1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 *
21 * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
22 */
23 /*
24 * Copyright 2010 Nexenta Systems, Inc. All rights reserved.
25 * Copyright 2014, OmniTI Computer Consulting, Inc. All rights reserved.
26 */
27
28 #ifndef _CRYPTOUTIL_H
29 #define _CRYPTOUTIL_H
30
31 #ifdef __cplusplus
32 extern "C" {
33 #endif
34
35 #include <sys/types.h>
36 #include <syslog.h>
37 #include <security/cryptoki.h>
38 #include <sys/param.h>
39
40 #define LOG_STDERR -1
41 #define SUCCESS 0
42 #define FAILURE 1
43 #define MECH_ID_HEX_LEN 11 /* length of mechanism id in hex form */
44
45 #define _PATH_PKCS11_CONF "/etc/crypto/pkcs11.conf"
46 #define _PATH_KCF_CONF "/etc/crypto/kcf.conf"
47 #define _PATH_KCFD_LOCK "/var/run/kcfd.lock"
48
49 /* $ISA substitution for parsing pkcs11.conf data */
50 #define PKCS11_ISA "/$ISA/"
51 #if defined(_LP64)
52 #define PKCS11_ISA_DIR "/64/"
53 #else /* !_LP64 */
54 #define PKCS11_ISA_DIR "/"
55 #endif
56
57 /* keywords and delimiters for parsing configuration files */
58 #define SEP_COLON ":"
59 #define SEP_SEMICOLON ";"
60 #define SEP_EQUAL "="
61 #define SEP_COMMA ","
62 #define METASLOT_KEYWORD "metaslot"
63 #define FIPS_KEYWORD "fips-140"
64 #define EF_DISABLED "disabledlist="
65 #define EF_ENABLED "enabledlist="
66 #define EF_NORANDOM "NO_RANDOM"
67 #define METASLOT_TOKEN "metaslot_token="
68 #define METASLOT_SLOT "metaslot_slot="
69 #define METASLOT_STATUS "metaslot_status="
70 #define EF_FIPS_STATUS "fips_status="
71 #define METASLOT_AUTO_KEY_MIGRATE "metaslot_auto_key_migrate="
72 #define ENABLED_KEYWORD "enabled"
73 #define DISABLED_KEYWORD "disabled"
74 #define SLOT_DESCRIPTION_SIZE 64
75 #define TOKEN_LABEL_SIZE 32
76 #define TOKEN_MANUFACTURER_SIZE 32
77 #define TOKEN_SERIAL_SIZE 16
78 #define CRYPTO_FIPS_MODE_DISABLED 0
79 #define CRYPTO_FIPS_MODE_ENABLED 1
80
81 /*
82 * Define the following softtoken values that are used by softtoken
83 * library, cryptoadm and pktool command.
84 */
85 #define SOFT_SLOT_DESCRIPTION \
86 "Sun Crypto Softtoken " \
87 " "
88 #define SOFT_TOKEN_LABEL "Sun Software PKCS#11 softtoken "
89 #define SOFT_TOKEN_SERIAL " "
90 #define SOFT_MANUFACTURER_ID "Sun Microsystems, Inc. "
91 #define SOFT_DEFAULT_PIN "changeme"
92
93 typedef char libname_t[MAXPATHLEN];
94 typedef char midstr_t[MECH_ID_HEX_LEN];
95
96 typedef struct umechlist {
97 midstr_t name; /* mechanism name in hex form */
98 struct umechlist *next;
99 } umechlist_t;
100
101 typedef struct uentry {
102 libname_t name;
103 boolean_t flag_norandom; /* TRUE if random is disabled */
104 boolean_t flag_enabledlist; /* TRUE if an enabledlist */
105 umechlist_t *policylist; /* disabledlist or enabledlist */
106 boolean_t flag_metaslot_enabled; /* TRUE if metaslot's enabled */
107 boolean_t flag_metaslot_auto_key_migrate;
108 CK_UTF8CHAR metaslot_ks_slot[SLOT_DESCRIPTION_SIZE + 1];
109 CK_UTF8CHAR metaslot_ks_token[TOKEN_LABEL_SIZE + 1];
110 int count;
111 boolean_t flag_fips_enabled;
112 } uentry_t;
113
114 typedef struct uentrylist {
115 uentry_t *puent;
116 struct uentrylist *next;
117 } uentrylist_t;
118
119 /* Return codes for pkcs11_parse_uri() */
120 #define PK11_URI_OK 0
121 #define PK11_URI_INVALID 1
122 #define PK11_MALLOC_ERROR 2
123 #define PK11_URI_VALUE_OVERFLOW 3
124 #define PK11_NOT_PKCS11_URI 4
125
126 /*
127 * There is no limit for the attribute length in the spec. 256 bytes should be
128 * enough for the object name.
129 */
130 #define PK11_MAX_OBJECT_LEN 256
131 /*
132 * CKA_ID is of type "byte array" which can be of arbitrary length. 256 bytes
133 * should be sufficient though.
134 */
135 #define PK11_MAX_ID_LEN 256
136
137 /* Structure for the PKCS#11 URI. */
138 typedef struct pkcs11_uri_t {
139 /* CKA_LABEL attribute to the C_FindObjectsInit function. */
140 CK_UTF8CHAR_PTR object;
141 /*
142 * CKA_CLASS attribute to the C_FindObjectsInit function. The
143 * "objecttype" URI attribute can have a value one of "private",
144 * "public", "cert", "secretkey", and "data". The "objecttype" field can
145 * have a value of CKO_PUBLIC_KEY, CKO_PRIVATE_KEY, CKO_CERTIFICATE,
146 * CKO_SECRET_KEY, and CKO_DATA. This attribute cannot be empty in the
147 * URI.
148 */
149 CK_ULONG objecttype;
150 /* CKO_DATA is 0 so we need this flag. Not part of the URI itself. */
151 boolean_t objecttype_present;
152 /*
153 * Token, manufufacturer, serial and model are of fixed size length in
154 * the specification. We allocate memory on the fly to distinguish
155 * between an attribute not present and an empty value. We check for
156 * overflows. We always terminate the string with '\0' even when that is
157 * not used in the PKCS#11's CK_TOKEN_INFO structure (fields are padded
158 * with spaces).
159 */
160 /* Token label from CK_TOKEN_INFO. */
161 CK_UTF8CHAR_PTR token;
162 /* ManufacturerID from CK_TOKEN_INFO. */
163 CK_UTF8CHAR_PTR manuf;
164 /* SerialNumber from CK_TOKEN_INFO. */
165 CK_CHAR_PTR serial;
166 /* Model from CK_TOKEN_INFO. */
167 CK_UTF8CHAR_PTR model;
168 /* This is a byte array, we need a length parameter as well. */
169 CK_BYTE_PTR id;
170 int id_len;
171 /*
172 * Location of the file with a token PIN. Application can overload this,
173 * eg. "/bin/askpass|" may mean to read the PIN from a command. However,
174 * the pkcs11_parse_uri() function does not interpret this field in any
175 * way.
176 */
177 char *pinfile;
178 } pkcs11_uri_t;
179
180 extern void cryptodebug(const char *fmt, ...);
181 extern void cryptoerror(int priority, const char *fmt, ...);
182 extern void cryptodebug_init(const char *prefix);
183 extern void cryptoerror_off();
184 extern void cryptoerror_on();
185
186 extern const char *pkcs11_mech2str(CK_MECHANISM_TYPE mech);
187 extern CK_RV pkcs11_str2mech(char *mech_str, CK_MECHANISM_TYPE_PTR mech);
188
189 extern int get_pkcs11conf_info(uentrylist_t **);
190 extern umechlist_t *create_umech(char *);
191 extern void free_umechlist(umechlist_t *);
192 extern void free_uentrylist(uentrylist_t *);
193 extern void free_uentry(uentry_t *);
194 extern uentry_t *getent_uef(char *);
195
196 extern void tohexstr(uchar_t *bytes, size_t blen, char *hexstr, size_t hexlen);
197 extern int hexstr_to_bytes(char *hexstr, size_t hexlen, uchar_t **bytes,
198 size_t *blen);
199 extern CK_RV pkcs11_mech2keytype(CK_MECHANISM_TYPE mech_type,
200 CK_KEY_TYPE *ktype);
201 extern CK_RV pkcs11_mech2keygen(CK_MECHANISM_TYPE mech_type,
202 CK_MECHANISM_TYPE *gen_mech);
203 extern char *pkcs11_strerror(CK_RV rv);
204
205 extern int
206 get_metaslot_info(boolean_t *status_enabled, boolean_t *migrate_enabled,
207 char **objectstore_slot_info, char **objectstore_token_info);
208
209 extern char *get_fullpath(char *dir, char *filepath);
210 extern int str2lifetime(char *ltimestr, uint32_t *ltime);
211
212 extern char *pkcs11_default_token(void);
213 extern int pkcs11_get_pass(char *token_name, char **pdata, size_t *psize,
214 size_t min_psize, boolean_t with_confirmation);
215
216 extern int pkcs11_seed_urandom(void *sbuf, size_t slen);
217 extern int pkcs11_get_random(void *dbuf, size_t dlen);
218 extern int pkcs11_get_urandom(void *dbuf, size_t dlen);
219 extern int pkcs11_get_nzero_urandom(void *dbuf, size_t dlen);
220 extern int pkcs11_read_data(char *filename, void **dbuf, size_t *dlen);
221
222 extern int open_nointr(const char *path, int oflag, ...);
223 extern ssize_t readn_nointr(int fd, void *dbuf, size_t dlen);
224 extern ssize_t writen_nointr(int fd, void *dbuf, size_t dlen);
225 extern int update_conf(char *conf_file, char *entry);
226
227 extern int pkcs11_parse_uri(const char *str, pkcs11_uri_t *uri);
228 extern void pkcs11_free_uri(pkcs11_uri_t *uri);
229
230 #ifdef __cplusplus
231 }
232 #endif
233
234 #endif /* _CRYPTOUTIL_H */