17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 599ebb4caSwyllys * Common Development and Distribution License (the "License"). 699ebb4caSwyllys * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 217c478bd9Sstevel@tonic-gate /* 22*c197cb9dShylee * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 237c478bd9Sstevel@tonic-gate * Use is subject to license terms. 247c478bd9Sstevel@tonic-gate */ 257c478bd9Sstevel@tonic-gate 267c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 277c478bd9Sstevel@tonic-gate 287c478bd9Sstevel@tonic-gate /* 297c478bd9Sstevel@tonic-gate * This file contains the functions that are shared among 307c478bd9Sstevel@tonic-gate * the various services this tool will ultimately provide. 317711facfSdinak * The functions in this file return PKCS#11 CK_RV errors. 327711facfSdinak * Only one session and one login per token is supported 337711facfSdinak * at this time. 347c478bd9Sstevel@tonic-gate */ 357c478bd9Sstevel@tonic-gate 367c478bd9Sstevel@tonic-gate #include <stdio.h> 377c478bd9Sstevel@tonic-gate #include <stdlib.h> 387c478bd9Sstevel@tonic-gate #include <string.h> 397c478bd9Sstevel@tonic-gate #include <ctype.h> 4099ebb4caSwyllys #include <sys/types.h> 4199ebb4caSwyllys #include <sys/stat.h> 4299ebb4caSwyllys #include <fcntl.h> 4399ebb4caSwyllys #include <tzfile.h> 447c478bd9Sstevel@tonic-gate #include <cryptoutil.h> 457c478bd9Sstevel@tonic-gate #include <security/cryptoki.h> 4699ebb4caSwyllys #include <kmfapi.h> 477c478bd9Sstevel@tonic-gate 4899ebb4caSwyllys #include "common.h" 497711facfSdinak 507711facfSdinak /* Local status variables. */ 517711facfSdinak static boolean_t initialized = B_FALSE; 527711facfSdinak static boolean_t session_opened = B_FALSE; 537711facfSdinak static boolean_t logged_in = B_FALSE; 547c478bd9Sstevel@tonic-gate 5549e21299Sdinak /* Supporting structures and global variables for getopt_av(). */ 5649e21299Sdinak typedef struct av_opts_s { 5749e21299Sdinak int shortnm; /* short name character */ 5849e21299Sdinak char *longnm; /* long name string, NOT terminated */ 5949e21299Sdinak int longnm_len; /* length of long name string */ 6049e21299Sdinak boolean_t has_arg; /* takes optional argument */ 6149e21299Sdinak } av_opts; 6249e21299Sdinak static av_opts *opts_av = NULL; 6349e21299Sdinak static const char *_save_optstr = NULL; 6449e21299Sdinak static int _save_numopts = 0; 6549e21299Sdinak 6649e21299Sdinak int optind_av = 1; 6749e21299Sdinak char *optarg_av = NULL; 6849e21299Sdinak 6999ebb4caSwyllys static void close_sess(CK_SESSION_HANDLE); 7099ebb4caSwyllys static void logout_token(CK_SESSION_HANDLE); 7199ebb4caSwyllys 727c478bd9Sstevel@tonic-gate /* 737711facfSdinak * Perform PKCS#11 setup here. Currently only C_Initialize is required, 747711facfSdinak * along with setting/resetting state variables. 757c478bd9Sstevel@tonic-gate */ 767711facfSdinak CK_RV 777711facfSdinak init_pk11(void) 787c478bd9Sstevel@tonic-gate { 797711facfSdinak CK_RV rv = CKR_OK; 807711facfSdinak 817711facfSdinak /* If C_Initialize() already called, nothing to do here. */ 827711facfSdinak if (initialized == B_TRUE) 837711facfSdinak return (CKR_OK); 847c478bd9Sstevel@tonic-gate 857711facfSdinak /* Reset state variables because C_Initialize() not yet done. */ 867711facfSdinak session_opened = B_FALSE; 877711facfSdinak logged_in = B_FALSE; 887c478bd9Sstevel@tonic-gate 897711facfSdinak /* Initialize PKCS#11 library. */ 907711facfSdinak if ((rv = C_Initialize(NULL_PTR)) != CKR_OK && 917711facfSdinak rv != CKR_CRYPTOKI_ALREADY_INITIALIZED) { 927711facfSdinak return (rv); 937711facfSdinak } 947c478bd9Sstevel@tonic-gate 957711facfSdinak initialized = B_TRUE; 967711facfSdinak return (CKR_OK); 977c478bd9Sstevel@tonic-gate } 987c478bd9Sstevel@tonic-gate 997c478bd9Sstevel@tonic-gate /* 1007711facfSdinak * Finalize PKCS#11 library and reset state variables. Open sessions, 1017711facfSdinak * if any, are closed, and thereby any logins are logged out also. 1027c478bd9Sstevel@tonic-gate */ 1037711facfSdinak void 1047711facfSdinak final_pk11(CK_SESSION_HANDLE sess) 1057c478bd9Sstevel@tonic-gate { 1067c478bd9Sstevel@tonic-gate 1077711facfSdinak /* If the library wasn't initialized, nothing to do here. */ 1087711facfSdinak if (!initialized) 1097711facfSdinak return; 1107c478bd9Sstevel@tonic-gate 1117711facfSdinak /* Make sure the sesion is closed first. */ 1127711facfSdinak close_sess(sess); 1137711facfSdinak 1147711facfSdinak (void) C_Finalize(NULL); 1157711facfSdinak initialized = B_FALSE; 1167711facfSdinak } 1177711facfSdinak 1187711facfSdinak /* 1197711facfSdinak * Close PKCS#11 session and reset state variables. Any logins are 1207711facfSdinak * logged out. 1217711facfSdinak */ 12299ebb4caSwyllys static void 1237711facfSdinak close_sess(CK_SESSION_HANDLE sess) 1247711facfSdinak { 1257711facfSdinak 1267711facfSdinak if (sess == NULL) { 1277711facfSdinak return; 1287711facfSdinak } 1297711facfSdinak 1307711facfSdinak /* If session is already closed, nothing to do here. */ 1317711facfSdinak if (!session_opened) 1327711facfSdinak return; 1337711facfSdinak 1347711facfSdinak /* Make sure user is logged out of token. */ 1357711facfSdinak logout_token(sess); 1367711facfSdinak 1377711facfSdinak (void) C_CloseSession(sess); 1387711facfSdinak session_opened = B_FALSE; 1397711facfSdinak } 1407711facfSdinak 1417711facfSdinak /* 1427711facfSdinak * Log user out of token and reset status variable. 1437711facfSdinak */ 14499ebb4caSwyllys static void 1457711facfSdinak logout_token(CK_SESSION_HANDLE sess) 1467711facfSdinak { 1477711facfSdinak 1487711facfSdinak if (sess == NULL) { 1497711facfSdinak return; 1507c478bd9Sstevel@tonic-gate } 1517c478bd9Sstevel@tonic-gate 1527711facfSdinak /* If already logged out, nothing to do here. */ 1537711facfSdinak if (!logged_in) 1547711facfSdinak return; 1557711facfSdinak 1567711facfSdinak (void) C_Logout(sess); 1577711facfSdinak logged_in = B_FALSE; 1587711facfSdinak } 1597711facfSdinak 1607711facfSdinak /* 1617711facfSdinak * Gets PIN from user. Caller needs to free the returned PIN when done. 1627711facfSdinak * If two prompts are given, the PIN is confirmed with second prompt. 1637711facfSdinak * Note that getphassphrase() may return data in static memory area. 1647711facfSdinak */ 1657711facfSdinak CK_RV 1667711facfSdinak get_pin(char *prompt1, char *prompt2, CK_UTF8CHAR_PTR *pin, CK_ULONG *pinlen) 1677711facfSdinak { 1687711facfSdinak char *save_phrase, *phrase1, *phrase2; 1697711facfSdinak 17099ebb4caSwyllys 17199ebb4caSwyllys #ifdef DEBUG 17299ebb4caSwyllys if (getenv("TOKENPIN") != NULL) { 17399ebb4caSwyllys *pin = (CK_UTF8CHAR_PTR)strdup(getenv("TOKENPIN")); 17499ebb4caSwyllys *pinlen = strlen((char *)(*pin)); 17599ebb4caSwyllys return (CKR_OK); 17699ebb4caSwyllys } 17799ebb4caSwyllys #endif /* DEBUG */ 1787711facfSdinak 1797711facfSdinak /* Prompt user for a PIN. */ 1807711facfSdinak if (prompt1 == NULL) { 1817711facfSdinak return (CKR_ARGUMENTS_BAD); 1827711facfSdinak } 1837711facfSdinak if ((phrase1 = getpassphrase(prompt1)) == NULL) { 1847711facfSdinak return (CKR_FUNCTION_FAILED); 1857711facfSdinak } 1867711facfSdinak 1877711facfSdinak /* Duplicate 1st PIN in separate chunk of memory. */ 1887711facfSdinak if ((save_phrase = strdup(phrase1)) == NULL) 1897711facfSdinak return (CKR_HOST_MEMORY); 1907711facfSdinak 1917711facfSdinak /* If second prompt given, PIN confirmation is requested. */ 1927711facfSdinak if (prompt2 != NULL) { 1937711facfSdinak if ((phrase2 = getpassphrase(prompt2)) == NULL) { 1947711facfSdinak free(save_phrase); 1957711facfSdinak return (CKR_FUNCTION_FAILED); 1967711facfSdinak } 1977711facfSdinak if (strcmp(save_phrase, phrase2) != 0) { 1987711facfSdinak free(save_phrase); 1997711facfSdinak return (CKR_PIN_INCORRECT); 2007711facfSdinak } 2017711facfSdinak } 2027711facfSdinak 2037711facfSdinak *pin = (CK_UTF8CHAR_PTR)save_phrase; 2047711facfSdinak *pinlen = strlen(save_phrase); 2057711facfSdinak return (CKR_OK); 2067711facfSdinak } 2077711facfSdinak 2087711facfSdinak /* 2097711facfSdinak * Gets yes/no response from user. If either no prompt is supplied, a 2107711facfSdinak * default prompt is used. If not message for invalid input is supplied, 2117711facfSdinak * a default will not be provided. If the user provides no response, 2127711facfSdinak * the input default B_TRUE == yes, B_FALSE == no is returned. 2137711facfSdinak * Otherwise, B_TRUE is returned for yes, and B_FALSE for no. 2147711facfSdinak */ 2157711facfSdinak boolean_t 2167711facfSdinak yesno(char *prompt, char *invalid, boolean_t dflt) 2177711facfSdinak { 2187711facfSdinak char *response, buf[1024]; 2197711facfSdinak char *yes = gettext("yes"); 2207711facfSdinak char *no = gettext("no"); 2217711facfSdinak 22299ebb4caSwyllys 22399ebb4caSwyllys #ifdef DEBUG 22499ebb4caSwyllys /* If debugging or testing, return TRUE and avoid prompting */ 22599ebb4caSwyllys if (getenv("TOKENPIN") != NULL) { 22699ebb4caSwyllys return (B_TRUE); 22799ebb4caSwyllys } 22899ebb4caSwyllys #endif /* DEBUG */ 2297711facfSdinak 2307711facfSdinak if (prompt == NULL) 2317711facfSdinak prompt = gettext("Enter (y)es or (n)o? "); 2327711facfSdinak 2337711facfSdinak for (;;) { 2347711facfSdinak /* Prompt user. */ 2357711facfSdinak (void) printf("%s", prompt); 2367711facfSdinak (void) fflush(stdout); 2377711facfSdinak 2387711facfSdinak /* Get the response. */ 2397711facfSdinak if ((response = fgets(buf, sizeof (buf), stdin)) == NULL) 2407711facfSdinak break; /* go to default response */ 2417711facfSdinak 2427711facfSdinak /* Skip any leading white space. */ 2437711facfSdinak while (isspace(*response)) 2447711facfSdinak response++; 2457711facfSdinak if (*response == '\0') 2467711facfSdinak break; /* go to default response */ 2477711facfSdinak 2487711facfSdinak /* Is it valid input? Return appropriately. */ 2497711facfSdinak if (strncasecmp(response, yes, 1) == 0) 2507711facfSdinak return (B_TRUE); 2517711facfSdinak if (strncasecmp(response, no, 1) == 0) 2527711facfSdinak return (B_FALSE); 2537711facfSdinak 2547711facfSdinak /* Indicate invalid input, and try again. */ 2557711facfSdinak if (invalid != NULL) 2567711facfSdinak (void) printf("%s", invalid); 2577711facfSdinak } 2587711facfSdinak return (dflt); 2597711facfSdinak } 2607711facfSdinak 2617711facfSdinak /* 2627711facfSdinak * Gets the list of slots which have tokens in them. Keeps adjusting 2637711facfSdinak * the size of the slot list buffer until the call is successful or an 2647711facfSdinak * irrecoverable error occurs. 2657711facfSdinak */ 2667711facfSdinak CK_RV 2677711facfSdinak get_token_slots(CK_SLOT_ID_PTR *slot_list, CK_ULONG *slot_count) 2687711facfSdinak { 2697711facfSdinak CK_ULONG tmp_count = 0; 2707711facfSdinak CK_SLOT_ID_PTR tmp_list = NULL_PTR, tmp2_list = NULL_PTR; 2717711facfSdinak int rv = CKR_OK; 2727711facfSdinak 2737711facfSdinak if (!initialized) 2747711facfSdinak if ((rv = init_pk11()) != CKR_OK) 2757711facfSdinak return (rv); 2767711facfSdinak 2777711facfSdinak /* 2787711facfSdinak * Get the slot count first because we don't know how many 2797711facfSdinak * slots there are and how many of those slots even have tokens. 2807711facfSdinak * Don't specify an arbitrary buffer size for the slot list; 2817711facfSdinak * it may be too small (see section 11.5 of PKCS#11 spec). 2827711facfSdinak * Also select only those slots that have tokens in them, 2837711facfSdinak * because this tool has no need to know about empty slots. 2847711facfSdinak */ 2857711facfSdinak if ((rv = C_GetSlotList(1, NULL_PTR, &tmp_count)) != CKR_OK) 2867711facfSdinak return (rv); 2877711facfSdinak 2887711facfSdinak if (tmp_count == 0) { 2897711facfSdinak *slot_list = NULL_PTR; 2907711facfSdinak *slot_count = 0; 2917711facfSdinak return (CKR_OK); 2927711facfSdinak } 2937711facfSdinak 2947711facfSdinak /* Allocate initial space for the slot list. */ 2957711facfSdinak if ((tmp_list = (CK_SLOT_ID_PTR) malloc(tmp_count * 2967711facfSdinak sizeof (CK_SLOT_ID))) == NULL) 2977711facfSdinak return (CKR_HOST_MEMORY); 2987711facfSdinak 2997711facfSdinak /* Then get the slot list itself. */ 3007711facfSdinak for (;;) { 3017711facfSdinak if ((rv = C_GetSlotList(1, tmp_list, &tmp_count)) == CKR_OK) { 3027711facfSdinak *slot_list = tmp_list; 3037711facfSdinak *slot_count = tmp_count; 3047711facfSdinak break; 3057711facfSdinak } 3067711facfSdinak 3077711facfSdinak if (rv != CKR_BUFFER_TOO_SMALL) { 3087711facfSdinak free(tmp_list); 3097711facfSdinak break; 3107711facfSdinak } 3117711facfSdinak 3127711facfSdinak /* If the number of slots grew, try again. */ 3137711facfSdinak if ((tmp2_list = (CK_SLOT_ID_PTR) realloc(tmp_list, 3147711facfSdinak tmp_count * sizeof (CK_SLOT_ID))) == NULL) { 3157711facfSdinak free(tmp_list); 3167711facfSdinak rv = CKR_HOST_MEMORY; 3177711facfSdinak break; 3187711facfSdinak } 3197711facfSdinak tmp_list = tmp2_list; 3207711facfSdinak } 3217711facfSdinak 3227711facfSdinak return (rv); 3237c478bd9Sstevel@tonic-gate } 3247c478bd9Sstevel@tonic-gate 3257c478bd9Sstevel@tonic-gate /* 32699ebb4caSwyllys * Breaks out the getopt-style option string into a structure that can be 32799ebb4caSwyllys * traversed later for calls to getopt_av(). Option string is NOT altered, 32899ebb4caSwyllys * but the struct fields point to locations within option string. 3297c478bd9Sstevel@tonic-gate */ 3307c478bd9Sstevel@tonic-gate static int 33199ebb4caSwyllys populate_opts(char *optstring) 3327c478bd9Sstevel@tonic-gate { 33399ebb4caSwyllys int i; 33499ebb4caSwyllys av_opts *temp; 3357c478bd9Sstevel@tonic-gate char *marker; 3367c478bd9Sstevel@tonic-gate 33799ebb4caSwyllys if (optstring == NULL || *optstring == '\0') 33899ebb4caSwyllys return (0); 33999ebb4caSwyllys 34099ebb4caSwyllys /* 34199ebb4caSwyllys * This tries to imitate getopt(3c) Each option must conform to: 34299ebb4caSwyllys * <short name char> [ ':' ] [ '(' <long name string> ')' ] 34399ebb4caSwyllys * If long name is missing, the short name is used for long name. 34499ebb4caSwyllys */ 34599ebb4caSwyllys for (i = 0; *optstring != '\0'; i++) { 34699ebb4caSwyllys if ((temp = (av_opts *)((i == 0) ? malloc(sizeof (av_opts)) : 34799ebb4caSwyllys realloc(opts_av, (i+1) * sizeof (av_opts)))) == NULL) { 34899ebb4caSwyllys if (opts_av != NULL) 34999ebb4caSwyllys free(opts_av); 35099ebb4caSwyllys opts_av = NULL; 35199ebb4caSwyllys return (0); 35299ebb4caSwyllys } else { 35399ebb4caSwyllys opts_av = (av_opts *)temp; 35499ebb4caSwyllys } 3557c478bd9Sstevel@tonic-gate 35699ebb4caSwyllys (void) memset(&opts_av[i], 0, sizeof (av_opts)); 35799ebb4caSwyllys marker = optstring; /* may need optstring later */ 3587c478bd9Sstevel@tonic-gate 35999ebb4caSwyllys opts_av[i].shortnm = *marker++; /* set short name */ 36099ebb4caSwyllys 36199ebb4caSwyllys if (*marker == ':') { /* check for opt arg */ 36299ebb4caSwyllys marker++; 36399ebb4caSwyllys opts_av[i].has_arg = B_TRUE; 36499ebb4caSwyllys } 36599ebb4caSwyllys 36699ebb4caSwyllys if (*marker == '(') { /* check and set long name */ 36799ebb4caSwyllys marker++; 36899ebb4caSwyllys opts_av[i].longnm = marker; 36999ebb4caSwyllys opts_av[i].longnm_len = strcspn(marker, ")"); 37099ebb4caSwyllys optstring = marker + opts_av[i].longnm_len + 1; 37199ebb4caSwyllys } else { 37299ebb4caSwyllys /* use short name option character */ 37399ebb4caSwyllys opts_av[i].longnm = optstring; 37499ebb4caSwyllys opts_av[i].longnm_len = 1; 37599ebb4caSwyllys optstring = marker; 37699ebb4caSwyllys } 37799ebb4caSwyllys } 37899ebb4caSwyllys 37999ebb4caSwyllys return (i); 3807c478bd9Sstevel@tonic-gate } 3817c478bd9Sstevel@tonic-gate 3827c478bd9Sstevel@tonic-gate /* 38399ebb4caSwyllys * getopt_av() is very similar to getopt(3c) in that the takes an option 38499ebb4caSwyllys * string, compares command line arguments for matches, and returns a single 38599ebb4caSwyllys * letter option when a match is found. However, getopt_av() differs from 38699ebb4caSwyllys * getopt(3c) by requiring that only longname options and values be found 38799ebb4caSwyllys * on the command line and all leading dashes are omitted. In other words, 38899ebb4caSwyllys * it tries to enforce only longname "option=value" arguments on the command 38999ebb4caSwyllys * line. Boolean options are not allowed either. 3907c478bd9Sstevel@tonic-gate */ 39199ebb4caSwyllys int 39299ebb4caSwyllys getopt_av(int argc, char * const *argv, const char *optstring) 3937c478bd9Sstevel@tonic-gate { 39499ebb4caSwyllys int i; 39599ebb4caSwyllys int len; 39699ebb4caSwyllys char *cur_option; 3977c478bd9Sstevel@tonic-gate 39899ebb4caSwyllys if (optind_av >= argc) 39999ebb4caSwyllys return (EOF); 4007c478bd9Sstevel@tonic-gate 40199ebb4caSwyllys /* First time or when optstring changes from previous one */ 40299ebb4caSwyllys if (_save_optstr != optstring) { 40399ebb4caSwyllys if (opts_av != NULL) 40499ebb4caSwyllys free(opts_av); 40599ebb4caSwyllys opts_av = NULL; 40699ebb4caSwyllys _save_optstr = optstring; 40799ebb4caSwyllys _save_numopts = populate_opts((char *)optstring); 40899ebb4caSwyllys } 4097c478bd9Sstevel@tonic-gate 41099ebb4caSwyllys for (i = 0; i < _save_numopts; i++) { 41199ebb4caSwyllys cur_option = argv[optind_av]; 4127c478bd9Sstevel@tonic-gate 41399ebb4caSwyllys if (strcmp(cur_option, "--") == 0) { 41499ebb4caSwyllys optind_av++; 41599ebb4caSwyllys break; 4167c478bd9Sstevel@tonic-gate } 4177c478bd9Sstevel@tonic-gate 41899ebb4caSwyllys if (cur_option[0] == '-' && strlen(cur_option) == 2) { 41999ebb4caSwyllys len = 1; 42099ebb4caSwyllys cur_option++; /* remove "-" */ 42199ebb4caSwyllys } else { 42299ebb4caSwyllys len = strcspn(cur_option, "="); 42399ebb4caSwyllys } 4247c478bd9Sstevel@tonic-gate 42599ebb4caSwyllys if (len == opts_av[i].longnm_len && strncmp(cur_option, 42699ebb4caSwyllys opts_av[i].longnm, opts_av[i].longnm_len) == 0) { 42799ebb4caSwyllys /* matched */ 42899ebb4caSwyllys if (!opts_av[i].has_arg) { 42999ebb4caSwyllys optind_av++; 43099ebb4caSwyllys return (opts_av[i].shortnm); 43199ebb4caSwyllys } 43299ebb4caSwyllys 43399ebb4caSwyllys /* needs optarg */ 43499ebb4caSwyllys if (cur_option[len] == '=') { 43599ebb4caSwyllys optarg_av = &(cur_option[len+1]); 43699ebb4caSwyllys optind_av++; 43799ebb4caSwyllys return (opts_av[i].shortnm); 43899ebb4caSwyllys } 43999ebb4caSwyllys 44099ebb4caSwyllys optarg_av = NULL; 44199ebb4caSwyllys optind_av++; 44299ebb4caSwyllys return ((int)'?'); 44399ebb4caSwyllys } 4447c478bd9Sstevel@tonic-gate } 4457c478bd9Sstevel@tonic-gate 44699ebb4caSwyllys return (EOF); 4477c478bd9Sstevel@tonic-gate } 4487c478bd9Sstevel@tonic-gate 44999ebb4caSwyllys KMF_KEYSTORE_TYPE 45099ebb4caSwyllys KS2Int(char *keystore_str) 45149e21299Sdinak { 45299ebb4caSwyllys if (keystore_str == NULL) 45399ebb4caSwyllys return (0); 45499ebb4caSwyllys if (!strcasecmp(keystore_str, "pkcs11")) 45599ebb4caSwyllys return (KMF_KEYSTORE_PK11TOKEN); 45699ebb4caSwyllys else if (!strcasecmp(keystore_str, "nss")) 45799ebb4caSwyllys return (KMF_KEYSTORE_NSS); 45899ebb4caSwyllys else if (!strcasecmp(keystore_str, "file")) 45999ebb4caSwyllys return (KMF_KEYSTORE_OPENSSL); 46099ebb4caSwyllys else 46199ebb4caSwyllys return (0); 46299ebb4caSwyllys } 46349e21299Sdinak 46449e21299Sdinak 46599ebb4caSwyllys int 46699ebb4caSwyllys Str2KeyType(char *algm, KMF_KEY_ALG *ktype, KMF_ALGORITHM_INDEX *sigAlg) 46799ebb4caSwyllys { 46899ebb4caSwyllys if (algm == NULL) { 46999ebb4caSwyllys *sigAlg = KMF_ALGID_MD5WithRSA; 47099ebb4caSwyllys *ktype = KMF_RSA; 47199ebb4caSwyllys } else if (strcasecmp(algm, "DSA") == 0) { 47299ebb4caSwyllys *sigAlg = KMF_ALGID_SHA1WithDSA; 47399ebb4caSwyllys *ktype = KMF_DSA; 47499ebb4caSwyllys } else if (strcasecmp(algm, "RSA") == 0) { 47599ebb4caSwyllys *sigAlg = KMF_ALGID_MD5WithRSA; 47699ebb4caSwyllys *ktype = KMF_RSA; 47799ebb4caSwyllys } else { 47899ebb4caSwyllys return (-1); 47949e21299Sdinak } 48099ebb4caSwyllys return (0); 48149e21299Sdinak } 48249e21299Sdinak 48399ebb4caSwyllys int 48499ebb4caSwyllys Str2SymKeyType(char *algm, KMF_KEY_ALG *ktype) 48549e21299Sdinak { 48699ebb4caSwyllys if (algm == NULL) 48799ebb4caSwyllys *ktype = KMF_AES; 48899ebb4caSwyllys else if (strcasecmp(algm, "aes") == 0) 48999ebb4caSwyllys *ktype = KMF_AES; 49099ebb4caSwyllys else if (strcasecmp(algm, "arcfour") == 0) 49199ebb4caSwyllys *ktype = KMF_RC4; 49299ebb4caSwyllys else if (strcasecmp(algm, "des") == 0) 49399ebb4caSwyllys *ktype = KMF_DES; 49499ebb4caSwyllys else if (strcasecmp(algm, "3des") == 0) 49599ebb4caSwyllys *ktype = KMF_DES3; 496*c197cb9dShylee else if (strcasecmp(algm, "generic") == 0) 497*c197cb9dShylee *ktype = KMF_GENERIC_SECRET; 49899ebb4caSwyllys else 49999ebb4caSwyllys return (-1); 50049e21299Sdinak 50199ebb4caSwyllys return (0); 50249e21299Sdinak } 50349e21299Sdinak 50449e21299Sdinak int 50599ebb4caSwyllys Str2Lifetime(char *ltimestr, uint32_t *ltime) 50649e21299Sdinak { 50799ebb4caSwyllys int num; 50899ebb4caSwyllys char timetok[6]; 50949e21299Sdinak 51099ebb4caSwyllys if (ltimestr == NULL || !strlen(ltimestr)) { 51199ebb4caSwyllys /* default to 1 year lifetime */ 51299ebb4caSwyllys *ltime = SECSPERDAY * DAYSPERNYEAR; 51399ebb4caSwyllys return (0); 51449e21299Sdinak } 51549e21299Sdinak 51699ebb4caSwyllys (void) memset(timetok, 0, sizeof (timetok)); 51799ebb4caSwyllys if (sscanf(ltimestr, "%d-%06s", &num, timetok) != 2) 51899ebb4caSwyllys return (-1); 51949e21299Sdinak 52099ebb4caSwyllys if (!strcasecmp(timetok, "day") || 52199ebb4caSwyllys !strcasecmp(timetok, "days")) { 52299ebb4caSwyllys *ltime = num * SECSPERDAY; 52399ebb4caSwyllys } else if (!strcasecmp(timetok, "hour") || 52499ebb4caSwyllys !strcasecmp(timetok, "hours")) { 52599ebb4caSwyllys *ltime = num * SECSPERHOUR; 52699ebb4caSwyllys } else if (!strcasecmp(timetok, "year") || 52799ebb4caSwyllys !strcasecmp(timetok, "years")) { 52899ebb4caSwyllys *ltime = num * SECSPERDAY * DAYSPERNYEAR; 52999ebb4caSwyllys } else { 53099ebb4caSwyllys *ltime = 0; 53149e21299Sdinak return (-1); 53249e21299Sdinak } 53349e21299Sdinak 53499ebb4caSwyllys return (0); 53599ebb4caSwyllys } 53649e21299Sdinak 53799ebb4caSwyllys int 53899ebb4caSwyllys OT2Int(char *objclass) 53999ebb4caSwyllys { 54099ebb4caSwyllys char *c = NULL; 54199ebb4caSwyllys int retval = 0; 54249e21299Sdinak 54399ebb4caSwyllys if (objclass == NULL) 54499ebb4caSwyllys return (-1); 54549e21299Sdinak 54699ebb4caSwyllys c = strchr(objclass, ':'); 54799ebb4caSwyllys if (c != NULL) { 54899ebb4caSwyllys if (!strcasecmp(c, ":private")) 54999ebb4caSwyllys retval = PK_PRIVATE_OBJ; 55099ebb4caSwyllys else if (!strcasecmp(c, ":public")) 55199ebb4caSwyllys retval = PK_PUBLIC_OBJ; 55299ebb4caSwyllys else if (!strcasecmp(c, ":both")) 55399ebb4caSwyllys retval = PK_PRIVATE_OBJ | PK_PUBLIC_OBJ; 55499ebb4caSwyllys else /* unrecognized option */ 55599ebb4caSwyllys return (-1); 55699ebb4caSwyllys 55799ebb4caSwyllys *c = '\0'; 55899ebb4caSwyllys } 55999ebb4caSwyllys 56099ebb4caSwyllys if (!strcasecmp(objclass, "public")) { 56199ebb4caSwyllys if (retval) 56299ebb4caSwyllys return (-1); 56399ebb4caSwyllys return (retval | PK_PUBLIC_OBJ | PK_CERT_OBJ | 56499ebb4caSwyllys PK_PUBKEY_OBJ); 56599ebb4caSwyllys } else if (!strcasecmp(objclass, "private")) { 56699ebb4caSwyllys if (retval) 56799ebb4caSwyllys return (-1); 56899ebb4caSwyllys return (retval | PK_PRIKEY_OBJ | PK_PRIVATE_OBJ); 56999ebb4caSwyllys } else if (!strcasecmp(objclass, "both")) { 57099ebb4caSwyllys if (retval) 57199ebb4caSwyllys return (-1); 57299ebb4caSwyllys return (PK_KEY_OBJ | PK_PUBLIC_OBJ | PK_PRIVATE_OBJ); 57399ebb4caSwyllys } else if (!strcasecmp(objclass, "cert")) { 57499ebb4caSwyllys return (retval | PK_CERT_OBJ); 57599ebb4caSwyllys } else if (!strcasecmp(objclass, "key")) { 57699ebb4caSwyllys if (retval == 0) /* return all keys */ 57799ebb4caSwyllys return (retval | PK_KEY_OBJ); 57899ebb4caSwyllys else if (retval == (PK_PRIVATE_OBJ | PK_PUBLIC_OBJ)) 57999ebb4caSwyllys /* return all keys */ 58099ebb4caSwyllys return (retval | PK_KEY_OBJ); 58199ebb4caSwyllys else if (retval & PK_PUBLIC_OBJ) 58299ebb4caSwyllys /* Only return public keys */ 58399ebb4caSwyllys return (retval | PK_PUBKEY_OBJ); 58499ebb4caSwyllys else if (retval & PK_PRIVATE_OBJ) 58599ebb4caSwyllys /* Only return private keys */ 58699ebb4caSwyllys return (retval | PK_PRIKEY_OBJ); 58799ebb4caSwyllys } else if (!strcasecmp(objclass, "crl")) { 58899ebb4caSwyllys if (retval) 58999ebb4caSwyllys return (-1); 59099ebb4caSwyllys return (retval | PK_CRL_OBJ); 59199ebb4caSwyllys } 59299ebb4caSwyllys 59399ebb4caSwyllys if (retval == 0) /* No matches found */ 59499ebb4caSwyllys retval = -1; 59599ebb4caSwyllys return (retval); 59649e21299Sdinak } 59749e21299Sdinak 59899ebb4caSwyllys KMF_ENCODE_FORMAT 59999ebb4caSwyllys Str2Format(char *formstr) 6007c478bd9Sstevel@tonic-gate { 60199ebb4caSwyllys if (formstr == NULL || !strcasecmp(formstr, "der")) 60299ebb4caSwyllys return (KMF_FORMAT_ASN1); 60399ebb4caSwyllys if (!strcasecmp(formstr, "pem")) 60499ebb4caSwyllys return (KMF_FORMAT_PEM); 60599ebb4caSwyllys if (!strcasecmp(formstr, "pkcs12")) 60699ebb4caSwyllys return (KMF_FORMAT_PKCS12); 60799ebb4caSwyllys 60899ebb4caSwyllys return (KMF_FORMAT_UNDEF); 60999ebb4caSwyllys } 6107c478bd9Sstevel@tonic-gate 6117711facfSdinak 61299ebb4caSwyllys KMF_RETURN 61399ebb4caSwyllys select_token(void *kmfhandle, char *token, 61499ebb4caSwyllys int readonly) 61599ebb4caSwyllys { 61699ebb4caSwyllys KMF_RETURN rv = KMF_OK; 61799ebb4caSwyllys KMF_CONFIG_PARAMS config; 6187711facfSdinak 61999ebb4caSwyllys if (token == NULL) 62099ebb4caSwyllys return (KMF_ERR_BAD_PARAMETER); 6217c478bd9Sstevel@tonic-gate 62299ebb4caSwyllys (void) memset(&config, 0, sizeof (config)); 62399ebb4caSwyllys config.kstype = KMF_KEYSTORE_PK11TOKEN; 62499ebb4caSwyllys config.pkcs11config.label = token; 62599ebb4caSwyllys config.pkcs11config.readonly = readonly; 6267711facfSdinak 62799ebb4caSwyllys rv = KMF_ConfigureKeystore(kmfhandle, &config); 62899ebb4caSwyllys if (rv == KMF_ERR_TOKEN_SELECTED) 62999ebb4caSwyllys rv = KMF_OK; 63099ebb4caSwyllys return (rv); 6317711facfSdinak } 6327711facfSdinak 63399ebb4caSwyllys 63499ebb4caSwyllys KMF_RETURN 63599ebb4caSwyllys configure_nss(void *kmfhandle, char *dir, char *prefix) 6367711facfSdinak { 63799ebb4caSwyllys KMF_RETURN rv = KMF_OK; 63899ebb4caSwyllys KMF_CONFIG_PARAMS config; 6397711facfSdinak 64099ebb4caSwyllys (void) memset(&config, 0, sizeof (config)); 64199ebb4caSwyllys config.kstype = KMF_KEYSTORE_NSS; 64299ebb4caSwyllys config.nssconfig.configdir = dir; 64399ebb4caSwyllys config.nssconfig.certPrefix = prefix; 64499ebb4caSwyllys config.nssconfig.keyPrefix = prefix; 64599ebb4caSwyllys config.nssconfig.secModName = NULL; 6467711facfSdinak 64799ebb4caSwyllys rv = KMF_ConfigureKeystore(kmfhandle, &config); 64899ebb4caSwyllys if (rv == KMF_KEYSTORE_ALREADY_INITIALIZED) 64999ebb4caSwyllys rv = KMF_OK; 6507c478bd9Sstevel@tonic-gate 65199ebb4caSwyllys return (rv); 65299ebb4caSwyllys } 6537711facfSdinak 65499ebb4caSwyllys 65599ebb4caSwyllys KMF_RETURN 65699ebb4caSwyllys get_pk12_password(KMF_CREDENTIAL *cred) 65799ebb4caSwyllys { 65899ebb4caSwyllys KMF_RETURN rv = KMF_OK; 65999ebb4caSwyllys char prompt[1024]; 6607711facfSdinak 6617711facfSdinak /* 66299ebb4caSwyllys * Get the password to use for the PK12 encryption. 6637711facfSdinak */ 66499ebb4caSwyllys (void) strlcpy(prompt, 66599ebb4caSwyllys gettext("Enter password to use for " 66699ebb4caSwyllys "accessing the PKCS12 file: "), 66799ebb4caSwyllys sizeof (prompt)); 6687711facfSdinak 66999ebb4caSwyllys if (get_pin(prompt, NULL, (uchar_t **)&cred->cred, 67099ebb4caSwyllys (ulong_t *)&cred->credlen) != CKR_OK) { 67199ebb4caSwyllys cred->cred = NULL; 67299ebb4caSwyllys cred->credlen = 0; 6737711facfSdinak } 6747711facfSdinak 6757711facfSdinak return (rv); 6767711facfSdinak } 6777711facfSdinak 6787711facfSdinak 67999ebb4caSwyllys #define COUNTRY_PROMPT "Country Name (2 letter code) [US]:" 68099ebb4caSwyllys #define STATE_PROMPT "State or Province Name (full name) [Some-State]:" 68199ebb4caSwyllys #define LOCALITY_PROMPT "Locality Name (eg, city) []:" 68299ebb4caSwyllys #define ORG_PROMPT "Organization Name (eg, company) []:" 68399ebb4caSwyllys #define UNIT_PROMPT "Organizational Unit Name (eg, section) []:" 68499ebb4caSwyllys #define NAME_PROMPT "Common Name (eg, YOUR name) []:" 68599ebb4caSwyllys #define EMAIL_PROMPT "Email Address []:" 6867711facfSdinak 68799ebb4caSwyllys #define COUNTRY_DEFAULT "US" 68899ebb4caSwyllys #define STATE_DEFAULT "Some-State" 68999ebb4caSwyllys #define INVALID_INPUT "Invalid input; please re-enter ..." 6907711facfSdinak 69199ebb4caSwyllys #define SUBNAMESIZ 1024 69299ebb4caSwyllys #define RDN_MIN 1 69399ebb4caSwyllys #define RDN_MAX 64 69499ebb4caSwyllys #define COUNTRYNAME_MIN 2 69599ebb4caSwyllys #define COUNTRYNAME_MAX 2 6967711facfSdinak 69799ebb4caSwyllys static char * 69899ebb4caSwyllys get_input_string(char *prompt, char *default_str, int min_len, int max_len) 69999ebb4caSwyllys { 70099ebb4caSwyllys char buf[1024]; 70199ebb4caSwyllys char *response = NULL; 70299ebb4caSwyllys char *ret = NULL; 70399ebb4caSwyllys int len; 7047711facfSdinak 70599ebb4caSwyllys for (;;) { 70699ebb4caSwyllys (void) printf("\t%s", prompt); 70799ebb4caSwyllys (void) fflush(stdout); 70899ebb4caSwyllys 70999ebb4caSwyllys response = fgets(buf, sizeof (buf), stdin); 71099ebb4caSwyllys if (response == NULL) { 71199ebb4caSwyllys if (default_str != NULL) { 71299ebb4caSwyllys ret = strdup(default_str); 71399ebb4caSwyllys } 71499ebb4caSwyllys break; 71599ebb4caSwyllys } 71699ebb4caSwyllys 71799ebb4caSwyllys /* Skip any leading white space. */ 71899ebb4caSwyllys while (isspace(*response)) 71999ebb4caSwyllys response++; 72099ebb4caSwyllys if (*response == '\0') { 72199ebb4caSwyllys if (default_str != NULL) { 72299ebb4caSwyllys ret = strdup(default_str); 72399ebb4caSwyllys } 72499ebb4caSwyllys break; 72599ebb4caSwyllys } 72699ebb4caSwyllys 72799ebb4caSwyllys len = strlen(response); 72899ebb4caSwyllys response[len-1] = '\0'; /* get rid of "LF" */ 72999ebb4caSwyllys len--; 73099ebb4caSwyllys if (len >= min_len && len <= max_len) { 73199ebb4caSwyllys ret = strdup(response); 73299ebb4caSwyllys break; 7337711facfSdinak } 7347711facfSdinak 73599ebb4caSwyllys (void) printf("%s\n", INVALID_INPUT); 73699ebb4caSwyllys 7377711facfSdinak } 7387711facfSdinak 73999ebb4caSwyllys return (ret); 74099ebb4caSwyllys } 7417711facfSdinak 74299ebb4caSwyllys int 74399ebb4caSwyllys get_subname(char **result) 74499ebb4caSwyllys { 74599ebb4caSwyllys char *country = NULL; 74699ebb4caSwyllys char *state = NULL; 74799ebb4caSwyllys char *locality = NULL; 74899ebb4caSwyllys char *org = NULL; 74999ebb4caSwyllys char *unit = NULL; 75099ebb4caSwyllys char *name = NULL; 75199ebb4caSwyllys char *email = NULL; 75299ebb4caSwyllys char *subname = NULL; 75399ebb4caSwyllys 75499ebb4caSwyllys (void) printf("Entering following fields for subject (a DN) ...\n"); 75599ebb4caSwyllys country = get_input_string(COUNTRY_PROMPT, COUNTRY_DEFAULT, 75699ebb4caSwyllys COUNTRYNAME_MIN, COUNTRYNAME_MAX); 75799ebb4caSwyllys if (country == NULL) 75899ebb4caSwyllys return (-1); 75999ebb4caSwyllys 76099ebb4caSwyllys state = get_input_string(STATE_PROMPT, STATE_DEFAULT, 76199ebb4caSwyllys RDN_MIN, RDN_MAX); 76299ebb4caSwyllys if (state == NULL) { 76399ebb4caSwyllys goto out; 7647711facfSdinak } 7657711facfSdinak 76699ebb4caSwyllys locality = get_input_string(LOCALITY_PROMPT, NULL, RDN_MIN, RDN_MAX); 76799ebb4caSwyllys org = get_input_string(ORG_PROMPT, NULL, RDN_MIN, RDN_MAX); 76899ebb4caSwyllys unit = get_input_string(UNIT_PROMPT, NULL, RDN_MIN, RDN_MAX); 76999ebb4caSwyllys name = get_input_string(NAME_PROMPT, NULL, RDN_MIN, RDN_MAX); 77099ebb4caSwyllys email = get_input_string(EMAIL_PROMPT, NULL, RDN_MIN, RDN_MAX); 7717711facfSdinak 77299ebb4caSwyllys /* Now create a subject name from the input strings */ 77399ebb4caSwyllys if ((subname = malloc(SUBNAMESIZ)) == NULL) 77499ebb4caSwyllys goto out; 77599ebb4caSwyllys 77699ebb4caSwyllys (void) memset(subname, 0, SUBNAMESIZ); 77799ebb4caSwyllys (void) strlcpy(subname, "C=", SUBNAMESIZ); 77899ebb4caSwyllys (void) strlcat(subname, country, SUBNAMESIZ); 77999ebb4caSwyllys (void) strlcat(subname, ", ", SUBNAMESIZ); 78099ebb4caSwyllys (void) strlcat(subname, "ST=", SUBNAMESIZ); 78199ebb4caSwyllys (void) strlcat(subname, state, SUBNAMESIZ); 7827711facfSdinak 78399ebb4caSwyllys if (locality) { 78499ebb4caSwyllys (void) strlcat(subname, ", ", SUBNAMESIZ); 78599ebb4caSwyllys (void) strlcat(subname, "L=", SUBNAMESIZ); 78699ebb4caSwyllys (void) strlcat(subname, locality, SUBNAMESIZ); 7877711facfSdinak } 7887711facfSdinak 78999ebb4caSwyllys if (org) { 79099ebb4caSwyllys (void) strlcat(subname, ", ", SUBNAMESIZ); 79199ebb4caSwyllys (void) strlcat(subname, "O=", SUBNAMESIZ); 79299ebb4caSwyllys (void) strlcat(subname, org, SUBNAMESIZ); 7937711facfSdinak } 7947711facfSdinak 79599ebb4caSwyllys if (unit) { 79699ebb4caSwyllys (void) strlcat(subname, ", ", SUBNAMESIZ); 79799ebb4caSwyllys (void) strlcat(subname, "OU=", SUBNAMESIZ); 79899ebb4caSwyllys (void) strlcat(subname, unit, SUBNAMESIZ); 79999ebb4caSwyllys } 8007711facfSdinak 80199ebb4caSwyllys if (name) { 80299ebb4caSwyllys (void) strlcat(subname, ", ", SUBNAMESIZ); 80399ebb4caSwyllys (void) strlcat(subname, "CN=", SUBNAMESIZ); 80499ebb4caSwyllys (void) strlcat(subname, name, SUBNAMESIZ); 8057711facfSdinak } 8067711facfSdinak 80799ebb4caSwyllys if (email) { 80899ebb4caSwyllys (void) strlcat(subname, ", ", SUBNAMESIZ); 80999ebb4caSwyllys (void) strlcat(subname, "E=", SUBNAMESIZ); 81099ebb4caSwyllys (void) strlcat(subname, email, SUBNAMESIZ); 8117c478bd9Sstevel@tonic-gate } 8127c478bd9Sstevel@tonic-gate 81399ebb4caSwyllys out: 81499ebb4caSwyllys if (country) 81599ebb4caSwyllys free(country); 81699ebb4caSwyllys if (state) 81799ebb4caSwyllys free(state); 81899ebb4caSwyllys if (locality) 81999ebb4caSwyllys free(locality); 82099ebb4caSwyllys if (org) 82199ebb4caSwyllys free(org); 82299ebb4caSwyllys if (unit) 82399ebb4caSwyllys free(unit); 82499ebb4caSwyllys if (name) 82599ebb4caSwyllys free(name); 82699ebb4caSwyllys if (email) 82799ebb4caSwyllys free(email); 82899ebb4caSwyllys 82999ebb4caSwyllys if (subname == NULL) 83099ebb4caSwyllys return (-1); 83199ebb4caSwyllys else { 83299ebb4caSwyllys *result = subname; 83399ebb4caSwyllys return (0); 8347711facfSdinak } 8357c478bd9Sstevel@tonic-gate } 8367c478bd9Sstevel@tonic-gate 8377c478bd9Sstevel@tonic-gate /* 83899ebb4caSwyllys * Parse a string of KeyUsage values and convert 83999ebb4caSwyllys * them to the correct KU Bits. 84099ebb4caSwyllys * The field may be marked "critical" by prepending 84199ebb4caSwyllys * "critical:" to the list. 84299ebb4caSwyllys * EX: critical:digitialSignature,keyEncipherment 8437c478bd9Sstevel@tonic-gate */ 84499ebb4caSwyllys KMF_RETURN 84599ebb4caSwyllys verify_keyusage(char *kustr, uint16_t *kubits, int *critical) 8467c478bd9Sstevel@tonic-gate { 84799ebb4caSwyllys KMF_RETURN ret = KMF_OK; 84899ebb4caSwyllys uint16_t kuval; 84999ebb4caSwyllys char *k; 85099ebb4caSwyllys 85199ebb4caSwyllys *kubits = 0; 85299ebb4caSwyllys if (kustr == NULL || !strlen(kustr)) 85399ebb4caSwyllys return (KMF_ERR_BAD_PARAMETER); 85499ebb4caSwyllys 85599ebb4caSwyllys /* Check to see if this is critical */ 85699ebb4caSwyllys if (!strncasecmp(kustr, "critical:", strlen("critical:"))) { 85799ebb4caSwyllys *critical = TRUE; 85899ebb4caSwyllys kustr += strlen("critical:"); 85999ebb4caSwyllys } else { 86099ebb4caSwyllys *critical = FALSE; 8617c478bd9Sstevel@tonic-gate } 8627711facfSdinak 86399ebb4caSwyllys k = strtok(kustr, ","); 86499ebb4caSwyllys while (k != NULL) { 86599ebb4caSwyllys kuval = KMF_StringToKeyUsage(k); 86699ebb4caSwyllys if (kuval == 0) { 86799ebb4caSwyllys *kubits = 0; 86899ebb4caSwyllys return (KMF_ERR_BAD_PARAMETER); 8697711facfSdinak } 87099ebb4caSwyllys *kubits |= kuval; 87199ebb4caSwyllys k = strtok(NULL, ","); 8727711facfSdinak } 8737711facfSdinak 87499ebb4caSwyllys return (ret); 8757711facfSdinak } 8767711facfSdinak 8777711facfSdinak /* 87899ebb4caSwyllys * Verify the alternate subject label is real or invalid. 87999ebb4caSwyllys * 88099ebb4caSwyllys * The field may be marked "critical" by prepending 88199ebb4caSwyllys * "critical:" to the list. 88299ebb4caSwyllys * EX: "critical:IP=1.2.3.4" 8837711facfSdinak */ 88499ebb4caSwyllys KMF_RETURN 88599ebb4caSwyllys verify_altname(char *arg, KMF_GENERALNAMECHOICES *type, int *critical) 8867711facfSdinak { 88799ebb4caSwyllys char *p; 88899ebb4caSwyllys KMF_RETURN rv = KMF_OK; 8897711facfSdinak 89099ebb4caSwyllys /* Check to see if this is critical */ 89199ebb4caSwyllys if (!strncasecmp(arg, "critical:", strlen("critical:"))) { 89299ebb4caSwyllys *critical = TRUE; 89399ebb4caSwyllys arg += strlen("critical:"); 89499ebb4caSwyllys } else { 89599ebb4caSwyllys *critical = FALSE; 89699ebb4caSwyllys } 8977711facfSdinak 89899ebb4caSwyllys /* Make sure there is an "=" sign */ 89999ebb4caSwyllys p = strchr(arg, '='); 90099ebb4caSwyllys if (p == NULL) 90199ebb4caSwyllys return (KMF_ERR_BAD_PARAMETER); 9027711facfSdinak 90399ebb4caSwyllys p[0] = '\0'; 90499ebb4caSwyllys 90599ebb4caSwyllys if (strcmp(arg, "IP") == 0) 90699ebb4caSwyllys *type = GENNAME_IPADDRESS; 90799ebb4caSwyllys else if (strcmp(arg, "DNS") == 0) 90899ebb4caSwyllys *type = GENNAME_DNSNAME; 90999ebb4caSwyllys else if (strcmp(arg, "EMAIL") == 0) 91099ebb4caSwyllys *type = GENNAME_RFC822NAME; 91199ebb4caSwyllys else if (strcmp(arg, "URI") == 0) 91299ebb4caSwyllys *type = GENNAME_URI; 91399ebb4caSwyllys else if (strcmp(arg, "DN") == 0) 91499ebb4caSwyllys *type = GENNAME_DIRECTORYNAME; 91599ebb4caSwyllys else if (strcmp(arg, "RID") == 0) 91699ebb4caSwyllys *type = GENNAME_REGISTEREDID; 91799ebb4caSwyllys else 91899ebb4caSwyllys rv = KMF_ERR_BAD_PARAMETER; 91999ebb4caSwyllys 92099ebb4caSwyllys p[0] = '='; 92199ebb4caSwyllys 92299ebb4caSwyllys return (rv); 9237c478bd9Sstevel@tonic-gate } 92449e21299Sdinak 92599ebb4caSwyllys int 92699ebb4caSwyllys get_token_password(KMF_KEYSTORE_TYPE kstype, 92799ebb4caSwyllys char *token_spec, KMF_CREDENTIAL *cred) 92849e21299Sdinak { 92999ebb4caSwyllys char prompt[1024]; 93099ebb4caSwyllys char *p = NULL; 93149e21299Sdinak 93299ebb4caSwyllys if (kstype == KMF_KEYSTORE_PK11TOKEN) { 93399ebb4caSwyllys p = strchr(token_spec, ':'); 93499ebb4caSwyllys if (p != NULL) 93599ebb4caSwyllys *p = 0; 93699ebb4caSwyllys } 93749e21299Sdinak /* 93899ebb4caSwyllys * Login to the token first. 93949e21299Sdinak */ 94099ebb4caSwyllys (void) snprintf(prompt, sizeof (prompt), 94199ebb4caSwyllys gettext(DEFAULT_TOKEN_PROMPT), 94299ebb4caSwyllys token_spec); 94349e21299Sdinak 94499ebb4caSwyllys if (get_pin(prompt, NULL, (uchar_t **)&cred->cred, 94599ebb4caSwyllys (ulong_t *)&cred->credlen) != CKR_OK) { 94699ebb4caSwyllys cred->cred = NULL; 94799ebb4caSwyllys cred->credlen = 0; 94849e21299Sdinak } 94949e21299Sdinak 95099ebb4caSwyllys if (kstype == KMF_KEYSTORE_PK11TOKEN && p != NULL) 95199ebb4caSwyllys *p = ':'; 95299ebb4caSwyllys return (KMF_OK); 95349e21299Sdinak } 95449e21299Sdinak 95599ebb4caSwyllys KMF_RETURN 95699ebb4caSwyllys verify_file(char *filename) 95749e21299Sdinak { 95899ebb4caSwyllys KMF_RETURN ret = KMF_OK; 95999ebb4caSwyllys int fd; 96049e21299Sdinak 96199ebb4caSwyllys /* 96299ebb4caSwyllys * Attempt to open with the EXCL flag so that if 96399ebb4caSwyllys * it already exists, the open will fail. It will 96499ebb4caSwyllys * also fail if the file cannot be created due to 96599ebb4caSwyllys * permissions on the parent directory, or if the 96699ebb4caSwyllys * parent directory itself does not exist. 96799ebb4caSwyllys */ 96899ebb4caSwyllys fd = open(filename, O_CREAT | O_EXCL, 0600); 96999ebb4caSwyllys if (fd == -1) 97099ebb4caSwyllys return (KMF_ERR_OPEN_FILE); 97149e21299Sdinak 97299ebb4caSwyllys /* If we were able to create it, delete it. */ 97399ebb4caSwyllys (void) close(fd); 97499ebb4caSwyllys (void) unlink(filename); 97549e21299Sdinak 97699ebb4caSwyllys return (ret); 97799ebb4caSwyllys } 97849e21299Sdinak 97999ebb4caSwyllys void 98099ebb4caSwyllys display_error(void *handle, KMF_RETURN errcode, char *prefix) 98199ebb4caSwyllys { 98299ebb4caSwyllys KMF_RETURN rv1, rv2; 98399ebb4caSwyllys char *plugin_errmsg = NULL; 98499ebb4caSwyllys char *kmf_errmsg = NULL; 98549e21299Sdinak 98699ebb4caSwyllys rv1 = KMF_GetPluginErrorString(handle, &plugin_errmsg); 98799ebb4caSwyllys rv2 = KMF_GetKMFErrorString(errcode, &kmf_errmsg); 98849e21299Sdinak 98999ebb4caSwyllys cryptoerror(LOG_STDERR, "%s:", prefix); 99099ebb4caSwyllys if (rv1 == KMF_OK && plugin_errmsg) { 99199ebb4caSwyllys cryptoerror(LOG_STDERR, 99299ebb4caSwyllys gettext("keystore error: %s"), 99399ebb4caSwyllys plugin_errmsg); 99499ebb4caSwyllys KMF_FreeString(plugin_errmsg); 99599ebb4caSwyllys } 99649e21299Sdinak 99799ebb4caSwyllys if (rv2 == KMF_OK && kmf_errmsg) { 99899ebb4caSwyllys cryptoerror(LOG_STDERR, 99999ebb4caSwyllys gettext("libkmf error: %s"), 100099ebb4caSwyllys kmf_errmsg); 100199ebb4caSwyllys KMF_FreeString(kmf_errmsg); 100249e21299Sdinak } 100349e21299Sdinak 100499ebb4caSwyllys if (rv1 != KMF_OK && rv2 != KMF_OK) 100599ebb4caSwyllys cryptoerror(LOG_STDERR, gettext("<unknown error>\n")); 100699ebb4caSwyllys 100749e21299Sdinak } 1008