17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5c197cb9dShylee * Common Development and Distribution License (the "License"). 6c197cb9dShylee * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 2154da5c1fSjk /* Portions Copyright 2005 Richard Lowe */ 227c478bd9Sstevel@tonic-gate /* 23c197cb9dShylee * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 247c478bd9Sstevel@tonic-gate * Use is subject to license terms. 257c478bd9Sstevel@tonic-gate */ 267c478bd9Sstevel@tonic-gate 277c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 287c478bd9Sstevel@tonic-gate 297c478bd9Sstevel@tonic-gate /* 307c478bd9Sstevel@tonic-gate * decrypt.c 317c478bd9Sstevel@tonic-gate * 327c478bd9Sstevel@tonic-gate * Implements encrypt(1) and decrypt(1) commands 337c478bd9Sstevel@tonic-gate * 347c478bd9Sstevel@tonic-gate * One binary performs both encrypt/decrypt operation. 357c478bd9Sstevel@tonic-gate * 367c478bd9Sstevel@tonic-gate * usage: 377c478bd9Sstevel@tonic-gate * 387c478bd9Sstevel@tonic-gate * algorithm - mechanism name without CKM_ prefix. Case 397c478bd9Sstevel@tonic-gate * does not matter 407c478bd9Sstevel@tonic-gate * keyfile - file containing key data. If not specified user is 417c478bd9Sstevel@tonic-gate * prompted to enter key. key length > 0 is required 427c478bd9Sstevel@tonic-gate * infile - input file to encrypt/decrypt. If omitted, stdin used. 437c478bd9Sstevel@tonic-gate * outfile - output file to encrypt/decrypt. If omitted, stdout used. 447c478bd9Sstevel@tonic-gate * if infile & outfile are same, a temp file is used for 457c478bd9Sstevel@tonic-gate * output and infile is replaced with this file after 467c478bd9Sstevel@tonic-gate * operation is complete. 477c478bd9Sstevel@tonic-gate * 487c478bd9Sstevel@tonic-gate * Implementation notes: 497c478bd9Sstevel@tonic-gate * iv data - It is generated by random bytes equal to one block size. 507c478bd9Sstevel@tonic-gate * 517c478bd9Sstevel@tonic-gate * encrypted output format - 527c478bd9Sstevel@tonic-gate * - Output format version number - 4 bytes in network byte order. 537c478bd9Sstevel@tonic-gate * - Iterations used in key gen function, 4 bytes in network byte order. 547c478bd9Sstevel@tonic-gate * - IV ( 'ivlen' bytes) 557c478bd9Sstevel@tonic-gate * - Salt data used in key gen (16 bytes) 567c478bd9Sstevel@tonic-gate * - cipher text data. 577c478bd9Sstevel@tonic-gate * 587c478bd9Sstevel@tonic-gate */ 597c478bd9Sstevel@tonic-gate 607c478bd9Sstevel@tonic-gate #include <stdio.h> 617c478bd9Sstevel@tonic-gate #include <stdlib.h> 627c478bd9Sstevel@tonic-gate #include <unistd.h> 637c478bd9Sstevel@tonic-gate #include <errno.h> 647c478bd9Sstevel@tonic-gate #include <fcntl.h> 657c478bd9Sstevel@tonic-gate #include <ctype.h> 667c478bd9Sstevel@tonic-gate #include <strings.h> 677c478bd9Sstevel@tonic-gate #include <libintl.h> 687c478bd9Sstevel@tonic-gate #include <libgen.h> 697c478bd9Sstevel@tonic-gate #include <locale.h> 707c478bd9Sstevel@tonic-gate #include <limits.h> 717c478bd9Sstevel@tonic-gate #include <sys/types.h> 727c478bd9Sstevel@tonic-gate #include <sys/stat.h> 737c478bd9Sstevel@tonic-gate #include <netinet/in.h> 747c478bd9Sstevel@tonic-gate #include <security/cryptoki.h> 757c478bd9Sstevel@tonic-gate #include <cryptoutil.h> 76c197cb9dShylee #include <kmfapi.h> 777c478bd9Sstevel@tonic-gate 787c478bd9Sstevel@tonic-gate #define BUFFERSIZE (2048) /* Buffer size for reading file */ 797c478bd9Sstevel@tonic-gate #define BLOCKSIZE (128) /* Largest guess for block size */ 807c478bd9Sstevel@tonic-gate #define PROGRESSSIZE (BUFFERSIZE*20) /* stdin progress indicator size */ 817c478bd9Sstevel@tonic-gate 827c478bd9Sstevel@tonic-gate #define SUNW_ENCRYPT_FILE_VERSION 1 837c478bd9Sstevel@tonic-gate 847c478bd9Sstevel@tonic-gate /* 857c478bd9Sstevel@tonic-gate * Exit Status codes 867c478bd9Sstevel@tonic-gate */ 877c478bd9Sstevel@tonic-gate #ifndef EXIT_SUCCESS 887c478bd9Sstevel@tonic-gate #define EXIT_SUCCESS 0 /* No errors */ 897c478bd9Sstevel@tonic-gate #define EXIT_FAILURE 1 /* All errors except usage */ 907c478bd9Sstevel@tonic-gate #endif /* EXIT_SUCCESS */ 917c478bd9Sstevel@tonic-gate 927c478bd9Sstevel@tonic-gate #define EXIT_USAGE 2 /* usage/syntax error */ 937c478bd9Sstevel@tonic-gate 947c478bd9Sstevel@tonic-gate #define ENCRYPT_NAME "encrypt" /* name of encrypt command */ 95c197cb9dShylee #define ENCRYPT_OPTIONS "a:T:K:k:i:o:lv" /* options for encrypt */ 967c478bd9Sstevel@tonic-gate #define DECRYPT_NAME "decrypt" /* name of decrypt command */ 97c197cb9dShylee #define DECRYPT_OPTIONS "a:T:K:k:i:o:lv" /* options for decrypt */ 987c478bd9Sstevel@tonic-gate 997c478bd9Sstevel@tonic-gate /* 1007c478bd9Sstevel@tonic-gate * Structure containing info for encrypt/decrypt 1017c478bd9Sstevel@tonic-gate * command 1027c478bd9Sstevel@tonic-gate */ 1037c478bd9Sstevel@tonic-gate struct CommandInfo { 1047c478bd9Sstevel@tonic-gate char *name; /* name of the command */ 1057c478bd9Sstevel@tonic-gate char *options; /* command line options */ 1067c478bd9Sstevel@tonic-gate CK_FLAGS flags; 1077c478bd9Sstevel@tonic-gate CK_ATTRIBUTE_TYPE type; /* type of command */ 1087c478bd9Sstevel@tonic-gate 1097c478bd9Sstevel@tonic-gate /* function pointers for various operations */ 1107c478bd9Sstevel@tonic-gate CK_RV (*Init)(CK_SESSION_HANDLE, CK_MECHANISM_PTR, CK_OBJECT_HANDLE); 1117c478bd9Sstevel@tonic-gate CK_RV (*Update)(CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_BYTE_PTR, 1127c478bd9Sstevel@tonic-gate CK_ULONG_PTR); 1137c478bd9Sstevel@tonic-gate CK_RV (*Crypt)(CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_BYTE_PTR, 1147c478bd9Sstevel@tonic-gate CK_ULONG_PTR); 1157c478bd9Sstevel@tonic-gate CK_RV (*Final)(CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG_PTR); 1167c478bd9Sstevel@tonic-gate }; 1177c478bd9Sstevel@tonic-gate 1187c478bd9Sstevel@tonic-gate static struct CommandInfo encrypt_cmd = { 1197c478bd9Sstevel@tonic-gate ENCRYPT_NAME, 1207c478bd9Sstevel@tonic-gate ENCRYPT_OPTIONS, 1217c478bd9Sstevel@tonic-gate CKF_ENCRYPT, 1227c478bd9Sstevel@tonic-gate CKA_ENCRYPT, 1237c478bd9Sstevel@tonic-gate C_EncryptInit, 1247c478bd9Sstevel@tonic-gate C_EncryptUpdate, 1257c478bd9Sstevel@tonic-gate C_Encrypt, 1267c478bd9Sstevel@tonic-gate C_EncryptFinal 1277c478bd9Sstevel@tonic-gate }; 1287c478bd9Sstevel@tonic-gate 1297c478bd9Sstevel@tonic-gate static struct CommandInfo decrypt_cmd = { 1307c478bd9Sstevel@tonic-gate DECRYPT_NAME, 1317c478bd9Sstevel@tonic-gate DECRYPT_OPTIONS, 1327c478bd9Sstevel@tonic-gate CKF_DECRYPT, 1337c478bd9Sstevel@tonic-gate CKA_DECRYPT, 1347c478bd9Sstevel@tonic-gate C_DecryptInit, 1357c478bd9Sstevel@tonic-gate C_DecryptUpdate, 1367c478bd9Sstevel@tonic-gate C_Decrypt, 1377c478bd9Sstevel@tonic-gate C_DecryptFinal 1387c478bd9Sstevel@tonic-gate }; 1397c478bd9Sstevel@tonic-gate 1407c478bd9Sstevel@tonic-gate struct mech_alias { 1417c478bd9Sstevel@tonic-gate CK_MECHANISM_TYPE type; 1427c478bd9Sstevel@tonic-gate char *alias; 1437c478bd9Sstevel@tonic-gate CK_ULONG keysize_min; 1447c478bd9Sstevel@tonic-gate CK_ULONG keysize_max; 1457c478bd9Sstevel@tonic-gate int keysize_unit; 1467c478bd9Sstevel@tonic-gate int ivlen; 1477c478bd9Sstevel@tonic-gate boolean_t available; 1487c478bd9Sstevel@tonic-gate }; 1497c478bd9Sstevel@tonic-gate 1507c478bd9Sstevel@tonic-gate #define MECH_ALIASES_COUNT 4 1517c478bd9Sstevel@tonic-gate 1527c478bd9Sstevel@tonic-gate static struct mech_alias mech_aliases[] = { 1537c478bd9Sstevel@tonic-gate { CKM_AES_CBC_PAD, "aes", ULONG_MAX, 0L, 8, 16, B_FALSE }, 1547c478bd9Sstevel@tonic-gate { CKM_RC4, "arcfour", ULONG_MAX, 0L, 1, 0, B_FALSE }, 1557c478bd9Sstevel@tonic-gate { CKM_DES_CBC_PAD, "des", 8, 8, 8, 8, B_FALSE }, 1567c478bd9Sstevel@tonic-gate { CKM_DES3_CBC_PAD, "3des", 24, 24, 8, 8, B_FALSE }, 1577c478bd9Sstevel@tonic-gate }; 1587c478bd9Sstevel@tonic-gate 1597c478bd9Sstevel@tonic-gate static CK_BBOOL truevalue = TRUE; 1607c478bd9Sstevel@tonic-gate static CK_BBOOL falsevalue = FALSE; 1617c478bd9Sstevel@tonic-gate 1627c478bd9Sstevel@tonic-gate static boolean_t aflag = B_FALSE; /* -a <algorithm> flag, required */ 1637c478bd9Sstevel@tonic-gate static boolean_t kflag = B_FALSE; /* -k <keyfile> flag */ 1647c478bd9Sstevel@tonic-gate static boolean_t iflag = B_FALSE; /* -i <infile> flag, use stdin if absent */ 1657c478bd9Sstevel@tonic-gate static boolean_t oflag = B_FALSE; /* -o <outfile> flag, use stdout if absent */ 1667c478bd9Sstevel@tonic-gate static boolean_t lflag = B_FALSE; /* -l flag (list) */ 1677c478bd9Sstevel@tonic-gate static boolean_t vflag = B_FALSE; /* -v flag (verbose) */ 168c197cb9dShylee static boolean_t Tflag = B_FALSE; 169c197cb9dShylee static boolean_t Kflag = B_FALSE; 1707c478bd9Sstevel@tonic-gate 1717c478bd9Sstevel@tonic-gate static char *keyfile = NULL; /* name of keyfile */ 1727c478bd9Sstevel@tonic-gate static char *inputfile = NULL; /* name of input file */ 1737c478bd9Sstevel@tonic-gate static char *outputfile = NULL; /* name of output file */ 174c197cb9dShylee static char *token_label = NULL; 175c197cb9dShylee static char *key_label = NULL; 1767c478bd9Sstevel@tonic-gate 1777c478bd9Sstevel@tonic-gate static int status_pos = 0; /* current position of progress bar element */ 1787c478bd9Sstevel@tonic-gate 1797c478bd9Sstevel@tonic-gate /* 1807c478bd9Sstevel@tonic-gate * function prototypes 1817c478bd9Sstevel@tonic-gate */ 1827c478bd9Sstevel@tonic-gate static void usage(struct CommandInfo *cmd); 1837c478bd9Sstevel@tonic-gate static int execute_cmd(struct CommandInfo *cmd, char *algo_str); 1847c478bd9Sstevel@tonic-gate static int crypt_multipart(struct CommandInfo *cmd, CK_SESSION_HANDLE hSession, 18554da5c1fSjk int infd, int outfd, off_t insize); 1867c478bd9Sstevel@tonic-gate 1877c478bd9Sstevel@tonic-gate int 1887c478bd9Sstevel@tonic-gate main(int argc, char **argv) 1897c478bd9Sstevel@tonic-gate { 1907c478bd9Sstevel@tonic-gate 1917c478bd9Sstevel@tonic-gate extern char *optarg; 1927c478bd9Sstevel@tonic-gate extern int optind; 1937c478bd9Sstevel@tonic-gate char *optstr; 1947c478bd9Sstevel@tonic-gate char c; /* current getopts flag */ 1957c478bd9Sstevel@tonic-gate char *algo_str = NULL; /* algorithm string */ 1967c478bd9Sstevel@tonic-gate struct CommandInfo *cmd; 1977c478bd9Sstevel@tonic-gate char *cmdname; /* name of command */ 1987c478bd9Sstevel@tonic-gate boolean_t errflag = B_FALSE; 1997c478bd9Sstevel@tonic-gate 2007c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, ""); 2017c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN) /* Should be defiend by cc -D */ 2027c478bd9Sstevel@tonic-gate #define TEXT_DOMAIN "SYS_TEST" /* Use this only if it weren't */ 2037c478bd9Sstevel@tonic-gate #endif 2047c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 2057c478bd9Sstevel@tonic-gate 2067c478bd9Sstevel@tonic-gate /* 2077c478bd9Sstevel@tonic-gate * Based on command name, determine 2087c478bd9Sstevel@tonic-gate * type of command. 2097c478bd9Sstevel@tonic-gate */ 2107c478bd9Sstevel@tonic-gate cmdname = basename(argv[0]); 2117c478bd9Sstevel@tonic-gate 2127c478bd9Sstevel@tonic-gate cryptodebug_init(cmdname); 2137c478bd9Sstevel@tonic-gate 2147c478bd9Sstevel@tonic-gate if (strcmp(cmdname, encrypt_cmd.name) == 0) { 2157c478bd9Sstevel@tonic-gate cmd = &encrypt_cmd; 2167c478bd9Sstevel@tonic-gate } else if (strcmp(cmdname, decrypt_cmd.name) == 0) { 2177c478bd9Sstevel@tonic-gate cmd = &decrypt_cmd; 2187c478bd9Sstevel@tonic-gate } else { 2197c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 2207c478bd9Sstevel@tonic-gate "command name must be either encrypt or decrypt")); 2217c478bd9Sstevel@tonic-gate exit(EXIT_USAGE); 2227c478bd9Sstevel@tonic-gate } 2237c478bd9Sstevel@tonic-gate 2247c478bd9Sstevel@tonic-gate optstr = cmd->options; 2257c478bd9Sstevel@tonic-gate 2267c478bd9Sstevel@tonic-gate /* Parse command line arguments */ 2277c478bd9Sstevel@tonic-gate while (!errflag && (c = getopt(argc, argv, optstr)) != -1) { 2287c478bd9Sstevel@tonic-gate 2297c478bd9Sstevel@tonic-gate switch (c) { 2307c478bd9Sstevel@tonic-gate case 'a': 2317c478bd9Sstevel@tonic-gate aflag = B_TRUE; 2327c478bd9Sstevel@tonic-gate algo_str = optarg; 2337c478bd9Sstevel@tonic-gate break; 2347c478bd9Sstevel@tonic-gate case 'k': 2357c478bd9Sstevel@tonic-gate kflag = B_TRUE; 2367c478bd9Sstevel@tonic-gate keyfile = optarg; 2377c478bd9Sstevel@tonic-gate break; 238c197cb9dShylee case 'T': 239c197cb9dShylee Tflag = B_TRUE; 240c197cb9dShylee token_label = optarg; 241c197cb9dShylee break; 242c197cb9dShylee case 'K': 243c197cb9dShylee Kflag = B_TRUE; 244c197cb9dShylee key_label = optarg; 245c197cb9dShylee break; 2467c478bd9Sstevel@tonic-gate case 'i': 2477c478bd9Sstevel@tonic-gate iflag = B_TRUE; 2487c478bd9Sstevel@tonic-gate inputfile = optarg; 2497c478bd9Sstevel@tonic-gate break; 2507c478bd9Sstevel@tonic-gate case 'o': 2517c478bd9Sstevel@tonic-gate oflag = B_TRUE; 2527c478bd9Sstevel@tonic-gate outputfile = optarg; 2537c478bd9Sstevel@tonic-gate break; 2547c478bd9Sstevel@tonic-gate case 'l': 2557c478bd9Sstevel@tonic-gate lflag = B_TRUE; 2567c478bd9Sstevel@tonic-gate break; 2577c478bd9Sstevel@tonic-gate case 'v': 2587c478bd9Sstevel@tonic-gate vflag = B_TRUE; 2597c478bd9Sstevel@tonic-gate break; 2607c478bd9Sstevel@tonic-gate default: 2617c478bd9Sstevel@tonic-gate errflag = B_TRUE; 2627c478bd9Sstevel@tonic-gate } 2637c478bd9Sstevel@tonic-gate } 2647c478bd9Sstevel@tonic-gate 2657c478bd9Sstevel@tonic-gate if (errflag || (!aflag && !lflag) || (lflag && argc > 2) || 266c197cb9dShylee (kflag && Kflag) || (Tflag && !Kflag) || 2677c478bd9Sstevel@tonic-gate (optind < argc)) { 2687c478bd9Sstevel@tonic-gate usage(cmd); 2697c478bd9Sstevel@tonic-gate exit(EXIT_USAGE); 2707c478bd9Sstevel@tonic-gate } 2717c478bd9Sstevel@tonic-gate 2727c478bd9Sstevel@tonic-gate return (execute_cmd(cmd, algo_str)); 2737c478bd9Sstevel@tonic-gate } 2747c478bd9Sstevel@tonic-gate 2757c478bd9Sstevel@tonic-gate /* 2767c478bd9Sstevel@tonic-gate * usage message 2777c478bd9Sstevel@tonic-gate */ 2787c478bd9Sstevel@tonic-gate static void 2797c478bd9Sstevel@tonic-gate usage(struct CommandInfo *cmd) 2807c478bd9Sstevel@tonic-gate { 281c197cb9dShylee (void) fprintf(stderr, gettext("Usage:\n")); 2827c478bd9Sstevel@tonic-gate if (cmd->type == CKA_ENCRYPT) { 283c197cb9dShylee (void) fprintf(stderr, gettext(" encrypt -l\n")); 284c197cb9dShylee (void) fprintf(stderr, gettext(" encrypt -a <algorithm> " 285c197cb9dShylee "[-v] [-k <keyfile> | -K <keylabel> [-T <tokenspec>]] " 286c197cb9dShylee "[-i <infile>] [-o <outfile>]\n")); 287c197cb9dShylee 2887c478bd9Sstevel@tonic-gate } else { 289c197cb9dShylee (void) fprintf(stderr, gettext(" decrypt -l\n")); 290c197cb9dShylee (void) fprintf(stderr, gettext(" decrypt -a <algorithm> " 291c197cb9dShylee "[-v] [-k <keyfile> | -K <keylabel> [-T <tokenspec>]] " 292c197cb9dShylee "[-i <infile>] [-o <outfile>]\n")); 2937c478bd9Sstevel@tonic-gate } 2947c478bd9Sstevel@tonic-gate } 2957c478bd9Sstevel@tonic-gate 2967c478bd9Sstevel@tonic-gate /* 2977c478bd9Sstevel@tonic-gate * Print out list of algorithms in default and verbose mode 2987c478bd9Sstevel@tonic-gate */ 2997c478bd9Sstevel@tonic-gate static void 3007c478bd9Sstevel@tonic-gate algorithm_list() 3017c478bd9Sstevel@tonic-gate { 3027c478bd9Sstevel@tonic-gate int mech; 3037c478bd9Sstevel@tonic-gate 3047c478bd9Sstevel@tonic-gate (void) printf(gettext("Algorithm Keysize: Min Max (bits)\n" 3057c478bd9Sstevel@tonic-gate "------------------------------------------\n")); 3067c478bd9Sstevel@tonic-gate 3077c478bd9Sstevel@tonic-gate for (mech = 0; mech < MECH_ALIASES_COUNT; mech++) { 3087c478bd9Sstevel@tonic-gate 3097c478bd9Sstevel@tonic-gate if (mech_aliases[mech].available == B_FALSE) 3107c478bd9Sstevel@tonic-gate continue; 3117c478bd9Sstevel@tonic-gate 3127c478bd9Sstevel@tonic-gate (void) printf("%-15s", mech_aliases[mech].alias); 3137c478bd9Sstevel@tonic-gate 3147c478bd9Sstevel@tonic-gate if (mech_aliases[mech].keysize_min != UINT_MAX && 3157c478bd9Sstevel@tonic-gate mech_aliases[mech].keysize_max != 0) 3167c478bd9Sstevel@tonic-gate (void) printf(" %5lu %5lu\n", 3177c478bd9Sstevel@tonic-gate (mech_aliases[mech].keysize_min * 31830a5e8faSwyllys mech_aliases[mech].keysize_unit), 3197c478bd9Sstevel@tonic-gate (mech_aliases[mech].keysize_max * 32030a5e8faSwyllys mech_aliases[mech].keysize_unit)); 3217c478bd9Sstevel@tonic-gate else 3227c478bd9Sstevel@tonic-gate (void) printf("\n"); 3237c478bd9Sstevel@tonic-gate 3247c478bd9Sstevel@tonic-gate } 3257c478bd9Sstevel@tonic-gate } 3267c478bd9Sstevel@tonic-gate 327c197cb9dShylee /* 328c197cb9dShylee * This function will login into the token with the provided password and 329c197cb9dShylee * find the token key object with the specified keytype and keylabel. 330c197cb9dShylee */ 331c197cb9dShylee static int 332c197cb9dShylee get_token_key(CK_SESSION_HANDLE hSession, CK_KEY_TYPE keytype, 333c197cb9dShylee char *keylabel, CK_BYTE *password, int password_len, 334c197cb9dShylee CK_OBJECT_HANDLE *keyobj) 335c197cb9dShylee { 336c197cb9dShylee CK_RV rv; 337c197cb9dShylee CK_ATTRIBUTE pTmpl[10]; 338c197cb9dShylee CK_OBJECT_CLASS class = CKO_SECRET_KEY; 339c197cb9dShylee CK_BBOOL true = 1; 340c197cb9dShylee CK_BBOOL is_token = 1; 341c197cb9dShylee CK_ULONG key_obj_count = 1; 342c197cb9dShylee int i; 343c197cb9dShylee CK_KEY_TYPE ckKeyType = keytype; 344c197cb9dShylee 345c197cb9dShylee 346c197cb9dShylee rv = C_Login(hSession, CKU_USER, (CK_UTF8CHAR_PTR)password, 347c197cb9dShylee (CK_ULONG)password_len); 348c197cb9dShylee if (rv != CKR_OK) { 349c197cb9dShylee (void) fprintf(stderr, "Cannot login to the token." 350c197cb9dShylee " error = %s\n", pkcs11_strerror(rv)); 351c197cb9dShylee return (-1); 352c197cb9dShylee } 353c197cb9dShylee 354c197cb9dShylee i = 0; 355c197cb9dShylee pTmpl[i].type = CKA_TOKEN; 356c197cb9dShylee pTmpl[i].pValue = &is_token; 357c197cb9dShylee pTmpl[i].ulValueLen = sizeof (CK_BBOOL); 358c197cb9dShylee i++; 359c197cb9dShylee 360c197cb9dShylee pTmpl[i].type = CKA_CLASS; 361c197cb9dShylee pTmpl[i].pValue = &class; 362c197cb9dShylee pTmpl[i].ulValueLen = sizeof (class); 363c197cb9dShylee i++; 364c197cb9dShylee 365c197cb9dShylee pTmpl[i].type = CKA_LABEL; 366c197cb9dShylee pTmpl[i].pValue = keylabel; 367c197cb9dShylee pTmpl[i].ulValueLen = strlen(keylabel); 368c197cb9dShylee i++; 369c197cb9dShylee 370c197cb9dShylee pTmpl[i].type = CKA_KEY_TYPE; 371c197cb9dShylee pTmpl[i].pValue = &ckKeyType; 372c197cb9dShylee pTmpl[i].ulValueLen = sizeof (ckKeyType); 373c197cb9dShylee i++; 374c197cb9dShylee 375c197cb9dShylee pTmpl[i].type = CKA_PRIVATE; 376c197cb9dShylee pTmpl[i].pValue = &true; 377c197cb9dShylee pTmpl[i].ulValueLen = sizeof (true); 378c197cb9dShylee i++; 379c197cb9dShylee 380c197cb9dShylee rv = C_FindObjectsInit(hSession, pTmpl, i); 381c197cb9dShylee if (rv != CKR_OK) { 382c197cb9dShylee goto out; 383c197cb9dShylee } 384c197cb9dShylee 385c197cb9dShylee rv = C_FindObjects(hSession, keyobj, 1, &key_obj_count); 386c197cb9dShylee 387c197cb9dShylee (void) C_FindObjectsFinal(hSession); 388c197cb9dShylee 389c197cb9dShylee out: 390c197cb9dShylee if (rv != CKR_OK) { 391c197cb9dShylee (void) fprintf(stderr, 392c197cb9dShylee "Cannot retrieve key object. error = %s\n", 393c197cb9dShylee pkcs11_strerror(rv)); 394c197cb9dShylee return (-1); 395c197cb9dShylee } 396c197cb9dShylee 397c197cb9dShylee if (key_obj_count == 0) { 398c197cb9dShylee (void) fprintf(stderr, "Cannot find the key object.\n"); 399c197cb9dShylee return (-1); 400c197cb9dShylee } 401c197cb9dShylee 402c197cb9dShylee return (0); 403c197cb9dShylee } 404c197cb9dShylee 4057c478bd9Sstevel@tonic-gate 4067c478bd9Sstevel@tonic-gate /* 4077c478bd9Sstevel@tonic-gate * Execute the command. 4087c478bd9Sstevel@tonic-gate * cmd - command pointing to type of operation. 4097c478bd9Sstevel@tonic-gate * algo_str - alias of the algorithm passed. 4107c478bd9Sstevel@tonic-gate */ 4117c478bd9Sstevel@tonic-gate static int 4127c478bd9Sstevel@tonic-gate execute_cmd(struct CommandInfo *cmd, char *algo_str) 4137c478bd9Sstevel@tonic-gate { 4147c478bd9Sstevel@tonic-gate CK_RV rv; 4157c478bd9Sstevel@tonic-gate CK_ULONG slotcount; 4167c478bd9Sstevel@tonic-gate CK_SLOT_ID slotID; 4177c478bd9Sstevel@tonic-gate CK_SLOT_ID_PTR pSlotList = NULL; 4187c478bd9Sstevel@tonic-gate CK_MECHANISM_TYPE mech_type = 0; 4197c478bd9Sstevel@tonic-gate CK_MECHANISM_INFO info, kg_info; 4207c478bd9Sstevel@tonic-gate CK_MECHANISM mech; 4217c478bd9Sstevel@tonic-gate CK_SESSION_HANDLE hSession = CK_INVALID_HANDLE; 4227c478bd9Sstevel@tonic-gate CK_BYTE_PTR pkeydata = NULL; 423*1c9bd843Sdinak CK_BYTE salt[CK_PKCS5_PBKD2_SALT_SIZE]; 4247c478bd9Sstevel@tonic-gate CK_ULONG keysize = 0; 4257c478bd9Sstevel@tonic-gate int i, slot, mek; /* index variables */ 4267c478bd9Sstevel@tonic-gate int status; 4277c478bd9Sstevel@tonic-gate struct stat insbuf; /* stat buf for infile */ 4287c478bd9Sstevel@tonic-gate struct stat outsbuf; /* stat buf for outfile */ 4297c478bd9Sstevel@tonic-gate char tmpnam[PATH_MAX]; /* tmp file name */ 4307c478bd9Sstevel@tonic-gate CK_OBJECT_HANDLE key = (CK_OBJECT_HANDLE) 0; 4317c478bd9Sstevel@tonic-gate int infd = 0; /* input file, stdin default */ 4327c478bd9Sstevel@tonic-gate int outfd = 1; /* output file, stdout default */ 4337c478bd9Sstevel@tonic-gate char *outfilename = NULL; 4347c478bd9Sstevel@tonic-gate boolean_t errflag = B_TRUE; 4357c478bd9Sstevel@tonic-gate boolean_t inoutsame = B_FALSE; /* if both input & output are same */ 4367c478bd9Sstevel@tonic-gate CK_BYTE_PTR pivbuf = NULL_PTR; 4377c478bd9Sstevel@tonic-gate CK_ULONG ivlen = 0L; 4387c478bd9Sstevel@tonic-gate int mech_match = 0; 439*1c9bd843Sdinak CK_ULONG iterations = CK_PKCS5_PBKD2_ITERATIONS; 4407c478bd9Sstevel@tonic-gate CK_ULONG keylen; 4417c478bd9Sstevel@tonic-gate int version = SUNW_ENCRYPT_FILE_VERSION; 4427c478bd9Sstevel@tonic-gate CK_KEY_TYPE keytype; 443c197cb9dShylee KMF_RETURN kmfrv; 444c197cb9dShylee CK_SLOT_ID token_slot_id; 4457c478bd9Sstevel@tonic-gate 4467c478bd9Sstevel@tonic-gate if (aflag) { 4477c478bd9Sstevel@tonic-gate /* Determine if algorithm is valid */ 4487c478bd9Sstevel@tonic-gate for (mech_match = 0; mech_match < MECH_ALIASES_COUNT; 44930a5e8faSwyllys mech_match++) { 4507c478bd9Sstevel@tonic-gate if (strcmp(algo_str, 4517c478bd9Sstevel@tonic-gate mech_aliases[mech_match].alias) == 0) { 4527c478bd9Sstevel@tonic-gate mech_type = mech_aliases[mech_match].type; 4537c478bd9Sstevel@tonic-gate break; 4547c478bd9Sstevel@tonic-gate } 4557c478bd9Sstevel@tonic-gate } 4567c478bd9Sstevel@tonic-gate 4577c478bd9Sstevel@tonic-gate if (mech_match == MECH_ALIASES_COUNT) { 4587c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 4597c478bd9Sstevel@tonic-gate gettext("unknown algorithm -- %s"), algo_str); 4607c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 4617c478bd9Sstevel@tonic-gate } 4627c478bd9Sstevel@tonic-gate 4637c478bd9Sstevel@tonic-gate /* 464c197cb9dShylee * Process keyfile or get the token pin if -K is specified. 4657c478bd9Sstevel@tonic-gate * 4667c478bd9Sstevel@tonic-gate * If a keyfile is provided, get the key data from 4677c478bd9Sstevel@tonic-gate * the file. Otherwise, prompt for a passphrase. The 4687c478bd9Sstevel@tonic-gate * passphrase is used as the key data. 4697c478bd9Sstevel@tonic-gate */ 470c197cb9dShylee if (Kflag) { 471c197cb9dShylee /* get the pin of the token */ 472c197cb9dShylee if (token_label == NULL || !strlen(token_label)) { 473*1c9bd843Sdinak token_label = pkcs11_default_token(); 474c197cb9dShylee } 475c197cb9dShylee 476*1c9bd843Sdinak status = pkcs11_get_pass(token_label, 477*1c9bd843Sdinak (char **)&pkeydata, (size_t *)&keysize, 0, B_FALSE); 478c197cb9dShylee } else if (kflag) { 479c197cb9dShylee /* get the key file */ 480*1c9bd843Sdinak status = pkcs11_read_data(keyfile, (void **)&pkeydata, 481*1c9bd843Sdinak (size_t *)&keysize); 4827c478bd9Sstevel@tonic-gate } else { 483c197cb9dShylee /* get the key from input */ 484*1c9bd843Sdinak status = pkcs11_get_pass(NULL, (char **)&pkeydata, 485*1c9bd843Sdinak (size_t *)&keysize, 0, B_FALSE); 4867c478bd9Sstevel@tonic-gate } 4877c478bd9Sstevel@tonic-gate 4887c478bd9Sstevel@tonic-gate if (status == -1 || keysize == 0L) { 489c197cb9dShylee cryptoerror(LOG_STDERR, 490c197cb9dShylee Kflag ? gettext("invalid password.") : 491c197cb9dShylee gettext("invalid key.")); 4927c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 4937c478bd9Sstevel@tonic-gate } 4947c478bd9Sstevel@tonic-gate } 4957c478bd9Sstevel@tonic-gate 4967c478bd9Sstevel@tonic-gate bzero(salt, sizeof (salt)); 4977c478bd9Sstevel@tonic-gate /* Initialize pkcs */ 498c197cb9dShylee rv = C_Initialize(NULL); 499c197cb9dShylee if (rv != CKR_OK && rv != CKR_CRYPTOKI_ALREADY_INITIALIZED) { 5007c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("failed to initialize " 5017c478bd9Sstevel@tonic-gate "PKCS #11 framework: %s"), pkcs11_strerror(rv)); 5027c478bd9Sstevel@tonic-gate goto cleanup; 5037c478bd9Sstevel@tonic-gate } 5047c478bd9Sstevel@tonic-gate 5057c478bd9Sstevel@tonic-gate /* Get slot count */ 5067c478bd9Sstevel@tonic-gate rv = C_GetSlotList(0, NULL_PTR, &slotcount); 5077c478bd9Sstevel@tonic-gate if (rv != CKR_OK || slotcount == 0) { 5087c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 5097c478bd9Sstevel@tonic-gate "failed to find any cryptographic provider," 5107c478bd9Sstevel@tonic-gate "please check with your system administrator: %s"), 5117c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 5127c478bd9Sstevel@tonic-gate goto cleanup; 5137c478bd9Sstevel@tonic-gate } 5147c478bd9Sstevel@tonic-gate 5157c478bd9Sstevel@tonic-gate /* Found at least one slot, allocate memory for slot list */ 5167c478bd9Sstevel@tonic-gate pSlotList = malloc(slotcount * sizeof (CK_SLOT_ID)); 5177c478bd9Sstevel@tonic-gate if (pSlotList == NULL_PTR) { 5187c478bd9Sstevel@tonic-gate int err = errno; 5197c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("malloc: %s"), strerror(err)); 5207c478bd9Sstevel@tonic-gate goto cleanup; 5217c478bd9Sstevel@tonic-gate } 5227c478bd9Sstevel@tonic-gate 5237c478bd9Sstevel@tonic-gate /* Get the list of slots */ 5247c478bd9Sstevel@tonic-gate if ((rv = C_GetSlotList(0, pSlotList, &slotcount)) != CKR_OK) { 5257c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 5267c478bd9Sstevel@tonic-gate "failed to find any cryptographic provider," 5277c478bd9Sstevel@tonic-gate "please check with your system administrator: %s"), 5287c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 5297c478bd9Sstevel@tonic-gate goto cleanup; 5307c478bd9Sstevel@tonic-gate } 5317c478bd9Sstevel@tonic-gate 5327c478bd9Sstevel@tonic-gate if (lflag) { 5337c478bd9Sstevel@tonic-gate 5347c478bd9Sstevel@tonic-gate /* Iterate through slots */ 5357c478bd9Sstevel@tonic-gate for (slot = 0; slot < slotcount; slot++) { 5367c478bd9Sstevel@tonic-gate 5377c478bd9Sstevel@tonic-gate /* Iterate through each mechanism */ 5387c478bd9Sstevel@tonic-gate for (mek = 0; mek < MECH_ALIASES_COUNT; mek++) { 5397c478bd9Sstevel@tonic-gate rv = C_GetMechanismInfo(pSlotList[slot], 5407c478bd9Sstevel@tonic-gate mech_aliases[mek].type, &info); 5417c478bd9Sstevel@tonic-gate 5427c478bd9Sstevel@tonic-gate if (rv != CKR_OK) 5437c478bd9Sstevel@tonic-gate continue; 5447c478bd9Sstevel@tonic-gate 5457c478bd9Sstevel@tonic-gate /* 5467c478bd9Sstevel@tonic-gate * Set to minimum/maximum key sizes assuming 5477c478bd9Sstevel@tonic-gate * the values available are not 0. 5487c478bd9Sstevel@tonic-gate */ 5497c478bd9Sstevel@tonic-gate if (info.ulMinKeySize && (info.ulMinKeySize < 5507c478bd9Sstevel@tonic-gate mech_aliases[mek].keysize_min)) 5517c478bd9Sstevel@tonic-gate mech_aliases[mek].keysize_min = 55230a5e8faSwyllys info.ulMinKeySize; 5537c478bd9Sstevel@tonic-gate 5547c478bd9Sstevel@tonic-gate if (info.ulMaxKeySize && (info.ulMaxKeySize > 5557c478bd9Sstevel@tonic-gate mech_aliases[mek].keysize_max)) 5567c478bd9Sstevel@tonic-gate mech_aliases[mek].keysize_max = 55730a5e8faSwyllys info.ulMaxKeySize; 5587c478bd9Sstevel@tonic-gate 5597c478bd9Sstevel@tonic-gate mech_aliases[mek].available = B_TRUE; 5607c478bd9Sstevel@tonic-gate } 5617c478bd9Sstevel@tonic-gate 5627c478bd9Sstevel@tonic-gate } 5637c478bd9Sstevel@tonic-gate 5647c478bd9Sstevel@tonic-gate algorithm_list(); 5657c478bd9Sstevel@tonic-gate 5667c478bd9Sstevel@tonic-gate errflag = B_FALSE; 5677c478bd9Sstevel@tonic-gate goto cleanup; 5687c478bd9Sstevel@tonic-gate } 5697c478bd9Sstevel@tonic-gate 570c197cb9dShylee 571c197cb9dShylee /* 572c197cb9dShylee * Find a slot with matching mechanism 573c197cb9dShylee * 574c197cb9dShylee * If -K is specified, we find the slot id for the token first, then 575c197cb9dShylee * check if the slot supports the algorithm. 576c197cb9dShylee */ 577c197cb9dShylee i = 0; 578c197cb9dShylee if (Kflag) { 57930a5e8faSwyllys kmfrv = kmf_pk11_token_lookup(NULL, token_label, 58030a5e8faSwyllys &token_slot_id); 581c197cb9dShylee if (kmfrv != KMF_OK) { 582c197cb9dShylee cryptoerror(LOG_STDERR, 583c197cb9dShylee gettext("no matching PKCS#11 token")); 584c197cb9dShylee errflag = B_TRUE; 585c197cb9dShylee goto cleanup; 586c197cb9dShylee } 587c197cb9dShylee rv = C_GetMechanismInfo(token_slot_id, mech_type, &info); 588c197cb9dShylee if (rv == CKR_OK && (info.flags & cmd->flags)) 589c197cb9dShylee slotID = token_slot_id; 590c197cb9dShylee else 591c197cb9dShylee i = slotcount; 592c197cb9dShylee } else { 593c197cb9dShylee for (i = 0; i < slotcount; i++) { 594c197cb9dShylee slotID = pSlotList[i]; 595c197cb9dShylee rv = C_GetMechanismInfo(slotID, mech_type, &info); 596c197cb9dShylee if (rv != CKR_OK) { 597c197cb9dShylee continue; /* to the next slot */ 598c197cb9dShylee } else { 599c197cb9dShylee /* 600c197cb9dShylee * If the slot support the crypto, also 601c197cb9dShylee * make sure it supports the correct 602c197cb9dShylee * key generation mech if needed. 603c197cb9dShylee * 604c197cb9dShylee * We need PKCS5 when RC4 is used or 605c197cb9dShylee * when the key is entered on cmd line. 606c197cb9dShylee */ 607c197cb9dShylee if ((info.flags & cmd->flags) && 608c197cb9dShylee (mech_type == CKM_RC4) || 609c197cb9dShylee (keyfile == NULL)) { 610c197cb9dShylee rv = C_GetMechanismInfo(slotID, 611c197cb9dShylee CKM_PKCS5_PBKD2, &kg_info); 612c197cb9dShylee if (rv == CKR_OK) 613c197cb9dShylee break; 614c197cb9dShylee } else if (info.flags & cmd->flags) { 6157c478bd9Sstevel@tonic-gate break; 616c197cb9dShylee } 6177c478bd9Sstevel@tonic-gate } 6187c478bd9Sstevel@tonic-gate } 6197c478bd9Sstevel@tonic-gate } 6207c478bd9Sstevel@tonic-gate 6217c478bd9Sstevel@tonic-gate /* Show error if no matching mechanism found */ 6227c478bd9Sstevel@tonic-gate if (i == slotcount) { 6237c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 6247c478bd9Sstevel@tonic-gate gettext("no cryptographic provider was " 6257c478bd9Sstevel@tonic-gate "found for this algorithm -- %s"), algo_str); 6267c478bd9Sstevel@tonic-gate goto cleanup; 6277c478bd9Sstevel@tonic-gate } 6287c478bd9Sstevel@tonic-gate 6297c478bd9Sstevel@tonic-gate /* Open a session */ 6307c478bd9Sstevel@tonic-gate rv = C_OpenSession(slotID, CKF_SERIAL_SESSION, 63130a5e8faSwyllys NULL_PTR, NULL, &hSession); 6327c478bd9Sstevel@tonic-gate 6337c478bd9Sstevel@tonic-gate if (rv != CKR_OK) { 6347c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 6357c478bd9Sstevel@tonic-gate gettext("can not open PKCS #11 session: %s"), 6367c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 6377c478bd9Sstevel@tonic-gate goto cleanup; 6387c478bd9Sstevel@tonic-gate } 6397c478bd9Sstevel@tonic-gate 6407c478bd9Sstevel@tonic-gate /* 6417c478bd9Sstevel@tonic-gate * Generate IV data for encrypt. 6427c478bd9Sstevel@tonic-gate */ 6437c478bd9Sstevel@tonic-gate ivlen = mech_aliases[mech_match].ivlen; 6447c478bd9Sstevel@tonic-gate if ((pivbuf = malloc((size_t)ivlen)) == NULL) { 6457c478bd9Sstevel@tonic-gate int err = errno; 6467c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("malloc: %s"), 6477c478bd9Sstevel@tonic-gate strerror(err)); 6487c478bd9Sstevel@tonic-gate goto cleanup; 6497c478bd9Sstevel@tonic-gate } 6507c478bd9Sstevel@tonic-gate 6517c478bd9Sstevel@tonic-gate if (cmd->type == CKA_ENCRYPT) { 652*1c9bd843Sdinak if ((pkcs11_random_data((void *)pivbuf, 6537c478bd9Sstevel@tonic-gate mech_aliases[mech_match].ivlen)) != 0) { 6547c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 65530a5e8faSwyllys "Unable to generate random " 65630a5e8faSwyllys "data for initialization vector.")); 6577c478bd9Sstevel@tonic-gate goto cleanup; 6587c478bd9Sstevel@tonic-gate } 6597c478bd9Sstevel@tonic-gate } 6607c478bd9Sstevel@tonic-gate 6617c478bd9Sstevel@tonic-gate /* 6627c478bd9Sstevel@tonic-gate * Create the key object 6637c478bd9Sstevel@tonic-gate */ 6647c478bd9Sstevel@tonic-gate rv = pkcs11_mech2keytype(mech_type, &keytype); 6657c478bd9Sstevel@tonic-gate if (rv != CKR_OK) { 6667c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 66730a5e8faSwyllys gettext("unable to find key type for algorithm.")); 6687c478bd9Sstevel@tonic-gate goto cleanup; 6697c478bd9Sstevel@tonic-gate } 6707c478bd9Sstevel@tonic-gate 6717c478bd9Sstevel@tonic-gate /* Open input file */ 6727c478bd9Sstevel@tonic-gate if (iflag) { 6737c478bd9Sstevel@tonic-gate if ((infd = open(inputfile, O_RDONLY | O_NONBLOCK)) == -1) { 6747c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 67530a5e8faSwyllys "can not open input file %s"), inputfile); 6767c478bd9Sstevel@tonic-gate goto cleanup; 6777c478bd9Sstevel@tonic-gate } 6787c478bd9Sstevel@tonic-gate 6797c478bd9Sstevel@tonic-gate /* Get info on input file */ 6807c478bd9Sstevel@tonic-gate if (fstat(infd, &insbuf) == -1) { 6817c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 68230a5e8faSwyllys "can not stat input file %s"), inputfile); 6837c478bd9Sstevel@tonic-gate goto cleanup; 6847c478bd9Sstevel@tonic-gate } 6857c478bd9Sstevel@tonic-gate } 6867c478bd9Sstevel@tonic-gate 6877c478bd9Sstevel@tonic-gate /* 6887c478bd9Sstevel@tonic-gate * Prepare output file 6897c478bd9Sstevel@tonic-gate * If the input & output file are same, 6907c478bd9Sstevel@tonic-gate * the output is written to a temp 6917c478bd9Sstevel@tonic-gate * file first, then renamed to the original file 6927c478bd9Sstevel@tonic-gate * after the crypt operation 6937c478bd9Sstevel@tonic-gate */ 6947c478bd9Sstevel@tonic-gate inoutsame = B_FALSE; 6957c478bd9Sstevel@tonic-gate if (oflag) { 6967c478bd9Sstevel@tonic-gate outfilename = outputfile; 6977c478bd9Sstevel@tonic-gate if ((stat(outputfile, &outsbuf) != -1) && 69830a5e8faSwyllys (insbuf.st_ino == outsbuf.st_ino)) { 6997c478bd9Sstevel@tonic-gate char *dir; 7007c478bd9Sstevel@tonic-gate 7017c478bd9Sstevel@tonic-gate /* create temp file on same dir */ 7027c478bd9Sstevel@tonic-gate dir = dirname(outputfile); 7037c478bd9Sstevel@tonic-gate (void) snprintf(tmpnam, sizeof (tmpnam), 70430a5e8faSwyllys "%s/encrXXXXXX", dir); 7057c478bd9Sstevel@tonic-gate outfilename = tmpnam; 7067c478bd9Sstevel@tonic-gate if ((outfd = mkstemp(tmpnam)) == -1) { 7077c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 7087c478bd9Sstevel@tonic-gate "cannot create temp file")); 7097c478bd9Sstevel@tonic-gate goto cleanup; 7107c478bd9Sstevel@tonic-gate } 7117c478bd9Sstevel@tonic-gate inoutsame = B_TRUE; 7127c478bd9Sstevel@tonic-gate } else { 7137c478bd9Sstevel@tonic-gate /* Create file for output */ 7147c478bd9Sstevel@tonic-gate if ((outfd = open(outfilename, 71530a5e8faSwyllys O_CREAT|O_WRONLY|O_TRUNC, 0644)) == -1) { 7167c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 7177c478bd9Sstevel@tonic-gate "cannot open output file %s"), 7187c478bd9Sstevel@tonic-gate outfilename); 7197c478bd9Sstevel@tonic-gate goto cleanup; 7207c478bd9Sstevel@tonic-gate } 7217c478bd9Sstevel@tonic-gate } 7227c478bd9Sstevel@tonic-gate } 7237c478bd9Sstevel@tonic-gate 7247c478bd9Sstevel@tonic-gate /* 7257c478bd9Sstevel@tonic-gate * Read the version number from the head of the file 7267c478bd9Sstevel@tonic-gate * to know how to interpret the data that follows. 7277c478bd9Sstevel@tonic-gate */ 7287c478bd9Sstevel@tonic-gate if (cmd->type == CKA_DECRYPT) { 7297c478bd9Sstevel@tonic-gate if (read(infd, &version, sizeof (version)) != 73030a5e8faSwyllys sizeof (version)) { 7317c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 7327c478bd9Sstevel@tonic-gate "failed to get format version from " 7337c478bd9Sstevel@tonic-gate "input file.")); 7347c478bd9Sstevel@tonic-gate goto cleanup; 7357c478bd9Sstevel@tonic-gate } 7367c478bd9Sstevel@tonic-gate /* convert to host byte order */ 7377c478bd9Sstevel@tonic-gate version = ntohl(version); 7387c478bd9Sstevel@tonic-gate 7397c478bd9Sstevel@tonic-gate switch (version) { 7407c478bd9Sstevel@tonic-gate case 1: 7417c478bd9Sstevel@tonic-gate /* 7427c478bd9Sstevel@tonic-gate * Version 1 output format: 7437c478bd9Sstevel@tonic-gate * - Iterations used in key gen function (4 bytes) 7447c478bd9Sstevel@tonic-gate * - IV ( 'ivlen' bytes) 7457c478bd9Sstevel@tonic-gate * - Salt data used in key gen (16 bytes) 7467c478bd9Sstevel@tonic-gate * 7477c478bd9Sstevel@tonic-gate * An encrypted file has IV as first block (0 or 7487c478bd9Sstevel@tonic-gate * more bytes depending on mechanism) followed 7497c478bd9Sstevel@tonic-gate * by cipher text. Get the IV from the encrypted 7507c478bd9Sstevel@tonic-gate * file. 7517c478bd9Sstevel@tonic-gate */ 7527c478bd9Sstevel@tonic-gate /* 7537c478bd9Sstevel@tonic-gate * Read iteration count and salt data. 7547c478bd9Sstevel@tonic-gate */ 7557c478bd9Sstevel@tonic-gate if (read(infd, &iterations, 75630a5e8faSwyllys sizeof (iterations)) != sizeof (iterations)) { 7577c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 75830a5e8faSwyllys "failed to get iterations from " 75930a5e8faSwyllys "input file.")); 7607c478bd9Sstevel@tonic-gate goto cleanup; 7617c478bd9Sstevel@tonic-gate } 7627c478bd9Sstevel@tonic-gate /* convert to host byte order */ 7637c478bd9Sstevel@tonic-gate iterations = ntohl(iterations); 7647c478bd9Sstevel@tonic-gate if (ivlen > 0 && 7657c478bd9Sstevel@tonic-gate read(infd, pivbuf, ivlen) != ivlen) { 7667c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 7677c478bd9Sstevel@tonic-gate "failed to get initialization " 7687c478bd9Sstevel@tonic-gate "vector from input file.")); 7697c478bd9Sstevel@tonic-gate goto cleanup; 7707c478bd9Sstevel@tonic-gate } 7717c478bd9Sstevel@tonic-gate if (read(infd, salt, sizeof (salt)) 77230a5e8faSwyllys != sizeof (salt)) { 7737c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 77430a5e8faSwyllys "failed to get salt data from " 77530a5e8faSwyllys "input file.")); 7767c478bd9Sstevel@tonic-gate goto cleanup; 7777c478bd9Sstevel@tonic-gate } 7787c478bd9Sstevel@tonic-gate break; 7797c478bd9Sstevel@tonic-gate default: 7807c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 78130a5e8faSwyllys "Unrecognized format version read from " 78230a5e8faSwyllys "input file - expected %d, got %d."), 78330a5e8faSwyllys SUNW_ENCRYPT_FILE_VERSION, version); 7847c478bd9Sstevel@tonic-gate goto cleanup; 7857c478bd9Sstevel@tonic-gate break; 7867c478bd9Sstevel@tonic-gate } 7877c478bd9Sstevel@tonic-gate } 788c197cb9dShylee 7897c478bd9Sstevel@tonic-gate /* 790c197cb9dShylee * If Kflag is set, let's find the token key now. 791c197cb9dShylee * 792c197cb9dShylee * If Kflag is not set and if encrypting, we need some random 7937c478bd9Sstevel@tonic-gate * salt data to create the key. If decrypting, 7947c478bd9Sstevel@tonic-gate * the salt should come from head of the file 7957c478bd9Sstevel@tonic-gate * to be decrypted. 7967c478bd9Sstevel@tonic-gate */ 797c197cb9dShylee if (Kflag) { 798c197cb9dShylee rv = get_token_key(hSession, keytype, key_label, pkeydata, 799c197cb9dShylee keysize, &key); 800c197cb9dShylee if (rv != CKR_OK) { 801c197cb9dShylee cryptoerror(LOG_STDERR, gettext( 802c197cb9dShylee "Can not find the token key")); 803c197cb9dShylee goto cleanup; 804c197cb9dShylee } else { 805c197cb9dShylee goto do_crypto; 806c197cb9dShylee } 807c197cb9dShylee } else if (cmd->type == CKA_ENCRYPT) { 808*1c9bd843Sdinak rv = pkcs11_random_data((void *)salt, sizeof (salt)); 8097c478bd9Sstevel@tonic-gate if (rv != 0) { 8107c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 8117c478bd9Sstevel@tonic-gate gettext("unable to generate random " 81230a5e8faSwyllys "data for key salt.")); 8137c478bd9Sstevel@tonic-gate goto cleanup; 8147c478bd9Sstevel@tonic-gate } 8157c478bd9Sstevel@tonic-gate } 8167c478bd9Sstevel@tonic-gate 817c197cb9dShylee 8187c478bd9Sstevel@tonic-gate /* 8197c478bd9Sstevel@tonic-gate * If key input is read from a file, treat it as 8207c478bd9Sstevel@tonic-gate * raw key data, unless it is to be used with RC4, 8217c478bd9Sstevel@tonic-gate * in which case it must be used to generate a pkcs5 8227c478bd9Sstevel@tonic-gate * key to address security concerns with RC4 keys. 8237c478bd9Sstevel@tonic-gate */ 8247c478bd9Sstevel@tonic-gate if (kflag && keyfile != NULL && keytype != CKK_RC4) { 825*1c9bd843Sdinak /* XXX : why wasn't SUNW_C_KeyToObject used here? */ 8267c478bd9Sstevel@tonic-gate CK_OBJECT_CLASS objclass = CKO_SECRET_KEY; 8277c478bd9Sstevel@tonic-gate CK_ATTRIBUTE template[5]; 8287c478bd9Sstevel@tonic-gate int nattr = 0; 8297c478bd9Sstevel@tonic-gate 8307c478bd9Sstevel@tonic-gate template[nattr].type = CKA_CLASS; 8317c478bd9Sstevel@tonic-gate template[nattr].pValue = &objclass; 8327c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (objclass); 8337c478bd9Sstevel@tonic-gate nattr++; 8347c478bd9Sstevel@tonic-gate 8357c478bd9Sstevel@tonic-gate template[nattr].type = CKA_KEY_TYPE; 8367c478bd9Sstevel@tonic-gate template[nattr].pValue = &keytype; 8377c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (keytype); 8387c478bd9Sstevel@tonic-gate nattr++; 8397c478bd9Sstevel@tonic-gate 8407c478bd9Sstevel@tonic-gate template[nattr].type = cmd->type; 8417c478bd9Sstevel@tonic-gate template[nattr].pValue = &truevalue; 8427c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (truevalue); 8437c478bd9Sstevel@tonic-gate nattr++; 8447c478bd9Sstevel@tonic-gate 8457c478bd9Sstevel@tonic-gate template[nattr].type = CKA_TOKEN; 8467c478bd9Sstevel@tonic-gate template[nattr].pValue = &falsevalue; 8477c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (falsevalue); 8487c478bd9Sstevel@tonic-gate nattr++; 8497c478bd9Sstevel@tonic-gate 8507c478bd9Sstevel@tonic-gate template[nattr].type = CKA_VALUE; 8517c478bd9Sstevel@tonic-gate template[nattr].pValue = pkeydata; 8527c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = keysize; 8537c478bd9Sstevel@tonic-gate nattr++; 8547c478bd9Sstevel@tonic-gate 85530a5e8faSwyllys rv = C_CreateObject(hSession, template, nattr, &key); 8567c478bd9Sstevel@tonic-gate } else { 8577c478bd9Sstevel@tonic-gate /* 8587c478bd9Sstevel@tonic-gate * If the encryption type has a fixed key length, 8597c478bd9Sstevel@tonic-gate * then its not necessary to set the key length 8607c478bd9Sstevel@tonic-gate * parameter when generating the key. 8617c478bd9Sstevel@tonic-gate */ 8627c478bd9Sstevel@tonic-gate if (keytype == CKK_DES || keytype == CKK_DES3) 8637c478bd9Sstevel@tonic-gate keylen = 0; 8647c478bd9Sstevel@tonic-gate else 8657c478bd9Sstevel@tonic-gate keylen = 16; 8667c478bd9Sstevel@tonic-gate 8677c478bd9Sstevel@tonic-gate /* 8687c478bd9Sstevel@tonic-gate * Generate a cryptographically secure key using 8697c478bd9Sstevel@tonic-gate * the key read from the file given (-k keyfile) or 8707c478bd9Sstevel@tonic-gate * the passphrase entered by the user. 8717c478bd9Sstevel@tonic-gate */ 872*1c9bd843Sdinak rv = pkcs11_PasswdToPBKD2Object(hSession, (char *)pkeydata, 873*1c9bd843Sdinak (size_t)keysize, (void *)salt, sizeof (salt), iterations, 874*1c9bd843Sdinak keytype, keylen, cmd->flags, &key); 8757c478bd9Sstevel@tonic-gate } 8767c478bd9Sstevel@tonic-gate 8777c478bd9Sstevel@tonic-gate if (rv != CKR_OK) { 8787c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 8797c478bd9Sstevel@tonic-gate "failed to generate a key: %s"), 8807c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 8817c478bd9Sstevel@tonic-gate goto cleanup; 8827c478bd9Sstevel@tonic-gate } 8837c478bd9Sstevel@tonic-gate 884c197cb9dShylee 885c197cb9dShylee do_crypto: 8867c478bd9Sstevel@tonic-gate /* Setup up mechanism */ 8877c478bd9Sstevel@tonic-gate mech.mechanism = mech_type; 8887c478bd9Sstevel@tonic-gate mech.pParameter = (CK_VOID_PTR)pivbuf; 8897c478bd9Sstevel@tonic-gate mech.ulParameterLen = ivlen; 8907c478bd9Sstevel@tonic-gate 8917c478bd9Sstevel@tonic-gate if ((rv = cmd->Init(hSession, &mech, key)) != CKR_OK) { 8927c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 8937c478bd9Sstevel@tonic-gate "failed to initialize crypto operation: %s"), 8947c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 8957c478bd9Sstevel@tonic-gate goto cleanup; 8967c478bd9Sstevel@tonic-gate } 8977c478bd9Sstevel@tonic-gate 8987c478bd9Sstevel@tonic-gate /* Write the version header encrypt command */ 8997c478bd9Sstevel@tonic-gate if (cmd->type == CKA_ENCRYPT) { 9007c478bd9Sstevel@tonic-gate /* convert to network order for storage */ 9017c478bd9Sstevel@tonic-gate int netversion = htonl(version); 9027c478bd9Sstevel@tonic-gate CK_ULONG netiter; 9037c478bd9Sstevel@tonic-gate 9047c478bd9Sstevel@tonic-gate if (write(outfd, &netversion, sizeof (netversion)) 90530a5e8faSwyllys != sizeof (netversion)) { 9067c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 90730a5e8faSwyllys "failed to write version number " 90830a5e8faSwyllys "to output file.")); 9097c478bd9Sstevel@tonic-gate goto cleanup; 9107c478bd9Sstevel@tonic-gate } 9117c478bd9Sstevel@tonic-gate /* 9127c478bd9Sstevel@tonic-gate * Write the iteration and salt data, even if they 9137c478bd9Sstevel@tonic-gate * were not used to generate a key. 9147c478bd9Sstevel@tonic-gate */ 9157c478bd9Sstevel@tonic-gate netiter = htonl(iterations); 9167c478bd9Sstevel@tonic-gate if (write(outfd, &netiter, 91730a5e8faSwyllys sizeof (netiter)) != sizeof (netiter)) { 9187c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 9197c478bd9Sstevel@tonic-gate "failed to write iterations to output")); 9207c478bd9Sstevel@tonic-gate goto cleanup; 9217c478bd9Sstevel@tonic-gate } 92230a5e8faSwyllys if (ivlen > 0 && write(outfd, pivbuf, ivlen) != ivlen) { 9237c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 92430a5e8faSwyllys "failed to write initialization vector " 92530a5e8faSwyllys "to output")); 9267c478bd9Sstevel@tonic-gate goto cleanup; 9277c478bd9Sstevel@tonic-gate } 9287c478bd9Sstevel@tonic-gate if (write(outfd, salt, sizeof (salt)) != sizeof (salt)) { 9297c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 9307c478bd9Sstevel@tonic-gate "failed to write salt data to output")); 9317c478bd9Sstevel@tonic-gate goto cleanup; 9327c478bd9Sstevel@tonic-gate } 9337c478bd9Sstevel@tonic-gate } 9347c478bd9Sstevel@tonic-gate 93554da5c1fSjk if (crypt_multipart(cmd, hSession, infd, outfd, insbuf.st_size) == -1) { 9367c478bd9Sstevel@tonic-gate goto cleanup; 9377c478bd9Sstevel@tonic-gate } 9387c478bd9Sstevel@tonic-gate 9397c478bd9Sstevel@tonic-gate errflag = B_FALSE; 9407c478bd9Sstevel@tonic-gate 9417c478bd9Sstevel@tonic-gate /* 9427c478bd9Sstevel@tonic-gate * Clean up 9437c478bd9Sstevel@tonic-gate */ 9447c478bd9Sstevel@tonic-gate cleanup: 9457c478bd9Sstevel@tonic-gate /* Clear the key data, so others cannot snoop */ 9467c478bd9Sstevel@tonic-gate if (pkeydata != NULL) { 9477c478bd9Sstevel@tonic-gate bzero(pkeydata, keysize); 9487c478bd9Sstevel@tonic-gate free(pkeydata); 9497c478bd9Sstevel@tonic-gate pkeydata = NULL; 9507c478bd9Sstevel@tonic-gate } 9517c478bd9Sstevel@tonic-gate 9527c478bd9Sstevel@tonic-gate /* Destroy key object */ 953c197cb9dShylee if (Kflag != B_FALSE && key != (CK_OBJECT_HANDLE) 0) { 9547c478bd9Sstevel@tonic-gate (void) C_DestroyObject(hSession, key); 9557c478bd9Sstevel@tonic-gate } 9567c478bd9Sstevel@tonic-gate 9577c478bd9Sstevel@tonic-gate /* free allocated memory */ 9587c478bd9Sstevel@tonic-gate if (pSlotList != NULL) 9597c478bd9Sstevel@tonic-gate free(pSlotList); 9607c478bd9Sstevel@tonic-gate if (pivbuf != NULL) 9617c478bd9Sstevel@tonic-gate free(pivbuf); 9627c478bd9Sstevel@tonic-gate 9637c478bd9Sstevel@tonic-gate /* close all the files */ 96454da5c1fSjk if (iflag && (infd != -1)) 9657c478bd9Sstevel@tonic-gate (void) close(infd); 96654da5c1fSjk if (oflag && (outfd != -1)) 9677c478bd9Sstevel@tonic-gate (void) close(outfd); 9687c478bd9Sstevel@tonic-gate 9697c478bd9Sstevel@tonic-gate /* rename tmp output to input file */ 9707c478bd9Sstevel@tonic-gate if (inoutsame) { 9717c478bd9Sstevel@tonic-gate if (rename(outfilename, inputfile) == -1) { 9727c478bd9Sstevel@tonic-gate (void) unlink(outfilename); 9737c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("rename failed.")); 9747c478bd9Sstevel@tonic-gate } 9757c478bd9Sstevel@tonic-gate } 9767c478bd9Sstevel@tonic-gate 9777c478bd9Sstevel@tonic-gate /* If error occurred, remove the output file */ 9787c478bd9Sstevel@tonic-gate if (errflag && outfilename != NULL) { 9797c478bd9Sstevel@tonic-gate (void) unlink(outfilename); 9807c478bd9Sstevel@tonic-gate } 9817c478bd9Sstevel@tonic-gate 9827c478bd9Sstevel@tonic-gate /* close pkcs11 session */ 9837c478bd9Sstevel@tonic-gate if (hSession != CK_INVALID_HANDLE) 9847c478bd9Sstevel@tonic-gate (void) C_CloseSession(hSession); 9857c478bd9Sstevel@tonic-gate 9867c478bd9Sstevel@tonic-gate (void) C_Finalize(NULL); 9877c478bd9Sstevel@tonic-gate 9887c478bd9Sstevel@tonic-gate return (errflag); 9897c478bd9Sstevel@tonic-gate } 9907c478bd9Sstevel@tonic-gate 9917c478bd9Sstevel@tonic-gate /* 9927c478bd9Sstevel@tonic-gate * Function for printing progress bar when the verbose flag 9937c478bd9Sstevel@tonic-gate * is set. 9947c478bd9Sstevel@tonic-gate * 9957c478bd9Sstevel@tonic-gate * The vertical bar is printed at 25, 50, and 75% complete. 9967c478bd9Sstevel@tonic-gate * 9977c478bd9Sstevel@tonic-gate * The function is passed the number of positions on the screen it needs to 9987c478bd9Sstevel@tonic-gate * advance and loops. 9997c478bd9Sstevel@tonic-gate */ 10007c478bd9Sstevel@tonic-gate 10017c478bd9Sstevel@tonic-gate static void 10027c478bd9Sstevel@tonic-gate print_status(int pos_to_advance) 10037c478bd9Sstevel@tonic-gate { 10047c478bd9Sstevel@tonic-gate 10057c478bd9Sstevel@tonic-gate while (pos_to_advance > 0) { 10067c478bd9Sstevel@tonic-gate switch (status_pos) { 10077c478bd9Sstevel@tonic-gate case 0: 10087c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("[")); 10097c478bd9Sstevel@tonic-gate break; 10107c478bd9Sstevel@tonic-gate case 19: 10117c478bd9Sstevel@tonic-gate case 39: 10127c478bd9Sstevel@tonic-gate case 59: 10137c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("|")); 10147c478bd9Sstevel@tonic-gate break; 10157c478bd9Sstevel@tonic-gate default: 10167c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext(".")); 10177c478bd9Sstevel@tonic-gate } 10187c478bd9Sstevel@tonic-gate pos_to_advance--; 10197c478bd9Sstevel@tonic-gate status_pos++; 10207c478bd9Sstevel@tonic-gate } 10217c478bd9Sstevel@tonic-gate } 10227c478bd9Sstevel@tonic-gate 10237c478bd9Sstevel@tonic-gate /* 10247c478bd9Sstevel@tonic-gate * Encrypt/Decrypt in multi part. 10257c478bd9Sstevel@tonic-gate * 10267c478bd9Sstevel@tonic-gate * This function reads the input file (infd) and writes the 10277c478bd9Sstevel@tonic-gate * encrypted/decrypted output to file (outfd). 10287c478bd9Sstevel@tonic-gate * 10297c478bd9Sstevel@tonic-gate * cmd - pointing to commandinfo 10307c478bd9Sstevel@tonic-gate * hSession - pkcs session 10317c478bd9Sstevel@tonic-gate * infd - input file descriptor 10327c478bd9Sstevel@tonic-gate * outfd - output file descriptor 10337c478bd9Sstevel@tonic-gate * 10347c478bd9Sstevel@tonic-gate */ 10357c478bd9Sstevel@tonic-gate 10367c478bd9Sstevel@tonic-gate static int 10377c478bd9Sstevel@tonic-gate crypt_multipart(struct CommandInfo *cmd, CK_SESSION_HANDLE hSession, 103854da5c1fSjk int infd, int outfd, off_t insize) 10397c478bd9Sstevel@tonic-gate { 10407c478bd9Sstevel@tonic-gate CK_RV rv; 10417c478bd9Sstevel@tonic-gate CK_ULONG resultlen; 10427c478bd9Sstevel@tonic-gate CK_ULONG resultbuflen; 10437c478bd9Sstevel@tonic-gate CK_BYTE_PTR resultbuf; 10447c478bd9Sstevel@tonic-gate CK_ULONG datalen; 10457c478bd9Sstevel@tonic-gate CK_BYTE databuf[BUFFERSIZE]; 10467c478bd9Sstevel@tonic-gate CK_BYTE outbuf[BUFFERSIZE+BLOCKSIZE]; 10477c478bd9Sstevel@tonic-gate CK_ULONG status_index = 0; /* current total file size read */ 10487c478bd9Sstevel@tonic-gate float status_last = 0.0; /* file size of last element used */ 10497c478bd9Sstevel@tonic-gate float status_incr = 0.0; /* file size element increments */ 10507c478bd9Sstevel@tonic-gate int pos; /* # of progress bar elements to be print */ 10517c478bd9Sstevel@tonic-gate ssize_t nread; 10527c478bd9Sstevel@tonic-gate boolean_t errflag = B_FALSE; 10537c478bd9Sstevel@tonic-gate 10547c478bd9Sstevel@tonic-gate datalen = sizeof (databuf); 10557c478bd9Sstevel@tonic-gate resultbuflen = sizeof (outbuf); 10567c478bd9Sstevel@tonic-gate resultbuf = outbuf; 10577c478bd9Sstevel@tonic-gate 10587c478bd9Sstevel@tonic-gate /* Divide into 79 increments for progress bar element spacing */ 10597c478bd9Sstevel@tonic-gate if (vflag && iflag) 106054da5c1fSjk status_incr = (insize / 79.0); 10617c478bd9Sstevel@tonic-gate 10627c478bd9Sstevel@tonic-gate while ((nread = read(infd, databuf, datalen)) > 0) { 10637c478bd9Sstevel@tonic-gate 10647c478bd9Sstevel@tonic-gate /* Start with the initial buffer */ 10657c478bd9Sstevel@tonic-gate resultlen = resultbuflen; 10667c478bd9Sstevel@tonic-gate rv = cmd->Update(hSession, databuf, (CK_ULONG)nread, 106730a5e8faSwyllys resultbuf, &resultlen); 10687c478bd9Sstevel@tonic-gate 10697c478bd9Sstevel@tonic-gate /* Need a bigger buffer? */ 10707c478bd9Sstevel@tonic-gate if (rv == CKR_BUFFER_TOO_SMALL) { 10717c478bd9Sstevel@tonic-gate 10727c478bd9Sstevel@tonic-gate /* free the old buffer */ 10737c478bd9Sstevel@tonic-gate if (resultbuf != NULL && resultbuf != outbuf) { 10747c478bd9Sstevel@tonic-gate bzero(resultbuf, resultbuflen); 10757c478bd9Sstevel@tonic-gate free(resultbuf); 10767c478bd9Sstevel@tonic-gate } 10777c478bd9Sstevel@tonic-gate 10787c478bd9Sstevel@tonic-gate /* allocate a new big buffer */ 10797c478bd9Sstevel@tonic-gate if ((resultbuf = malloc((size_t)resultlen)) == NULL) { 10807c478bd9Sstevel@tonic-gate int err = errno; 10817c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("malloc: %s"), 10827c478bd9Sstevel@tonic-gate strerror(err)); 10837c478bd9Sstevel@tonic-gate return (-1); 10847c478bd9Sstevel@tonic-gate } 10857c478bd9Sstevel@tonic-gate resultbuflen = resultlen; 10867c478bd9Sstevel@tonic-gate 10877c478bd9Sstevel@tonic-gate /* Try again with bigger buffer */ 10887c478bd9Sstevel@tonic-gate rv = cmd->Update(hSession, databuf, (CK_ULONG)nread, 108930a5e8faSwyllys resultbuf, &resultlen); 10907c478bd9Sstevel@tonic-gate } 10917c478bd9Sstevel@tonic-gate 10927c478bd9Sstevel@tonic-gate if (rv != CKR_OK) { 10937c478bd9Sstevel@tonic-gate errflag = B_TRUE; 10947c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 10957c478bd9Sstevel@tonic-gate "crypto operation failed: %s"), 10967c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 10977c478bd9Sstevel@tonic-gate break; 10987c478bd9Sstevel@tonic-gate } 10997c478bd9Sstevel@tonic-gate 11007c478bd9Sstevel@tonic-gate /* write the output */ 11017c478bd9Sstevel@tonic-gate if (write(outfd, resultbuf, resultlen) != resultlen) { 11027c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 11037c478bd9Sstevel@tonic-gate "failed to write result to output file.")); 11047c478bd9Sstevel@tonic-gate errflag = B_TRUE; 11057c478bd9Sstevel@tonic-gate break; 11067c478bd9Sstevel@tonic-gate } 11077c478bd9Sstevel@tonic-gate 11087c478bd9Sstevel@tonic-gate if (vflag) { 11097c478bd9Sstevel@tonic-gate status_index += resultlen; 11107c478bd9Sstevel@tonic-gate 11117c478bd9Sstevel@tonic-gate /* 11127c478bd9Sstevel@tonic-gate * If input is from stdin, do a our own progress bar 11137c478bd9Sstevel@tonic-gate * by printing periods at a pre-defined increment 11147c478bd9Sstevel@tonic-gate * until the file is done. 11157c478bd9Sstevel@tonic-gate */ 11167c478bd9Sstevel@tonic-gate if (!iflag) { 11177c478bd9Sstevel@tonic-gate 11187c478bd9Sstevel@tonic-gate /* 11197c478bd9Sstevel@tonic-gate * Print at least 1 element in case the file 11207c478bd9Sstevel@tonic-gate * is small, it looks better than nothing. 11217c478bd9Sstevel@tonic-gate */ 11227c478bd9Sstevel@tonic-gate if (status_pos == 0) { 11237c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext(".")); 11247c478bd9Sstevel@tonic-gate status_pos = 1; 11257c478bd9Sstevel@tonic-gate } 11267c478bd9Sstevel@tonic-gate 11277c478bd9Sstevel@tonic-gate if ((status_index - status_last) > 11287c478bd9Sstevel@tonic-gate (PROGRESSSIZE)) { 11297c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext(".")); 11307c478bd9Sstevel@tonic-gate status_last = status_index; 11317c478bd9Sstevel@tonic-gate } 11327c478bd9Sstevel@tonic-gate continue; 11337c478bd9Sstevel@tonic-gate } 11347c478bd9Sstevel@tonic-gate 11357c478bd9Sstevel@tonic-gate /* Calculate the number of elements need to be print */ 113654da5c1fSjk if (insize <= BUFFERSIZE) 11377c478bd9Sstevel@tonic-gate pos = 78; 11387c478bd9Sstevel@tonic-gate else 11397c478bd9Sstevel@tonic-gate pos = (int)((status_index - status_last) / 11407c478bd9Sstevel@tonic-gate status_incr); 11417c478bd9Sstevel@tonic-gate 11427c478bd9Sstevel@tonic-gate /* Add progress bar elements, if needed */ 11437c478bd9Sstevel@tonic-gate if (pos > 0) { 11447c478bd9Sstevel@tonic-gate print_status(pos); 11457c478bd9Sstevel@tonic-gate status_last += (status_incr * pos); 11467c478bd9Sstevel@tonic-gate } 11477c478bd9Sstevel@tonic-gate } 11487c478bd9Sstevel@tonic-gate } 11497c478bd9Sstevel@tonic-gate 11507c478bd9Sstevel@tonic-gate /* Print verbose completion */ 11517c478bd9Sstevel@tonic-gate if (vflag) { 11527c478bd9Sstevel@tonic-gate if (iflag) 11537c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "]"); 11547c478bd9Sstevel@tonic-gate 11557c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "\n%s\n", gettext("Done.")); 11567c478bd9Sstevel@tonic-gate } 11577c478bd9Sstevel@tonic-gate 11587c478bd9Sstevel@tonic-gate /* Error in reading */ 11597c478bd9Sstevel@tonic-gate if (nread == -1) { 11607c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 11617c478bd9Sstevel@tonic-gate "error reading from input file")); 11627c478bd9Sstevel@tonic-gate errflag = B_TRUE; 11637c478bd9Sstevel@tonic-gate } 11647c478bd9Sstevel@tonic-gate 11657c478bd9Sstevel@tonic-gate if (!errflag) { 11667c478bd9Sstevel@tonic-gate 11677c478bd9Sstevel@tonic-gate /* Do the final part */ 11687c478bd9Sstevel@tonic-gate 11697c478bd9Sstevel@tonic-gate rv = cmd->Final(hSession, resultbuf, &resultlen); 11707c478bd9Sstevel@tonic-gate 11717c478bd9Sstevel@tonic-gate if (rv == CKR_OK) { 11727c478bd9Sstevel@tonic-gate /* write the output */ 11737c478bd9Sstevel@tonic-gate if (write(outfd, resultbuf, resultlen) != resultlen) { 11747c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 11757c478bd9Sstevel@tonic-gate "failed to write result to output file.")); 11767c478bd9Sstevel@tonic-gate errflag = B_TRUE; 11777c478bd9Sstevel@tonic-gate } 11787c478bd9Sstevel@tonic-gate } else { 11797c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 11807c478bd9Sstevel@tonic-gate "crypto operation failed: %s"), 11817c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 11827c478bd9Sstevel@tonic-gate errflag = B_TRUE; 11837c478bd9Sstevel@tonic-gate } 11847c478bd9Sstevel@tonic-gate 11857c478bd9Sstevel@tonic-gate } 11867c478bd9Sstevel@tonic-gate 11877c478bd9Sstevel@tonic-gate if (resultbuf != NULL && resultbuf != outbuf) { 11887c478bd9Sstevel@tonic-gate bzero(resultbuf, resultbuflen); 11897c478bd9Sstevel@tonic-gate free(resultbuf); 11907c478bd9Sstevel@tonic-gate } 11917c478bd9Sstevel@tonic-gate 11927c478bd9Sstevel@tonic-gate if (errflag) { 11937c478bd9Sstevel@tonic-gate return (-1); 11947c478bd9Sstevel@tonic-gate } else { 11957c478bd9Sstevel@tonic-gate return (0); 11967c478bd9Sstevel@tonic-gate } 11977c478bd9Sstevel@tonic-gate } 1198