usr/src/cmd/cmd-crypto/kmfcfg/list.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  *
  21  * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
  22  */
  23
  24 #include <stdio.h>
  25 #include <strings.h>
  26 #include <ctype.h>
  27 #include <libgen.h>
  28 #include <libintl.h>
  29 #include <errno.h>
  30 #include <sys/stat.h>
  31 #include <kmfapiP.h>
  32 #include "util.h"
  33
  34 #define LIB_NSS_PATH    "/usr/lib/mps/libnss3.so"
  35 #define LIB_NSPR_PATH   "/usr/lib/mps/libnspr4.so"
  36
  37 static void
  38 show_policy(KMF_POLICY_RECORD *plc)
  39 {
  40         int i;
  41         if (plc == NULL)
  42                 return;
  43
  44         (void) printf("Name: %s\n", plc->name);
  45
  46         (void) printf(gettext("Ignore Date: %s\n"),
  47             plc->ignore_date ? gettext("true") : gettext("false"));
  48
  49         (void) printf(gettext("Ignore Unknown EKUs: %s\n"),
  50             plc->ignore_unknown_ekus ? gettext("true") : gettext("false"));
  51
  52         (void) printf(gettext("Ignore TA: %s\n"),
  53             plc->ignore_trust_anchor ? gettext("true") : gettext("false"));
  54
  55         (void) printf(gettext("Validity Adjusted Time: %s\n"),
  56             plc->validity_adjusttime ? plc->validity_adjusttime : "<null>");
  57
  58         if (plc->ta_name == NULL && plc->ta_serial == NULL) {
  59                 (void) printf(gettext("Trust Anchor Certificate: <null>\n"));
  60         } else if (strcasecmp(plc->ta_name, "search") == 0) {
  61                 (void) printf(gettext("Trust Anchor Certificate: "
  62                     "Search by Issuer\n"));
  63         } else {
  64                 (void) printf(gettext("Trust Anchor Certificate:\n"));
  65                 (void) printf(gettext("\tName: %s\n"),
  66                     plc->ta_name ? plc->ta_name : "<null>");
  67                 (void) printf(gettext("\tSerial Number: %s\n"),
  68                     plc->ta_serial ? plc->ta_serial : "<null>");
  69         }
  70
  71         if (plc->ku_bits != 0) {
  72                 (void) printf(gettext("Key Usage Bits: "));
  73                 for (i = KULOWBIT; i <= KUHIGHBIT; i++) {
  74                         char *s = kmf_ku_to_string(
  75                             (plc->ku_bits & (1<<i)));
  76                         if (s != NULL) {
  77                                 (void) printf("%s ", s);
  78                         }
  79                 }
  80                 (void) printf("\n");
  81         } else {
  82                 (void) printf(gettext("Key Usage Bits: 0\n"));
  83         }
  84
  85         if (plc->eku_set.eku_count > 0) {
  86                 (void) printf(gettext("Extended Key Usage Values:\n"));
  87                 for (i = 0; i < plc->eku_set.eku_count; i++) {
  88                         char *s = kmf_oid_to_ekuname(
  89                             &plc->eku_set.ekulist[i]);
  90                         (void) printf("\t%s\t(%s)\n",
  91                             kmf_oid_to_string(&plc->eku_set.ekulist[i]),
  92                             s ? s : "unknown");
  93                 }
  94         } else {
  95                 (void) printf(gettext("Extended Key Usage Values: <null>\n"));
  96         }
  97
  98         (void) printf(gettext("Validation Policy Information:\n"));
  99
 100         if (plc->revocation & KMF_REVOCATION_METHOD_OCSP) {
 101                 (void) printf(gettext("    OCSP:\n"));
 102
 103                 (void) printf(gettext("\tResponder URI: %s\n"),
 104                     plc->VAL_OCSP_BASIC.responderURI ?
 105                     plc->VAL_OCSP_BASIC.responderURI : "<null>");
 106
 107                 (void) printf(gettext("\tProxy: %s\n"),
 108                     plc->VAL_OCSP_BASIC.proxy ?
 109                     plc->VAL_OCSP_BASIC.proxy : "<null>");
 110
 111                 (void) printf(gettext("\tUse ResponderURI from Certificate: "
 112                     "%s\n"), plc->VAL_OCSP_BASIC.uri_from_cert ?
 113                     gettext("true") : gettext("false"));
 114
 115                 (void) printf(gettext("\tResponse lifetime: %s\n"),
 116                     plc->VAL_OCSP_BASIC.response_lifetime ?
 117                     plc->VAL_OCSP_BASIC.response_lifetime : "<null>");
 118
 119                 (void) printf(gettext("\tIgnore Response signature: %s\n"),
 120                     plc->VAL_OCSP_BASIC.ignore_response_sign ?
 121                     gettext("true") : gettext("false"));
 122
 123                 if (!plc->VAL_OCSP.has_resp_cert) {
 124                         (void) printf(gettext("\tResponder Certificate:"
 125                             " <null>\n"));
 126                 } else {
 127                         (void) printf(gettext("\tResponder Certificate:\n"));
 128                         (void) printf(gettext("\t\tName: %s\n"),
 129                             plc->VAL_OCSP_RESP_CERT.name ?
 130                             plc->VAL_OCSP_RESP_CERT.name : "<null>");
 131                         (void) printf(gettext("\t\tSerial: %s\n"),
 132                             plc->VAL_OCSP_RESP_CERT.serial ?
 133                             plc->VAL_OCSP_RESP_CERT.serial : "<null>");
 134                 }
 135         }
 136
 137         if (plc->revocation & KMF_REVOCATION_METHOD_CRL) {
 138                 (void) printf(gettext("    CRL:\n"));
 139
 140                 (void) printf(gettext("\tBase filename: %s\n"),
 141                     plc->validation_info.crl_info.basefilename ?
 142                     plc->validation_info.crl_info.basefilename : "<null>");
 143
 144                 (void) printf(gettext("\tDirectory: %s\n"),
 145                     plc->validation_info.crl_info.directory ?
 146                     plc->validation_info.crl_info.directory : "<null>");
 147
 148                 (void) printf(gettext("\tDownload and cache CRL: %s\n"),
 149                     plc->validation_info.crl_info.get_crl_uri ?
 150                     gettext("true") : gettext("false"));
 151
 152                 (void) printf(gettext("\tProxy: %s\n"),
 153                     plc->validation_info.crl_info.proxy ?
 154                     plc->validation_info.crl_info.proxy : "<null>");
 155
 156                 (void) printf(gettext("\tIgnore CRL signature: %s\n"),
 157                     plc->validation_info.crl_info.ignore_crl_sign ?
 158                     gettext("true") : gettext("false"));
 159
 160                 (void) printf(gettext("\tIgnore CRL validity date: %s\n"),
 161                     plc->validation_info.crl_info.ignore_crl_date ?
 162                     gettext("true") : gettext("false"));
 163         }
 164         (void) printf(gettext("Mapper name: %s\n"),
 165             plc->mapper.mapname ? plc->mapper.mapname : "<null>");
 166         (void) printf(gettext("Mapper pathname: %s\n"),
 167             plc->mapper.pathname ? plc->mapper.pathname : "<null>");
 168         (void) printf(gettext("Mapper directory: %s\n"),
 169             plc->mapper.dir ? plc->mapper.dir : "<null>");
 170         (void) printf(gettext("Mapper options: %s\n"),
 171             plc->mapper.options ? plc->mapper.options : "<null>");
 172
 173         (void) printf("\n");
 174 }
 175
 176 void
 177 show_plugin(void)
 178 {
 179         conf_entrylist_t *phead = NULL;
 180         struct stat     statbuf;
 181
 182         (void) printf(gettext("KMF plugin information:\n"));
 183         (void) printf(gettext("-----------------------\n"));
 184
 185         /* List the built-in plugins */
 186         (void) printf("pkcs11:kmf_pkcs11.so.1 (built-in)\n");
 187         (void) printf("file:kmf_openssl.so.1 (built-in)\n");
 188
 189         /*
 190          * If the NSS libraries are not installed in the system,
 191          * then we will not show the nss plugin either.
 192          */
 193         if (stat(LIB_NSS_PATH, &statbuf) == 0 &&
 194             stat(LIB_NSPR_PATH, &statbuf) == 0) {
 195                 (void) printf("nss:kmf_nss.so.1 (built-in)\n");
 196         }
 197
 198         /* List non-default plugins, if there is any. */
 199         if (get_entrylist(&phead) == KMF_OK) {
 200                 while (phead != NULL) {
 201                         (void) printf("%s:%s", phead->entry->keystore,
 202                             phead->entry->modulepath);
 203
 204                         if (phead->entry->option == NULL)
 205                                 (void) printf("\n");
 206                         else
 207                                 (void) printf(";option=%s\n",
 208                                     phead->entry->option);
 209                         phead = phead->next;
 210                 }
 211                 free_entrylist(phead);
 212         }
 213 }
 214
 215
 216 int
 217 kc_list(int argc, char *argv[])
 218 {
 219         int             rv = KC_OK;
 220         int             opt, found = 0;
 221         extern int      optind_av;
 222         extern char     *optarg_av;
 223         char            *filename = NULL;
 224         char            *policyname = NULL;
 225         POLICY_LIST     *plclist = NULL, *pnode;
 226         int             sanity_err = 0;
 227         boolean_t       list_plugin = B_FALSE;
 228
 229         while ((opt = getopt_av(argc, argv, "i:(dbfile)p:(policy)m(plugin)"))
 230             != EOF) {
 231                 switch (opt) {
 232                 case 'i':
 233                         if (list_plugin)
 234                                 rv = KC_ERR_USAGE;
 235                         else {
 236                                 filename = get_string(optarg_av, &rv);
 237                                 if (filename == NULL) {
 238                                         (void) fprintf(stderr,
 239                                             gettext("Error dbfile input.\n"));
 240                                 }
 241                         }
 242                         break;
 243                 case 'p':
 244                         if (list_plugin)
 245                                 rv = KC_ERR_USAGE;
 246                         else {
 247                                 policyname = get_string(optarg_av, &rv);
 248                                 if (policyname == NULL) {
 249                                         (void) fprintf(stderr,
 250                                             gettext("Error policy name.\n"));
 251                                 }
 252                         }
 253                         break;
 254                 case 'm':
 255                         list_plugin = B_TRUE;
 256                         break;
 257                 default:
 258                         (void) fprintf(stderr,
 259                             gettext("Error input option.\n"));
 260                         rv = KC_ERR_USAGE;
 261                         break;
 262                 }
 263                 if (rv != KC_OK)
 264                         goto out;
 265         }
 266
 267         /* No additional args allowed. */
 268         argc -= optind_av;
 269         if (argc) {
 270                 (void) fprintf(stderr,
 271                     gettext("Error input option\n"));
 272                 rv = KC_ERR_USAGE;
 273                 goto out;
 274         }
 275
 276         if (list_plugin) {
 277                 show_plugin();
 278                 goto out;
 279         }
 280
 281         if (filename == NULL) {
 282                 filename = strdup(KMF_DEFAULT_POLICY_FILE);
 283                 if (filename == NULL) {
 284                         rv = KC_ERR_MEMORY;
 285                         goto out;
 286                 }
 287         }
 288
 289         /* Check the access permission of the policy DB */
 290         if (access(filename, R_OK) < 0) {
 291                 int err = errno;
 292                 (void) fprintf(stderr,
 293                     gettext("Cannot access \"%s\" for list - %s\n"), filename,
 294                     strerror(err));
 295                 rv = KC_ERR_ACCESS;
 296                 goto out;
 297         }
 298
 299         rv = load_policies(filename, &plclist);
 300         if (rv != KMF_OK) {
 301                 goto out;
 302         }
 303
 304         pnode = plclist;
 305         while (pnode != NULL) {
 306                 if (policyname == NULL ||
 307                     strcmp(policyname, pnode->plc.name) == 0) {
 308                         KMF_POLICY_RECORD *plc = &pnode->plc;
 309
 310                         found++;
 311                         rv = kmf_verify_policy(plc);
 312                         if (rv != KMF_OK) {
 313                                 (void) fprintf(stderr, gettext(
 314                                     "Policy Name: '%s' is invalid\n"),
 315                                     plc->name);
 316                                 sanity_err++;
 317                         } else {
 318                                 show_policy(&pnode->plc);
 319                         }
 320                 }
 321                 pnode = pnode->next;
 322         }
 323
 324         free_policy_list(plclist);
 325
 326         if (!found) {
 327                 if (policyname)
 328                         (void) fprintf(stderr, gettext(
 329                             "Cannot find policy '%s'\n"), policyname);
 330                 else
 331                         (void) fprintf(stderr, gettext("Cannot find "
 332                             "any policies to display\n"));
 333                 rv = KC_ERR_FIND_POLICY;
 334         } else if (sanity_err) {
 335                 rv = KC_ERR_VERIFY_POLICY;
 336         }
 337
 338 out:
 339
 340         if (filename != NULL)
 341                 free(filename);
 342
 343         if (policyname != NULL)
 344                 free(policyname);
 345
 346         return (rv);
 347 }