1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright 2006 Sun Microsystems, Inc. All rights reserved.
23 * Use is subject to license terms.
24 * Copyright 2018, Joyent, Inc.
25 */
26
27 #include <cryptoutil.h>
28 #include <strings.h>
29 #include <stdio.h>
30 #include <tzfile.h>
31 #include <sys/crypto/common.h>
32
33 /*
34 * In order to fit everything on one line, the 'CRYPTO_' prefix
35 * has been dropped from the KCF #defines, e.g.
36 * CRYPTO_SUCCESS becomes SUCCESS.
37 */
38
39 static CK_RV error_number_table[CRYPTO_LAST_ERROR + 1] = {
40 CKR_OK, /* SUCCESS */
41 CKR_CANCEL, /* CANCEL */
42 CKR_HOST_MEMORY, /* HOST_MEMORY */
43 CKR_GENERAL_ERROR, /* GENERAL_ERROR */
44 CKR_FUNCTION_FAILED, /* FAILED */
45 CKR_ARGUMENTS_BAD, /* ARGUMENTS_BAD */
46 CKR_ATTRIBUTE_READ_ONLY, /* ATTRIBUTE_READ_ONLY */
47 CKR_ATTRIBUTE_SENSITIVE, /* ATTRIBUTE_SENSITIVE */
48 CKR_ATTRIBUTE_TYPE_INVALID, /* ATTRIBUTE_TYPE_INVALID */
49 CKR_ATTRIBUTE_VALUE_INVALID, /* ATTRIBUTE_VALUE_INVALID */
50 CKR_FUNCTION_FAILED, /* CANCELED */
51 CKR_DATA_INVALID, /* DATA_INVALID */
52 CKR_DATA_LEN_RANGE, /* DATA_LEN_RANGE */
53 CKR_DEVICE_ERROR, /* DEVICE_ERROR */
54 CKR_DEVICE_MEMORY, /* DEVICE_MEMORY */
55 CKR_DEVICE_REMOVED, /* DEVICE_REMOVED */
56 CKR_ENCRYPTED_DATA_INVALID, /* ENCRYPTED_DATA_INVALID */
57 CKR_ENCRYPTED_DATA_LEN_RANGE, /* ENCRYPTED_DATA_LEN_RANGE */
58 CKR_KEY_HANDLE_INVALID, /* KEY_HANDLE_INVALID */
59 CKR_KEY_SIZE_RANGE, /* KEY_SIZE_RANGE */
60 CKR_KEY_TYPE_INCONSISTENT, /* KEY_TYPE_INCONSISTENT */
61 CKR_KEY_NOT_NEEDED, /* KEY_NOT_NEEDED */
62 CKR_KEY_CHANGED, /* KEY_CHANGED */
63 CKR_KEY_NEEDED, /* KEY_NEEDED */
64 CKR_KEY_INDIGESTIBLE, /* KEY_INDIGESTIBLE */
65 CKR_KEY_FUNCTION_NOT_PERMITTED, /* KEY_FUNCTION_NOT_PERMITTED */
66 CKR_KEY_NOT_WRAPPABLE, /* KEY_NOT_WRAPPABLE */
67 CKR_KEY_UNEXTRACTABLE, /* KEY_UNEXTRACTABLE */
68 CKR_MECHANISM_INVALID, /* MECHANISM_INVALID */
69 CKR_MECHANISM_PARAM_INVALID, /* MECHANISM_PARAM_INVALID */
70 CKR_OBJECT_HANDLE_INVALID, /* OBJECT_HANDLE_INVALID */
71 CKR_OPERATION_ACTIVE, /* OPERATION_ACTIVE */
72 CKR_OPERATION_NOT_INITIALIZED, /* OPERATION_NOT_INITIALIZED */
73 CKR_PIN_INCORRECT, /* PIN_INCORRECT */
74 CKR_PIN_INVALID, /* PIN_INVALID */
75 CKR_PIN_LEN_RANGE, /* PIN_LEN_RANGE */
76 CKR_PIN_EXPIRED, /* PIN_EXPIRED */
77 CKR_PIN_LOCKED, /* PIN_LOCKED */
78 CKR_SESSION_CLOSED, /* SESSION_CLOSED */
79 CKR_SESSION_COUNT, /* SESSION_COUNT */
80 CKR_SESSION_HANDLE_INVALID, /* SESSION_HANDLE_INVALID */
81 CKR_SESSION_READ_ONLY, /* SESSION_READ_ONLY */
82 CKR_SESSION_EXISTS, /* SESSION_EXISTS */
83 CKR_SESSION_READ_ONLY_EXISTS, /* SESSION_READ_ONLY_EXISTS */
84 CKR_SESSION_READ_WRITE_SO_EXISTS, /* SESSION_READ_WRITE_SO_EXISTS */
85 CKR_SIGNATURE_INVALID, /* SIGNATURE_INVALID */
86 CKR_SIGNATURE_LEN_RANGE, /* SIGNATURE_LEN_RANGE */
87 CKR_TEMPLATE_INCOMPLETE, /* TEMPLATE_INCOMPLETE */
88 CKR_TEMPLATE_INCONSISTENT, /* TEMPLATE_INCONSISTENT */
89 CKR_UNWRAPPING_KEY_HANDLE_INVALID, /* UNWRAPPING_KEY_HANDLE_INVALID */
90 CKR_UNWRAPPING_KEY_SIZE_RANGE, /* UNWRAPPING_KEY_SIZE_RANGE */
91 CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT, /* UNWRAPPING_KEY_TYPE_INCONSISTENT */
92 CKR_USER_ALREADY_LOGGED_IN, /* USER_ALREADY_LOGGED_IN */
93 CKR_USER_NOT_LOGGED_IN, /* USER_NOT_LOGGED_IN */
94 CKR_USER_PIN_NOT_INITIALIZED, /* USER_PIN_NOT_INITIALIZED */
95 CKR_USER_TYPE_INVALID, /* USER_TYPE_INVALID */
96 CKR_USER_ANOTHER_ALREADY_LOGGED_IN, /* USER_ANOTHER_ALREADY_LOGGED_IN */
97 CKR_USER_TOO_MANY_TYPES, /* USER_TOO_MANY_TYPES */
98 CKR_WRAPPED_KEY_INVALID, /* WRAPPED_KEY_INVALID */
99 CKR_WRAPPED_KEY_LEN_RANGE, /* WRAPPED_KEY_LEN_RANGE */
100 CKR_WRAPPING_KEY_HANDLE_INVALID, /* WRAPPING_KEY_HANDLE_INVALID */
101 CKR_WRAPPING_KEY_SIZE_RANGE, /* WRAPPING_KEY_SIZE_RANGE */
102 CKR_WRAPPING_KEY_TYPE_INCONSISTENT, /* WRAPPING_KEY_TYPE_INCONSISTENT */
103 CKR_RANDOM_SEED_NOT_SUPPORTED, /* RANDOM_SEED_NOT_SUPPORTED */
104 CKR_RANDOM_NO_RNG, /* RANDOM_NO_RNG */
105 CKR_DOMAIN_PARAMS_INVALID, /* DOMAIN_PARAMS_INVALID */
106 CKR_BUFFER_TOO_SMALL, /* BUFFER_TOO_SMALL */
107 CKR_INFORMATION_SENSITIVE, /* INFORMATION_SENSITIVE */
108 CKR_FUNCTION_NOT_SUPPORTED, /* NOT_SUPPORTED */
109 CKR_GENERAL_ERROR, /* QUEUED */
110 CKR_GENERAL_ERROR, /* BUFFER_TOO_BIG */
111 CKR_OPERATION_NOT_INITIALIZED, /* INVALID_CONTEXT */
112 CKR_GENERAL_ERROR, /* INVALID_MAC */
113 CKR_GENERAL_ERROR, /* MECH_NOT_SUPPORTED */
114 CKR_GENERAL_ERROR, /* INCONSISTENT_ATTRIBUTE */
115 CKR_GENERAL_ERROR, /* NO_PERMISSION */
116 CKR_SLOT_ID_INVALID, /* INVALID_PROVIDER_ID */
117 CKR_GENERAL_ERROR, /* VERSION_MISMATCH */
118 CKR_GENERAL_ERROR, /* BUSY */
119 CKR_GENERAL_ERROR, /* UNKNOWN_PROVIDER */
120 CKR_GENERAL_ERROR, /* MODVERIFICATION_FAILED */
121 CKR_GENERAL_ERROR, /* OLD_CTX_TEMPLATE */
122 CKR_GENERAL_ERROR, /* WEAK_KEY */
123 CKR_GENERAL_ERROR /* FIPS140_ERROR */
124 };
125
126 #if CRYPTO_LAST_ERROR != CRYPTO_FIPS140_ERROR
127 #error "Crypto to PKCS11 error mapping table needs to be updated!"
128 #endif
129
130 /*
131 * This function returns a fullpath based on the "dir" and "filepath" input
132 * arugments.
133 * - If the filepath specified does not start with a "/" and the directory
134 * is also given, prepend the directory to the filename.
135 * - If only dir or filepath is given, this function returns a copy of the
136 * given argument.
137 * - If the filepath is fully qualified already and the "dir" is also
138 * given, return NULL to indicate an error.
139 */
140 char *
get_fullpath(char * dir,char * filepath)141 get_fullpath(char *dir, char *filepath)
142 {
143 char *fullpath = NULL;
144 int pathlen = 0;
145 int dirlen = 0;
146
147 if (filepath != NULL)
148 pathlen = strlen(filepath);
149
150 if (dir != NULL)
151 dirlen = strlen(dir);
152
153 if (pathlen > 0 && dirlen > 0) {
154 if (filepath[0] != '/') {
155 int len = pathlen + dirlen + 2;
156 fullpath = (char *)malloc(len);
157 if (fullpath != NULL)
158 (void) snprintf(fullpath, len, "%s/%s",
159 dir, filepath);
160 } else {
161 return (NULL);
162 }
163 } else if (pathlen > 0) {
164 fullpath = (char *)strdup(filepath);
165 } else if (dirlen > 0) {
166 fullpath = (char *)strdup(dir);
167 }
168
169 return (fullpath);
170 }
171
172 /*
173 * This function converts the input string to the value of time
174 * in seconds.
175 * - If the input string is NULL, return zero second.
176 * - The input string needs to be in the form of:
177 * number-second(s), number-minute(s), number-hour(s) or
178 * number-day(s).
179 */
180 int
str2lifetime(char * ltimestr,uint32_t * ltime)181 str2lifetime(char *ltimestr, uint32_t *ltime)
182 {
183 int num;
184 char timetok[10];
185
186 if (ltimestr == NULL || !strlen(ltimestr)) {
187 *ltime = 0;
188 return (0);
189 }
190
191 (void) memset(timetok, 0, sizeof (timetok));
192 if (sscanf(ltimestr, "%d-%08s", &num, timetok) != 2)
193 return (-1);
194
195 if (!strcasecmp(timetok, "second") ||
196 !strcasecmp(timetok, "seconds")) {
197 *ltime = num;
198 } else if (!strcasecmp(timetok, "minute") ||
199 !strcasecmp(timetok, "minutes")) {
200 *ltime = num * SECSPERMIN;
201 } else if (!strcasecmp(timetok, "day") ||
202 !strcasecmp(timetok, "days")) {
203 *ltime = num * SECSPERDAY;
204 } else if (!strcasecmp(timetok, "hour") ||
205 !strcasecmp(timetok, "hours")) {
206 *ltime = num * SECSPERHOUR;
207 } else {
208 *ltime = 0;
209 return (-1);
210 }
211
212 return (0);
213 }
214
215 /*
216 * Map KCF error codes into PKCS11 error codes.
217 */
218 CK_RV
crypto2pkcs11_error_number(uint_t n)219 crypto2pkcs11_error_number(uint_t n)
220 {
221 if (n >= sizeof (error_number_table) / sizeof (error_number_table[0]))
222 return (CKR_GENERAL_ERROR);
223
224 return (error_number_table[n]);
225 }
226