17711facfSdinak /* 27711facfSdinak * CDDL HEADER START 37711facfSdinak * 47711facfSdinak * The contents of this file are subject to the terms of the 599ebb4caSwyllys * Common Development and Distribution License (the "License"). 699ebb4caSwyllys * You may not use this file except in compliance with the License. 77711facfSdinak * 87711facfSdinak * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97711facfSdinak * or http://www.opensolaris.org/os/licensing. 107711facfSdinak * See the License for the specific language governing permissions 117711facfSdinak * and limitations under the License. 127711facfSdinak * 137711facfSdinak * When distributing Covered Code, include this CDDL HEADER in each 147711facfSdinak * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157711facfSdinak * If applicable, add the following below this CDDL HEADER, with the 167711facfSdinak * fields enclosed by brackets "[]" replaced with your own identifying 177711facfSdinak * information: Portions Copyright [yyyy] [name of copyright owner] 187711facfSdinak * 197711facfSdinak * CDDL HEADER END 207711facfSdinak */ 217711facfSdinak /* 2230a5e8faSwyllys * Copyright 2007 Sun Microsystems, Inc. All rights reserved. 237711facfSdinak * Use is subject to license terms. 247711facfSdinak */ 257711facfSdinak 267711facfSdinak #pragma ident "%Z%%M% %I% %E% SMI" 277711facfSdinak 287711facfSdinak /* 297711facfSdinak * This file implements the import operation for this tool. 307711facfSdinak * The basic flow of the process is to decrypt the PKCS#12 317711facfSdinak * input file if it has a password, parse the elements in 327711facfSdinak * the file, find the soft token, log into it, import the 337711facfSdinak * PKCS#11 objects into the soft token, and log out. 347711facfSdinak */ 357711facfSdinak 367711facfSdinak #include <stdio.h> 377711facfSdinak #include <stdlib.h> 387711facfSdinak #include <string.h> 3999ebb4caSwyllys #include <ctype.h> 407711facfSdinak #include <errno.h> 417711facfSdinak #include <fcntl.h> 427711facfSdinak #include <sys/types.h> 437711facfSdinak #include <sys/stat.h> 447711facfSdinak #include "common.h" 457711facfSdinak 4699ebb4caSwyllys #include <kmfapi.h> 4799ebb4caSwyllys 48*5b3e1433Swyllys #define NEW_ATTRLIST(a, n) \ 49*5b3e1433Swyllys { \ 50*5b3e1433Swyllys a = (KMF_ATTRIBUTE *)malloc(n * sizeof (KMF_ATTRIBUTE)); \ 51*5b3e1433Swyllys if (a == NULL) { \ 52*5b3e1433Swyllys rv = KMF_ERR_MEMORY; \ 53*5b3e1433Swyllys goto end; \ 54*5b3e1433Swyllys } \ 55*5b3e1433Swyllys (void) memset(a, 0, n * sizeof (KMF_ATTRIBUTE)); \ 56*5b3e1433Swyllys } 57*5b3e1433Swyllys 5899ebb4caSwyllys static KMF_RETURN 5999ebb4caSwyllys pk_import_pk12_files(KMF_HANDLE_T kmfhandle, KMF_CREDENTIAL *cred, 6099ebb4caSwyllys char *outfile, char *certfile, char *keyfile, 6199ebb4caSwyllys char *dir, char *keydir, KMF_ENCODE_FORMAT outformat) 627711facfSdinak { 6399ebb4caSwyllys KMF_RETURN rv = KMF_OK; 64*5b3e1433Swyllys KMF_X509_DER_CERT *certs = NULL; 6599ebb4caSwyllys KMF_RAW_KEY_DATA *keys = NULL; 6699ebb4caSwyllys int ncerts = 0; 6799ebb4caSwyllys int nkeys = 0; 6899ebb4caSwyllys int i; 6930a5e8faSwyllys KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_OPENSSL; 70*5b3e1433Swyllys KMF_ATTRIBUTE *attrlist = NULL; 7130a5e8faSwyllys int numattr = 0; 7299ebb4caSwyllys 7330a5e8faSwyllys rv = kmf_import_objects(kmfhandle, outfile, cred, 7430a5e8faSwyllys &certs, &ncerts, &keys, &nkeys); 7599ebb4caSwyllys 7699ebb4caSwyllys if (rv == KMF_OK) { 7799ebb4caSwyllys (void) printf(gettext("Found %d certificate(s) and %d " 7830a5e8faSwyllys "key(s) in %s\n"), ncerts, nkeys, outfile); 7999ebb4caSwyllys } 8099ebb4caSwyllys 8199ebb4caSwyllys if (rv == KMF_OK && ncerts > 0) { 8299ebb4caSwyllys char newcertfile[MAXPATHLEN]; 8399ebb4caSwyllys 84*5b3e1433Swyllys NEW_ATTRLIST(attrlist, (3 + (3 * ncerts))); 85*5b3e1433Swyllys 8630a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 8730a5e8faSwyllys KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype)); 8830a5e8faSwyllys numattr++; 8930a5e8faSwyllys 9030a5e8faSwyllys if (dir != NULL) { 9130a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 9230a5e8faSwyllys KMF_DIRPATH_ATTR, dir, strlen(dir)); 9330a5e8faSwyllys numattr++; 9430a5e8faSwyllys } 9530a5e8faSwyllys 9630a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 9730a5e8faSwyllys KMF_ENCODE_FORMAT_ATTR, &outformat, sizeof (outformat)); 9830a5e8faSwyllys numattr++; 9999ebb4caSwyllys 10099ebb4caSwyllys for (i = 0; rv == KMF_OK && i < ncerts; i++) { 10130a5e8faSwyllys int num = numattr; 10230a5e8faSwyllys 10399ebb4caSwyllys /* 10499ebb4caSwyllys * If storing more than 1 cert, gotta change 10599ebb4caSwyllys * the name so we don't overwrite the previous one. 10699ebb4caSwyllys * Just append a _# to the name. 10799ebb4caSwyllys */ 10899ebb4caSwyllys if (i > 0) { 10999ebb4caSwyllys (void) snprintf(newcertfile, 11030a5e8faSwyllys sizeof (newcertfile), "%s_%d", certfile, i); 11130a5e8faSwyllys 11230a5e8faSwyllys kmf_set_attr_at_index(attrlist, num, 11330a5e8faSwyllys KMF_CERT_FILENAME_ATTR, newcertfile, 11430a5e8faSwyllys strlen(newcertfile)); 11530a5e8faSwyllys num++; 11699ebb4caSwyllys } else { 11730a5e8faSwyllys kmf_set_attr_at_index(attrlist, num, 11830a5e8faSwyllys KMF_CERT_FILENAME_ATTR, certfile, 11930a5e8faSwyllys strlen(certfile)); 12030a5e8faSwyllys num++; 12199ebb4caSwyllys } 12230a5e8faSwyllys 123*5b3e1433Swyllys if (certs[i].kmf_private.label != NULL) { 124*5b3e1433Swyllys kmf_set_attr_at_index(attrlist, num, 125*5b3e1433Swyllys KMF_CERT_LABEL_ATTR, 126*5b3e1433Swyllys certs[i].kmf_private.label, 127*5b3e1433Swyllys strlen(certs[i].kmf_private.label)); 128*5b3e1433Swyllys num++; 129*5b3e1433Swyllys } 13030a5e8faSwyllys kmf_set_attr_at_index(attrlist, num, 131*5b3e1433Swyllys KMF_CERT_DATA_ATTR, &certs[i].certificate, 132*5b3e1433Swyllys sizeof (KMF_DATA)); 13330a5e8faSwyllys num++; 13430a5e8faSwyllys rv = kmf_store_cert(kmfhandle, num, attrlist); 13599ebb4caSwyllys } 136*5b3e1433Swyllys free(attrlist); 1377711facfSdinak } 13899ebb4caSwyllys if (rv == KMF_OK && nkeys > 0) { 13999ebb4caSwyllys char newkeyfile[MAXPATHLEN]; 14030a5e8faSwyllys numattr = 0; 141*5b3e1433Swyllys NEW_ATTRLIST(attrlist, (4 + (4 * nkeys))); 14230a5e8faSwyllys 14330a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 14430a5e8faSwyllys KMF_KEYSTORE_TYPE_ATTR, &kstype, 14530a5e8faSwyllys sizeof (kstype)); 14630a5e8faSwyllys numattr++; 14730a5e8faSwyllys 14830a5e8faSwyllys if (keydir != NULL) { 14930a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 15030a5e8faSwyllys KMF_DIRPATH_ATTR, keydir, 15130a5e8faSwyllys strlen(keydir)); 15230a5e8faSwyllys numattr++; 15330a5e8faSwyllys } 15430a5e8faSwyllys 15530a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 15630a5e8faSwyllys KMF_ENCODE_FORMAT_ATTR, &outformat, 15730a5e8faSwyllys sizeof (outformat)); 15830a5e8faSwyllys numattr++; 15930a5e8faSwyllys 16030a5e8faSwyllys if (cred != NULL && cred->credlen > 0) { 16130a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 16230a5e8faSwyllys KMF_CREDENTIAL_ATTR, cred, 16330a5e8faSwyllys sizeof (KMF_CREDENTIAL)); 16430a5e8faSwyllys numattr++; 16530a5e8faSwyllys } 16699ebb4caSwyllys 16799ebb4caSwyllys /* The order of certificates and keys should match */ 16899ebb4caSwyllys for (i = 0; rv == KMF_OK && i < nkeys; i++) { 16930a5e8faSwyllys int num = numattr; 17099ebb4caSwyllys 17199ebb4caSwyllys if (i > 0) { 17299ebb4caSwyllys (void) snprintf(newkeyfile, 17330a5e8faSwyllys sizeof (newkeyfile), "%s_%d", keyfile, i); 17430a5e8faSwyllys 17530a5e8faSwyllys kmf_set_attr_at_index(attrlist, num, 17630a5e8faSwyllys KMF_KEY_FILENAME_ATTR, newkeyfile, 17730a5e8faSwyllys strlen(newkeyfile)); 17830a5e8faSwyllys num++; 17999ebb4caSwyllys } else { 18030a5e8faSwyllys kmf_set_attr_at_index(attrlist, num, 18130a5e8faSwyllys KMF_KEY_FILENAME_ATTR, keyfile, 18230a5e8faSwyllys strlen(keyfile)); 18330a5e8faSwyllys num++; 18499ebb4caSwyllys } 18599ebb4caSwyllys 186*5b3e1433Swyllys if (i < ncerts) { 187*5b3e1433Swyllys kmf_set_attr_at_index(attrlist, num, 188*5b3e1433Swyllys KMF_CERT_DATA_ATTR, &certs[i], 189*5b3e1433Swyllys sizeof (KMF_CERT_DATA_ATTR)); 190*5b3e1433Swyllys num++; 191*5b3e1433Swyllys } 19230a5e8faSwyllys 19330a5e8faSwyllys kmf_set_attr_at_index(attrlist, num, 19430a5e8faSwyllys KMF_RAW_KEY_ATTR, &keys[i], 19530a5e8faSwyllys sizeof (KMF_RAW_KEY_DATA)); 19630a5e8faSwyllys num++; 19730a5e8faSwyllys 19830a5e8faSwyllys rv = kmf_store_key(kmfhandle, num, attrlist); 19999ebb4caSwyllys } 200*5b3e1433Swyllys free(attrlist); 2017711facfSdinak } 202*5b3e1433Swyllys end: 20399ebb4caSwyllys /* 20499ebb4caSwyllys * Cleanup memory. 20599ebb4caSwyllys */ 20699ebb4caSwyllys if (certs) { 20799ebb4caSwyllys for (i = 0; i < ncerts; i++) 208*5b3e1433Swyllys kmf_free_kmf_cert(kmfhandle, &certs[i]); 20999ebb4caSwyllys free(certs); 21099ebb4caSwyllys } 21199ebb4caSwyllys if (keys) { 21299ebb4caSwyllys for (i = 0; i < nkeys; i++) 21330a5e8faSwyllys kmf_free_raw_key(&keys[i]); 21499ebb4caSwyllys free(keys); 2157711facfSdinak } 2167711facfSdinak 2177711facfSdinak 21899ebb4caSwyllys return (rv); 2197711facfSdinak } 2207711facfSdinak 22199ebb4caSwyllys 22299ebb4caSwyllys static KMF_RETURN 22399ebb4caSwyllys pk_import_pk12_nss( 22499ebb4caSwyllys KMF_HANDLE_T kmfhandle, KMF_CREDENTIAL *kmfcred, 22599ebb4caSwyllys KMF_CREDENTIAL *tokencred, 22699ebb4caSwyllys char *token_spec, char *dir, char *prefix, 22799ebb4caSwyllys char *nickname, char *trustflags, char *filename) 2287711facfSdinak { 22999ebb4caSwyllys KMF_RETURN rv = KMF_OK; 230*5b3e1433Swyllys KMF_X509_DER_CERT *certs = NULL; 23199ebb4caSwyllys KMF_RAW_KEY_DATA *keys = NULL; 23299ebb4caSwyllys int ncerts = 0; 23399ebb4caSwyllys int nkeys = 0; 23499ebb4caSwyllys int i; 23530a5e8faSwyllys KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_NSS; 236*5b3e1433Swyllys KMF_ATTRIBUTE *attrlist = NULL; 23730a5e8faSwyllys int numattr = 0; 23899ebb4caSwyllys 23999ebb4caSwyllys rv = configure_nss(kmfhandle, dir, prefix); 24099ebb4caSwyllys if (rv != KMF_OK) 24199ebb4caSwyllys return (rv); 2427711facfSdinak 24330a5e8faSwyllys rv = kmf_import_objects(kmfhandle, filename, kmfcred, 24430a5e8faSwyllys &certs, &ncerts, &keys, &nkeys); 2457711facfSdinak 24699ebb4caSwyllys if (rv == KMF_OK) 24799ebb4caSwyllys (void) printf(gettext("Found %d certificate(s) and %d " 24830a5e8faSwyllys "key(s) in %s\n"), ncerts, nkeys, filename); 2497711facfSdinak 25099ebb4caSwyllys if (rv == KMF_OK) { 251*5b3e1433Swyllys NEW_ATTRLIST(attrlist, (3 + (2 * ncerts))); 252*5b3e1433Swyllys 25330a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 25430a5e8faSwyllys KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype)); 25530a5e8faSwyllys numattr++; 25630a5e8faSwyllys 25730a5e8faSwyllys if (token_spec != NULL) { 25830a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 25930a5e8faSwyllys KMF_TOKEN_LABEL_ATTR, token_spec, 26030a5e8faSwyllys strlen(token_spec)); 26130a5e8faSwyllys numattr++; 26230a5e8faSwyllys } 2637711facfSdinak 26430a5e8faSwyllys if (trustflags != NULL) { 26530a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 26630a5e8faSwyllys KMF_TRUSTFLAG_ATTR, trustflags, 26730a5e8faSwyllys strlen(trustflags)); 26830a5e8faSwyllys numattr++; 26930a5e8faSwyllys } 2707711facfSdinak 27199ebb4caSwyllys for (i = 0; rv == KMF_OK && i < ncerts; i++) { 27230a5e8faSwyllys int num = numattr; 2737711facfSdinak 274*5b3e1433Swyllys if (certs[i].kmf_private.label != NULL) { 275*5b3e1433Swyllys kmf_set_attr_at_index(attrlist, num, 276*5b3e1433Swyllys KMF_CERT_LABEL_ATTR, 277*5b3e1433Swyllys certs[i].kmf_private.label, 278*5b3e1433Swyllys strlen(certs[i].kmf_private.label)); 279*5b3e1433Swyllys num++; 280*5b3e1433Swyllys } else if (i == 0 && nickname != NULL) { 28130a5e8faSwyllys kmf_set_attr_at_index(attrlist, num, 28230a5e8faSwyllys KMF_CERT_LABEL_ATTR, nickname, 28330a5e8faSwyllys strlen(nickname)); 28430a5e8faSwyllys num++; 28530a5e8faSwyllys } 28630a5e8faSwyllys 28730a5e8faSwyllys kmf_set_attr_at_index(attrlist, num, 288*5b3e1433Swyllys KMF_CERT_DATA_ATTR, 289*5b3e1433Swyllys &certs[i].certificate, sizeof (KMF_DATA)); 29030a5e8faSwyllys num++; 29130a5e8faSwyllys rv = kmf_store_cert(kmfhandle, num, attrlist); 2927711facfSdinak } 293*5b3e1433Swyllys free(attrlist); 294*5b3e1433Swyllys attrlist = NULL; 29599ebb4caSwyllys if (rv != KMF_OK) { 29699ebb4caSwyllys display_error(kmfhandle, rv, 29730a5e8faSwyllys gettext("Error storing certificate in NSS token")); 2987711facfSdinak } 2997711facfSdinak } 3007711facfSdinak 30199ebb4caSwyllys if (rv == KMF_OK) { 30230a5e8faSwyllys numattr = 0; 303*5b3e1433Swyllys NEW_ATTRLIST(attrlist, (4 + (2 * nkeys))); 30430a5e8faSwyllys 30530a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 30630a5e8faSwyllys KMF_KEYSTORE_TYPE_ATTR, &kstype, 30730a5e8faSwyllys sizeof (kstype)); 30830a5e8faSwyllys numattr++; 30930a5e8faSwyllys 31030a5e8faSwyllys if (token_spec != NULL) { 31130a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 31230a5e8faSwyllys KMF_TOKEN_LABEL_ATTR, token_spec, 31330a5e8faSwyllys strlen(token_spec)); 31430a5e8faSwyllys numattr++; 31530a5e8faSwyllys } 31630a5e8faSwyllys 31730a5e8faSwyllys if (nickname != NULL) { 31830a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 31930a5e8faSwyllys KMF_KEYLABEL_ATTR, nickname, 32030a5e8faSwyllys strlen(nickname)); 32130a5e8faSwyllys numattr++; 32230a5e8faSwyllys } 32330a5e8faSwyllys 32430a5e8faSwyllys if (tokencred->credlen > 0) { 32530a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 32630a5e8faSwyllys KMF_CREDENTIAL_ATTR, tokencred, 32730a5e8faSwyllys sizeof (KMF_CREDENTIAL)); 32830a5e8faSwyllys numattr++; 32930a5e8faSwyllys } 3307711facfSdinak 33199ebb4caSwyllys /* The order of certificates and keys should match */ 33299ebb4caSwyllys for (i = 0; i < nkeys; i++) { 33330a5e8faSwyllys int num = numattr; 33430a5e8faSwyllys 335*5b3e1433Swyllys if (i < ncerts) { 336*5b3e1433Swyllys kmf_set_attr_at_index(attrlist, num, 337*5b3e1433Swyllys KMF_CERT_DATA_ATTR, &certs[i], 338*5b3e1433Swyllys sizeof (KMF_DATA)); 339*5b3e1433Swyllys num++; 340*5b3e1433Swyllys } 34130a5e8faSwyllys 34230a5e8faSwyllys kmf_set_attr_at_index(attrlist, num, 34330a5e8faSwyllys KMF_RAW_KEY_ATTR, &keys[i], 34430a5e8faSwyllys sizeof (KMF_RAW_KEY_DATA)); 34530a5e8faSwyllys num++; 3467711facfSdinak 34730a5e8faSwyllys rv = kmf_store_key(kmfhandle, num, attrlist); 34899ebb4caSwyllys } 349*5b3e1433Swyllys free(attrlist); 3507711facfSdinak } 3517711facfSdinak 352*5b3e1433Swyllys end: 35399ebb4caSwyllys /* 35499ebb4caSwyllys * Cleanup memory. 35599ebb4caSwyllys */ 35699ebb4caSwyllys if (certs) { 35799ebb4caSwyllys for (i = 0; i < ncerts; i++) 358*5b3e1433Swyllys kmf_free_kmf_cert(kmfhandle, &certs[i]); 35999ebb4caSwyllys free(certs); 3607711facfSdinak } 36199ebb4caSwyllys if (keys) { 36299ebb4caSwyllys for (i = 0; i < nkeys; i++) 36330a5e8faSwyllys kmf_free_raw_key(&keys[i]); 36499ebb4caSwyllys free(keys); 3657711facfSdinak } 3667711facfSdinak 36799ebb4caSwyllys return (rv); 36899ebb4caSwyllys } 3697711facfSdinak 37099ebb4caSwyllys static KMF_RETURN 37199ebb4caSwyllys pk_import_cert( 37299ebb4caSwyllys KMF_HANDLE_T kmfhandle, 37399ebb4caSwyllys KMF_KEYSTORE_TYPE kstype, 37499ebb4caSwyllys char *label, char *token_spec, char *filename, 37599ebb4caSwyllys char *dir, char *prefix, char *trustflags) 37699ebb4caSwyllys { 37799ebb4caSwyllys KMF_RETURN rv = KMF_OK; 37830a5e8faSwyllys KMF_ATTRIBUTE attrlist[32]; 37930a5e8faSwyllys int i = 0; 3807711facfSdinak 38199ebb4caSwyllys if (kstype == KMF_KEYSTORE_PK11TOKEN) { 38299ebb4caSwyllys rv = select_token(kmfhandle, token_spec, FALSE); 38330a5e8faSwyllys } else if (kstype == KMF_KEYSTORE_NSS) { 38430a5e8faSwyllys rv = configure_nss(kmfhandle, dir, prefix); 3857711facfSdinak } 38630a5e8faSwyllys if (rv != KMF_OK) 38730a5e8faSwyllys return (rv); 3887711facfSdinak 38930a5e8faSwyllys kmf_set_attr_at_index(attrlist, i, 39030a5e8faSwyllys KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (KMF_KEYSTORE_TYPE)); 39130a5e8faSwyllys i++; 3927711facfSdinak 39330a5e8faSwyllys kmf_set_attr_at_index(attrlist, i, KMF_CERT_FILENAME_ATTR, 39430a5e8faSwyllys filename, strlen(filename)); 39530a5e8faSwyllys i++; 39630a5e8faSwyllys 39730a5e8faSwyllys if (label != NULL) { 39830a5e8faSwyllys kmf_set_attr_at_index(attrlist, i, KMF_CERT_LABEL_ATTR, 39930a5e8faSwyllys label, strlen(label)); 40030a5e8faSwyllys i++; 4017711facfSdinak } 4027711facfSdinak 40330a5e8faSwyllys if (kstype == KMF_KEYSTORE_NSS) { 40430a5e8faSwyllys if (trustflags != NULL) { 40530a5e8faSwyllys kmf_set_attr_at_index(attrlist, i, KMF_TRUSTFLAG_ATTR, 40630a5e8faSwyllys trustflags, strlen(trustflags)); 40730a5e8faSwyllys i++; 40830a5e8faSwyllys } 4097711facfSdinak 41030a5e8faSwyllys if (token_spec != NULL) { 41130a5e8faSwyllys kmf_set_attr_at_index(attrlist, i, 41230a5e8faSwyllys KMF_TOKEN_LABEL_ATTR, 41330a5e8faSwyllys token_spec, strlen(token_spec)); 41430a5e8faSwyllys i++; 41530a5e8faSwyllys } 41630a5e8faSwyllys } 41730a5e8faSwyllys 41830a5e8faSwyllys rv = kmf_import_cert(kmfhandle, i, attrlist); 41999ebb4caSwyllys return (rv); 4207711facfSdinak } 4217711facfSdinak 42299ebb4caSwyllys static KMF_RETURN 42399ebb4caSwyllys pk_import_file_crl(void *kmfhandle, 42499ebb4caSwyllys char *infile, 42599ebb4caSwyllys char *outfile, 42699ebb4caSwyllys char *outdir, 42799ebb4caSwyllys KMF_ENCODE_FORMAT outfmt) 4287711facfSdinak { 42930a5e8faSwyllys int numattr = 0; 43030a5e8faSwyllys KMF_ATTRIBUTE attrlist[8]; 43130a5e8faSwyllys KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_OPENSSL; 43230a5e8faSwyllys 43330a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR, 43430a5e8faSwyllys &kstype, sizeof (kstype)); 43530a5e8faSwyllys numattr++; 43630a5e8faSwyllys if (infile) { 43730a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 43830a5e8faSwyllys KMF_CRL_FILENAME_ATTR, infile, strlen(infile)); 43930a5e8faSwyllys numattr++; 44030a5e8faSwyllys } 44130a5e8faSwyllys if (outdir) { 44230a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 44330a5e8faSwyllys KMF_DIRPATH_ATTR, outdir, strlen(outdir)); 44430a5e8faSwyllys numattr++; 44530a5e8faSwyllys } 44630a5e8faSwyllys if (outfile) { 44730a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 44830a5e8faSwyllys KMF_CRL_OUTFILE_ATTR, outfile, strlen(outfile)); 44930a5e8faSwyllys numattr++; 45030a5e8faSwyllys } 45130a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 45230a5e8faSwyllys KMF_ENCODE_FORMAT_ATTR, &outfmt, sizeof (outfmt)); 45330a5e8faSwyllys numattr++; 4547711facfSdinak 45530a5e8faSwyllys return (kmf_import_crl(kmfhandle, numattr, attrlist)); 45699ebb4caSwyllys } 4577711facfSdinak 45899ebb4caSwyllys static KMF_RETURN 45999ebb4caSwyllys pk_import_nss_crl(void *kmfhandle, 46099ebb4caSwyllys boolean_t verify_crl_flag, 46199ebb4caSwyllys char *infile, 46299ebb4caSwyllys char *outdir, 46399ebb4caSwyllys char *prefix) 46499ebb4caSwyllys { 46599ebb4caSwyllys KMF_RETURN rv; 46630a5e8faSwyllys int numattr = 0; 46730a5e8faSwyllys KMF_ATTRIBUTE attrlist[4]; 46830a5e8faSwyllys KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_NSS; 46999ebb4caSwyllys 47099ebb4caSwyllys rv = configure_nss(kmfhandle, outdir, prefix); 47199ebb4caSwyllys if (rv != KMF_OK) 4727711facfSdinak return (rv); 4737711facfSdinak 47430a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR, 47530a5e8faSwyllys &kstype, sizeof (kstype)); 47630a5e8faSwyllys numattr++; 47730a5e8faSwyllys if (infile) { 47830a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CRL_FILENAME_ATTR, 47930a5e8faSwyllys infile, strlen(infile)); 48030a5e8faSwyllys numattr++; 48130a5e8faSwyllys } 48230a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_CRL_CHECK_ATTR, 48330a5e8faSwyllys &verify_crl_flag, sizeof (verify_crl_flag)); 48430a5e8faSwyllys numattr++; 4857711facfSdinak 48630a5e8faSwyllys return (kmf_import_crl(kmfhandle, numattr, attrlist)); 4877711facfSdinak 4887711facfSdinak } 4897711facfSdinak 49099ebb4caSwyllys static KMF_RETURN 49199ebb4caSwyllys pk_import_pk12_pk11( 49299ebb4caSwyllys KMF_HANDLE_T kmfhandle, 49399ebb4caSwyllys KMF_CREDENTIAL *p12cred, 49499ebb4caSwyllys KMF_CREDENTIAL *tokencred, 49599ebb4caSwyllys char *label, char *token_spec, 49699ebb4caSwyllys char *filename) 4977711facfSdinak { 49899ebb4caSwyllys KMF_RETURN rv = KMF_OK; 499*5b3e1433Swyllys KMF_X509_DER_CERT *certs = NULL; 50099ebb4caSwyllys KMF_RAW_KEY_DATA *keys = NULL; 50199ebb4caSwyllys int ncerts = 0; 50299ebb4caSwyllys int nkeys = 0; 50399ebb4caSwyllys int i; 50430a5e8faSwyllys KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_PK11TOKEN; 505*5b3e1433Swyllys KMF_ATTRIBUTE *attrlist = NULL; 50630a5e8faSwyllys int numattr = 0; 5077711facfSdinak 50899ebb4caSwyllys rv = select_token(kmfhandle, token_spec, FALSE); 5097711facfSdinak 51099ebb4caSwyllys if (rv != KMF_OK) { 51199ebb4caSwyllys return (rv); 5127711facfSdinak } 5137711facfSdinak 51430a5e8faSwyllys rv = kmf_import_objects(kmfhandle, filename, p12cred, 51530a5e8faSwyllys &certs, &ncerts, &keys, &nkeys); 5167711facfSdinak 51799ebb4caSwyllys if (rv == KMF_OK) { 518*5b3e1433Swyllys NEW_ATTRLIST(attrlist, (3 + (2 * nkeys))); 51930a5e8faSwyllys 52030a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 52130a5e8faSwyllys KMF_KEYSTORE_TYPE_ATTR, &kstype, 52230a5e8faSwyllys sizeof (kstype)); 52330a5e8faSwyllys numattr++; 52430a5e8faSwyllys 52530a5e8faSwyllys if (label != NULL) { 52630a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 52730a5e8faSwyllys KMF_KEYLABEL_ATTR, label, 52830a5e8faSwyllys strlen(label)); 52930a5e8faSwyllys numattr++; 53030a5e8faSwyllys } 53130a5e8faSwyllys 53230a5e8faSwyllys if (tokencred != NULL && tokencred->credlen > 0) { 53330a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 53430a5e8faSwyllys KMF_CREDENTIAL_ATTR, tokencred, 53530a5e8faSwyllys sizeof (KMF_CREDENTIAL)); 53630a5e8faSwyllys numattr++; 53730a5e8faSwyllys } 5387711facfSdinak 53999ebb4caSwyllys /* The order of certificates and keys should match */ 54099ebb4caSwyllys for (i = 0; i < nkeys; i++) { 54130a5e8faSwyllys int num = numattr; 54230a5e8faSwyllys 543*5b3e1433Swyllys if (i < ncerts) { 544*5b3e1433Swyllys kmf_set_attr_at_index(attrlist, num, 545*5b3e1433Swyllys KMF_CERT_DATA_ATTR, &certs[i].certificate, 546*5b3e1433Swyllys sizeof (KMF_DATA)); 547*5b3e1433Swyllys num++; 548*5b3e1433Swyllys } 54930a5e8faSwyllys 55030a5e8faSwyllys kmf_set_attr_at_index(attrlist, num, 55130a5e8faSwyllys KMF_RAW_KEY_ATTR, &keys[i], 55230a5e8faSwyllys sizeof (KMF_RAW_KEY_DATA)); 55330a5e8faSwyllys num++; 55430a5e8faSwyllys 55530a5e8faSwyllys rv = kmf_store_key(kmfhandle, num, attrlist); 5567711facfSdinak 55799ebb4caSwyllys } 558*5b3e1433Swyllys free(attrlist); 5597711facfSdinak } 5607711facfSdinak 56199ebb4caSwyllys if (rv == KMF_OK) { 562*5b3e1433Swyllys numattr = 0; 563*5b3e1433Swyllys NEW_ATTRLIST(attrlist, (1 + (2 * ncerts))); 5647711facfSdinak 56599ebb4caSwyllys (void) printf(gettext("Found %d certificate(s) and %d " 56630a5e8faSwyllys "key(s) in %s\n"), ncerts, nkeys, filename); 567*5b3e1433Swyllys 56830a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 56930a5e8faSwyllys KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype)); 57030a5e8faSwyllys numattr++; 5717711facfSdinak 57299ebb4caSwyllys for (i = 0; rv == KMF_OK && i < ncerts; i++) { 57330a5e8faSwyllys int num = numattr; 574*5b3e1433Swyllys if (certs[i].kmf_private.label != NULL) { 575*5b3e1433Swyllys kmf_set_attr_at_index(attrlist, num, 576*5b3e1433Swyllys KMF_CERT_LABEL_ATTR, 577*5b3e1433Swyllys certs[i].kmf_private.label, 578*5b3e1433Swyllys strlen(certs[i].kmf_private.label)); 579*5b3e1433Swyllys num++; 580*5b3e1433Swyllys } else if (i == 0 && label != NULL) { 58130a5e8faSwyllys kmf_set_attr_at_index(attrlist, num, 58230a5e8faSwyllys KMF_CERT_LABEL_ATTR, label, strlen(label)); 58330a5e8faSwyllys num++; 58430a5e8faSwyllys } 5857711facfSdinak 58630a5e8faSwyllys kmf_set_attr_at_index(attrlist, num, 587*5b3e1433Swyllys KMF_CERT_DATA_ATTR, &certs[i].certificate, 588*5b3e1433Swyllys sizeof (KMF_DATA)); 58930a5e8faSwyllys num++; 59030a5e8faSwyllys 59130a5e8faSwyllys rv = kmf_store_cert(kmfhandle, num, attrlist); 59299ebb4caSwyllys } 593*5b3e1433Swyllys free(attrlist); 5947711facfSdinak } 5957711facfSdinak 596*5b3e1433Swyllys end: 59799ebb4caSwyllys /* 59899ebb4caSwyllys * Cleanup memory. 59999ebb4caSwyllys */ 60099ebb4caSwyllys if (certs) { 60199ebb4caSwyllys for (i = 0; i < ncerts; i++) 602*5b3e1433Swyllys kmf_free_kmf_cert(kmfhandle, &certs[i]); 60399ebb4caSwyllys free(certs); 60499ebb4caSwyllys } 60599ebb4caSwyllys if (keys) { 60699ebb4caSwyllys for (i = 0; i < nkeys; i++) 60730a5e8faSwyllys kmf_free_raw_key(&keys[i]); 60899ebb4caSwyllys free(keys); 6097711facfSdinak } 6107711facfSdinak 61199ebb4caSwyllys return (rv); 6127711facfSdinak } 6137711facfSdinak 61446d33f7eSwyllys /*ARGSUSED*/ 61530a5e8faSwyllys static KMF_RETURN 61630a5e8faSwyllys pk_import_keys(KMF_HANDLE_T kmfhandle, 61730a5e8faSwyllys KMF_KEYSTORE_TYPE kstype, char *token_spec, 61830a5e8faSwyllys KMF_CREDENTIAL *cred, char *filename, 61930a5e8faSwyllys char *label, char *senstr, char *extstr) 62030a5e8faSwyllys { 62130a5e8faSwyllys KMF_RETURN rv = KMF_OK; 62230a5e8faSwyllys KMF_ATTRIBUTE attrlist[16]; 62330a5e8faSwyllys KMF_KEYSTORE_TYPE fileks = KMF_KEYSTORE_OPENSSL; 62430a5e8faSwyllys int numattr = 0; 62530a5e8faSwyllys KMF_KEY_HANDLE key; 62630a5e8faSwyllys KMF_RAW_KEY_DATA rawkey; 62730a5e8faSwyllys KMF_KEY_CLASS class = KMF_ASYM_PRI; 62830a5e8faSwyllys int numkeys = 1; 62930a5e8faSwyllys 63030a5e8faSwyllys if (kstype == KMF_KEYSTORE_PK11TOKEN) { 63130a5e8faSwyllys rv = select_token(kmfhandle, token_spec, FALSE); 63230a5e8faSwyllys } 63330a5e8faSwyllys if (rv != KMF_OK) 63430a5e8faSwyllys return (rv); 63530a5e8faSwyllys /* 63630a5e8faSwyllys * First, set up to read the keyfile using the FILE plugin 63730a5e8faSwyllys * mechanisms. 63830a5e8faSwyllys */ 63930a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR, 64030a5e8faSwyllys &fileks, sizeof (fileks)); 64130a5e8faSwyllys numattr++; 64230a5e8faSwyllys 64330a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_COUNT_ATTR, 64430a5e8faSwyllys &numkeys, sizeof (numkeys)); 64530a5e8faSwyllys numattr++; 64630a5e8faSwyllys 64730a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_HANDLE_ATTR, 64830a5e8faSwyllys &key, sizeof (key)); 64930a5e8faSwyllys numattr++; 65030a5e8faSwyllys 65130a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_RAW_KEY_ATTR, 65230a5e8faSwyllys &rawkey, sizeof (rawkey)); 65330a5e8faSwyllys numattr++; 65430a5e8faSwyllys 65530a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYCLASS_ATTR, 65630a5e8faSwyllys &class, sizeof (class)); 65730a5e8faSwyllys numattr++; 65830a5e8faSwyllys 65930a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_FILENAME_ATTR, 66030a5e8faSwyllys filename, strlen(filename)); 66130a5e8faSwyllys numattr++; 66230a5e8faSwyllys 66330a5e8faSwyllys rv = kmf_find_key(kmfhandle, numattr, attrlist); 66430a5e8faSwyllys if (rv == KMF_OK) { 66530a5e8faSwyllys numattr = 0; 66630a5e8faSwyllys 66730a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR, 66830a5e8faSwyllys &kstype, sizeof (kstype)); 66930a5e8faSwyllys numattr++; 67030a5e8faSwyllys 67130a5e8faSwyllys if (cred != NULL && cred->credlen > 0) { 67230a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 67330a5e8faSwyllys KMF_CREDENTIAL_ATTR, cred, sizeof (KMF_CREDENTIAL)); 67430a5e8faSwyllys numattr++; 67530a5e8faSwyllys } 67630a5e8faSwyllys 67730a5e8faSwyllys if (label != NULL) { 67830a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 67930a5e8faSwyllys KMF_KEYLABEL_ATTR, label, strlen(label)); 68030a5e8faSwyllys numattr++; 68130a5e8faSwyllys } 68230a5e8faSwyllys 68330a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 68430a5e8faSwyllys KMF_RAW_KEY_ATTR, &rawkey, sizeof (rawkey)); 68530a5e8faSwyllys numattr++; 68630a5e8faSwyllys 68730a5e8faSwyllys rv = kmf_store_key(kmfhandle, numattr, attrlist); 68830a5e8faSwyllys if (rv == KMF_OK) { 68946d33f7eSwyllys (void) printf(gettext("Importing %d keys\n"), numkeys); 69030a5e8faSwyllys } 69130a5e8faSwyllys 69230a5e8faSwyllys kmf_free_kmf_key(kmfhandle, &key); 69330a5e8faSwyllys kmf_free_raw_key(&rawkey); 69430a5e8faSwyllys } else { 69530a5e8faSwyllys cryptoerror(LOG_STDERR, 69630a5e8faSwyllys gettext("Failed to load key from file (%s)\n"), 69730a5e8faSwyllys filename); 69830a5e8faSwyllys } 69930a5e8faSwyllys return (rv); 70030a5e8faSwyllys } 70130a5e8faSwyllys 70230a5e8faSwyllys static KMF_RETURN 70330a5e8faSwyllys pk_import_rawkey(KMF_HANDLE_T kmfhandle, 70430a5e8faSwyllys KMF_KEYSTORE_TYPE kstype, char *token, 70530a5e8faSwyllys KMF_CREDENTIAL *cred, 70630a5e8faSwyllys char *filename, char *label, KMF_KEY_ALG keyAlg, 70730a5e8faSwyllys char *senstr, char *extstr) 70830a5e8faSwyllys { 70930a5e8faSwyllys KMF_RETURN rv = KMF_OK; 71030a5e8faSwyllys KMF_ATTRIBUTE attrlist[16]; 71130a5e8faSwyllys int numattr = 0; 71230a5e8faSwyllys uint32_t keylen; 71330a5e8faSwyllys boolean_t sensitive = B_FALSE; 71430a5e8faSwyllys boolean_t not_extractable = B_FALSE; 71530a5e8faSwyllys KMF_DATA keydata = {NULL, 0}; 71630a5e8faSwyllys KMF_KEY_HANDLE rawkey; 71730a5e8faSwyllys 71830a5e8faSwyllys rv = kmf_read_input_file(kmfhandle, filename, &keydata); 71930a5e8faSwyllys if (rv != KMF_OK) 72030a5e8faSwyllys return (rv); 72130a5e8faSwyllys 72230a5e8faSwyllys rv = select_token(kmfhandle, token, FALSE); 72330a5e8faSwyllys 72430a5e8faSwyllys if (rv != KMF_OK) { 72530a5e8faSwyllys return (rv); 72630a5e8faSwyllys } 72730a5e8faSwyllys if (senstr != NULL) { 72830a5e8faSwyllys if (tolower(senstr[0]) == 'y') 72930a5e8faSwyllys sensitive = B_TRUE; 73030a5e8faSwyllys else if (tolower(senstr[0]) == 'n') 73130a5e8faSwyllys sensitive = B_FALSE; 73230a5e8faSwyllys else { 73330a5e8faSwyllys cryptoerror(LOG_STDERR, 73430a5e8faSwyllys gettext("Incorrect sensitive option value.\n")); 73530a5e8faSwyllys return (KMF_ERR_BAD_PARAMETER); 73630a5e8faSwyllys } 73730a5e8faSwyllys } 73830a5e8faSwyllys 73930a5e8faSwyllys if (extstr != NULL) { 74030a5e8faSwyllys if (tolower(extstr[0]) == 'y') 74130a5e8faSwyllys not_extractable = B_FALSE; 74230a5e8faSwyllys else if (tolower(extstr[0]) == 'n') 74330a5e8faSwyllys not_extractable = B_TRUE; 74430a5e8faSwyllys else { 74530a5e8faSwyllys cryptoerror(LOG_STDERR, 74630a5e8faSwyllys gettext("Incorrect extractable option value.\n")); 74730a5e8faSwyllys return (KMF_ERR_BAD_PARAMETER); 74830a5e8faSwyllys } 74930a5e8faSwyllys } 75030a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 75130a5e8faSwyllys KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype)); 75230a5e8faSwyllys numattr++; 75330a5e8faSwyllys 75430a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 75530a5e8faSwyllys KMF_KEY_HANDLE_ATTR, &rawkey, sizeof (rawkey)); 75630a5e8faSwyllys numattr++; 75730a5e8faSwyllys 75830a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 75930a5e8faSwyllys KMF_KEYALG_ATTR, &keyAlg, sizeof (KMF_KEY_ALG)); 76030a5e8faSwyllys numattr++; 76130a5e8faSwyllys 76230a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 76330a5e8faSwyllys KMF_KEY_DATA_ATTR, keydata.Data, keydata.Length); 76430a5e8faSwyllys numattr++; 76530a5e8faSwyllys 76630a5e8faSwyllys /* Key length is given in bits not bytes */ 76730a5e8faSwyllys keylen = keydata.Length * 8; 76830a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 76930a5e8faSwyllys KMF_KEYLENGTH_ATTR, &keylen, sizeof (keydata.Length)); 77030a5e8faSwyllys numattr++; 77130a5e8faSwyllys 77230a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 77330a5e8faSwyllys KMF_SENSITIVE_BOOL_ATTR, &sensitive, sizeof (sensitive)); 77430a5e8faSwyllys numattr++; 77530a5e8faSwyllys 77630a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 77730a5e8faSwyllys KMF_NON_EXTRACTABLE_BOOL_ATTR, ¬_extractable, 77830a5e8faSwyllys sizeof (not_extractable)); 77930a5e8faSwyllys numattr++; 78030a5e8faSwyllys 78130a5e8faSwyllys if (label != NULL) { 78230a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 78330a5e8faSwyllys KMF_KEYLABEL_ATTR, label, strlen(label)); 78430a5e8faSwyllys numattr++; 78530a5e8faSwyllys } 78630a5e8faSwyllys if (cred != NULL && cred->credlen > 0) { 78730a5e8faSwyllys kmf_set_attr_at_index(attrlist, numattr, 78830a5e8faSwyllys KMF_CREDENTIAL_ATTR, cred, sizeof (KMF_CREDENTIAL)); 78930a5e8faSwyllys numattr++; 79030a5e8faSwyllys } 79130a5e8faSwyllys rv = kmf_create_sym_key(kmfhandle, numattr, attrlist); 79230a5e8faSwyllys 79330a5e8faSwyllys return (rv); 79430a5e8faSwyllys } 79530a5e8faSwyllys 7967711facfSdinak /* 79799ebb4caSwyllys * Import objects from into KMF repositories. 7987711facfSdinak */ 7997711facfSdinak int 8007711facfSdinak pk_import(int argc, char *argv[]) 8017711facfSdinak { 80249e21299Sdinak int opt; 80349e21299Sdinak extern int optind_av; 80449e21299Sdinak extern char *optarg_av; 80549e21299Sdinak char *token_spec = NULL; 8067711facfSdinak char *filename = NULL; 80799ebb4caSwyllys char *keyfile = NULL; 80899ebb4caSwyllys char *certfile = NULL; 80999ebb4caSwyllys char *crlfile = NULL; 81030a5e8faSwyllys char *label = NULL; 81199ebb4caSwyllys char *dir = NULL; 81299ebb4caSwyllys char *keydir = NULL; 81399ebb4caSwyllys char *prefix = NULL; 81499ebb4caSwyllys char *trustflags = NULL; 81599ebb4caSwyllys char *verify_crl = NULL; 81630a5e8faSwyllys char *keytype = "generic"; 81730a5e8faSwyllys char *senstr = NULL; 81830a5e8faSwyllys char *extstr = NULL; 81999ebb4caSwyllys boolean_t verify_crl_flag = B_FALSE; 82099ebb4caSwyllys int oclass = 0; 82199ebb4caSwyllys KMF_KEYSTORE_TYPE kstype = 0; 82299ebb4caSwyllys KMF_ENCODE_FORMAT kfmt = 0; 82399ebb4caSwyllys KMF_ENCODE_FORMAT okfmt = KMF_FORMAT_ASN1; 82499ebb4caSwyllys KMF_RETURN rv = KMF_OK; 82599ebb4caSwyllys KMF_CREDENTIAL pk12cred = { NULL, 0 }; 82699ebb4caSwyllys KMF_CREDENTIAL tokencred = { NULL, 0 }; 82799ebb4caSwyllys KMF_HANDLE_T kmfhandle = NULL; 82830a5e8faSwyllys KMF_KEY_ALG keyAlg = KMF_GENERIC_SECRET; 8297711facfSdinak 83049e21299Sdinak /* Parse command line options. Do NOT i18n/l10n. */ 83199ebb4caSwyllys while ((opt = getopt_av(argc, argv, 83230a5e8faSwyllys "T:(token)i:(infile)" 83330a5e8faSwyllys "k:(keystore)y:(objtype)" 83430a5e8faSwyllys "d:(dir)p:(prefix)" 83530a5e8faSwyllys "n:(certlabel)N:(label)" 83630a5e8faSwyllys "K:(outkey)c:(outcert)" 83730a5e8faSwyllys "v:(verifycrl)l:(outcrl)" 83830a5e8faSwyllys "E:(keytype)s:(sensitive)x:(extractable)" 83930a5e8faSwyllys "t:(trust)D:(keydir)F:(outformat)")) != EOF) { 84099ebb4caSwyllys if (EMPTYSTRING(optarg_av)) 84199ebb4caSwyllys return (PK_ERR_USAGE); 84249e21299Sdinak switch (opt) { 84349e21299Sdinak case 'T': /* token specifier */ 84449e21299Sdinak if (token_spec) 84549e21299Sdinak return (PK_ERR_USAGE); 84649e21299Sdinak token_spec = optarg_av; 84749e21299Sdinak break; 84899ebb4caSwyllys case 'c': /* output cert file name */ 84999ebb4caSwyllys if (certfile) 85099ebb4caSwyllys return (PK_ERR_USAGE); 85199ebb4caSwyllys certfile = optarg_av; 85299ebb4caSwyllys break; 85399ebb4caSwyllys case 'l': /* output CRL file name */ 85499ebb4caSwyllys if (crlfile) 85599ebb4caSwyllys return (PK_ERR_USAGE); 85699ebb4caSwyllys crlfile = optarg_av; 85799ebb4caSwyllys break; 85899ebb4caSwyllys case 'K': /* output key file name */ 85999ebb4caSwyllys if (keyfile) 86099ebb4caSwyllys return (PK_ERR_USAGE); 86199ebb4caSwyllys keyfile = optarg_av; 86299ebb4caSwyllys break; 86349e21299Sdinak case 'i': /* input file name */ 86449e21299Sdinak if (filename) 86549e21299Sdinak return (PK_ERR_USAGE); 86649e21299Sdinak filename = optarg_av; 86749e21299Sdinak break; 86899ebb4caSwyllys case 'k': 86999ebb4caSwyllys kstype = KS2Int(optarg_av); 87099ebb4caSwyllys if (kstype == 0) 87199ebb4caSwyllys return (PK_ERR_USAGE); 87299ebb4caSwyllys break; 87399ebb4caSwyllys case 'y': 87499ebb4caSwyllys oclass = OT2Int(optarg_av); 87599ebb4caSwyllys if (oclass == -1) 87699ebb4caSwyllys return (PK_ERR_USAGE); 87799ebb4caSwyllys break; 87899ebb4caSwyllys case 'd': 87999ebb4caSwyllys dir = optarg_av; 88099ebb4caSwyllys break; 88199ebb4caSwyllys case 'D': 88299ebb4caSwyllys keydir = optarg_av; 88399ebb4caSwyllys break; 88499ebb4caSwyllys case 'p': 88599ebb4caSwyllys if (prefix) 88699ebb4caSwyllys return (PK_ERR_USAGE); 88799ebb4caSwyllys prefix = optarg_av; 88899ebb4caSwyllys break; 88999ebb4caSwyllys case 'n': 89099ebb4caSwyllys case 'N': 89130a5e8faSwyllys if (label) 89299ebb4caSwyllys return (PK_ERR_USAGE); 89330a5e8faSwyllys label = optarg_av; 89499ebb4caSwyllys break; 89599ebb4caSwyllys case 'F': 89699ebb4caSwyllys okfmt = Str2Format(optarg_av); 89799ebb4caSwyllys if (okfmt == KMF_FORMAT_UNDEF) 89899ebb4caSwyllys return (PK_ERR_USAGE); 89999ebb4caSwyllys break; 90099ebb4caSwyllys case 't': 90199ebb4caSwyllys if (trustflags) 90299ebb4caSwyllys return (PK_ERR_USAGE); 90399ebb4caSwyllys trustflags = optarg_av; 90499ebb4caSwyllys break; 90599ebb4caSwyllys case 'v': 90699ebb4caSwyllys verify_crl = optarg_av; 90799ebb4caSwyllys if (tolower(verify_crl[0]) == 'y') 90899ebb4caSwyllys verify_crl_flag = B_TRUE; 90999ebb4caSwyllys else if (tolower(verify_crl[0]) == 'n') 91099ebb4caSwyllys verify_crl_flag = B_FALSE; 91199ebb4caSwyllys else 91299ebb4caSwyllys return (PK_ERR_USAGE); 91399ebb4caSwyllys break; 91430a5e8faSwyllys case 'E': 91530a5e8faSwyllys keytype = optarg_av; 91630a5e8faSwyllys break; 91730a5e8faSwyllys case 's': 91830a5e8faSwyllys if (senstr) 91930a5e8faSwyllys return (PK_ERR_USAGE); 92030a5e8faSwyllys senstr = optarg_av; 92130a5e8faSwyllys break; 92230a5e8faSwyllys case 'x': 92330a5e8faSwyllys if (extstr) 92430a5e8faSwyllys return (PK_ERR_USAGE); 92530a5e8faSwyllys extstr = optarg_av; 92630a5e8faSwyllys break; 92749e21299Sdinak default: 92849e21299Sdinak return (PK_ERR_USAGE); 92949e21299Sdinak break; 93049e21299Sdinak } 93149e21299Sdinak } 93249e21299Sdinak 93399ebb4caSwyllys /* Assume keystore = PKCS#11 if not specified */ 93499ebb4caSwyllys if (kstype == 0) 93599ebb4caSwyllys kstype = KMF_KEYSTORE_PK11TOKEN; 9367711facfSdinak 93749e21299Sdinak /* Filename arg is required. */ 93899ebb4caSwyllys if (EMPTYSTRING(filename)) { 93999ebb4caSwyllys cryptoerror(LOG_STDERR, gettext("The 'infile' parameter" 94030a5e8faSwyllys "is required for the import operation.\n")); 9417711facfSdinak return (PK_ERR_USAGE); 94299ebb4caSwyllys } 9437711facfSdinak 94449e21299Sdinak /* No additional args allowed. */ 94549e21299Sdinak argc -= optind_av; 94649e21299Sdinak argv += optind_av; 94749e21299Sdinak if (argc) 94849e21299Sdinak return (PK_ERR_USAGE); 9497711facfSdinak 95099ebb4caSwyllys /* if PUBLIC or PRIVATE obj was given, the old syntax was used. */ 95199ebb4caSwyllys if ((oclass & (PK_PUBLIC_OBJ | PK_PRIVATE_OBJ)) && 95230a5e8faSwyllys kstype != KMF_KEYSTORE_PK11TOKEN) { 9537711facfSdinak 95499ebb4caSwyllys (void) fprintf(stderr, gettext("The objtype parameter " 95530a5e8faSwyllys "is only relevant if keystore=pkcs11\n")); 95699ebb4caSwyllys return (PK_ERR_USAGE); 95799ebb4caSwyllys } 9587711facfSdinak 95999ebb4caSwyllys /* 96099ebb4caSwyllys * You must specify a certlabel (cert label) when importing 96199ebb4caSwyllys * into NSS or PKCS#11. 96299ebb4caSwyllys */ 96399ebb4caSwyllys if (kstype == KMF_KEYSTORE_NSS && 96430a5e8faSwyllys (oclass != PK_CRL_OBJ) && EMPTYSTRING(label)) { 96599ebb4caSwyllys cryptoerror(LOG_STDERR, gettext("The 'label' argument " 96630a5e8faSwyllys "is required for this operation\n")); 96799ebb4caSwyllys return (PK_ERR_USAGE); 9687711facfSdinak } 9697711facfSdinak 97030a5e8faSwyllys if ((rv = kmf_get_file_format(filename, &kfmt)) != KMF_OK) { 97130a5e8faSwyllys /* 97230a5e8faSwyllys * Allow for raw key data to be imported. 97330a5e8faSwyllys */ 97430a5e8faSwyllys if (rv == KMF_ERR_ENCODING) { 97530a5e8faSwyllys rv = KMF_OK; 97630a5e8faSwyllys kfmt = KMF_FORMAT_RAWKEY; 97730a5e8faSwyllys /* 97830a5e8faSwyllys * Set the object class only if it was not 97930a5e8faSwyllys * given on the command line or if it was 98030a5e8faSwyllys * specified as a symmetric key object. 98130a5e8faSwyllys */ 98230a5e8faSwyllys if (oclass == 0 || (oclass & PK_SYMKEY_OBJ)) { 98330a5e8faSwyllys oclass = PK_SYMKEY_OBJ; 98430a5e8faSwyllys } else { 98530a5e8faSwyllys cryptoerror(LOG_STDERR, gettext( 98630a5e8faSwyllys "The input file does not contain the " 98730a5e8faSwyllys "object type indicated on command " 98830a5e8faSwyllys "line.")); 98930a5e8faSwyllys return (KMF_ERR_BAD_PARAMETER); 99030a5e8faSwyllys } 99130a5e8faSwyllys } else { 99230a5e8faSwyllys cryptoerror(LOG_STDERR, 99330a5e8faSwyllys gettext("File format not recognized.")); 99430a5e8faSwyllys return (rv); 99599ebb4caSwyllys } 9967711facfSdinak } 9977711facfSdinak 99830a5e8faSwyllys /* Check parameters for raw key import operation */ 99930a5e8faSwyllys if (kfmt == KMF_FORMAT_RAWKEY) { 100030a5e8faSwyllys if (keytype != NULL && 100130a5e8faSwyllys Str2SymKeyType(keytype, &keyAlg) != 0) { 100230a5e8faSwyllys cryptoerror(LOG_STDERR, 100330a5e8faSwyllys gettext("Unrecognized keytype(%s).\n"), keytype); 100430a5e8faSwyllys return (PK_ERR_USAGE); 100530a5e8faSwyllys } 100630a5e8faSwyllys if (senstr != NULL && extstr != NULL && 100730a5e8faSwyllys kstype != KMF_KEYSTORE_PK11TOKEN) { 100830a5e8faSwyllys cryptoerror(LOG_STDERR, 100930a5e8faSwyllys gettext("The sensitive or extractable option " 101030a5e8faSwyllys "applies only when importing a key from a file " 101130a5e8faSwyllys "into a PKCS#11 keystore.\n")); 101230a5e8faSwyllys return (PK_ERR_USAGE); 101330a5e8faSwyllys } 10147711facfSdinak } 101530a5e8faSwyllys 101630a5e8faSwyllys /* If no objtype was given, treat it as a certificate */ 101799ebb4caSwyllys if (oclass == 0 && (kfmt == KMF_FORMAT_ASN1 || 101830a5e8faSwyllys kfmt == KMF_FORMAT_PEM)) 101999ebb4caSwyllys oclass = PK_CERT_OBJ; 10207711facfSdinak 102199ebb4caSwyllys if (kstype == KMF_KEYSTORE_NSS) { 102299ebb4caSwyllys if (oclass == PK_CRL_OBJ && 102330a5e8faSwyllys (kfmt != KMF_FORMAT_ASN1 && kfmt != KMF_FORMAT_PEM)) { 102499ebb4caSwyllys cryptoerror(LOG_STDERR, gettext( 102530a5e8faSwyllys "CRL data can only be imported as DER or " 102630a5e8faSwyllys "PEM format")); 102799ebb4caSwyllys return (PK_ERR_USAGE); 102899ebb4caSwyllys } 10297711facfSdinak 103099ebb4caSwyllys if (oclass == PK_CERT_OBJ && 103130a5e8faSwyllys (kfmt != KMF_FORMAT_ASN1 && kfmt != KMF_FORMAT_PEM)) { 103299ebb4caSwyllys cryptoerror(LOG_STDERR, gettext( 103330a5e8faSwyllys "Certificates can only be imported as DER or " 103430a5e8faSwyllys "PEM format")); 103599ebb4caSwyllys return (PK_ERR_USAGE); 103699ebb4caSwyllys } 10377711facfSdinak 103899ebb4caSwyllys /* we do not import private keys except in PKCS12 bundles */ 103999ebb4caSwyllys if (oclass & (PK_PRIVATE_OBJ | PK_PRIKEY_OBJ)) { 104099ebb4caSwyllys cryptoerror(LOG_STDERR, gettext( 104130a5e8faSwyllys "Private key data can only be imported as part " 104230a5e8faSwyllys "of a PKCS12 file.\n")); 104399ebb4caSwyllys return (PK_ERR_USAGE); 104499ebb4caSwyllys } 10457711facfSdinak } 10467711facfSdinak 104799ebb4caSwyllys if (kstype == KMF_KEYSTORE_OPENSSL && oclass != PK_CRL_OBJ) { 104899ebb4caSwyllys if (EMPTYSTRING(keyfile) || EMPTYSTRING(certfile)) { 10497711facfSdinak cryptoerror(LOG_STDERR, gettext( 105030a5e8faSwyllys "The 'outkey' and 'outcert' parameters " 105130a5e8faSwyllys "are required for the import operation " 105230a5e8faSwyllys "when the 'file' keystore is used.\n")); 105399ebb4caSwyllys return (PK_ERR_USAGE); 10547711facfSdinak } 105599ebb4caSwyllys } 10567711facfSdinak 105799ebb4caSwyllys if (kstype == KMF_KEYSTORE_PK11TOKEN && EMPTYSTRING(token_spec)) 105899ebb4caSwyllys token_spec = PK_DEFAULT_PK11TOKEN; 105999ebb4caSwyllys else if (kstype == KMF_KEYSTORE_NSS && EMPTYSTRING(token_spec)) 106099ebb4caSwyllys token_spec = DEFAULT_NSS_TOKEN; 106199ebb4caSwyllys 106299ebb4caSwyllys if (kfmt == KMF_FORMAT_PKCS12) { 106399ebb4caSwyllys (void) get_pk12_password(&pk12cred); 106430a5e8faSwyllys } 106599ebb4caSwyllys 106630a5e8faSwyllys if ((kfmt == KMF_FORMAT_PKCS12 || kfmt == KMF_FORMAT_RAWKEY || 106730a5e8faSwyllys (kfmt == KMF_FORMAT_PEM && (oclass & PK_KEY_OBJ))) && 106830a5e8faSwyllys (kstype == KMF_KEYSTORE_PK11TOKEN || kstype == KMF_KEYSTORE_NSS)) { 106930a5e8faSwyllys (void) get_token_password(kstype, token_spec, &tokencred); 107099ebb4caSwyllys } 107199ebb4caSwyllys 107230a5e8faSwyllys if ((rv = kmf_initialize(&kmfhandle, NULL, NULL)) != KMF_OK) { 107399ebb4caSwyllys cryptoerror(LOG_STDERR, gettext("Error initializing " 107430a5e8faSwyllys "KMF: 0x%02x\n"), rv); 107599ebb4caSwyllys goto end; 107699ebb4caSwyllys } 107799ebb4caSwyllys 107899ebb4caSwyllys switch (kstype) { 107999ebb4caSwyllys case KMF_KEYSTORE_PK11TOKEN: 108099ebb4caSwyllys if (kfmt == KMF_FORMAT_PKCS12) 108199ebb4caSwyllys rv = pk_import_pk12_pk11( 108230a5e8faSwyllys kmfhandle, &pk12cred, 108330a5e8faSwyllys &tokencred, label, 108430a5e8faSwyllys token_spec, filename); 108599ebb4caSwyllys else if (oclass == PK_CERT_OBJ) 108699ebb4caSwyllys rv = pk_import_cert( 108730a5e8faSwyllys kmfhandle, kstype, 108830a5e8faSwyllys label, token_spec, 108930a5e8faSwyllys filename, 109030a5e8faSwyllys NULL, NULL, NULL); 109199ebb4caSwyllys else if (oclass == PK_CRL_OBJ) 109299ebb4caSwyllys rv = pk_import_file_crl( 109330a5e8faSwyllys kmfhandle, filename, 109430a5e8faSwyllys crlfile, dir, okfmt); 109530a5e8faSwyllys else if (kfmt == KMF_FORMAT_RAWKEY && 109630a5e8faSwyllys oclass == PK_SYMKEY_OBJ) { 109730a5e8faSwyllys rv = pk_import_rawkey(kmfhandle, 109830a5e8faSwyllys kstype, token_spec, &tokencred, 109930a5e8faSwyllys filename, label, 110030a5e8faSwyllys keyAlg, senstr, extstr); 110130a5e8faSwyllys } else if (kfmt == KMF_FORMAT_PEM || 110230a5e8faSwyllys kfmt == KMF_FORMAT_PEM_KEYPAIR) { 110330a5e8faSwyllys rv = pk_import_keys(kmfhandle, 110430a5e8faSwyllys kstype, token_spec, &tokencred, 110530a5e8faSwyllys filename, label, senstr, extstr); 110630a5e8faSwyllys } else { 110730a5e8faSwyllys rv = PK_ERR_USAGE; 110830a5e8faSwyllys } 11097711facfSdinak break; 111099ebb4caSwyllys case KMF_KEYSTORE_NSS: 111199ebb4caSwyllys if (dir == NULL) 111299ebb4caSwyllys dir = PK_DEFAULT_DIRECTORY; 111399ebb4caSwyllys if (kfmt == KMF_FORMAT_PKCS12) 111499ebb4caSwyllys rv = pk_import_pk12_nss( 111530a5e8faSwyllys kmfhandle, &pk12cred, 111630a5e8faSwyllys &tokencred, 111730a5e8faSwyllys token_spec, dir, prefix, 111830a5e8faSwyllys label, trustflags, filename); 111999ebb4caSwyllys else if (oclass == PK_CERT_OBJ) { 112099ebb4caSwyllys rv = pk_import_cert( 112130a5e8faSwyllys kmfhandle, kstype, 112230a5e8faSwyllys label, token_spec, 112330a5e8faSwyllys filename, dir, prefix, trustflags); 112499ebb4caSwyllys } else if (oclass == PK_CRL_OBJ) { 112599ebb4caSwyllys rv = pk_import_nss_crl( 112630a5e8faSwyllys kmfhandle, verify_crl_flag, 112730a5e8faSwyllys filename, dir, prefix); 112899ebb4caSwyllys } 112999ebb4caSwyllys break; 113099ebb4caSwyllys case KMF_KEYSTORE_OPENSSL: 113199ebb4caSwyllys if (kfmt == KMF_FORMAT_PKCS12) 113299ebb4caSwyllys rv = pk_import_pk12_files( 113330a5e8faSwyllys kmfhandle, &pk12cred, 113430a5e8faSwyllys filename, certfile, keyfile, 113530a5e8faSwyllys dir, keydir, okfmt); 113699ebb4caSwyllys else if (oclass == PK_CRL_OBJ) { 113799ebb4caSwyllys rv = pk_import_file_crl( 113830a5e8faSwyllys kmfhandle, filename, 113930a5e8faSwyllys crlfile, dir, okfmt); 114099ebb4caSwyllys } else 114199ebb4caSwyllys /* 114299ebb4caSwyllys * It doesn't make sense to import anything 114399ebb4caSwyllys * else for the files plugin. 114499ebb4caSwyllys */ 114599ebb4caSwyllys return (PK_ERR_USAGE); 114699ebb4caSwyllys break; 114799ebb4caSwyllys default: 114899ebb4caSwyllys rv = PK_ERR_USAGE; 114999ebb4caSwyllys break; 115099ebb4caSwyllys } 11517711facfSdinak 115299ebb4caSwyllys end: 115399ebb4caSwyllys if (rv != KMF_OK) 115499ebb4caSwyllys display_error(kmfhandle, rv, 115530a5e8faSwyllys gettext("Error importing objects")); 11567711facfSdinak 115799ebb4caSwyllys if (tokencred.cred != NULL) 115899ebb4caSwyllys free(tokencred.cred); 11597711facfSdinak 116099ebb4caSwyllys if (pk12cred.cred != NULL) 116199ebb4caSwyllys free(pk12cred.cred); 11627711facfSdinak 116330a5e8faSwyllys (void) kmf_finalize(kmfhandle); 116499ebb4caSwyllys 116599ebb4caSwyllys if (rv != KMF_OK) 116699ebb4caSwyllys return (PK_ERR_USAGE); 11677711facfSdinak 11687711facfSdinak return (0); 11697711facfSdinak } 1170