199ebb4caSwyllys /* 299ebb4caSwyllys * CDDL HEADER START 399ebb4caSwyllys * 499ebb4caSwyllys * The contents of this file are subject to the terms of the 599ebb4caSwyllys * Common Development and Distribution License (the "License"). 699ebb4caSwyllys * You may not use this file except in compliance with the License. 799ebb4caSwyllys * 899ebb4caSwyllys * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 999ebb4caSwyllys * or http://www.opensolaris.org/os/licensing. 1099ebb4caSwyllys * See the License for the specific language governing permissions 1199ebb4caSwyllys * and limitations under the License. 1299ebb4caSwyllys * 1399ebb4caSwyllys * When distributing Covered Code, include this CDDL HEADER in each 1499ebb4caSwyllys * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 1599ebb4caSwyllys * If applicable, add the following below this CDDL HEADER, with the 1699ebb4caSwyllys * fields enclosed by brackets "[]" replaced with your own identifying 1799ebb4caSwyllys * information: Portions Copyright [yyyy] [name of copyright owner] 1899ebb4caSwyllys * 1999ebb4caSwyllys * CDDL HEADER END 2099ebb4caSwyllys */ 2199ebb4caSwyllys /* 22*e65e5c2dSWyllys Ingersoll * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 2399ebb4caSwyllys * Use is subject to license terms. 2499ebb4caSwyllys */ 2599ebb4caSwyllys #ifndef _KMFAPIP_H 2699ebb4caSwyllys #define _KMFAPIP_H 2799ebb4caSwyllys 2899ebb4caSwyllys #include <kmfapi.h> 2999ebb4caSwyllys #include <kmfpolicy.h> 3099ebb4caSwyllys 3199ebb4caSwyllys #ifdef __cplusplus 3299ebb4caSwyllys extern "C" { 3399ebb4caSwyllys #endif 3499ebb4caSwyllys 3599ebb4caSwyllys /* Plugin function table */ 3699ebb4caSwyllys typedef struct { 3799ebb4caSwyllys ushort_t version; 3899ebb4caSwyllys KMF_RETURN (*ConfigureKeystore) ( 3999ebb4caSwyllys KMF_HANDLE_T, 4030a5e8faSwyllys int, 4130a5e8faSwyllys KMF_ATTRIBUTE *); 4299ebb4caSwyllys 4399ebb4caSwyllys KMF_RETURN (*FindCert) ( 4499ebb4caSwyllys KMF_HANDLE_T, 4530a5e8faSwyllys int, 4630a5e8faSwyllys KMF_ATTRIBUTE *); 4799ebb4caSwyllys 4899ebb4caSwyllys void (*FreeKMFCert) ( 4999ebb4caSwyllys KMF_HANDLE_T, 5099ebb4caSwyllys KMF_X509_DER_CERT *); 5199ebb4caSwyllys 5299ebb4caSwyllys KMF_RETURN (*StoreCert) ( 5399ebb4caSwyllys KMF_HANDLE_T, 5430a5e8faSwyllys int, KMF_ATTRIBUTE *); 5599ebb4caSwyllys 5699ebb4caSwyllys KMF_RETURN (*ImportCert) ( 5799ebb4caSwyllys KMF_HANDLE_T, 5830a5e8faSwyllys int, KMF_ATTRIBUTE *); 5999ebb4caSwyllys 6099ebb4caSwyllys KMF_RETURN (*ImportCRL) ( 6199ebb4caSwyllys KMF_HANDLE_T, 6230a5e8faSwyllys int, KMF_ATTRIBUTE *); 6399ebb4caSwyllys 6499ebb4caSwyllys KMF_RETURN (*DeleteCert) ( 6599ebb4caSwyllys KMF_HANDLE_T, 6630a5e8faSwyllys int, KMF_ATTRIBUTE *); 6799ebb4caSwyllys 6899ebb4caSwyllys KMF_RETURN (*DeleteCRL) ( 6999ebb4caSwyllys KMF_HANDLE_T, 7030a5e8faSwyllys int, KMF_ATTRIBUTE *); 7199ebb4caSwyllys 7299ebb4caSwyllys KMF_RETURN (*CreateKeypair) ( 7399ebb4caSwyllys KMF_HANDLE_T, 7430a5e8faSwyllys int, 7530a5e8faSwyllys KMF_ATTRIBUTE *); 7699ebb4caSwyllys 7799ebb4caSwyllys KMF_RETURN (*FindKey) ( 7899ebb4caSwyllys KMF_HANDLE_T, 7930a5e8faSwyllys int, 8030a5e8faSwyllys KMF_ATTRIBUTE *); 8199ebb4caSwyllys 8299ebb4caSwyllys KMF_RETURN (*EncodePubkeyData) ( 8399ebb4caSwyllys KMF_HANDLE_T, 8499ebb4caSwyllys KMF_KEY_HANDLE *, 8599ebb4caSwyllys KMF_DATA *); 8699ebb4caSwyllys 8799ebb4caSwyllys KMF_RETURN (*SignData) ( 8899ebb4caSwyllys KMF_HANDLE_T, 8999ebb4caSwyllys KMF_KEY_HANDLE *, 9099ebb4caSwyllys KMF_OID *, 9199ebb4caSwyllys KMF_DATA *, 9299ebb4caSwyllys KMF_DATA *); 9399ebb4caSwyllys 9499ebb4caSwyllys KMF_RETURN (*DeleteKey) ( 9599ebb4caSwyllys KMF_HANDLE_T, 9630a5e8faSwyllys int, 9730a5e8faSwyllys KMF_ATTRIBUTE *); 9899ebb4caSwyllys 9999ebb4caSwyllys KMF_RETURN (*ListCRL) ( 10099ebb4caSwyllys KMF_HANDLE_T, 10130a5e8faSwyllys int, KMF_ATTRIBUTE *); 10299ebb4caSwyllys 10399ebb4caSwyllys KMF_RETURN (*FindCRL) ( 10499ebb4caSwyllys KMF_HANDLE_T, 10530a5e8faSwyllys int, KMF_ATTRIBUTE *); 10699ebb4caSwyllys 10799ebb4caSwyllys KMF_RETURN (*FindCertInCRL) ( 10899ebb4caSwyllys KMF_HANDLE_T, 10930a5e8faSwyllys int, KMF_ATTRIBUTE *); 11099ebb4caSwyllys 11199ebb4caSwyllys KMF_RETURN (*GetErrorString) ( 11299ebb4caSwyllys KMF_HANDLE_T, 11399ebb4caSwyllys char **); 11499ebb4caSwyllys 11530a5e8faSwyllys KMF_RETURN (*FindPrikeyByCert) ( 11699ebb4caSwyllys KMF_HANDLE_T, 11730a5e8faSwyllys int, 11830a5e8faSwyllys KMF_ATTRIBUTE *); 11999ebb4caSwyllys 12099ebb4caSwyllys KMF_RETURN (*DecryptData) ( 12199ebb4caSwyllys KMF_HANDLE_T, 12299ebb4caSwyllys KMF_KEY_HANDLE *, 12399ebb4caSwyllys KMF_OID *, 12499ebb4caSwyllys KMF_DATA *, 12599ebb4caSwyllys KMF_DATA *); 12699ebb4caSwyllys 12730a5e8faSwyllys KMF_RETURN (*ExportPK12)( 12899ebb4caSwyllys KMF_HANDLE_T, 12930a5e8faSwyllys int, 13030a5e8faSwyllys KMF_ATTRIBUTE *); 13199ebb4caSwyllys 13299ebb4caSwyllys KMF_RETURN (*CreateSymKey) ( 13399ebb4caSwyllys KMF_HANDLE_T, 13430a5e8faSwyllys int, 13530a5e8faSwyllys KMF_ATTRIBUTE *); 13699ebb4caSwyllys 13799ebb4caSwyllys KMF_RETURN (*GetSymKeyValue) ( 13899ebb4caSwyllys KMF_HANDLE_T, 13999ebb4caSwyllys KMF_KEY_HANDLE *, 14099ebb4caSwyllys KMF_RAW_SYM_KEY *); 14199ebb4caSwyllys 14299ebb4caSwyllys KMF_RETURN (*SetTokenPin) ( 14399ebb4caSwyllys KMF_HANDLE_T, 14430a5e8faSwyllys int, KMF_ATTRIBUTE *); 14599ebb4caSwyllys 14630a5e8faSwyllys KMF_RETURN (*StoreKey) ( 14730a5e8faSwyllys KMF_HANDLE_T, 14830a5e8faSwyllys int, 14930a5e8faSwyllys KMF_ATTRIBUTE *); 15030a5e8faSwyllys 15199ebb4caSwyllys void (*Finalize) (); 15299ebb4caSwyllys 15399ebb4caSwyllys } KMF_PLUGIN_FUNCLIST; 15499ebb4caSwyllys 15530a5e8faSwyllys typedef struct { 15630a5e8faSwyllys KMF_ATTR_TYPE type; 15730a5e8faSwyllys boolean_t null_value_ok; /* Is the pValue required */ 15830a5e8faSwyllys uint32_t minlen; 15930a5e8faSwyllys uint32_t maxlen; 16030a5e8faSwyllys } KMF_ATTRIBUTE_TESTER; 16130a5e8faSwyllys 16299ebb4caSwyllys typedef struct { 16399ebb4caSwyllys KMF_KEYSTORE_TYPE type; 16499ebb4caSwyllys char *applications; 16599ebb4caSwyllys char *path; 16699ebb4caSwyllys void *dldesc; 16799ebb4caSwyllys KMF_PLUGIN_FUNCLIST *funclist; 16899ebb4caSwyllys } KMF_PLUGIN; 16999ebb4caSwyllys 17099ebb4caSwyllys typedef struct _KMF_PLUGIN_LIST { 17199ebb4caSwyllys KMF_PLUGIN *plugin; 17299ebb4caSwyllys struct _KMF_PLUGIN_LIST *next; 17399ebb4caSwyllys } KMF_PLUGIN_LIST; 17499ebb4caSwyllys 17599ebb4caSwyllys typedef struct _kmf_handle { 17699ebb4caSwyllys /* 17730a5e8faSwyllys * session handle opened by kmf_select_token() to talk 17899ebb4caSwyllys * to a specific slot in Crypto framework. It is used 17999ebb4caSwyllys * by pkcs11 plugin module. 18099ebb4caSwyllys */ 18199ebb4caSwyllys CK_SESSION_HANDLE pk11handle; 18299ebb4caSwyllys KMF_ERROR lasterr; 18399ebb4caSwyllys KMF_POLICY_RECORD *policy; 18499ebb4caSwyllys KMF_PLUGIN_LIST *plugins; 18599ebb4caSwyllys } KMF_HANDLE; 18699ebb4caSwyllys 18799ebb4caSwyllys #define CLEAR_ERROR(h, rv) { \ 18899ebb4caSwyllys if (h == NULL) { \ 18999ebb4caSwyllys rv = KMF_ERR_BAD_PARAMETER; \ 19099ebb4caSwyllys } else { \ 19199ebb4caSwyllys h->lasterr.errcode = 0; \ 19299ebb4caSwyllys h->lasterr.kstype = 0; \ 19399ebb4caSwyllys rv = KMF_OK; \ 19499ebb4caSwyllys } \ 19599ebb4caSwyllys } 19699ebb4caSwyllys 19799ebb4caSwyllys #define KMF_PLUGIN_INIT_SYMBOL "KMF_Plugin_Initialize" 19899ebb4caSwyllys 19999ebb4caSwyllys #ifndef KMF_PLUGIN_PATH 20099ebb4caSwyllys #if defined(__sparcv9) 201257873cfSJohn.Zolnowsky@Sun.COM #define KMF_PLUGIN_PATH "/lib/crypto/sparcv9/" 20299ebb4caSwyllys #elif defined(__sparc) 203257873cfSJohn.Zolnowsky@Sun.COM #define KMF_PLUGIN_PATH "/lib/crypto/" 20499ebb4caSwyllys #elif defined(__i386) 205257873cfSJohn.Zolnowsky@Sun.COM #define KMF_PLUGIN_PATH "/lib/crypto/" 20699ebb4caSwyllys #elif defined(__amd64) 207257873cfSJohn.Zolnowsky@Sun.COM #define KMF_PLUGIN_PATH "/lib/crypto/amd64/" 20899ebb4caSwyllys #endif 20999ebb4caSwyllys #endif /* !KMF_PLUGIN_PATH */ 21099ebb4caSwyllys 21199ebb4caSwyllys KMF_PLUGIN_FUNCLIST *KMF_Plugin_Initialize(); 21299ebb4caSwyllys 213d00756ccSwyllys extern KMF_RETURN 214d00756ccSwyllys VerifyDataWithKey(KMF_HANDLE_T, KMF_DATA *, KMF_ALGORITHM_INDEX, 215d00756ccSwyllys KMF_DATA *, KMF_DATA *); 216d00756ccSwyllys 217d00756ccSwyllys extern KMF_BOOL pkcs_algid_to_keytype( 218d00756ccSwyllys KMF_ALGORITHM_INDEX, CK_KEY_TYPE *); 219d00756ccSwyllys 220*e65e5c2dSWyllys Ingersoll extern KMF_RETURN PKCS_DigestData(KMF_HANDLE_T, 221*e65e5c2dSWyllys Ingersoll CK_SESSION_HANDLE, CK_MECHANISM_TYPE, 222*e65e5c2dSWyllys Ingersoll KMF_DATA *, KMF_DATA *, boolean_t); 223*e65e5c2dSWyllys Ingersoll 224d00756ccSwyllys extern KMF_RETURN PKCS_VerifyData( 225d00756ccSwyllys KMF_HANDLE *, 226d00756ccSwyllys KMF_ALGORITHM_INDEX, 227d00756ccSwyllys KMF_X509_SPKI *, 228d00756ccSwyllys KMF_DATA *, KMF_DATA *); 229d00756ccSwyllys 230d00756ccSwyllys extern KMF_RETURN PKCS_EncryptData( 231d00756ccSwyllys KMF_HANDLE *, 232d00756ccSwyllys KMF_ALGORITHM_INDEX, 233d00756ccSwyllys KMF_X509_SPKI *, 234d00756ccSwyllys KMF_DATA *, 235d00756ccSwyllys KMF_DATA *); 236d00756ccSwyllys 237d00756ccSwyllys extern KMF_PLUGIN *FindPlugin(KMF_HANDLE_T, KMF_KEYSTORE_TYPE); 238d00756ccSwyllys 239d00756ccSwyllys extern KMF_BOOL IsEqualOid(KMF_OID *, KMF_OID *); 240d00756ccSwyllys 241d00756ccSwyllys extern KMF_RETURN copy_algoid(KMF_X509_ALGORITHM_IDENTIFIER *destid, 242d00756ccSwyllys KMF_X509_ALGORITHM_IDENTIFIER *srcid); 243d00756ccSwyllys 244d00756ccSwyllys extern KMF_OID *x509_algid_to_algoid(KMF_ALGORITHM_INDEX); 245d00756ccSwyllys extern KMF_ALGORITHM_INDEX x509_algoid_to_algid(KMF_OID *); 246d00756ccSwyllys 247d00756ccSwyllys extern KMF_RETURN GetIDFromSPKI(KMF_X509_SPKI *, KMF_DATA *); 248d00756ccSwyllys extern KMF_RETURN kmf_select_token(KMF_HANDLE_T, char *, int); 249d00756ccSwyllys extern KMF_RETURN kmf_set_altname(KMF_X509_EXTENSIONS *, 250d00756ccSwyllys KMF_OID *, int, KMF_GENERALNAMECHOICES, char *); 251d00756ccSwyllys extern KMF_RETURN GetSequenceContents(char *, size_t, char **, size_t *); 252d00756ccSwyllys extern KMF_X509_EXTENSION *FindExtn(KMF_X509_EXTENSIONS *, KMF_OID *); 253d00756ccSwyllys extern KMF_RETURN add_an_extension(KMF_X509_EXTENSIONS *exts, 254d00756ccSwyllys KMF_X509_EXTENSION *newextn); 255d00756ccSwyllys extern KMF_RETURN set_integer(KMF_DATA *, void *, int); 256d00756ccSwyllys extern void free_keyidlist(KMF_OID *, int); 257d00756ccSwyllys extern KMF_RETURN copy_data(KMF_DATA *, KMF_DATA *); 258d00756ccSwyllys extern void Cleanup_PK11_Session(KMF_HANDLE_T handle); 259d00756ccSwyllys extern void free_dp_name(KMF_CRL_DIST_POINT *); 260d00756ccSwyllys extern void free_dp(KMF_CRL_DIST_POINT *); 261d00756ccSwyllys extern KMF_RETURN set_key_usage_extension(KMF_X509_EXTENSIONS *, 262d00756ccSwyllys int, uint32_t); 263d00756ccSwyllys extern KMF_RETURN init_pk11(); 264d00756ccSwyllys extern KMF_RETURN test_attributes(int, KMF_ATTRIBUTE_TESTER *, 265d00756ccSwyllys int, KMF_ATTRIBUTE_TESTER *, int, KMF_ATTRIBUTE *); 26699ebb4caSwyllys 26799ebb4caSwyllys /* Indexes into the key parts array for RSA keys */ 26899ebb4caSwyllys #define KMF_RSA_MODULUS (0) 26999ebb4caSwyllys #define KMF_RSA_PUBLIC_EXPONENT (1) 27099ebb4caSwyllys #define KMF_RSA_PRIVATE_EXPONENT (2) 27199ebb4caSwyllys #define KMF_RSA_PRIME1 (3) 27299ebb4caSwyllys #define KMF_RSA_PRIME2 (4) 27399ebb4caSwyllys #define KMF_RSA_EXPONENT1 (5) 27499ebb4caSwyllys #define KMF_RSA_EXPONENT2 (6) 27599ebb4caSwyllys #define KMF_RSA_COEFFICIENT (7) 27699ebb4caSwyllys 27799ebb4caSwyllys /* Key part counts for RSA keys */ 27899ebb4caSwyllys #define KMF_NUMBER_RSA_PUBLIC_KEY_PARTS (2) 27999ebb4caSwyllys #define KMF_NUMBER_RSA_PRIVATE_KEY_PARTS (8) 28099ebb4caSwyllys 28199ebb4caSwyllys /* Key part counts for DSA keys */ 28299ebb4caSwyllys #define KMF_NUMBER_DSA_PUBLIC_KEY_PARTS (4) 28399ebb4caSwyllys #define KMF_NUMBER_DSA_PRIVATE_KEY_PARTS (4) 28499ebb4caSwyllys 28599ebb4caSwyllys /* Indexes into the key parts array for DSA keys */ 28699ebb4caSwyllys #define KMF_DSA_PRIME (0) 28799ebb4caSwyllys #define KMF_DSA_SUB_PRIME (1) 28899ebb4caSwyllys #define KMF_DSA_BASE (2) 28999ebb4caSwyllys #define KMF_DSA_PUBLIC_VALUE (3) 29099ebb4caSwyllys 291*e65e5c2dSWyllys Ingersoll #define KMF_ECDSA_PARAMS (0) 292*e65e5c2dSWyllys Ingersoll #define KMF_ECDSA_POINT (1) 293*e65e5c2dSWyllys Ingersoll 29499ebb4caSwyllys #ifndef max 29599ebb4caSwyllys #define max(a, b) ((a) < (b) ? (b) : (a)) 29699ebb4caSwyllys #endif 29799ebb4caSwyllys 29899ebb4caSwyllys /* Maximum key parts for all algorithms */ 29999ebb4caSwyllys #define KMF_MAX_PUBLIC_KEY_PARTS \ 30099ebb4caSwyllys (max(KMF_NUMBER_RSA_PUBLIC_KEY_PARTS, \ 30199ebb4caSwyllys KMF_NUMBER_DSA_PUBLIC_KEY_PARTS)) 30299ebb4caSwyllys 30399ebb4caSwyllys #define KMF_MAX_PRIVATE_KEY_PARTS \ 30499ebb4caSwyllys (max(KMF_NUMBER_RSA_PRIVATE_KEY_PARTS, \ 30599ebb4caSwyllys KMF_NUMBER_DSA_PRIVATE_KEY_PARTS)) 30699ebb4caSwyllys 30799ebb4caSwyllys #define KMF_MAX_KEY_PARTS \ 30899ebb4caSwyllys (max(KMF_MAX_PUBLIC_KEY_PARTS, KMF_MAX_PRIVATE_KEY_PARTS)) 30999ebb4caSwyllys 31099ebb4caSwyllys typedef enum { 31199ebb4caSwyllys KMF_ALGMODE_NONE = 0, 31299ebb4caSwyllys KMF_ALGMODE_CUSTOM, 31399ebb4caSwyllys KMF_ALGMODE_PUBLIC_KEY, 31499ebb4caSwyllys KMF_ALGMODE_PRIVATE_KEY, 31599ebb4caSwyllys KMF_ALGMODE_PKCS1_EMSA_V15 31699ebb4caSwyllys } KMF_SIGNATURE_MODE; 31799ebb4caSwyllys 31899ebb4caSwyllys #define KMF_CERT_PRINTABLE_LEN 1024 31999ebb4caSwyllys #define SHA1_HASH_LENGTH 20 32099ebb4caSwyllys 32199ebb4caSwyllys #define OCSPREQ_TEMPNAME "/tmp/ocsp.reqXXXXXX" 32299ebb4caSwyllys #define OCSPRESP_TEMPNAME "/tmp/ocsp.respXXXXXX" 32399ebb4caSwyllys 324431deaa0Shylee #define _PATH_KMF_CONF "/etc/crypto/kmf.conf" 325431deaa0Shylee #define CONF_MODULEPATH "modulepath=" 326431deaa0Shylee #define CONF_OPTION "option=" 327431deaa0Shylee 328431deaa0Shylee typedef struct { 329431deaa0Shylee char *keystore; 330431deaa0Shylee char *modulepath; 331431deaa0Shylee char *option; 332431deaa0Shylee KMF_KEYSTORE_TYPE kstype; 333431deaa0Shylee } conf_entry_t; 334431deaa0Shylee 335431deaa0Shylee typedef struct conf_entrylist { 336431deaa0Shylee conf_entry_t *entry; 337431deaa0Shylee struct conf_entrylist *next; 338431deaa0Shylee } conf_entrylist_t; 339431deaa0Shylee 340*e65e5c2dSWyllys Ingersoll extern KMF_RETURN get_pk11_data(KMF_ALGORITHM_INDEX, 341*e65e5c2dSWyllys Ingersoll CK_KEY_TYPE *, CK_MECHANISM_TYPE *, CK_MECHANISM_TYPE *, boolean_t); 342*e65e5c2dSWyllys Ingersoll extern KMF_RETURN kmf_create_pk11_session(CK_SESSION_HANDLE *, 343*e65e5c2dSWyllys Ingersoll CK_MECHANISM_TYPE, CK_FLAGS); 344431deaa0Shylee extern KMF_RETURN get_entrylist(conf_entrylist_t **); 345431deaa0Shylee extern void free_entrylist(conf_entrylist_t *); 346431deaa0Shylee extern void free_entry(conf_entry_t *); 347431deaa0Shylee extern conf_entry_t *dup_entry(conf_entry_t *); 348d00756ccSwyllys extern boolean_t is_valid_keystore_type(KMF_KEYSTORE_TYPE); 349d00756ccSwyllys extern KMF_BOOL is_eku_present(KMF_X509EXT_EKU *, KMF_OID *); 350d00756ccSwyllys extern KMF_RETURN parse_eku_data(const KMF_DATA *, KMF_X509EXT_EKU *); 351448b8615Swyllys extern KMF_RETURN 352448b8615Swyllys copy_extension_data(KMF_X509_EXTENSION *, KMF_X509_EXTENSION *); 353431deaa0Shylee 35499ebb4caSwyllys #ifdef __cplusplus 35599ebb4caSwyllys } 35699ebb4caSwyllys #endif 35799ebb4caSwyllys #endif /* _KMFAPIP_H */ 358