfo(pSlotList[slot],
5477c478bd9Sstevel@tonic-gate 				    mech_aliases[mek].type, &info);
5487c478bd9Sstevel@tonic-gate 
5497c478bd9Sstevel@tonic-gate 				if (rv != CKR_OK)
5507c478bd9Sstevel@tonic-gate 					continue;
5517c478bd9Sstevel@tonic-gate 
5527c478bd9Sstevel@tonic-gate 				/*
5537c478bd9Sstevel@tonic-gate 				 * Set to minimum/maximum key sizes assuming
5547c478bd9Sstevel@tonic-gate 				 * the values available are not 0.
5557c478bd9Sstevel@tonic-gate 				 */
5567c478bd9Sstevel@tonic-gate 				if (info.ulMinKeySize && (info.ulMinKeySize <
5577c478bd9Sstevel@tonic-gate 				    mech_aliases[mek].keysize_min))
5587c478bd9Sstevel@tonic-gate 					mech_aliases[mek].keysize_min =
55930a5e8faSwyllys 					    info.ulMinKeySize;
5607c478bd9Sstevel@tonic-gate 
5617c478bd9Sstevel@tonic-gate 				if (info.ulMaxKeySize && (info.ulMaxKeySize >
5627c478bd9Sstevel@tonic-gate 				    mech_aliases[mek].keysize_max))
5637c478bd9Sstevel@tonic-gate 					mech_aliases[mek].keysize_max =
56430a5e8faSwyllys 					    info.ulMaxKeySize;
5657c478bd9Sstevel@tonic-gate 
5667c478bd9Sstevel@tonic-gate 				mech_aliases[mek].available = B_TRUE;
5677c478bd9Sstevel@tonic-gate 			}
5687c478bd9Sstevel@tonic-gate 
5697c478bd9Sstevel@tonic-gate 		}
5707c478bd9Sstevel@tonic-gate 
5717c478bd9Sstevel@tonic-gate 		algorithm_list();
5727c478bd9Sstevel@tonic-gate 
5737c478bd9Sstevel@tonic-gate 		errflag = B_FALSE;
5747c478bd9Sstevel@tonic-gate 		goto cleanup;
5757c478bd9Sstevel@tonic-gate 	}
5767c478bd9Sstevel@tonic-gate 
577c197cb9dShylee 
578c197cb9dShylee 	/*
579c197cb9dShylee 	 * Find a slot with matching mechanism
580c197cb9dShylee 	 *
581c197cb9dShylee 	 * If -K is specified, we find the slot id for the token first, then
582c197cb9dShylee 	 * check if the slot supports the algorithm.
583c197cb9dShylee 	 */
584c197cb9dShylee 	i = 0;
585c197cb9dShylee 	if (Kflag) {
58630a5e8faSwyllys 		kmfrv = kmf_pk11_token_lookup(NULL, token_label,
58730a5e8faSwyllys 		    &token_slot_id);
588c197cb9dShylee 		if (kmfrv != KMF_OK) {
589c197cb9dShylee 			cryptoerror(LOG_STDERR,
590c197cb9dShylee 			    gettext("no matching PKCS#11 token"));
591c197cb9dShylee 			errflag = B_TRUE;
592c197cb9dShylee 			goto cleanup;
593c197cb9dShylee 		}
594c197cb9dShylee 		rv = C_GetMechanismInfo(token_slot_id, mech_type, &info);
595c197cb9dShylee 		if (rv == CKR_OK && (info.flags & cmd->flags))
596c197cb9dShylee 			slotID = token_slot_id;
597c197cb9dShylee 		else
598c197cb9dShylee 			i = slotcount;
599c197cb9dShylee 	} else {
600c197cb9dShylee 		for (i = 0; i < slotcount; i++) {
601c197cb9dShylee 			slotID = pSlotList[i];
602c197cb9dShylee 			rv = C_GetMechanismInfo(slotID, mech_type, &info);
603c197cb9dShylee 			if (rv != CKR_OK) {
604c197cb9dShylee 				continue; /* to the next slot */
605c197cb9dShylee 			} else {
606c197cb9dShylee 				/*
607c197cb9dShylee 				 * If the slot support the crypto, also
608c197cb9dShylee 				 * make sure it supports the correct
609c197cb9dShylee 				 * key generation mech if needed.
610c197cb9dShylee 				 *
611c197cb9dShylee 				 * We need PKCS5 when RC4 is used or
612c197cb9dShylee 				 * when the key is entered on cmd line.
613c197cb9dShylee 				 */
614c197cb9dShylee 				if ((info.flags & cmd->flags) &&
615c197cb9dShylee 				    (mech_type == CKM_RC4) ||
616c197cb9dShylee 				    (keyfile == NULL)) {
617c197cb9dShylee 					rv = C_GetMechanismInfo(slotID,
618c197cb9dShylee 					    CKM_PKCS5_PBKD2, &kg_info);
619c197cb9dShylee 					if (rv == CKR_OK)
620c197cb9dShylee 						break;
621c197cb9dShylee 				} else if (info.flags & cmd->flags) {
6227c478bd9Sstevel@tonic-gate 					break;
623c197cb9dShylee 				}
6247c478bd9Sstevel@tonic-gate 			}
6257c478bd9Sstevel@tonic-gate 		}
6267c478bd9Sstevel@tonic-gate 	}
6277c478bd9Sstevel@tonic-gate 
6287c478bd9Sstevel@tonic-gate 	/* Show error if no matching mechanism found */
6297c478bd9Sstevel@tonic-gate 	if (i == slotcount) {
6307c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
6317c478bd9Sstevel@tonic-gate 		    gettext("no cryptographic provider was "
6327c478bd9Sstevel@tonic-gate 		    "found for this algorithm -- %s"), algo_str);
6337c478bd9Sstevel@tonic-gate 		goto cleanup;
6347c478bd9Sstevel@tonic-gate 	}
6357c478bd9Sstevel@tonic-gate 
6367c478bd9Sstevel@tonic-gate 	/* Open a session */
6377c478bd9Sstevel@tonic-gate 	rv = C_OpenSession(slotID, CKF_SERIAL_SESSION,
63830a5e8faSwyllys 	    NULL_PTR, NULL, &hSession);
6397c478bd9Sstevel@tonic-gate 
6407c478bd9Sstevel@tonic-gate 	if (rv != CKR_OK) {
6417c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
6427c478bd9Sstevel@tonic-gate 		    gettext("can not open PKCS #11 session: %s"),
6437c478bd9Sstevel@tonic-gate 		    pkcs11_strerror(rv));
6447c478bd9Sstevel@tonic-gate 		goto cleanup;
6457c478bd9Sstevel@tonic-gate 	}
6467c478bd9Sstevel@tonic-gate 
6477c478bd9Sstevel@tonic-gate 	/*
6487c478bd9Sstevel@tonic-gate 	 * Generate IV data for encrypt.
6497c478bd9Sstevel@tonic-gate 	 */
6507c478bd9Sstevel@tonic-gate 	ivlen = mech_aliases[mech_match].ivlen;
6517c478bd9Sstevel@tonic-gate 	if ((pivbuf = malloc((size_t)ivlen)) == NULL) {
6527c478bd9Sstevel@tonic-gate 		int err = errno;
6537c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("malloc: %s"),
6547c478bd9Sstevel@tonic-gate 		    strerror(err));
6557c478bd9Sstevel@tonic-gate 		goto cleanup;
6567c478bd9Sstevel@tonic-gate 	}
6577c478bd9Sstevel@tonic-gate 
6587c478bd9Sstevel@tonic-gate 	if (cmd->type == CKA_ENCRYPT) {
6597b79d846SDina K Nimeh 		if ((pkcs11_get_urandom((void *)pivbuf,
6607c478bd9Sstevel@tonic-gate 		    mech_aliases[mech_match].ivlen)) != 0) {
6617c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext(
66230a5e8faSwyllys 			    "Unable to generate random "
66330a5e8faSwyllys 			    "data for initialization vector."));
6647c478bd9Sstevel@tonic-gate 			goto cleanup;
6657c478bd9Sstevel@tonic-gate 		}
6667c478bd9Sstevel@tonic-gate 	}
6677c478bd9Sstevel@tonic-gate 
6687c478bd9Sstevel@tonic-gate 	/*
6697c478bd9Sstevel@tonic-gate 	 * Create the key object
6707c478bd9Sstevel@tonic-gate 	 */
6717c478bd9Sstevel@tonic-gate 	rv = pkcs11_mech2keytype(mech_type, &keytype);
6727c478bd9Sstevel@tonic-gate 	if (rv != CKR_OK) {
6737c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
67430a5e8faSwyllys 		    gettext("unable to find key type for algorithm."));
6757c478bd9Sstevel@tonic-gate 		goto cleanup;
6767c478bd9Sstevel@tonic-gate 	}
6777c478bd9Sstevel@tonic-gate 
6787c478bd9Sstevel@tonic-gate 	/* Open input file */
6797c478bd9Sstevel@tonic-gate 	if (iflag) {
6807c478bd9Sstevel@tonic-gate 		if ((infd = open(inputfile, O_RDONLY | O_NONBLOCK)) == -1) {
6817c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext(
68230a5e8faSwyllys 			    "can not open input file %s"), inputfile);
6837c478bd9Sstevel@tonic-gate 			goto cleanup;
6847c478bd9Sstevel@tonic-gate 		}
6857c478bd9Sstevel@tonic-gate 
6867c478bd9Sstevel@tonic-gate 		/* Get info on input file */
6877c478bd9Sstevel@tonic-gate 		if (fstat(infd, &insbuf) == -1) {
6887c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext(
68930a5e8faSwyllys 			    "can not stat input file %s"), inputfile);
6907c478bd9Sstevel@tonic-gate 			goto cleanup;
6917c478bd9Sstevel@tonic-gate 		}
6927c478bd9Sstevel@tonic-gate 	}
6937c478bd9Sstevel@tonic-gate 
6947c478bd9Sstevel@tonic-gate 	/*
6957c478bd9Sstevel@tonic-gate 	 * Prepare output file
6967c478bd9Sstevel@tonic-gate 	 * If the input & output file are same,
6977c478bd9Sstevel@tonic-gate 	 * the output is written to a temp
6987c478bd9Sstevel@tonic-gate 	 * file first, then renamed to the original file
6997c478bd9Sstevel@tonic-gate 	 * after the crypt operation
7007c478bd9Sstevel@tonic-gate 	 */
7017c478bd9Sstevel@tonic-gate 	inoutsame = B_FALSE;
7027c478bd9Sstevel@tonic-gate 	if (oflag) {
7037c478bd9Sstevel@tonic-gate 		outfilename = outputfile;
7047c478bd9Sstevel@tonic-gate 		if ((stat(outputfile, &outsbuf) != -1) &&
70530a5e8faSwyllys 		    (insbuf.st_ino == outsbuf.st_ino)) {
7067c478bd9Sstevel@tonic-gate 			char *dir;
7077c478bd9Sstevel@tonic-gate 
7087c478bd9Sstevel@tonic-gate 			/* create temp file on same dir */
7097c478bd9Sstevel@tonic-gate 			dir = dirname(outputfile);
7107c478bd9Sstevel@tonic-gate 			(void) snprintf(tmpnam, sizeof (tmpnam),
71130a5e8faSwyllys 			    "%s/encrXXXXXX", dir);
7127c478bd9Sstevel@tonic-gate 			outfilename = tmpnam;
7137c478bd9Sstevel@tonic-gate 			if ((outfd = mkstemp(tmpnam)) == -1) {
7147c478bd9Sstevel@tonic-gate 				cryptoerror(LOG_STDERR, gettext(
7157c478bd9Sstevel@tonic-gate 				    "cannot create temp file"));
7167c478bd9Sstevel@tonic-gate 				goto cleanup;
7177c478bd9Sstevel@tonic-gate 			}
7187c478bd9Sstevel@tonic-gate 			inoutsame = B_TRUE;
7197c478bd9Sstevel@tonic-gate 		} else {
7207c478bd9Sstevel@tonic-gate 			/* Create file for output */
7217c478bd9Sstevel@tonic-gate 			if ((outfd = open(outfilename,
72230a5e8faSwyllys 			    O_CREAT|O_WRONLY|O_TRUNC, 0644)) == -1) {
7237c478bd9Sstevel@tonic-gate 				cryptoerror(LOG_STDERR, gettext(
7247c478bd9Sstevel@tonic-gate 				    "cannot open output file %s"),
7257c478bd9Sstevel@tonic-gate 				    outfilename);
7269a2817adSValerie Bubb Fenwick 				/* Cannot open file, should leave it alone */
7279a2817adSValerie Bubb Fenwick 				leavefilealone = B_TRUE;
7287c478bd9Sstevel@tonic-gate 				goto cleanup;
7297c478bd9Sstevel@tonic-gate 			}
7307c478bd9Sstevel@tonic-gate 		}
7317c478bd9Sstevel@tonic-gate 	}
7327c478bd9Sstevel@tonic-gate 
7337c478bd9Sstevel@tonic-gate 	/*
7347c478bd9Sstevel@tonic-gate 	 * Read the version number from the head of the file
7357c478bd9Sstevel@tonic-gate 	 * to know how to interpret the data that follows.
7367c478bd9Sstevel@tonic-gate 	 */
7377c478bd9Sstevel@tonic-gate 	if (cmd->type == CKA_DECRYPT) {
7387c478bd9Sstevel@tonic-gate 		if (read(infd, &version, sizeof (version)) !=
73930a5e8faSwyllys 		    sizeof (version)) {
7407c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext(
7417c478bd9Sstevel@tonic-gate 			    "failed to get format version from "
7427c478bd9Sstevel@tonic-gate 			    "input file."));
7437c478bd9Sstevel@tonic-gate 			goto cleanup;
7447c478bd9Sstevel@tonic-gate 		}
7457c478bd9Sstevel@tonic-gate 		/* convert to host byte order */
7467c478bd9Sstevel@tonic-gate 		version = ntohl(version);
7477c478bd9Sstevel@tonic-gate 
7487c478bd9Sstevel@tonic-gate 		switch (version) {
7497c478bd9Sstevel@tonic-gate 		case 1:
7507c478bd9Sstevel@tonic-gate 		/*
7517c478bd9Sstevel@tonic-gate 		 * Version 1 output format:
752b54157c1Sda 		 *  - Output format version 1 (4 bytes)
7537c478bd9Sstevel@tonic-gate 		 *  - Iterations used in key gen function (4 bytes)
754b54157c1Sda 		 *  - IV ('ivlen' bytes). The length algorithm-dependent
7557c478bd9Sstevel@tonic-gate 		 *  - Salt data used in key gen (16 bytes)
756b54157c1Sda 		 *  - Cipher text data (remainder of the file)
7577c478bd9Sstevel@tonic-gate 		 *
7587c478bd9Sstevel@tonic-gate 		 * An encrypted file has IV as first block (0 or
7597c478bd9Sstevel@tonic-gate 		 * more bytes depending on mechanism) followed
7607c478bd9Sstevel@tonic-gate 		 * by cipher text.  Get the IV from the encrypted
7617c478bd9Sstevel@tonic-gate 		 * file.
7627c478bd9Sstevel@tonic-gate 		 */
7637c478bd9Sstevel@tonic-gate 			/*
7647c478bd9Sstevel@tonic-gate 			 * Read iteration count and salt data.
7657c478bd9Sstevel@tonic-gate 			 */
7667c478bd9Sstevel@tonic-gate 			if (read(infd, &iterations,
76730a5e8faSwyllys 			    sizeof (iterations)) != sizeof (iterations)) {
7687c478bd9Sstevel@tonic-gate 				cryptoerror(LOG_STDERR, gettext(
76930a5e8faSwyllys 				    "failed to get iterations from "
77030a5e8faSwyllys 				    "input file."));
7717c478bd9Sstevel@tonic-gate 				goto cleanup;
7727c478bd9Sstevel@tonic-gate 			}
7737c478bd9Sstevel@tonic-gate 			/* convert to host byte order */
7747c478bd9Sstevel@tonic-gate 			iterations = ntohl(iterations);
7757c478bd9Sstevel@tonic-gate 			if (ivlen > 0 &&
7767c478bd9Sstevel@tonic-gate 			    read(infd, pivbuf, ivlen) != ivlen) {
7777c478bd9Sstevel@tonic-gate 				cryptoerror(LOG_STDERR, gettext(
7787c478bd9Sstevel@tonic-gate 				    "failed to get initialization "
7797c478bd9Sstevel@tonic-gate 				    "vector from input file."));
7807c478bd9Sstevel@tonic-gate 				goto cleanup;
7817c478bd9Sstevel@tonic-gate 			}
7827c478bd9Sstevel@tonic-gate 			if (read(infd, salt, sizeof (salt))
78330a5e8faSwyllys 			    != sizeof (salt)) {
7847c478bd9Sstevel@tonic-gate 				cryptoerror(LOG_STDERR, gettext(
78530a5e8faSwyllys 				    "failed to get salt data from "
78630a5e8faSwyllys 				    "input file."));
7877c478bd9Sstevel@tonic-gate 				goto cleanup;
7887c478bd9Sstevel@tonic-gate 			}
7897c478bd9Sstevel@tonic-gate 			break;
7907c478bd9Sstevel@tonic-gate 		default:
7917c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext(
79230a5e8faSwyllys 			    "Unrecognized format version read from "
79330a5e8faSwyllys 			    "input file - expected %d, got %d."),
79430a5e8faSwyllys 			    SUNW_ENCRYPT_FILE_VERSION, version);
7957c478bd9Sstevel@tonic-gate 			goto cleanup;
7967c478bd9Sstevel@tonic-gate 		}
7977c478bd9Sstevel@tonic-gate 	}
798c197cb9dShylee 
7997c478bd9Sstevel@tonic-gate 	/*
800c197cb9dShylee 	 * If Kflag is set, let's find the token key now.
801c197cb9dShylee 	 *
802c197cb9dShylee 	 * If Kflag is not set and if encrypting, we need some random
8037c478bd9Sstevel@tonic-gate 	 * salt data to create the key.  If decrypting,
8047c478bd9Sstevel@tonic-gate 	 * the salt should come from head of the file
8057c478bd9Sstevel@tonic-gate 	 * to be decrypted.
8067c478bd9Sstevel@tonic-gate 	 */
807c197cb9dShylee 	if (Kflag) {
808c197cb9dShylee 		rv = get_token_key(hSession, keytype, key_label, pkeydata,
809c197cb9dShylee 		    keysize, &key);
810c197cb9dShylee 		if (rv != CKR_OK) {
811c197cb9dShylee 			cryptoerror(LOG_STDERR, gettext(
812c197cb9dShylee 			    "Can not find the token key"));
813c197cb9dShylee 			goto cleanup;
814c197cb9dShylee 		} else {
815c197cb9dShylee 			goto do_crypto;
816c197cb9dShylee 		}
817c197cb9dShylee 	} else if (cmd->type == CKA_ENCRYPT) {
8187b79d846SDina K Nimeh 		rv = pkcs11_get_urandom((void *)salt, sizeof (salt));
8197c478bd9Sstevel@tonic-gate 		if (rv != 0) {
8207c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_STDERR,
8217c478bd9Sstevel@tonic-gate 			gettext("unable to generate random "
82230a5e8faSwyllys 			    "data for key salt."));
8237c478bd9Sstevel@tonic-gate 			goto cleanup;
8247c478bd9Sstevel@tonic-gate 		}
8257c478bd9Sstevel@tonic-gate 	}
8267c478bd9Sstevel@tonic-gate 
827c197cb9dShylee 
8287c478bd9Sstevel@tonic-gate 	/*
8297c478bd9Sstevel@tonic-gate 	 * If key input is read from  a file, treat it as
8307c478bd9Sstevel@tonic-gate 	 * raw key data, unless it is to be used with RC4,
8317c478bd9Sstevel@tonic-gate 	 * in which case it must be used to generate a pkcs5
8327c478bd9Sstevel@tonic-gate 	 * key to address security concerns with RC4 keys.
8337c478bd9Sstevel@tonic-gate 	 */
8347c478bd9Sstevel@tonic-gate 	if (kflag && keyfile != NULL && keytype != CKK_RC4) {
8351c9bd843Sdinak 		/* XXX : why wasn't SUNW_C_KeyToObject used here? */
8367c478bd9Sstevel@tonic-gate 		CK_OBJECT_CLASS objclass = CKO_SECRET_KEY;
8377c478bd9Sstevel@tonic-gate 		CK_ATTRIBUTE template[5];
8387c478bd9Sstevel@tonic-gate 		int nattr = 0;
8397c478bd9Sstevel@tonic-gate 
8407c478bd9Sstevel@tonic-gate 		template[nattr].type = CKA_CLASS;
8417c478bd9Sstevel@tonic-gate 		template[nattr].pValue = &objclass;
8427c478bd9Sstevel@tonic-gate 		template[nattr].ulValueLen = sizeof (objclass);
8437c478bd9Sstevel@tonic-gate 		nattr++;
8447c478bd9Sstevel@tonic-gate 
8457c478bd9Sstevel@tonic-gate 		template[nattr].type = CKA_KEY_TYPE;
8467c478bd9Sstevel@tonic-gate 		template[nattr].pValue = &keytype;
8477c478bd9Sstevel@tonic-gate 		template[nattr].ulValueLen = sizeof (keytype);
8487c478bd9Sstevel@tonic-gate 		nattr++;
8497c478bd9Sstevel@tonic-gate 
8507c478bd9Sstevel@tonic-gate 		template[nattr].type = cmd->type;
8517c478bd9Sstevel@tonic-gate 		template[nattr].pValue = &truevalue;
8527c478bd9Sstevel@tonic-gate 		template[nattr].ulValueLen = sizeof (truevalue);
8537c478bd9Sstevel@tonic-gate 		nattr++;
8547c478bd9Sstevel@tonic-gate 
8557c478bd9Sstevel@tonic-gate 		template[nattr].type = CKA_TOKEN;
8567c478bd9Sstevel@tonic-gate 		template[nattr].pValue = &falsevalue;
8577c478bd9Sstevel@tonic-gate 		template[nattr].ulValueLen = sizeof (falsevalue);
8587c478bd9Sstevel@tonic-gate 		nattr++;
8597c478bd9Sstevel@tonic-gate 
8607c478bd9Sstevel@tonic-gate 		template[nattr].type = CKA_VALUE;
8617c478bd9Sstevel@tonic-gate 		template[nattr].pValue = pkeydata;
8627c478bd9Sstevel@tonic-gate 		template[nattr].ulValueLen = keysize;
8637c478bd9Sstevel@tonic-gate 		nattr++;
8647c478bd9Sstevel@tonic-gate 
86530a5e8faSwyllys 		rv = C_CreateObject(hSession, template, nattr, &key);
8667c478bd9Sstevel@tonic-gate 	} else {
8677c478bd9Sstevel@tonic-gate 		/*
8687c478bd9Sstevel@tonic-gate 		 * If the encryption type has a fixed key length,
8697c478bd9Sstevel@tonic-gate 		 * then its not necessary to set the key length
8707c478bd9Sstevel@tonic-gate 		 * parameter when generating the key.
8717c478bd9Sstevel@tonic-gate 		 */
8727c478bd9Sstevel@tonic-gate 		if (keytype == CKK_DES || keytype == CKK_DES3)
8737c478bd9Sstevel@tonic-gate 			keylen = 0;
8747c478bd9Sstevel@tonic-gate 		else
8757c478bd9Sstevel@tonic-gate 			keylen = 16;
8767c478bd9Sstevel@tonic-gate 
8777c478bd9Sstevel@tonic-gate 		/*
8787c478bd9Sstevel@tonic-gate 		 * Generate a cryptographically secure key using
8797c478bd9Sstevel@tonic-gate 		 * the key read from the file given (-k keyfile) or
8807c478bd9Sstevel@tonic-gate 		 * the passphrase entered by the user.
8817c478bd9Sstevel@tonic-gate 		 */
8821c9bd843Sdinak 		rv = pkcs11_PasswdToPBKD2Object(hSession, (char *)pkeydata,
8831c9bd843Sdinak 		    (size_t)keysize, (void *)salt, sizeof (salt), iterations,
8841c9bd843Sdinak 		    keytype, keylen, cmd->flags, &key);
8857c478bd9Sstevel@tonic-gate 	}
8867c478bd9Sstevel@tonic-gate 
8877c478bd9Sstevel@tonic-gate 	if (rv != CKR_OK) {
8887c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext(
8897c478bd9Sstevel@tonic-gate 		    "failed to generate a key: %s"),
8907c478bd9Sstevel@tonic-gate 		    pkcs11_strerror(rv));
8917c478bd9Sstevel@tonic-gate 		goto cleanup;
8927c478bd9Sstevel@tonic-gate 	}
8937c478bd9Sstevel@tonic-gate 
894c197cb9dShylee 
895c197cb9dShylee do_crypto:
8967c478bd9Sstevel@tonic-gate 	/* Setup up mechanism */
8977c478bd9Sstevel@tonic-gate 	mech.mechanism = mech_type;
8987c478bd9Sstevel@tonic-gate 	mech.pParameter = (CK_VOID_PTR)pivbuf;
8997c478bd9Sstevel@tonic-gate 	mech.ulParameterLen = ivlen;
9007c478bd9Sstevel@tonic-gate 
9017c478bd9Sstevel@tonic-gate 	if ((rv = cmd->Init(hSession, &mech, key)) != CKR_OK) {
9027c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext(
9037c478bd9Sstevel@tonic-gate 		    "failed to initialize crypto operation: %s"),
9047c478bd9Sstevel@tonic-gate 		    pkcs11_strerror(rv));
9057c478bd9Sstevel@tonic-gate 		goto cleanup;
9067c478bd9Sstevel@tonic-gate 	}
9077c478bd9Sstevel@tonic-gate 
9087c478bd9Sstevel@tonic-gate 	/* Write the version header encrypt command */
9097c478bd9Sstevel@tonic-gate 	if (cmd->type == CKA_ENCRYPT) {
9107c478bd9Sstevel@tonic-gate 		/* convert to network order for storage */
911b54157c1Sda 		uint32_t	netversion = htonl(version);
912b54157c1Sda 		uint32_t	netiter;
9137c478bd9Sstevel@tonic-gate 
9147c478bd9Sstevel@tonic-gate 		if (write(outfd, &netversion, sizeof (netversion))
91530a5e8faSwyllys 		    != sizeof (netversion)) {
9167c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext(
91730a5e8faSwyllys 			    "failed to write version number "
91830a5e8faSwyllys 			    "to output file."));
9197c478bd9Sstevel@tonic-gate 			goto cleanup;
9207c478bd9Sstevel@tonic-gate 		}
9217c478bd9Sstevel@tonic-gate 		/*
9227c478bd9Sstevel@tonic-gate 		 * Write the iteration and salt data, even if they
9237c478bd9Sstevel@tonic-gate 		 * were not used to generate a key.
9247c478bd9Sstevel@tonic-gate 		 */
9257c478bd9Sstevel@tonic-gate 		netiter = htonl(iterations);
9267c478bd9Sstevel@tonic-gate 		if (write(outfd, &netiter,
92730a5e8faSwyllys 		    sizeof (netiter)) != sizeof (netiter)) {
9287c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext(
9297c478bd9Sstevel@tonic-gate 			    "failed to write iterations to output"));
9307c478bd9Sstevel@tonic-gate 			goto cleanup;
9317c478bd9Sstevel@tonic-gate 		}
93230a5e8faSwyllys 		if (ivlen > 0 && write(outfd, pivbuf, ivlen) != ivlen) {
9337c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext(
93430a5e8faSwyllys 			    "failed to write initialization vector "
93530a5e8faSwyllys 			    "to output"));
9367c478bd9Sstevel@tonic-gate 			goto cleanup;
9377c478bd9Sstevel@tonic-gate 		}
9387c478bd9Sstevel@tonic-gate 		if (write(outfd, salt, sizeof (salt)) != sizeof (salt)) {
9397c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext(
9407c478bd9Sstevel@tonic-gate 			    "failed to write salt data to output"));
9417c478bd9Sstevel@tonic-gate 			goto cleanup;
9427c478bd9Sstevel@tonic-gate 		}
9437c478bd9Sstevel@tonic-gate 	}
9447c478bd9Sstevel@tonic-gate 
94554da5c1fSjk 	if (crypt_multipart(cmd, hSession, infd, outfd, insbuf.st_size) == -1) {
9467c478bd9Sstevel@tonic-gate 		goto cleanup;
9477c478bd9Sstevel@tonic-gate 	}
9487c478bd9Sstevel@tonic-gate 
9497c478bd9Sstevel@tonic-gate 	errflag = B_FALSE;
9507c478bd9Sstevel@tonic-gate 
9517c478bd9Sstevel@tonic-gate 	/*
9527c478bd9Sstevel@tonic-gate 	 * Clean up
9537c478bd9Sstevel@tonic-gate 	 */
9547c478bd9Sstevel@tonic-gate cleanup:
9557c478bd9Sstevel@tonic-gate 	/* Clear the key data, so others cannot snoop */
9567c478bd9Sstevel@tonic-gate 	if (pkeydata != NULL) {
9577c478bd9Sstevel@tonic-gate 		bzero(pkeydata, keysize);
9587c478bd9Sstevel@tonic-gate 		free(pkeydata);
9597c478bd9Sstevel@tonic-gate 		pkeydata = NULL;
9607c478bd9Sstevel@tonic-gate 	}
9617c478bd9Sstevel@tonic-gate 
9627c478bd9Sstevel@tonic-gate 	/* Destroy key object */
963c197cb9dShylee 	if (Kflag != B_FALSE && key != (CK_OBJECT_HANDLE) 0) {
9647c478bd9Sstevel@tonic-gate 		(void) C_DestroyObject(hSession, key);
9657c478bd9Sstevel@tonic-gate 	}
9667c478bd9Sstevel@tonic-gate 
9677c478bd9Sstevel@tonic-gate 	/* free allocated memory */
9687c478bd9Sstevel@tonic-gate 	if (pSlotList != NULL)
9697c478bd9Sstevel@tonic-gate 		free(pSlotList);
9707c478bd9Sstevel@tonic-gate 	if (pivbuf != NULL)
9717c478bd9Sstevel@tonic-gate 		free(pivbuf);
9727c478bd9Sstevel@tonic-gate 
9737c478bd9Sstevel@tonic-gate 	/* close all the files */
97454da5c1fSjk 	if (iflag && (infd != -1))
9757c478bd9Sstevel@tonic-gate 		(void) close(infd);
97654da5c1fSjk 	if (oflag && (outfd != -1))
9777c478bd9Sstevel@tonic-gate 		(void) close(outfd);
9787c478bd9Sstevel@tonic-gate 
9797c478bd9Sstevel@tonic-gate 	/* rename tmp output to input file */
9807c478bd9Sstevel@tonic-gate 	if (inoutsame) {
9817c478bd9Sstevel@tonic-gate 		if (rename(outfilename, inputfile) == -1) {
9827c478bd9Sstevel@tonic-gate 			(void) unlink(outfilename);
9837c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext("rename failed."));
9847c478bd9Sstevel@tonic-gate 		}
9857c478bd9Sstevel@tonic-gate 	}
9867c478bd9Sstevel@tonic-gate 
9879a2817adSValerie Bubb Fenwick 	/* If error occurred and the file was new, remove the output file */
9889a2817adSValerie Bubb Fenwick 	if (errflag && (outfilename != NULL) && !leavefilealone) {
9897c478bd9Sstevel@tonic-gate 		(void) unlink(outfilename);
9907c478bd9Sstevel@tonic-gate 	}
9917c478bd9Sstevel@tonic-gate 
9927c478bd9Sstevel@tonic-gate 	/* close pkcs11 session */
9937c478bd9Sstevel@tonic-gate 	if (hSession != CK_INVALID_HANDLE)
9947c478bd9Sstevel@tonic-gate 		(void) C_CloseSession(hSession);
9957c478bd9Sstevel@tonic-gate 
9967c478bd9Sstevel@tonic-gate 	(void) C_Finalize(NULL);
9977c478bd9Sstevel@tonic-gate 
9987c478bd9Sstevel@tonic-gate 	return (errflag);
9997c478bd9Sstevel@tonic-gate }
10007c478bd9Sstevel@tonic-gate 
10017c478bd9Sstevel@tonic-gate /*
10027c478bd9Sstevel@tonic-gate  * Function for printing progress bar when the verbose flag
10037c478bd9Sstevel@tonic-gate  * is set.
10047c478bd9Sstevel@tonic-gate  *
10057c478bd9Sstevel@tonic-gate  * The vertical bar is printed at 25, 50, and 75% complete.
10067c478bd9Sstevel@tonic-gate  *
10077c478bd9Sstevel@tonic-gate  * The function is passed the number of positions on the screen it needs to
10087c478bd9Sstevel@tonic-gate  * advance and loops.
10097c478bd9Sstevel@tonic-gate  */
10107c478bd9Sstevel@tonic-gate 
10117c478bd9Sstevel@tonic-gate static void
print_status(int pos_to_advance)10127c478bd9Sstevel@tonic-gate print_status(int pos_to_advance)
10137c478bd9Sstevel@tonic-gate {
10147c478bd9Sstevel@tonic-gate 
10157c478bd9Sstevel@tonic-gate 	while (pos_to_advance > 0) {
10167c478bd9Sstevel@tonic-gate 		switch (status_pos) {
10177c478bd9Sstevel@tonic-gate 		case 0:
10187c478bd9Sstevel@tonic-gate 			(void) fprintf(stderr, gettext("["));
10197c478bd9Sstevel@tonic-gate 			break;
10207c478bd9Sstevel@tonic-gate 		case 19:
10217c478bd9Sstevel@tonic-gate 		case 39:
10227c478bd9Sstevel@tonic-gate 		case 59:
10237c478bd9Sstevel@tonic-gate 			(void) fprintf(stderr, gettext("|"));
10247c478bd9Sstevel@tonic-gate 			break;
10257c478bd9Sstevel@tonic-gate 		default:
10267c478bd9Sstevel@tonic-gate 			(void) fprintf(stderr, gettext("."));
10277c478bd9Sstevel@tonic-gate 		}
10287c478bd9Sstevel@tonic-gate 		pos_to_advance--;
10297c478bd9Sstevel@tonic-gate 		status_pos++;
10307c478bd9Sstevel@tonic-gate 	}
10317c478bd9Sstevel@tonic-gate }
10327c478bd9Sstevel@tonic-gate 
10337c478bd9Sstevel@tonic-gate /*
10347c478bd9Sstevel@tonic-gate  * Encrypt/Decrypt in multi part.
10357c478bd9Sstevel@tonic-gate  *
10367c478bd9Sstevel@tonic-gate  * This function reads the input file (infd) and writes the
10377c478bd9Sstevel@tonic-gate  * encrypted/decrypted output to file (outfd).
10387c478bd9Sstevel@tonic-gate  *
10397c478bd9Sstevel@tonic-gate  * cmd - pointing  to commandinfo
10407c478bd9Sstevel@tonic-gate  * hSession - pkcs session
10417c478bd9Sstevel@tonic-gate  * infd - input file descriptor
10427c478bd9Sstevel@tonic-gate  * outfd - output file descriptor
10437c478bd9Sstevel@tonic-gate  *
10447c478bd9Sstevel@tonic-gate  */
10457c478bd9Sstevel@tonic-gate 
10467c478bd9Sstevel@tonic-gate static int
crypt_multipart(struct CommandInfo * cmd,CK_SESSION_HANDLE hSession,int infd,int outfd,off_t insize)10477c478bd9Sstevel@tonic-gate crypt_multipart(struct CommandInfo *cmd, CK_SESSION_HANDLE hSession,
104854da5c1fSjk 	int infd, int outfd, off_t insize)
10497c478bd9Sstevel@tonic-gate {
10507c478bd9Sstevel@tonic-gate 	CK_RV		rv;
10517c478bd9Sstevel@tonic-gate 	CK_ULONG	resultlen;
10527c478bd9Sstevel@tonic-gate 	CK_ULONG	resultbuflen;
10537c478bd9Sstevel@tonic-gate 	CK_BYTE_PTR	resultbuf;
10547c478bd9Sstevel@tonic-gate 	CK_ULONG	datalen;
10557c478bd9Sstevel@tonic-gate 	CK_BYTE		databuf[BUFFERSIZE];
10567c478bd9Sstevel@tonic-gate 	CK_BYTE		outbuf[BUFFERSIZE+BLOCKSIZE];
10577c478bd9Sstevel@tonic-gate 	CK_ULONG	status_index = 0; /* current total file size read */
10587c478bd9Sstevel@tonic-gate 	float		status_last = 0.0; /* file size of last element used */
10597c478bd9Sstevel@tonic-gate 	float		status_incr = 0.0; /* file size element increments */
10607c478bd9Sstevel@tonic-gate 	int		pos; /* # of progress bar elements to be print */
10617c478bd9Sstevel@tonic-gate 	ssize_t		nread;
10627c478bd9Sstevel@tonic-gate 	boolean_t	errflag = B_FALSE;
10637c478bd9Sstevel@tonic-gate 
10647c478bd9Sstevel@tonic-gate 	datalen = sizeof (databuf);
10657c478bd9Sstevel@tonic-gate 	resultbuflen = sizeof (outbuf);
10667c478bd9Sstevel@tonic-gate 	resultbuf = outbuf;
10677c478bd9Sstevel@tonic-gate 
10687c478bd9Sstevel@tonic-gate 	/* Divide into 79 increments for progress bar element spacing */
10697c478bd9Sstevel@tonic-gate 	if (vflag && iflag)
107054da5c1fSjk 		status_incr = (insize / 79.0);
10717c478bd9Sstevel@tonic-gate 
10727c478bd9Sstevel@tonic-gate 	while ((nread = read(infd, databuf, datalen)) > 0) {
10737c478bd9Sstevel@tonic-gate 
10747c478bd9Sstevel@tonic-gate 		/* Start with the initial buffer */
10757c478bd9Sstevel@tonic-gate 		resultlen = resultbuflen;
10767c478bd9Sstevel@tonic-gate 		rv = cmd->Update(hSession, databuf, (CK_ULONG)nread,
107730a5e8faSwyllys 		    resultbuf, &resultlen);
10787c478bd9Sstevel@tonic-gate 
10797c478bd9Sstevel@tonic-gate 		/* Need a bigger buffer? */
10807c478bd9Sstevel@tonic-gate 		if (rv == CKR_BUFFER_TOO_SMALL) {
10817c478bd9Sstevel@tonic-gate 
10827c478bd9Sstevel@tonic-gate 			/* free the old buffer */
10837c478bd9Sstevel@tonic-gate 			if (resultbuf != NULL && resultbuf != outbuf) {
10847c478bd9Sstevel@tonic-gate 				bzero(resultbuf, resultbuflen);
10857c478bd9Sstevel@tonic-gate 				free(resultbuf);
10867c478bd9Sstevel@tonic-gate 			}
10877c478bd9Sstevel@tonic-gate 
10887c478bd9Sstevel@tonic-gate 			/* allocate a new big buffer */
10897c478bd9Sstevel@tonic-gate 			if ((resultbuf = malloc((size_t)resultlen)) == NULL) {
10907c478bd9Sstevel@tonic-gate 				int err = errno;
10917c478bd9Sstevel@tonic-gate 				cryptoerror(LOG_STDERR, gettext("malloc: %s"),
10927c478bd9Sstevel@tonic-gate 				    strerror(err));
10937c478bd9Sstevel@tonic-gate 				return (-1);
10947c478bd9Sstevel@tonic-gate 			}
10957c478bd9Sstevel@tonic-gate 			resultbuflen = resultlen;
10967c478bd9Sstevel@tonic-gate 
10977c478bd9Sstevel@tonic-gate 			/* Try again with bigger buffer */
10987c478bd9Sstevel@tonic-gate 			rv = cmd->Update(hSession, databuf, (CK_ULONG)nread,
109930a5e8faSwyllys 			    resultbuf, &resultlen);
11007c478bd9Sstevel@tonic-gate 		}
11017c478bd9Sstevel@tonic-gate 
11027c478bd9Sstevel@tonic-gate 		if (rv != CKR_OK) {
11037c478bd9Sstevel@tonic-gate 			errflag = B_TRUE;
11047c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext(
11057c478bd9Sstevel@tonic-gate 			    "crypto operation failed: %s"),
11067c478bd9Sstevel@tonic-gate 			    pkcs11_strerror(rv));
11077c478bd9Sstevel@tonic-gate 			break;
11087c478bd9Sstevel@tonic-gate 		}
11097c478bd9Sstevel@tonic-gate 
11107c478bd9Sstevel@tonic-gate 		/* write the output */
11117c478bd9Sstevel@tonic-gate 		if (write(outfd, resultbuf, resultlen) != resultlen) {
11127c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext(
11137c478bd9Sstevel@tonic-gate 			    "failed to write result to output file."));
11147c478bd9Sstevel@tonic-gate 			errflag = B_TRUE;
11157c478bd9Sstevel@tonic-gate 			break;
11167c478bd9Sstevel@tonic-gate 		}
11177c478bd9Sstevel@tonic-gate 
11187c478bd9Sstevel@tonic-gate 		if (vflag) {
11197c478bd9Sstevel@tonic-gate 			status_index += resultlen;
11207c478bd9Sstevel@tonic-gate 
11217c478bd9Sstevel@tonic-gate 			/*
11227c478bd9Sstevel@tonic-gate 			 * If input is from stdin, do a our own progress bar
11237c478bd9Sstevel@tonic-gate 			 * by printing periods at a pre-defined increment
11247c478bd9Sstevel@tonic-gate 			 * until the file is done.
11257c478bd9Sstevel@tonic-gate 			 */
11267c478bd9Sstevel@tonic-gate 			if (!iflag) {
11277c478bd9Sstevel@tonic-gate 
11287c478bd9Sstevel@tonic-gate 				/*
11297c478bd9Sstevel@tonic-gate 				 * Print at least 1 element in case the file
11307c478bd9Sstevel@tonic-gate 				 * is small, it looks better than nothing.
11317c478bd9Sstevel@tonic-gate 				 */
11327c478bd9Sstevel@tonic-gate 				if (status_pos == 0) {
11337c478bd9Sstevel@tonic-gate 					(void) fprintf(stderr, gettext("."));
11347c478bd9Sstevel@tonic-gate 					status_pos = 1;
11357c478bd9Sstevel@tonic-gate 				}
11367c478bd9Sstevel@tonic-gate 
1137f2728256SKrishna Yenduri 				while ((status_index - status_last) >
11387c478bd9Sstevel@tonic-gate 				    (PROGRESSSIZE)) {
11397c478bd9Sstevel@tonic-gate 					(void) fprintf(stderr, gettext("."));
1140f2728256SKrishna Yenduri 					status_last += PROGRESSSIZE;
11417c478bd9Sstevel@tonic-gate 				}
11427c478bd9Sstevel@tonic-gate 				continue;
11437c478bd9Sstevel@tonic-gate 			}
11447c478bd9Sstevel@tonic-gate 
11457c478bd9Sstevel@tonic-gate 			/* Calculate the number of elements need to be print */
114654da5c1fSjk 			if (insize <= BUFFERSIZE)
11477c478bd9Sstevel@tonic-gate 				pos = 78;
11487c478bd9Sstevel@tonic-gate 			else
11497c478bd9Sstevel@tonic-gate 				pos = (int)((status_index - status_last) /
11507c478bd9Sstevel@tonic-gate 				    status_incr);
11517c478bd9Sstevel@tonic-gate 
11527c478bd9Sstevel@tonic-gate 			/* Add progress bar elements, if needed */
11537c478bd9Sstevel@tonic-gate 			if (pos > 0) {
11547c478bd9Sstevel@tonic-gate 				print_status(pos);
11557c478bd9Sstevel@tonic-gate 				status_last += (status_incr * pos);
11567c478bd9Sstevel@tonic-gate 			}
11577c478bd9Sstevel@tonic-gate 		}
11587c478bd9Sstevel@tonic-gate 	}
11597c478bd9Sstevel@tonic-gate 
11607c478bd9Sstevel@tonic-gate 	/* Print verbose completion */
11617c478bd9Sstevel@tonic-gate 	if (vflag) {
11627c478bd9Sstevel@tonic-gate 		if (iflag)
11637c478bd9Sstevel@tonic-gate 			(void) fprintf(stderr, "]");
11647c478bd9Sstevel@tonic-gate 
11657c478bd9Sstevel@tonic-gate 		(void) fprintf(stderr, "\n%s\n", gettext("Done."));
11667c478bd9Sstevel@tonic-gate 	}
11677c478bd9Sstevel@tonic-gate 
11687c478bd9Sstevel@tonic-gate 	/* Error in reading */
11697c478bd9Sstevel@tonic-gate 	if (nread == -1) {
11707c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext(
11717c478bd9Sstevel@tonic-gate 		    "error reading from input file"));
11727c478bd9Sstevel@tonic-gate 		errflag = B_TRUE;
11737c478bd9Sstevel@tonic-gate 	}
11747c478bd9Sstevel@tonic-gate 
11757c478bd9Sstevel@tonic-gate 	if (!errflag) {
11767c478bd9Sstevel@tonic-gate 
11777c478bd9Sstevel@tonic-gate 		/* Do the final part */
11787c478bd9Sstevel@tonic-gate 
11797c478bd9Sstevel@tonic-gate 		rv = cmd->Final(hSession, resultbuf, &resultlen);
11807c478bd9Sstevel@tonic-gate 
11817c478bd9Sstevel@tonic-gate 		if (rv == CKR_OK) {
11827c478bd9Sstevel@tonic-gate 			/* write the output */
11837c478bd9Sstevel@tonic-gate 			if (write(outfd, resultbuf, resultlen) != resultlen) {
11847c478bd9Sstevel@tonic-gate 				cryptoerror(LOG_STDERR, gettext(
11857c478bd9Sstevel@tonic-gate 				    "failed to write result to output file."));
11867c478bd9Sstevel@tonic-gate 				errflag = B_TRUE;
11877c478bd9Sstevel@tonic-gate 			}
11887c478bd9Sstevel@tonic-gate 		} else {
11897c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext(
11907c478bd9Sstevel@tonic-gate 			    "crypto operation failed: %s"),
11917c478bd9Sstevel@tonic-gate 			    pkcs11_strerror(rv));
11927c478bd9Sstevel@tonic-gate 			errflag = B_TRUE;
11937c478bd9Sstevel@tonic-gate 		}
11947c478bd9Sstevel@tonic-gate 
11957c478bd9Sstevel@tonic-gate 	}
11967c478bd9Sstevel@tonic-gate 
11977c478bd9Sstevel@tonic-gate 	if (resultbuf != NULL && resultbuf != outbuf) {
11987c478bd9Sstevel@tonic-gate 		bzero(resultbuf, resultbuflen);
11997c478bd9Sstevel@tonic-gate 		free(resultbuf);
12007c478bd9Sstevel@tonic-gate 	}
12017c478bd9Sstevel@tonic-gate 
12027c478bd9Sstevel@tonic-gate 	if (errflag) {
12037c478bd9Sstevel@tonic-gate 		return (-1);
12047c478bd9Sstevel@tonic-gate 	} else {
12057c478bd9Sstevel@tonic-gate 		return (0);
12067c478bd9Sstevel@tonic-gate 	}
12077c478bd9Sstevel@tonic-gate }
1208