199ebb4cwyllys/*
299ebb4cwyllys * CDDL HEADER START
399ebb4cwyllys *
499ebb4cwyllys * The contents of this file are subject to the terms of the
599ebb4cwyllys * Common Development and Distribution License (the "License").
699ebb4cwyllys * You may not use this file except in compliance with the License.
799ebb4cwyllys *
899ebb4cwyllys * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
999ebb4cwyllys * or http://www.opensolaris.org/os/licensing.
1099ebb4cwyllys * See the License for the specific language governing permissions
1199ebb4cwyllys * and limitations under the License.
1299ebb4cwyllys *
1399ebb4cwyllys * When distributing Covered Code, include this CDDL HEADER in each
1499ebb4cwyllys * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
1599ebb4cwyllys * If applicable, add the following below this CDDL HEADER, with the
1699ebb4cwyllys * fields enclosed by brackets "[]" replaced with your own identifying
1799ebb4cwyllys * information: Portions Copyright [yyyy] [name of copyright owner]
1899ebb4cwyllys *
1999ebb4cwyllys * CDDL HEADER END
2099ebb4cwyllys *
21269e59fJan Pechanec * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
2299ebb4cwyllys */
2399ebb4cwyllys
2499ebb4cwyllys#include <stdio.h>
2599ebb4cwyllys#include <strings.h>
2699ebb4cwyllys#include <ctype.h>
2799ebb4cwyllys#include <libgen.h>
2899ebb4cwyllys#include <libintl.h>
2999ebb4cwyllys#include <errno.h>
30431deaahylee#include <sys/stat.h>
3199ebb4cwyllys#include <kmfapiP.h>
3299ebb4cwyllys#include "util.h"
3399ebb4cwyllys
34431deaahylee#define	LIB_NSS_PATH	"/usr/lib/mps/libnss3.so"
35431deaahylee#define	LIB_NSPR_PATH	"/usr/lib/mps/libnspr4.so"
36431deaahylee
3799ebb4cwyllysstatic void
3899ebb4cwyllysshow_policy(KMF_POLICY_RECORD *plc)
3999ebb4cwyllys{
4099ebb4cwyllys	int i;
4199ebb4cwyllys	if (plc == NULL)
4299ebb4cwyllys		return;
4399ebb4cwyllys
4499ebb4cwyllys	(void) printf("Name: %s\n", plc->name);
4599ebb4cwyllys
4699ebb4cwyllys	(void) printf(gettext("Ignore Date: %s\n"),
4730a5e8fwyllys	    plc->ignore_date ? gettext("true") : gettext("false"));
4899ebb4cwyllys
4999ebb4cwyllys	(void) printf(gettext("Ignore Unknown EKUs: %s\n"),
5030a5e8fwyllys	    plc->ignore_unknown_ekus ? gettext("true") : gettext("false"));
5199ebb4cwyllys
5299ebb4cwyllys	(void) printf(gettext("Ignore TA: %s\n"),
5330a5e8fwyllys	    plc->ignore_trust_anchor ? gettext("true") : gettext("false"));
5499ebb4cwyllys
5599ebb4cwyllys	(void) printf(gettext("Validity Adjusted Time: %s\n"),
5630a5e8fwyllys	    plc->validity_adjusttime ? plc->validity_adjusttime : "<null>");
5799ebb4cwyllys
5899ebb4cwyllys	if (plc->ta_name == NULL && plc->ta_serial == NULL) {
5999ebb4cwyllys		(void) printf(gettext("Trust Anchor Certificate: <null>\n"));
60fc2613bWyllys Ingersoll	} else if (strcasecmp(plc->ta_name, "search") == 0) {
61fc2613bWyllys Ingersoll		(void) printf(gettext("Trust Anchor Certificate: "
62fc2613bWyllys Ingersoll		    "Search by Issuer\n"));
6399ebb4cwyllys	} else {
6499ebb4cwyllys		(void) printf(gettext("Trust Anchor Certificate:\n"));
6599ebb4cwyllys		(void) printf(gettext("\tName: %s\n"),
6630a5e8fwyllys		    plc->ta_name ? plc->ta_name : "<null>");
6799ebb4cwyllys		(void) printf(gettext("\tSerial Number: %s\n"),
6830a5e8fwyllys		    plc->ta_serial ? plc->ta_serial : "<null>");
6999ebb4cwyllys	}
7099ebb4cwyllys
7199ebb4cwyllys	if (plc->ku_bits != 0) {
7299ebb4cwyllys		(void) printf(gettext("Key Usage Bits: "));
7399ebb4cwyllys		for (i = KULOWBIT; i <= KUHIGHBIT; i++) {
7430a5e8fwyllys			char *s = kmf_ku_to_string(
7530a5e8fwyllys			    (plc->ku_bits & (1<<i)));
7699ebb4cwyllys			if (s != NULL) {
7799ebb4cwyllys				(void) printf("%s ", s);
7899ebb4cwyllys			}
7999ebb4cwyllys		}
8099ebb4cwyllys		(void) printf("\n");
8199ebb4cwyllys	} else {
8299ebb4cwyllys		(void) printf(gettext("Key Usage Bits: 0\n"));
8399ebb4cwyllys	}
8499ebb4cwyllys
8599ebb4cwyllys	if (plc->eku_set.eku_count > 0) {
8699ebb4cwyllys		(void) printf(gettext("Extended Key Usage Values:\n"));
8799ebb4cwyllys		for (i = 0; i < plc->eku_set.eku_count; i++) {
88d00756cwyllys			char *s = kmf_oid_to_ekuname(
8930a5e8fwyllys			    &plc->eku_set.ekulist[i]);
9099ebb4cwyllys			(void) printf("\t%s\t(%s)\n",
9130a5e8fwyllys			    kmf_oid_to_string(&plc->eku_set.ekulist[i]),
9230a5e8fwyllys			    s ? s : "unknown");
9399ebb4cwyllys		}
9499ebb4cwyllys	} else {
9599ebb4cwyllys		(void) printf(gettext("Extended Key Usage Values: <null>\n"));
9699ebb4cwyllys	}
9799ebb4cwyllys
9899ebb4cwyllys	(void) printf(gettext("Validation Policy Information:\n"));
9999ebb4cwyllys
10099ebb4cwyllys	if (plc->revocation & KMF_REVOCATION_METHOD_OCSP) {
10199ebb4cwyllys		(void) printf(gettext("    OCSP:\n"));
10299ebb4cwyllys
10399ebb4cwyllys		(void) printf(gettext("\tResponder URI: %s\n"),
10499ebb4cwyllys		    plc->VAL_OCSP_BASIC.responderURI ?
10599ebb4cwyllys		    plc->VAL_OCSP_BASIC.responderURI : "<null>");
10699ebb4cwyllys
10799ebb4cwyllys		(void) printf(gettext("\tProxy: %s\n"),
10899ebb4cwyllys		    plc->VAL_OCSP_BASIC.proxy ?
10999ebb4cwyllys		    plc->VAL_OCSP_BASIC.proxy : "<null>");
11099ebb4cwyllys
11199ebb4cwyllys		(void) printf(gettext("\tUse ResponderURI from Certificate: "
11299ebb4cwyllys		    "%s\n"), plc->VAL_OCSP_BASIC.uri_from_cert ?
11399ebb4cwyllys		    gettext("true") : gettext("false"));
11499ebb4cwyllys
11599ebb4cwyllys		(void) printf(gettext("\tResponse lifetime: %s\n"),
11699ebb4cwyllys		    plc->VAL_OCSP_BASIC.response_lifetime ?
11799ebb4cwyllys		    plc->VAL_OCSP_BASIC.response_lifetime : "<null>");
11899ebb4cwyllys
11999ebb4cwyllys		(void) printf(gettext("\tIgnore Response signature: %s\n"),
12099ebb4cwyllys		    plc->VAL_OCSP_BASIC.ignore_response_sign ?
12199ebb4cwyllys		    gettext("true") : gettext("false"));
12299ebb4cwyllys
12399ebb4cwyllys		if (!plc->VAL_OCSP.has_resp_cert) {
12499ebb4cwyllys			(void) printf(gettext("\tResponder Certificate:"
12599ebb4cwyllys			    " <null>\n"));
12699ebb4cwyllys		} else {
12799ebb4cwyllys			(void) printf(gettext("\tResponder Certificate:\n"));
12899ebb4cwyllys			(void) printf(gettext("\t\tName: %s\n"),
12999ebb4cwyllys			    plc->VAL_OCSP_RESP_CERT.name ?
13099ebb4cwyllys			    plc->VAL_OCSP_RESP_CERT.name : "<null>");
13199ebb4cwyllys			(void) printf(gettext("\t\tSerial: %s\n"),
13299ebb4cwyllys			    plc->VAL_OCSP_RESP_CERT.serial ?
13399ebb4cwyllys			    plc->VAL_OCSP_RESP_CERT.serial : "<null>");
13499ebb4cwyllys		}
13599ebb4cwyllys	}
13699ebb4cwyllys
13799ebb4cwyllys	if (plc->revocation & KMF_REVOCATION_METHOD_CRL) {
13899ebb4cwyllys		(void) printf(gettext("    CRL:\n"));
13999ebb4cwyllys
14099ebb4cwyllys		(void) printf(gettext("\tBase filename: %s\n"),
14199ebb4cwyllys		    plc->validation_info.crl_info.basefilename ?
14299ebb4cwyllys		    plc->validation_info.crl_info.basefilename : "<null>");
14399ebb4cwyllys
14499ebb4cwyllys		(void) printf(gettext("\tDirectory: %s\n"),
14599ebb4cwyllys		    plc->validation_info.crl_info.directory ?
14699ebb4cwyllys		    plc->validation_info.crl_info.directory : "<null>");
14799ebb4cwyllys
14899ebb4cwyllys		(void) printf(gettext("\tDownload and cache CRL: %s\n"),
14930a5e8fwyllys		    plc->validation_info.crl_info.get_crl_uri ?
15030a5e8fwyllys		    gettext("true") : gettext("false"));
15199ebb4cwyllys
15299ebb4cwyllys		(void) printf(gettext("\tProxy: %s\n"),
15399ebb4cwyllys		    plc->validation_info.crl_info.proxy ?
15499ebb4cwyllys		    plc->validation_info.crl_info.proxy : "<null>");
15599ebb4cwyllys
15699ebb4cwyllys		(void) printf(gettext("\tIgnore CRL signature: %s\n"),
15730a5e8fwyllys		    plc->validation_info.crl_info.ignore_crl_sign ?
15830a5e8fwyllys		    gettext("true") : gettext("false"));
15999ebb4cwyllys
16099ebb4cwyllys		(void) printf(gettext("\tIgnore CRL validity date: %s\n"),
16130a5e8fwyllys		    plc->validation_info.crl_info.ignore_crl_date ?
16230a5e8fwyllys		    gettext("true") : gettext("false"));
16399ebb4cwyllys	}
164269e59fJan Pechanec	(void) printf(gettext("Mapper name: %s\n"),
165269e59fJan Pechanec	    plc->mapper.mapname ? plc->mapper.mapname : "<null>");
166269e59fJan Pechanec	(void) printf(gettext("Mapper pathname: %s\n"),
167269e59fJan Pechanec	    plc->mapper.pathname ? plc->mapper.pathname : "<null>");
168269e59fJan Pechanec	(void) printf(gettext("Mapper directory: %s\n"),
169269e59fJan Pechanec	    plc->mapper.dir ? plc->mapper.dir : "<null>");
170269e59fJan Pechanec	(void) printf(gettext("Mapper options: %s\n"),
171269e59fJan Pechanec	    plc->mapper.options ? plc->mapper.options : "<null>");
17299ebb4cwyllys
17399ebb4cwyllys	(void) printf("\n");
17499ebb4cwyllys}
17599ebb4cwyllys
176431deaahyleevoid
177431deaahyleeshow_plugin(void)
178431deaahylee{
179431deaahylee	conf_entrylist_t *phead = NULL;
180431deaahylee	struct stat 	statbuf;
181431deaahylee
182431deaahylee	(void) printf(gettext("KMF plugin information:\n"));
183431deaahylee	(void) printf(gettext("-----------------------\n"));
184431deaahylee
185431deaahylee	/* List the built-in plugins */
186431deaahylee	(void) printf("pkcs11:kmf_pkcs11.so.1 (built-in)\n");
187431deaahylee	(void) printf("file:kmf_openssl.so.1 (built-in)\n");
188431deaahylee
189431deaahylee	/*
190431deaahylee	 * If the NSS libraries are not installed in the system,
191431deaahylee	 * then we will not show the nss plugin either.
192431deaahylee	 */
193431deaahylee	if (stat(LIB_NSS_PATH, &statbuf) == 0 &&
194431deaahylee	    stat(LIB_NSPR_PATH, &statbuf) == 0) {
195431deaahylee		(void) printf("nss:kmf_nss.so.1 (built-in)\n");
196431deaahylee	}
197431deaahylee
198431deaahylee	/* List non-default plugins, if there is any. */
199431deaahylee	if (get_entrylist(&phead) == KMF_OK) {
200431deaahylee		while (phead != NULL) {
201431deaahylee			(void) printf("%s:%s", phead->entry->keystore,
202431deaahylee			    phead->entry->modulepath);
203431deaahylee
204431deaahylee			if (phead->entry->option == NULL)
205431deaahylee				(void) printf("\n");
206431deaahylee			else
207431deaahylee				(void) printf(";option=%s\n",
208431deaahylee				    phead->entry->option);
209431deaahylee			phead = phead->next;
210431deaahylee		}
211431deaahylee		free_entrylist(phead);
212431deaahylee	}
213431deaahylee}
214431deaahylee
215431deaahylee
21699ebb4cwyllysint
21799ebb4cwyllyskc_list(int argc, char *argv[])
21899ebb4cwyllys{
21999ebb4cwyllys	int 		rv = KC_OK;
22099ebb4cwyllys	int		opt, found = 0;
22199ebb4cwyllys	extern int	optind_av;
22299ebb4cwyllys	extern char	*optarg_av;
22399ebb4cwyllys	char		*filename = NULL;
22499ebb4cwyllys	char		*policyname = NULL;
22599ebb4cwyllys	POLICY_LIST	*plclist = NULL, *pnode;
22699ebb4cwyllys	int		sanity_err = 0;
227431deaahylee	boolean_t	list_plugin = B_FALSE;
22899ebb4cwyllys
229431deaahylee	while ((opt = getopt_av(argc, argv, "i:(dbfile)p:(policy)m(plugin)"))
230431deaahylee	    != EOF) {
23199ebb4cwyllys		switch (opt) {
232431deaahylee		case 'i':
233431deaahylee			if (list_plugin)
234431deaahylee				rv = KC_ERR_USAGE;
235431deaahylee			else {
23699ebb4cwyllys				filename = get_string(optarg_av, &rv);
23799ebb4cwyllys				if (filename == NULL) {
23899ebb4cwyllys					(void) fprintf(stderr,
23999ebb4cwyllys					    gettext("Error dbfile input.\n"));
24099ebb4cwyllys				}
241431deaahylee			}
242431deaahylee			break;
243431deaahylee		case 'p':
244431deaahylee			if (list_plugin)
245431deaahylee				rv = KC_ERR_USAGE;
246431deaahylee			else {
24799ebb4cwyllys				policyname = get_string(optarg_av, &rv);
24899ebb4cwyllys				if (policyname == NULL) {
24999ebb4cwyllys					(void) fprintf(stderr,
25099ebb4cwyllys					    gettext("Error policy name.\n"));
25199ebb4cwyllys				}
252431deaahylee			}
253431deaahylee			break;
254431deaahylee		case 'm':
255431deaahylee			list_plugin = B_TRUE;
256431deaahylee			break;
257431deaahylee		default:
258431deaahylee			(void) fprintf(stderr,
259431deaahylee			    gettext("Error input option.\n"));
260431deaahylee			rv = KC_ERR_USAGE;
261431deaahylee			break;
26299ebb4cwyllys		}
26399ebb4cwyllys		if (rv != KC_OK)
26499ebb4cwyllys			goto out;
26599ebb4cwyllys	}
26699ebb4cwyllys
26799ebb4cwyllys	/* No additional args allowed. */
26899ebb4cwyllys	argc -= optind_av;
26999ebb4cwyllys	if (argc) {
27099ebb4cwyllys		(void) fprintf(stderr,
27199ebb4cwyllys		    gettext("Error input option\n"));
27299ebb4cwyllys		rv = KC_ERR_USAGE;
27399ebb4cwyllys		goto out;
27499ebb4cwyllys	}
27599ebb4cwyllys
276431deaahylee	if (list_plugin) {
277431deaahylee		show_plugin();
278431deaahylee		goto out;
279431deaahylee	}
280431deaahylee
28199ebb4cwyllys	if (filename == NULL) {
28299ebb4cwyllys		filename = strdup(KMF_DEFAULT_POLICY_FILE);
28399ebb4cwyllys		if (filename == NULL) {
28499ebb4cwyllys			rv = KC_ERR_MEMORY;
28599ebb4cwyllys			goto out;
28699ebb4cwyllys		}
28799ebb4cwyllys	}
28899ebb4cwyllys
28999ebb4cwyllys	/* Check the access permission of the policy DB */
29099ebb4cwyllys	if (access(filename, R_OK) < 0) {
29199ebb4cwyllys		int err = errno;
29299ebb4cwyllys		(void) fprintf(stderr,
29399ebb4cwyllys		    gettext("Cannot access \"%s\" for list - %s\n"), filename,
29499ebb4cwyllys		    strerror(err));
29599ebb4cwyllys		rv = KC_ERR_ACCESS;
29699ebb4cwyllys		goto out;
29799ebb4cwyllys	}
29899ebb4cwyllys
29999ebb4cwyllys	rv = load_policies(filename, &plclist);
30099ebb4cwyllys	if (rv != KMF_OK) {
30199ebb4cwyllys		goto out;
30299ebb4cwyllys	}
30399ebb4cwyllys
30499ebb4cwyllys	pnode = plclist;
30599ebb4cwyllys	while (pnode != NULL) {
30699ebb4cwyllys		if (policyname == NULL ||
30730a5e8fwyllys		    strcmp(policyname, pnode->plc.name) == 0) {
30899ebb4cwyllys			KMF_POLICY_RECORD *plc = &pnode->plc;
30999ebb4cwyllys
31099ebb4cwyllys			found++;
31130a5e8fwyllys			rv = kmf_verify_policy(plc);
31299ebb4cwyllys			if (rv != KMF_OK) {
31399ebb4cwyllys				(void) fprintf(stderr, gettext(
31499ebb4cwyllys				    "Policy Name: '%s' is invalid\n"),
31599ebb4cwyllys				    plc->name);
31699ebb4cwyllys				sanity_err++;
31799ebb4cwyllys			} else {
31899ebb4cwyllys				show_policy(&pnode->plc);
31999ebb4cwyllys			}
32099ebb4cwyllys		}
32199ebb4cwyllys		pnode = pnode->next;
32299ebb4cwyllys	}
32399ebb4cwyllys
32499ebb4cwyllys	free_policy_list(plclist);
32599ebb4cwyllys
32699ebb4cwyllys	if (!found) {
32799ebb4cwyllys		if (policyname)
32899ebb4cwyllys			(void) fprintf(stderr, gettext(
32999ebb4cwyllys			    "Cannot find policy '%s'\n"), policyname);
33099ebb4cwyllys		else
33199ebb4cwyllys			(void) fprintf(stderr, gettext("Cannot find "
33299ebb4cwyllys			    "any policies to display\n"));
33399ebb4cwyllys		rv = KC_ERR_FIND_POLICY;
33499ebb4cwyllys	} else if (sanity_err) {
33599ebb4cwyllys		rv = KC_ERR_VERIFY_POLICY;
33699ebb4cwyllys	}
33799ebb4cwyllys
33899ebb4cwyllysout:
33999ebb4cwyllys
34099ebb4cwyllys	if (filename != NULL)
34199ebb4cwyllys		free(filename);
34299ebb4cwyllys
34399ebb4cwyllys	if (policyname != NULL)
34499ebb4cwyllys		free(policyname);
34599ebb4cwyllys
34699ebb4cwyllys	return (rv);
34799ebb4cwyllys}
348