17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 57c478bd9Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only 67c478bd9Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance 77c478bd9Sstevel@tonic-gate * with the License. 87c478bd9Sstevel@tonic-gate * 97c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 107c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 117c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 127c478bd9Sstevel@tonic-gate * and limitations under the License. 137c478bd9Sstevel@tonic-gate * 147c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 157c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 167c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 177c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 187c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 197c478bd9Sstevel@tonic-gate * 207c478bd9Sstevel@tonic-gate * CDDL HEADER END 217c478bd9Sstevel@tonic-gate */ 227c478bd9Sstevel@tonic-gate /* 23*e39dcb66Sdarrenm * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 247c478bd9Sstevel@tonic-gate * Use is subject to license terms. 257c478bd9Sstevel@tonic-gate */ 267c478bd9Sstevel@tonic-gate 277c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 287c478bd9Sstevel@tonic-gate 297c478bd9Sstevel@tonic-gate #include <sys/types.h> 307c478bd9Sstevel@tonic-gate #include <sys/stat.h> 317c478bd9Sstevel@tonic-gate #include <dlfcn.h> 327c478bd9Sstevel@tonic-gate #include <fcntl.h> 337c478bd9Sstevel@tonic-gate #include <link.h> 347c478bd9Sstevel@tonic-gate #include <stdio.h> 357c478bd9Sstevel@tonic-gate #include <stdlib.h> 367c478bd9Sstevel@tonic-gate #include <strings.h> 377c478bd9Sstevel@tonic-gate #include <errno.h> 387c478bd9Sstevel@tonic-gate #include <door.h> 397c478bd9Sstevel@tonic-gate #include <pthread.h> 407c478bd9Sstevel@tonic-gate #include <sys/mman.h> 417c478bd9Sstevel@tonic-gate 427c478bd9Sstevel@tonic-gate #include <sys/crypto/elfsign.h> 437c478bd9Sstevel@tonic-gate #include <cryptoutil.h> 447c478bd9Sstevel@tonic-gate 457c478bd9Sstevel@tonic-gate #include <security/cryptoki.h> 467c478bd9Sstevel@tonic-gate #include "pkcs11Global.h" 477c478bd9Sstevel@tonic-gate #include "pkcs11Conf.h" 487c478bd9Sstevel@tonic-gate #include "pkcs11Slot.h" 497c478bd9Sstevel@tonic-gate #include "metaGlobal.h" 507c478bd9Sstevel@tonic-gate 517c478bd9Sstevel@tonic-gate /* 527c478bd9Sstevel@tonic-gate * Fastpath is used when there is only one slot available from a single provider 537c478bd9Sstevel@tonic-gate * plugged into the framework this is the common case. 547c478bd9Sstevel@tonic-gate * These globals are used to track the function pointers and policy when 557c478bd9Sstevel@tonic-gate * the fast-path is activated. 567c478bd9Sstevel@tonic-gate * This will need to be revisted if per-slot policy is ever 577c478bd9Sstevel@tonic-gate * implemented. 587c478bd9Sstevel@tonic-gate */ 597c478bd9Sstevel@tonic-gate boolean_t purefastpath = B_FALSE; 607c478bd9Sstevel@tonic-gate boolean_t policyfastpath = B_FALSE; 617c478bd9Sstevel@tonic-gate CK_FUNCTION_LIST_PTR fast_funcs = NULL; 627c478bd9Sstevel@tonic-gate CK_SLOT_ID fast_slot = 0; 637c478bd9Sstevel@tonic-gate boolean_t metaslot_enabled = B_FALSE; 647c478bd9Sstevel@tonic-gate boolean_t metaslot_auto_key_migrate = B_FALSE; 657c478bd9Sstevel@tonic-gate metaslot_config_t metaslot_config; 667c478bd9Sstevel@tonic-gate 677c478bd9Sstevel@tonic-gate static const char *conf_err = "See cryptoadm(1M). Skipping this plug-in."; 687c478bd9Sstevel@tonic-gate 697c478bd9Sstevel@tonic-gate /* 707c478bd9Sstevel@tonic-gate * Set up metaslot for the framework using either user configuration 717c478bd9Sstevel@tonic-gate * or system wide configuration options 727c478bd9Sstevel@tonic-gate * 737c478bd9Sstevel@tonic-gate * Also sets up the global "slottable" to have the first slot be metaslot. 747c478bd9Sstevel@tonic-gate */ 757c478bd9Sstevel@tonic-gate static CK_RV 767c478bd9Sstevel@tonic-gate setup_metaslot(uentry_t *metaslot_entry) { 777c478bd9Sstevel@tonic-gate CK_RV rv; 787c478bd9Sstevel@tonic-gate CK_MECHANISM_TYPE_PTR prov_pol_mechs = NULL; 797c478bd9Sstevel@tonic-gate pkcs11_slot_t *cur_slot; 807c478bd9Sstevel@tonic-gate 817c478bd9Sstevel@tonic-gate /* process policies for mechanisms */ 827c478bd9Sstevel@tonic-gate if ((metaslot_entry) && (metaslot_entry->count > 0)) { 837c478bd9Sstevel@tonic-gate rv = pkcs11_mech_parse(metaslot_entry->policylist, 847c478bd9Sstevel@tonic-gate &prov_pol_mechs, metaslot_entry->count); 857c478bd9Sstevel@tonic-gate 867c478bd9Sstevel@tonic-gate if (rv == CKR_HOST_MEMORY) { 877c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, 887c478bd9Sstevel@tonic-gate "libpkcs11: Could not parse configuration," 897c478bd9Sstevel@tonic-gate "out of memory. Cannot continue parsing " 907c478bd9Sstevel@tonic-gate "%s.\n", _PATH_PKCS11_CONF); 917c478bd9Sstevel@tonic-gate return (rv); 927c478bd9Sstevel@tonic-gate } else if (rv == CKR_MECHANISM_INVALID) { 937c478bd9Sstevel@tonic-gate /* 947c478bd9Sstevel@tonic-gate * Configuration file is corrupted for metaslot 957c478bd9Sstevel@tonic-gate */ 967c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, 977c478bd9Sstevel@tonic-gate "libpkcs11: Policy invalid or corrupted " 987c478bd9Sstevel@tonic-gate "for metaslot. Use cryptoadm(1M) to fix " 997c478bd9Sstevel@tonic-gate "this. Disabling metaslot functionality.\n"); 1007c478bd9Sstevel@tonic-gate metaslot_enabled = B_FALSE; 1017c478bd9Sstevel@tonic-gate return (rv); 1027c478bd9Sstevel@tonic-gate } 1037c478bd9Sstevel@tonic-gate } 1047c478bd9Sstevel@tonic-gate 1057c478bd9Sstevel@tonic-gate /* 1067c478bd9Sstevel@tonic-gate * Check for metaslot policy. If all mechanisms are 1077c478bd9Sstevel@tonic-gate * disabled, disable metaslot since there is nothing 1087c478bd9Sstevel@tonic-gate * interesting for it to do 1097c478bd9Sstevel@tonic-gate */ 1107c478bd9Sstevel@tonic-gate if ((metaslot_entry) && (metaslot_entry->flag_enabledlist) && 1117c478bd9Sstevel@tonic-gate (prov_pol_mechs == NULL)) { 1127c478bd9Sstevel@tonic-gate metaslot_enabled = B_FALSE; 1137c478bd9Sstevel@tonic-gate return (rv); 1147c478bd9Sstevel@tonic-gate } 1157c478bd9Sstevel@tonic-gate 1167c478bd9Sstevel@tonic-gate /* 1177c478bd9Sstevel@tonic-gate * save system wide value for metaslot's keystore. 1187c478bd9Sstevel@tonic-gate * If either slot description or token label is specified by 1197c478bd9Sstevel@tonic-gate * the user, the system wide value for both is ignored. 1207c478bd9Sstevel@tonic-gate */ 1217c478bd9Sstevel@tonic-gate if ((metaslot_entry) && 1227c478bd9Sstevel@tonic-gate (!metaslot_config.keystore_token_specified) && 1237c478bd9Sstevel@tonic-gate (!metaslot_config.keystore_slot_specified)) { 1247c478bd9Sstevel@tonic-gate /* 1257c478bd9Sstevel@tonic-gate * blank_str is used for comparing with token label, 1267c478bd9Sstevel@tonic-gate * and slot description, make sure it is better than 1277c478bd9Sstevel@tonic-gate * the larger of both 1287c478bd9Sstevel@tonic-gate */ 1297c478bd9Sstevel@tonic-gate char blank_str[TOKEN_LABEL_SIZE + SLOT_DESCRIPTION_SIZE]; 1307c478bd9Sstevel@tonic-gate 1317c478bd9Sstevel@tonic-gate bzero(blank_str, sizeof (blank_str)); 1327c478bd9Sstevel@tonic-gate 1337c478bd9Sstevel@tonic-gate if (memcmp(metaslot_entry->metaslot_ks_token, 1347c478bd9Sstevel@tonic-gate blank_str, TOKEN_LABEL_SIZE) != 0) { 1357c478bd9Sstevel@tonic-gate metaslot_config.keystore_token_specified = B_TRUE; 1367c478bd9Sstevel@tonic-gate (void) strlcpy( 1377c478bd9Sstevel@tonic-gate (char *)metaslot_config.keystore_token, 1387c478bd9Sstevel@tonic-gate (const char *)metaslot_entry->metaslot_ks_token, 1397c478bd9Sstevel@tonic-gate TOKEN_LABEL_SIZE); 1407c478bd9Sstevel@tonic-gate } 1417c478bd9Sstevel@tonic-gate 1427c478bd9Sstevel@tonic-gate if (memcmp(metaslot_entry->metaslot_ks_slot, 1437c478bd9Sstevel@tonic-gate blank_str, SLOT_DESCRIPTION_SIZE) != 0) { 1447c478bd9Sstevel@tonic-gate metaslot_config.keystore_slot_specified = B_TRUE; 1457c478bd9Sstevel@tonic-gate (void) strlcpy( 1467c478bd9Sstevel@tonic-gate (char *)metaslot_config.keystore_slot, 1477c478bd9Sstevel@tonic-gate (const char *)metaslot_entry->metaslot_ks_slot, 1487c478bd9Sstevel@tonic-gate SLOT_DESCRIPTION_SIZE); 1497c478bd9Sstevel@tonic-gate } 1507c478bd9Sstevel@tonic-gate } 1517c478bd9Sstevel@tonic-gate 1527c478bd9Sstevel@tonic-gate /* check system-wide value for auto_key_migrate */ 1537c478bd9Sstevel@tonic-gate if (metaslot_config.auto_key_migrate_specified) { 1547c478bd9Sstevel@tonic-gate /* take user's specified value */ 1557c478bd9Sstevel@tonic-gate metaslot_auto_key_migrate = metaslot_config.auto_key_migrate; 1567c478bd9Sstevel@tonic-gate } else { 1577c478bd9Sstevel@tonic-gate if (metaslot_entry) { 1587c478bd9Sstevel@tonic-gate /* use system-wide default */ 1597c478bd9Sstevel@tonic-gate metaslot_auto_key_migrate = 1607c478bd9Sstevel@tonic-gate metaslot_entry->flag_metaslot_auto_key_migrate; 1617c478bd9Sstevel@tonic-gate } else { 1627c478bd9Sstevel@tonic-gate /* 1637c478bd9Sstevel@tonic-gate * there's no system wide metaslot entry, 1647c478bd9Sstevel@tonic-gate * default auto_key_migrate to true 1657c478bd9Sstevel@tonic-gate */ 1667c478bd9Sstevel@tonic-gate metaslot_auto_key_migrate = B_TRUE; 1677c478bd9Sstevel@tonic-gate } 1687c478bd9Sstevel@tonic-gate } 1697c478bd9Sstevel@tonic-gate 1707c478bd9Sstevel@tonic-gate 1717c478bd9Sstevel@tonic-gate /* Make first slotID be 0, for metaslot. */ 1727c478bd9Sstevel@tonic-gate slottable->st_first = 0; 1737c478bd9Sstevel@tonic-gate 1747c478bd9Sstevel@tonic-gate /* Set up the slottable entry for metaslot */ 1757c478bd9Sstevel@tonic-gate slottable->st_slots[0] = NULL; 1767c478bd9Sstevel@tonic-gate cur_slot = calloc(1, sizeof (pkcs11_slot_t)); 1777c478bd9Sstevel@tonic-gate if (cur_slot == NULL) { 1787c478bd9Sstevel@tonic-gate rv = CKR_HOST_MEMORY; 1797c478bd9Sstevel@tonic-gate return (rv); 1807c478bd9Sstevel@tonic-gate } 1817c478bd9Sstevel@tonic-gate cur_slot->sl_wfse_state = WFSE_CLEAR; 1827c478bd9Sstevel@tonic-gate cur_slot->sl_enabledpol = B_FALSE; 1837c478bd9Sstevel@tonic-gate cur_slot->sl_no_wfse = B_FALSE; 1847c478bd9Sstevel@tonic-gate (void) pthread_mutex_init(&cur_slot->sl_mutex, NULL); 1857c478bd9Sstevel@tonic-gate 1867c478bd9Sstevel@tonic-gate /* 1877c478bd9Sstevel@tonic-gate * The metaslot entry was prealloc'd by 1887c478bd9Sstevel@tonic-gate * pkcs11_slottable_increase() 1897c478bd9Sstevel@tonic-gate */ 1907c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&slottable->st_mutex); 1917c478bd9Sstevel@tonic-gate slottable->st_slots[0] = cur_slot; 1927c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&slottable->st_mutex); 1937c478bd9Sstevel@tonic-gate 1947c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&cur_slot->sl_mutex); 1957c478bd9Sstevel@tonic-gate cur_slot->sl_id = METASLOT_SLOTID; 1967c478bd9Sstevel@tonic-gate cur_slot->sl_func_list = &metaslot_functionList; 1977c478bd9Sstevel@tonic-gate if (metaslot_entry) { 1987c478bd9Sstevel@tonic-gate cur_slot->sl_enabledpol = metaslot_entry->flag_enabledlist; 1997c478bd9Sstevel@tonic-gate cur_slot->sl_pol_count = metaslot_entry->count; 2007c478bd9Sstevel@tonic-gate } else { 2017c478bd9Sstevel@tonic-gate /* if no metaslot entry, assume all mechs are enabled */ 2027c478bd9Sstevel@tonic-gate cur_slot->sl_enabledpol = B_FALSE; 2037c478bd9Sstevel@tonic-gate cur_slot->sl_pol_count = 0; 2047c478bd9Sstevel@tonic-gate } 2057c478bd9Sstevel@tonic-gate cur_slot->sl_pol_mechs = prov_pol_mechs; 2067c478bd9Sstevel@tonic-gate cur_slot->sl_dldesc = NULL; /* not applicable */ 2077c478bd9Sstevel@tonic-gate cur_slot->sl_prov_id = 0; 2087c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&cur_slot->sl_mutex); 2097c478bd9Sstevel@tonic-gate 2107c478bd9Sstevel@tonic-gate /* Call the meta_Initialize() to initialize metaslot */ 2117c478bd9Sstevel@tonic-gate rv = meta_Initialize(NULL); 2127c478bd9Sstevel@tonic-gate if (rv != CKR_OK) { 2137c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, 2147c478bd9Sstevel@tonic-gate "libpkcs11: Can't initialize metaslot (%s)", 2157c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 2167c478bd9Sstevel@tonic-gate goto cleanup; 2177c478bd9Sstevel@tonic-gate } 2187c478bd9Sstevel@tonic-gate 2197c478bd9Sstevel@tonic-gate return (CKR_OK); 2207c478bd9Sstevel@tonic-gate 2217c478bd9Sstevel@tonic-gate cleanup: 2227c478bd9Sstevel@tonic-gate metaslot_enabled = B_FALSE; 2237c478bd9Sstevel@tonic-gate slottable->st_slots[0] = NULL; 2247c478bd9Sstevel@tonic-gate 2257c478bd9Sstevel@tonic-gate if (cur_slot) { 2267c478bd9Sstevel@tonic-gate (void) pthread_mutex_destroy(&cur_slot->sl_mutex); 2277c478bd9Sstevel@tonic-gate free(cur_slot); 2287c478bd9Sstevel@tonic-gate } 2297c478bd9Sstevel@tonic-gate return (rv); 2307c478bd9Sstevel@tonic-gate } 2317c478bd9Sstevel@tonic-gate 2327c478bd9Sstevel@tonic-gate /* 2337c478bd9Sstevel@tonic-gate * For each provider found in pkcs11.conf: expand $ISA if necessary, 2347c478bd9Sstevel@tonic-gate * verify the module is signed, load the provider, find all of its 2357c478bd9Sstevel@tonic-gate * slots, and store the function list and disabled policy. 2367c478bd9Sstevel@tonic-gate * 2377c478bd9Sstevel@tonic-gate * This function requires that the uentrylist_t and pkcs11_slottable_t 2387c478bd9Sstevel@tonic-gate * already have memory allocated, and that the uentrylist_t is already 2397c478bd9Sstevel@tonic-gate * populated with provider and policy information. 2407c478bd9Sstevel@tonic-gate * 2417c478bd9Sstevel@tonic-gate * pInitArgs can be set to NULL, but is normally the same value 2427c478bd9Sstevel@tonic-gate * the framework's C_Initialize() was called with. 2437c478bd9Sstevel@tonic-gate * 2447c478bd9Sstevel@tonic-gate * Unless metaslot is explicitly disabled, it is setup when all other 2457c478bd9Sstevel@tonic-gate * providers are loaded. 2467c478bd9Sstevel@tonic-gate */ 2477c478bd9Sstevel@tonic-gate CK_RV 2487c478bd9Sstevel@tonic-gate pkcs11_slot_mapping(uentrylist_t *pplist, CK_VOID_PTR pInitArgs) 2497c478bd9Sstevel@tonic-gate { 2507c478bd9Sstevel@tonic-gate CK_RV rv = CKR_OK; 2517c478bd9Sstevel@tonic-gate CK_RV prov_rv; /* Provider's return code */ 2527c478bd9Sstevel@tonic-gate CK_INFO prov_info; 2537c478bd9Sstevel@tonic-gate CK_RV (*Tmp_C_GetFunctionList)(CK_FUNCTION_LIST_PTR_PTR); 2547c478bd9Sstevel@tonic-gate CK_FUNCTION_LIST_PTR prov_funcs = NULL; /* Provider's function list */ 2557c478bd9Sstevel@tonic-gate CK_ULONG prov_slot_count; /* Number of slots */ 2567c478bd9Sstevel@tonic-gate CK_SLOT_ID slot_id; /* slotID assigned for framework */ 2577c478bd9Sstevel@tonic-gate CK_SLOT_ID_PTR prov_slots = NULL; /* Provider's slot list */ 2587c478bd9Sstevel@tonic-gate /* Enabled or Disabled policy */ 2597c478bd9Sstevel@tonic-gate CK_MECHANISM_TYPE_PTR prov_pol_mechs = NULL; 2607c478bd9Sstevel@tonic-gate 2617c478bd9Sstevel@tonic-gate void *dldesc = NULL; 2627c478bd9Sstevel@tonic-gate char *isa, *fullpath = NULL, *dl_error; 2637c478bd9Sstevel@tonic-gate uentrylist_t *phead; 2647c478bd9Sstevel@tonic-gate uint_t prov_count = 0; 2657c478bd9Sstevel@tonic-gate pkcs11_slot_t *cur_slot; 2667c478bd9Sstevel@tonic-gate CK_ULONG i; 2677c478bd9Sstevel@tonic-gate size_t len; 2687c478bd9Sstevel@tonic-gate uentry_t *metaslot_entry = NULL; 2697c478bd9Sstevel@tonic-gate /* number of slots in the framework, not including metaslot */ 2707c478bd9Sstevel@tonic-gate uint_t slot_count = 0; 2717c478bd9Sstevel@tonic-gate 2727c478bd9Sstevel@tonic-gate ELFsign_status_t estatus = ELFSIGN_UNKNOWN; 2737c478bd9Sstevel@tonic-gate char *estatus_str = NULL; 2747c478bd9Sstevel@tonic-gate int kcfdfd = -1; 2757c478bd9Sstevel@tonic-gate door_arg_t darg; 2767c478bd9Sstevel@tonic-gate kcf_door_arg_t *kda = NULL; 2777c478bd9Sstevel@tonic-gate kcf_door_arg_t *rkda = NULL; 2787c478bd9Sstevel@tonic-gate int r; 2797c478bd9Sstevel@tonic-gate 2807c478bd9Sstevel@tonic-gate phead = pplist; 2817c478bd9Sstevel@tonic-gate 2827c478bd9Sstevel@tonic-gate /* Loop through all of the provider listed in pkcs11.conf */ 2837c478bd9Sstevel@tonic-gate while (phead != NULL) { 2847c478bd9Sstevel@tonic-gate if (!strcasecmp(phead->puent->name, "metaslot")) { 2857c478bd9Sstevel@tonic-gate /* 2867c478bd9Sstevel@tonic-gate * Skip standard processing for metaslot 2877c478bd9Sstevel@tonic-gate * entry since it is not an actual library 2887c478bd9Sstevel@tonic-gate * that can be dlopened. 2897c478bd9Sstevel@tonic-gate * It will be initialized later. 2907c478bd9Sstevel@tonic-gate */ 2917c478bd9Sstevel@tonic-gate if (metaslot_entry != NULL) { 2927c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, 2937c478bd9Sstevel@tonic-gate "libpkcs11: multiple entries for metaslot " 2947c478bd9Sstevel@tonic-gate "detected. All but the first entry will " 2957c478bd9Sstevel@tonic-gate "be ignored"); 2967c478bd9Sstevel@tonic-gate } else { 2977c478bd9Sstevel@tonic-gate metaslot_entry = phead->puent; 2987c478bd9Sstevel@tonic-gate } 2997c478bd9Sstevel@tonic-gate goto contparse; 3007c478bd9Sstevel@tonic-gate } 3017c478bd9Sstevel@tonic-gate 3027c478bd9Sstevel@tonic-gate /* Check for Instruction Set Architecture indicator */ 3037c478bd9Sstevel@tonic-gate if ((isa = strstr(phead->puent->name, PKCS11_ISA)) != NULL) { 3047c478bd9Sstevel@tonic-gate /* Substitute the architecture dependent path */ 3057c478bd9Sstevel@tonic-gate len = strlen(phead->puent->name) - 3067c478bd9Sstevel@tonic-gate strlen(PKCS11_ISA) + 3077c478bd9Sstevel@tonic-gate strlen(PKCS11_ISA_DIR) + 1; 3087c478bd9Sstevel@tonic-gate if ((fullpath = (char *)malloc(len)) == NULL) { 3097c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, 3107c478bd9Sstevel@tonic-gate "libpksc11: parsing %s, out of memory. " 3117c478bd9Sstevel@tonic-gate "Cannot continue parsing.", 3127c478bd9Sstevel@tonic-gate _PATH_PKCS11_CONF); 3137c478bd9Sstevel@tonic-gate rv = CKR_HOST_MEMORY; 3147c478bd9Sstevel@tonic-gate goto conferror; 3157c478bd9Sstevel@tonic-gate } 3167c478bd9Sstevel@tonic-gate *isa = '\000'; 3177c478bd9Sstevel@tonic-gate isa += strlen(PKCS11_ISA); 3187c478bd9Sstevel@tonic-gate (void) snprintf(fullpath, len, "%s%s%s", 3197c478bd9Sstevel@tonic-gate phead->puent->name, PKCS11_ISA_DIR, isa); 3207c478bd9Sstevel@tonic-gate } else if ((fullpath = strdup(phead->puent->name)) == 0) { 3217c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, 3227c478bd9Sstevel@tonic-gate "libpkcs11: parsing %s, out of memory. " 3237c478bd9Sstevel@tonic-gate "Cannot continue parsing.", 3247c478bd9Sstevel@tonic-gate _PATH_PKCS11_CONF); 3257c478bd9Sstevel@tonic-gate rv = CKR_HOST_MEMORY; 3267c478bd9Sstevel@tonic-gate goto conferror; 3277c478bd9Sstevel@tonic-gate } 3287c478bd9Sstevel@tonic-gate 3297c478bd9Sstevel@tonic-gate /* 3307c478bd9Sstevel@tonic-gate * Open the provider. Use RTLD_NOW to make sure we 3317c478bd9Sstevel@tonic-gate * will not encounter symbol referencing errors later. 3327c478bd9Sstevel@tonic-gate * Use RTLD_GROUP to limit the provider to it's own 3337c478bd9Sstevel@tonic-gate * symbols, which prevents it from mistakenly accessing 3347c478bd9Sstevel@tonic-gate * the framework's C_* functions. 3357c478bd9Sstevel@tonic-gate */ 3367c478bd9Sstevel@tonic-gate dldesc = dlopen(fullpath, RTLD_NOW|RTLD_GROUP); 3377c478bd9Sstevel@tonic-gate 3387c478bd9Sstevel@tonic-gate /* 3397c478bd9Sstevel@tonic-gate * If we failed to load it, we will just skip this 3407c478bd9Sstevel@tonic-gate * provider and move on to the next one. 3417c478bd9Sstevel@tonic-gate */ 3427c478bd9Sstevel@tonic-gate if (dldesc == NULL) { 3437c478bd9Sstevel@tonic-gate dl_error = dlerror(); 3447c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, 3457c478bd9Sstevel@tonic-gate "libpkcs11: Cannot load PKCS#11 library %s. " 3467c478bd9Sstevel@tonic-gate "dlerror: %s. %s", 3477c478bd9Sstevel@tonic-gate fullpath, dl_error != NULL ? dl_error : "Unknown", 3487c478bd9Sstevel@tonic-gate conf_err); 3497c478bd9Sstevel@tonic-gate goto contparse; 3507c478bd9Sstevel@tonic-gate } 3517c478bd9Sstevel@tonic-gate 3527c478bd9Sstevel@tonic-gate /* Get the pointer to provider's C_GetFunctionList() */ 3537c478bd9Sstevel@tonic-gate Tmp_C_GetFunctionList = 3547c478bd9Sstevel@tonic-gate (CK_RV(*)())dlsym(dldesc, "C_GetFunctionList"); 3557c478bd9Sstevel@tonic-gate 3567c478bd9Sstevel@tonic-gate /* 3577c478bd9Sstevel@tonic-gate * If we failed to get the pointer to C_GetFunctionList(), 3587c478bd9Sstevel@tonic-gate * skip this provider and continue to the next one. 3597c478bd9Sstevel@tonic-gate */ 3607c478bd9Sstevel@tonic-gate if (Tmp_C_GetFunctionList == NULL) { 3617c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, 3627c478bd9Sstevel@tonic-gate "libpkcs11: Could not dlsym() C_GetFunctionList() " 3637c478bd9Sstevel@tonic-gate "for %s. May not be a PKCS#11 library. %s", 3647c478bd9Sstevel@tonic-gate fullpath, conf_err); 3657c478bd9Sstevel@tonic-gate (void) dlclose(dldesc); 3667c478bd9Sstevel@tonic-gate goto contparse; 3677c478bd9Sstevel@tonic-gate } 3687c478bd9Sstevel@tonic-gate 3697c478bd9Sstevel@tonic-gate 3707c478bd9Sstevel@tonic-gate /* Get the provider's function list */ 3717c478bd9Sstevel@tonic-gate prov_rv = Tmp_C_GetFunctionList(&prov_funcs); 3727c478bd9Sstevel@tonic-gate 3737c478bd9Sstevel@tonic-gate /* 3747c478bd9Sstevel@tonic-gate * If we failed to get the provider's function list, 3757c478bd9Sstevel@tonic-gate * skip this provider and continue to the next one. 3767c478bd9Sstevel@tonic-gate */ 3777c478bd9Sstevel@tonic-gate if (prov_rv != CKR_OK) { 3787c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, 3797c478bd9Sstevel@tonic-gate "libpkcs11: Could not get function list for %s. " 3807c478bd9Sstevel@tonic-gate "%s Error: %s.", 3817c478bd9Sstevel@tonic-gate fullpath, conf_err, pkcs11_strerror(prov_rv)); 3827c478bd9Sstevel@tonic-gate (void) dlclose(dldesc); 3837c478bd9Sstevel@tonic-gate goto contparse; 3847c478bd9Sstevel@tonic-gate } 3857c478bd9Sstevel@tonic-gate 3867c478bd9Sstevel@tonic-gate /* Initialize this provider */ 3877c478bd9Sstevel@tonic-gate prov_rv = prov_funcs->C_Initialize(pInitArgs); 3887c478bd9Sstevel@tonic-gate 3897c478bd9Sstevel@tonic-gate /* 3907c478bd9Sstevel@tonic-gate * If we failed to initialize this provider, 3917c478bd9Sstevel@tonic-gate * skip this provider and continue to the next one. 3927c478bd9Sstevel@tonic-gate */ 3937c478bd9Sstevel@tonic-gate if ((prov_rv != CKR_OK) && 3947c478bd9Sstevel@tonic-gate (prov_rv != CKR_CRYPTOKI_ALREADY_INITIALIZED)) { 3957c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, 3967c478bd9Sstevel@tonic-gate "libpkcs11: Could not initialize %s. " 3977c478bd9Sstevel@tonic-gate "%s Error: %s.", 3987c478bd9Sstevel@tonic-gate fullpath, conf_err, pkcs11_strerror(prov_rv)); 3997c478bd9Sstevel@tonic-gate (void) dlclose(dldesc); 4007c478bd9Sstevel@tonic-gate goto contparse; 4017c478bd9Sstevel@tonic-gate } 4027c478bd9Sstevel@tonic-gate 4037c478bd9Sstevel@tonic-gate /* 4047c478bd9Sstevel@tonic-gate * Make sure this provider is implementing the same 4057c478bd9Sstevel@tonic-gate * major version, and at least the same minor version 4067c478bd9Sstevel@tonic-gate * that we are. 4077c478bd9Sstevel@tonic-gate */ 4087c478bd9Sstevel@tonic-gate prov_rv = prov_funcs->C_GetInfo(&prov_info); 4097c478bd9Sstevel@tonic-gate 4107c478bd9Sstevel@tonic-gate /* 4117c478bd9Sstevel@tonic-gate * If we can't verify that we are implementing the 4127c478bd9Sstevel@tonic-gate * same major version, or if it is definitely not the same 4137c478bd9Sstevel@tonic-gate * version, we need to skip this provider. 4147c478bd9Sstevel@tonic-gate */ 4157c478bd9Sstevel@tonic-gate if ((prov_rv != CKR_OK) || 4167c478bd9Sstevel@tonic-gate (prov_info.cryptokiVersion.major != 4177c478bd9Sstevel@tonic-gate CRYPTOKI_VERSION_MAJOR)) { 4187c478bd9Sstevel@tonic-gate if (prov_rv != CKR_OK) { 4197c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, 4207c478bd9Sstevel@tonic-gate "libpkcs11: Could not verify version of " 4217c478bd9Sstevel@tonic-gate "%s. %s Error: %s.", fullpath, 4227c478bd9Sstevel@tonic-gate conf_err, pkcs11_strerror(prov_rv)); 4237c478bd9Sstevel@tonic-gate } else { 4247c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, 4257c478bd9Sstevel@tonic-gate "libpkcs11: Only CRYPTOKI major version " 4267c478bd9Sstevel@tonic-gate "%d is supported. %s is major " 4277c478bd9Sstevel@tonic-gate "version %d. %s", 4287c478bd9Sstevel@tonic-gate CRYPTOKI_VERSION_MAJOR, fullpath, 4297c478bd9Sstevel@tonic-gate prov_info.cryptokiVersion.major, conf_err); 4307c478bd9Sstevel@tonic-gate } 4317c478bd9Sstevel@tonic-gate (void) prov_funcs->C_Finalize(NULL); 4327c478bd9Sstevel@tonic-gate (void) dlclose(dldesc); 4337c478bd9Sstevel@tonic-gate goto contparse; 4347c478bd9Sstevel@tonic-gate } 4357c478bd9Sstevel@tonic-gate 4367c478bd9Sstevel@tonic-gate /* 437*e39dcb66Sdarrenm * Warn the administrator (at debug) that a provider with 4387c478bd9Sstevel@tonic-gate * a significantly older or newer version of 4397c478bd9Sstevel@tonic-gate * CRYPTOKI is being used. It should not cause 4407c478bd9Sstevel@tonic-gate * problems, but logging a warning makes it easier 4417c478bd9Sstevel@tonic-gate * to debug later. 4427c478bd9Sstevel@tonic-gate */ 4437c478bd9Sstevel@tonic-gate if ((prov_info.cryptokiVersion.minor < 4447c478bd9Sstevel@tonic-gate CRYPTOKI_VERSION_WARN_MINOR) || 4457c478bd9Sstevel@tonic-gate (prov_info.cryptokiVersion.minor > 4467c478bd9Sstevel@tonic-gate CRYPTOKI_VERSION_MINOR)) { 447*e39dcb66Sdarrenm cryptoerror(LOG_DEBUG, 4487c478bd9Sstevel@tonic-gate "libpkcs11: %s CRYPTOKI minor version, %d, may " 4497c478bd9Sstevel@tonic-gate "not be compatible with minor version %d.", 4507c478bd9Sstevel@tonic-gate fullpath, prov_info.cryptokiVersion.minor, 4517c478bd9Sstevel@tonic-gate CRYPTOKI_VERSION_MINOR); 4527c478bd9Sstevel@tonic-gate } 4537c478bd9Sstevel@tonic-gate 4547c478bd9Sstevel@tonic-gate /* 4557c478bd9Sstevel@tonic-gate * Find out how many slots this provider has, 4567c478bd9Sstevel@tonic-gate * call with tokenPresent set to FALSE so all 4577c478bd9Sstevel@tonic-gate * potential slots are returned. 4587c478bd9Sstevel@tonic-gate */ 4597c478bd9Sstevel@tonic-gate prov_rv = prov_funcs->C_GetSlotList(FALSE, 4607c478bd9Sstevel@tonic-gate NULL, &prov_slot_count); 4617c478bd9Sstevel@tonic-gate 4627c478bd9Sstevel@tonic-gate /* 4637c478bd9Sstevel@tonic-gate * If the call failed, or if no slots are returned, 4647c478bd9Sstevel@tonic-gate * then skip this provider and continue to next one. 4657c478bd9Sstevel@tonic-gate */ 4667c478bd9Sstevel@tonic-gate if (prov_rv != CKR_OK) { 4677c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, 4687c478bd9Sstevel@tonic-gate "libpksc11: Could not get slot list from %s. " 4697c478bd9Sstevel@tonic-gate "%s Error: %s.", 4707c478bd9Sstevel@tonic-gate fullpath, conf_err, pkcs11_strerror(prov_rv)); 4717c478bd9Sstevel@tonic-gate (void) prov_funcs->C_Finalize(NULL); 4727c478bd9Sstevel@tonic-gate (void) dlclose(dldesc); 4737c478bd9Sstevel@tonic-gate goto contparse; 4747c478bd9Sstevel@tonic-gate } 4757c478bd9Sstevel@tonic-gate 4767c478bd9Sstevel@tonic-gate if (prov_slot_count == 0) { 4777c478bd9Sstevel@tonic-gate cryptodebug("libpkcs11: No slots presented from %s. " 4787c478bd9Sstevel@tonic-gate "Skipping this plug-in at this time.\n", 4797c478bd9Sstevel@tonic-gate fullpath); 4807c478bd9Sstevel@tonic-gate (void) prov_funcs->C_Finalize(NULL); 4817c478bd9Sstevel@tonic-gate (void) dlclose(dldesc); 4827c478bd9Sstevel@tonic-gate goto contparse; 4837c478bd9Sstevel@tonic-gate } 4847c478bd9Sstevel@tonic-gate 4857c478bd9Sstevel@tonic-gate /* 4867c478bd9Sstevel@tonic-gate * Verify that the module is signed correctly. 4877c478bd9Sstevel@tonic-gate * 4887c478bd9Sstevel@tonic-gate * NOTE: there is a potential race condition here, 4897c478bd9Sstevel@tonic-gate * since the module is verified well after we have 4907c478bd9Sstevel@tonic-gate * opened the provider via dlopen(). This could be 4917c478bd9Sstevel@tonic-gate * resolved by a variant of dlopen() that would take a 4927c478bd9Sstevel@tonic-gate * file descriptor as an argument and by changing the 4937c478bd9Sstevel@tonic-gate * kcfd libelfsign door protocol to use and fd instead 4947c478bd9Sstevel@tonic-gate * of a path - but that wouldn't work in the kernel case. 4957c478bd9Sstevel@tonic-gate */ 4967c478bd9Sstevel@tonic-gate while ((kcfdfd = open(_PATH_KCFD_DOOR, O_RDONLY)) == -1) { 4977c478bd9Sstevel@tonic-gate if (errno != EINTR) 4987c478bd9Sstevel@tonic-gate break; 4997c478bd9Sstevel@tonic-gate } 5007c478bd9Sstevel@tonic-gate if (kcfdfd == -1) { 5017c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, "libpkcs11: open %s: %s", 5027c478bd9Sstevel@tonic-gate _PATH_KCFD_DOOR, 5037c478bd9Sstevel@tonic-gate strerror(errno)); 5047c478bd9Sstevel@tonic-gate goto verifycleanup; 5057c478bd9Sstevel@tonic-gate } 5067c478bd9Sstevel@tonic-gate 5077c478bd9Sstevel@tonic-gate /* Mark the door "close on exec" */ 5087c478bd9Sstevel@tonic-gate (void) fcntl(kcfdfd, F_SETFD, FD_CLOEXEC); 5097c478bd9Sstevel@tonic-gate 5107c478bd9Sstevel@tonic-gate if ((kda = malloc(sizeof (kcf_door_arg_t))) == NULL) { 5117c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, "libpkcs11: malloc of kda " 5127c478bd9Sstevel@tonic-gate "failed: %s", strerror(errno)); 5137c478bd9Sstevel@tonic-gate goto verifycleanup; 5147c478bd9Sstevel@tonic-gate } 5157c478bd9Sstevel@tonic-gate kda->da_version = KCF_KCFD_VERSION1; 5167c478bd9Sstevel@tonic-gate kda->da_iskernel = B_FALSE; 5177c478bd9Sstevel@tonic-gate (void) strlcpy(kda->da_u.filename, fullpath, 5187c478bd9Sstevel@tonic-gate strlen(fullpath) + 1); 5197c478bd9Sstevel@tonic-gate 5207c478bd9Sstevel@tonic-gate darg.data_ptr = (char *)kda; 5217c478bd9Sstevel@tonic-gate darg.data_size = sizeof (kcf_door_arg_t); 5227c478bd9Sstevel@tonic-gate darg.desc_ptr = NULL; 5237c478bd9Sstevel@tonic-gate darg.desc_num = 0; 5247c478bd9Sstevel@tonic-gate darg.rbuf = (char *)kda; 5257c478bd9Sstevel@tonic-gate darg.rsize = sizeof (kcf_door_arg_t); 5267c478bd9Sstevel@tonic-gate 5277c478bd9Sstevel@tonic-gate while ((r = door_call(kcfdfd, &darg)) != 0) { 5287c478bd9Sstevel@tonic-gate if (errno != EINTR) 5297c478bd9Sstevel@tonic-gate break; 5307c478bd9Sstevel@tonic-gate } 5317c478bd9Sstevel@tonic-gate 5327c478bd9Sstevel@tonic-gate if (r != 0) { 5337c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, 5347c478bd9Sstevel@tonic-gate "libpkcs11: Unable to contact kcfd: %s", 5357c478bd9Sstevel@tonic-gate strerror(errno)); 5367c478bd9Sstevel@tonic-gate goto verifycleanup; 5377c478bd9Sstevel@tonic-gate } 5387c478bd9Sstevel@tonic-gate 5397c478bd9Sstevel@tonic-gate /*LINTED*/ 5407c478bd9Sstevel@tonic-gate rkda = (kcf_door_arg_t *)darg.rbuf; 5417c478bd9Sstevel@tonic-gate if (rkda->da_version != KCF_KCFD_VERSION1) { 5427c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, 5437c478bd9Sstevel@tonic-gate "libpkcs11: kcfd and libelfsign versions " 5447c478bd9Sstevel@tonic-gate "don't match: got %d expected %d", 5457c478bd9Sstevel@tonic-gate rkda->da_version, KCF_KCFD_VERSION1); 5467c478bd9Sstevel@tonic-gate goto verifycleanup; 5477c478bd9Sstevel@tonic-gate } 5487c478bd9Sstevel@tonic-gate estatus = rkda->da_u.result.status; 5497c478bd9Sstevel@tonic-gate verifycleanup: 5507c478bd9Sstevel@tonic-gate if (kcfdfd != -1) { 5517c478bd9Sstevel@tonic-gate (void) close(kcfdfd); 5527c478bd9Sstevel@tonic-gate } 5537c478bd9Sstevel@tonic-gate if (rkda != NULL && rkda != kda) 5547c478bd9Sstevel@tonic-gate (void) munmap((char *)rkda, darg.rsize); 5557c478bd9Sstevel@tonic-gate if (kda != NULL) { 5567c478bd9Sstevel@tonic-gate bzero(kda, sizeof (kda)); 5577c478bd9Sstevel@tonic-gate free(kda); 5587c478bd9Sstevel@tonic-gate kda = NULL; 5597c478bd9Sstevel@tonic-gate rkda = NULL; /* rkda is an alias of kda */ 5607c478bd9Sstevel@tonic-gate } 5617c478bd9Sstevel@tonic-gate 5627c478bd9Sstevel@tonic-gate switch (estatus) { 5637c478bd9Sstevel@tonic-gate case ELFSIGN_SUCCESS: 5647c478bd9Sstevel@tonic-gate case ELFSIGN_RESTRICTED: 5657c478bd9Sstevel@tonic-gate break; 5667c478bd9Sstevel@tonic-gate case ELFSIGN_NOTSIGNED: 5677c478bd9Sstevel@tonic-gate estatus_str = strdup("not a signed provider."); 5687c478bd9Sstevel@tonic-gate break; 5697c478bd9Sstevel@tonic-gate case ELFSIGN_FAILED: 5707c478bd9Sstevel@tonic-gate estatus_str = strdup("signature verification failed."); 5717c478bd9Sstevel@tonic-gate break; 5727c478bd9Sstevel@tonic-gate default: 5737c478bd9Sstevel@tonic-gate estatus_str = strdup("unexpected failure in ELF " 5747c478bd9Sstevel@tonic-gate "signature verification. " 5757c478bd9Sstevel@tonic-gate "System may have been tampered with."); 5767c478bd9Sstevel@tonic-gate } 5777c478bd9Sstevel@tonic-gate if (estatus_str != NULL) { 5787c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, "libpkcs11: %s %s %s", 5797c478bd9Sstevel@tonic-gate fullpath, estatus_str ? estatus_str : "", 5807c478bd9Sstevel@tonic-gate estatus == ELFSIGN_UNKNOWN ? 5817c478bd9Sstevel@tonic-gate "Cannot continue parsing " _PATH_PKCS11_CONF: 5827c478bd9Sstevel@tonic-gate conf_err); 5837c478bd9Sstevel@tonic-gate (void) prov_funcs->C_Finalize(NULL); 5847c478bd9Sstevel@tonic-gate (void) dlclose(dldesc); 5857c478bd9Sstevel@tonic-gate free(estatus_str); 5867c478bd9Sstevel@tonic-gate estatus_str = NULL; 5877c478bd9Sstevel@tonic-gate if (estatus == ELFSIGN_UNKNOWN) { 5887c478bd9Sstevel@tonic-gate prov_funcs = NULL; 5897c478bd9Sstevel@tonic-gate dldesc = NULL; 5907c478bd9Sstevel@tonic-gate rv = CKR_GENERAL_ERROR; 5917c478bd9Sstevel@tonic-gate goto conferror; 5927c478bd9Sstevel@tonic-gate } 5937c478bd9Sstevel@tonic-gate goto contparse; 5947c478bd9Sstevel@tonic-gate } 5957c478bd9Sstevel@tonic-gate 5967c478bd9Sstevel@tonic-gate /* Allocate memory for the slot list */ 5977c478bd9Sstevel@tonic-gate prov_slots = calloc(prov_slot_count, sizeof (CK_SLOT_ID)); 5987c478bd9Sstevel@tonic-gate 5997c478bd9Sstevel@tonic-gate if (prov_slots == NULL) { 6007c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, 6017c478bd9Sstevel@tonic-gate "libpkcs11: Could not allocate memory for " 6027c478bd9Sstevel@tonic-gate "plug-in slots. Cannot continue parsing %s\n", 6037c478bd9Sstevel@tonic-gate _PATH_PKCS11_CONF); 6047c478bd9Sstevel@tonic-gate rv = CKR_HOST_MEMORY; 6057c478bd9Sstevel@tonic-gate goto conferror; 6067c478bd9Sstevel@tonic-gate } 6077c478bd9Sstevel@tonic-gate 6087c478bd9Sstevel@tonic-gate /* Get slot list from provider */ 6097c478bd9Sstevel@tonic-gate prov_rv = prov_funcs->C_GetSlotList(FALSE, 6107c478bd9Sstevel@tonic-gate prov_slots, &prov_slot_count); 6117c478bd9Sstevel@tonic-gate 6127c478bd9Sstevel@tonic-gate /* if second call fails, drop this provider */ 6137c478bd9Sstevel@tonic-gate if (prov_rv != CKR_OK) { 6147c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, 6157c478bd9Sstevel@tonic-gate "libpkcs11: Second call to C_GetSlotList() for %s " 6167c478bd9Sstevel@tonic-gate "failed. %s Error: %s.", 6177c478bd9Sstevel@tonic-gate fullpath, conf_err, pkcs11_strerror(prov_rv)); 6187c478bd9Sstevel@tonic-gate (void) prov_funcs->C_Finalize(NULL); 6197c478bd9Sstevel@tonic-gate (void) dlclose(dldesc); 6207c478bd9Sstevel@tonic-gate goto contparse; 6217c478bd9Sstevel@tonic-gate } 6227c478bd9Sstevel@tonic-gate 6237c478bd9Sstevel@tonic-gate /* 6247c478bd9Sstevel@tonic-gate * Parse the list of disabled or enabled mechanisms, will 6257c478bd9Sstevel@tonic-gate * apply to each of the provider's slots. 6267c478bd9Sstevel@tonic-gate */ 6277c478bd9Sstevel@tonic-gate if (phead->puent->count > 0) { 6287c478bd9Sstevel@tonic-gate rv = pkcs11_mech_parse(phead->puent->policylist, 6297c478bd9Sstevel@tonic-gate &prov_pol_mechs, phead->puent->count); 6307c478bd9Sstevel@tonic-gate 6317c478bd9Sstevel@tonic-gate if (rv == CKR_HOST_MEMORY) { 6327c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, 6337c478bd9Sstevel@tonic-gate "libpkcs11: Could not parse configuration," 6347c478bd9Sstevel@tonic-gate "out of memory. Cannot continue parsing " 6357c478bd9Sstevel@tonic-gate "%s.", _PATH_PKCS11_CONF); 6367c478bd9Sstevel@tonic-gate goto conferror; 6377c478bd9Sstevel@tonic-gate } else if (rv == CKR_MECHANISM_INVALID) { 6387c478bd9Sstevel@tonic-gate /* 6397c478bd9Sstevel@tonic-gate * Configuration file is corrupted for this 6407c478bd9Sstevel@tonic-gate * provider. 6417c478bd9Sstevel@tonic-gate */ 6427c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, 6437c478bd9Sstevel@tonic-gate "libpkcs11: Policy invalid or corrupted " 6447c478bd9Sstevel@tonic-gate "for %s. Use cryptoadm(1M) to fix " 6457c478bd9Sstevel@tonic-gate "this. Skipping this plug-in.", 6467c478bd9Sstevel@tonic-gate fullpath); 6477c478bd9Sstevel@tonic-gate (void) prov_funcs->C_Finalize(NULL); 6487c478bd9Sstevel@tonic-gate (void) dlclose(dldesc); 6497c478bd9Sstevel@tonic-gate goto contparse; 6507c478bd9Sstevel@tonic-gate } 6517c478bd9Sstevel@tonic-gate } 6527c478bd9Sstevel@tonic-gate 6537c478bd9Sstevel@tonic-gate /* Allocate memory in our slottable for these slots */ 6547c478bd9Sstevel@tonic-gate rv = pkcs11_slottable_increase(prov_slot_count); 6557c478bd9Sstevel@tonic-gate 6567c478bd9Sstevel@tonic-gate /* 6577c478bd9Sstevel@tonic-gate * If any error is returned, it will be memory related, 6587c478bd9Sstevel@tonic-gate * so we need to abort the attempt at filling the 6597c478bd9Sstevel@tonic-gate * slottable. 6607c478bd9Sstevel@tonic-gate */ 6617c478bd9Sstevel@tonic-gate if (rv != CKR_OK) { 6627c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, 6637c478bd9Sstevel@tonic-gate "libpkcs11: slottable could not increase. " 6647c478bd9Sstevel@tonic-gate "Cannot continue parsing %s.", 6657c478bd9Sstevel@tonic-gate _PATH_PKCS11_CONF); 6667c478bd9Sstevel@tonic-gate goto conferror; 6677c478bd9Sstevel@tonic-gate } 6687c478bd9Sstevel@tonic-gate 6697c478bd9Sstevel@tonic-gate /* Configure information for each new slot */ 6707c478bd9Sstevel@tonic-gate for (i = 0; i < prov_slot_count; i++) { 6717c478bd9Sstevel@tonic-gate /* allocate slot in framework */ 6727c478bd9Sstevel@tonic-gate rv = pkcs11_slot_allocate(&slot_id); 6737c478bd9Sstevel@tonic-gate if (rv != CKR_OK) { 6747c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, 6757c478bd9Sstevel@tonic-gate "libpkcs11: Could not allocate " 6767c478bd9Sstevel@tonic-gate "new slot. Cannot continue parsing %s.", 6777c478bd9Sstevel@tonic-gate _PATH_PKCS11_CONF); 6787c478bd9Sstevel@tonic-gate goto conferror; 6797c478bd9Sstevel@tonic-gate } 6807c478bd9Sstevel@tonic-gate slot_count++; 6817c478bd9Sstevel@tonic-gate cur_slot = slottable->st_slots[slot_id]; 6827c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&cur_slot->sl_mutex); 6837c478bd9Sstevel@tonic-gate cur_slot->sl_id = prov_slots[i]; 6847c478bd9Sstevel@tonic-gate cur_slot->sl_func_list = prov_funcs; 6857c478bd9Sstevel@tonic-gate cur_slot->sl_enabledpol = 6867c478bd9Sstevel@tonic-gate phead->puent->flag_enabledlist; 6877c478bd9Sstevel@tonic-gate cur_slot->sl_pol_mechs = prov_pol_mechs; 6887c478bd9Sstevel@tonic-gate cur_slot->sl_pol_count = phead->puent->count; 6897c478bd9Sstevel@tonic-gate cur_slot->sl_norandom = phead->puent->flag_norandom; 6907c478bd9Sstevel@tonic-gate cur_slot->sl_dldesc = dldesc; 6917c478bd9Sstevel@tonic-gate cur_slot->sl_prov_id = prov_count + 1; 6927c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&cur_slot->sl_mutex); 6937c478bd9Sstevel@tonic-gate } 6947c478bd9Sstevel@tonic-gate 6957c478bd9Sstevel@tonic-gate 6967c478bd9Sstevel@tonic-gate /* Set and reset values to process next provider */ 6977c478bd9Sstevel@tonic-gate prov_count++; 6987c478bd9Sstevel@tonic-gate contparse: 6997c478bd9Sstevel@tonic-gate prov_slot_count = 0; 7007c478bd9Sstevel@tonic-gate Tmp_C_GetFunctionList = NULL; 7017c478bd9Sstevel@tonic-gate prov_funcs = NULL; 7027c478bd9Sstevel@tonic-gate dldesc = NULL; 7037c478bd9Sstevel@tonic-gate if (fullpath != NULL) { 7047c478bd9Sstevel@tonic-gate free(fullpath); 7057c478bd9Sstevel@tonic-gate fullpath = NULL; 7067c478bd9Sstevel@tonic-gate } 7077c478bd9Sstevel@tonic-gate if (prov_slots != NULL) { 7087c478bd9Sstevel@tonic-gate free(prov_slots); 7097c478bd9Sstevel@tonic-gate prov_slots = NULL; 7107c478bd9Sstevel@tonic-gate } 7117c478bd9Sstevel@tonic-gate phead = phead->next; 7127c478bd9Sstevel@tonic-gate } 7137c478bd9Sstevel@tonic-gate 7147c478bd9Sstevel@tonic-gate if (slot_count == 0) { 7157c478bd9Sstevel@tonic-gate /* 7167c478bd9Sstevel@tonic-gate * there's no other slot in the framework, 7177c478bd9Sstevel@tonic-gate * there is nothing to do 7187c478bd9Sstevel@tonic-gate */ 7197c478bd9Sstevel@tonic-gate goto config_complete; 7207c478bd9Sstevel@tonic-gate } 7217c478bd9Sstevel@tonic-gate 7227c478bd9Sstevel@tonic-gate /* determine if metaslot should be enabled */ 7237c478bd9Sstevel@tonic-gate 7247c478bd9Sstevel@tonic-gate /* 7257c478bd9Sstevel@tonic-gate * Check to see if any environment variable is defined 7267c478bd9Sstevel@tonic-gate * by the user for configuring metaslot. Users' 7277c478bd9Sstevel@tonic-gate * setting always take precedence over the system wide 7287c478bd9Sstevel@tonic-gate * setting. So, we will first check for any user's 7297c478bd9Sstevel@tonic-gate * defined env variables before looking at the system-wide 7307c478bd9Sstevel@tonic-gate * configuration. 7317c478bd9Sstevel@tonic-gate */ 7327c478bd9Sstevel@tonic-gate get_user_metaslot_config(); 7337c478bd9Sstevel@tonic-gate 7347c478bd9Sstevel@tonic-gate /* no metaslot entry in /etc/crypto/pkcs11.conf */ 7357c478bd9Sstevel@tonic-gate if (!metaslot_entry) { 7367c478bd9Sstevel@tonic-gate /* 7377c478bd9Sstevel@tonic-gate * If user env variable indicates metaslot should be enabled, 7387c478bd9Sstevel@tonic-gate * but there's no entry in /etc/crypto/pkcs11.conf for 7397c478bd9Sstevel@tonic-gate * metaslot at all, will respect the user's defined value 7407c478bd9Sstevel@tonic-gate */ 7417c478bd9Sstevel@tonic-gate if ((metaslot_config.enabled_specified) && 7427c478bd9Sstevel@tonic-gate (metaslot_config.enabled)) { 7437c478bd9Sstevel@tonic-gate metaslot_enabled = B_TRUE; 7447c478bd9Sstevel@tonic-gate } 7457c478bd9Sstevel@tonic-gate } else { 7467c478bd9Sstevel@tonic-gate if (!metaslot_config.enabled_specified) { 7477c478bd9Sstevel@tonic-gate /* 7487c478bd9Sstevel@tonic-gate * take system wide value if 7497c478bd9Sstevel@tonic-gate * it is not specified by user 7507c478bd9Sstevel@tonic-gate */ 7517c478bd9Sstevel@tonic-gate metaslot_enabled 7527c478bd9Sstevel@tonic-gate = metaslot_entry->flag_metaslot_enabled; 7537c478bd9Sstevel@tonic-gate } else { 7547c478bd9Sstevel@tonic-gate metaslot_enabled = metaslot_config.enabled; 7557c478bd9Sstevel@tonic-gate } 7567c478bd9Sstevel@tonic-gate } 7577c478bd9Sstevel@tonic-gate 7587c478bd9Sstevel@tonic-gate /* 7597c478bd9Sstevel@tonic-gate * 7607c478bd9Sstevel@tonic-gate * As long as the user or system configuration file does not 7617c478bd9Sstevel@tonic-gate * disable metaslot, it will be enabled regardless of the 7627c478bd9Sstevel@tonic-gate * number of slots plugged into the framework. Therefore, 7637c478bd9Sstevel@tonic-gate * metaslot is enabled even when there's only one slot 7647c478bd9Sstevel@tonic-gate * plugged into the framework. This is necessary for 7657c478bd9Sstevel@tonic-gate * presenting a consistent token label view to applications. 7667c478bd9Sstevel@tonic-gate * 7677c478bd9Sstevel@tonic-gate * However, for the case where there is only 1 slot plugged into 7687c478bd9Sstevel@tonic-gate * the framework, we can use "fastpath". 7697c478bd9Sstevel@tonic-gate * 7707c478bd9Sstevel@tonic-gate * "fastpath" will pass all of the application's requests 7717c478bd9Sstevel@tonic-gate * directly to the underlying provider. Only when policy is in 7727c478bd9Sstevel@tonic-gate * effect will we need to keep slotID around. 7737c478bd9Sstevel@tonic-gate * 7747c478bd9Sstevel@tonic-gate * When metaslot is enabled, and fastpath is enabled, 7757c478bd9Sstevel@tonic-gate * all the metaslot processing will be skipped. 7767c478bd9Sstevel@tonic-gate * When there is only 1 slot, there's 7777c478bd9Sstevel@tonic-gate * really not much metaslot can do in terms of combining functionality 7787c478bd9Sstevel@tonic-gate * of different slots, and object migration. 7797c478bd9Sstevel@tonic-gate * 7807c478bd9Sstevel@tonic-gate */ 7817c478bd9Sstevel@tonic-gate 7827c478bd9Sstevel@tonic-gate /* check to see if fastpath can be used */ 7837c478bd9Sstevel@tonic-gate if (slottable->st_last == slottable->st_first) { 7847c478bd9Sstevel@tonic-gate 7857c478bd9Sstevel@tonic-gate cur_slot = slottable->st_slots[slottable->st_first]; 7867c478bd9Sstevel@tonic-gate 7877c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&cur_slot->sl_mutex); 7887c478bd9Sstevel@tonic-gate 7897c478bd9Sstevel@tonic-gate if ((cur_slot->sl_pol_count == 0) && 7907c478bd9Sstevel@tonic-gate (!cur_slot->sl_enabledpol) && (!cur_slot->sl_norandom)) { 7917c478bd9Sstevel@tonic-gate /* No policy is in effect, don't need slotid */ 7927c478bd9Sstevel@tonic-gate fast_funcs = cur_slot->sl_func_list; 7937c478bd9Sstevel@tonic-gate purefastpath = B_TRUE; 7947c478bd9Sstevel@tonic-gate } else { 7957c478bd9Sstevel@tonic-gate fast_funcs = cur_slot->sl_func_list; 7967c478bd9Sstevel@tonic-gate fast_slot = slottable->st_first; 7977c478bd9Sstevel@tonic-gate policyfastpath = B_TRUE; 7987c478bd9Sstevel@tonic-gate } 7997c478bd9Sstevel@tonic-gate 8007c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&cur_slot->sl_mutex); 8017c478bd9Sstevel@tonic-gate } 8027c478bd9Sstevel@tonic-gate 8037c478bd9Sstevel@tonic-gate if ((purefastpath || policyfastpath) && (!metaslot_enabled)) { 8047c478bd9Sstevel@tonic-gate goto config_complete; 8057c478bd9Sstevel@tonic-gate } 8067c478bd9Sstevel@tonic-gate 8077c478bd9Sstevel@tonic-gate /* 8087c478bd9Sstevel@tonic-gate * If we get here, there are more than 2 slots in the framework, 8097c478bd9Sstevel@tonic-gate * we need to set up metaslot if it is enabled 8107c478bd9Sstevel@tonic-gate */ 8117c478bd9Sstevel@tonic-gate if (metaslot_enabled) { 8127c478bd9Sstevel@tonic-gate rv = setup_metaslot(metaslot_entry); 8137c478bd9Sstevel@tonic-gate if (rv != CKR_OK) { 8147c478bd9Sstevel@tonic-gate goto conferror; 8157c478bd9Sstevel@tonic-gate } 8167c478bd9Sstevel@tonic-gate } 8177c478bd9Sstevel@tonic-gate 8187c478bd9Sstevel@tonic-gate 8197c478bd9Sstevel@tonic-gate config_complete: 8207c478bd9Sstevel@tonic-gate 8217c478bd9Sstevel@tonic-gate return (CKR_OK); 8227c478bd9Sstevel@tonic-gate 8237c478bd9Sstevel@tonic-gate conferror: 8247c478bd9Sstevel@tonic-gate /* 8257c478bd9Sstevel@tonic-gate * This cleanup code is only exercised when a major, 8267c478bd9Sstevel@tonic-gate * unrecoverable error like "out of memory" occurs. 8277c478bd9Sstevel@tonic-gate */ 8287c478bd9Sstevel@tonic-gate if (prov_funcs != NULL) { 8297c478bd9Sstevel@tonic-gate (void) prov_funcs->C_Finalize(NULL); 8307c478bd9Sstevel@tonic-gate } 8317c478bd9Sstevel@tonic-gate if (dldesc != NULL) { 8327c478bd9Sstevel@tonic-gate (void) dlclose(dldesc); 8337c478bd9Sstevel@tonic-gate } 8347c478bd9Sstevel@tonic-gate if (fullpath != NULL) { 8357c478bd9Sstevel@tonic-gate free(fullpath); 8367c478bd9Sstevel@tonic-gate fullpath = NULL; 8377c478bd9Sstevel@tonic-gate } 8387c478bd9Sstevel@tonic-gate if (prov_slots != NULL) { 8397c478bd9Sstevel@tonic-gate free(prov_slots); 8407c478bd9Sstevel@tonic-gate prov_slots = NULL; 8417c478bd9Sstevel@tonic-gate } 8427c478bd9Sstevel@tonic-gate 8437c478bd9Sstevel@tonic-gate return (rv); 8447c478bd9Sstevel@tonic-gate } 8457c478bd9Sstevel@tonic-gate 8467c478bd9Sstevel@tonic-gate /* 8477c478bd9Sstevel@tonic-gate * pkcs11_mech_parse will take hex mechanism ids, as a list of 8487c478bd9Sstevel@tonic-gate * strings, and convert them to CK_MECHANISM_TYPE_PTR. 8497c478bd9Sstevel@tonic-gate */ 8507c478bd9Sstevel@tonic-gate CK_RV 8517c478bd9Sstevel@tonic-gate pkcs11_mech_parse(umechlist_t *str_list, CK_MECHANISM_TYPE_PTR *mech_list, 8527c478bd9Sstevel@tonic-gate int mech_count) 8537c478bd9Sstevel@tonic-gate { 8547c478bd9Sstevel@tonic-gate CK_MECHANISM_TYPE_PTR tmp_list; 8557c478bd9Sstevel@tonic-gate umechlist_t *shead = str_list; 8567c478bd9Sstevel@tonic-gate 8577c478bd9Sstevel@tonic-gate tmp_list = malloc(mech_count * sizeof (CK_MECHANISM_TYPE)); 8587c478bd9Sstevel@tonic-gate 8597c478bd9Sstevel@tonic-gate if (tmp_list == NULL) { 8607c478bd9Sstevel@tonic-gate cryptoerror(LOG_ERR, "libpkcs11: parsing %s, out of memory. " 8617c478bd9Sstevel@tonic-gate "Cannot continue.", 8627c478bd9Sstevel@tonic-gate _PATH_PKCS11_CONF); 8637c478bd9Sstevel@tonic-gate return (CKR_HOST_MEMORY); 8647c478bd9Sstevel@tonic-gate } 8657c478bd9Sstevel@tonic-gate 8667c478bd9Sstevel@tonic-gate *mech_list = tmp_list; 8677c478bd9Sstevel@tonic-gate 8687c478bd9Sstevel@tonic-gate /* 8697c478bd9Sstevel@tonic-gate * The following will loop mech_count times, as there are 8707c478bd9Sstevel@tonic-gate * exactly mech_count items in the str_list. 8717c478bd9Sstevel@tonic-gate */ 8727c478bd9Sstevel@tonic-gate while (shead != NULL) { 8737c478bd9Sstevel@tonic-gate CK_MECHANISM_TYPE cur_mech; 8747c478bd9Sstevel@tonic-gate 8757c478bd9Sstevel@tonic-gate errno = 0; 8767c478bd9Sstevel@tonic-gate 8777c478bd9Sstevel@tonic-gate /* 8787c478bd9Sstevel@tonic-gate * "name" is a hexadecimal number, preceded by 0x. 8797c478bd9Sstevel@tonic-gate */ 8807c478bd9Sstevel@tonic-gate cur_mech = strtoul(shead->name, NULL, 16); 8817c478bd9Sstevel@tonic-gate 8827c478bd9Sstevel@tonic-gate if ((cur_mech == 0) && 8837c478bd9Sstevel@tonic-gate ((errno == EINVAL) || (errno == ERANGE))) { 8847c478bd9Sstevel@tonic-gate free(mech_list); 8857c478bd9Sstevel@tonic-gate return (CKR_MECHANISM_INVALID); 8867c478bd9Sstevel@tonic-gate } 8877c478bd9Sstevel@tonic-gate *tmp_list = (CK_MECHANISM_TYPE)cur_mech; 8887c478bd9Sstevel@tonic-gate tmp_list++; 8897c478bd9Sstevel@tonic-gate shead = shead->next; 8907c478bd9Sstevel@tonic-gate } 8917c478bd9Sstevel@tonic-gate 8927c478bd9Sstevel@tonic-gate return (CKR_OK); 8937c478bd9Sstevel@tonic-gate } 8947c478bd9Sstevel@tonic-gate 8957c478bd9Sstevel@tonic-gate /* 8967c478bd9Sstevel@tonic-gate * pkcs11_is_dismech is provided a slotid and a mechanism. 8977c478bd9Sstevel@tonic-gate * If mech is not disabled, then return B_FALSE. 8987c478bd9Sstevel@tonic-gate */ 8997c478bd9Sstevel@tonic-gate boolean_t 9007c478bd9Sstevel@tonic-gate pkcs11_is_dismech(CK_SLOT_ID slotid, CK_MECHANISM_TYPE mech) 9017c478bd9Sstevel@tonic-gate { 9027c478bd9Sstevel@tonic-gate ulong_t i; 9037c478bd9Sstevel@tonic-gate boolean_t enabled_pol; 9047c478bd9Sstevel@tonic-gate CK_MECHANISM_TYPE_PTR pol_mechs; 9057c478bd9Sstevel@tonic-gate ulong_t pol_count; 9067c478bd9Sstevel@tonic-gate 9077c478bd9Sstevel@tonic-gate /* Find the associated slot and get the mech policy info */ 9087c478bd9Sstevel@tonic-gate (void) pthread_mutex_lock(&slottable->st_slots[slotid]->sl_mutex); 9097c478bd9Sstevel@tonic-gate enabled_pol = slottable->st_slots[slotid]->sl_enabledpol; 9107c478bd9Sstevel@tonic-gate pol_mechs = slottable->st_slots[slotid]->sl_pol_mechs; 9117c478bd9Sstevel@tonic-gate pol_count = slottable->st_slots[slotid]->sl_pol_count; 9127c478bd9Sstevel@tonic-gate (void) pthread_mutex_unlock(&slottable->st_slots[slotid]->sl_mutex); 9137c478bd9Sstevel@tonic-gate 9147c478bd9Sstevel@tonic-gate /* Check for policy */ 9157c478bd9Sstevel@tonic-gate if ((!enabled_pol) && (pol_mechs == NULL)) { 9167c478bd9Sstevel@tonic-gate /* no policy */ 9177c478bd9Sstevel@tonic-gate return (B_FALSE); 9187c478bd9Sstevel@tonic-gate } else if (pol_mechs == NULL) { 9197c478bd9Sstevel@tonic-gate /* 9207c478bd9Sstevel@tonic-gate * We have an empty enabled list, which means no 9217c478bd9Sstevel@tonic-gate * mechanisms are exempted from this policy: all 9227c478bd9Sstevel@tonic-gate * are disabled. 9237c478bd9Sstevel@tonic-gate */ 9247c478bd9Sstevel@tonic-gate return (B_TRUE); 9257c478bd9Sstevel@tonic-gate } 9267c478bd9Sstevel@tonic-gate 9277c478bd9Sstevel@tonic-gate for (i = 0; i < pol_count; i++) { 9287c478bd9Sstevel@tonic-gate /* 9297c478bd9Sstevel@tonic-gate * If it matches, return status based on this 9307c478bd9Sstevel@tonic-gate * being and enabled or a disabled list of mechs. 9317c478bd9Sstevel@tonic-gate */ 9327c478bd9Sstevel@tonic-gate if (pol_mechs[i] == mech) { 9337c478bd9Sstevel@tonic-gate return (enabled_pol ? B_FALSE : B_TRUE); 9347c478bd9Sstevel@tonic-gate } 9357c478bd9Sstevel@tonic-gate } 9367c478bd9Sstevel@tonic-gate 9377c478bd9Sstevel@tonic-gate /* mech was not found in list */ 9387c478bd9Sstevel@tonic-gate return (enabled_pol ? B_TRUE : B_FALSE); 9397c478bd9Sstevel@tonic-gate } 940