usr/src/lib/libcryptoutil/common/cryptoutil.h

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  *
  21  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
  22  */
  23 /*
  24  * Copyright 2010 Nexenta Systems, Inc.  All rights reserved.
  25  * Copyright 2014, OmniTI Computer Consulting, Inc. All rights reserved.
  26  * Copyright 2018, Joyent, Inc.
  27  */
  28
  29 #ifndef _CRYPTOUTIL_H
  30 #define _CRYPTOUTIL_H
  31
  32 #ifdef __cplusplus
  33 extern "C" {
  34 #endif
  35
  36 #include <sys/types.h>
  37 #include <syslog.h>
  38 #include <security/cryptoki.h>
  39 #include <sys/param.h>
  40
  41 #define LOG_STDERR      -1
  42 #define SUCCESS         0
  43 #define FAILURE         1
  44 #define MECH_ID_HEX_LEN 11      /* length of mechanism id in hex form */
  45
  46 #define _PATH_PKCS11_CONF       "/etc/crypto/pkcs11.conf"
  47 #define _PATH_KCF_CONF          "/etc/crypto/kcf.conf"
  48 #define _PATH_KCFD_LOCK         "/var/run/kcfd.lock"
  49
  50 /* $ISA substitution for parsing pkcs11.conf data */
  51 #define PKCS11_ISA      "/$ISA/"
  52 #if defined(_LP64)
  53 #define PKCS11_ISA_DIR  "/64/"
  54 #else   /* !_LP64 */
  55 #define PKCS11_ISA_DIR  "/"
  56 #endif
  57
  58 /* keywords and delimiters for parsing configuration files */
  59 #define SEP_COLON       ":"
  60 #define SEP_SEMICOLON   ";"
  61 #define SEP_EQUAL       "="
  62 #define SEP_COMMA       ","
  63 #define METASLOT_KEYWORD        "metaslot"
  64 #define FIPS_KEYWORD    "fips-140"
  65 #define EF_DISABLED     "disabledlist="
  66 #define EF_ENABLED      "enabledlist="
  67 #define EF_NORANDOM     "NO_RANDOM"
  68 #define METASLOT_TOKEN  "metaslot_token="
  69 #define METASLOT_SLOT   "metaslot_slot="
  70 #define METASLOT_STATUS "metaslot_status="
  71 #define EF_FIPS_STATUS  "fips_status="
  72 #define METASLOT_AUTO_KEY_MIGRATE       "metaslot_auto_key_migrate="
  73 #define ENABLED_KEYWORD         "enabled"
  74 #define DISABLED_KEYWORD        "disabled"
  75 #define SLOT_DESCRIPTION_SIZE   64
  76 #define TOKEN_LABEL_SIZE        32
  77 #define TOKEN_MANUFACTURER_SIZE 32
  78 #define TOKEN_SERIAL_SIZE       16
  79 #define CRYPTO_FIPS_MODE_DISABLED       0
  80 #define CRYPTO_FIPS_MODE_ENABLED        1
  81
  82 /*
  83  * Define the following softtoken values that are used by softtoken
  84  * library, cryptoadm and pktool command.
  85  */
  86 #define SOFT_SLOT_DESCRIPTION   \
  87                         "Sun Crypto Softtoken            " \
  88                         "                                "
  89 #define SOFT_TOKEN_LABEL        "Sun Software PKCS#11 softtoken  "
  90 #define SOFT_TOKEN_SERIAL       "                "
  91 #define SOFT_MANUFACTURER_ID    "Sun Microsystems, Inc.          "
  92 #define SOFT_DEFAULT_PIN        "changeme"
  93
  94 typedef char libname_t[MAXPATHLEN];
  95 typedef char midstr_t[MECH_ID_HEX_LEN];
  96
  97 typedef struct umechlist {
  98         midstr_t                name;   /* mechanism name in hex form */
  99         struct umechlist        *next;
 100 } umechlist_t;
 101
 102 typedef struct uentry {
 103         libname_t       name;
 104         boolean_t       flag_norandom; /* TRUE if random is disabled */
 105         boolean_t       flag_enabledlist; /* TRUE if an enabledlist */
 106         umechlist_t     *policylist; /* disabledlist or enabledlist */
 107         boolean_t       flag_metaslot_enabled; /* TRUE if metaslot's enabled */
 108         boolean_t       flag_metaslot_auto_key_migrate;
 109         CK_UTF8CHAR     metaslot_ks_slot[SLOT_DESCRIPTION_SIZE + 1];
 110         CK_UTF8CHAR     metaslot_ks_token[TOKEN_LABEL_SIZE + 1];
 111         int             count;
 112         boolean_t       flag_fips_enabled;
 113 } uentry_t;
 114
 115 typedef struct uentrylist {
 116         uentry_t        *puent;
 117         struct uentrylist       *next;
 118 } uentrylist_t;
 119
 120 /* Return codes for pkcs11_parse_uri() */
 121 #define PK11_URI_OK             0
 122 #define PK11_URI_INVALID        1
 123 #define PK11_MALLOC_ERROR       2
 124 #define PK11_URI_VALUE_OVERFLOW 3
 125 #define PK11_NOT_PKCS11_URI     4
 126
 127 /*
 128  * There is no limit for the attribute length in the spec. 256 bytes should be
 129  * enough for the object name.
 130  */
 131 #define PK11_MAX_OBJECT_LEN             256
 132 /*
 133  * CKA_ID is of type "byte array" which can be of arbitrary length. 256 bytes
 134  * should be sufficient though.
 135  */
 136 #define PK11_MAX_ID_LEN                 256
 137
 138 /* Structure for the PKCS#11 URI. */
 139 typedef struct pkcs11_uri_t {
 140         /* CKA_LABEL attribute to the C_FindObjectsInit function. */
 141         CK_UTF8CHAR_PTR object;
 142         /*
 143          * CKA_CLASS attribute to the C_FindObjectsInit function. The
 144          * "objecttype" URI attribute can have a value one of "private",
 145          * "public", "cert", "secretkey", and "data". The "objecttype" field can
 146          * have a value of CKO_PUBLIC_KEY, CKO_PRIVATE_KEY, CKO_CERTIFICATE,
 147          * CKO_SECRET_KEY, and CKO_DATA. This attribute cannot be empty in the
 148          * URI.
 149          */
 150         CK_ULONG        objecttype;
 151         /* CKO_DATA is 0 so we need this flag. Not part of the URI itself. */
 152         boolean_t       objecttype_present;
 153         /*
 154          * Token, manufufacturer, serial and model are of fixed size length in
 155          * the specification. We allocate memory on the fly to distinguish
 156          * between an attribute not present and an empty value. We check for
 157          * overflows. We always terminate the string with '\0' even when that is
 158          * not used in the PKCS#11's CK_TOKEN_INFO structure (fields are padded
 159          * with spaces).
 160          */
 161         /* Token label from CK_TOKEN_INFO. */
 162         CK_UTF8CHAR_PTR token;
 163         /* ManufacturerID from CK_TOKEN_INFO. */
 164         CK_UTF8CHAR_PTR manuf;
 165         /* SerialNumber from CK_TOKEN_INFO. */
 166         CK_CHAR_PTR     serial;
 167         /* Model from CK_TOKEN_INFO. */
 168         CK_UTF8CHAR_PTR model;
 169         /* This is a byte array, we need a length parameter as well. */
 170         CK_BYTE_PTR     id;
 171         int             id_len;
 172         /*
 173          * Location of the file with a token PIN. Application can overload this,
 174          * eg. "/bin/askpass|" may mean to read the PIN from a command. However,
 175          * the pkcs11_parse_uri() function does not interpret this field in any
 176          * way.
 177          */
 178         char            *pinfile;
 179 } pkcs11_uri_t;
 180
 181 extern void cryptodebug(const char *fmt, ...);
 182 extern void cryptoerror(int priority, const char *fmt, ...);
 183 extern void cryptodebug_init(const char *prefix);
 184 extern void cryptoerror_off();
 185 extern void cryptoerror_on();
 186
 187 extern const char *pkcs11_mech2str(CK_MECHANISM_TYPE mech);
 188 extern CK_RV pkcs11_str2mech(char *mech_str, CK_MECHANISM_TYPE_PTR mech);
 189
 190 extern int get_pkcs11conf_info(uentrylist_t **);
 191 extern umechlist_t *create_umech(char *);
 192 extern void free_umechlist(umechlist_t *);
 193 extern void free_uentrylist(uentrylist_t *);
 194 extern void free_uentry(uentry_t *);
 195 extern uentry_t *getent_uef(char *);
 196
 197 extern void tohexstr(uchar_t *bytes, size_t blen, char *hexstr, size_t hexlen);
 198 extern int hexstr_to_bytes(char *hexstr, size_t hexlen, uchar_t **bytes,
 199     size_t *blen);
 200 extern CK_RV pkcs11_mech2keytype(CK_MECHANISM_TYPE mech_type,
 201     CK_KEY_TYPE *ktype);
 202 extern CK_RV pkcs11_mech2keygen(CK_MECHANISM_TYPE mech_type,
 203     CK_MECHANISM_TYPE *gen_mech);
 204 extern char *pkcs11_strerror(CK_RV rv);
 205
 206 extern int
 207 get_metaslot_info(boolean_t  *status_enabled, boolean_t *migrate_enabled,
 208     char **objectstore_slot_info, char **objectstore_token_info);
 209
 210 extern char *get_fullpath(char *dir, char *filepath);
 211 extern int str2lifetime(char *ltimestr, uint32_t *ltime);
 212
 213 extern char *pkcs11_default_token(void);
 214 extern int pkcs11_get_pass(char *token_name, char **pdata, size_t *psize,
 215     size_t min_psize, boolean_t with_confirmation);
 216
 217 extern int pkcs11_seed_urandom(void *sbuf, size_t slen);
 218 extern int pkcs11_get_random(void *dbuf, size_t dlen);
 219 extern int pkcs11_get_urandom(void *dbuf, size_t dlen);
 220 extern int pkcs11_get_nzero_urandom(void *dbuf, size_t dlen);
 221 extern int pkcs11_read_data(char *filename, void **dbuf, size_t *dlen);
 222
 223 extern int open_nointr(const char *path, int oflag, ...);
 224 extern ssize_t readn_nointr(int fd, void *dbuf, size_t dlen);
 225 extern ssize_t writen_nointr(int fd, void *dbuf, size_t dlen);
 226 extern int update_conf(char *conf_file, char *entry);
 227
 228 extern int pkcs11_parse_uri(const char *str, pkcs11_uri_t *uri);
 229 extern void pkcs11_free_uri(pkcs11_uri_t *uri);
 230
 231 extern CK_RV crypto2pkcs11_error_number(uint_t);
 232
 233 #ifdef __cplusplus
 234 }
 235 #endif
 236
 237 #endif /* _CRYPTOUTIL_H */