17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5c197cb9dShylee * Common Development and Distribution License (the "License"). 6c197cb9dShylee * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 2154da5c1fSjk /* Portions Copyright 2005 Richard Lowe */ 227c478bd9Sstevel@tonic-gate /* 237b79d846SDina K Nimeh * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 247c478bd9Sstevel@tonic-gate * Use is subject to license terms. 257c478bd9Sstevel@tonic-gate */ 267c478bd9Sstevel@tonic-gate 277c478bd9Sstevel@tonic-gate /* 287c478bd9Sstevel@tonic-gate * decrypt.c 297c478bd9Sstevel@tonic-gate * 307c478bd9Sstevel@tonic-gate * Implements encrypt(1) and decrypt(1) commands 317c478bd9Sstevel@tonic-gate * 327c478bd9Sstevel@tonic-gate * One binary performs both encrypt/decrypt operation. 337c478bd9Sstevel@tonic-gate * 34b54157c1Sda * Usage: 35b54157c1Sda * -a algorithm mechanism name without CKM_ prefix. Case 36b54157c1Sda * does not matter 37b54157c1Sda * -k keyfile file containing key data. If not specified user is 38b54157c1Sda * prompted to enter key. key length > 0 is required 39b54157c1Sda * -i infile input file to encrypt/decrypt. If omitted, stdin used. 40b54157c1Sda * -o outfile output file to encrypt/decrypt. If omitted, stdout used. 41b54157c1Sda * if infile & outfile are same, a temp file is used for 42b54157c1Sda * output and infile is replaced with this file after 43b54157c1Sda * operation is complete 44b54157c1Sda * -l Display the list of algorithms 45b54157c1Sda * -v Display verbose information 46b54157c1Sda * -T tokenspec Specify a PKCS#11 token (optionally used with -K) 47b54157c1Sda * -K keylabel Specify the symmetric PKCS#11 token key label 487c478bd9Sstevel@tonic-gate * 497c478bd9Sstevel@tonic-gate * Implementation notes: 50b54157c1Sda * IV data - It is generated by random bytes equal to one block size. 517c478bd9Sstevel@tonic-gate * 52b54157c1Sda * Encrypted output format - 53b54157c1Sda * - Output format version number (1) - 4 bytes in network byte order. 54b54157c1Sda * - Iterations used in key gen function, 4 bytes in network byte order. 55b54157c1Sda * - IV ('ivlen' bytes). Length is algorithm-dependent (see mech_aliases) 567c478bd9Sstevel@tonic-gate * - Salt data used in key gen (16 bytes) 57b54157c1Sda * - Cipher text data (remainder of the file) 587c478bd9Sstevel@tonic-gate */ 597c478bd9Sstevel@tonic-gate 607c478bd9Sstevel@tonic-gate #include <stdio.h> 617c478bd9Sstevel@tonic-gate #include <stdlib.h> 627c478bd9Sstevel@tonic-gate #include <unistd.h> 637c478bd9Sstevel@tonic-gate #include <errno.h> 647c478bd9Sstevel@tonic-gate #include <fcntl.h> 657c478bd9Sstevel@tonic-gate #include <ctype.h> 667c478bd9Sstevel@tonic-gate #include <strings.h> 677c478bd9Sstevel@tonic-gate #include <libintl.h> 687c478bd9Sstevel@tonic-gate #include <libgen.h> 697c478bd9Sstevel@tonic-gate #include <locale.h> 707c478bd9Sstevel@tonic-gate #include <limits.h> 717c478bd9Sstevel@tonic-gate #include <sys/types.h> 727c478bd9Sstevel@tonic-gate #include <sys/stat.h> 737c478bd9Sstevel@tonic-gate #include <netinet/in.h> 747c478bd9Sstevel@tonic-gate #include <security/cryptoki.h> 757c478bd9Sstevel@tonic-gate #include <cryptoutil.h> 76c197cb9dShylee #include <kmfapi.h> 777c478bd9Sstevel@tonic-gate 787c478bd9Sstevel@tonic-gate #define BUFFERSIZE (2048) /* Buffer size for reading file */ 797c478bd9Sstevel@tonic-gate #define BLOCKSIZE (128) /* Largest guess for block size */ 807c478bd9Sstevel@tonic-gate #define PROGRESSSIZE (BUFFERSIZE*20) /* stdin progress indicator size */ 817c478bd9Sstevel@tonic-gate 827c478bd9Sstevel@tonic-gate #define SUNW_ENCRYPT_FILE_VERSION 1 837c478bd9Sstevel@tonic-gate 847c478bd9Sstevel@tonic-gate /* 857c478bd9Sstevel@tonic-gate * Exit Status codes 867c478bd9Sstevel@tonic-gate */ 877c478bd9Sstevel@tonic-gate #ifndef EXIT_SUCCESS 887c478bd9Sstevel@tonic-gate #define EXIT_SUCCESS 0 /* No errors */ 897c478bd9Sstevel@tonic-gate #define EXIT_FAILURE 1 /* All errors except usage */ 907c478bd9Sstevel@tonic-gate #endif /* EXIT_SUCCESS */ 917c478bd9Sstevel@tonic-gate 927c478bd9Sstevel@tonic-gate #define EXIT_USAGE 2 /* usage/syntax error */ 937c478bd9Sstevel@tonic-gate 947c478bd9Sstevel@tonic-gate #define ENCRYPT_NAME "encrypt" /* name of encrypt command */ 95c197cb9dShylee #define ENCRYPT_OPTIONS "a:T:K:k:i:o:lv" /* options for encrypt */ 967c478bd9Sstevel@tonic-gate #define DECRYPT_NAME "decrypt" /* name of decrypt command */ 97c197cb9dShylee #define DECRYPT_OPTIONS "a:T:K:k:i:o:lv" /* options for decrypt */ 987c478bd9Sstevel@tonic-gate 997c478bd9Sstevel@tonic-gate /* 1007c478bd9Sstevel@tonic-gate * Structure containing info for encrypt/decrypt 1017c478bd9Sstevel@tonic-gate * command 1027c478bd9Sstevel@tonic-gate */ 1037c478bd9Sstevel@tonic-gate struct CommandInfo { 1047c478bd9Sstevel@tonic-gate char *name; /* name of the command */ 1057c478bd9Sstevel@tonic-gate char *options; /* command line options */ 1067c478bd9Sstevel@tonic-gate CK_FLAGS flags; 1077c478bd9Sstevel@tonic-gate CK_ATTRIBUTE_TYPE type; /* type of command */ 1087c478bd9Sstevel@tonic-gate 1097c478bd9Sstevel@tonic-gate /* function pointers for various operations */ 1107c478bd9Sstevel@tonic-gate CK_RV (*Init)(CK_SESSION_HANDLE, CK_MECHANISM_PTR, CK_OBJECT_HANDLE); 1117c478bd9Sstevel@tonic-gate CK_RV (*Update)(CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_BYTE_PTR, 1127c478bd9Sstevel@tonic-gate CK_ULONG_PTR); 1137c478bd9Sstevel@tonic-gate CK_RV (*Crypt)(CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_BYTE_PTR, 1147c478bd9Sstevel@tonic-gate CK_ULONG_PTR); 1157c478bd9Sstevel@tonic-gate CK_RV (*Final)(CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG_PTR); 1167c478bd9Sstevel@tonic-gate }; 1177c478bd9Sstevel@tonic-gate 1187c478bd9Sstevel@tonic-gate static struct CommandInfo encrypt_cmd = { 1197c478bd9Sstevel@tonic-gate ENCRYPT_NAME, 1207c478bd9Sstevel@tonic-gate ENCRYPT_OPTIONS, 1217c478bd9Sstevel@tonic-gate CKF_ENCRYPT, 1227c478bd9Sstevel@tonic-gate CKA_ENCRYPT, 1237c478bd9Sstevel@tonic-gate C_EncryptInit, 1247c478bd9Sstevel@tonic-gate C_EncryptUpdate, 1257c478bd9Sstevel@tonic-gate C_Encrypt, 1267c478bd9Sstevel@tonic-gate C_EncryptFinal 1277c478bd9Sstevel@tonic-gate }; 1287c478bd9Sstevel@tonic-gate 1297c478bd9Sstevel@tonic-gate static struct CommandInfo decrypt_cmd = { 1307c478bd9Sstevel@tonic-gate DECRYPT_NAME, 1317c478bd9Sstevel@tonic-gate DECRYPT_OPTIONS, 1327c478bd9Sstevel@tonic-gate CKF_DECRYPT, 1337c478bd9Sstevel@tonic-gate CKA_DECRYPT, 1347c478bd9Sstevel@tonic-gate C_DecryptInit, 1357c478bd9Sstevel@tonic-gate C_DecryptUpdate, 1367c478bd9Sstevel@tonic-gate C_Decrypt, 1377c478bd9Sstevel@tonic-gate C_DecryptFinal 1387c478bd9Sstevel@tonic-gate }; 1397c478bd9Sstevel@tonic-gate 1407c478bd9Sstevel@tonic-gate struct mech_alias { 1417c478bd9Sstevel@tonic-gate CK_MECHANISM_TYPE type; 1427c478bd9Sstevel@tonic-gate char *alias; 1437c478bd9Sstevel@tonic-gate CK_ULONG keysize_min; 1447c478bd9Sstevel@tonic-gate CK_ULONG keysize_max; 1457c478bd9Sstevel@tonic-gate int keysize_unit; 1467c478bd9Sstevel@tonic-gate int ivlen; 1477c478bd9Sstevel@tonic-gate boolean_t available; 1487c478bd9Sstevel@tonic-gate }; 1497c478bd9Sstevel@tonic-gate 1507c478bd9Sstevel@tonic-gate #define MECH_ALIASES_COUNT 4 1517c478bd9Sstevel@tonic-gate 1527c478bd9Sstevel@tonic-gate static struct mech_alias mech_aliases[] = { 1537c478bd9Sstevel@tonic-gate { CKM_AES_CBC_PAD, "aes", ULONG_MAX, 0L, 8, 16, B_FALSE }, 1547c478bd9Sstevel@tonic-gate { CKM_RC4, "arcfour", ULONG_MAX, 0L, 1, 0, B_FALSE }, 1557c478bd9Sstevel@tonic-gate { CKM_DES_CBC_PAD, "des", 8, 8, 8, 8, B_FALSE }, 1567c478bd9Sstevel@tonic-gate { CKM_DES3_CBC_PAD, "3des", 24, 24, 8, 8, B_FALSE }, 1577c478bd9Sstevel@tonic-gate }; 1587c478bd9Sstevel@tonic-gate 1597c478bd9Sstevel@tonic-gate static CK_BBOOL truevalue = TRUE; 1607c478bd9Sstevel@tonic-gate static CK_BBOOL falsevalue = FALSE; 1617c478bd9Sstevel@tonic-gate 1627c478bd9Sstevel@tonic-gate static boolean_t aflag = B_FALSE; /* -a <algorithm> flag, required */ 1637c478bd9Sstevel@tonic-gate static boolean_t kflag = B_FALSE; /* -k <keyfile> flag */ 1647c478bd9Sstevel@tonic-gate static boolean_t iflag = B_FALSE; /* -i <infile> flag, use stdin if absent */ 1657c478bd9Sstevel@tonic-gate static boolean_t oflag = B_FALSE; /* -o <outfile> flag, use stdout if absent */ 1667c478bd9Sstevel@tonic-gate static boolean_t lflag = B_FALSE; /* -l flag (list) */ 1677c478bd9Sstevel@tonic-gate static boolean_t vflag = B_FALSE; /* -v flag (verbose) */ 168b54157c1Sda static boolean_t Tflag = B_FALSE; /* -T flag (tokenspec) */ 169b54157c1Sda static boolean_t Kflag = B_FALSE; /* -K flag (keylabel) */ 1707c478bd9Sstevel@tonic-gate 171b54157c1Sda static char *keyfile = NULL; /* name of keyfile */ 172b54157c1Sda static char *inputfile = NULL; /* name of input file */ 173b54157c1Sda static char *outputfile = NULL; /* name of output file */ 174b54157c1Sda static char *token_label = NULL; /* name of PKCS#11 token */ 175b54157c1Sda static char *key_label = NULL; /* name of PKCS#11 token key label */ 1767c478bd9Sstevel@tonic-gate 1777c478bd9Sstevel@tonic-gate static int status_pos = 0; /* current position of progress bar element */ 1787c478bd9Sstevel@tonic-gate 1797c478bd9Sstevel@tonic-gate /* 1807c478bd9Sstevel@tonic-gate * function prototypes 1817c478bd9Sstevel@tonic-gate */ 1827c478bd9Sstevel@tonic-gate static void usage(struct CommandInfo *cmd); 1837c478bd9Sstevel@tonic-gate static int execute_cmd(struct CommandInfo *cmd, char *algo_str); 1847c478bd9Sstevel@tonic-gate static int crypt_multipart(struct CommandInfo *cmd, CK_SESSION_HANDLE hSession, 18554da5c1fSjk int infd, int outfd, off_t insize); 1867c478bd9Sstevel@tonic-gate 1877c478bd9Sstevel@tonic-gate int 1887c478bd9Sstevel@tonic-gate main(int argc, char **argv) 1897c478bd9Sstevel@tonic-gate { 1907c478bd9Sstevel@tonic-gate 1917c478bd9Sstevel@tonic-gate extern char *optarg; 1927c478bd9Sstevel@tonic-gate extern int optind; 1937c478bd9Sstevel@tonic-gate char *optstr; 1947c478bd9Sstevel@tonic-gate char c; /* current getopts flag */ 1957c478bd9Sstevel@tonic-gate char *algo_str = NULL; /* algorithm string */ 1967c478bd9Sstevel@tonic-gate struct CommandInfo *cmd; 1977c478bd9Sstevel@tonic-gate char *cmdname; /* name of command */ 1987c478bd9Sstevel@tonic-gate boolean_t errflag = B_FALSE; 1997c478bd9Sstevel@tonic-gate 2007c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, ""); 201b54157c1Sda #if !defined(TEXT_DOMAIN) /* Should be defined by cc -D */ 2027c478bd9Sstevel@tonic-gate #define TEXT_DOMAIN "SYS_TEST" /* Use this only if it weren't */ 2037c478bd9Sstevel@tonic-gate #endif 2047c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 2057c478bd9Sstevel@tonic-gate 2067c478bd9Sstevel@tonic-gate /* 2077c478bd9Sstevel@tonic-gate * Based on command name, determine 2087c478bd9Sstevel@tonic-gate * type of command. 2097c478bd9Sstevel@tonic-gate */ 2107c478bd9Sstevel@tonic-gate cmdname = basename(argv[0]); 2117c478bd9Sstevel@tonic-gate 2127c478bd9Sstevel@tonic-gate cryptodebug_init(cmdname); 2137c478bd9Sstevel@tonic-gate 2147c478bd9Sstevel@tonic-gate if (strcmp(cmdname, encrypt_cmd.name) == 0) { 2157c478bd9Sstevel@tonic-gate cmd = &encrypt_cmd; 2167c478bd9Sstevel@tonic-gate } else if (strcmp(cmdname, decrypt_cmd.name) == 0) { 2177c478bd9Sstevel@tonic-gate cmd = &decrypt_cmd; 2187c478bd9Sstevel@tonic-gate } else { 2197c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 2207c478bd9Sstevel@tonic-gate "command name must be either encrypt or decrypt")); 2217c478bd9Sstevel@tonic-gate exit(EXIT_USAGE); 2227c478bd9Sstevel@tonic-gate } 2237c478bd9Sstevel@tonic-gate 2247c478bd9Sstevel@tonic-gate optstr = cmd->options; 2257c478bd9Sstevel@tonic-gate 2267c478bd9Sstevel@tonic-gate /* Parse command line arguments */ 2277c478bd9Sstevel@tonic-gate while (!errflag && (c = getopt(argc, argv, optstr)) != -1) { 2287c478bd9Sstevel@tonic-gate 2297c478bd9Sstevel@tonic-gate switch (c) { 2307c478bd9Sstevel@tonic-gate case 'a': 2317c478bd9Sstevel@tonic-gate aflag = B_TRUE; 2327c478bd9Sstevel@tonic-gate algo_str = optarg; 2337c478bd9Sstevel@tonic-gate break; 2347c478bd9Sstevel@tonic-gate case 'k': 2357c478bd9Sstevel@tonic-gate kflag = B_TRUE; 2367c478bd9Sstevel@tonic-gate keyfile = optarg; 2377c478bd9Sstevel@tonic-gate break; 238c197cb9dShylee case 'T': 239c197cb9dShylee Tflag = B_TRUE; 240c197cb9dShylee token_label = optarg; 241c197cb9dShylee break; 242c197cb9dShylee case 'K': 243c197cb9dShylee Kflag = B_TRUE; 244c197cb9dShylee key_label = optarg; 245c197cb9dShylee break; 2467c478bd9Sstevel@tonic-gate case 'i': 2477c478bd9Sstevel@tonic-gate iflag = B_TRUE; 2487c478bd9Sstevel@tonic-gate inputfile = optarg; 2497c478bd9Sstevel@tonic-gate break; 2507c478bd9Sstevel@tonic-gate case 'o': 2517c478bd9Sstevel@tonic-gate oflag = B_TRUE; 2527c478bd9Sstevel@tonic-gate outputfile = optarg; 2537c478bd9Sstevel@tonic-gate break; 2547c478bd9Sstevel@tonic-gate case 'l': 2557c478bd9Sstevel@tonic-gate lflag = B_TRUE; 2567c478bd9Sstevel@tonic-gate break; 2577c478bd9Sstevel@tonic-gate case 'v': 2587c478bd9Sstevel@tonic-gate vflag = B_TRUE; 2597c478bd9Sstevel@tonic-gate break; 2607c478bd9Sstevel@tonic-gate default: 2617c478bd9Sstevel@tonic-gate errflag = B_TRUE; 2627c478bd9Sstevel@tonic-gate } 2637c478bd9Sstevel@tonic-gate } 2647c478bd9Sstevel@tonic-gate 2657c478bd9Sstevel@tonic-gate if (errflag || (!aflag && !lflag) || (lflag && argc > 2) || 266c197cb9dShylee (kflag && Kflag) || (Tflag && !Kflag) || 2677c478bd9Sstevel@tonic-gate (optind < argc)) { 2687c478bd9Sstevel@tonic-gate usage(cmd); 2697c478bd9Sstevel@tonic-gate exit(EXIT_USAGE); 2707c478bd9Sstevel@tonic-gate } 2717c478bd9Sstevel@tonic-gate 2727c478bd9Sstevel@tonic-gate return (execute_cmd(cmd, algo_str)); 2737c478bd9Sstevel@tonic-gate } 2747c478bd9Sstevel@tonic-gate 2757c478bd9Sstevel@tonic-gate /* 2767c478bd9Sstevel@tonic-gate * usage message 2777c478bd9Sstevel@tonic-gate */ 2787c478bd9Sstevel@tonic-gate static void 2797c478bd9Sstevel@tonic-gate usage(struct CommandInfo *cmd) 2807c478bd9Sstevel@tonic-gate { 281c197cb9dShylee (void) fprintf(stderr, gettext("Usage:\n")); 2827c478bd9Sstevel@tonic-gate if (cmd->type == CKA_ENCRYPT) { 283c197cb9dShylee (void) fprintf(stderr, gettext(" encrypt -l\n")); 284c197cb9dShylee (void) fprintf(stderr, gettext(" encrypt -a <algorithm> " 285c197cb9dShylee "[-v] [-k <keyfile> | -K <keylabel> [-T <tokenspec>]] " 286c197cb9dShylee "[-i <infile>] [-o <outfile>]\n")); 287c197cb9dShylee 2887c478bd9Sstevel@tonic-gate } else { 289c197cb9dShylee (void) fprintf(stderr, gettext(" decrypt -l\n")); 290c197cb9dShylee (void) fprintf(stderr, gettext(" decrypt -a <algorithm> " 291c197cb9dShylee "[-v] [-k <keyfile> | -K <keylabel> [-T <tokenspec>]] " 292c197cb9dShylee "[-i <infile>] [-o <outfile>]\n")); 2937c478bd9Sstevel@tonic-gate } 2947c478bd9Sstevel@tonic-gate } 2957c478bd9Sstevel@tonic-gate 2967c478bd9Sstevel@tonic-gate /* 2977c478bd9Sstevel@tonic-gate * Print out list of algorithms in default and verbose mode 2987c478bd9Sstevel@tonic-gate */ 2997c478bd9Sstevel@tonic-gate static void 3007c478bd9Sstevel@tonic-gate algorithm_list() 3017c478bd9Sstevel@tonic-gate { 3027c478bd9Sstevel@tonic-gate int mech; 3037c478bd9Sstevel@tonic-gate 3047c478bd9Sstevel@tonic-gate (void) printf(gettext("Algorithm Keysize: Min Max (bits)\n" 3057c478bd9Sstevel@tonic-gate "------------------------------------------\n")); 3067c478bd9Sstevel@tonic-gate 3077c478bd9Sstevel@tonic-gate for (mech = 0; mech < MECH_ALIASES_COUNT; mech++) { 3087c478bd9Sstevel@tonic-gate 3097c478bd9Sstevel@tonic-gate if (mech_aliases[mech].available == B_FALSE) 3107c478bd9Sstevel@tonic-gate continue; 3117c478bd9Sstevel@tonic-gate 3127c478bd9Sstevel@tonic-gate (void) printf("%-15s", mech_aliases[mech].alias); 3137c478bd9Sstevel@tonic-gate 3147c478bd9Sstevel@tonic-gate if (mech_aliases[mech].keysize_min != UINT_MAX && 3157c478bd9Sstevel@tonic-gate mech_aliases[mech].keysize_max != 0) 3167c478bd9Sstevel@tonic-gate (void) printf(" %5lu %5lu\n", 3177c478bd9Sstevel@tonic-gate (mech_aliases[mech].keysize_min * 31830a5e8faSwyllys mech_aliases[mech].keysize_unit), 3197c478bd9Sstevel@tonic-gate (mech_aliases[mech].keysize_max * 32030a5e8faSwyllys mech_aliases[mech].keysize_unit)); 3217c478bd9Sstevel@tonic-gate else 3227c478bd9Sstevel@tonic-gate (void) printf("\n"); 3237c478bd9Sstevel@tonic-gate 3247c478bd9Sstevel@tonic-gate } 3257c478bd9Sstevel@tonic-gate } 3267c478bd9Sstevel@tonic-gate 327c197cb9dShylee /* 328c197cb9dShylee * This function will login into the token with the provided password and 329c197cb9dShylee * find the token key object with the specified keytype and keylabel. 330c197cb9dShylee */ 331c197cb9dShylee static int 332c197cb9dShylee get_token_key(CK_SESSION_HANDLE hSession, CK_KEY_TYPE keytype, 333c197cb9dShylee char *keylabel, CK_BYTE *password, int password_len, 334c197cb9dShylee CK_OBJECT_HANDLE *keyobj) 335c197cb9dShylee { 336c197cb9dShylee CK_RV rv; 337c197cb9dShylee CK_ATTRIBUTE pTmpl[10]; 338c197cb9dShylee CK_OBJECT_CLASS class = CKO_SECRET_KEY; 339c197cb9dShylee CK_BBOOL true = 1; 340c197cb9dShylee CK_BBOOL is_token = 1; 341c197cb9dShylee CK_ULONG key_obj_count = 1; 342c197cb9dShylee int i; 343c197cb9dShylee CK_KEY_TYPE ckKeyType = keytype; 344c197cb9dShylee 345c197cb9dShylee 346c197cb9dShylee rv = C_Login(hSession, CKU_USER, (CK_UTF8CHAR_PTR)password, 347c197cb9dShylee (CK_ULONG)password_len); 348c197cb9dShylee if (rv != CKR_OK) { 349c197cb9dShylee (void) fprintf(stderr, "Cannot login to the token." 350c197cb9dShylee " error = %s\n", pkcs11_strerror(rv)); 351c197cb9dShylee return (-1); 352c197cb9dShylee } 353c197cb9dShylee 354c197cb9dShylee i = 0; 355c197cb9dShylee pTmpl[i].type = CKA_TOKEN; 356c197cb9dShylee pTmpl[i].pValue = &is_token; 357c197cb9dShylee pTmpl[i].ulValueLen = sizeof (CK_BBOOL); 358c197cb9dShylee i++; 359c197cb9dShylee 360c197cb9dShylee pTmpl[i].type = CKA_CLASS; 361c197cb9dShylee pTmpl[i].pValue = &class; 362c197cb9dShylee pTmpl[i].ulValueLen = sizeof (class); 363c197cb9dShylee i++; 364c197cb9dShylee 365c197cb9dShylee pTmpl[i].type = CKA_LABEL; 366c197cb9dShylee pTmpl[i].pValue = keylabel; 367c197cb9dShylee pTmpl[i].ulValueLen = strlen(keylabel); 368c197cb9dShylee i++; 369c197cb9dShylee 370c197cb9dShylee pTmpl[i].type = CKA_KEY_TYPE; 371c197cb9dShylee pTmpl[i].pValue = &ckKeyType; 372c197cb9dShylee pTmpl[i].ulValueLen = sizeof (ckKeyType); 373c197cb9dShylee i++; 374c197cb9dShylee 375c197cb9dShylee pTmpl[i].type = CKA_PRIVATE; 376c197cb9dShylee pTmpl[i].pValue = &true; 377c197cb9dShylee pTmpl[i].ulValueLen = sizeof (true); 378c197cb9dShylee i++; 379c197cb9dShylee 380c197cb9dShylee rv = C_FindObjectsInit(hSession, pTmpl, i); 381c197cb9dShylee if (rv != CKR_OK) { 382c197cb9dShylee goto out; 383c197cb9dShylee } 384c197cb9dShylee 385c197cb9dShylee rv = C_FindObjects(hSession, keyobj, 1, &key_obj_count); 386c197cb9dShylee 387c197cb9dShylee (void) C_FindObjectsFinal(hSession); 388c197cb9dShylee 389c197cb9dShylee out: 390c197cb9dShylee if (rv != CKR_OK) { 391c197cb9dShylee (void) fprintf(stderr, 392c197cb9dShylee "Cannot retrieve key object. error = %s\n", 393c197cb9dShylee pkcs11_strerror(rv)); 394c197cb9dShylee return (-1); 395c197cb9dShylee } 396c197cb9dShylee 397c197cb9dShylee if (key_obj_count == 0) { 398c197cb9dShylee (void) fprintf(stderr, "Cannot find the key object.\n"); 399c197cb9dShylee return (-1); 400c197cb9dShylee } 401c197cb9dShylee 402c197cb9dShylee return (0); 403c197cb9dShylee } 404c197cb9dShylee 4057c478bd9Sstevel@tonic-gate 4067c478bd9Sstevel@tonic-gate /* 4077c478bd9Sstevel@tonic-gate * Execute the command. 4087c478bd9Sstevel@tonic-gate * cmd - command pointing to type of operation. 4097c478bd9Sstevel@tonic-gate * algo_str - alias of the algorithm passed. 4107c478bd9Sstevel@tonic-gate */ 4117c478bd9Sstevel@tonic-gate static int 4127c478bd9Sstevel@tonic-gate execute_cmd(struct CommandInfo *cmd, char *algo_str) 4137c478bd9Sstevel@tonic-gate { 4147c478bd9Sstevel@tonic-gate CK_RV rv; 4157c478bd9Sstevel@tonic-gate CK_ULONG slotcount; 4167c478bd9Sstevel@tonic-gate CK_SLOT_ID slotID; 4177c478bd9Sstevel@tonic-gate CK_SLOT_ID_PTR pSlotList = NULL; 4187c478bd9Sstevel@tonic-gate CK_MECHANISM_TYPE mech_type = 0; 4197c478bd9Sstevel@tonic-gate CK_MECHANISM_INFO info, kg_info; 4207c478bd9Sstevel@tonic-gate CK_MECHANISM mech; 4217c478bd9Sstevel@tonic-gate CK_SESSION_HANDLE hSession = CK_INVALID_HANDLE; 4227c478bd9Sstevel@tonic-gate CK_BYTE_PTR pkeydata = NULL; 4231c9bd843Sdinak CK_BYTE salt[CK_PKCS5_PBKD2_SALT_SIZE]; 4247c478bd9Sstevel@tonic-gate CK_ULONG keysize = 0; 4257c478bd9Sstevel@tonic-gate int i, slot, mek; /* index variables */ 4267c478bd9Sstevel@tonic-gate int status; 4277c478bd9Sstevel@tonic-gate struct stat insbuf; /* stat buf for infile */ 4287c478bd9Sstevel@tonic-gate struct stat outsbuf; /* stat buf for outfile */ 4297c478bd9Sstevel@tonic-gate char tmpnam[PATH_MAX]; /* tmp file name */ 4307c478bd9Sstevel@tonic-gate CK_OBJECT_HANDLE key = (CK_OBJECT_HANDLE) 0; 4317c478bd9Sstevel@tonic-gate int infd = 0; /* input file, stdin default */ 4327c478bd9Sstevel@tonic-gate int outfd = 1; /* output file, stdout default */ 4337c478bd9Sstevel@tonic-gate char *outfilename = NULL; 4347c478bd9Sstevel@tonic-gate boolean_t errflag = B_TRUE; 4357c478bd9Sstevel@tonic-gate boolean_t inoutsame = B_FALSE; /* if both input & output are same */ 436*9a2817adSValerie Bubb Fenwick boolean_t leavefilealone = B_FALSE; 4377c478bd9Sstevel@tonic-gate CK_BYTE_PTR pivbuf = NULL_PTR; 4387c478bd9Sstevel@tonic-gate CK_ULONG ivlen = 0L; 439b54157c1Sda int mech_match = 0; 440b54157c1Sda uint32_t iterations = CK_PKCS5_PBKD2_ITERATIONS; 4417c478bd9Sstevel@tonic-gate CK_ULONG keylen; 442b54157c1Sda uint32_t version = SUNW_ENCRYPT_FILE_VERSION; 4437c478bd9Sstevel@tonic-gate CK_KEY_TYPE keytype; 444c197cb9dShylee KMF_RETURN kmfrv; 445c197cb9dShylee CK_SLOT_ID token_slot_id; 4467c478bd9Sstevel@tonic-gate 4477c478bd9Sstevel@tonic-gate if (aflag) { 4487c478bd9Sstevel@tonic-gate /* Determine if algorithm is valid */ 4497c478bd9Sstevel@tonic-gate for (mech_match = 0; mech_match < MECH_ALIASES_COUNT; 45030a5e8faSwyllys mech_match++) { 4517c478bd9Sstevel@tonic-gate if (strcmp(algo_str, 4527c478bd9Sstevel@tonic-gate mech_aliases[mech_match].alias) == 0) { 4537c478bd9Sstevel@tonic-gate mech_type = mech_aliases[mech_match].type; 4547c478bd9Sstevel@tonic-gate break; 4557c478bd9Sstevel@tonic-gate } 4567c478bd9Sstevel@tonic-gate } 4577c478bd9Sstevel@tonic-gate 4587c478bd9Sstevel@tonic-gate if (mech_match == MECH_ALIASES_COUNT) { 4597c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 4607c478bd9Sstevel@tonic-gate gettext("unknown algorithm -- %s"), algo_str); 4617c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 4627c478bd9Sstevel@tonic-gate } 4637c478bd9Sstevel@tonic-gate 4647c478bd9Sstevel@tonic-gate /* 465c197cb9dShylee * Process keyfile or get the token pin if -K is specified. 4667c478bd9Sstevel@tonic-gate * 4677c478bd9Sstevel@tonic-gate * If a keyfile is provided, get the key data from 4687c478bd9Sstevel@tonic-gate * the file. Otherwise, prompt for a passphrase. The 4697c478bd9Sstevel@tonic-gate * passphrase is used as the key data. 4707c478bd9Sstevel@tonic-gate */ 471c197cb9dShylee if (Kflag) { 472c197cb9dShylee /* get the pin of the token */ 473c197cb9dShylee if (token_label == NULL || !strlen(token_label)) { 4741c9bd843Sdinak token_label = pkcs11_default_token(); 475c197cb9dShylee } 476c197cb9dShylee 4771c9bd843Sdinak status = pkcs11_get_pass(token_label, 4781c9bd843Sdinak (char **)&pkeydata, (size_t *)&keysize, 0, B_FALSE); 479c197cb9dShylee } else if (kflag) { 480c197cb9dShylee /* get the key file */ 4811c9bd843Sdinak status = pkcs11_read_data(keyfile, (void **)&pkeydata, 4821c9bd843Sdinak (size_t *)&keysize); 4837c478bd9Sstevel@tonic-gate } else { 484c197cb9dShylee /* get the key from input */ 4851c9bd843Sdinak status = pkcs11_get_pass(NULL, (char **)&pkeydata, 486c545f712SDina K Nimeh (size_t *)&keysize, 0, 487c545f712SDina K Nimeh (cmd->type == CKA_ENCRYPT) ? B_TRUE : B_FALSE); 4887c478bd9Sstevel@tonic-gate } 4897c478bd9Sstevel@tonic-gate 490a7e661a2SAnthony Scarpino if (status != 0 || keysize == 0L) { 491c197cb9dShylee cryptoerror(LOG_STDERR, 492c545f712SDina K Nimeh kflag ? gettext("invalid key.") : 493c545f712SDina K Nimeh gettext("invalid passphrase.")); 4947c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 4957c478bd9Sstevel@tonic-gate } 4967c478bd9Sstevel@tonic-gate } 4977c478bd9Sstevel@tonic-gate 4987c478bd9Sstevel@tonic-gate bzero(salt, sizeof (salt)); 4997c478bd9Sstevel@tonic-gate /* Initialize pkcs */ 500c197cb9dShylee rv = C_Initialize(NULL); 501c197cb9dShylee if (rv != CKR_OK && rv != CKR_CRYPTOKI_ALREADY_INITIALIZED) { 5027c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("failed to initialize " 5037c478bd9Sstevel@tonic-gate "PKCS #11 framework: %s"), pkcs11_strerror(rv)); 5047c478bd9Sstevel@tonic-gate goto cleanup; 5057c478bd9Sstevel@tonic-gate } 5067c478bd9Sstevel@tonic-gate 5077c478bd9Sstevel@tonic-gate /* Get slot count */ 5087c478bd9Sstevel@tonic-gate rv = C_GetSlotList(0, NULL_PTR, &slotcount); 5097c478bd9Sstevel@tonic-gate if (rv != CKR_OK || slotcount == 0) { 5107c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 5117c478bd9Sstevel@tonic-gate "failed to find any cryptographic provider," 5127c478bd9Sstevel@tonic-gate "please check with your system administrator: %s"), 5137c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 5147c478bd9Sstevel@tonic-gate goto cleanup; 5157c478bd9Sstevel@tonic-gate } 5167c478bd9Sstevel@tonic-gate 5177c478bd9Sstevel@tonic-gate /* Found at least one slot, allocate memory for slot list */ 5187c478bd9Sstevel@tonic-gate pSlotList = malloc(slotcount * sizeof (CK_SLOT_ID)); 5197c478bd9Sstevel@tonic-gate if (pSlotList == NULL_PTR) { 5207c478bd9Sstevel@tonic-gate int err = errno; 5217c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("malloc: %s"), strerror(err)); 5227c478bd9Sstevel@tonic-gate goto cleanup; 5237c478bd9Sstevel@tonic-gate } 5247c478bd9Sstevel@tonic-gate 5257c478bd9Sstevel@tonic-gate /* Get the list of slots */ 5267c478bd9Sstevel@tonic-gate if ((rv = C_GetSlotList(0, pSlotList, &slotcount)) != CKR_OK) { 5277c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 5287c478bd9Sstevel@tonic-gate "failed to find any cryptographic provider," 5297c478bd9Sstevel@tonic-gate "please check with your system administrator: %s"), 5307c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 5317c478bd9Sstevel@tonic-gate goto cleanup; 5327c478bd9Sstevel@tonic-gate } 5337c478bd9Sstevel@tonic-gate 5347c478bd9Sstevel@tonic-gate if (lflag) { 5357c478bd9Sstevel@tonic-gate 5367c478bd9Sstevel@tonic-gate /* Iterate through slots */ 5377c478bd9Sstevel@tonic-gate for (slot = 0; slot < slotcount; slot++) { 5387c478bd9Sstevel@tonic-gate 5397c478bd9Sstevel@tonic-gate /* Iterate through each mechanism */ 5407c478bd9Sstevel@tonic-gate for (mek = 0; mek < MECH_ALIASES_COUNT; mek++) { 5417c478bd9Sstevel@tonic-gate rv = C_GetMechanismInfo(pSlotList[slot], 5427c478bd9Sstevel@tonic-gate mech_aliases[mek].type, &info); 5437c478bd9Sstevel@tonic-gate 5447c478bd9Sstevel@tonic-gate if (rv != CKR_OK) 5457c478bd9Sstevel@tonic-gate continue; 5467c478bd9Sstevel@tonic-gate 5477c478bd9Sstevel@tonic-gate /* 5487c478bd9Sstevel@tonic-gate * Set to minimum/maximum key sizes assuming 5497c478bd9Sstevel@tonic-gate * the values available are not 0. 5507c478bd9Sstevel@tonic-gate */ 5517c478bd9Sstevel@tonic-gate if (info.ulMinKeySize && (info.ulMinKeySize < 5527c478bd9Sstevel@tonic-gate mech_aliases[mek].keysize_min)) 5537c478bd9Sstevel@tonic-gate mech_aliases[mek].keysize_min = 55430a5e8faSwyllys info.ulMinKeySize; 5557c478bd9Sstevel@tonic-gate 5567c478bd9Sstevel@tonic-gate if (info.ulMaxKeySize && (info.ulMaxKeySize > 5577c478bd9Sstevel@tonic-gate mech_aliases[mek].keysize_max)) 5587c478bd9Sstevel@tonic-gate mech_aliases[mek].keysize_max = 55930a5e8faSwyllys info.ulMaxKeySize; 5607c478bd9Sstevel@tonic-gate 5617c478bd9Sstevel@tonic-gate mech_aliases[mek].available = B_TRUE; 5627c478bd9Sstevel@tonic-gate } 5637c478bd9Sstevel@tonic-gate 5647c478bd9Sstevel@tonic-gate } 5657c478bd9Sstevel@tonic-gate 5667c478bd9Sstevel@tonic-gate algorithm_list(); 5677c478bd9Sstevel@tonic-gate 5687c478bd9Sstevel@tonic-gate errflag = B_FALSE; 5697c478bd9Sstevel@tonic-gate goto cleanup; 5707c478bd9Sstevel@tonic-gate } 5717c478bd9Sstevel@tonic-gate 572c197cb9dShylee 573c197cb9dShylee /* 574c197cb9dShylee * Find a slot with matching mechanism 575c197cb9dShylee * 576c197cb9dShylee * If -K is specified, we find the slot id for the token first, then 577c197cb9dShylee * check if the slot supports the algorithm. 578c197cb9dShylee */ 579c197cb9dShylee i = 0; 580c197cb9dShylee if (Kflag) { 58130a5e8faSwyllys kmfrv = kmf_pk11_token_lookup(NULL, token_label, 58230a5e8faSwyllys &token_slot_id); 583c197cb9dShylee if (kmfrv != KMF_OK) { 584c197cb9dShylee cryptoerror(LOG_STDERR, 585c197cb9dShylee gettext("no matching PKCS#11 token")); 586c197cb9dShylee errflag = B_TRUE; 587c197cb9dShylee goto cleanup; 588c197cb9dShylee } 589c197cb9dShylee rv = C_GetMechanismInfo(token_slot_id, mech_type, &info); 590c197cb9dShylee if (rv == CKR_OK && (info.flags & cmd->flags)) 591c197cb9dShylee slotID = token_slot_id; 592c197cb9dShylee else 593c197cb9dShylee i = slotcount; 594c197cb9dShylee } else { 595c197cb9dShylee for (i = 0; i < slotcount; i++) { 596c197cb9dShylee slotID = pSlotList[i]; 597c197cb9dShylee rv = C_GetMechanismInfo(slotID, mech_type, &info); 598c197cb9dShylee if (rv != CKR_OK) { 599c197cb9dShylee continue; /* to the next slot */ 600c197cb9dShylee } else { 601c197cb9dShylee /* 602c197cb9dShylee * If the slot support the crypto, also 603c197cb9dShylee * make sure it supports the correct 604c197cb9dShylee * key generation mech if needed. 605c197cb9dShylee * 606c197cb9dShylee * We need PKCS5 when RC4 is used or 607c197cb9dShylee * when the key is entered on cmd line. 608c197cb9dShylee */ 609c197cb9dShylee if ((info.flags & cmd->flags) && 610c197cb9dShylee (mech_type == CKM_RC4) || 611c197cb9dShylee (keyfile == NULL)) { 612c197cb9dShylee rv = C_GetMechanismInfo(slotID, 613c197cb9dShylee CKM_PKCS5_PBKD2, &kg_info); 614c197cb9dShylee if (rv == CKR_OK) 615c197cb9dShylee break; 616c197cb9dShylee } else if (info.flags & cmd->flags) { 6177c478bd9Sstevel@tonic-gate break; 618c197cb9dShylee } 6197c478bd9Sstevel@tonic-gate } 6207c478bd9Sstevel@tonic-gate } 6217c478bd9Sstevel@tonic-gate } 6227c478bd9Sstevel@tonic-gate 6237c478bd9Sstevel@tonic-gate /* Show error if no matching mechanism found */ 6247c478bd9Sstevel@tonic-gate if (i == slotcount) { 6257c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 6267c478bd9Sstevel@tonic-gate gettext("no cryptographic provider was " 6277c478bd9Sstevel@tonic-gate "found for this algorithm -- %s"), algo_str); 6287c478bd9Sstevel@tonic-gate goto cleanup; 6297c478bd9Sstevel@tonic-gate } 6307c478bd9Sstevel@tonic-gate 6317c478bd9Sstevel@tonic-gate /* Open a session */ 6327c478bd9Sstevel@tonic-gate rv = C_OpenSession(slotID, CKF_SERIAL_SESSION, 63330a5e8faSwyllys NULL_PTR, NULL, &hSession); 6347c478bd9Sstevel@tonic-gate 6357c478bd9Sstevel@tonic-gate if (rv != CKR_OK) { 6367c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 6377c478bd9Sstevel@tonic-gate gettext("can not open PKCS #11 session: %s"), 6387c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 6397c478bd9Sstevel@tonic-gate goto cleanup; 6407c478bd9Sstevel@tonic-gate } 6417c478bd9Sstevel@tonic-gate 6427c478bd9Sstevel@tonic-gate /* 6437c478bd9Sstevel@tonic-gate * Generate IV data for encrypt. 6447c478bd9Sstevel@tonic-gate */ 6457c478bd9Sstevel@tonic-gate ivlen = mech_aliases[mech_match].ivlen; 6467c478bd9Sstevel@tonic-gate if ((pivbuf = malloc((size_t)ivlen)) == NULL) { 6477c478bd9Sstevel@tonic-gate int err = errno; 6487c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("malloc: %s"), 6497c478bd9Sstevel@tonic-gate strerror(err)); 6507c478bd9Sstevel@tonic-gate goto cleanup; 6517c478bd9Sstevel@tonic-gate } 6527c478bd9Sstevel@tonic-gate 6537c478bd9Sstevel@tonic-gate if (cmd->type == CKA_ENCRYPT) { 6547b79d846SDina K Nimeh if ((pkcs11_get_urandom((void *)pivbuf, 6557c478bd9Sstevel@tonic-gate mech_aliases[mech_match].ivlen)) != 0) { 6567c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 65730a5e8faSwyllys "Unable to generate random " 65830a5e8faSwyllys "data for initialization vector.")); 6597c478bd9Sstevel@tonic-gate goto cleanup; 6607c478bd9Sstevel@tonic-gate } 6617c478bd9Sstevel@tonic-gate } 6627c478bd9Sstevel@tonic-gate 6637c478bd9Sstevel@tonic-gate /* 6647c478bd9Sstevel@tonic-gate * Create the key object 6657c478bd9Sstevel@tonic-gate */ 6667c478bd9Sstevel@tonic-gate rv = pkcs11_mech2keytype(mech_type, &keytype); 6677c478bd9Sstevel@tonic-gate if (rv != CKR_OK) { 6687c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 66930a5e8faSwyllys gettext("unable to find key type for algorithm.")); 6707c478bd9Sstevel@tonic-gate goto cleanup; 6717c478bd9Sstevel@tonic-gate } 6727c478bd9Sstevel@tonic-gate 6737c478bd9Sstevel@tonic-gate /* Open input file */ 6747c478bd9Sstevel@tonic-gate if (iflag) { 6757c478bd9Sstevel@tonic-gate if ((infd = open(inputfile, O_RDONLY | O_NONBLOCK)) == -1) { 6767c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 67730a5e8faSwyllys "can not open input file %s"), inputfile); 6787c478bd9Sstevel@tonic-gate goto cleanup; 6797c478bd9Sstevel@tonic-gate } 6807c478bd9Sstevel@tonic-gate 6817c478bd9Sstevel@tonic-gate /* Get info on input file */ 6827c478bd9Sstevel@tonic-gate if (fstat(infd, &insbuf) == -1) { 6837c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 68430a5e8faSwyllys "can not stat input file %s"), inputfile); 6857c478bd9Sstevel@tonic-gate goto cleanup; 6867c478bd9Sstevel@tonic-gate } 6877c478bd9Sstevel@tonic-gate } 6887c478bd9Sstevel@tonic-gate 6897c478bd9Sstevel@tonic-gate /* 6907c478bd9Sstevel@tonic-gate * Prepare output file 6917c478bd9Sstevel@tonic-gate * If the input & output file are same, 6927c478bd9Sstevel@tonic-gate * the output is written to a temp 6937c478bd9Sstevel@tonic-gate * file first, then renamed to the original file 6947c478bd9Sstevel@tonic-gate * after the crypt operation 6957c478bd9Sstevel@tonic-gate */ 6967c478bd9Sstevel@tonic-gate inoutsame = B_FALSE; 6977c478bd9Sstevel@tonic-gate if (oflag) { 6987c478bd9Sstevel@tonic-gate outfilename = outputfile; 6997c478bd9Sstevel@tonic-gate if ((stat(outputfile, &outsbuf) != -1) && 70030a5e8faSwyllys (insbuf.st_ino == outsbuf.st_ino)) { 7017c478bd9Sstevel@tonic-gate char *dir; 7027c478bd9Sstevel@tonic-gate 7037c478bd9Sstevel@tonic-gate /* create temp file on same dir */ 7047c478bd9Sstevel@tonic-gate dir = dirname(outputfile); 7057c478bd9Sstevel@tonic-gate (void) snprintf(tmpnam, sizeof (tmpnam), 70630a5e8faSwyllys "%s/encrXXXXXX", dir); 7077c478bd9Sstevel@tonic-gate outfilename = tmpnam; 7087c478bd9Sstevel@tonic-gate if ((outfd = mkstemp(tmpnam)) == -1) { 7097c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 7107c478bd9Sstevel@tonic-gate "cannot create temp file")); 7117c478bd9Sstevel@tonic-gate goto cleanup; 7127c478bd9Sstevel@tonic-gate } 7137c478bd9Sstevel@tonic-gate inoutsame = B_TRUE; 7147c478bd9Sstevel@tonic-gate } else { 7157c478bd9Sstevel@tonic-gate /* Create file for output */ 7167c478bd9Sstevel@tonic-gate if ((outfd = open(outfilename, 71730a5e8faSwyllys O_CREAT|O_WRONLY|O_TRUNC, 0644)) == -1) { 7187c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 7197c478bd9Sstevel@tonic-gate "cannot open output file %s"), 7207c478bd9Sstevel@tonic-gate outfilename); 721*9a2817adSValerie Bubb Fenwick /* Cannot open file, should leave it alone */ 722*9a2817adSValerie Bubb Fenwick leavefilealone = B_TRUE; 7237c478bd9Sstevel@tonic-gate goto cleanup; 7247c478bd9Sstevel@tonic-gate } 7257c478bd9Sstevel@tonic-gate } 7267c478bd9Sstevel@tonic-gate } 7277c478bd9Sstevel@tonic-gate 7287c478bd9Sstevel@tonic-gate /* 7297c478bd9Sstevel@tonic-gate * Read the version number from the head of the file 7307c478bd9Sstevel@tonic-gate * to know how to interpret the data that follows. 7317c478bd9Sstevel@tonic-gate */ 7327c478bd9Sstevel@tonic-gate if (cmd->type == CKA_DECRYPT) { 7337c478bd9Sstevel@tonic-gate if (read(infd, &version, sizeof (version)) != 73430a5e8faSwyllys sizeof (version)) { 7357c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 7367c478bd9Sstevel@tonic-gate "failed to get format version from " 7377c478bd9Sstevel@tonic-gate "input file.")); 7387c478bd9Sstevel@tonic-gate goto cleanup; 7397c478bd9Sstevel@tonic-gate } 7407c478bd9Sstevel@tonic-gate /* convert to host byte order */ 7417c478bd9Sstevel@tonic-gate version = ntohl(version); 7427c478bd9Sstevel@tonic-gate 7437c478bd9Sstevel@tonic-gate switch (version) { 7447c478bd9Sstevel@tonic-gate case 1: 7457c478bd9Sstevel@tonic-gate /* 7467c478bd9Sstevel@tonic-gate * Version 1 output format: 747b54157c1Sda * - Output format version 1 (4 bytes) 7487c478bd9Sstevel@tonic-gate * - Iterations used in key gen function (4 bytes) 749b54157c1Sda * - IV ('ivlen' bytes). The length algorithm-dependent 7507c478bd9Sstevel@tonic-gate * - Salt data used in key gen (16 bytes) 751b54157c1Sda * - Cipher text data (remainder of the file) 7527c478bd9Sstevel@tonic-gate * 7537c478bd9Sstevel@tonic-gate * An encrypted file has IV as first block (0 or 7547c478bd9Sstevel@tonic-gate * more bytes depending on mechanism) followed 7557c478bd9Sstevel@tonic-gate * by cipher text. Get the IV from the encrypted 7567c478bd9Sstevel@tonic-gate * file. 7577c478bd9Sstevel@tonic-gate */ 7587c478bd9Sstevel@tonic-gate /* 7597c478bd9Sstevel@tonic-gate * Read iteration count and salt data. 7607c478bd9Sstevel@tonic-gate */ 7617c478bd9Sstevel@tonic-gate if (read(infd, &iterations, 76230a5e8faSwyllys sizeof (iterations)) != sizeof (iterations)) { 7637c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 76430a5e8faSwyllys "failed to get iterations from " 76530a5e8faSwyllys "input file.")); 7667c478bd9Sstevel@tonic-gate goto cleanup; 7677c478bd9Sstevel@tonic-gate } 7687c478bd9Sstevel@tonic-gate /* convert to host byte order */ 7697c478bd9Sstevel@tonic-gate iterations = ntohl(iterations); 7707c478bd9Sstevel@tonic-gate if (ivlen > 0 && 7717c478bd9Sstevel@tonic-gate read(infd, pivbuf, ivlen) != ivlen) { 7727c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 7737c478bd9Sstevel@tonic-gate "failed to get initialization " 7747c478bd9Sstevel@tonic-gate "vector from input file.")); 7757c478bd9Sstevel@tonic-gate goto cleanup; 7767c478bd9Sstevel@tonic-gate } 7777c478bd9Sstevel@tonic-gate if (read(infd, salt, sizeof (salt)) 77830a5e8faSwyllys != sizeof (salt)) { 7797c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 78030a5e8faSwyllys "failed to get salt data from " 78130a5e8faSwyllys "input file.")); 7827c478bd9Sstevel@tonic-gate goto cleanup; 7837c478bd9Sstevel@tonic-gate } 7847c478bd9Sstevel@tonic-gate break; 7857c478bd9Sstevel@tonic-gate default: 7867c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 78730a5e8faSwyllys "Unrecognized format version read from " 78830a5e8faSwyllys "input file - expected %d, got %d."), 78930a5e8faSwyllys SUNW_ENCRYPT_FILE_VERSION, version); 7907c478bd9Sstevel@tonic-gate goto cleanup; 7917c478bd9Sstevel@tonic-gate break; 7927c478bd9Sstevel@tonic-gate } 7937c478bd9Sstevel@tonic-gate } 794c197cb9dShylee 7957c478bd9Sstevel@tonic-gate /* 796c197cb9dShylee * If Kflag is set, let's find the token key now. 797c197cb9dShylee * 798c197cb9dShylee * If Kflag is not set and if encrypting, we need some random 7997c478bd9Sstevel@tonic-gate * salt data to create the key. If decrypting, 8007c478bd9Sstevel@tonic-gate * the salt should come from head of the file 8017c478bd9Sstevel@tonic-gate * to be decrypted. 8027c478bd9Sstevel@tonic-gate */ 803c197cb9dShylee if (Kflag) { 804c197cb9dShylee rv = get_token_key(hSession, keytype, key_label, pkeydata, 805c197cb9dShylee keysize, &key); 806c197cb9dShylee if (rv != CKR_OK) { 807c197cb9dShylee cryptoerror(LOG_STDERR, gettext( 808c197cb9dShylee "Can not find the token key")); 809c197cb9dShylee goto cleanup; 810c197cb9dShylee } else { 811c197cb9dShylee goto do_crypto; 812c197cb9dShylee } 813c197cb9dShylee } else if (cmd->type == CKA_ENCRYPT) { 8147b79d846SDina K Nimeh rv = pkcs11_get_urandom((void *)salt, sizeof (salt)); 8157c478bd9Sstevel@tonic-gate if (rv != 0) { 8167c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 8177c478bd9Sstevel@tonic-gate gettext("unable to generate random " 81830a5e8faSwyllys "data for key salt.")); 8197c478bd9Sstevel@tonic-gate goto cleanup; 8207c478bd9Sstevel@tonic-gate } 8217c478bd9Sstevel@tonic-gate } 8227c478bd9Sstevel@tonic-gate 823c197cb9dShylee 8247c478bd9Sstevel@tonic-gate /* 8257c478bd9Sstevel@tonic-gate * If key input is read from a file, treat it as 8267c478bd9Sstevel@tonic-gate * raw key data, unless it is to be used with RC4, 8277c478bd9Sstevel@tonic-gate * in which case it must be used to generate a pkcs5 8287c478bd9Sstevel@tonic-gate * key to address security concerns with RC4 keys. 8297c478bd9Sstevel@tonic-gate */ 8307c478bd9Sstevel@tonic-gate if (kflag && keyfile != NULL && keytype != CKK_RC4) { 8311c9bd843Sdinak /* XXX : why wasn't SUNW_C_KeyToObject used here? */ 8327c478bd9Sstevel@tonic-gate CK_OBJECT_CLASS objclass = CKO_SECRET_KEY; 8337c478bd9Sstevel@tonic-gate CK_ATTRIBUTE template[5]; 8347c478bd9Sstevel@tonic-gate int nattr = 0; 8357c478bd9Sstevel@tonic-gate 8367c478bd9Sstevel@tonic-gate template[nattr].type = CKA_CLASS; 8377c478bd9Sstevel@tonic-gate template[nattr].pValue = &objclass; 8387c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (objclass); 8397c478bd9Sstevel@tonic-gate nattr++; 8407c478bd9Sstevel@tonic-gate 8417c478bd9Sstevel@tonic-gate template[nattr].type = CKA_KEY_TYPE; 8427c478bd9Sstevel@tonic-gate template[nattr].pValue = &keytype; 8437c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (keytype); 8447c478bd9Sstevel@tonic-gate nattr++; 8457c478bd9Sstevel@tonic-gate 8467c478bd9Sstevel@tonic-gate template[nattr].type = cmd->type; 8477c478bd9Sstevel@tonic-gate template[nattr].pValue = &truevalue; 8487c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (truevalue); 8497c478bd9Sstevel@tonic-gate nattr++; 8507c478bd9Sstevel@tonic-gate 8517c478bd9Sstevel@tonic-gate template[nattr].type = CKA_TOKEN; 8527c478bd9Sstevel@tonic-gate template[nattr].pValue = &falsevalue; 8537c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (falsevalue); 8547c478bd9Sstevel@tonic-gate nattr++; 8557c478bd9Sstevel@tonic-gate 8567c478bd9Sstevel@tonic-gate template[nattr].type = CKA_VALUE; 8577c478bd9Sstevel@tonic-gate template[nattr].pValue = pkeydata; 8587c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = keysize; 8597c478bd9Sstevel@tonic-gate nattr++; 8607c478bd9Sstevel@tonic-gate 86130a5e8faSwyllys rv = C_CreateObject(hSession, template, nattr, &key); 8627c478bd9Sstevel@tonic-gate } else { 8637c478bd9Sstevel@tonic-gate /* 8647c478bd9Sstevel@tonic-gate * If the encryption type has a fixed key length, 8657c478bd9Sstevel@tonic-gate * then its not necessary to set the key length 8667c478bd9Sstevel@tonic-gate * parameter when generating the key. 8677c478bd9Sstevel@tonic-gate */ 8687c478bd9Sstevel@tonic-gate if (keytype == CKK_DES || keytype == CKK_DES3) 8697c478bd9Sstevel@tonic-gate keylen = 0; 8707c478bd9Sstevel@tonic-gate else 8717c478bd9Sstevel@tonic-gate keylen = 16; 8727c478bd9Sstevel@tonic-gate 8737c478bd9Sstevel@tonic-gate /* 8747c478bd9Sstevel@tonic-gate * Generate a cryptographically secure key using 8757c478bd9Sstevel@tonic-gate * the key read from the file given (-k keyfile) or 8767c478bd9Sstevel@tonic-gate * the passphrase entered by the user. 8777c478bd9Sstevel@tonic-gate */ 8781c9bd843Sdinak rv = pkcs11_PasswdToPBKD2Object(hSession, (char *)pkeydata, 8791c9bd843Sdinak (size_t)keysize, (void *)salt, sizeof (salt), iterations, 8801c9bd843Sdinak keytype, keylen, cmd->flags, &key); 8817c478bd9Sstevel@tonic-gate } 8827c478bd9Sstevel@tonic-gate 8837c478bd9Sstevel@tonic-gate if (rv != CKR_OK) { 8847c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 8857c478bd9Sstevel@tonic-gate "failed to generate a key: %s"), 8867c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 8877c478bd9Sstevel@tonic-gate goto cleanup; 8887c478bd9Sstevel@tonic-gate } 8897c478bd9Sstevel@tonic-gate 890c197cb9dShylee 891c197cb9dShylee do_crypto: 8927c478bd9Sstevel@tonic-gate /* Setup up mechanism */ 8937c478bd9Sstevel@tonic-gate mech.mechanism = mech_type; 8947c478bd9Sstevel@tonic-gate mech.pParameter = (CK_VOID_PTR)pivbuf; 8957c478bd9Sstevel@tonic-gate mech.ulParameterLen = ivlen; 8967c478bd9Sstevel@tonic-gate 8977c478bd9Sstevel@tonic-gate if ((rv = cmd->Init(hSession, &mech, key)) != CKR_OK) { 8987c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 8997c478bd9Sstevel@tonic-gate "failed to initialize crypto operation: %s"), 9007c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 9017c478bd9Sstevel@tonic-gate goto cleanup; 9027c478bd9Sstevel@tonic-gate } 9037c478bd9Sstevel@tonic-gate 9047c478bd9Sstevel@tonic-gate /* Write the version header encrypt command */ 9057c478bd9Sstevel@tonic-gate if (cmd->type == CKA_ENCRYPT) { 9067c478bd9Sstevel@tonic-gate /* convert to network order for storage */ 907b54157c1Sda uint32_t netversion = htonl(version); 908b54157c1Sda uint32_t netiter; 9097c478bd9Sstevel@tonic-gate 9107c478bd9Sstevel@tonic-gate if (write(outfd, &netversion, sizeof (netversion)) 91130a5e8faSwyllys != sizeof (netversion)) { 9127c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 91330a5e8faSwyllys "failed to write version number " 91430a5e8faSwyllys "to output file.")); 9157c478bd9Sstevel@tonic-gate goto cleanup; 9167c478bd9Sstevel@tonic-gate } 9177c478bd9Sstevel@tonic-gate /* 9187c478bd9Sstevel@tonic-gate * Write the iteration and salt data, even if they 9197c478bd9Sstevel@tonic-gate * were not used to generate a key. 9207c478bd9Sstevel@tonic-gate */ 9217c478bd9Sstevel@tonic-gate netiter = htonl(iterations); 9227c478bd9Sstevel@tonic-gate if (write(outfd, &netiter, 92330a5e8faSwyllys sizeof (netiter)) != sizeof (netiter)) { 9247c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 9257c478bd9Sstevel@tonic-gate "failed to write iterations to output")); 9267c478bd9Sstevel@tonic-gate goto cleanup; 9277c478bd9Sstevel@tonic-gate } 92830a5e8faSwyllys if (ivlen > 0 && write(outfd, pivbuf, ivlen) != ivlen) { 9297c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 93030a5e8faSwyllys "failed to write initialization vector " 93130a5e8faSwyllys "to output")); 9327c478bd9Sstevel@tonic-gate goto cleanup; 9337c478bd9Sstevel@tonic-gate } 9347c478bd9Sstevel@tonic-gate if (write(outfd, salt, sizeof (salt)) != sizeof (salt)) { 9357c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 9367c478bd9Sstevel@tonic-gate "failed to write salt data to output")); 9377c478bd9Sstevel@tonic-gate goto cleanup; 9387c478bd9Sstevel@tonic-gate } 9397c478bd9Sstevel@tonic-gate } 9407c478bd9Sstevel@tonic-gate 94154da5c1fSjk if (crypt_multipart(cmd, hSession, infd, outfd, insbuf.st_size) == -1) { 9427c478bd9Sstevel@tonic-gate goto cleanup; 9437c478bd9Sstevel@tonic-gate } 9447c478bd9Sstevel@tonic-gate 9457c478bd9Sstevel@tonic-gate errflag = B_FALSE; 9467c478bd9Sstevel@tonic-gate 9477c478bd9Sstevel@tonic-gate /* 9487c478bd9Sstevel@tonic-gate * Clean up 9497c478bd9Sstevel@tonic-gate */ 9507c478bd9Sstevel@tonic-gate cleanup: 9517c478bd9Sstevel@tonic-gate /* Clear the key data, so others cannot snoop */ 9527c478bd9Sstevel@tonic-gate if (pkeydata != NULL) { 9537c478bd9Sstevel@tonic-gate bzero(pkeydata, keysize); 9547c478bd9Sstevel@tonic-gate free(pkeydata); 9557c478bd9Sstevel@tonic-gate pkeydata = NULL; 9567c478bd9Sstevel@tonic-gate } 9577c478bd9Sstevel@tonic-gate 9587c478bd9Sstevel@tonic-gate /* Destroy key object */ 959c197cb9dShylee if (Kflag != B_FALSE && key != (CK_OBJECT_HANDLE) 0) { 9607c478bd9Sstevel@tonic-gate (void) C_DestroyObject(hSession, key); 9617c478bd9Sstevel@tonic-gate } 9627c478bd9Sstevel@tonic-gate 9637c478bd9Sstevel@tonic-gate /* free allocated memory */ 9647c478bd9Sstevel@tonic-gate if (pSlotList != NULL) 9657c478bd9Sstevel@tonic-gate free(pSlotList); 9667c478bd9Sstevel@tonic-gate if (pivbuf != NULL) 9677c478bd9Sstevel@tonic-gate free(pivbuf); 9687c478bd9Sstevel@tonic-gate 9697c478bd9Sstevel@tonic-gate /* close all the files */ 97054da5c1fSjk if (iflag && (infd != -1)) 9717c478bd9Sstevel@tonic-gate (void) close(infd); 97254da5c1fSjk if (oflag && (outfd != -1)) 9737c478bd9Sstevel@tonic-gate (void) close(outfd); 9747c478bd9Sstevel@tonic-gate 9757c478bd9Sstevel@tonic-gate /* rename tmp output to input file */ 9767c478bd9Sstevel@tonic-gate if (inoutsame) { 9777c478bd9Sstevel@tonic-gate if (rename(outfilename, inputfile) == -1) { 9787c478bd9Sstevel@tonic-gate (void) unlink(outfilename); 9797c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("rename failed.")); 9807c478bd9Sstevel@tonic-gate } 9817c478bd9Sstevel@tonic-gate } 9827c478bd9Sstevel@tonic-gate 983*9a2817adSValerie Bubb Fenwick /* If error occurred and the file was new, remove the output file */ 984*9a2817adSValerie Bubb Fenwick if (errflag && (outfilename != NULL) && !leavefilealone) { 9857c478bd9Sstevel@tonic-gate (void) unlink(outfilename); 9867c478bd9Sstevel@tonic-gate } 9877c478bd9Sstevel@tonic-gate 9887c478bd9Sstevel@tonic-gate /* close pkcs11 session */ 9897c478bd9Sstevel@tonic-gate if (hSession != CK_INVALID_HANDLE) 9907c478bd9Sstevel@tonic-gate (void) C_CloseSession(hSession); 9917c478bd9Sstevel@tonic-gate 9927c478bd9Sstevel@tonic-gate (void) C_Finalize(NULL); 9937c478bd9Sstevel@tonic-gate 9947c478bd9Sstevel@tonic-gate return (errflag); 9957c478bd9Sstevel@tonic-gate } 9967c478bd9Sstevel@tonic-gate 9977c478bd9Sstevel@tonic-gate /* 9987c478bd9Sstevel@tonic-gate * Function for printing progress bar when the verbose flag 9997c478bd9Sstevel@tonic-gate * is set. 10007c478bd9Sstevel@tonic-gate * 10017c478bd9Sstevel@tonic-gate * The vertical bar is printed at 25, 50, and 75% complete. 10027c478bd9Sstevel@tonic-gate * 10037c478bd9Sstevel@tonic-gate * The function is passed the number of positions on the screen it needs to 10047c478bd9Sstevel@tonic-gate * advance and loops. 10057c478bd9Sstevel@tonic-gate */ 10067c478bd9Sstevel@tonic-gate 10077c478bd9Sstevel@tonic-gate static void 10087c478bd9Sstevel@tonic-gate print_status(int pos_to_advance) 10097c478bd9Sstevel@tonic-gate { 10107c478bd9Sstevel@tonic-gate 10117c478bd9Sstevel@tonic-gate while (pos_to_advance > 0) { 10127c478bd9Sstevel@tonic-gate switch (status_pos) { 10137c478bd9Sstevel@tonic-gate case 0: 10147c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("[")); 10157c478bd9Sstevel@tonic-gate break; 10167c478bd9Sstevel@tonic-gate case 19: 10177c478bd9Sstevel@tonic-gate case 39: 10187c478bd9Sstevel@tonic-gate case 59: 10197c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("|")); 10207c478bd9Sstevel@tonic-gate break; 10217c478bd9Sstevel@tonic-gate default: 10227c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext(".")); 10237c478bd9Sstevel@tonic-gate } 10247c478bd9Sstevel@tonic-gate pos_to_advance--; 10257c478bd9Sstevel@tonic-gate status_pos++; 10267c478bd9Sstevel@tonic-gate } 10277c478bd9Sstevel@tonic-gate } 10287c478bd9Sstevel@tonic-gate 10297c478bd9Sstevel@tonic-gate /* 10307c478bd9Sstevel@tonic-gate * Encrypt/Decrypt in multi part. 10317c478bd9Sstevel@tonic-gate * 10327c478bd9Sstevel@tonic-gate * This function reads the input file (infd) and writes the 10337c478bd9Sstevel@tonic-gate * encrypted/decrypted output to file (outfd). 10347c478bd9Sstevel@tonic-gate * 10357c478bd9Sstevel@tonic-gate * cmd - pointing to commandinfo 10367c478bd9Sstevel@tonic-gate * hSession - pkcs session 10377c478bd9Sstevel@tonic-gate * infd - input file descriptor 10387c478bd9Sstevel@tonic-gate * outfd - output file descriptor 10397c478bd9Sstevel@tonic-gate * 10407c478bd9Sstevel@tonic-gate */ 10417c478bd9Sstevel@tonic-gate 10427c478bd9Sstevel@tonic-gate static int 10437c478bd9Sstevel@tonic-gate crypt_multipart(struct CommandInfo *cmd, CK_SESSION_HANDLE hSession, 104454da5c1fSjk int infd, int outfd, off_t insize) 10457c478bd9Sstevel@tonic-gate { 10467c478bd9Sstevel@tonic-gate CK_RV rv; 10477c478bd9Sstevel@tonic-gate CK_ULONG resultlen; 10487c478bd9Sstevel@tonic-gate CK_ULONG resultbuflen; 10497c478bd9Sstevel@tonic-gate CK_BYTE_PTR resultbuf; 10507c478bd9Sstevel@tonic-gate CK_ULONG datalen; 10517c478bd9Sstevel@tonic-gate CK_BYTE databuf[BUFFERSIZE]; 10527c478bd9Sstevel@tonic-gate CK_BYTE outbuf[BUFFERSIZE+BLOCKSIZE]; 10537c478bd9Sstevel@tonic-gate CK_ULONG status_index = 0; /* current total file size read */ 10547c478bd9Sstevel@tonic-gate float status_last = 0.0; /* file size of last element used */ 10557c478bd9Sstevel@tonic-gate float status_incr = 0.0; /* file size element increments */ 10567c478bd9Sstevel@tonic-gate int pos; /* # of progress bar elements to be print */ 10577c478bd9Sstevel@tonic-gate ssize_t nread; 10587c478bd9Sstevel@tonic-gate boolean_t errflag = B_FALSE; 10597c478bd9Sstevel@tonic-gate 10607c478bd9Sstevel@tonic-gate datalen = sizeof (databuf); 10617c478bd9Sstevel@tonic-gate resultbuflen = sizeof (outbuf); 10627c478bd9Sstevel@tonic-gate resultbuf = outbuf; 10637c478bd9Sstevel@tonic-gate 10647c478bd9Sstevel@tonic-gate /* Divide into 79 increments for progress bar element spacing */ 10657c478bd9Sstevel@tonic-gate if (vflag && iflag) 106654da5c1fSjk status_incr = (insize / 79.0); 10677c478bd9Sstevel@tonic-gate 10687c478bd9Sstevel@tonic-gate while ((nread = read(infd, databuf, datalen)) > 0) { 10697c478bd9Sstevel@tonic-gate 10707c478bd9Sstevel@tonic-gate /* Start with the initial buffer */ 10717c478bd9Sstevel@tonic-gate resultlen = resultbuflen; 10727c478bd9Sstevel@tonic-gate rv = cmd->Update(hSession, databuf, (CK_ULONG)nread, 107330a5e8faSwyllys resultbuf, &resultlen); 10747c478bd9Sstevel@tonic-gate 10757c478bd9Sstevel@tonic-gate /* Need a bigger buffer? */ 10767c478bd9Sstevel@tonic-gate if (rv == CKR_BUFFER_TOO_SMALL) { 10777c478bd9Sstevel@tonic-gate 10787c478bd9Sstevel@tonic-gate /* free the old buffer */ 10797c478bd9Sstevel@tonic-gate if (resultbuf != NULL && resultbuf != outbuf) { 10807c478bd9Sstevel@tonic-gate bzero(resultbuf, resultbuflen); 10817c478bd9Sstevel@tonic-gate free(resultbuf); 10827c478bd9Sstevel@tonic-gate } 10837c478bd9Sstevel@tonic-gate 10847c478bd9Sstevel@tonic-gate /* allocate a new big buffer */ 10857c478bd9Sstevel@tonic-gate if ((resultbuf = malloc((size_t)resultlen)) == NULL) { 10867c478bd9Sstevel@tonic-gate int err = errno; 10877c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("malloc: %s"), 10887c478bd9Sstevel@tonic-gate strerror(err)); 10897c478bd9Sstevel@tonic-gate return (-1); 10907c478bd9Sstevel@tonic-gate } 10917c478bd9Sstevel@tonic-gate resultbuflen = resultlen; 10927c478bd9Sstevel@tonic-gate 10937c478bd9Sstevel@tonic-gate /* Try again with bigger buffer */ 10947c478bd9Sstevel@tonic-gate rv = cmd->Update(hSession, databuf, (CK_ULONG)nread, 109530a5e8faSwyllys resultbuf, &resultlen); 10967c478bd9Sstevel@tonic-gate } 10977c478bd9Sstevel@tonic-gate 10987c478bd9Sstevel@tonic-gate if (rv != CKR_OK) { 10997c478bd9Sstevel@tonic-gate errflag = B_TRUE; 11007c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 11017c478bd9Sstevel@tonic-gate "crypto operation failed: %s"), 11027c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 11037c478bd9Sstevel@tonic-gate break; 11047c478bd9Sstevel@tonic-gate } 11057c478bd9Sstevel@tonic-gate 11067c478bd9Sstevel@tonic-gate /* write the output */ 11077c478bd9Sstevel@tonic-gate if (write(outfd, resultbuf, resultlen) != resultlen) { 11087c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 11097c478bd9Sstevel@tonic-gate "failed to write result to output file.")); 11107c478bd9Sstevel@tonic-gate errflag = B_TRUE; 11117c478bd9Sstevel@tonic-gate break; 11127c478bd9Sstevel@tonic-gate } 11137c478bd9Sstevel@tonic-gate 11147c478bd9Sstevel@tonic-gate if (vflag) { 11157c478bd9Sstevel@tonic-gate status_index += resultlen; 11167c478bd9Sstevel@tonic-gate 11177c478bd9Sstevel@tonic-gate /* 11187c478bd9Sstevel@tonic-gate * If input is from stdin, do a our own progress bar 11197c478bd9Sstevel@tonic-gate * by printing periods at a pre-defined increment 11207c478bd9Sstevel@tonic-gate * until the file is done. 11217c478bd9Sstevel@tonic-gate */ 11227c478bd9Sstevel@tonic-gate if (!iflag) { 11237c478bd9Sstevel@tonic-gate 11247c478bd9Sstevel@tonic-gate /* 11257c478bd9Sstevel@tonic-gate * Print at least 1 element in case the file 11267c478bd9Sstevel@tonic-gate * is small, it looks better than nothing. 11277c478bd9Sstevel@tonic-gate */ 11287c478bd9Sstevel@tonic-gate if (status_pos == 0) { 11297c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext(".")); 11307c478bd9Sstevel@tonic-gate status_pos = 1; 11317c478bd9Sstevel@tonic-gate } 11327c478bd9Sstevel@tonic-gate 11337c478bd9Sstevel@tonic-gate if ((status_index - status_last) > 11347c478bd9Sstevel@tonic-gate (PROGRESSSIZE)) { 11357c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext(".")); 11367c478bd9Sstevel@tonic-gate status_last = status_index; 11377c478bd9Sstevel@tonic-gate } 11387c478bd9Sstevel@tonic-gate continue; 11397c478bd9Sstevel@tonic-gate } 11407c478bd9Sstevel@tonic-gate 11417c478bd9Sstevel@tonic-gate /* Calculate the number of elements need to be print */ 114254da5c1fSjk if (insize <= BUFFERSIZE) 11437c478bd9Sstevel@tonic-gate pos = 78; 11447c478bd9Sstevel@tonic-gate else 11457c478bd9Sstevel@tonic-gate pos = (int)((status_index - status_last) / 11467c478bd9Sstevel@tonic-gate status_incr); 11477c478bd9Sstevel@tonic-gate 11487c478bd9Sstevel@tonic-gate /* Add progress bar elements, if needed */ 11497c478bd9Sstevel@tonic-gate if (pos > 0) { 11507c478bd9Sstevel@tonic-gate print_status(pos); 11517c478bd9Sstevel@tonic-gate status_last += (status_incr * pos); 11527c478bd9Sstevel@tonic-gate } 11537c478bd9Sstevel@tonic-gate } 11547c478bd9Sstevel@tonic-gate } 11557c478bd9Sstevel@tonic-gate 11567c478bd9Sstevel@tonic-gate /* Print verbose completion */ 11577c478bd9Sstevel@tonic-gate if (vflag) { 11587c478bd9Sstevel@tonic-gate if (iflag) 11597c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "]"); 11607c478bd9Sstevel@tonic-gate 11617c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "\n%s\n", gettext("Done.")); 11627c478bd9Sstevel@tonic-gate } 11637c478bd9Sstevel@tonic-gate 11647c478bd9Sstevel@tonic-gate /* Error in reading */ 11657c478bd9Sstevel@tonic-gate if (nread == -1) { 11667c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 11677c478bd9Sstevel@tonic-gate "error reading from input file")); 11687c478bd9Sstevel@tonic-gate errflag = B_TRUE; 11697c478bd9Sstevel@tonic-gate } 11707c478bd9Sstevel@tonic-gate 11717c478bd9Sstevel@tonic-gate if (!errflag) { 11727c478bd9Sstevel@tonic-gate 11737c478bd9Sstevel@tonic-gate /* Do the final part */ 11747c478bd9Sstevel@tonic-gate 11757c478bd9Sstevel@tonic-gate rv = cmd->Final(hSession, resultbuf, &resultlen); 11767c478bd9Sstevel@tonic-gate 11777c478bd9Sstevel@tonic-gate if (rv == CKR_OK) { 11787c478bd9Sstevel@tonic-gate /* write the output */ 11797c478bd9Sstevel@tonic-gate if (write(outfd, resultbuf, resultlen) != resultlen) { 11807c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 11817c478bd9Sstevel@tonic-gate "failed to write result to output file.")); 11827c478bd9Sstevel@tonic-gate errflag = B_TRUE; 11837c478bd9Sstevel@tonic-gate } 11847c478bd9Sstevel@tonic-gate } else { 11857c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 11867c478bd9Sstevel@tonic-gate "crypto operation failed: %s"), 11877c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 11887c478bd9Sstevel@tonic-gate errflag = B_TRUE; 11897c478bd9Sstevel@tonic-gate } 11907c478bd9Sstevel@tonic-gate 11917c478bd9Sstevel@tonic-gate } 11927c478bd9Sstevel@tonic-gate 11937c478bd9Sstevel@tonic-gate if (resultbuf != NULL && resultbuf != outbuf) { 11947c478bd9Sstevel@tonic-gate bzero(resultbuf, resultbuflen); 11957c478bd9Sstevel@tonic-gate free(resultbuf); 11967c478bd9Sstevel@tonic-gate } 11977c478bd9Sstevel@tonic-gate 11987c478bd9Sstevel@tonic-gate if (errflag) { 11997c478bd9Sstevel@tonic-gate return (-1); 12007c478bd9Sstevel@tonic-gate } else { 12017c478bd9Sstevel@tonic-gate return (0); 12027c478bd9Sstevel@tonic-gate } 12037c478bd9Sstevel@tonic-gate } 1204