17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 599ebb4caSwyllys * Common Development and Distribution License (the "License"). 699ebb4caSwyllys * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 217c478bd9Sstevel@tonic-gate /* 22*d00756ccSwyllys * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 237c478bd9Sstevel@tonic-gate * Use is subject to license terms. 247c478bd9Sstevel@tonic-gate */ 257c478bd9Sstevel@tonic-gate 267c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 277c478bd9Sstevel@tonic-gate 287c478bd9Sstevel@tonic-gate /* 297c478bd9Sstevel@tonic-gate * This file contains the functions that are shared among 307c478bd9Sstevel@tonic-gate * the various services this tool will ultimately provide. 317711facfSdinak * The functions in this file return PKCS#11 CK_RV errors. 327711facfSdinak * Only one session and one login per token is supported 337711facfSdinak * at this time. 347c478bd9Sstevel@tonic-gate */ 357c478bd9Sstevel@tonic-gate 367c478bd9Sstevel@tonic-gate #include <stdio.h> 377c478bd9Sstevel@tonic-gate #include <stdlib.h> 387c478bd9Sstevel@tonic-gate #include <string.h> 397c478bd9Sstevel@tonic-gate #include <ctype.h> 4099ebb4caSwyllys #include <sys/types.h> 4199ebb4caSwyllys #include <sys/stat.h> 4299ebb4caSwyllys #include <fcntl.h> 4399ebb4caSwyllys #include <tzfile.h> 447c478bd9Sstevel@tonic-gate #include <cryptoutil.h> 457c478bd9Sstevel@tonic-gate #include <security/cryptoki.h> 4699ebb4caSwyllys #include <kmfapi.h> 477c478bd9Sstevel@tonic-gate 4899ebb4caSwyllys #include "common.h" 497711facfSdinak 507711facfSdinak /* Local status variables. */ 517711facfSdinak static boolean_t initialized = B_FALSE; 527711facfSdinak static boolean_t session_opened = B_FALSE; 537711facfSdinak static boolean_t logged_in = B_FALSE; 547c478bd9Sstevel@tonic-gate 5549e21299Sdinak /* Supporting structures and global variables for getopt_av(). */ 5649e21299Sdinak typedef struct av_opts_s { 5749e21299Sdinak int shortnm; /* short name character */ 5849e21299Sdinak char *longnm; /* long name string, NOT terminated */ 5949e21299Sdinak int longnm_len; /* length of long name string */ 6049e21299Sdinak boolean_t has_arg; /* takes optional argument */ 6149e21299Sdinak } av_opts; 6249e21299Sdinak static av_opts *opts_av = NULL; 6349e21299Sdinak static const char *_save_optstr = NULL; 6449e21299Sdinak static int _save_numopts = 0; 6549e21299Sdinak 6649e21299Sdinak int optind_av = 1; 6749e21299Sdinak char *optarg_av = NULL; 6849e21299Sdinak 6999ebb4caSwyllys static void close_sess(CK_SESSION_HANDLE); 7099ebb4caSwyllys static void logout_token(CK_SESSION_HANDLE); 7199ebb4caSwyllys 727c478bd9Sstevel@tonic-gate /* 737711facfSdinak * Perform PKCS#11 setup here. Currently only C_Initialize is required, 747711facfSdinak * along with setting/resetting state variables. 757c478bd9Sstevel@tonic-gate */ 767711facfSdinak CK_RV 777711facfSdinak init_pk11(void) 787c478bd9Sstevel@tonic-gate { 797711facfSdinak CK_RV rv = CKR_OK; 807711facfSdinak 817711facfSdinak /* If C_Initialize() already called, nothing to do here. */ 827711facfSdinak if (initialized == B_TRUE) 837711facfSdinak return (CKR_OK); 847c478bd9Sstevel@tonic-gate 857711facfSdinak /* Reset state variables because C_Initialize() not yet done. */ 867711facfSdinak session_opened = B_FALSE; 877711facfSdinak logged_in = B_FALSE; 887c478bd9Sstevel@tonic-gate 897711facfSdinak /* Initialize PKCS#11 library. */ 907711facfSdinak if ((rv = C_Initialize(NULL_PTR)) != CKR_OK && 917711facfSdinak rv != CKR_CRYPTOKI_ALREADY_INITIALIZED) { 927711facfSdinak return (rv); 937711facfSdinak } 947c478bd9Sstevel@tonic-gate 957711facfSdinak initialized = B_TRUE; 967711facfSdinak return (CKR_OK); 977c478bd9Sstevel@tonic-gate } 987c478bd9Sstevel@tonic-gate 997c478bd9Sstevel@tonic-gate /* 1007711facfSdinak * Finalize PKCS#11 library and reset state variables. Open sessions, 1017711facfSdinak * if any, are closed, and thereby any logins are logged out also. 1027c478bd9Sstevel@tonic-gate */ 1037711facfSdinak void 1047711facfSdinak final_pk11(CK_SESSION_HANDLE sess) 1057c478bd9Sstevel@tonic-gate { 1067c478bd9Sstevel@tonic-gate 1077711facfSdinak /* If the library wasn't initialized, nothing to do here. */ 1087711facfSdinak if (!initialized) 1097711facfSdinak return; 1107c478bd9Sstevel@tonic-gate 1117711facfSdinak /* Make sure the sesion is closed first. */ 1127711facfSdinak close_sess(sess); 1137711facfSdinak 1147711facfSdinak (void) C_Finalize(NULL); 1157711facfSdinak initialized = B_FALSE; 1167711facfSdinak } 1177711facfSdinak 1187711facfSdinak /* 1197711facfSdinak * Close PKCS#11 session and reset state variables. Any logins are 1207711facfSdinak * logged out. 1217711facfSdinak */ 12299ebb4caSwyllys static void 1237711facfSdinak close_sess(CK_SESSION_HANDLE sess) 1247711facfSdinak { 1257711facfSdinak 1267711facfSdinak if (sess == NULL) { 1277711facfSdinak return; 1287711facfSdinak } 1297711facfSdinak 1307711facfSdinak /* If session is already closed, nothing to do here. */ 1317711facfSdinak if (!session_opened) 1327711facfSdinak return; 1337711facfSdinak 1347711facfSdinak /* Make sure user is logged out of token. */ 1357711facfSdinak logout_token(sess); 1367711facfSdinak 1377711facfSdinak (void) C_CloseSession(sess); 1387711facfSdinak session_opened = B_FALSE; 1397711facfSdinak } 1407711facfSdinak 1417711facfSdinak /* 1427711facfSdinak * Log user out of token and reset status variable. 1437711facfSdinak */ 14499ebb4caSwyllys static void 1457711facfSdinak logout_token(CK_SESSION_HANDLE sess) 1467711facfSdinak { 1477711facfSdinak 1487711facfSdinak if (sess == NULL) { 1497711facfSdinak return; 1507c478bd9Sstevel@tonic-gate } 1517c478bd9Sstevel@tonic-gate 1527711facfSdinak /* If already logged out, nothing to do here. */ 1537711facfSdinak if (!logged_in) 1547711facfSdinak return; 1557711facfSdinak 1567711facfSdinak (void) C_Logout(sess); 1577711facfSdinak logged_in = B_FALSE; 1587711facfSdinak } 1597711facfSdinak 1607711facfSdinak /* 1617711facfSdinak * Gets PIN from user. Caller needs to free the returned PIN when done. 1627711facfSdinak * If two prompts are given, the PIN is confirmed with second prompt. 1637711facfSdinak * Note that getphassphrase() may return data in static memory area. 1647711facfSdinak */ 1657711facfSdinak CK_RV 1667711facfSdinak get_pin(char *prompt1, char *prompt2, CK_UTF8CHAR_PTR *pin, CK_ULONG *pinlen) 1677711facfSdinak { 168*d00756ccSwyllys char *save_phrase, *phrase1, *phrase2; 1697711facfSdinak 1707711facfSdinak /* Prompt user for a PIN. */ 1717711facfSdinak if (prompt1 == NULL) { 1727711facfSdinak return (CKR_ARGUMENTS_BAD); 1737711facfSdinak } 1747711facfSdinak if ((phrase1 = getpassphrase(prompt1)) == NULL) { 1757711facfSdinak return (CKR_FUNCTION_FAILED); 1767711facfSdinak } 1777711facfSdinak 1787711facfSdinak /* Duplicate 1st PIN in separate chunk of memory. */ 1797711facfSdinak if ((save_phrase = strdup(phrase1)) == NULL) 1807711facfSdinak return (CKR_HOST_MEMORY); 1817711facfSdinak 1827711facfSdinak /* If second prompt given, PIN confirmation is requested. */ 1837711facfSdinak if (prompt2 != NULL) { 1847711facfSdinak if ((phrase2 = getpassphrase(prompt2)) == NULL) { 1857711facfSdinak free(save_phrase); 1867711facfSdinak return (CKR_FUNCTION_FAILED); 1877711facfSdinak } 1887711facfSdinak if (strcmp(save_phrase, phrase2) != 0) { 1897711facfSdinak free(save_phrase); 1907711facfSdinak return (CKR_PIN_INCORRECT); 1917711facfSdinak } 1927711facfSdinak } 1937711facfSdinak 1947711facfSdinak *pin = (CK_UTF8CHAR_PTR)save_phrase; 1957711facfSdinak *pinlen = strlen(save_phrase); 1967711facfSdinak return (CKR_OK); 1977711facfSdinak } 1987711facfSdinak 199*d00756ccSwyllys int 200*d00756ccSwyllys yn_to_int(char *ynstr) 201*d00756ccSwyllys { 202*d00756ccSwyllys char *y = gettext("yes"); 203*d00756ccSwyllys char *n = gettext("no"); 204*d00756ccSwyllys if (ynstr == NULL) 205*d00756ccSwyllys return (-1); 206*d00756ccSwyllys 207*d00756ccSwyllys if (strncasecmp(ynstr, y, 1) == 0) 208*d00756ccSwyllys return (1); 209*d00756ccSwyllys else if (strncasecmp(ynstr, n, 1) == 0) 210*d00756ccSwyllys return (0); 211*d00756ccSwyllys else 212*d00756ccSwyllys return (-1); 213*d00756ccSwyllys } 214*d00756ccSwyllys 2157711facfSdinak /* 2167711facfSdinak * Gets yes/no response from user. If either no prompt is supplied, a 2177711facfSdinak * default prompt is used. If not message for invalid input is supplied, 2187711facfSdinak * a default will not be provided. If the user provides no response, 2197711facfSdinak * the input default B_TRUE == yes, B_FALSE == no is returned. 2207711facfSdinak * Otherwise, B_TRUE is returned for yes, and B_FALSE for no. 2217711facfSdinak */ 2227711facfSdinak boolean_t 2237711facfSdinak yesno(char *prompt, char *invalid, boolean_t dflt) 2247711facfSdinak { 225*d00756ccSwyllys char *response, buf[1024]; 226*d00756ccSwyllys int ans; 2277711facfSdinak 2287711facfSdinak if (prompt == NULL) 2297711facfSdinak prompt = gettext("Enter (y)es or (n)o? "); 2307711facfSdinak 2317711facfSdinak for (;;) { 2327711facfSdinak /* Prompt user. */ 2337711facfSdinak (void) printf("%s", prompt); 2347711facfSdinak (void) fflush(stdout); 2357711facfSdinak 2367711facfSdinak /* Get the response. */ 2377711facfSdinak if ((response = fgets(buf, sizeof (buf), stdin)) == NULL) 2387711facfSdinak break; /* go to default response */ 2397711facfSdinak 2407711facfSdinak /* Skip any leading white space. */ 2417711facfSdinak while (isspace(*response)) 2427711facfSdinak response++; 2437711facfSdinak if (*response == '\0') 2447711facfSdinak break; /* go to default response */ 2457711facfSdinak 246*d00756ccSwyllys ans = yn_to_int(response); 247*d00756ccSwyllys if (ans == 1) 2487711facfSdinak return (B_TRUE); 249*d00756ccSwyllys else if (ans == 0) 2507711facfSdinak return (B_FALSE); 2517711facfSdinak 2527711facfSdinak /* Indicate invalid input, and try again. */ 2537711facfSdinak if (invalid != NULL) 25430a5e8faSwyllys (void) printf("%s", invalid); 2557711facfSdinak } 2567711facfSdinak return (dflt); 2577711facfSdinak } 2587711facfSdinak 2597711facfSdinak /* 2607711facfSdinak * Gets the list of slots which have tokens in them. Keeps adjusting 2617711facfSdinak * the size of the slot list buffer until the call is successful or an 2627711facfSdinak * irrecoverable error occurs. 2637711facfSdinak */ 2647711facfSdinak CK_RV 2657711facfSdinak get_token_slots(CK_SLOT_ID_PTR *slot_list, CK_ULONG *slot_count) 2667711facfSdinak { 2677711facfSdinak CK_ULONG tmp_count = 0; 2687711facfSdinak CK_SLOT_ID_PTR tmp_list = NULL_PTR, tmp2_list = NULL_PTR; 2697711facfSdinak int rv = CKR_OK; 2707711facfSdinak 2717711facfSdinak if (!initialized) 2727711facfSdinak if ((rv = init_pk11()) != CKR_OK) 2737711facfSdinak return (rv); 2747711facfSdinak 2757711facfSdinak /* 2767711facfSdinak * Get the slot count first because we don't know how many 2777711facfSdinak * slots there are and how many of those slots even have tokens. 2787711facfSdinak * Don't specify an arbitrary buffer size for the slot list; 2797711facfSdinak * it may be too small (see section 11.5 of PKCS#11 spec). 2807711facfSdinak * Also select only those slots that have tokens in them, 2817711facfSdinak * because this tool has no need to know about empty slots. 2827711facfSdinak */ 2837711facfSdinak if ((rv = C_GetSlotList(1, NULL_PTR, &tmp_count)) != CKR_OK) 2847711facfSdinak return (rv); 2857711facfSdinak 2867711facfSdinak if (tmp_count == 0) { 2877711facfSdinak *slot_list = NULL_PTR; 2887711facfSdinak *slot_count = 0; 2897711facfSdinak return (CKR_OK); 2907711facfSdinak } 2917711facfSdinak 2927711facfSdinak /* Allocate initial space for the slot list. */ 2937711facfSdinak if ((tmp_list = (CK_SLOT_ID_PTR) malloc(tmp_count * 2947711facfSdinak sizeof (CK_SLOT_ID))) == NULL) 2957711facfSdinak return (CKR_HOST_MEMORY); 2967711facfSdinak 2977711facfSdinak /* Then get the slot list itself. */ 2987711facfSdinak for (;;) { 2997711facfSdinak if ((rv = C_GetSlotList(1, tmp_list, &tmp_count)) == CKR_OK) { 3007711facfSdinak *slot_list = tmp_list; 3017711facfSdinak *slot_count = tmp_count; 3027711facfSdinak break; 3037711facfSdinak } 3047711facfSdinak 3057711facfSdinak if (rv != CKR_BUFFER_TOO_SMALL) { 3067711facfSdinak free(tmp_list); 3077711facfSdinak break; 3087711facfSdinak } 3097711facfSdinak 3107711facfSdinak /* If the number of slots grew, try again. */ 3117711facfSdinak if ((tmp2_list = (CK_SLOT_ID_PTR) realloc(tmp_list, 3127711facfSdinak tmp_count * sizeof (CK_SLOT_ID))) == NULL) { 3137711facfSdinak free(tmp_list); 3147711facfSdinak rv = CKR_HOST_MEMORY; 3157711facfSdinak break; 3167711facfSdinak } 3177711facfSdinak tmp_list = tmp2_list; 3187711facfSdinak } 3197711facfSdinak 3207711facfSdinak return (rv); 3217c478bd9Sstevel@tonic-gate } 3227c478bd9Sstevel@tonic-gate 3237c478bd9Sstevel@tonic-gate /* 32499ebb4caSwyllys * Breaks out the getopt-style option string into a structure that can be 32599ebb4caSwyllys * traversed later for calls to getopt_av(). Option string is NOT altered, 32699ebb4caSwyllys * but the struct fields point to locations within option string. 3277c478bd9Sstevel@tonic-gate */ 3287c478bd9Sstevel@tonic-gate static int 32999ebb4caSwyllys populate_opts(char *optstring) 3307c478bd9Sstevel@tonic-gate { 33199ebb4caSwyllys int i; 33299ebb4caSwyllys av_opts *temp; 3337c478bd9Sstevel@tonic-gate char *marker; 3347c478bd9Sstevel@tonic-gate 33599ebb4caSwyllys if (optstring == NULL || *optstring == '\0') 33699ebb4caSwyllys return (0); 33799ebb4caSwyllys 33899ebb4caSwyllys /* 33999ebb4caSwyllys * This tries to imitate getopt(3c) Each option must conform to: 34099ebb4caSwyllys * <short name char> [ ':' ] [ '(' <long name string> ')' ] 34199ebb4caSwyllys * If long name is missing, the short name is used for long name. 34299ebb4caSwyllys */ 34399ebb4caSwyllys for (i = 0; *optstring != '\0'; i++) { 34499ebb4caSwyllys if ((temp = (av_opts *)((i == 0) ? malloc(sizeof (av_opts)) : 34599ebb4caSwyllys realloc(opts_av, (i+1) * sizeof (av_opts)))) == NULL) { 34699ebb4caSwyllys if (opts_av != NULL) 34799ebb4caSwyllys free(opts_av); 34899ebb4caSwyllys opts_av = NULL; 34999ebb4caSwyllys return (0); 35099ebb4caSwyllys } else { 35199ebb4caSwyllys opts_av = (av_opts *)temp; 35299ebb4caSwyllys } 3537c478bd9Sstevel@tonic-gate 35499ebb4caSwyllys (void) memset(&opts_av[i], 0, sizeof (av_opts)); 35599ebb4caSwyllys marker = optstring; /* may need optstring later */ 3567c478bd9Sstevel@tonic-gate 35799ebb4caSwyllys opts_av[i].shortnm = *marker++; /* set short name */ 35899ebb4caSwyllys 35999ebb4caSwyllys if (*marker == ':') { /* check for opt arg */ 36099ebb4caSwyllys marker++; 36199ebb4caSwyllys opts_av[i].has_arg = B_TRUE; 36299ebb4caSwyllys } 36399ebb4caSwyllys 36499ebb4caSwyllys if (*marker == '(') { /* check and set long name */ 36599ebb4caSwyllys marker++; 36699ebb4caSwyllys opts_av[i].longnm = marker; 36799ebb4caSwyllys opts_av[i].longnm_len = strcspn(marker, ")"); 36899ebb4caSwyllys optstring = marker + opts_av[i].longnm_len + 1; 36999ebb4caSwyllys } else { 37099ebb4caSwyllys /* use short name option character */ 37199ebb4caSwyllys opts_av[i].longnm = optstring; 37299ebb4caSwyllys opts_av[i].longnm_len = 1; 37399ebb4caSwyllys optstring = marker; 37499ebb4caSwyllys } 37599ebb4caSwyllys } 37699ebb4caSwyllys 37799ebb4caSwyllys return (i); 3787c478bd9Sstevel@tonic-gate } 3797c478bd9Sstevel@tonic-gate 3807c478bd9Sstevel@tonic-gate /* 38199ebb4caSwyllys * getopt_av() is very similar to getopt(3c) in that the takes an option 38299ebb4caSwyllys * string, compares command line arguments for matches, and returns a single 38399ebb4caSwyllys * letter option when a match is found. However, getopt_av() differs from 38499ebb4caSwyllys * getopt(3c) by requiring that only longname options and values be found 38599ebb4caSwyllys * on the command line and all leading dashes are omitted. In other words, 38699ebb4caSwyllys * it tries to enforce only longname "option=value" arguments on the command 38799ebb4caSwyllys * line. Boolean options are not allowed either. 3887c478bd9Sstevel@tonic-gate */ 38999ebb4caSwyllys int 39099ebb4caSwyllys getopt_av(int argc, char * const *argv, const char *optstring) 3917c478bd9Sstevel@tonic-gate { 39299ebb4caSwyllys int i; 39399ebb4caSwyllys int len; 39499ebb4caSwyllys char *cur_option; 3957c478bd9Sstevel@tonic-gate 39699ebb4caSwyllys if (optind_av >= argc) 39799ebb4caSwyllys return (EOF); 3987c478bd9Sstevel@tonic-gate 39999ebb4caSwyllys /* First time or when optstring changes from previous one */ 40099ebb4caSwyllys if (_save_optstr != optstring) { 40199ebb4caSwyllys if (opts_av != NULL) 40230a5e8faSwyllys free(opts_av); 40399ebb4caSwyllys opts_av = NULL; 40499ebb4caSwyllys _save_optstr = optstring; 40599ebb4caSwyllys _save_numopts = populate_opts((char *)optstring); 40699ebb4caSwyllys } 4077c478bd9Sstevel@tonic-gate 40899ebb4caSwyllys for (i = 0; i < _save_numopts; i++) { 40999ebb4caSwyllys cur_option = argv[optind_av]; 4107c478bd9Sstevel@tonic-gate 41199ebb4caSwyllys if (strcmp(cur_option, "--") == 0) { 41299ebb4caSwyllys optind_av++; 41399ebb4caSwyllys break; 4147c478bd9Sstevel@tonic-gate } 4157c478bd9Sstevel@tonic-gate 41699ebb4caSwyllys if (cur_option[0] == '-' && strlen(cur_option) == 2) { 41799ebb4caSwyllys len = 1; 41899ebb4caSwyllys cur_option++; /* remove "-" */ 41999ebb4caSwyllys } else { 42099ebb4caSwyllys len = strcspn(cur_option, "="); 42199ebb4caSwyllys } 4227c478bd9Sstevel@tonic-gate 42399ebb4caSwyllys if (len == opts_av[i].longnm_len && strncmp(cur_option, 42499ebb4caSwyllys opts_av[i].longnm, opts_av[i].longnm_len) == 0) { 42599ebb4caSwyllys /* matched */ 42699ebb4caSwyllys if (!opts_av[i].has_arg) { 42799ebb4caSwyllys optind_av++; 42899ebb4caSwyllys return (opts_av[i].shortnm); 42999ebb4caSwyllys } 43099ebb4caSwyllys 43199ebb4caSwyllys /* needs optarg */ 43299ebb4caSwyllys if (cur_option[len] == '=') { 43399ebb4caSwyllys optarg_av = &(cur_option[len+1]); 43499ebb4caSwyllys optind_av++; 43599ebb4caSwyllys return (opts_av[i].shortnm); 43699ebb4caSwyllys } 43799ebb4caSwyllys 43899ebb4caSwyllys optarg_av = NULL; 43999ebb4caSwyllys optind_av++; 44099ebb4caSwyllys return ((int)'?'); 44199ebb4caSwyllys } 4427c478bd9Sstevel@tonic-gate } 4437c478bd9Sstevel@tonic-gate 44499ebb4caSwyllys return (EOF); 4457c478bd9Sstevel@tonic-gate } 4467c478bd9Sstevel@tonic-gate 44799ebb4caSwyllys KMF_KEYSTORE_TYPE 44899ebb4caSwyllys KS2Int(char *keystore_str) 44949e21299Sdinak { 45099ebb4caSwyllys if (keystore_str == NULL) 45199ebb4caSwyllys return (0); 452*d00756ccSwyllys if (strcasecmp(keystore_str, "pkcs11") == 0) 45399ebb4caSwyllys return (KMF_KEYSTORE_PK11TOKEN); 454*d00756ccSwyllys else if (strcasecmp(keystore_str, "nss") == 0) 45599ebb4caSwyllys return (KMF_KEYSTORE_NSS); 456*d00756ccSwyllys else if (strcasecmp(keystore_str, "file") == 0) 45799ebb4caSwyllys return (KMF_KEYSTORE_OPENSSL); 45899ebb4caSwyllys else 45999ebb4caSwyllys return (0); 46099ebb4caSwyllys } 46149e21299Sdinak 46249e21299Sdinak 46399ebb4caSwyllys int 46499ebb4caSwyllys Str2KeyType(char *algm, KMF_KEY_ALG *ktype, KMF_ALGORITHM_INDEX *sigAlg) 46599ebb4caSwyllys { 46699ebb4caSwyllys if (algm == NULL) { 46799ebb4caSwyllys *sigAlg = KMF_ALGID_MD5WithRSA; 46899ebb4caSwyllys *ktype = KMF_RSA; 46999ebb4caSwyllys } else if (strcasecmp(algm, "DSA") == 0) { 47099ebb4caSwyllys *sigAlg = KMF_ALGID_SHA1WithDSA; 47199ebb4caSwyllys *ktype = KMF_DSA; 47299ebb4caSwyllys } else if (strcasecmp(algm, "RSA") == 0) { 47399ebb4caSwyllys *sigAlg = KMF_ALGID_MD5WithRSA; 47499ebb4caSwyllys *ktype = KMF_RSA; 47599ebb4caSwyllys } else { 47699ebb4caSwyllys return (-1); 47749e21299Sdinak } 47899ebb4caSwyllys return (0); 47949e21299Sdinak } 48049e21299Sdinak 48199ebb4caSwyllys int 48299ebb4caSwyllys Str2SymKeyType(char *algm, KMF_KEY_ALG *ktype) 48349e21299Sdinak { 48499ebb4caSwyllys if (algm == NULL) 48599ebb4caSwyllys *ktype = KMF_AES; 48699ebb4caSwyllys else if (strcasecmp(algm, "aes") == 0) 48799ebb4caSwyllys *ktype = KMF_AES; 48899ebb4caSwyllys else if (strcasecmp(algm, "arcfour") == 0) 48999ebb4caSwyllys *ktype = KMF_RC4; 49099ebb4caSwyllys else if (strcasecmp(algm, "des") == 0) 49199ebb4caSwyllys *ktype = KMF_DES; 49299ebb4caSwyllys else if (strcasecmp(algm, "3des") == 0) 49399ebb4caSwyllys *ktype = KMF_DES3; 494c197cb9dShylee else if (strcasecmp(algm, "generic") == 0) 495c197cb9dShylee *ktype = KMF_GENERIC_SECRET; 49699ebb4caSwyllys else 49799ebb4caSwyllys return (-1); 49849e21299Sdinak 49999ebb4caSwyllys return (0); 50049e21299Sdinak } 50149e21299Sdinak 50249e21299Sdinak int 50399ebb4caSwyllys Str2Lifetime(char *ltimestr, uint32_t *ltime) 50449e21299Sdinak { 50599ebb4caSwyllys int num; 50699ebb4caSwyllys char timetok[6]; 50749e21299Sdinak 508*d00756ccSwyllys if (ltimestr == NULL || strlen(ltimestr) == 0) { 50999ebb4caSwyllys /* default to 1 year lifetime */ 51099ebb4caSwyllys *ltime = SECSPERDAY * DAYSPERNYEAR; 51199ebb4caSwyllys return (0); 51249e21299Sdinak } 51349e21299Sdinak 51499ebb4caSwyllys (void) memset(timetok, 0, sizeof (timetok)); 51599ebb4caSwyllys if (sscanf(ltimestr, "%d-%06s", &num, timetok) != 2) 51699ebb4caSwyllys return (-1); 51749e21299Sdinak 518*d00756ccSwyllys if (strcasecmp(timetok, "day") == 0|| 519*d00756ccSwyllys strcasecmp(timetok, "days") == 0) { 52099ebb4caSwyllys *ltime = num * SECSPERDAY; 521*d00756ccSwyllys } else if (strcasecmp(timetok, "hour") == 0|| 522*d00756ccSwyllys strcasecmp(timetok, "hours") == 0) { 52399ebb4caSwyllys *ltime = num * SECSPERHOUR; 524*d00756ccSwyllys } else if (strcasecmp(timetok, "year") == 0 || 525*d00756ccSwyllys strcasecmp(timetok, "years") == 0) { 52699ebb4caSwyllys *ltime = num * SECSPERDAY * DAYSPERNYEAR; 52799ebb4caSwyllys } else { 52899ebb4caSwyllys *ltime = 0; 52949e21299Sdinak return (-1); 53049e21299Sdinak } 53149e21299Sdinak 53299ebb4caSwyllys return (0); 53399ebb4caSwyllys } 53449e21299Sdinak 53599ebb4caSwyllys int 53699ebb4caSwyllys OT2Int(char *objclass) 53799ebb4caSwyllys { 53899ebb4caSwyllys char *c = NULL; 53999ebb4caSwyllys int retval = 0; 54049e21299Sdinak 54199ebb4caSwyllys if (objclass == NULL) 54299ebb4caSwyllys return (-1); 54349e21299Sdinak 54499ebb4caSwyllys c = strchr(objclass, ':'); 54599ebb4caSwyllys if (c != NULL) { 546*d00756ccSwyllys if (strcasecmp(c, ":private") == 0) 54799ebb4caSwyllys retval = PK_PRIVATE_OBJ; 548*d00756ccSwyllys else if (strcasecmp(c, ":public") == 0) 54999ebb4caSwyllys retval = PK_PUBLIC_OBJ; 550*d00756ccSwyllys else if (strcasecmp(c, ":both") == 0) 55199ebb4caSwyllys retval = PK_PRIVATE_OBJ | PK_PUBLIC_OBJ; 55299ebb4caSwyllys else /* unrecognized option */ 55399ebb4caSwyllys return (-1); 55499ebb4caSwyllys 55599ebb4caSwyllys *c = '\0'; 55699ebb4caSwyllys } 55799ebb4caSwyllys 558*d00756ccSwyllys if (strcasecmp(objclass, "public") == 0) { 55999ebb4caSwyllys if (retval) 56099ebb4caSwyllys return (-1); 56130a5e8faSwyllys return (retval | PK_PUBLIC_OBJ | PK_CERT_OBJ | PK_PUBKEY_OBJ); 562*d00756ccSwyllys } else if (strcasecmp(objclass, "private") == 0) { 56399ebb4caSwyllys if (retval) 56499ebb4caSwyllys return (-1); 56599ebb4caSwyllys return (retval | PK_PRIKEY_OBJ | PK_PRIVATE_OBJ); 566*d00756ccSwyllys } else if (strcasecmp(objclass, "both") == 0) { 56799ebb4caSwyllys if (retval) 56899ebb4caSwyllys return (-1); 56999ebb4caSwyllys return (PK_KEY_OBJ | PK_PUBLIC_OBJ | PK_PRIVATE_OBJ); 570*d00756ccSwyllys } else if (strcasecmp(objclass, "cert") == 0) { 57199ebb4caSwyllys return (retval | PK_CERT_OBJ); 572*d00756ccSwyllys } else if (strcasecmp(objclass, "key") == 0) { 57399ebb4caSwyllys if (retval == 0) /* return all keys */ 57499ebb4caSwyllys return (retval | PK_KEY_OBJ); 57599ebb4caSwyllys else if (retval == (PK_PRIVATE_OBJ | PK_PUBLIC_OBJ)) 57699ebb4caSwyllys /* return all keys */ 57799ebb4caSwyllys return (retval | PK_KEY_OBJ); 57899ebb4caSwyllys else if (retval & PK_PUBLIC_OBJ) 57999ebb4caSwyllys /* Only return public keys */ 58099ebb4caSwyllys return (retval | PK_PUBKEY_OBJ); 58199ebb4caSwyllys else if (retval & PK_PRIVATE_OBJ) 58299ebb4caSwyllys /* Only return private keys */ 58399ebb4caSwyllys return (retval | PK_PRIKEY_OBJ); 584*d00756ccSwyllys } else if (strcasecmp(objclass, "crl") == 0) { 58599ebb4caSwyllys if (retval) 58699ebb4caSwyllys return (-1); 58799ebb4caSwyllys return (retval | PK_CRL_OBJ); 58899ebb4caSwyllys } 58999ebb4caSwyllys 59099ebb4caSwyllys if (retval == 0) /* No matches found */ 59199ebb4caSwyllys retval = -1; 59299ebb4caSwyllys return (retval); 59349e21299Sdinak } 59449e21299Sdinak 59599ebb4caSwyllys KMF_ENCODE_FORMAT 59699ebb4caSwyllys Str2Format(char *formstr) 5977c478bd9Sstevel@tonic-gate { 598*d00756ccSwyllys if (formstr == NULL || strcasecmp(formstr, "der") == 0) 59999ebb4caSwyllys return (KMF_FORMAT_ASN1); 600*d00756ccSwyllys if (strcasecmp(formstr, "pem") == 0) 60199ebb4caSwyllys return (KMF_FORMAT_PEM); 602*d00756ccSwyllys if (strcasecmp(formstr, "pkcs12") == 0) 60399ebb4caSwyllys return (KMF_FORMAT_PKCS12); 604*d00756ccSwyllys if (strcasecmp(formstr, "raw") == 0) 60530a5e8faSwyllys return (KMF_FORMAT_RAWKEY); 60699ebb4caSwyllys 60799ebb4caSwyllys return (KMF_FORMAT_UNDEF); 60899ebb4caSwyllys } 6097c478bd9Sstevel@tonic-gate 61099ebb4caSwyllys KMF_RETURN 611*d00756ccSwyllys select_token(void *kmfhandle, char *token, int readonly) 61299ebb4caSwyllys { 61330a5e8faSwyllys KMF_ATTRIBUTE attlist[10]; 61430a5e8faSwyllys int i = 0; 61530a5e8faSwyllys KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_PK11TOKEN; 61699ebb4caSwyllys KMF_RETURN rv = KMF_OK; 6177711facfSdinak 61899ebb4caSwyllys if (token == NULL) 61999ebb4caSwyllys return (KMF_ERR_BAD_PARAMETER); 6207c478bd9Sstevel@tonic-gate 62130a5e8faSwyllys kmf_set_attr_at_index(attlist, i, 62230a5e8faSwyllys KMF_KEYSTORE_TYPE_ATTR, &kstype, 62330a5e8faSwyllys sizeof (kstype)); 62430a5e8faSwyllys i++; 6257711facfSdinak 62630a5e8faSwyllys if (token) { 62730a5e8faSwyllys kmf_set_attr_at_index(attlist, i, 62830a5e8faSwyllys KMF_TOKEN_LABEL_ATTR, token, 62930a5e8faSwyllys strlen(token)); 63030a5e8faSwyllys i++; 63130a5e8faSwyllys } 63230a5e8faSwyllys 63330a5e8faSwyllys kmf_set_attr_at_index(attlist, i, 63430a5e8faSwyllys KMF_READONLY_ATTR, &readonly, 63530a5e8faSwyllys sizeof (readonly)); 63630a5e8faSwyllys i++; 63730a5e8faSwyllys 63830a5e8faSwyllys rv = kmf_configure_keystore(kmfhandle, i, attlist); 63999ebb4caSwyllys if (rv == KMF_ERR_TOKEN_SELECTED) 64099ebb4caSwyllys rv = KMF_OK; 64199ebb4caSwyllys return (rv); 6427711facfSdinak } 6437711facfSdinak 64499ebb4caSwyllys KMF_RETURN 64599ebb4caSwyllys configure_nss(void *kmfhandle, char *dir, char *prefix) 6467711facfSdinak { 64730a5e8faSwyllys KMF_ATTRIBUTE attlist[10]; 64830a5e8faSwyllys int i = 0; 64930a5e8faSwyllys KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_NSS; 65099ebb4caSwyllys KMF_RETURN rv = KMF_OK; 6517711facfSdinak 65230a5e8faSwyllys kmf_set_attr_at_index(attlist, i, 65330a5e8faSwyllys KMF_KEYSTORE_TYPE_ATTR, &kstype, 65430a5e8faSwyllys sizeof (kstype)); 65530a5e8faSwyllys i++; 65630a5e8faSwyllys 65730a5e8faSwyllys if (dir) { 65830a5e8faSwyllys kmf_set_attr_at_index(attlist, i, 65930a5e8faSwyllys KMF_DIRPATH_ATTR, dir, 66030a5e8faSwyllys strlen(dir)); 66130a5e8faSwyllys i++; 66230a5e8faSwyllys } 66330a5e8faSwyllys 66430a5e8faSwyllys if (prefix) { 66530a5e8faSwyllys kmf_set_attr_at_index(attlist, i, 66630a5e8faSwyllys KMF_CERTPREFIX_ATTR, prefix, 66730a5e8faSwyllys strlen(prefix)); 66830a5e8faSwyllys i++; 66930a5e8faSwyllys 67030a5e8faSwyllys kmf_set_attr_at_index(attlist, i, 67130a5e8faSwyllys KMF_KEYPREFIX_ATTR, prefix, 67230a5e8faSwyllys strlen(prefix)); 67330a5e8faSwyllys i++; 67430a5e8faSwyllys } 6757711facfSdinak 67630a5e8faSwyllys rv = kmf_configure_keystore(kmfhandle, i, attlist); 67799ebb4caSwyllys if (rv == KMF_KEYSTORE_ALREADY_INITIALIZED) 67899ebb4caSwyllys rv = KMF_OK; 6797c478bd9Sstevel@tonic-gate 68099ebb4caSwyllys return (rv); 68199ebb4caSwyllys } 6827711facfSdinak 68399ebb4caSwyllys KMF_RETURN 68499ebb4caSwyllys get_pk12_password(KMF_CREDENTIAL *cred) 68599ebb4caSwyllys { 68699ebb4caSwyllys KMF_RETURN rv = KMF_OK; 68799ebb4caSwyllys char prompt[1024]; 6887711facfSdinak 6897711facfSdinak /* 69099ebb4caSwyllys * Get the password to use for the PK12 encryption. 6917711facfSdinak */ 69299ebb4caSwyllys (void) strlcpy(prompt, 69330a5e8faSwyllys gettext("Enter password to use for " 69430a5e8faSwyllys "accessing the PKCS12 file: "), sizeof (prompt)); 6957711facfSdinak 69699ebb4caSwyllys if (get_pin(prompt, NULL, (uchar_t **)&cred->cred, 69730a5e8faSwyllys (ulong_t *)&cred->credlen) != CKR_OK) { 69899ebb4caSwyllys cred->cred = NULL; 69999ebb4caSwyllys cred->credlen = 0; 7007711facfSdinak } 7017711facfSdinak 7027711facfSdinak return (rv); 7037711facfSdinak } 7047711facfSdinak 7052cbed729Swyllys #define FILENAME_PROMPT gettext("Filename:") 7062cbed729Swyllys #define FILENAME_MINLEN 1 7072cbed729Swyllys #define FILENAME_MAXLEN MAXPATHLEN 7082cbed729Swyllys 7092cbed729Swyllys #define COUNTRY_PROMPT gettext("Country Name (2 letter code) [US]:") 7102cbed729Swyllys #define STATE_PROMPT gettext("State or Province Name (full name) " \ 7112cbed729Swyllys "[Some-State]:") 7122cbed729Swyllys #define LOCALITY_PROMPT gettext("Locality Name (eg, city) []:") 7132cbed729Swyllys #define ORG_PROMPT gettext("Organization Name (eg, company) []:") 7142cbed729Swyllys #define UNIT_PROMPT gettext("Organizational Unit Name (eg, section) []:") 7152cbed729Swyllys #define NAME_PROMPT gettext("Common Name (eg, YOUR name) []:") 7162cbed729Swyllys #define EMAIL_PROMPT gettext("Email Address []:") 7172cbed729Swyllys 7182cbed729Swyllys #define SERNO_PROMPT gettext("Serial Number (hex value, example: " \ 7192cbed729Swyllys "0x01020304):") 7202cbed729Swyllys #define SERNO_MINLEN 3 7212cbed729Swyllys #define SERNO_MAXLEN 42 7222cbed729Swyllys 7232cbed729Swyllys #define LABEL_PROMPT gettext("Enter a label for the certificate:") 7242cbed729Swyllys #define LABEL_MINLEN 1 7252cbed729Swyllys #define LABEL_MAXLEN 1024 7267711facfSdinak 72799ebb4caSwyllys #define COUNTRY_DEFAULT "US" 7282cbed729Swyllys #define STATE_DEFAULT NULL 7292cbed729Swyllys #define INVALID_INPUT gettext("Invalid input; please re-enter ...") 7307711facfSdinak 73199ebb4caSwyllys #define SUBNAMESIZ 1024 73299ebb4caSwyllys #define RDN_MIN 1 73399ebb4caSwyllys #define RDN_MAX 64 73499ebb4caSwyllys #define COUNTRYNAME_MIN 2 73599ebb4caSwyllys #define COUNTRYNAME_MAX 2 7367711facfSdinak 73799ebb4caSwyllys static char * 73899ebb4caSwyllys get_input_string(char *prompt, char *default_str, int min_len, int max_len) 73999ebb4caSwyllys { 74099ebb4caSwyllys char buf[1024]; 74199ebb4caSwyllys char *response = NULL; 74299ebb4caSwyllys char *ret = NULL; 74399ebb4caSwyllys int len; 7447711facfSdinak 74599ebb4caSwyllys for (;;) { 74699ebb4caSwyllys (void) printf("\t%s", prompt); 74799ebb4caSwyllys (void) fflush(stdout); 74899ebb4caSwyllys 74999ebb4caSwyllys response = fgets(buf, sizeof (buf), stdin); 75099ebb4caSwyllys if (response == NULL) { 75199ebb4caSwyllys if (default_str != NULL) { 75299ebb4caSwyllys ret = strdup(default_str); 75399ebb4caSwyllys } 75499ebb4caSwyllys break; 75599ebb4caSwyllys } 75699ebb4caSwyllys 75799ebb4caSwyllys /* Skip any leading white space. */ 75899ebb4caSwyllys while (isspace(*response)) 75999ebb4caSwyllys response++; 76099ebb4caSwyllys if (*response == '\0') { 76199ebb4caSwyllys if (default_str != NULL) { 76299ebb4caSwyllys ret = strdup(default_str); 76399ebb4caSwyllys } 76499ebb4caSwyllys break; 76599ebb4caSwyllys } 76699ebb4caSwyllys 76799ebb4caSwyllys len = strlen(response); 76899ebb4caSwyllys response[len-1] = '\0'; /* get rid of "LF" */ 76999ebb4caSwyllys len--; 77099ebb4caSwyllys if (len >= min_len && len <= max_len) { 77199ebb4caSwyllys ret = strdup(response); 77299ebb4caSwyllys break; 7737711facfSdinak } 7747711facfSdinak 77599ebb4caSwyllys (void) printf("%s\n", INVALID_INPUT); 77699ebb4caSwyllys 7777711facfSdinak } 7787711facfSdinak 77999ebb4caSwyllys return (ret); 78099ebb4caSwyllys } 7817711facfSdinak 7822cbed729Swyllys int 7832cbed729Swyllys get_filename(char *txt, char **result) 7842cbed729Swyllys { 7852cbed729Swyllys char prompt[1024]; 7862cbed729Swyllys char *fname = NULL; 7872cbed729Swyllys 7882cbed729Swyllys (void) snprintf(prompt, sizeof (prompt), 7892cbed729Swyllys gettext("Enter filename for the %s: "), 7902cbed729Swyllys txt); 7912cbed729Swyllys fname = get_input_string(prompt, NULL, 7922cbed729Swyllys FILENAME_MINLEN, FILENAME_MAXLEN); 7932cbed729Swyllys *result = fname; 7942cbed729Swyllys return (0); 7952cbed729Swyllys } 7962cbed729Swyllys 7972cbed729Swyllys int 7982cbed729Swyllys get_certlabel(char **result) 7992cbed729Swyllys { 8002cbed729Swyllys char *label = NULL; 8012cbed729Swyllys 8022cbed729Swyllys label = get_input_string(LABEL_PROMPT, NULL, 8032cbed729Swyllys LABEL_MINLEN, LABEL_MAXLEN); 8042cbed729Swyllys *result = label; 8052cbed729Swyllys return (0); 8062cbed729Swyllys } 8072cbed729Swyllys 8082cbed729Swyllys int 8092cbed729Swyllys get_serial(char **result) 8102cbed729Swyllys { 8112cbed729Swyllys char *serial = NULL; 8122cbed729Swyllys 8132cbed729Swyllys serial = get_input_string(SERNO_PROMPT, NULL, SERNO_MINLEN, 8142cbed729Swyllys SERNO_MAXLEN); 8152cbed729Swyllys 8162cbed729Swyllys *result = serial; 8172cbed729Swyllys return (0); 8182cbed729Swyllys } 8192cbed729Swyllys 82099ebb4caSwyllys int 82199ebb4caSwyllys get_subname(char **result) 82299ebb4caSwyllys { 82399ebb4caSwyllys char *country = NULL; 82499ebb4caSwyllys char *state = NULL; 82599ebb4caSwyllys char *locality = NULL; 82699ebb4caSwyllys char *org = NULL; 82799ebb4caSwyllys char *unit = NULL; 82899ebb4caSwyllys char *name = NULL; 82999ebb4caSwyllys char *email = NULL; 83099ebb4caSwyllys char *subname = NULL; 83199ebb4caSwyllys 83299ebb4caSwyllys (void) printf("Entering following fields for subject (a DN) ...\n"); 83399ebb4caSwyllys country = get_input_string(COUNTRY_PROMPT, COUNTRY_DEFAULT, 83499ebb4caSwyllys COUNTRYNAME_MIN, COUNTRYNAME_MAX); 83599ebb4caSwyllys if (country == NULL) 83699ebb4caSwyllys return (-1); 83799ebb4caSwyllys 83899ebb4caSwyllys state = get_input_string(STATE_PROMPT, STATE_DEFAULT, 83999ebb4caSwyllys RDN_MIN, RDN_MAX); 8407711facfSdinak 84199ebb4caSwyllys locality = get_input_string(LOCALITY_PROMPT, NULL, RDN_MIN, RDN_MAX); 84299ebb4caSwyllys org = get_input_string(ORG_PROMPT, NULL, RDN_MIN, RDN_MAX); 84399ebb4caSwyllys unit = get_input_string(UNIT_PROMPT, NULL, RDN_MIN, RDN_MAX); 84499ebb4caSwyllys name = get_input_string(NAME_PROMPT, NULL, RDN_MIN, RDN_MAX); 84599ebb4caSwyllys email = get_input_string(EMAIL_PROMPT, NULL, RDN_MIN, RDN_MAX); 8467711facfSdinak 84799ebb4caSwyllys /* Now create a subject name from the input strings */ 84899ebb4caSwyllys if ((subname = malloc(SUBNAMESIZ)) == NULL) 84999ebb4caSwyllys goto out; 85099ebb4caSwyllys 85199ebb4caSwyllys (void) memset(subname, 0, SUBNAMESIZ); 85299ebb4caSwyllys (void) strlcpy(subname, "C=", SUBNAMESIZ); 85399ebb4caSwyllys (void) strlcat(subname, country, SUBNAMESIZ); 8542cbed729Swyllys if (state != NULL) { 8552cbed729Swyllys (void) strlcat(subname, ", ST=", SUBNAMESIZ); 8562cbed729Swyllys (void) strlcat(subname, state, SUBNAMESIZ); 8572cbed729Swyllys } 8587711facfSdinak 8592cbed729Swyllys if (locality != NULL) { 8602cbed729Swyllys (void) strlcat(subname, ", L=", SUBNAMESIZ); 86199ebb4caSwyllys (void) strlcat(subname, locality, SUBNAMESIZ); 8627711facfSdinak } 8637711facfSdinak 8642cbed729Swyllys if (org != NULL) { 8652cbed729Swyllys (void) strlcat(subname, ", O=", SUBNAMESIZ); 86699ebb4caSwyllys (void) strlcat(subname, org, SUBNAMESIZ); 8677711facfSdinak } 8687711facfSdinak 8692cbed729Swyllys if (unit != NULL) { 8702cbed729Swyllys (void) strlcat(subname, ", OU=", SUBNAMESIZ); 87199ebb4caSwyllys (void) strlcat(subname, unit, SUBNAMESIZ); 87299ebb4caSwyllys } 8737711facfSdinak 8742cbed729Swyllys if (name != NULL) { 8752cbed729Swyllys (void) strlcat(subname, ", CN=", SUBNAMESIZ); 87699ebb4caSwyllys (void) strlcat(subname, name, SUBNAMESIZ); 8777711facfSdinak } 8787711facfSdinak 8792cbed729Swyllys if (email != NULL) { 8802cbed729Swyllys (void) strlcat(subname, ", E=", SUBNAMESIZ); 88199ebb4caSwyllys (void) strlcat(subname, email, SUBNAMESIZ); 8827c478bd9Sstevel@tonic-gate } 8837c478bd9Sstevel@tonic-gate 88499ebb4caSwyllys out: 88599ebb4caSwyllys if (country) 88699ebb4caSwyllys free(country); 88799ebb4caSwyllys if (state) 88899ebb4caSwyllys free(state); 88999ebb4caSwyllys if (locality) 89099ebb4caSwyllys free(locality); 89199ebb4caSwyllys if (org) 89299ebb4caSwyllys free(org); 89399ebb4caSwyllys if (unit) 89499ebb4caSwyllys free(unit); 89599ebb4caSwyllys if (name) 89699ebb4caSwyllys free(name); 89799ebb4caSwyllys if (email) 89899ebb4caSwyllys free(email); 89999ebb4caSwyllys 90099ebb4caSwyllys if (subname == NULL) 90199ebb4caSwyllys return (-1); 90299ebb4caSwyllys else { 90399ebb4caSwyllys *result = subname; 90499ebb4caSwyllys return (0); 9057711facfSdinak } 9067c478bd9Sstevel@tonic-gate } 9077c478bd9Sstevel@tonic-gate 9087c478bd9Sstevel@tonic-gate /* 90999ebb4caSwyllys * Parse a string of KeyUsage values and convert 91099ebb4caSwyllys * them to the correct KU Bits. 91199ebb4caSwyllys * The field may be marked "critical" by prepending 91299ebb4caSwyllys * "critical:" to the list. 91399ebb4caSwyllys * EX: critical:digitialSignature,keyEncipherment 9147c478bd9Sstevel@tonic-gate */ 91599ebb4caSwyllys KMF_RETURN 91699ebb4caSwyllys verify_keyusage(char *kustr, uint16_t *kubits, int *critical) 9177c478bd9Sstevel@tonic-gate { 91899ebb4caSwyllys KMF_RETURN ret = KMF_OK; 91999ebb4caSwyllys uint16_t kuval; 92099ebb4caSwyllys char *k; 92199ebb4caSwyllys 92299ebb4caSwyllys *kubits = 0; 923*d00756ccSwyllys if (kustr == NULL || strlen(kustr) == 0) 92499ebb4caSwyllys return (KMF_ERR_BAD_PARAMETER); 92599ebb4caSwyllys 92699ebb4caSwyllys /* Check to see if this is critical */ 927*d00756ccSwyllys if (strncasecmp(kustr, "critical:", strlen("critical:")) == 0) { 92899ebb4caSwyllys *critical = TRUE; 92999ebb4caSwyllys kustr += strlen("critical:"); 93099ebb4caSwyllys } else { 93199ebb4caSwyllys *critical = FALSE; 9327c478bd9Sstevel@tonic-gate } 9337711facfSdinak 93499ebb4caSwyllys k = strtok(kustr, ","); 93599ebb4caSwyllys while (k != NULL) { 93630a5e8faSwyllys kuval = kmf_string_to_ku(k); 93799ebb4caSwyllys if (kuval == 0) { 93899ebb4caSwyllys *kubits = 0; 93999ebb4caSwyllys return (KMF_ERR_BAD_PARAMETER); 9407711facfSdinak } 94199ebb4caSwyllys *kubits |= kuval; 94299ebb4caSwyllys k = strtok(NULL, ","); 9437711facfSdinak } 9447711facfSdinak 94599ebb4caSwyllys return (ret); 9467711facfSdinak } 9477711facfSdinak 9487711facfSdinak /* 94999ebb4caSwyllys * Verify the alternate subject label is real or invalid. 95099ebb4caSwyllys * 95199ebb4caSwyllys * The field may be marked "critical" by prepending 95299ebb4caSwyllys * "critical:" to the list. 95399ebb4caSwyllys * EX: "critical:IP=1.2.3.4" 9547711facfSdinak */ 95599ebb4caSwyllys KMF_RETURN 95699ebb4caSwyllys verify_altname(char *arg, KMF_GENERALNAMECHOICES *type, int *critical) 9577711facfSdinak { 95899ebb4caSwyllys char *p; 95999ebb4caSwyllys KMF_RETURN rv = KMF_OK; 9607711facfSdinak 96199ebb4caSwyllys /* Check to see if this is critical */ 962*d00756ccSwyllys if (strncasecmp(arg, "critical:", strlen("critical:")) == 0) { 96399ebb4caSwyllys *critical = TRUE; 96499ebb4caSwyllys arg += strlen("critical:"); 96599ebb4caSwyllys } else { 96699ebb4caSwyllys *critical = FALSE; 96799ebb4caSwyllys } 9687711facfSdinak 96999ebb4caSwyllys /* Make sure there is an "=" sign */ 97099ebb4caSwyllys p = strchr(arg, '='); 97199ebb4caSwyllys if (p == NULL) 97299ebb4caSwyllys return (KMF_ERR_BAD_PARAMETER); 9737711facfSdinak 97499ebb4caSwyllys p[0] = '\0'; 97599ebb4caSwyllys 97699ebb4caSwyllys if (strcmp(arg, "IP") == 0) 97799ebb4caSwyllys *type = GENNAME_IPADDRESS; 97899ebb4caSwyllys else if (strcmp(arg, "DNS") == 0) 97999ebb4caSwyllys *type = GENNAME_DNSNAME; 98099ebb4caSwyllys else if (strcmp(arg, "EMAIL") == 0) 98199ebb4caSwyllys *type = GENNAME_RFC822NAME; 98299ebb4caSwyllys else if (strcmp(arg, "URI") == 0) 98399ebb4caSwyllys *type = GENNAME_URI; 98499ebb4caSwyllys else if (strcmp(arg, "DN") == 0) 98599ebb4caSwyllys *type = GENNAME_DIRECTORYNAME; 98699ebb4caSwyllys else if (strcmp(arg, "RID") == 0) 98799ebb4caSwyllys *type = GENNAME_REGISTEREDID; 988*d00756ccSwyllys else if (strcmp(arg, "KRB") == 0) 989*d00756ccSwyllys *type = GENNAME_KRB5PRINC; 990*d00756ccSwyllys else if (strcmp(arg, "UPN") == 0) 991*d00756ccSwyllys *type = GENNAME_SCLOGON_UPN; 99299ebb4caSwyllys else 99399ebb4caSwyllys rv = KMF_ERR_BAD_PARAMETER; 99499ebb4caSwyllys 99599ebb4caSwyllys p[0] = '='; 99699ebb4caSwyllys 99799ebb4caSwyllys return (rv); 9987c478bd9Sstevel@tonic-gate } 99949e21299Sdinak 100099ebb4caSwyllys int 100199ebb4caSwyllys get_token_password(KMF_KEYSTORE_TYPE kstype, 100299ebb4caSwyllys char *token_spec, KMF_CREDENTIAL *cred) 100349e21299Sdinak { 100499ebb4caSwyllys char prompt[1024]; 100599ebb4caSwyllys char *p = NULL; 100649e21299Sdinak 100799ebb4caSwyllys if (kstype == KMF_KEYSTORE_PK11TOKEN) { 100899ebb4caSwyllys p = strchr(token_spec, ':'); 100999ebb4caSwyllys if (p != NULL) 101099ebb4caSwyllys *p = 0; 101199ebb4caSwyllys } 101249e21299Sdinak /* 101399ebb4caSwyllys * Login to the token first. 101449e21299Sdinak */ 101599ebb4caSwyllys (void) snprintf(prompt, sizeof (prompt), 101630a5e8faSwyllys gettext(DEFAULT_TOKEN_PROMPT), token_spec); 101749e21299Sdinak 101899ebb4caSwyllys if (get_pin(prompt, NULL, (uchar_t **)&cred->cred, 101930a5e8faSwyllys (ulong_t *)&cred->credlen) != CKR_OK) { 102099ebb4caSwyllys cred->cred = NULL; 102199ebb4caSwyllys cred->credlen = 0; 102249e21299Sdinak } 102349e21299Sdinak 102499ebb4caSwyllys if (kstype == KMF_KEYSTORE_PK11TOKEN && p != NULL) 102599ebb4caSwyllys *p = ':'; 102699ebb4caSwyllys return (KMF_OK); 102749e21299Sdinak } 102849e21299Sdinak 102999ebb4caSwyllys KMF_RETURN 103099ebb4caSwyllys verify_file(char *filename) 103149e21299Sdinak { 103299ebb4caSwyllys KMF_RETURN ret = KMF_OK; 103399ebb4caSwyllys int fd; 103449e21299Sdinak 103599ebb4caSwyllys /* 103699ebb4caSwyllys * Attempt to open with the EXCL flag so that if 103799ebb4caSwyllys * it already exists, the open will fail. It will 103899ebb4caSwyllys * also fail if the file cannot be created due to 103999ebb4caSwyllys * permissions on the parent directory, or if the 104099ebb4caSwyllys * parent directory itself does not exist. 104199ebb4caSwyllys */ 104299ebb4caSwyllys fd = open(filename, O_CREAT | O_EXCL, 0600); 104399ebb4caSwyllys if (fd == -1) 104499ebb4caSwyllys return (KMF_ERR_OPEN_FILE); 104549e21299Sdinak 104699ebb4caSwyllys /* If we were able to create it, delete it. */ 104799ebb4caSwyllys (void) close(fd); 104899ebb4caSwyllys (void) unlink(filename); 104949e21299Sdinak 105099ebb4caSwyllys return (ret); 105199ebb4caSwyllys } 105249e21299Sdinak 105399ebb4caSwyllys void 105499ebb4caSwyllys display_error(void *handle, KMF_RETURN errcode, char *prefix) 105599ebb4caSwyllys { 105699ebb4caSwyllys KMF_RETURN rv1, rv2; 105799ebb4caSwyllys char *plugin_errmsg = NULL; 105899ebb4caSwyllys char *kmf_errmsg = NULL; 105949e21299Sdinak 106030a5e8faSwyllys rv1 = kmf_get_plugin_error_str(handle, &plugin_errmsg); 106130a5e8faSwyllys rv2 = kmf_get_kmf_error_str(errcode, &kmf_errmsg); 106249e21299Sdinak 106399ebb4caSwyllys cryptoerror(LOG_STDERR, "%s:", prefix); 106499ebb4caSwyllys if (rv1 == KMF_OK && plugin_errmsg) { 106530a5e8faSwyllys cryptoerror(LOG_STDERR, gettext("keystore error: %s"), 106630a5e8faSwyllys plugin_errmsg); 106730a5e8faSwyllys kmf_free_str(plugin_errmsg); 106899ebb4caSwyllys } 106949e21299Sdinak 107099ebb4caSwyllys if (rv2 == KMF_OK && kmf_errmsg) { 107130a5e8faSwyllys cryptoerror(LOG_STDERR, gettext("libkmf error: %s"), 107230a5e8faSwyllys kmf_errmsg); 107330a5e8faSwyllys kmf_free_str(kmf_errmsg); 107449e21299Sdinak } 107549e21299Sdinak 107699ebb4caSwyllys if (rv1 != KMF_OK && rv2 != KMF_OK) 107799ebb4caSwyllys cryptoerror(LOG_STDERR, gettext("<unknown error>\n")); 107899ebb4caSwyllys 107949e21299Sdinak } 1080*d00756ccSwyllys 1081*d00756ccSwyllys static KMF_RETURN 1082*d00756ccSwyllys addToEKUList(EKU_LIST *ekus, int critical, KMF_OID *newoid) 1083*d00756ccSwyllys { 1084*d00756ccSwyllys if (newoid != NULL && ekus != NULL) { 1085*d00756ccSwyllys ekus->eku_count++; 1086*d00756ccSwyllys 1087*d00756ccSwyllys ekus->critlist = realloc(ekus->critlist, 1088*d00756ccSwyllys ekus->eku_count * sizeof (int)); 1089*d00756ccSwyllys if (ekus->critlist != NULL) 1090*d00756ccSwyllys ekus->critlist[ekus->eku_count-1] = critical; 1091*d00756ccSwyllys else 1092*d00756ccSwyllys return (KMF_ERR_MEMORY); 1093*d00756ccSwyllys 1094*d00756ccSwyllys ekus->ekulist = realloc( 1095*d00756ccSwyllys ekus->ekulist, ekus->eku_count * sizeof (KMF_OID)); 1096*d00756ccSwyllys if (ekus->ekulist != NULL) 1097*d00756ccSwyllys ekus->ekulist[ekus->eku_count-1] = *newoid; 1098*d00756ccSwyllys else 1099*d00756ccSwyllys return (KMF_ERR_MEMORY); 1100*d00756ccSwyllys } 1101*d00756ccSwyllys return (KMF_OK); 1102*d00756ccSwyllys } 1103*d00756ccSwyllys 1104*d00756ccSwyllys void 1105*d00756ccSwyllys free_eku_list(EKU_LIST *ekus) 1106*d00756ccSwyllys { 1107*d00756ccSwyllys if (ekus != NULL && ekus->eku_count > 0) { 1108*d00756ccSwyllys int i; 1109*d00756ccSwyllys for (i = 0; i < ekus->eku_count; i++) { 1110*d00756ccSwyllys kmf_free_data(&ekus->ekulist[i]); 1111*d00756ccSwyllys } 1112*d00756ccSwyllys free(ekus->ekulist); 1113*d00756ccSwyllys free(ekus->critlist); 1114*d00756ccSwyllys } 1115*d00756ccSwyllys } 1116*d00756ccSwyllys 1117*d00756ccSwyllys static KMF_RETURN 1118*d00756ccSwyllys parse_ekus(char *ekustr, EKU_LIST *ekus) 1119*d00756ccSwyllys { 1120*d00756ccSwyllys KMF_RETURN rv = KMF_OK; 1121*d00756ccSwyllys KMF_OID *newoid; 1122*d00756ccSwyllys int critical; 1123*d00756ccSwyllys 1124*d00756ccSwyllys if (strncasecmp(ekustr, "critical:", 1125*d00756ccSwyllys strlen("critical:")) == 0) { 1126*d00756ccSwyllys critical = TRUE; 1127*d00756ccSwyllys ekustr += strlen("critical:"); 1128*d00756ccSwyllys } else { 1129*d00756ccSwyllys critical = FALSE; 1130*d00756ccSwyllys } 1131*d00756ccSwyllys newoid = kmf_ekuname_to_oid(ekustr); 1132*d00756ccSwyllys if (newoid != NULL) { 1133*d00756ccSwyllys rv = addToEKUList(ekus, critical, newoid); 1134*d00756ccSwyllys free(newoid); 1135*d00756ccSwyllys } else { 1136*d00756ccSwyllys rv = PK_ERR_USAGE; 1137*d00756ccSwyllys } 1138*d00756ccSwyllys 1139*d00756ccSwyllys return (rv); 1140*d00756ccSwyllys } 1141*d00756ccSwyllys 1142*d00756ccSwyllys KMF_RETURN 1143*d00756ccSwyllys verify_ekunames(char *ekuliststr, EKU_LIST **ekulist) 1144*d00756ccSwyllys { 1145*d00756ccSwyllys KMF_RETURN rv = KMF_OK; 1146*d00756ccSwyllys char *p; 1147*d00756ccSwyllys EKU_LIST *ekus = NULL; 1148*d00756ccSwyllys 1149*d00756ccSwyllys if (ekuliststr == NULL || strlen(ekuliststr) == 0) 1150*d00756ccSwyllys return (0); 1151*d00756ccSwyllys 1152*d00756ccSwyllys /* 1153*d00756ccSwyllys * The list should be comma separated list of EKU Names. 1154*d00756ccSwyllys */ 1155*d00756ccSwyllys p = strtok(ekuliststr, ","); 1156*d00756ccSwyllys 1157*d00756ccSwyllys /* If no tokens found, then maybe it's just a single EKU value */ 1158*d00756ccSwyllys if (p == NULL) { 1159*d00756ccSwyllys rv = parse_ekus(ekuliststr, ekus); 1160*d00756ccSwyllys } 1161*d00756ccSwyllys 1162*d00756ccSwyllys while (p != NULL) { 1163*d00756ccSwyllys rv = parse_ekus(p, ekus); 1164*d00756ccSwyllys 1165*d00756ccSwyllys if (rv != KMF_OK) 1166*d00756ccSwyllys break; 1167*d00756ccSwyllys p = strtok(NULL, ","); 1168*d00756ccSwyllys } 1169*d00756ccSwyllys 1170*d00756ccSwyllys if (rv != KMF_OK) 1171*d00756ccSwyllys free_eku_list(ekus); 1172*d00756ccSwyllys else 1173*d00756ccSwyllys *ekulist = ekus; 1174*d00756ccSwyllys 1175*d00756ccSwyllys return (rv); 1176*d00756ccSwyllys } 1177