usr/src/cmd/cmd-crypto/cryptoadm/adm_uef.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
  23  */
  24 /*
  25  * Copyright 2010 Nexenta Systems, Inc.  All rights resrved.
  26  */
  27
  28 #include <cryptoutil.h>
  29 #include <fcntl.h>
  30 #include <libintl.h>
  31 #include <stdio.h>
  32 #include <stdlib.h>
  33 #include <strings.h>
  34 #include <unistd.h>
  35 #include <errno.h>
  36 #include <dlfcn.h>
  37 #include <link.h>
  38 #include <sys/types.h>
  39 #include <sys/stat.h>
  40 #include <security/cryptoki.h>
  41 #include "cryptoadm.h"
  42
  43 #define HDR1 "                                     P\n"
  44 #define HDR2 "                         S     V  K  a     U  D\n"
  45 #define HDR3 "                         i     e  e  i     n  e\n"
  46 #define HDR4 "                      S  g  V  r  y  r  W  w  r\n"
  47 #define HDR5 "             E  D  D  i  n  e  i  G  G  r  r  i\n"
  48 #define HDR6 "          H  n  e  i  g  +  r  +  e  e  a  a  v  E\n"
  49 #define HDR7 "min  max  W  c  c  g  n  R  i  R  n  n  p  p  e  C\n"
  50
  51
  52 static int err; /* To store errno which may be overwritten by gettext() */
  53 static boolean_t is_in_policylist(midstr_t, umechlist_t *);
  54 static char *uent2str(uentry_t *);
  55 static boolean_t check_random(CK_SLOT_ID, CK_FUNCTION_LIST_PTR);
  56
  57 static void display_slot_flags(CK_FLAGS flags)
  58 {
  59         (void) printf(gettext("Slot Flags: "));
  60         if (flags & CKF_TOKEN_PRESENT)
  61                 (void) printf("CKF_TOKEN_PRESENT ");
  62         if (flags & CKF_REMOVABLE_DEVICE)
  63                 (void) printf("CKF_REMOVABLE_DEVICE ");
  64         if (flags & CKF_HW_SLOT)
  65                 (void) printf("CKF_HW_SLOT ");
  66         (void) printf("\n");
  67 }
  68
  69 void
  70 display_token_flags(CK_FLAGS flags)
  71 {
  72         (void) printf(gettext("Flags: "));
  73         if (flags & CKF_RNG)
  74                 (void) printf("CKF_RNG ");
  75         if (flags & CKF_WRITE_PROTECTED)
  76                 (void) printf("CKF_WRITE_PROTECTED ");
  77         if (flags & CKF_LOGIN_REQUIRED)
  78                 (void) printf("CKF_LOGIN_REQUIRED ");
  79         if (flags & CKF_USER_PIN_INITIALIZED)
  80                 (void) printf("CKF_USER_PIN_INITIALIZED ");
  81         if (flags & CKF_RESTORE_KEY_NOT_NEEDED)
  82                 (void) printf("CKF_RESTORE_KEY_NOT_NEEDED ");
  83         if (flags & CKF_CLOCK_ON_TOKEN)
  84                 (void) printf("CKF_CLOCK_ON_TOKEN ");
  85         if (flags & CKF_PROTECTED_AUTHENTICATION_PATH)
  86                 (void) printf("CKF_PROTECTED_AUTHENTICATION_PATH ");
  87         if (flags & CKF_DUAL_CRYPTO_OPERATIONS)
  88                 (void) printf("CKF_DUAL_CRYPTO_OPERATIONS ");
  89         if (flags & CKF_TOKEN_INITIALIZED)
  90                 (void) printf("CKF_TOKEN_INITIALIZED ");
  91         if (flags & CKF_SECONDARY_AUTHENTICATION)
  92                 (void) printf("CKF_SECONDARY_AUTHENTICATION ");
  93         if (flags & CKF_USER_PIN_COUNT_LOW)
  94                 (void) printf("CKF_USER_PIN_COUNT_LOW ");
  95         if (flags & CKF_USER_PIN_FINAL_TRY)
  96                 (void) printf("CKF_USER_PIN_FINAL_TRY ");
  97         if (flags & CKF_USER_PIN_LOCKED)
  98                 (void) printf("CKF_USER_PIN_LOCKED ");
  99         if (flags & CKF_USER_PIN_TO_BE_CHANGED)
 100                 (void) printf("CKF_USER_PIN_TO_BE_CHANGED ");
 101         if (flags & CKF_SO_PIN_COUNT_LOW)
 102                 (void) printf("CKF_SO_PIN_COUNT_LOW ");
 103         if (flags & CKF_SO_PIN_FINAL_TRY)
 104                 (void) printf("CKF_SO_PIN_FINAL_TRY ");
 105         if (flags & CKF_SO_PIN_LOCKED)
 106                 (void) printf("CKF_SO_PIN_LOCKED ");
 107         if (flags & CKF_SO_PIN_TO_BE_CHANGED)
 108                 (void) printf("CKF_SO_PIN_TO_BE_CHANGED ");
 109         if (flags & CKF_SO_PIN_TO_BE_CHANGED)
 110                 (void) printf("CKF_SO_PIN_TO_BE_CHANGED ");
 111         (void) printf("\n");
 112 }
 113
 114 void
 115 display_mech_info(CK_MECHANISM_INFO *mechInfo)
 116 {
 117         CK_FLAGS ec_flags = CKF_EC_F_P | CKF_EC_F_2M | CKF_EC_ECPARAMETERS |
 118             CKF_EC_NAMEDCURVE | CKF_EC_UNCOMPRESS | CKF_EC_COMPRESS;
 119
 120         (void) printf("%-4ld %-4ld ", mechInfo->ulMinKeySize,
 121             mechInfo->ulMaxKeySize);
 122         (void) printf("%s  %s  %s  %s  %s  %s  %s  %s  %s  %s  %s  %s  "
 123             "%s  %s",
 124             (mechInfo->flags & CKF_HW) ? "X" : ".",
 125             (mechInfo->flags & CKF_ENCRYPT) ? "X" : ".",
 126             (mechInfo->flags & CKF_DECRYPT) ? "X" : ".",
 127             (mechInfo->flags & CKF_DIGEST) ? "X" : ".",
 128             (mechInfo->flags & CKF_SIGN) ? "X" : ".",
 129             (mechInfo->flags & CKF_SIGN_RECOVER) ? "X" : ".",
 130             (mechInfo->flags & CKF_VERIFY) ? "X" : ".",
 131             (mechInfo->flags & CKF_VERIFY_RECOVER) ? "X" : ".",
 132             (mechInfo->flags & CKF_GENERATE) ? "X" : ".",
 133             (mechInfo->flags & CKF_GENERATE_KEY_PAIR) ? "X" : ".",
 134             (mechInfo->flags & CKF_WRAP) ? "X" : ".",
 135             (mechInfo->flags & CKF_UNWRAP) ? "X" : ".",
 136             (mechInfo->flags & CKF_DERIVE) ? "X" : ".",
 137             (mechInfo->flags & ec_flags) ? "X" : ".");
 138 }
 139
 140 /*
 141  * Converts the provided list of mechanism names in their string format to
 142  * their corresponding PKCS#11 mechanism IDs.
 143  *
 144  * The list of mechanism names to be converted is provided in the
 145  * "mlist" argument.  The list of converted mechanism IDs is returned
 146  * in the "pmech_list" argument.
 147  *
 148  * This function is called by list_metaslot_info() and
 149  * list_mechlist_for_lib() functions.
 150  */
 151 int
 152 convert_mechlist(CK_MECHANISM_TYPE **pmech_list, CK_ULONG *mech_count,
 153     mechlist_t *mlist)
 154 {
 155         int i, n = 0;
 156         mechlist_t *p = mlist;
 157
 158         while (p != NULL) {
 159                 p = p->next;
 160                 n++;
 161         }
 162
 163         *pmech_list = malloc(n * sizeof (CK_MECHANISM_TYPE));
 164         if (pmech_list == NULL) {
 165                 cryptodebug("out of memory");
 166                 return (FAILURE);
 167         }
 168         p = mlist;
 169         for (i = 0; i < n; i++) {
 170                 if (pkcs11_str2mech(p->name, &(*pmech_list[i])) != CKR_OK) {
 171                         free(*pmech_list);
 172                         return (FAILURE);
 173                 }
 174                 p = p->next;
 175         }
 176         *mech_count = n;
 177         return (SUCCESS);
 178 }
 179
 180 /*
 181  * Display the mechanism list for a user-level library
 182  */
 183 int
 184 list_mechlist_for_lib(char *libname, mechlist_t *mlist,
 185                 flag_val_t *rng_flag, boolean_t no_warn,
 186                 boolean_t verbose, boolean_t show_mechs)
 187 {
 188         CK_RV   rv = CKR_OK;
 189         CK_RV   (*Tmp_C_GetFunctionList)(CK_FUNCTION_LIST_PTR_PTR);
 190         CK_FUNCTION_LIST_PTR    prov_funcs; /* Provider's function list */
 191         CK_SLOT_ID_PTR          prov_slots = NULL; /* Provider's slot list */
 192         CK_MECHANISM_TYPE_PTR   pmech_list = NULL; /* mech list for a slot */
 193         CK_SLOT_INFO    slotinfo;
 194         CK_ULONG        slot_count;
 195         CK_ULONG        mech_count;
 196         uentry_t        *puent = NULL;
 197         boolean_t       lib_initialized = B_FALSE;
 198         void            *dldesc = NULL;
 199         char            *dl_error;
 200         const char      *mech_name;
 201         char            *isa;
 202         char            libpath[MAXPATHLEN];
 203         char            buf[MAXPATHLEN];
 204         int             i, j;
 205         int             rc = SUCCESS;
 206
 207         if (libname == NULL) {
 208                 /* should not happen */
 209                 cryptoerror(LOG_STDERR, gettext("internal error."));
 210                 cryptodebug("list_mechlist_for_lib() - libname is NULL.");
 211                 return (FAILURE);
 212         }
 213
 214         /* Check if the library is in the pkcs11.conf file */
 215         if ((puent = getent_uef(libname)) == NULL) {
 216                 cryptoerror(LOG_STDERR,
 217                     gettext("%s does not exist."), libname);
 218                 return (FAILURE);
 219         }
 220         free_uentry(puent);
 221
 222         /* Remove $ISA from the library name */
 223         if (strlcpy(buf, libname, sizeof (buf)) >= sizeof (buf)) {
 224                 (void) printf(gettext("%s: the provider name is too long."),
 225                     libname);
 226                 return (FAILURE);
 227         }
 228
 229         if ((isa = strstr(buf, PKCS11_ISA)) != NULL) {
 230                 *isa = '\000';
 231                 isa += strlen(PKCS11_ISA);
 232                 (void) snprintf(libpath, MAXPATHLEN, "%s%s%s", buf, "/", isa);
 233         } else {
 234                 (void) strlcpy(libpath, libname, sizeof (libpath));
 235         }
 236
 237         /*
 238          * Open the provider. Use RTLD_NOW here, as a way to
 239          * catch any providers with incomplete symbols that
 240          * might otherwise cause problems during libpkcs11's
 241          * execution.
 242          */
 243         dldesc = dlopen(libpath, RTLD_NOW);
 244         if (dldesc == NULL) {
 245                 dl_error = dlerror();
 246                 cryptodebug("Cannot load PKCS#11 library %s.  dlerror: %s",
 247                     libname, dl_error != NULL ? dl_error : "Unknown");
 248                 rc = FAILURE;
 249                 goto clean_exit;
 250         }
 251
 252         /* Get the pointer to provider's C_GetFunctionList() */
 253         Tmp_C_GetFunctionList = (CK_RV(*)())dlsym(dldesc, "C_GetFunctionList");
 254         if (Tmp_C_GetFunctionList == NULL) {
 255                 cryptodebug("Cannot get the address of the C_GetFunctionList "
 256                     "from %s", libname);
 257                 rc = FAILURE;
 258                 goto clean_exit;
 259         }
 260
 261         /* Get the provider's function list */
 262         rv = Tmp_C_GetFunctionList(&prov_funcs);
 263         if (rv != CKR_OK) {
 264                 cryptodebug("failed to call C_GetFunctionList from %s",
 265                     libname);
 266                 rc = FAILURE;
 267                 goto clean_exit;
 268         }
 269
 270         /* Initialize this provider */
 271         rv = prov_funcs->C_Initialize(NULL_PTR);
 272         if (rv != CKR_OK) {
 273                 cryptodebug("failed to call C_Initialize from %s, "
 274                     "return code = %d", libname, rv);
 275                 rc = FAILURE;
 276                 goto clean_exit;
 277         } else {
 278                 lib_initialized = B_TRUE;
 279         }
 280
 281         /*
 282          * Find out how many slots this provider has, call with tokenPresent
 283          * set to FALSE so all potential slots are returned.
 284          */
 285         rv = prov_funcs->C_GetSlotList(FALSE, NULL_PTR, &slot_count);
 286         if (rv != CKR_OK) {
 287                 cryptodebug("failed to get the slotlist from %s.", libname);
 288                 rc = FAILURE;
 289                 goto clean_exit;
 290         } else if (slot_count == 0) {
 291                 if (!no_warn)
 292                         (void) printf(gettext("%s: no slots presented.\n"),
 293                             libname);
 294                 rc = SUCCESS;
 295                 goto clean_exit;
 296         }
 297
 298         /* Allocate memory for the slot list */
 299         prov_slots = malloc(slot_count * sizeof (CK_SLOT_ID));
 300         if (prov_slots == NULL) {
 301                 cryptodebug("out of memory.");
 302                 rc = FAILURE;
 303                 goto clean_exit;
 304         }
 305
 306         /* Get the slot list from provider */
 307         rv = prov_funcs->C_GetSlotList(FALSE, prov_slots, &slot_count);
 308         if (rv != CKR_OK) {
 309                 cryptodebug("failed to call C_GetSlotList() from %s.",
 310                     libname);
 311                 rc = FAILURE;
 312                 goto clean_exit;
 313         }
 314
 315         if (verbose) {
 316                 (void) printf(gettext("Number of slots: %d\n"), slot_count);
 317         }
 318
 319         /* Get the mechanism list for each slot */
 320         for (i = 0; i < slot_count; i++) {
 321                 if (verbose)
 322                         /*
 323                          * TRANSLATION_NOTE
 324                          * In some languages, the # symbol should be
 325                          * converted to "no", an "n" followed by a
 326                          * superscript "o"..
 327                          */
 328                         (void) printf(gettext("\nSlot #%d\n"), i+1);
 329
 330                 if ((rng_flag != NULL) && (*rng_flag == NO_RNG)) {
 331                         if (check_random(prov_slots[i], prov_funcs)) {
 332                                 *rng_flag = HAS_RNG;
 333                                 rc = SUCCESS;
 334                                 goto clean_exit;
 335                         } else
 336                                 continue;
 337                 }
 338
 339                 rv = prov_funcs->C_GetSlotInfo(prov_slots[i], &slotinfo);
 340                 if (rv != CKR_OK) {
 341                         cryptodebug("failed to get slotinfo from %s", libname);
 342                         rc = FAILURE;
 343                         break;
 344                 }
 345                 if (verbose) {
 346                         CK_TOKEN_INFO tokeninfo;
 347
 348                         (void) printf(gettext("Description: %.64s\n"
 349                             "Manufacturer: %.32s\n"
 350                             "PKCS#11 Version: %d.%d\n"),
 351                             slotinfo.slotDescription,
 352                             slotinfo.manufacturerID,
 353                             prov_funcs->version.major,
 354                             prov_funcs->version.minor);
 355
 356                         (void) printf(gettext("Hardware Version: %d.%d\n"
 357                             "Firmware Version: %d.%d\n"),
 358                             slotinfo.hardwareVersion.major,
 359                             slotinfo.hardwareVersion.minor,
 360                             slotinfo.firmwareVersion.major,
 361                             slotinfo.firmwareVersion.minor);
 362
 363                         (void) printf(gettext("Token Present: %s\n"),
 364                             (slotinfo.flags & CKF_TOKEN_PRESENT ?
 365                             gettext("True") : gettext("False")));
 366
 367                         display_slot_flags(slotinfo.flags);
 368
 369                         rv = prov_funcs->C_GetTokenInfo(prov_slots[i],
 370                             &tokeninfo);
 371                         if (rv != CKR_OK) {
 372                                 cryptodebug("Failed to get "
 373                                     "token info from %s", libname);
 374                                 rc = FAILURE;
 375                                 break;
 376                         }
 377
 378                         (void) printf(gettext("Token Label: %.32s\n"
 379                             "Manufacturer ID: %.32s\n"
 380                             "Model: %.16s\n"
 381                             "Serial Number: %.16s\n"
 382                             "Hardware Version: %d.%d\n"
 383                             "Firmware Version: %d.%d\n"
 384                             "UTC Time: %.16s\n"
 385                             "PIN Min Length: %d\n"
 386                             "PIN Max Length: %d\n"),
 387                             tokeninfo.label,
 388                             tokeninfo.manufacturerID,
 389                             tokeninfo.model,
 390                             tokeninfo.serialNumber,
 391                             tokeninfo.hardwareVersion.major,
 392                             tokeninfo.hardwareVersion.minor,
 393                             tokeninfo.firmwareVersion.major,
 394                             tokeninfo.firmwareVersion.minor,
 395                             tokeninfo.utcTime,
 396                             tokeninfo.ulMinPinLen,
 397                             tokeninfo.ulMaxPinLen);
 398
 399                         display_token_flags(tokeninfo.flags);
 400                 }
 401
 402                 if (mlist == NULL) {
 403                         rv = prov_funcs->C_GetMechanismList(prov_slots[i],
 404                             NULL_PTR, &mech_count);
 405                         if (rv != CKR_OK) {
 406                                 cryptodebug(
 407                                     "failed to call C_GetMechanismList() "
 408                                     "from %s.", libname);
 409                                 rc = FAILURE;
 410                                 break;
 411                         }
 412
 413                         if (mech_count == 0) {
 414                                 /* no mechanisms in this slot */
 415                                 continue;
 416                         }
 417
 418                         pmech_list = malloc(mech_count *
 419                             sizeof (CK_MECHANISM_TYPE));
 420                         if (pmech_list == NULL) {
 421                                 cryptodebug("out of memory");
 422                                 rc = FAILURE;
 423                                 break;
 424                         }
 425
 426                         /* Get the actual mechanism list */
 427                         rv = prov_funcs->C_GetMechanismList(prov_slots[i],
 428                             pmech_list, &mech_count);
 429                         if (rv != CKR_OK) {
 430                                 cryptodebug(
 431                                     "failed to call C_GetMechanismList() "
 432                                     "from %s.", libname);
 433                                 free(pmech_list);
 434                                 rc = FAILURE;
 435                                 break;
 436                         }
 437                 } else  {
 438                         /* use the mechanism list passed in */
 439                         rc = convert_mechlist(&pmech_list, &mech_count, mlist);
 440                         if (rc != SUCCESS) {
 441                                 goto clean_exit;
 442                         }
 443                 }
 444                 if (show_mechs)
 445                         (void) printf(gettext("Mechanisms:\n"));
 446
 447                 if (verbose && show_mechs) {
 448                         display_verbose_mech_header();
 449                 }
 450                 /*
 451                  * Merge the current mechanism list into the returning
 452                  * mechanism list.
 453                  */
 454                 for (j = 0; show_mechs && j < mech_count; j++) {
 455                         CK_MECHANISM_TYPE       mech = pmech_list[j];
 456                         CK_MECHANISM_INFO mech_info;
 457
 458                         rv = prov_funcs->C_GetMechanismInfo(
 459                             prov_slots[i], mech, &mech_info);
 460                         if (rv != CKR_OK) {
 461                                 cryptodebug(
 462                                     "failed to call "
 463                                     "C_GetMechanismInfo() from %s.",
 464                                     libname);
 465                                 free(pmech_list);
 466                                 pmech_list = NULL;
 467                                 rc = FAILURE;
 468                                 break;
 469                         }
 470                         if (mech >= CKM_VENDOR_DEFINED) {
 471                                 (void) printf("%#lx", mech);
 472                         } else {
 473                                 mech_name = pkcs11_mech2str(mech);
 474                                 (void) printf("%-29s", mech_name);
 475                         }
 476
 477                         if (verbose) {
 478                                 display_mech_info(&mech_info);
 479                         }
 480                         (void) printf("\n");
 481                 }
 482                 if (pmech_list)
 483                         free(pmech_list);
 484                 if (rc == FAILURE) {
 485                         break;
 486                 }
 487         }
 488
 489         if (rng_flag != NULL || rc == FAILURE) {
 490                 goto clean_exit;
 491         }
 492
 493 clean_exit:
 494
 495         if (rc == FAILURE) {
 496                 (void) printf(gettext(
 497                     "%s: failed to retrieve the mechanism list.\n"), libname);
 498         }
 499
 500         if (lib_initialized) {
 501                 (void) prov_funcs->C_Finalize(NULL_PTR);
 502         }
 503
 504         if (dldesc != NULL) {
 505                 (void) dlclose(dldesc);
 506         }
 507
 508         if (prov_slots != NULL) {
 509                 free(prov_slots);
 510         }
 511
 512         return (rc);
 513 }
 514
 515
 516 /*
 517  * Display the mechanism policy for a user-level library
 518  */
 519 int
 520 list_policy_for_lib(char *libname)
 521 {
 522         uentry_t *puent = NULL;
 523         int rc;
 524
 525         if (libname == NULL) {
 526                 /* should not happen */
 527                 cryptoerror(LOG_STDERR, gettext("internal error."));
 528                 cryptodebug("list_policy_for_lib() - libname is NULL.");
 529                 return (FAILURE);
 530         }
 531
 532         /* Get the library entry from the pkcs11.conf file */
 533         if ((puent = getent_uef(libname)) == NULL) {
 534                 cryptoerror(LOG_STDERR,
 535                     gettext("%s does not exist."), libname);
 536                 return (FAILURE);
 537         }
 538
 539         /* Print the policy for this library */
 540         rc = print_uef_policy(puent);
 541         free_uentry(puent);
 542
 543         return (rc);
 544 }
 545
 546
 547 /*
 548  * Disable mechanisms for a user-level library
 549  */
 550 int
 551 disable_uef_lib(char *libname, boolean_t rndflag, boolean_t allflag,
 552     mechlist_t *marglist)
 553 {
 554         uentry_t        *puent;
 555         int     rc;
 556
 557         if (libname == NULL) {
 558                 /* should not happen */
 559                 cryptoerror(LOG_STDERR, gettext("internal error."));
 560                 cryptodebug("disable_uef_lib() - libname is NULL.");
 561                 return (FAILURE);
 562         }
 563
 564         /* Get the provider entry from the pkcs11.conf file */
 565         if ((puent = getent_uef(libname)) == NULL) {
 566                 cryptoerror(LOG_STDERR,
 567                     gettext("%s does not exist."), libname);
 568                 return (FAILURE);
 569         }
 570
 571         /*
 572          * Update the mechanism policy of this library entry, based on
 573          * the current policy mode of the library and the mechanisms specified
 574          * in CLI.
 575          */
 576         if (allflag) {
 577                 /*
 578                  * If disabling all, just need to clean up the policylist and
 579                  * set the flag_enabledlist flag to be B_TRUE.
 580                  */
 581                 free_umechlist(puent->policylist);
 582                 puent->policylist = NULL;
 583                 puent->count = 0;
 584                 puent->flag_enabledlist = B_TRUE;
 585                 rc = SUCCESS;
 586         } else if (marglist != NULL) {
 587                 if (puent->flag_enabledlist == B_TRUE) {
 588                         /*
 589                          * The current default policy mode of this library
 590                          * is "all are disabled, except ...", so if a
 591                          * specified mechanism is in the exception list
 592                          * (the policylist), delete it from the policylist.
 593                          */
 594                         rc = update_policylist(puent, marglist, DELETE_MODE);
 595                 } else {
 596                         /*
 597                          * The current default policy mode of this library
 598                          * is "all are enabled", so if a specified mechanism
 599                          * is not in the exception list (policylist), add
 600                          * it into the policylist.
 601                          */
 602                         rc = update_policylist(puent, marglist, ADD_MODE);
 603                 }
 604         } else if (!rndflag) {
 605                 /* should not happen */
 606                 cryptoerror(LOG_STDERR, gettext("internal error."));
 607                 cryptodebug("disable_uef_lib() - wrong arguments.");
 608                 return (FAILURE);
 609         }
 610
 611         if (rndflag)
 612                 puent->flag_norandom = B_TRUE;
 613
 614         if (rc == FAILURE) {
 615                 free_uentry(puent);
 616                 return (FAILURE);
 617         }
 618
 619         /* Update the pkcs11.conf file with the updated entry */
 620         rc = update_pkcs11conf(puent);
 621         free_uentry(puent);
 622         return (rc);
 623 }
 624
 625
 626 /*
 627  * Enable disabled mechanisms for a user-level library.
 628  */
 629 int
 630 enable_uef_lib(char *libname, boolean_t rndflag, boolean_t allflag,
 631     mechlist_t *marglist)
 632 {
 633         uentry_t        *puent;
 634         int     rc = SUCCESS;
 635
 636         if (libname == NULL) {
 637                 /* should not happen */
 638                 cryptoerror(LOG_STDERR, gettext("internal error."));
 639                 cryptodebug("enable_uef_lib() - libname is NULL.");
 640                 return (FAILURE);
 641         }
 642
 643         /* Get the provider entry from the pkcs11.conf file */
 644         if ((puent = getent_uef(libname)) == NULL) {
 645                 cryptoerror(LOG_STDERR,
 646                     gettext("%s does not exist."), libname);
 647                 return (FAILURE);
 648         }
 649
 650         /*
 651          * Update the mechanism policy of this library entry, based on
 652          * the current policy mode of the library and the mechanisms
 653          * specified in CLI.
 654          */
 655         if (allflag) {
 656                 /*
 657                  * If enabling all, what needs to be done are cleaning up the
 658                  * policylist and setting the "flag_enabledlist" flag to
 659                  * B_FALSE.
 660                  */
 661                 free_umechlist(puent->policylist);
 662                 puent->policylist = NULL;
 663                 puent->count = 0;
 664                 puent->flag_enabledlist = B_FALSE;
 665                 rc = SUCCESS;
 666         } else if (marglist != NULL) {
 667                 if (puent->flag_enabledlist == B_TRUE) {
 668                         /*
 669                          * The current default policy mode of this library
 670                          * is "all are disabled, except ...", so if a
 671                          * specified mechanism is not in the exception list
 672                          * (policylist), add it.
 673                          */
 674                         rc = update_policylist(puent, marglist, ADD_MODE);
 675                 } else {
 676                         /*
 677                          * The current default policy mode of this library
 678                          * is "all are enabled, except", so if a specified
 679                          * mechanism is in the exception list (policylist),
 680                          * delete it.
 681                          */
 682                         rc = update_policylist(puent, marglist, DELETE_MODE);
 683                 }
 684         } else if (!rndflag) {
 685                 /* should not come here */
 686                 cryptoerror(LOG_STDERR, gettext("internal error."));
 687                 cryptodebug("enable_uef_lib() - wrong arguments.");
 688                 return (FAILURE);
 689         }
 690
 691         if (rndflag)
 692                 puent->flag_norandom = B_FALSE;
 693
 694         if (rc == FAILURE) {
 695                 free_uentry(puent);
 696                 return (FAILURE);
 697         }
 698
 699         /* Update the pkcs11.conf file with the updated entry */
 700         rc = update_pkcs11conf(puent);
 701         free_uentry(puent);
 702         return (rc);
 703 }
 704
 705
 706 /*
 707  * Install a user-level library.
 708  */
 709 int
 710 install_uef_lib(char *libname)
 711 {
 712         uentry_t        *puent;
 713         struct stat     statbuf;
 714         char    libpath[MAXPATHLEN];
 715         char    libbuf[MAXPATHLEN];
 716         char    *isa;
 717
 718         if (libname == NULL) {
 719                 /* should not happen */
 720                 cryptoerror(LOG_STDERR, gettext("internal error."));
 721                 cryptodebug("install_uef_lib() - libname is NULL.");
 722                 return (FAILURE);
 723         }
 724
 725         /* Check if the provider already exists in the framework */
 726         if ((puent = getent_uef(libname)) != NULL) {
 727                 cryptoerror(LOG_STDERR, gettext("%s exists already."),
 728                     libname);
 729                 free_uentry(puent);
 730                 return (FAILURE);
 731         }
 732
 733         /*
 734          * Check if the library exists in the system. if $ISA is in the
 735          * path, only check the 32bit version.
 736          */
 737         if (strlcpy(libbuf, libname, MAXPATHLEN) >= MAXPATHLEN) {
 738                 cryptoerror(LOG_STDERR,
 739                     gettext("the provider name is too long - %s"), libname);
 740                 return (FAILURE);
 741         }
 742
 743         if ((isa = strstr(libbuf, PKCS11_ISA)) != NULL) {
 744                 *isa = '\000';
 745                 isa += strlen(PKCS11_ISA);
 746                 (void) snprintf(libpath, sizeof (libpath), "%s%s%s", libbuf,
 747                     "/", isa);
 748         } else {
 749                 (void) strlcpy(libpath, libname, sizeof (libpath));
 750         }
 751
 752         /* Check if it is same as the framework library */
 753         if (strcmp(libpath, UEF_FRAME_LIB) == 0) {
 754                 cryptoerror(LOG_STDERR, gettext(
 755                     "The framework library %s can not be installed."),
 756                     libname);
 757                 return (FAILURE);
 758         }
 759
 760         if (stat(libpath, &statbuf) != 0) {
 761                 cryptoerror(LOG_STDERR, gettext("%s not found"), libname);
 762                 return (FAILURE);
 763         }
 764
 765         /* Need to add "\n" to libname for adding into the config file */
 766         if (strlcat(libname, "\n", MAXPATHLEN) >= MAXPATHLEN) {
 767                 cryptoerror(LOG_STDERR, gettext(
 768                     "can not install %s; the name is too long."), libname);
 769                 return (FAILURE);
 770         }
 771
 772         return (update_conf(_PATH_PKCS11_CONF, libname));
 773
 774 }
 775
 776
 777 /*
 778  * Uninstall a user-level library.
 779  */
 780 int
 781 uninstall_uef_lib(char *libname)
 782 {
 783         uentry_t        *puent;
 784         FILE    *pfile;
 785         FILE    *pfile_tmp;
 786         char    buffer[BUFSIZ];
 787         char    buffer2[BUFSIZ];
 788         char    tmpfile_name[MAXPATHLEN];
 789         char    *name;
 790         boolean_t       found;
 791         boolean_t       in_package;
 792         int     len;
 793         int     rc = SUCCESS;
 794
 795         if (libname == NULL) {
 796                 /* should not happen */
 797                 cryptoerror(LOG_STDERR, gettext("internal error."));
 798                 cryptodebug("uninstall_uef_lib() - libname is NULL.");
 799                 return (FAILURE);
 800         }
 801
 802         /* Check if the provider exists */
 803         if ((puent = getent_uef(libname)) == NULL) {
 804                 cryptoerror(LOG_STDERR,
 805                     gettext("%s does not exist."), libname);
 806                 return (FAILURE);
 807         }
 808         free_uentry(puent);
 809
 810         /*  Open the pkcs11.conf file and lock it */
 811         if ((pfile = fopen(_PATH_PKCS11_CONF, "r+")) == NULL) {
 812                 err = errno;
 813                 cryptoerror(LOG_STDERR,
 814                     gettext("failed to update the configuration - %s"),
 815                     strerror(err));
 816                 cryptodebug("failed to open %s for write.", _PATH_PKCS11_CONF);
 817                 return (FAILURE);
 818         }
 819
 820         if (lockf(fileno(pfile), F_TLOCK, 0) == -1) {
 821                 err = errno;
 822                 cryptoerror(LOG_STDERR,
 823                     gettext("failed to lock the configuration - %s"),
 824                     strerror(err));
 825                 (void) fclose(pfile);
 826                 return (FAILURE);
 827         }
 828
 829         /*
 830          * Create a temporary file in the /etc/crypto directory to save
 831          * the new configuration file first.
 832          */
 833         (void) strlcpy(tmpfile_name, TMPFILE_TEMPLATE, sizeof (tmpfile_name));
 834         if (mkstemp(tmpfile_name) == -1) {
 835                 err = errno;
 836                 cryptoerror(LOG_STDERR,
 837                     gettext("failed to create a temporary file - %s"),
 838                     strerror(err));
 839                 (void) fclose(pfile);
 840                 return (FAILURE);
 841         }
 842
 843         if ((pfile_tmp = fopen(tmpfile_name, "w")) == NULL) {
 844                 err = errno;
 845                 cryptoerror(LOG_STDERR, gettext("failed to open %s - %s"),
 846                     tmpfile_name, strerror(err));
 847                 if (unlink(tmpfile_name) != 0) {
 848                         err = errno;
 849                         cryptoerror(LOG_STDERR, gettext(
 850                             "(Warning) failed to remove %s: %s"),
 851                             tmpfile_name, strerror(err));
 852                 }
 853                 (void) fclose(pfile);
 854                 return (FAILURE);
 855         }
 856
 857
 858         /*
 859          * Loop thru the config file.  If the library to be uninstalled
 860          * is in a package, just comment it off.
 861          */
 862         in_package = B_FALSE;
 863         while (fgets(buffer, BUFSIZ, pfile) != NULL) {
 864                 found = B_FALSE;
 865                 if (!(buffer[0] == ' ' || buffer[0] == '\n' ||
 866                     buffer[0] == '\t')) {
 867                         if (strstr(buffer, " Start ") != NULL) {
 868                                 in_package = B_TRUE;
 869                         } else if (strstr(buffer, " End ") != NULL) {
 870                                 in_package = B_FALSE;
 871                         } else if (buffer[0] != '#') {
 872                                 (void) strlcpy(buffer2, buffer, BUFSIZ);
 873
 874                                 /* get rid of trailing '\n' */
 875                                 len = strlen(buffer2);
 876                                 if (buffer2[len-1] == '\n') {
 877                                         len--;
 878                                 }
 879                                 buffer2[len] = '\0';
 880
 881                                 if ((name = strtok(buffer2, SEP_COLON))
 882                                     == NULL) {
 883                                         rc = FAILURE;
 884                                         break;
 885                                 } else if (strcmp(libname, name) == 0) {
 886                                         found = B_TRUE;
 887                                 }
 888                         }
 889                 }
 890
 891                 if (found) {
 892                         if (in_package) {
 893                                 (void) snprintf(buffer2, sizeof (buffer2),
 894                                     "%s%s%s", "#", libname, "\n");
 895                                 if (fputs(buffer2, pfile_tmp) == EOF) {
 896                                         rc = FAILURE;
 897                                 }
 898                         }
 899                 } else {
 900                         if (fputs(buffer, pfile_tmp) == EOF) {
 901                                 rc = FAILURE;
 902                         }
 903                 }
 904
 905                 if (rc == FAILURE) {
 906                         break;
 907                 }
 908         }
 909
 910         if (rc == FAILURE) {
 911                 cryptoerror(LOG_STDERR, gettext("write error."));
 912                 (void) fclose(pfile);
 913                 (void) fclose(pfile_tmp);
 914                 if (unlink(tmpfile_name) != 0) {
 915                         err = errno;
 916                         cryptoerror(LOG_STDERR, gettext(
 917                             "(Warning) failed to remove %s: %s"),
 918                             tmpfile_name, strerror(err));
 919                 }
 920                 return (FAILURE);
 921         }
 922
 923         (void) fclose(pfile);
 924         if (fclose(pfile_tmp) != 0) {
 925                 err = errno;
 926                 cryptoerror(LOG_STDERR,
 927                     gettext("failed to close a temporary file - %s"),
 928                     strerror(err));
 929                 return (FAILURE);
 930         }
 931
 932         /* Now update the real config file */
 933         if (rename(tmpfile_name, _PATH_PKCS11_CONF) == -1) {
 934                 err = errno;
 935                 cryptoerror(LOG_STDERR,
 936                     gettext("failed to update the configuration - %s"),
 937                     strerror(err));
 938                 cryptodebug("failed to rename %s to %s: %s", tmpfile,
 939                     _PATH_PKCS11_CONF, strerror(err));
 940                 rc = FAILURE;
 941         } else if (chmod(_PATH_PKCS11_CONF,
 942             S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH) == -1) {
 943                 err = errno;
 944                 cryptoerror(LOG_STDERR,
 945                     gettext("failed to update the configuration - %s"),
 946                     strerror(err));
 947                 cryptodebug("failed to chmod to %s: %s", _PATH_PKCS11_CONF,
 948                     strerror(err));
 949                 rc = FAILURE;
 950         } else {
 951                 rc = SUCCESS;
 952         }
 953
 954         if ((rc == FAILURE) && (unlink(tmpfile_name) != 0)) {
 955                 err = errno;
 956                 cryptoerror(LOG_STDERR, gettext(
 957                     "(Warning) failed to remove %s: %s"),
 958                     tmpfile_name, strerror(err));
 959         }
 960
 961         return (rc);
 962 }
 963
 964
 965 int
 966 display_policy(uentry_t *puent)
 967 {
 968         CK_MECHANISM_TYPE       mech_id;
 969         const char              *mech_name;
 970         umechlist_t             *ptr;
 971
 972         if (puent == NULL) {
 973                 return (SUCCESS);
 974         }
 975
 976         if (puent->flag_enabledlist == B_FALSE) {
 977                 (void) printf(gettext("%s: all mechanisms are enabled"),
 978                     puent->name);
 979                 ptr = puent->policylist;
 980                 if (ptr == NULL) {
 981                         (void) printf(".");
 982                 } else {
 983                         (void) printf(gettext(", except "));
 984                         while (ptr != NULL) {
 985                                 mech_id = strtoul(ptr->name, NULL, 0);
 986                                 if (mech_id & CKO_VENDOR_DEFINED) {
 987                                         /* vendor defined mechanism */
 988                                         (void) printf("%s", ptr->name);
 989                                 } else {
 990                                         if (mech_id >= CKM_VENDOR_DEFINED) {
 991                                                 (void) printf("%#lx", mech_id);
 992                                         } else {
 993                                                 mech_name = pkcs11_mech2str(
 994                                                     mech_id);
 995                                                 if (mech_name == NULL) {
 996                                                         return (FAILURE);
 997                                                 }
 998                                                 (void) printf("%s", mech_name);
 999                                         }
1000                                 }
1001
1002                                 ptr = ptr->next;
1003                                 if (ptr == NULL) {
1004                                         (void) printf(".");
1005                                 } else {
1006                                         (void) printf(",");
1007                                 }
1008                         }
1009                 }
1010         } else { /* puent->flag_enabledlist == B_TRUE */
1011                 (void) printf(gettext("%s: all mechanisms are disabled"),
1012                     puent->name);
1013                 ptr = puent->policylist;
1014                 if (ptr == NULL) {
1015                         (void) printf(".");
1016                 } else {
1017                         (void) printf(gettext(", except "));
1018                         while (ptr != NULL) {
1019                                 mech_id = strtoul(ptr->name, NULL, 0);
1020                                 if (mech_id & CKO_VENDOR_DEFINED) {
1021                                         /* vendor defined mechanism */
1022                                         (void) printf("%s", ptr->name);
1023                                 } else {
1024                                         mech_name = pkcs11_mech2str(mech_id);
1025                                         if (mech_name == NULL) {
1026                                                 return (FAILURE);
1027                                         }
1028                                         (void) printf("%s", mech_name);
1029                                 }
1030                                 ptr = ptr->next;
1031                                 if (ptr == NULL) {
1032                                         (void) printf(".");
1033                                 } else {
1034                                         (void) printf(",");
1035                                 }
1036                         }
1037                 }
1038         }
1039         return (SUCCESS);
1040 }
1041
1042
1043
1044 /*
1045  * Print out the mechanism policy for a user-level provider pointed by puent.
1046  */
1047 int
1048 print_uef_policy(uentry_t *puent)
1049 {
1050         flag_val_t rng_flag;
1051
1052         if (puent == NULL) {
1053                 return (FAILURE);
1054         }
1055
1056         rng_flag = NO_RNG;
1057         if (list_mechlist_for_lib(puent->name, NULL, &rng_flag, B_TRUE,
1058             B_FALSE, B_FALSE) != SUCCESS) {
1059                 cryptoerror(LOG_STDERR,
1060                     gettext("%s internal error."), puent->name);
1061                 return (FAILURE);
1062         }
1063
1064         if (display_policy(puent) != SUCCESS) {
1065                 goto failed_exit;
1066         }
1067
1068
1069         if (puent->flag_norandom == B_TRUE)
1070                 /*
1071                  * TRANSLATION_NOTE
1072                  * "random" is a keyword and not to be translated.
1073                  */
1074                 (void) printf(gettext(" %s is disabled."), "random");
1075         else {
1076                 if (rng_flag == HAS_RNG)
1077                         /*
1078                          * TRANSLATION_NOTE
1079                          * "random" is a keyword and not to be translated.
1080                          */
1081                         (void) printf(gettext(" %s is enabled."), "random");
1082         }
1083         (void) printf("\n");
1084
1085         return (SUCCESS);
1086
1087 failed_exit:
1088
1089         (void) printf(gettext("\nout of memory.\n"));
1090         return (FAILURE);
1091 }
1092
1093
1094 /*
1095  * Check if the mechanism is in the mechanism list.
1096  */
1097 static boolean_t
1098 is_in_policylist(midstr_t mechname, umechlist_t *plist)
1099 {
1100         boolean_t found = B_FALSE;
1101
1102         if (mechname == NULL) {
1103                 return (B_FALSE);
1104         }
1105
1106         while (plist != NULL) {
1107                 if (strcmp(plist->name, mechname) == 0) {
1108                         found = B_TRUE;
1109                         break;
1110                 }
1111                 plist = plist->next;
1112         }
1113
1114         return (found);
1115 }
1116
1117
1118 /*
1119  * Update the pkcs11.conf file with the updated entry.
1120  */
1121 int
1122 update_pkcs11conf(uentry_t *puent)
1123 {
1124         FILE    *pfile;
1125         FILE    *pfile_tmp;
1126         char buffer[BUFSIZ];
1127         char buffer2[BUFSIZ];
1128         char tmpfile_name[MAXPATHLEN];
1129         char *name;
1130         char *str;
1131         int len;
1132         int rc = SUCCESS;
1133         boolean_t found;
1134
1135         if (puent == NULL) {
1136                 cryptoerror(LOG_STDERR, gettext("internal error."));
1137                 return (FAILURE);
1138         }
1139
1140         /* Open the pkcs11.conf file */
1141         if ((pfile = fopen(_PATH_PKCS11_CONF, "r+")) == NULL) {
1142                 err = errno;
1143                 cryptoerror(LOG_STDERR,
1144                     gettext("failed to update the configuration - %s"),
1145                     strerror(err));
1146                 cryptodebug("failed to open %s for write.", _PATH_PKCS11_CONF);
1147                 return (FAILURE);
1148         }
1149
1150         /* Lock the pkcs11.conf file */
1151         if (lockf(fileno(pfile), F_TLOCK, 0) == -1) {
1152                 err = errno;
1153                 cryptoerror(LOG_STDERR,
1154                     gettext("failed to update the configuration - %s"),
1155                     strerror(err));
1156                 (void) fclose(pfile);
1157                 return (FAILURE);
1158         }
1159
1160         /*
1161          * Create a temporary file in the /etc/crypto directory to save
1162          * updated configuration file first.
1163          */
1164         (void) strlcpy(tmpfile_name, TMPFILE_TEMPLATE, sizeof (tmpfile_name));
1165         if (mkstemp(tmpfile_name) == -1) {
1166                 err = errno;
1167                 cryptoerror(LOG_STDERR,
1168                     gettext("failed to create a temporary file - %s"),
1169                     strerror(err));
1170                 (void) fclose(pfile);
1171                 return (FAILURE);
1172         }
1173
1174         if ((pfile_tmp = fopen(tmpfile_name, "w")) == NULL) {
1175                 err = errno;
1176                 cryptoerror(LOG_STDERR, gettext("failed to open %s - %s"),
1177                     tmpfile_name, strerror(err));
1178                 if (unlink(tmpfile_name) != 0) {
1179                         err = errno;
1180                         cryptoerror(LOG_STDERR, gettext(
1181                             "(Warning) failed to remove %s: %s"),
1182                             tmpfile_name, strerror(err));
1183                 }
1184                 (void) fclose(pfile);
1185                 return (FAILURE);
1186         }
1187
1188
1189         /*
1190          * Loop thru entire pkcs11.conf file, update the entry to be
1191          * updated and save the updated file to the temporary file first.
1192          */
1193         while (fgets(buffer, BUFSIZ, pfile) != NULL) {
1194                 found = B_FALSE;
1195                 if (!(buffer[0] == '#' || buffer[0] == ' ' ||
1196                     buffer[0] == '\n'|| buffer[0] == '\t')) {
1197                         /*
1198                          * Get the provider name from this line and check if
1199                          * this is the entry to be updated. Note: can not use
1200                          * "buffer" directly because strtok will change its
1201                          * value.
1202                          */
1203                         (void) strlcpy(buffer2, buffer, BUFSIZ);
1204
1205                         /* get rid of trailing '\n' */
1206                         len = strlen(buffer2);
1207                         if (buffer2[len-1] == '\n') {
1208                                 len--;
1209                         }
1210                         buffer2[len] = '\0';
1211
1212                         if ((name = strtok(buffer2, SEP_COLON)) == NULL) {
1213                                 rc = FAILURE;
1214                                 break;
1215                         } else if (strcmp(puent->name, name) == 0) {
1216                                 found = B_TRUE;
1217                         }
1218                 }
1219
1220                 if (found) {
1221                         /*
1222                          * This is the entry to be modified, get the updated
1223                          * string.
1224                          */
1225                         if ((str = uent2str(puent)) == NULL) {
1226                                 rc = FAILURE;
1227                                 break;
1228                         } else {
1229                                 (void) strlcpy(buffer, str, BUFSIZ);
1230                                 free(str);
1231                         }
1232                 }
1233
1234                 if (fputs(buffer, pfile_tmp) == EOF) {
1235                         err = errno;
1236                         cryptoerror(LOG_STDERR, gettext(
1237                             "failed to write to a temp file: %s."),
1238                             strerror(err));
1239                         rc = FAILURE;
1240                         break;
1241                 }
1242         }
1243
1244         if (rc == FAILURE) {
1245                 (void) fclose(pfile);
1246                 (void) fclose(pfile_tmp);
1247                 if (unlink(tmpfile_name) != 0) {
1248                         err = errno;
1249                         cryptoerror(LOG_STDERR, gettext(
1250                             "(Warning) failed to remove %s: %s"),
1251                             tmpfile_name, strerror(err));
1252                 }
1253                 return (FAILURE);
1254         }
1255
1256         (void) fclose(pfile);
1257         if (fclose(pfile_tmp) != 0) {
1258                 err = errno;
1259                 cryptoerror(LOG_STDERR,
1260                     gettext("failed to close %s: %s"), tmpfile_name,
1261                     strerror(err));
1262                 return (FAILURE);
1263         }
1264
1265         /* Copy the temporary file to the pkcs11.conf file */
1266         if (rename(tmpfile_name, _PATH_PKCS11_CONF) == -1) {
1267                 err = errno;
1268                 cryptoerror(LOG_STDERR,
1269                     gettext("failed to update the configuration - %s"),
1270                     strerror(err));
1271                 cryptodebug("failed to rename %s to %s: %s", tmpfile_name,
1272                     _PATH_PKCS11_CONF, strerror(err));
1273                 rc = FAILURE;
1274         } else if (chmod(_PATH_PKCS11_CONF,
1275             S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH) == -1) {
1276                 err = errno;
1277                 cryptoerror(LOG_STDERR,
1278                     gettext("failed to update the configuration - %s"),
1279                     strerror(err));
1280                 cryptodebug("failed to chmod to %s: %s", _PATH_PKCS11_CONF,
1281                     strerror(err));
1282                 rc = FAILURE;
1283         } else {
1284                 rc = SUCCESS;
1285         }
1286
1287         if ((rc == FAILURE) && (unlink(tmpfile_name) != 0)) {
1288                 err = errno;
1289                 cryptoerror(LOG_STDERR, gettext(
1290                     "(Warning) failed to remove %s: %s"),
1291                     tmpfile_name, strerror(err));
1292         }
1293
1294         return (rc);
1295 }
1296
1297
1298 /*
1299  * Convert an uentry to a character string
1300  */
1301 static char *
1302 uent2str(uentry_t *puent)
1303 {
1304         umechlist_t     *phead;
1305         boolean_t tok1_present = B_FALSE;
1306         char *buf;
1307         char blank_buf[128];
1308
1309         if (puent == NULL) {
1310                 cryptoerror(LOG_STDERR, gettext("internal error."));
1311                 return (NULL);
1312         }
1313
1314         buf = malloc(BUFSIZ);
1315         if (buf == NULL) {
1316                 cryptoerror(LOG_STDERR, gettext("out of memory."));
1317                 return (NULL);
1318         }
1319
1320         /* convert the library name */
1321         if (strlcpy(buf, puent->name, BUFSIZ) >= BUFSIZ) {
1322                 free(buf);
1323                 return (NULL);
1324         }
1325
1326
1327         /* convert the enabledlist or the disabledlist */
1328         if (puent->flag_enabledlist == B_TRUE) {
1329                 if (strlcat(buf, SEP_COLON, BUFSIZ) >= BUFSIZ) {
1330                         free(buf);
1331                         return (NULL);
1332                 }
1333
1334                 if (strlcat(buf, EF_ENABLED, BUFSIZ) >= BUFSIZ) {
1335                         free(buf);
1336                         return (NULL);
1337                 }
1338
1339                 phead = puent->policylist;
1340                 while (phead != NULL) {
1341                         if (strlcat(buf, phead->name, BUFSIZ) >= BUFSIZ) {
1342                                 free(buf);
1343                                 return (NULL);
1344                         }
1345
1346                         phead = phead->next;
1347                         if (phead != NULL) {
1348                                 if (strlcat(buf, SEP_COMMA, BUFSIZ)
1349                                     >= BUFSIZ) {
1350                                         free(buf);
1351                                         return (NULL);
1352                                 }
1353                         }
1354                 }
1355                 tok1_present = B_TRUE;
1356         } else if (puent->policylist != NULL) {
1357                 if (strlcat(buf, SEP_COLON, BUFSIZ) >= BUFSIZ) {
1358                         free(buf);
1359                         return (NULL);
1360                 }
1361
1362                 if (strlcat(buf, EF_DISABLED, BUFSIZ) >= BUFSIZ) {
1363                         free(buf);
1364                         return (NULL);
1365                 }
1366                 phead = puent->policylist;
1367                 while (phead != NULL) {
1368                         if (strlcat(buf, phead->name, BUFSIZ) >= BUFSIZ) {
1369                                 free(buf);
1370                                 return (NULL);
1371                         }
1372
1373                         phead = phead->next;
1374                         if (phead != NULL) {
1375                                 if (strlcat(buf, SEP_COMMA, BUFSIZ)
1376                                     >= BUFSIZ) {
1377                                         free(buf);
1378                                         return (NULL);
1379                                 }
1380                         }
1381                 }
1382                 tok1_present = B_TRUE;
1383         }
1384
1385         if (puent->flag_norandom == B_TRUE) {
1386                 if (strlcat(buf, (tok1_present ? SEP_SEMICOLON : SEP_COLON),
1387                     BUFSIZ) >= BUFSIZ) {
1388                         free(buf);
1389                         return (NULL);
1390                 }
1391
1392                 if (strlcat(buf, EF_NORANDOM, BUFSIZ) >= BUFSIZ) {
1393                         free(buf);
1394                         return (NULL);
1395                 }
1396         }
1397
1398         if (strcmp(puent->name, METASLOT_KEYWORD) == 0) {
1399
1400                 /* write the metaslot_status= value */
1401                 if (strlcat(buf, (tok1_present ? SEP_SEMICOLON : SEP_COLON),
1402                     BUFSIZ) >= BUFSIZ) {
1403                         free(buf);
1404                         return (NULL);
1405                 }
1406
1407                 if (strlcat(buf, METASLOT_STATUS, BUFSIZ) >= BUFSIZ) {
1408                         free(buf);
1409                         return (NULL);
1410                 }
1411
1412                 if (puent->flag_metaslot_enabled) {
1413                         if (strlcat(buf, ENABLED_KEYWORD, BUFSIZ) >= BUFSIZ) {
1414                                 free(buf);
1415                                 return (NULL);
1416                         }
1417                 } else {
1418                         if (strlcat(buf, DISABLED_KEYWORD, BUFSIZ)
1419                             >= BUFSIZ) {
1420                                 free(buf);
1421                                 return (NULL);
1422                         }
1423                 }
1424
1425                 if (!tok1_present) {
1426                         tok1_present = B_TRUE;
1427                 }
1428
1429                 if (strlcat(buf, SEP_SEMICOLON, BUFSIZ) >= BUFSIZ) {
1430                         free(buf);
1431                         return (NULL);
1432                 }
1433
1434                 if (strlcat(buf, METASLOT_AUTO_KEY_MIGRATE, BUFSIZ) >= BUFSIZ) {
1435                         free(buf);
1436                         return (NULL);
1437                 }
1438
1439                 if (puent->flag_metaslot_auto_key_migrate) {
1440                         if (strlcat(buf, ENABLED_KEYWORD, BUFSIZ) >= BUFSIZ) {
1441                                 free(buf);
1442                                 return (NULL);
1443                         }
1444                 } else {
1445                         if (strlcat(buf, DISABLED_KEYWORD, BUFSIZ) >= BUFSIZ) {
1446                                 free(buf);
1447                                 return (NULL);
1448                         }
1449                 }
1450
1451                 bzero(blank_buf, sizeof (blank_buf));
1452
1453                 /* write metaslot_token= if specified */
1454                 if (memcmp(puent->metaslot_ks_token, blank_buf,
1455                     TOKEN_LABEL_SIZE) != 0) {
1456                         /* write the metaslot_status= value */
1457                         if (strlcat(buf, (tok1_present ?
1458                             SEP_SEMICOLON : SEP_COLON), BUFSIZ) >= BUFSIZ) {
1459                                 free(buf);
1460                                 return (NULL);
1461                         }
1462
1463                         if (strlcat(buf, METASLOT_TOKEN, BUFSIZ) >= BUFSIZ) {
1464                                 free(buf);
1465                                 return (NULL);
1466                         }
1467
1468                         if (strlcat(buf,
1469                             (const char *)puent->metaslot_ks_token, BUFSIZ)
1470                             >= BUFSIZ) {
1471                                 free(buf);
1472                                 return (NULL);
1473                         }
1474                 }
1475
1476                 /* write metaslot_slot= if specified */
1477                 if (memcmp(puent->metaslot_ks_slot, blank_buf,
1478                     SLOT_DESCRIPTION_SIZE) != 0) {
1479                         /* write the metaslot_status= value */
1480                         if (strlcat(buf, (tok1_present ?
1481                             SEP_SEMICOLON : SEP_COLON), BUFSIZ) >= BUFSIZ) {
1482                                 free(buf);
1483                                 return (NULL);
1484                         }
1485
1486                         if (strlcat(buf, METASLOT_SLOT, BUFSIZ) >= BUFSIZ) {
1487                                 free(buf);
1488                                 return (NULL);
1489                         }
1490
1491                         if (strlcat(buf,
1492                             (const char *)puent->metaslot_ks_slot, BUFSIZ)
1493                             >= BUFSIZ) {
1494                                 free(buf);
1495                                 return (NULL);
1496                         }
1497                 }
1498         }
1499
1500         if (strlcat(buf, "\n", BUFSIZ) >= BUFSIZ) {
1501                 free(buf);
1502                 return (NULL);
1503         }
1504
1505         return (buf);
1506 }
1507
1508
1509 /*
1510  * This function updates the default policy mode and the policy exception list
1511  * for a user-level provider based on the mechanism specified in the disable
1512  * or enable subcommand and the update mode.   This function is called by the
1513  * enable_uef_lib() or disable_uef_lib().
1514  */
1515 int
1516 update_policylist(uentry_t *puent, mechlist_t *marglist, int update_mode)
1517 {
1518         CK_MECHANISM_TYPE mech_type;
1519         midstr_t        midname;
1520         umechlist_t     *phead;
1521         umechlist_t     *pcur;
1522         umechlist_t     *pumech;
1523         boolean_t       found;
1524         int     rc = SUCCESS;
1525
1526         if ((puent == NULL) || (marglist == NULL)) {
1527                 /* should not happen */
1528                 cryptoerror(LOG_STDERR, gettext("internal error."));
1529                 cryptodebug("update_policylist()- puent or marglist is NULL.");
1530                 return (FAILURE);
1531         }
1532
1533         if ((update_mode != ADD_MODE) && (update_mode != DELETE_MODE)) {
1534                 /* should not happen */
1535                 cryptoerror(LOG_STDERR, gettext("internal error."));
1536                 cryptodebug("update_policylist() - update_mode is incorrect.");
1537                 return (FAILURE);
1538         }
1539
1540         /*
1541          * For each mechanism operand, get its mechanism type first.
1542          * If fails to get the mechanism type, the mechanism operand must be
1543          * invalid, gives an warning and ignore it. Otherwise,
1544          * - convert the mechanism type to the internal representation (hex)
1545          *   in the pkcs11.conf file
1546          * - If update_mode == DELETE_MODE,
1547          *      If the mechanism is in the policy list, delete it.
1548          *      If the mechanism is not in the policy list, do nothing.
1549          * - If update_mode == ADD_MODE,
1550          *      If the mechanism is not in the policy list, add it.
1551          *      If the mechanism is in the policy list already, do nothing.
1552          */
1553         while (marglist) {
1554                 if (pkcs11_str2mech(marglist->name, &mech_type) != CKR_OK) {
1555                         /*
1556                          * This mechanism is not a valid PKCS11 mechanism,
1557                          * give warning and ignore it.
1558                          */
1559                         cryptoerror(LOG_STDERR, gettext(
1560                             "(Warning) %s is not a valid PKCS#11 mechanism."),
1561                             marglist->name);
1562                         rc = FAILURE;
1563                 } else {
1564                         (void) snprintf(midname, sizeof (midname), "%#010x",
1565                             (int)mech_type);
1566                         if (update_mode == DELETE_MODE) {
1567                                 found = B_FALSE;
1568                                 phead = pcur = puent->policylist;
1569                                 while (!found && pcur) {
1570                                         if (strcmp(pcur->name, midname) == 0) {
1571                                                 found = B_TRUE;
1572                                         } else {
1573                                                 phead = pcur;
1574                                                 pcur = pcur->next;
1575                                         }
1576                                 }
1577
1578                                 if (found) {
1579                                         if (phead == pcur) {
1580                                                 puent->policylist =
1581                                                     puent->policylist->next;
1582                                                 free(pcur);
1583                                         } else {
1584                                                 phead->next = pcur->next;
1585                                                 free(pcur);
1586                                         }
1587                                         puent->count--;
1588                                         if (puent->count == 0) {
1589                                                 puent->policylist = NULL;
1590                                         }
1591                                 }
1592                         } else if (update_mode == ADD_MODE) {
1593                                 if (!is_in_policylist(midname,
1594                                     puent->policylist)) {
1595                                         pumech = create_umech(midname);
1596                                         if (pumech == NULL) {
1597                                                 rc = FAILURE;
1598                                                 break;
1599                                         }
1600                                         phead = puent->policylist;
1601                                         puent->policylist = pumech;
1602                                         pumech->next = phead;
1603                                         puent->count++;
1604                                 }
1605                         }
1606                 }
1607                 marglist = marglist->next;
1608         }
1609
1610         return (rc);
1611 }
1612
1613 /*
1614  * Open a session to the given slot and check if we can do
1615  * random numbers by asking for one byte.
1616  */
1617 static boolean_t
1618 check_random(CK_SLOT_ID slot_id, CK_FUNCTION_LIST_PTR prov_funcs)
1619 {
1620         CK_RV rv;
1621         CK_SESSION_HANDLE hSession;
1622         CK_BYTE test_byte;
1623         CK_BYTE_PTR test_byte_ptr = &test_byte;
1624
1625         rv = prov_funcs->C_OpenSession(slot_id, CKF_SERIAL_SESSION,
1626             NULL_PTR, NULL, &hSession);
1627         if (rv != CKR_OK)
1628                 return (B_FALSE);
1629
1630         /* We care only about the return value */
1631         rv = prov_funcs->C_GenerateRandom(hSession, test_byte_ptr,
1632             sizeof (test_byte));
1633         (void) prov_funcs->C_CloseSession(hSession);
1634
1635         /*
1636          * These checks are purely to determine whether the slot can do
1637          * random numbers. So, we don't check whether the routine
1638          * succeeds. The reason we check for CKR_RANDOM_NO_RNG also is that
1639          * this error effectively means CKR_FUNCTION_NOT_SUPPORTED.
1640          */
1641         if (rv != CKR_FUNCTION_NOT_SUPPORTED && rv != CKR_RANDOM_NO_RNG)
1642                 return (B_TRUE);
1643         else
1644                 return (B_FALSE);
1645 }
1646
1647 void
1648 display_verbose_mech_header()
1649 {
1650         (void) printf("%28s %s", " ", HDR1);
1651         (void) printf("%28s %s", " ", HDR2);
1652         (void) printf("%28s %s", " ", HDR3);
1653         (void) printf("%28s %s", " ", HDR4);
1654         (void) printf("%28s %s", " ", HDR5);
1655         (void) printf("%28s %s", " ", HDR6);
1656         (void) printf("%-28.28s %s", gettext("mechanism name"), HDR7);
1657         /*
1658          * TRANSLATION_NOTE
1659          * Strictly for appearance's sake, the first header line should be
1660          * as long as the length of the translated text above.  The format
1661          * lengths should all match too.
1662          */
1663         (void) printf("%28s ---- ---- "
1664             "-  -  -  -  -  -  -  -  -  -  -  -  -  -\n",
1665             gettext("----------------------------"));
1666 }