17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate  * CDDL HEADER START
37c478bd9Sstevel@tonic-gate  *
47c478bd9Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
54468f880Sdarrenm  * Common Development and Distribution License (the "License").
64468f880Sdarrenm  * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate  *
87c478bd9Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate  * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate  * and limitations under the License.
127c478bd9Sstevel@tonic-gate  *
137c478bd9Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate  *
197c478bd9Sstevel@tonic-gate  * CDDL HEADER END
207c478bd9Sstevel@tonic-gate  */
217c478bd9Sstevel@tonic-gate /*
22fb99bed9SValerie Bubb Fenwick  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
237c478bd9Sstevel@tonic-gate  */
246ea3c060SGarrett D'Amore /*
256ea3c060SGarrett D'Amore  * Copyright 2010 Nexenta Systems, Inc.  All rights reserved.
266ea3c060SGarrett D'Amore  */
277c478bd9Sstevel@tonic-gate 
287c478bd9Sstevel@tonic-gate #include <sys/types.h>
297c478bd9Sstevel@tonic-gate #include <sys/stat.h>
307c478bd9Sstevel@tonic-gate #include <dlfcn.h>
317c478bd9Sstevel@tonic-gate #include <fcntl.h>
327c478bd9Sstevel@tonic-gate #include <link.h>
337c478bd9Sstevel@tonic-gate #include <stdio.h>
347c478bd9Sstevel@tonic-gate #include <stdlib.h>
357c478bd9Sstevel@tonic-gate #include <strings.h>
367c478bd9Sstevel@tonic-gate #include <errno.h>
377c478bd9Sstevel@tonic-gate #include <pthread.h>
387c478bd9Sstevel@tonic-gate #include <sys/mman.h>
397c478bd9Sstevel@tonic-gate 
407c478bd9Sstevel@tonic-gate #include <sys/crypto/elfsign.h>
417c478bd9Sstevel@tonic-gate #include <cryptoutil.h>
427c478bd9Sstevel@tonic-gate 
437c478bd9Sstevel@tonic-gate #include <security/cryptoki.h>
447c478bd9Sstevel@tonic-gate #include "pkcs11Global.h"
457c478bd9Sstevel@tonic-gate #include "pkcs11Conf.h"
467c478bd9Sstevel@tonic-gate #include "pkcs11Slot.h"
477c478bd9Sstevel@tonic-gate #include "metaGlobal.h"
487c478bd9Sstevel@tonic-gate 
497c478bd9Sstevel@tonic-gate /*
507c478bd9Sstevel@tonic-gate  * Fastpath is used when there is only one slot available from a single provider
517c478bd9Sstevel@tonic-gate  * plugged into the framework this is the common case.
527c478bd9Sstevel@tonic-gate  * These globals are used to track the function pointers and policy when
537c478bd9Sstevel@tonic-gate  * the fast-path is activated.
547c478bd9Sstevel@tonic-gate  * This will need to be revisted if per-slot policy is ever
557c478bd9Sstevel@tonic-gate  * implemented.
567c478bd9Sstevel@tonic-gate  */
577c478bd9Sstevel@tonic-gate boolean_t purefastpath = B_FALSE;
587c478bd9Sstevel@tonic-gate boolean_t policyfastpath = B_FALSE;
597c478bd9Sstevel@tonic-gate CK_FUNCTION_LIST_PTR fast_funcs = NULL;
607c478bd9Sstevel@tonic-gate CK_SLOT_ID fast_slot = 0;
617c478bd9Sstevel@tonic-gate boolean_t metaslot_enabled = B_FALSE;
627c478bd9Sstevel@tonic-gate boolean_t metaslot_auto_key_migrate = B_FALSE;
637c478bd9Sstevel@tonic-gate metaslot_config_t metaslot_config;
64a039cd31Shaimay void (*Tmp_GetThreshold)(void *) = NULL;
65a039cd31Shaimay cipher_mechs_threshold_t meta_mechs_threshold[MAX_NUM_THRESHOLD];
667c478bd9Sstevel@tonic-gate 
67*bbf21555SRichard Lowe static const char *conf_err = "See cryptoadm(8). Skipping this plug-in.";
687c478bd9Sstevel@tonic-gate 
697c478bd9Sstevel@tonic-gate /*
707c478bd9Sstevel@tonic-gate  * Set up metaslot for the framework using either user configuration
717c478bd9Sstevel@tonic-gate  * or system wide configuration options
727c478bd9Sstevel@tonic-gate  *
737c478bd9Sstevel@tonic-gate  * Also sets up the global "slottable" to have the first slot be metaslot.
747c478bd9Sstevel@tonic-gate  */
757c478bd9Sstevel@tonic-gate static CK_RV
setup_metaslot(uentry_t * metaslot_entry)767c478bd9Sstevel@tonic-gate setup_metaslot(uentry_t *metaslot_entry) {
777c478bd9Sstevel@tonic-gate 	CK_RV rv;
787c478bd9Sstevel@tonic-gate 	CK_MECHANISM_TYPE_PTR prov_pol_mechs = NULL;
797c478bd9Sstevel@tonic-gate 	pkcs11_slot_t *cur_slot;
807c478bd9Sstevel@tonic-gate 
817c478bd9Sstevel@tonic-gate 	/* process policies for mechanisms */
827c478bd9Sstevel@tonic-gate 	if ((metaslot_entry) && (metaslot_entry->count > 0)) {
837c478bd9Sstevel@tonic-gate 		rv = pkcs11_mech_parse(metaslot_entry->policylist,
847c478bd9Sstevel@tonic-gate 		    &prov_pol_mechs, metaslot_entry->count);
857c478bd9Sstevel@tonic-gate 
867c478bd9Sstevel@tonic-gate 		if (rv == CKR_HOST_MEMORY) {
877c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_ERR,
887c478bd9Sstevel@tonic-gate 			    "libpkcs11: Could not parse configuration,"
897c478bd9Sstevel@tonic-gate 			    "out of memory. Cannot continue parsing "
907c478bd9Sstevel@tonic-gate 			    "%s.\n", _PATH_PKCS11_CONF);
917c478bd9Sstevel@tonic-gate 			return (rv);
927c478bd9Sstevel@tonic-gate 		} else if (rv == CKR_MECHANISM_INVALID) {
937c478bd9Sstevel@tonic-gate 			/*
947c478bd9Sstevel@tonic-gate 			 * Configuration file is corrupted for metaslot
957c478bd9Sstevel@tonic-gate 			 */
967c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_ERR,
977c478bd9Sstevel@tonic-gate 			    "libpkcs11: Policy invalid or corrupted "
98*bbf21555SRichard Lowe 			    "for metaslot. Use cryptoadm(8) to fix "
997c478bd9Sstevel@tonic-gate 			    "this. Disabling metaslot functionality.\n");
1007c478bd9Sstevel@tonic-gate 			metaslot_enabled = B_FALSE;
1017c478bd9Sstevel@tonic-gate 			return (rv);
1027c478bd9Sstevel@tonic-gate 		}
1037c478bd9Sstevel@tonic-gate 	}
1047c478bd9Sstevel@tonic-gate 
1057c478bd9Sstevel@tonic-gate 	/*
1067c478bd9Sstevel@tonic-gate 	 * Check for metaslot policy.  If all mechanisms are
1077c478bd9Sstevel@tonic-gate 	 * disabled, disable metaslot since there is nothing
1087c478bd9Sstevel@tonic-gate 	 * interesting for it to do
1097c478bd9Sstevel@tonic-gate 	 */
1107c478bd9Sstevel@tonic-gate 	if ((metaslot_entry) && (metaslot_entry->flag_enabledlist) &&
1117c478bd9Sstevel@tonic-gate 	    (prov_pol_mechs == NULL)) {
1127c478bd9Sstevel@tonic-gate 		metaslot_enabled = B_FALSE;
1137c478bd9Sstevel@tonic-gate 		return (rv);
1147c478bd9Sstevel@tonic-gate 	}
1157c478bd9Sstevel@tonic-gate 
1167c478bd9Sstevel@tonic-gate 	/*
1177c478bd9Sstevel@tonic-gate 	 * save system wide value for metaslot's keystore.
1187c478bd9Sstevel@tonic-gate 	 * If either slot description or token label is specified by
1197c478bd9Sstevel@tonic-gate 	 * the user, the system wide value for both is ignored.
1207c478bd9Sstevel@tonic-gate 	 */
1217c478bd9Sstevel@tonic-gate 	if ((metaslot_entry) &&
1227c478bd9Sstevel@tonic-gate 	    (!metaslot_config.keystore_token_specified) &&
1237c478bd9Sstevel@tonic-gate 	    (!metaslot_config.keystore_slot_specified)) {
1247c478bd9Sstevel@tonic-gate 		/*
1257c478bd9Sstevel@tonic-gate 		 * blank_str is used for comparing with token label,
1267c478bd9Sstevel@tonic-gate 		 * and slot description, make sure it is better than
1277c478bd9Sstevel@tonic-gate 		 * the larger of both
1287c478bd9Sstevel@tonic-gate 		 */
1297c478bd9Sstevel@tonic-gate 		char blank_str[TOKEN_LABEL_SIZE + SLOT_DESCRIPTION_SIZE];
1307c478bd9Sstevel@tonic-gate 
1317c478bd9Sstevel@tonic-gate 		bzero(blank_str, sizeof (blank_str));
1327c478bd9Sstevel@tonic-gate 
1337c478bd9Sstevel@tonic-gate 		if (memcmp(metaslot_entry->metaslot_ks_token,
1347c478bd9Sstevel@tonic-gate 		    blank_str, TOKEN_LABEL_SIZE) != 0) {
1357c478bd9Sstevel@tonic-gate 			metaslot_config.keystore_token_specified = B_TRUE;
1367c478bd9Sstevel@tonic-gate 			(void) strlcpy(
1377c478bd9Sstevel@tonic-gate 			    (char *)metaslot_config.keystore_token,
1387c478bd9Sstevel@tonic-gate 			    (const char *)metaslot_entry->metaslot_ks_token,
1397c478bd9Sstevel@tonic-gate 			    TOKEN_LABEL_SIZE);
1407c478bd9Sstevel@tonic-gate 		}
1417c478bd9Sstevel@tonic-gate 
1427c478bd9Sstevel@tonic-gate 		if (memcmp(metaslot_entry->metaslot_ks_slot,
1437c478bd9Sstevel@tonic-gate 		    blank_str, SLOT_DESCRIPTION_SIZE) != 0) {
1447c478bd9Sstevel@tonic-gate 			metaslot_config.keystore_slot_specified = B_TRUE;
1457c478bd9Sstevel@tonic-gate 			(void) strlcpy(
1467c478bd9Sstevel@tonic-gate 			    (char *)metaslot_config.keystore_slot,
1477c478bd9Sstevel@tonic-gate 			    (const char *)metaslot_entry->metaslot_ks_slot,
1487c478bd9Sstevel@tonic-gate 			    SLOT_DESCRIPTION_SIZE);
1497c478bd9Sstevel@tonic-gate 		}
1507c478bd9Sstevel@tonic-gate 	}
1517c478bd9Sstevel@tonic-gate 
1527c478bd9Sstevel@tonic-gate 	/* check system-wide value for auto_key_migrate */
1537c478bd9Sstevel@tonic-gate 	if (metaslot_config.auto_key_migrate_specified) {
1547c478bd9Sstevel@tonic-gate 		/* take user's specified value */
1557c478bd9Sstevel@tonic-gate 		metaslot_auto_key_migrate = metaslot_config.auto_key_migrate;
1567c478bd9Sstevel@tonic-gate 	} else {
1577c478bd9Sstevel@tonic-gate 		if (metaslot_entry) {
1587c478bd9Sstevel@tonic-gate 			/* use system-wide default */
1597c478bd9Sstevel@tonic-gate 			metaslot_auto_key_migrate =
1607c478bd9Sstevel@tonic-gate 			    metaslot_entry->flag_metaslot_auto_key_migrate;
1617c478bd9Sstevel@tonic-gate 		} else {
1627c478bd9Sstevel@tonic-gate 			/*
1637c478bd9Sstevel@tonic-gate 			 * there's no system wide metaslot entry,
1647c478bd9Sstevel@tonic-gate 			 * default auto_key_migrate to true
1657c478bd9Sstevel@tonic-gate 			 */
1667c478bd9Sstevel@tonic-gate 			metaslot_auto_key_migrate = B_TRUE;
1677c478bd9Sstevel@tonic-gate 		}
1687c478bd9Sstevel@tonic-gate 	}
1697c478bd9Sstevel@tonic-gate 
1707c478bd9Sstevel@tonic-gate 
1717c478bd9Sstevel@tonic-gate 	/* Make first slotID be 0, for metaslot. */
1727c478bd9Sstevel@tonic-gate 	slottable->st_first = 0;
1737c478bd9Sstevel@tonic-gate 
1747c478bd9Sstevel@tonic-gate 	/* Set up the slottable entry for metaslot */
1757c478bd9Sstevel@tonic-gate 	slottable->st_slots[0] = NULL;
1767c478bd9Sstevel@tonic-gate 	cur_slot = calloc(1, sizeof (pkcs11_slot_t));
1777c478bd9Sstevel@tonic-gate 	if (cur_slot == NULL) {
1787c478bd9Sstevel@tonic-gate 		rv = CKR_HOST_MEMORY;
1797c478bd9Sstevel@tonic-gate 		return (rv);
1807c478bd9Sstevel@tonic-gate 	}
1817c478bd9Sstevel@tonic-gate 	cur_slot->sl_wfse_state = WFSE_CLEAR;
1827c478bd9Sstevel@tonic-gate 	cur_slot->sl_enabledpol = B_FALSE;
1837c478bd9Sstevel@tonic-gate 	cur_slot->sl_no_wfse = B_FALSE;
1847c478bd9Sstevel@tonic-gate 	(void) pthread_mutex_init(&cur_slot->sl_mutex, NULL);
1857c478bd9Sstevel@tonic-gate 
1867c478bd9Sstevel@tonic-gate 	/*
1877c478bd9Sstevel@tonic-gate 	 * The metaslot entry was prealloc'd by
1887c478bd9Sstevel@tonic-gate 	 * pkcs11_slottable_increase()
1897c478bd9Sstevel@tonic-gate 	 */
1907c478bd9Sstevel@tonic-gate 	(void) pthread_mutex_lock(&slottable->st_mutex);
1917c478bd9Sstevel@tonic-gate 	slottable->st_slots[0] = cur_slot;
1927c478bd9Sstevel@tonic-gate 	(void) pthread_mutex_unlock(&slottable->st_mutex);
1937c478bd9Sstevel@tonic-gate 
1947c478bd9Sstevel@tonic-gate 	(void) pthread_mutex_lock(&cur_slot->sl_mutex);
1957c478bd9Sstevel@tonic-gate 	cur_slot->sl_id = METASLOT_SLOTID;
1967c478bd9Sstevel@tonic-gate 	cur_slot->sl_func_list = &metaslot_functionList;
1977c478bd9Sstevel@tonic-gate 	if (metaslot_entry) {
1987c478bd9Sstevel@tonic-gate 		cur_slot->sl_enabledpol = metaslot_entry->flag_enabledlist;
1997c478bd9Sstevel@tonic-gate 		cur_slot->sl_pol_count = metaslot_entry->count;
2007c478bd9Sstevel@tonic-gate 	} else {
2017c478bd9Sstevel@tonic-gate 		/* if no metaslot entry, assume all mechs are enabled */
2027c478bd9Sstevel@tonic-gate 		cur_slot->sl_enabledpol = B_FALSE;
2037c478bd9Sstevel@tonic-gate 		cur_slot->sl_pol_count = 0;
2047c478bd9Sstevel@tonic-gate 	}
2057c478bd9Sstevel@tonic-gate 	cur_slot->sl_pol_mechs = prov_pol_mechs;
2067c478bd9Sstevel@tonic-gate 	cur_slot->sl_dldesc = NULL; /* not applicable */
2077c478bd9Sstevel@tonic-gate 	cur_slot->sl_prov_id = 0;
2087c478bd9Sstevel@tonic-gate 	(void) pthread_mutex_unlock(&cur_slot->sl_mutex);
2097c478bd9Sstevel@tonic-gate 
2107c478bd9Sstevel@tonic-gate 	/* Call the meta_Initialize() to initialize metaslot */
2117c478bd9Sstevel@tonic-gate 	rv = meta_Initialize(NULL);
2127c478bd9Sstevel@tonic-gate 	if (rv != CKR_OK) {
2137c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_ERR,
2147c478bd9Sstevel@tonic-gate 		    "libpkcs11: Can't initialize metaslot (%s)",
2157c478bd9Sstevel@tonic-gate 		    pkcs11_strerror(rv));
2167c478bd9Sstevel@tonic-gate 		goto cleanup;
2177c478bd9Sstevel@tonic-gate 	}
2187c478bd9Sstevel@tonic-gate 
2197c478bd9Sstevel@tonic-gate 	return (CKR_OK);
2207c478bd9Sstevel@tonic-gate 
2217c478bd9Sstevel@tonic-gate cleanup:
2227c478bd9Sstevel@tonic-gate 	metaslot_enabled = B_FALSE;
2237c478bd9Sstevel@tonic-gate 	slottable->st_slots[0] = NULL;
2247c478bd9Sstevel@tonic-gate 
2257c478bd9Sstevel@tonic-gate 	if (cur_slot) {
2267c478bd9Sstevel@tonic-gate 		(void) pthread_mutex_destroy(&cur_slot->sl_mutex);
2277c478bd9Sstevel@tonic-gate 		free(cur_slot);
2287c478bd9Sstevel@tonic-gate 	}
2297c478bd9Sstevel@tonic-gate 	return (rv);
2307c478bd9Sstevel@tonic-gate }
2317c478bd9Sstevel@tonic-gate 
2327c478bd9Sstevel@tonic-gate /*
2337c478bd9Sstevel@tonic-gate  * For each provider found in pkcs11.conf: expand $ISA if necessary,
2347c478bd9Sstevel@tonic-gate  * verify the module is signed, load the provider, find all of its
2357c478bd9Sstevel@tonic-gate  * slots, and store the function list and disabled policy.
2367c478bd9Sstevel@tonic-gate  *
2377c478bd9Sstevel@tonic-gate  * This function requires that the uentrylist_t and pkcs11_slottable_t
2387c478bd9Sstevel@tonic-gate  * already have memory allocated, and that the uentrylist_t is already
2397c478bd9Sstevel@tonic-gate  * populated with provider and policy information.
2407c478bd9Sstevel@tonic-gate  *
2417c478bd9Sstevel@tonic-gate  * pInitArgs can be set to NULL, but is normally the same value
2427c478bd9Sstevel@tonic-gate  * the framework's C_Initialize() was called with.
2437c478bd9Sstevel@tonic-gate  *
2447c478bd9Sstevel@tonic-gate  * Unless metaslot is explicitly disabled, it is setup when all other
2457c478bd9Sstevel@tonic-gate  * providers are loaded.
2467c478bd9Sstevel@tonic-gate  */
2477c478bd9Sstevel@tonic-gate CK_RV
pkcs11_slot_mapping(uentrylist_t * pplist,CK_VOID_PTR pInitArgs)2487c478bd9Sstevel@tonic-gate pkcs11_slot_mapping(uentrylist_t *pplist, CK_VOID_PTR pInitArgs)
2497c478bd9Sstevel@tonic-gate {
2507c478bd9Sstevel@tonic-gate 	CK_RV rv = CKR_OK;
2517c478bd9Sstevel@tonic-gate 	CK_RV prov_rv;			/* Provider's return code */
2527c478bd9Sstevel@tonic-gate 	CK_INFO prov_info;
2537c478bd9Sstevel@tonic-gate 	CK_RV (*Tmp_C_GetFunctionList)(CK_FUNCTION_LIST_PTR_PTR);
2547c478bd9Sstevel@tonic-gate 	CK_FUNCTION_LIST_PTR prov_funcs = NULL; /* Provider's function list */
2557c478bd9Sstevel@tonic-gate 	CK_ULONG prov_slot_count; 		/* Number of slots */
2567c478bd9Sstevel@tonic-gate 	CK_SLOT_ID slot_id; 		/* slotID assigned for framework */
2577c478bd9Sstevel@tonic-gate 	CK_SLOT_ID_PTR prov_slots = NULL; 	/* Provider's slot list */
2587c478bd9Sstevel@tonic-gate 					/* Enabled or Disabled policy */
2597c478bd9Sstevel@tonic-gate 	CK_MECHANISM_TYPE_PTR prov_pol_mechs = NULL;
2607c478bd9Sstevel@tonic-gate 
2617c478bd9Sstevel@tonic-gate 	void *dldesc = NULL;
2627c478bd9Sstevel@tonic-gate 	char *isa, *fullpath = NULL, *dl_error;
2637c478bd9Sstevel@tonic-gate 	uentrylist_t *phead;
2647c478bd9Sstevel@tonic-gate 	uint_t prov_count = 0;
2657c478bd9Sstevel@tonic-gate 	pkcs11_slot_t *cur_slot;
2667c478bd9Sstevel@tonic-gate 	CK_ULONG i;
2677c478bd9Sstevel@tonic-gate 	size_t len;
2687c478bd9Sstevel@tonic-gate 	uentry_t *metaslot_entry = NULL;
2697c478bd9Sstevel@tonic-gate 	/* number of slots in the framework, not including metaslot */
2707c478bd9Sstevel@tonic-gate 	uint_t slot_count = 0;
2717c478bd9Sstevel@tonic-gate 
2727c478bd9Sstevel@tonic-gate 	phead = pplist;
2737c478bd9Sstevel@tonic-gate 
2747c478bd9Sstevel@tonic-gate 	/* Loop through all of the provider listed in pkcs11.conf */
2757c478bd9Sstevel@tonic-gate 	while (phead != NULL) {
2767c478bd9Sstevel@tonic-gate 		if (!strcasecmp(phead->puent->name, "metaslot")) {
2777c478bd9Sstevel@tonic-gate 			/*
2787c478bd9Sstevel@tonic-gate 			 * Skip standard processing for metaslot
2797c478bd9Sstevel@tonic-gate 			 * entry since it is not an actual library
2807c478bd9Sstevel@tonic-gate 			 * that can be dlopened.
2817c478bd9Sstevel@tonic-gate 			 * It will be initialized later.
2827c478bd9Sstevel@tonic-gate 			 */
2837c478bd9Sstevel@tonic-gate 			if (metaslot_entry != NULL) {
2847c478bd9Sstevel@tonic-gate 				cryptoerror(LOG_ERR,
2857c478bd9Sstevel@tonic-gate 				    "libpkcs11: multiple entries for metaslot "
2867c478bd9Sstevel@tonic-gate 				    "detected.  All but the first entry will "
2877c478bd9Sstevel@tonic-gate 				    "be ignored");
2887c478bd9Sstevel@tonic-gate 			} else {
2897c478bd9Sstevel@tonic-gate 				metaslot_entry = phead->puent;
2907c478bd9Sstevel@tonic-gate 			}
2917c478bd9Sstevel@tonic-gate 			goto contparse;
2927c478bd9Sstevel@tonic-gate 		}
2937c478bd9Sstevel@tonic-gate 
294d616ad8eSHai-May Chao 		if (!strcasecmp(phead->puent->name, FIPS_KEYWORD)) {
295d616ad8eSHai-May Chao 			/*
296d616ad8eSHai-May Chao 			 * Skip standard processing for fips-140
297d616ad8eSHai-May Chao 			 * entry since it is not an actual library
298d616ad8eSHai-May Chao 			 * that can be dlopened.
299d616ad8eSHai-May Chao 			 */
300d616ad8eSHai-May Chao 			goto contparse;
301d616ad8eSHai-May Chao 		}
302d616ad8eSHai-May Chao 
3037c478bd9Sstevel@tonic-gate 		/* Check for Instruction Set Architecture indicator */
3047c478bd9Sstevel@tonic-gate 		if ((isa = strstr(phead->puent->name, PKCS11_ISA)) != NULL) {
3057c478bd9Sstevel@tonic-gate 			/* Substitute the architecture dependent path */
3067c478bd9Sstevel@tonic-gate 			len = strlen(phead->puent->name) -
3077c478bd9Sstevel@tonic-gate 			    strlen(PKCS11_ISA) +
3087c478bd9Sstevel@tonic-gate 			    strlen(PKCS11_ISA_DIR) + 1;
3097c478bd9Sstevel@tonic-gate 			if ((fullpath = (char *)malloc(len)) == NULL) {
3107c478bd9Sstevel@tonic-gate 				cryptoerror(LOG_ERR,
3117c478bd9Sstevel@tonic-gate 				    "libpksc11: parsing %s, out of memory. "
3127c478bd9Sstevel@tonic-gate 				    "Cannot continue parsing.",
3137c478bd9Sstevel@tonic-gate 				    _PATH_PKCS11_CONF);
3147c478bd9Sstevel@tonic-gate 				rv = CKR_HOST_MEMORY;
3157c478bd9Sstevel@tonic-gate 				goto conferror;
3167c478bd9Sstevel@tonic-gate 			}
3177c478bd9Sstevel@tonic-gate 			*isa = '\000';
3187c478bd9Sstevel@tonic-gate 			isa += strlen(PKCS11_ISA);
3197c478bd9Sstevel@tonic-gate 			(void) snprintf(fullpath, len, "%s%s%s",
3207c478bd9Sstevel@tonic-gate 			    phead->puent->name, PKCS11_ISA_DIR, isa);
3217c478bd9Sstevel@tonic-gate 		} else if ((fullpath = strdup(phead->puent->name)) == 0) {
3227c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_ERR,
3237c478bd9Sstevel@tonic-gate 			    "libpkcs11: parsing %s, out of memory. "
3247c478bd9Sstevel@tonic-gate 			    "Cannot continue parsing.",
3257c478bd9Sstevel@tonic-gate 			    _PATH_PKCS11_CONF);
3267c478bd9Sstevel@tonic-gate 			rv = CKR_HOST_MEMORY;
3277c478bd9Sstevel@tonic-gate 			goto conferror;
3287c478bd9Sstevel@tonic-gate 		}
3297c478bd9Sstevel@tonic-gate 
3307c478bd9Sstevel@tonic-gate 		/*
331699ea13aSValerie Bubb Fenwick 		 * Open the provider. We assume all of our plugins have
332699ea13aSValerie Bubb Fenwick 		 * their symbols properly defined, so the use of RTLD_NOW
333699ea13aSValerie Bubb Fenwick 		 * to flush out errors immediately is not necessary.
334699ea13aSValerie Bubb Fenwick 		 *
335699ea13aSValerie Bubb Fenwick 		 * Note that for proper operation, all plugins must be
336699ea13aSValerie Bubb Fenwick 		 * built with direct bindings enabled.
3377c478bd9Sstevel@tonic-gate 		 */
338699ea13aSValerie Bubb Fenwick 		dldesc = dlopen(fullpath, RTLD_LAZY);
3397c478bd9Sstevel@tonic-gate 
3407c478bd9Sstevel@tonic-gate 		/*
3417c478bd9Sstevel@tonic-gate 		 * If we failed to load it, we will just skip this
3427c478bd9Sstevel@tonic-gate 		 * provider and move on to the next one.
3437c478bd9Sstevel@tonic-gate 		 */
3447c478bd9Sstevel@tonic-gate 		if (dldesc == NULL) {
3457c478bd9Sstevel@tonic-gate 			dl_error = dlerror();
3467c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_ERR,
3477c478bd9Sstevel@tonic-gate 			    "libpkcs11: Cannot load PKCS#11 library %s.  "
3487c478bd9Sstevel@tonic-gate 			    "dlerror: %s. %s",
3497c478bd9Sstevel@tonic-gate 			    fullpath, dl_error != NULL ? dl_error : "Unknown",
3507c478bd9Sstevel@tonic-gate 			    conf_err);
3517c478bd9Sstevel@tonic-gate 			goto contparse;
3527c478bd9Sstevel@tonic-gate 		}
3537c478bd9Sstevel@tonic-gate 
3547c478bd9Sstevel@tonic-gate 		/* Get the pointer to provider's C_GetFunctionList() */
3557c478bd9Sstevel@tonic-gate 		Tmp_C_GetFunctionList =
3567c478bd9Sstevel@tonic-gate 		    (CK_RV(*)())dlsym(dldesc, "C_GetFunctionList");
3577c478bd9Sstevel@tonic-gate 
3587c478bd9Sstevel@tonic-gate 		/*
3597c478bd9Sstevel@tonic-gate 		 * If we failed to get the pointer to C_GetFunctionList(),
3607c478bd9Sstevel@tonic-gate 		 * skip this provider and continue to the next one.
3617c478bd9Sstevel@tonic-gate 		 */
3627c478bd9Sstevel@tonic-gate 		if (Tmp_C_GetFunctionList == NULL) {
3637c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_ERR,
3647c478bd9Sstevel@tonic-gate 			    "libpkcs11: Could not dlsym() C_GetFunctionList() "
3657c478bd9Sstevel@tonic-gate 			    "for %s. May not be a PKCS#11 library. %s",
3667c478bd9Sstevel@tonic-gate 			    fullpath, conf_err);
3677c478bd9Sstevel@tonic-gate 			(void) dlclose(dldesc);
3687c478bd9Sstevel@tonic-gate 			goto contparse;
3697c478bd9Sstevel@tonic-gate 		}
3707c478bd9Sstevel@tonic-gate 
3717c478bd9Sstevel@tonic-gate 
3727c478bd9Sstevel@tonic-gate 		/* Get the provider's function list */
3737c478bd9Sstevel@tonic-gate 		prov_rv = Tmp_C_GetFunctionList(&prov_funcs);
3747c478bd9Sstevel@tonic-gate 
3757c478bd9Sstevel@tonic-gate 		/*
3767c478bd9Sstevel@tonic-gate 		 * If we failed to get the provider's function list,
3777c478bd9Sstevel@tonic-gate 		 * skip this provider and continue to the next one.
3787c478bd9Sstevel@tonic-gate 		 */
3797c478bd9Sstevel@tonic-gate 		if (prov_rv != CKR_OK) {
3807c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_ERR,
3817c478bd9Sstevel@tonic-gate 			    "libpkcs11: Could not get function list for %s. "
3827c478bd9Sstevel@tonic-gate 			    "%s Error: %s.",
3837c478bd9Sstevel@tonic-gate 			    fullpath, conf_err, pkcs11_strerror(prov_rv));
3847c478bd9Sstevel@tonic-gate 			(void) dlclose(dldesc);
3857c478bd9Sstevel@tonic-gate 			goto contparse;
3867c478bd9Sstevel@tonic-gate 		}
3877c478bd9Sstevel@tonic-gate 
3887c478bd9Sstevel@tonic-gate 		/* Initialize this provider */
3897c478bd9Sstevel@tonic-gate 		prov_rv = prov_funcs->C_Initialize(pInitArgs);
3907c478bd9Sstevel@tonic-gate 
3917c478bd9Sstevel@tonic-gate 		/*
3927c478bd9Sstevel@tonic-gate 		 * If we failed to initialize this provider,
3937c478bd9Sstevel@tonic-gate 		 * skip this provider and continue to the next one.
3947c478bd9Sstevel@tonic-gate 		 */
3957c478bd9Sstevel@tonic-gate 		if ((prov_rv != CKR_OK) &&
3967c478bd9Sstevel@tonic-gate 		    (prov_rv != CKR_CRYPTOKI_ALREADY_INITIALIZED)) {
3977c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_ERR,
3987c478bd9Sstevel@tonic-gate 			    "libpkcs11: Could not initialize %s. "
3997c478bd9Sstevel@tonic-gate 			    "%s Error: %s.",
4007c478bd9Sstevel@tonic-gate 			    fullpath, conf_err, pkcs11_strerror(prov_rv));
4017c478bd9Sstevel@tonic-gate 			(void) dlclose(dldesc);
4027c478bd9Sstevel@tonic-gate 			goto contparse;
4037c478bd9Sstevel@tonic-gate 		}
4047c478bd9Sstevel@tonic-gate 
4057c478bd9Sstevel@tonic-gate 		/*
4067c478bd9Sstevel@tonic-gate 		 * Make sure this provider is implementing the same
4077c478bd9Sstevel@tonic-gate 		 * major version, and at least the same minor version
4087c478bd9Sstevel@tonic-gate 		 * that we are.
4097c478bd9Sstevel@tonic-gate 		 */
4107c478bd9Sstevel@tonic-gate 		prov_rv = prov_funcs->C_GetInfo(&prov_info);
4117c478bd9Sstevel@tonic-gate 
4127c478bd9Sstevel@tonic-gate 		/*
4137c478bd9Sstevel@tonic-gate 		 * If we can't verify that we are implementing the
4147c478bd9Sstevel@tonic-gate 		 * same major version, or if it is definitely not the same
4157c478bd9Sstevel@tonic-gate 		 * version, we need to skip this provider.
4167c478bd9Sstevel@tonic-gate 		 */
4177c478bd9Sstevel@tonic-gate 		if ((prov_rv != CKR_OK) ||
4187c478bd9Sstevel@tonic-gate 		    (prov_info.cryptokiVersion.major !=
4194a5b2e70Shaimay 		    CRYPTOKI_VERSION_MAJOR))  {
4207c478bd9Sstevel@tonic-gate 			if (prov_rv != CKR_OK) {
4217c478bd9Sstevel@tonic-gate 				cryptoerror(LOG_ERR,
4227c478bd9Sstevel@tonic-gate 				    "libpkcs11: Could not verify version of "
4237c478bd9Sstevel@tonic-gate 				    "%s. %s Error: %s.", fullpath,
4247c478bd9Sstevel@tonic-gate 				    conf_err, pkcs11_strerror(prov_rv));
4257c478bd9Sstevel@tonic-gate 			} else {
4267c478bd9Sstevel@tonic-gate 				cryptoerror(LOG_ERR,
4277c478bd9Sstevel@tonic-gate 				    "libpkcs11: Only CRYPTOKI major version "
4287c478bd9Sstevel@tonic-gate 				    "%d is supported.  %s is major "
4297c478bd9Sstevel@tonic-gate 				    "version %d. %s",
4307c478bd9Sstevel@tonic-gate 				    CRYPTOKI_VERSION_MAJOR, fullpath,
4317c478bd9Sstevel@tonic-gate 				    prov_info.cryptokiVersion.major, conf_err);
4327c478bd9Sstevel@tonic-gate 			}
4337c478bd9Sstevel@tonic-gate 			(void) prov_funcs->C_Finalize(NULL);
4347c478bd9Sstevel@tonic-gate 			(void) dlclose(dldesc);
4357c478bd9Sstevel@tonic-gate 			goto contparse;
4367c478bd9Sstevel@tonic-gate 		}
4377c478bd9Sstevel@tonic-gate 
4387c478bd9Sstevel@tonic-gate 		/*
439e39dcb66Sdarrenm 		 * Warn the administrator (at debug) that a provider with
4407c478bd9Sstevel@tonic-gate 		 * a significantly older or newer version of
4417c478bd9Sstevel@tonic-gate 		 * CRYPTOKI is being used.  It should not cause
4427c478bd9Sstevel@tonic-gate 		 * problems, but logging a warning makes it easier
4437c478bd9Sstevel@tonic-gate 		 * to debug later.
4447c478bd9Sstevel@tonic-gate 		 */
4457c478bd9Sstevel@tonic-gate 		if ((prov_info.cryptokiVersion.minor <
4464a5b2e70Shaimay 		    CRYPTOKI_VERSION_WARN_MINOR) ||
4477c478bd9Sstevel@tonic-gate 		    (prov_info.cryptokiVersion.minor >
4484a5b2e70Shaimay 		    CRYPTOKI_VERSION_MINOR)) {
449e39dcb66Sdarrenm 			cryptoerror(LOG_DEBUG,
4507c478bd9Sstevel@tonic-gate 			    "libpkcs11: %s CRYPTOKI minor version, %d, may "
4517c478bd9Sstevel@tonic-gate 			    "not be compatible with minor version %d.",
4527c478bd9Sstevel@tonic-gate 			    fullpath, prov_info.cryptokiVersion.minor,
4537c478bd9Sstevel@tonic-gate 			    CRYPTOKI_VERSION_MINOR);
4547c478bd9Sstevel@tonic-gate 		}
4557c478bd9Sstevel@tonic-gate 
4567c478bd9Sstevel@tonic-gate 		/*
4577c478bd9Sstevel@tonic-gate 		 * Find out how many slots this provider has,
4587c478bd9Sstevel@tonic-gate 		 * call with tokenPresent set to FALSE so all
4597c478bd9Sstevel@tonic-gate 		 * potential slots are returned.
4607c478bd9Sstevel@tonic-gate 		 */
4617c478bd9Sstevel@tonic-gate 		prov_rv = prov_funcs->C_GetSlotList(FALSE,
4627c478bd9Sstevel@tonic-gate 		    NULL, &prov_slot_count);
4637c478bd9Sstevel@tonic-gate 
4647c478bd9Sstevel@tonic-gate 		/*
4657c478bd9Sstevel@tonic-gate 		 * If the call failed, or if no slots are returned,
4667c478bd9Sstevel@tonic-gate 		 * then skip this provider and continue to next one.
4677c478bd9Sstevel@tonic-gate 		 */
4687c478bd9Sstevel@tonic-gate 		if (prov_rv != CKR_OK) {
4697c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_ERR,
4707c478bd9Sstevel@tonic-gate 			    "libpksc11: Could not get slot list from %s. "
4717c478bd9Sstevel@tonic-gate 			    "%s Error: %s.",
4727c478bd9Sstevel@tonic-gate 			    fullpath, conf_err, pkcs11_strerror(prov_rv));
4737c478bd9Sstevel@tonic-gate 			(void) prov_funcs->C_Finalize(NULL);
4747c478bd9Sstevel@tonic-gate 			(void) dlclose(dldesc);
4757c478bd9Sstevel@tonic-gate 			goto contparse;
4767c478bd9Sstevel@tonic-gate 		}
4777c478bd9Sstevel@tonic-gate 
4787c478bd9Sstevel@tonic-gate 		if (prov_slot_count == 0) {
4797c478bd9Sstevel@tonic-gate 			cryptodebug("libpkcs11: No slots presented from %s. "
4807c478bd9Sstevel@tonic-gate 			    "Skipping this plug-in at this time.\n",
4817c478bd9Sstevel@tonic-gate 			    fullpath);
4827c478bd9Sstevel@tonic-gate 			(void) prov_funcs->C_Finalize(NULL);
4837c478bd9Sstevel@tonic-gate 			(void) dlclose(dldesc);
4847c478bd9Sstevel@tonic-gate 			goto contparse;
4857c478bd9Sstevel@tonic-gate 		}
4867c478bd9Sstevel@tonic-gate 
4877c478bd9Sstevel@tonic-gate 		/* Allocate memory for the slot list */
4887c478bd9Sstevel@tonic-gate 		prov_slots = calloc(prov_slot_count, sizeof (CK_SLOT_ID));
4897c478bd9Sstevel@tonic-gate 
4907c478bd9Sstevel@tonic-gate 		if (prov_slots == NULL) {
4917c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_ERR,
4927c478bd9Sstevel@tonic-gate 			    "libpkcs11: Could not allocate memory for "
4937c478bd9Sstevel@tonic-gate 			    "plug-in slots. Cannot continue parsing %s\n",
4947c478bd9Sstevel@tonic-gate 			    _PATH_PKCS11_CONF);
4957c478bd9Sstevel@tonic-gate 			rv = CKR_HOST_MEMORY;
4967c478bd9Sstevel@tonic-gate 			goto conferror;
4977c478bd9Sstevel@tonic-gate 		}
4987c478bd9Sstevel@tonic-gate 
4997c478bd9Sstevel@tonic-gate 		/* Get slot list from provider */
5007c478bd9Sstevel@tonic-gate 		prov_rv = prov_funcs->C_GetSlotList(FALSE,
5017c478bd9Sstevel@tonic-gate 		    prov_slots, &prov_slot_count);
5027c478bd9Sstevel@tonic-gate 
5037c478bd9Sstevel@tonic-gate 		/* if second call fails, drop this provider */
5047c478bd9Sstevel@tonic-gate 		if (prov_rv != CKR_OK) {
5057c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_ERR,
5067c478bd9Sstevel@tonic-gate 			    "libpkcs11: Second call to C_GetSlotList() for %s "
5077c478bd9Sstevel@tonic-gate 			    "failed. %s Error: %s.",
5087c478bd9Sstevel@tonic-gate 			    fullpath, conf_err, pkcs11_strerror(prov_rv));
5097c478bd9Sstevel@tonic-gate 			(void) prov_funcs->C_Finalize(NULL);
5107c478bd9Sstevel@tonic-gate 			(void) dlclose(dldesc);
5117c478bd9Sstevel@tonic-gate 			goto contparse;
5127c478bd9Sstevel@tonic-gate 		}
5137c478bd9Sstevel@tonic-gate 
5147c478bd9Sstevel@tonic-gate 		/*
5157c478bd9Sstevel@tonic-gate 		 * Parse the list of disabled or enabled mechanisms, will
5167c478bd9Sstevel@tonic-gate 		 * apply to each of the provider's slots.
5177c478bd9Sstevel@tonic-gate 		 */
5187c478bd9Sstevel@tonic-gate 		if (phead->puent->count > 0) {
5197c478bd9Sstevel@tonic-gate 			rv = pkcs11_mech_parse(phead->puent->policylist,
5207c478bd9Sstevel@tonic-gate 			    &prov_pol_mechs, phead->puent->count);
5217c478bd9Sstevel@tonic-gate 
5227c478bd9Sstevel@tonic-gate 			if (rv == CKR_HOST_MEMORY) {
5237c478bd9Sstevel@tonic-gate 				cryptoerror(LOG_ERR,
5247c478bd9Sstevel@tonic-gate 				    "libpkcs11: Could not parse configuration,"
5257c478bd9Sstevel@tonic-gate 				    "out of memory. Cannot continue parsing "
5267c478bd9Sstevel@tonic-gate 				    "%s.", _PATH_PKCS11_CONF);
5277c478bd9Sstevel@tonic-gate 				goto conferror;
5287c478bd9Sstevel@tonic-gate 			} else if (rv == CKR_MECHANISM_INVALID) {
5297c478bd9Sstevel@tonic-gate 				/*
5307c478bd9Sstevel@tonic-gate 				 * Configuration file is corrupted for this
5317c478bd9Sstevel@tonic-gate 				 * provider.
5327c478bd9Sstevel@tonic-gate 				 */
5337c478bd9Sstevel@tonic-gate 				cryptoerror(LOG_ERR,
5347c478bd9Sstevel@tonic-gate 				    "libpkcs11: Policy invalid or corrupted "
535*bbf21555SRichard Lowe 				    "for %s. Use cryptoadm(8) to fix "
5367c478bd9Sstevel@tonic-gate 				    "this. Skipping this plug-in.",
5377c478bd9Sstevel@tonic-gate 				    fullpath);
5387c478bd9Sstevel@tonic-gate 				(void) prov_funcs->C_Finalize(NULL);
5397c478bd9Sstevel@tonic-gate 				(void) dlclose(dldesc);
5407c478bd9Sstevel@tonic-gate 				goto contparse;
5417c478bd9Sstevel@tonic-gate 			}
5427c478bd9Sstevel@tonic-gate 		}
5437c478bd9Sstevel@tonic-gate 
5447c478bd9Sstevel@tonic-gate 		/* Allocate memory in our slottable for these slots */
5457c478bd9Sstevel@tonic-gate 		rv = pkcs11_slottable_increase(prov_slot_count);
5467c478bd9Sstevel@tonic-gate 
5477c478bd9Sstevel@tonic-gate 		/*
5487c478bd9Sstevel@tonic-gate 		 * If any error is returned, it will be memory related,
5497c478bd9Sstevel@tonic-gate 		 * so we need to abort the attempt at filling the
5507c478bd9Sstevel@tonic-gate 		 * slottable.
5517c478bd9Sstevel@tonic-gate 		 */
5527c478bd9Sstevel@tonic-gate 		if (rv != CKR_OK) {
5537c478bd9Sstevel@tonic-gate 			cryptoerror(LOG_ERR,
5547c478bd9Sstevel@tonic-gate 			    "libpkcs11: slottable could not increase. "
5557c478bd9Sstevel@tonic-gate 			    "Cannot continue parsing %s.",
5567c478bd9Sstevel@tonic-gate 			    _PATH_PKCS11_CONF);
5577c478bd9Sstevel@tonic-gate 			goto conferror;
5587c478bd9Sstevel@tonic-gate 		}
5597c478bd9Sstevel@tonic-gate 
5607c478bd9Sstevel@tonic-gate 		/* Configure information for each new slot */
5617c478bd9Sstevel@tonic-gate 		for (i = 0; i < prov_slot_count; i++) {
5627c478bd9Sstevel@tonic-gate 			/* allocate slot in framework */
5637c478bd9Sstevel@tonic-gate 			rv = pkcs11_slot_allocate(&slot_id);
5647c478bd9Sstevel@tonic-gate 			if (rv != CKR_OK) {
5657c478bd9Sstevel@tonic-gate 				cryptoerror(LOG_ERR,
5667c478bd9Sstevel@tonic-gate 				    "libpkcs11: Could not allocate "
5677c478bd9Sstevel@tonic-gate 				    "new slot.  Cannot continue parsing %s.",
5687c478bd9Sstevel@tonic-gate 				    _PATH_PKCS11_CONF);
5697c478bd9Sstevel@tonic-gate 				goto conferror;
5707c478bd9Sstevel@tonic-gate 			}
5717c478bd9Sstevel@tonic-gate 			slot_count++;
5727c478bd9Sstevel@tonic-gate 			cur_slot = slottable->st_slots[slot_id];
5737c478bd9Sstevel@tonic-gate 			(void) pthread_mutex_lock(&cur_slot->sl_mutex);
5747c478bd9Sstevel@tonic-gate 			cur_slot->sl_id = prov_slots[i];
5757c478bd9Sstevel@tonic-gate 			cur_slot->sl_func_list = prov_funcs;
5767c478bd9Sstevel@tonic-gate 			cur_slot->sl_enabledpol =
5777c478bd9Sstevel@tonic-gate 			    phead->puent->flag_enabledlist;
5787c478bd9Sstevel@tonic-gate 			cur_slot->sl_pol_mechs = prov_pol_mechs;
5797c478bd9Sstevel@tonic-gate 			cur_slot->sl_pol_count = phead->puent->count;
5807c478bd9Sstevel@tonic-gate 			cur_slot->sl_norandom = phead->puent->flag_norandom;
5817c478bd9Sstevel@tonic-gate 			cur_slot->sl_dldesc = dldesc;
5827c478bd9Sstevel@tonic-gate 			cur_slot->sl_prov_id = prov_count + 1;
5837c478bd9Sstevel@tonic-gate 			(void) pthread_mutex_unlock(&cur_slot->sl_mutex);
5847c478bd9Sstevel@tonic-gate 		}
5857c478bd9Sstevel@tonic-gate 
5864a5b2e70Shaimay 		/*
5874a5b2e70Shaimay 		 * Get the pointer to private interface _SUNW_GetThreshold()
5884a5b2e70Shaimay 		 * in pkcs11_kernel.
5894a5b2e70Shaimay 		 */
5904a5b2e70Shaimay 
5914a5b2e70Shaimay 		if (Tmp_GetThreshold == NULL) {
5924a5b2e70Shaimay 			Tmp_GetThreshold =
593a039cd31Shaimay 			    (void(*)())dlsym(dldesc, "_SUNW_GetThreshold");
594a039cd31Shaimay 
595a039cd31Shaimay 			/* Get the threshold values for the supported mechs */
596a039cd31Shaimay 			if (Tmp_GetThreshold != NULL) {
597a039cd31Shaimay 				(void) memset(meta_mechs_threshold, 0,
598a039cd31Shaimay 				    sizeof (meta_mechs_threshold));
599a039cd31Shaimay 				Tmp_GetThreshold(meta_mechs_threshold);
600a039cd31Shaimay 			}
6014a5b2e70Shaimay 		}
6027c478bd9Sstevel@tonic-gate 
6037c478bd9Sstevel@tonic-gate 		/* Set and reset values to process next provider */
6047c478bd9Sstevel@tonic-gate 		prov_count++;
6057c478bd9Sstevel@tonic-gate contparse:
6067c478bd9Sstevel@tonic-gate 		prov_slot_count = 0;
6077c478bd9Sstevel@tonic-gate 		Tmp_C_GetFunctionList = NULL;
6087c478bd9Sstevel@tonic-gate 		prov_funcs = NULL;
6097c478bd9Sstevel@tonic-gate 		dldesc = NULL;
6107c478bd9Sstevel@tonic-gate 		if (fullpath != NULL) {
6117c478bd9Sstevel@tonic-gate 			free(fullpath);
6127c478bd9Sstevel@tonic-gate 			fullpath = NULL;
6137c478bd9Sstevel@tonic-gate 		}
6147c478bd9Sstevel@tonic-gate 		if (prov_slots != NULL) {
6157c478bd9Sstevel@tonic-gate 			free(prov_slots);
6167c478bd9Sstevel@tonic-gate 			prov_slots = NULL;
6177c478bd9Sstevel@tonic-gate 		}
6187c478bd9Sstevel@tonic-gate 		phead = phead->next;
6197c478bd9Sstevel@tonic-gate 	}
6207c478bd9Sstevel@tonic-gate 
6217c478bd9Sstevel@tonic-gate 	if (slot_count == 0) {
6227c478bd9Sstevel@tonic-gate 		/*
6237c478bd9Sstevel@tonic-gate 		 * there's no other slot in the framework,
6247c478bd9Sstevel@tonic-gate 		 * there is nothing to do
6257c478bd9Sstevel@tonic-gate 		 */
6267c478bd9Sstevel@tonic-gate 		goto config_complete;
6277c478bd9Sstevel@tonic-gate 	}
6287c478bd9Sstevel@tonic-gate 
6297c478bd9Sstevel@tonic-gate 	/* determine if metaslot should be enabled */
6307c478bd9Sstevel@tonic-gate 
6317c478bd9Sstevel@tonic-gate 	/*
6327c478bd9Sstevel@tonic-gate 	 * Check to see if any environment variable is defined
6337c478bd9Sstevel@tonic-gate 	 * by the user for configuring metaslot.  Users'
6347c478bd9Sstevel@tonic-gate 	 * setting always take precedence over the system wide
6357c478bd9Sstevel@tonic-gate 	 * setting.  So, we will first check for any user's
6367c478bd9Sstevel@tonic-gate 	 * defined env variables before looking at the system-wide
6377c478bd9Sstevel@tonic-gate 	 * configuration.
6387c478bd9Sstevel@tonic-gate 	 */
6397c478bd9Sstevel@tonic-gate 	get_user_metaslot_config();
6407c478bd9Sstevel@tonic-gate 
6417c478bd9Sstevel@tonic-gate 	/* no metaslot entry in /etc/crypto/pkcs11.conf */
6427c478bd9Sstevel@tonic-gate 	if (!metaslot_entry) {
6437c478bd9Sstevel@tonic-gate 		/*
6447c478bd9Sstevel@tonic-gate 		 * If user env variable indicates metaslot should be enabled,
6457c478bd9Sstevel@tonic-gate 		 * but there's no entry in /etc/crypto/pkcs11.conf for
6467c478bd9Sstevel@tonic-gate 		 * metaslot at all, will respect the user's defined value
6477c478bd9Sstevel@tonic-gate 		 */
6487c478bd9Sstevel@tonic-gate 		if ((metaslot_config.enabled_specified) &&
6497c478bd9Sstevel@tonic-gate 		    (metaslot_config.enabled)) {
6507c478bd9Sstevel@tonic-gate 			metaslot_enabled = B_TRUE;
6517c478bd9Sstevel@tonic-gate 		}
6527c478bd9Sstevel@tonic-gate 	} else {
6537c478bd9Sstevel@tonic-gate 		if (!metaslot_config.enabled_specified) {
6547c478bd9Sstevel@tonic-gate 			/*
6557c478bd9Sstevel@tonic-gate 			 * take system wide value if
6567c478bd9Sstevel@tonic-gate 			 * it is not specified by user
6577c478bd9Sstevel@tonic-gate 			 */
6587c478bd9Sstevel@tonic-gate 			metaslot_enabled
6597c478bd9Sstevel@tonic-gate 			    = metaslot_entry->flag_metaslot_enabled;
6607c478bd9Sstevel@tonic-gate 		} else {
6617c478bd9Sstevel@tonic-gate 			metaslot_enabled = metaslot_config.enabled;
6627c478bd9Sstevel@tonic-gate 		}
6637c478bd9Sstevel@tonic-gate 	}
6647c478bd9Sstevel@tonic-gate 
6657c478bd9Sstevel@tonic-gate 	/*
6667c478bd9Sstevel@tonic-gate 	 *
6677c478bd9Sstevel@tonic-gate 	 * As long as the user or system configuration file does not
6687c478bd9Sstevel@tonic-gate 	 * disable metaslot, it will be enabled regardless of the
6697c478bd9Sstevel@tonic-gate 	 * number of slots plugged into the framework.  Therefore,
6707c478bd9Sstevel@tonic-gate 	 * metaslot is enabled even when there's only one slot
6717c478bd9Sstevel@tonic-gate 	 * plugged into the framework.  This is necessary for
6727c478bd9Sstevel@tonic-gate 	 * presenting a consistent token label view to applications.
6737c478bd9Sstevel@tonic-gate 	 *
6747c478bd9Sstevel@tonic-gate 	 * However, for the case where there is only 1 slot plugged into
6757c478bd9Sstevel@tonic-gate 	 * the framework, we can use "fastpath".
6767c478bd9Sstevel@tonic-gate 	 *
6777c478bd9Sstevel@tonic-gate 	 * "fastpath" will pass all of the application's requests
6787c478bd9Sstevel@tonic-gate 	 * directly to the underlying provider.  Only when policy is in
6797c478bd9Sstevel@tonic-gate 	 * effect will we need to keep slotID around.
6807c478bd9Sstevel@tonic-gate 	 *
6817c478bd9Sstevel@tonic-gate 	 * When metaslot is enabled, and fastpath is enabled,
6827c478bd9Sstevel@tonic-gate 	 * all the metaslot processing will be skipped.
6837c478bd9Sstevel@tonic-gate 	 * When there is only 1 slot, there's
6847c478bd9Sstevel@tonic-gate 	 * really not much metaslot can do in terms of combining functionality
6857c478bd9Sstevel@tonic-gate 	 * of different slots, and object migration.
6867c478bd9Sstevel@tonic-gate 	 *
6877c478bd9Sstevel@tonic-gate 	 */
6887c478bd9Sstevel@tonic-gate 
6897c478bd9Sstevel@tonic-gate 	/* check to see if fastpath can be used */
6907c478bd9Sstevel@tonic-gate 	if (slottable->st_last == slottable->st_first) {
6917c478bd9Sstevel@tonic-gate 
6927c478bd9Sstevel@tonic-gate 		cur_slot = slottable->st_slots[slottable->st_first];
6937c478bd9Sstevel@tonic-gate 
6947c478bd9Sstevel@tonic-gate 		(void) pthread_mutex_lock(&cur_slot->sl_mutex);
6957c478bd9Sstevel@tonic-gate 
6967c478bd9Sstevel@tonic-gate 		if ((cur_slot->sl_pol_count == 0) &&
6977c478bd9Sstevel@tonic-gate 		    (!cur_slot->sl_enabledpol) && (!cur_slot->sl_norandom)) {
6987c478bd9Sstevel@tonic-gate 			/* No policy is in effect, don't need slotid */
6997c478bd9Sstevel@tonic-gate 			fast_funcs = cur_slot->sl_func_list;
7007c478bd9Sstevel@tonic-gate 			purefastpath = B_TRUE;
7017c478bd9Sstevel@tonic-gate 		} else {
7027c478bd9Sstevel@tonic-gate 			fast_funcs = cur_slot->sl_func_list;
7037c478bd9Sstevel@tonic-gate 			fast_slot = slottable->st_first;
7047c478bd9Sstevel@tonic-gate 			policyfastpath = B_TRUE;
7057c478bd9Sstevel@tonic-gate 		}
7067c478bd9Sstevel@tonic-gate 
7077c478bd9Sstevel@tonic-gate 		(void) pthread_mutex_unlock(&cur_slot->sl_mutex);
7087c478bd9Sstevel@tonic-gate 	}
7097c478bd9Sstevel@tonic-gate 
7107c478bd9Sstevel@tonic-gate 	if ((purefastpath || policyfastpath) && (!metaslot_enabled)) {
7117c478bd9Sstevel@tonic-gate 		goto config_complete;
7127c478bd9Sstevel@tonic-gate 	}
7137c478bd9Sstevel@tonic-gate 
7147c478bd9Sstevel@tonic-gate 	/*
7157c478bd9Sstevel@tonic-gate 	 * If we get here, there are more than 2 slots in the framework,
7167c478bd9Sstevel@tonic-gate 	 * we need to set up metaslot if it is enabled
7177c478bd9Sstevel@tonic-gate 	 */
7187c478bd9Sstevel@tonic-gate 	if (metaslot_enabled) {
7197c478bd9Sstevel@tonic-gate 		rv = setup_metaslot(metaslot_entry);
7207c478bd9Sstevel@tonic-gate 		if (rv != CKR_OK) {
7217c478bd9Sstevel@tonic-gate 			goto conferror;
7227c478bd9Sstevel@tonic-gate 		}
7237c478bd9Sstevel@tonic-gate 	}
7247c478bd9Sstevel@tonic-gate 
7257c478bd9Sstevel@tonic-gate 
7267c478bd9Sstevel@tonic-gate config_complete:
7277c478bd9Sstevel@tonic-gate 
7287c478bd9Sstevel@tonic-gate 	return (CKR_OK);
7297c478bd9Sstevel@tonic-gate 
7307c478bd9Sstevel@tonic-gate conferror:
7317c478bd9Sstevel@tonic-gate 	/*
7327c478bd9Sstevel@tonic-gate 	 * This cleanup code is only exercised when a major,
7336ea3c060SGarrett D'Amore 	 * unrecoverable error like "out of memory".
7347c478bd9Sstevel@tonic-gate 	 */
7357c478bd9Sstevel@tonic-gate 	if (prov_funcs != NULL) {
7367c478bd9Sstevel@tonic-gate 		(void) prov_funcs->C_Finalize(NULL);
7377c478bd9Sstevel@tonic-gate 	}
7387c478bd9Sstevel@tonic-gate 	if (dldesc != NULL) {
7397c478bd9Sstevel@tonic-gate 		(void) dlclose(dldesc);
7407c478bd9Sstevel@tonic-gate 	}
7417c478bd9Sstevel@tonic-gate 	if (fullpath != NULL) {
7427c478bd9Sstevel@tonic-gate 		free(fullpath);
7437c478bd9Sstevel@tonic-gate 		fullpath = NULL;
7447c478bd9Sstevel@tonic-gate 	}
7457c478bd9Sstevel@tonic-gate 	if (prov_slots != NULL) {
7467c478bd9Sstevel@tonic-gate 		free(prov_slots);
7477c478bd9Sstevel@tonic-gate 		prov_slots = NULL;
7487c478bd9Sstevel@tonic-gate 	}
7497c478bd9Sstevel@tonic-gate 
7507c478bd9Sstevel@tonic-gate 	return (rv);
7517c478bd9Sstevel@tonic-gate }
7527c478bd9Sstevel@tonic-gate 
7537c478bd9Sstevel@tonic-gate /*
7547c478bd9Sstevel@tonic-gate  * pkcs11_mech_parse will take hex mechanism ids, as a list of
7557c478bd9Sstevel@tonic-gate  * strings, and convert them to CK_MECHANISM_TYPE_PTR.
7567c478bd9Sstevel@tonic-gate  */
7577c478bd9Sstevel@tonic-gate CK_RV
pkcs11_mech_parse(umechlist_t * str_list,CK_MECHANISM_TYPE_PTR * mech_list,int mech_count)7587c478bd9Sstevel@tonic-gate pkcs11_mech_parse(umechlist_t *str_list, CK_MECHANISM_TYPE_PTR *mech_list,
7597c478bd9Sstevel@tonic-gate     int mech_count)
7607c478bd9Sstevel@tonic-gate {
7617c478bd9Sstevel@tonic-gate 	CK_MECHANISM_TYPE_PTR tmp_list;
7627c478bd9Sstevel@tonic-gate 	umechlist_t *shead = str_list;
7637c478bd9Sstevel@tonic-gate 
7647c478bd9Sstevel@tonic-gate 	tmp_list = malloc(mech_count * sizeof (CK_MECHANISM_TYPE));
7657c478bd9Sstevel@tonic-gate 
7667c478bd9Sstevel@tonic-gate 	if (tmp_list == NULL) {
7677c478bd9Sstevel@tonic-gate 		cryptoerror(LOG_ERR, "libpkcs11: parsing %s, out of memory. "
7687c478bd9Sstevel@tonic-gate 		    "Cannot continue.",
7697c478bd9Sstevel@tonic-gate 		    _PATH_PKCS11_CONF);
7707c478bd9Sstevel@tonic-gate 		return (CKR_HOST_MEMORY);
7717c478bd9Sstevel@tonic-gate 	}
7727c478bd9Sstevel@tonic-gate 
7737c478bd9Sstevel@tonic-gate 	*mech_list = tmp_list;
7747c478bd9Sstevel@tonic-gate 
7757c478bd9Sstevel@tonic-gate 	/*
7767c478bd9Sstevel@tonic-gate 	 * The following will loop mech_count times, as there are
7777c478bd9Sstevel@tonic-gate 	 * exactly mech_count items in the str_list.
7787c478bd9Sstevel@tonic-gate 	 */
7797c478bd9Sstevel@tonic-gate 	while (shead != NULL) {
7807c478bd9Sstevel@tonic-gate 		CK_MECHANISM_TYPE cur_mech;
7817c478bd9Sstevel@tonic-gate 
7827c478bd9Sstevel@tonic-gate 		errno = 0;
7837c478bd9Sstevel@tonic-gate 
7847c478bd9Sstevel@tonic-gate 		/*
7857c478bd9Sstevel@tonic-gate 		 * "name" is a hexadecimal number, preceded by 0x.
7867c478bd9Sstevel@tonic-gate 		 */
7877c478bd9Sstevel@tonic-gate 		cur_mech = strtoul(shead->name, NULL, 16);
7887c478bd9Sstevel@tonic-gate 
7897c478bd9Sstevel@tonic-gate 		if ((cur_mech == 0) &&
7907c478bd9Sstevel@tonic-gate 		    ((errno == EINVAL) || (errno == ERANGE))) {
7917c478bd9Sstevel@tonic-gate 			free(mech_list);
7927c478bd9Sstevel@tonic-gate 			return (CKR_MECHANISM_INVALID);
7937c478bd9Sstevel@tonic-gate 		}
7947c478bd9Sstevel@tonic-gate 		*tmp_list = (CK_MECHANISM_TYPE)cur_mech;
7957c478bd9Sstevel@tonic-gate 		tmp_list++;
7967c478bd9Sstevel@tonic-gate 		shead = shead->next;
7977c478bd9Sstevel@tonic-gate 	}
7987c478bd9Sstevel@tonic-gate 
7997c478bd9Sstevel@tonic-gate 	return (CKR_OK);
8007c478bd9Sstevel@tonic-gate }
8017c478bd9Sstevel@tonic-gate 
8027c478bd9Sstevel@tonic-gate /*
8037c478bd9Sstevel@tonic-gate  * pkcs11_is_dismech is provided a slotid and a mechanism.
8047c478bd9Sstevel@tonic-gate  * If mech is not disabled, then return B_FALSE.
8057c478bd9Sstevel@tonic-gate  */
8067c478bd9Sstevel@tonic-gate boolean_t
pkcs11_is_dismech(CK_SLOT_ID slotid,CK_MECHANISM_TYPE mech)8077c478bd9Sstevel@tonic-gate pkcs11_is_dismech(CK_SLOT_ID slotid, CK_MECHANISM_TYPE mech)
8087c478bd9Sstevel@tonic-gate {
8097c478bd9Sstevel@tonic-gate 	ulong_t i;
8107c478bd9Sstevel@tonic-gate 	boolean_t enabled_pol;
8117c478bd9Sstevel@tonic-gate 	CK_MECHANISM_TYPE_PTR pol_mechs;
8127c478bd9Sstevel@tonic-gate 	ulong_t pol_count;
8137c478bd9Sstevel@tonic-gate 
8147c478bd9Sstevel@tonic-gate 	/* Find the associated slot and get the mech policy info */
8157c478bd9Sstevel@tonic-gate 	(void) pthread_mutex_lock(&slottable->st_slots[slotid]->sl_mutex);
8167c478bd9Sstevel@tonic-gate 	enabled_pol = slottable->st_slots[slotid]->sl_enabledpol;
8177c478bd9Sstevel@tonic-gate 	pol_mechs = slottable->st_slots[slotid]->sl_pol_mechs;
8187c478bd9Sstevel@tonic-gate 	pol_count = slottable->st_slots[slotid]->sl_pol_count;
8197c478bd9Sstevel@tonic-gate 	(void) pthread_mutex_unlock(&slottable->st_slots[slotid]->sl_mutex);
8207c478bd9Sstevel@tonic-gate 
8217c478bd9Sstevel@tonic-gate 	/* Check for policy */
8227c478bd9Sstevel@tonic-gate 	if ((!enabled_pol) && (pol_mechs == NULL)) {
8237c478bd9Sstevel@tonic-gate 		/* no policy */
8247c478bd9Sstevel@tonic-gate 		return (B_FALSE);
8257c478bd9Sstevel@tonic-gate 	} else if (pol_mechs == NULL) {
8267c478bd9Sstevel@tonic-gate 		/*
8277c478bd9Sstevel@tonic-gate 		 * We have an empty enabled list, which means no
8287c478bd9Sstevel@tonic-gate 		 * mechanisms are exempted from this policy: all
8297c478bd9Sstevel@tonic-gate 		 * are disabled.
8307c478bd9Sstevel@tonic-gate 		 */
8317c478bd9Sstevel@tonic-gate 		return (B_TRUE);
8327c478bd9Sstevel@tonic-gate 	}
8337c478bd9Sstevel@tonic-gate 
8347c478bd9Sstevel@tonic-gate 	for (i = 0; i < pol_count; i++) {
8357c478bd9Sstevel@tonic-gate 		/*
8367c478bd9Sstevel@tonic-gate 		 * If it matches, return status based on this
8377c478bd9Sstevel@tonic-gate 		 * being and enabled or a disabled list of mechs.
8387c478bd9Sstevel@tonic-gate 		 */
8397c478bd9Sstevel@tonic-gate 		if (pol_mechs[i] == mech) {
8407c478bd9Sstevel@tonic-gate 			return (enabled_pol ? B_FALSE : B_TRUE);
8417c478bd9Sstevel@tonic-gate 		}
8427c478bd9Sstevel@tonic-gate 	}
8437c478bd9Sstevel@tonic-gate 
8447c478bd9Sstevel@tonic-gate 	/* mech was not found in list */
8457c478bd9Sstevel@tonic-gate 	return (enabled_pol ? B_TRUE : B_FALSE);
8467c478bd9Sstevel@tonic-gate }
847