xref: /illumos-gate/usr/src/cmd/cmd-crypto/pktool/common.c (revision 6f2b04a2)

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 *
 * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
 */

/*
 * This file contains the functions that are shared among
 * the various services this tool will ultimately provide.
 * The functions in this file return PKCS#11 CK_RV errors.
 * Only one session and one login per token is supported
 * at this time.
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <tzfile.h>
#include <cryptoutil.h>
#include <security/cryptoki.h>
#include <kmfapi.h>

#include "common.h"

/* Local status variables. */
static boolean_t	initialized = B_FALSE;
static boolean_t	session_opened = B_FALSE;
static boolean_t	logged_in = B_FALSE;

/* Supporting structures and global variables for getopt_av(). */
typedef struct	av_opts_s {
	int		shortnm;	/* short name character */
	char		*longnm;	/* long name string, NOT terminated */
	int		longnm_len;	/* length of long name string */
	boolean_t	has_arg;	/* takes optional argument */
} av_opts;
static av_opts		*opts_av = NULL;
static const char	*_save_optstr = NULL;
static int		_save_numopts = 0;

int			optind_av = 1;
char			*optarg_av = NULL;

static void close_sess(CK_SESSION_HANDLE);
static void logout_token(CK_SESSION_HANDLE);

struct oid_table_entry {
	const KMF_OID *oid;
	char *name;
};

struct oid_table_entry oid_table[] = {
	{ &KMFOID_ECC_secp112r1, "secp112r1"},
	{ &KMFOID_ECC_secp112r2, "secp112r2"},
	{ &KMFOID_ECC_secp128r1, "secp128r1"},
	{ &KMFOID_ECC_secp128r2, "secp128r2"},
	{ &KMFOID_ECC_secp160k1, "secp160k1"},
	{ &KMFOID_ECC_secp160r1, "secp160r1"},
	{ &KMFOID_ECC_secp160r2, "secp160r2"},
	{ &KMFOID_ECC_secp192k1, "secp192k1"},
	{ &KMFOID_ECC_secp192r1, "secp192r1"},
	{ &KMFOID_ECC_secp224k1, "secp224k1"},
	{ &KMFOID_ECC_secp224r1, "secp224r1"},
	{ &KMFOID_ECC_secp256k1, "secp256k1"},
	{ &KMFOID_ECC_secp256r1, "secp256r1"},
	{ &KMFOID_ECC_secp384r1, "secp384r1"},
	{ &KMFOID_ECC_secp521r1, "secp521r1"},
	{ &KMFOID_ECC_sect113r1, "sect113r1"},
	{ &KMFOID_ECC_sect113r2, "sect113r2"},
	{ &KMFOID_ECC_sect131r1, "sect131r1"},
	{ &KMFOID_ECC_sect131r2, "sect131r2"},
	{ &KMFOID_ECC_sect163k1, "sect163k1"},
	{ &KMFOID_ECC_sect163r1, "sect163r1"},
	{ &KMFOID_ECC_sect163r2, "sect163r2"},
	{ &KMFOID_ECC_sect193r1, "sect193r1"},
	{ &KMFOID_ECC_sect193r2, "sect193r2"},
	{ &KMFOID_ECC_sect233k1, "sect233k1"},
	{ &KMFOID_ECC_sect233r1, "sect233r1"},
	{ &KMFOID_ECC_sect239k1, "sect239k1"},
	{ &KMFOID_ECC_sect283k1, "sect283k1"},
	{ &KMFOID_ECC_sect283r1, "sect283r1"},
	{ &KMFOID_ECC_sect409k1, "sect409k1"},
	{ &KMFOID_ECC_sect409r1, "sect409r1"},
	{ &KMFOID_ECC_sect571k1, "sect571k1"},
	{ &KMFOID_ECC_sect571r1, "sect571r1"},
	{ &KMFOID_ECC_c2pnb163v1, "c2pnb163v1"},
	{ &KMFOID_ECC_c2pnb163v2, "c2pnb163v2"},
	{ &KMFOID_ECC_c2pnb163v3, "c2pnb163v3"},
	{ &KMFOID_ECC_c2pnb176v1, "c2pnb176v1"},
	{ &KMFOID_ECC_c2tnb191v1, "c2tnb191v1"},
	{ &KMFOID_ECC_c2tnb191v2, "c2tnb191v2"},
	{ &KMFOID_ECC_c2tnb191v3, "c2tnb191v3"},
	{ &KMFOID_ECC_c2pnb208w1, "c2pnb208w1"},
	{ &KMFOID_ECC_c2tnb239v1, "c2tnb239v1"},
	{ &KMFOID_ECC_c2tnb239v2, "c2tnb239v2"},
	{ &KMFOID_ECC_c2tnb239v3, "c2tnb239v3"},
	{ &KMFOID_ECC_c2pnb272w1, "c2pnb272w1"},
	{ &KMFOID_ECC_c2pnb304w1, "c2pnb304w1"},
	{ &KMFOID_ECC_c2tnb359v1, "c2tnb359v1"},
	{ &KMFOID_ECC_c2pnb368w1, "c2pnb368w1"},
	{ &KMFOID_ECC_c2tnb431r1, "c2tnb431r1"},
	{ &KMFOID_ECC_prime192v2, "prime192v2"},
	{ &KMFOID_ECC_prime192v3, "prime192v3"},
	{ &KMFOID_MD5, "md5"},
	{ &KMFOID_SHA1, "sha1"},
	{ &KMFOID_SHA256, "sha256"},
	{ &KMFOID_SHA384, "sha384"},
	{ &KMFOID_SHA512, "sha512"}
};
int number_of_oids = sizeof (oid_table) / sizeof (struct oid_table_entry);
#define	number_of_curves (number_of_oids - 5)

/*
 * Perform PKCS#11 setup here.  Currently only C_Initialize is required,
 * along with setting/resetting state variables.
 */
static CK_RV
init_pkcs11(void)
{
	CK_RV		rv = CKR_OK;

	/* If C_Initialize() already called, nothing to do here. */
	if (initialized == B_TRUE)
		return (CKR_OK);

	/* Reset state variables because C_Initialize() not yet done. */
	session_opened = B_FALSE;
	logged_in = B_FALSE;

	/* Initialize PKCS#11 library. */
	if ((rv = C_Initialize(NULL_PTR)) != CKR_OK &&
	    rv != CKR_CRYPTOKI_ALREADY_INITIALIZED) {
		return (rv);
	}

	initialized = B_TRUE;
	return (CKR_OK);
}

/*
 * Finalize PKCS#11 library and reset state variables.  Open sessions,
 * if any, are closed, and thereby any logins are logged out also.
 */
void
final_pk11(CK_SESSION_HANDLE sess)
{

	/* If the library wasn't initialized, nothing to do here. */
	if (!initialized)
		return;

	/* Make sure the sesion is closed first. */
	close_sess(sess);

	(void) C_Finalize(NULL);
	initialized = B_FALSE;
}

/*
 * Close PKCS#11 session and reset state variables.  Any logins are
 * logged out.
 */
static void
close_sess(CK_SESSION_HANDLE sess)
{

	if (sess == 0) {
		return;
	}

	/* If session is already closed, nothing to do here. */
	if (!session_opened)
		return;

	/* Make sure user is logged out of token. */
	logout_token(sess);

	(void) C_CloseSession(sess);
	session_opened = B_FALSE;
}

/*
 * Log user out of token and reset status variable.
 */
static void
logout_token(CK_SESSION_HANDLE sess)
{

	if (sess == 0) {
		return;
	}

	/* If already logged out, nothing to do here. */
	if (!logged_in)
		return;

	(void) C_Logout(sess);
	logged_in = B_FALSE;
}

/*
 * Gets PIN from user.  Caller needs to free the returned PIN when done.
 * If two prompts are given, the PIN is confirmed with second prompt.
 * Note that getphassphrase() may return data in static memory area.
 */
CK_RV
get_pin(char *prompt1, char *prompt2, CK_UTF8CHAR_PTR *pin, CK_ULONG *pinlen)
{
	char *save_phrase, *phrase1, *phrase2;

	/* Prompt user for a PIN. */
	if (prompt1 == NULL) {
		return (CKR_ARGUMENTS_BAD);
	}
	if ((phrase1 = getpassphrase(prompt1)) == NULL) {
		return (CKR_FUNCTION_FAILED);
	}

	/* Duplicate 1st PIN in separate chunk of memory. */
	if ((save_phrase = strdup(phrase1)) == NULL)
		return (CKR_HOST_MEMORY);

	/* If second prompt given, PIN confirmation is requested. */
	if (prompt2 != NULL) {
		if ((phrase2 = getpassphrase(prompt2)) == NULL) {
			free(save_phrase);
			return (CKR_FUNCTION_FAILED);
		}
		if (strcmp(save_phrase, phrase2) != 0) {
			free(save_phrase);
			return (CKR_PIN_INCORRECT);
		}
	}

	*pin = (CK_UTF8CHAR_PTR)save_phrase;
	*pinlen = strlen(save_phrase);
	return (CKR_OK);
}

int
yn_to_int(char *ynstr)
{
	char *y = gettext("yes");
	char *n = gettext("no");
	if (ynstr == NULL)
		return (-1);

	if (strncasecmp(ynstr, y, 1) == 0)
		return (1);
	else if (strncasecmp(ynstr, n, 1) == 0)
		return (0);
	else
		return (-1);
}

/*
 * Gets yes/no response from user.  If either no prompt is supplied, a
 * default prompt is used.  If not message for invalid input is supplied,
 * a default will not be provided.  If the user provides no response,
 * the input default B_TRUE == yes, B_FALSE == no is returned.
 * Otherwise, B_TRUE is returned for yes, and B_FALSE for no.
 */
boolean_t
yesno(char *prompt, char *invalid, boolean_t dflt)
{
	char	*response, buf[1024];
	int	ans;

	if (prompt == NULL)
		prompt = gettext("Enter (y)es or (n)o? ");

	for (;;) {
		/* Prompt user. */
		(void) printf("%s", prompt);
		(void) fflush(stdout);

		/* Get the response. */
		if ((response = fgets(buf, sizeof (buf), stdin)) == NULL)
			break;		/* go to default response */

		/* Skip any leading white space. */
		while (isspace(*response))
			response++;
		if (*response == '\0')
			break;		/* go to default response */

		ans = yn_to_int(response);
		if (ans == 1)
			return (B_TRUE);
		else if (ans == 0)
			return (B_FALSE);

		/* Indicate invalid input, and try again. */
		if (invalid != NULL)
			(void) printf("%s", invalid);
	}
	return (dflt);
}

/*
 * Gets the list of slots which have tokens in them.  Keeps adjusting
 * the size of the slot list buffer until the call is successful or an
 * irrecoverable error occurs.
 */
CK_RV
get_token_slots(CK_SLOT_ID_PTR *slot_list, CK_ULONG *slot_count)
{
	CK_ULONG	tmp_count = 0;
	CK_SLOT_ID_PTR	tmp_list = NULL_PTR, tmp2_list = NULL_PTR;
	int		rv = CKR_OK;

	if (!initialized)
		if ((rv = init_pkcs11()) != CKR_OK)
			return (rv);

	/*
	 * Get the slot count first because we don't know how many
	 * slots there are and how many of those slots even have tokens.
	 * Don't specify an arbitrary buffer size for the slot list;
	 * it may be too small (see section 11.5 of PKCS#11 spec).
	 * Also select only those slots that have tokens in them,
	 * because this tool has no need to know about empty slots.
	 */
	if ((rv = C_GetSlotList(1, NULL_PTR, &tmp_count)) != CKR_OK)
		return (rv);

	if (tmp_count == 0) {
		*slot_list = NULL_PTR;
		*slot_count = 0;
		return (CKR_OK);
	}

	/* Allocate initial space for the slot list. */
	if ((tmp_list = (CK_SLOT_ID_PTR) malloc(tmp_count *
	    sizeof (CK_SLOT_ID))) == NULL)
		return (CKR_HOST_MEMORY);

	/* Then get the slot list itself. */
	for (;;) {
		if ((rv = C_GetSlotList(1, tmp_list, &tmp_count)) == CKR_OK) {
			*slot_list = tmp_list;
			*slot_count = tmp_count;
			break;
		}

		if (rv != CKR_BUFFER_TOO_SMALL) {
			free(tmp_list);
			break;
		}

		/* If the number of slots grew, try again. */
		if ((tmp2_list = (CK_SLOT_ID_PTR) realloc(tmp_list,
		    tmp_count * sizeof (CK_SLOT_ID))) == NULL) {
			free(tmp_list);
			rv = CKR_HOST_MEMORY;
			break;
		}
		tmp_list = tmp2_list;
	}

	return (rv);
}

/*
 * Breaks out the getopt-style option string into a structure that can be
 * traversed later for calls to getopt_av().  Option string is NOT altered,
 * but the struct fields point to locations within option string.
 */
static int
populate_opts(char *optstring)
{
	int		i;
	av_opts		*temp;
	char		*marker;

	if (optstring == NULL || *optstring == '\0')
		return (0);

	/*
	 * This tries to imitate getopt(3c) Each option must conform to:
	 * <short name char> [ ':' ] [ '(' <long name string> ')' ]
	 * If long name is missing, the short name is used for long name.
	 */
	for (i = 0; *optstring != '\0'; i++) {
		if ((temp = (av_opts *)((i == 0) ? malloc(sizeof (av_opts)) :
		    realloc(opts_av, (i+1) * sizeof (av_opts)))) == NULL) {
			if (opts_av != NULL)
				free(opts_av);
			opts_av = NULL;
			return (0);
		} else {
			opts_av = (av_opts *)temp;
		}

		(void) memset(&opts_av[i], 0, sizeof (av_opts));
		marker = optstring;		/* may need optstring later */

		opts_av[i].shortnm = *marker++;	/* set short name */

		if (*marker == ':') {		/* check for opt arg */
			marker++;
			opts_av[i].has_arg = B_TRUE;
		}

		if (*marker == '(') {		/* check and set long name */
			marker++;
			opts_av[i].longnm = marker;
			opts_av[i].longnm_len = strcspn(marker, ")");
			optstring = marker + opts_av[i].longnm_len + 1;
		} else {
			/* use short name option character */
			opts_av[i].longnm = optstring;
			opts_av[i].longnm_len = 1;
			optstring = marker;
		}
	}

	return (i);
}

/*
 * getopt_av() is very similar to getopt(3c) in that the takes an option
 * string, compares command line arguments for matches, and returns a single
 * letter option when a match is found.  However, getopt_av() differs from
 * getopt(3c) by requiring that only longname options and values be found
 * on the command line and all leading dashes are omitted.  In other words,
 * it tries to enforce only longname "option=value" arguments on the command
 * line.  Boolean options are not allowed either.
 */
int
getopt_av(int argc, char * const *argv, const char *optstring)
{
	int	i;
	int	len;
	char   *cur_option;

	if (optind_av >= argc)
		return (EOF);

	/* First time or when optstring changes from previous one */
	if (_save_optstr != optstring) {
		if (opts_av != NULL)
			free(opts_av);
		opts_av = NULL;
		_save_optstr = optstring;
		_save_numopts = populate_opts((char *)optstring);
	}

	for (i = 0; i < _save_numopts; i++) {
		cur_option = argv[optind_av];

		if (strcmp(cur_option, "--") == 0) {
			optind_av++;
			break;
		}

		if (cur_option[0] == '-' && strlen(cur_option) == 2) {
			len = 1;
			cur_option++; /* remove "-" */
		} else {
			len = strcspn(cur_option, "=");
		}

		if (len == opts_av[i].longnm_len && strncmp(cur_option,
		    opts_av[i].longnm, opts_av[i].longnm_len) == 0) {
			/* matched */
			if (!opts_av[i].has_arg) {
				optind_av++;
				return (opts_av[i].shortnm);
			}

			/* needs optarg */
			if (cur_option[len] == '=') {
				optarg_av = &(cur_option[len+1]);
				optind_av++;
				return (opts_av[i].shortnm);
			}

			optarg_av = NULL;
			optind_av++;
			return ((int)'?');
		}
	}

	return (EOF);
}

KMF_KEYSTORE_TYPE
KS2Int(char *keystore_str)
{
	if (keystore_str == NULL)
		return (0);
	if (strcasecmp(keystore_str, "pkcs11") == 0)
		return (KMF_KEYSTORE_PK11TOKEN);
	else if (strcasecmp(keystore_str, "nss") == 0)
		return (KMF_KEYSTORE_NSS);
	else if (strcasecmp(keystore_str, "file") == 0)
		return (KMF_KEYSTORE_OPENSSL);
	else
		return (0);
}

/*
 * compare_oids
 * return 1 if equal
 */
boolean_t
compare_oids(KMF_OID *oid1, const KMF_OID *oid2)
{
	return ((oid1->Length == oid2->Length) &&
	    !memcmp(oid1->Data, oid2->Data, oid1->Length));
}

int
Str2KeyType(char *algm, KMF_OID *hashoid, KMF_KEY_ALG *ktype,
    KMF_ALGORITHM_INDEX *sigAlg)
{
	if (algm == NULL) {
		/* Default to SHA1+RSA */
		*sigAlg = KMF_ALGID_SHA1WithRSA;
		*ktype = KMF_RSA;
	} else if (strcasecmp(algm, "DSA") == 0) {
		if (hashoid == NULL ||
		    compare_oids(hashoid, &KMFOID_SHA1))
			*sigAlg = KMF_ALGID_SHA1WithDSA;
		else if (compare_oids(hashoid, &KMFOID_SHA256))
			*sigAlg = KMF_ALGID_SHA256WithDSA;
		else
			return (-1); /* unsupported hash/key combo */
		*ktype = KMF_DSA;
	} else if (strcasecmp(algm, "RSA") == 0) {
		if (hashoid == NULL ||
		    compare_oids(hashoid, &KMFOID_SHA1))
			*sigAlg = KMF_ALGID_SHA1WithRSA;
		else if (compare_oids(hashoid, &KMFOID_SHA256))
			*sigAlg = KMF_ALGID_SHA256WithRSA;
		else if (compare_oids(hashoid, &KMFOID_SHA384))
			*sigAlg = KMF_ALGID_SHA384WithRSA;
		else if (compare_oids(hashoid, &KMFOID_SHA512))
			*sigAlg = KMF_ALGID_SHA512WithRSA;
		else if (compare_oids(hashoid, &KMFOID_MD5))
			*sigAlg = KMF_ALGID_MD5WithRSA;
		else
			return (-1); /* unsupported hash/key combo */
		*ktype = KMF_RSA;
	} else if (strcasecmp(algm, "EC") == 0) {
		/* EC keys may be used with some SHA2 hashes */
		if (hashoid == NULL ||
		    compare_oids(hashoid, &KMFOID_SHA1))
			*sigAlg = KMF_ALGID_SHA1WithECDSA;
		else if (compare_oids(hashoid, &KMFOID_SHA256))
			*sigAlg = KMF_ALGID_SHA256WithECDSA;
		else if (compare_oids(hashoid, &KMFOID_SHA384))
			*sigAlg = KMF_ALGID_SHA384WithECDSA;
		else if (compare_oids(hashoid, &KMFOID_SHA512))
			*sigAlg = KMF_ALGID_SHA512WithECDSA;
		else
			return (-1); /* unsupported hash/key combo */

		*ktype = KMF_ECDSA;
	} else {
		return (-1);
	}
	return (0);
}

int
Str2SymKeyType(char *algm, KMF_KEY_ALG *ktype)
{
	if (algm == NULL)
		*ktype = KMF_AES;
	else if (strcasecmp(algm, "aes") == 0)
		*ktype = KMF_AES;
	else if (strcasecmp(algm, "arcfour") == 0)
		*ktype = KMF_RC4;
	else if (strcasecmp(algm, "des") == 0)
		*ktype = KMF_DES;
	else if (strcasecmp(algm, "3des") == 0)
		*ktype = KMF_DES3;
	else if (strcasecmp(algm, "generic") == 0)
		*ktype = KMF_GENERIC_SECRET;
	else
		return (-1);

	return (0);
}

int
Str2Lifetime(char *ltimestr, uint32_t *ltime)
{
	int num;
	char timetok[6];

	if (ltimestr == NULL || strlen(ltimestr) == 0) {
		/* default to 1 year lifetime */
		*ltime = SECSPERDAY * DAYSPERNYEAR;
		return (0);
	}

	(void) memset(timetok, 0, sizeof (timetok));
	if (sscanf(ltimestr, "%d-%06s", &num, timetok) != 2)
		return (-1);