1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #ifndef _CRYPTOADM_H 27 #define _CRYPTOADM_H 28 29 #include <sys/types.h> 30 #include <sys/crypto/ioctladmin.h> 31 #include <cryptoutil.h> 32 #include <security/cryptoki.h> 33 34 #ifdef __cplusplus 35 extern "C" { 36 #endif 37 38 #define _PATH_KCFD "/lib/crypto/kcfd" 39 #define TMPFILE_TEMPLATE "/etc/crypto/admXXXXXX" 40 41 #define ERROR_USAGE 2 42 43 /* 44 * Common keywords and delimiters for pkcs11.conf and kcf.conf files are 45 * defined in usr/lib/libcryptoutil/common/cryptoutil.h. The following is 46 * the extra keywords and delimiters used in kcf.conf file. 47 */ 48 #define SEP_SLASH '/' 49 #define EF_SUPPORTED "supportedlist=" 50 #define EF_UNLOAD "unload" 51 #define RANDOM "random" 52 #define UEF_FRAME_LIB "/usr/lib/libpkcs11.so" 53 54 #define ADD_MODE 1 55 #define DELETE_MODE 2 56 #define MODIFY_MODE 3 57 58 #define REFRESH 1 59 #define NOT_REFRESH 0 60 61 typedef char prov_name_t[MAXNAMELEN]; 62 typedef char mech_name_t[CRYPTO_MAX_MECH_NAME]; 63 64 typedef struct mechlist { 65 mech_name_t name; 66 struct mechlist *next; 67 } mechlist_t; 68 69 70 typedef struct entry { 71 prov_name_t name; 72 mechlist_t *suplist; /* supported list */ 73 uint_t sup_count; 74 mechlist_t *dislist; /* disabled list */ 75 uint_t dis_count; 76 boolean_t load; /* B_FALSE after cryptoadm unload */ 77 boolean_t flag_fips_enabled; 78 } entry_t; 79 80 81 typedef struct entrylist { 82 entry_t *pent; 83 struct entrylist *next; 84 } entrylist_t; 85 86 typedef enum { 87 NO_RNG, 88 HAS_RNG 89 } flag_val_t; 90 91 extern int errno; 92 93 /* adm_util */ 94 extern boolean_t is_in_list(char *, mechlist_t *); 95 extern mechlist_t *create_mech(char *); 96 extern void free_mechlist(mechlist_t *); 97 98 /* adm_kef_util */ 99 extern boolean_t is_device(char *); 100 extern boolean_t is_fips(char *); 101 extern int fips_update_kcfconf(int); 102 extern void fips_status_kcfconf(int *); 103 extern char *ent2str(entry_t *); 104 extern entry_t *getent_kef(char *provname, 105 entrylist_t *pdevlist, entrylist_t *psoftlist, 106 entrylist_t *pfipslist); 107 extern int check_kernel_for_soft(char *provname, 108 crypto_get_soft_list_t *psoftlist, boolean_t *in_kernel); 109 extern int check_kernel_for_hard(char *provname, 110 crypto_get_dev_list_t *pdevlist, boolean_t *in_kernel); 111 extern int disable_mechs(entry_t **, mechlist_t *, boolean_t, mechlist_t *); 112 extern int enable_mechs(entry_t **, boolean_t, mechlist_t *); 113 extern int get_kcfconf_info(entrylist_t **, entrylist_t **, entrylist_t **); 114 extern int get_admindev_info(entrylist_t **, entrylist_t **); 115 extern int get_mech_count(mechlist_t *); 116 extern entry_t *create_entry(char *provname); 117 extern int insert_kcfconf(entry_t *); 118 extern int split_hw_provname(char *, char *, int *); 119 extern int update_kcfconf(entry_t *, int); 120 extern void free_entry(entry_t *); 121 extern void free_entrylist(entrylist_t *); 122 extern void print_mechlist(char *, mechlist_t *); 123 extern void print_kef_policy(char *provname, entry_t *pent, 124 boolean_t has_random, boolean_t has_mechs); 125 extern boolean_t filter_mechlist(mechlist_t **, const char *); 126 extern uentry_t *getent_uef(char *); 127 128 129 /* adm_uef */ 130 extern int list_mechlist_for_lib(char *, mechlist_t *, flag_val_t *, 131 boolean_t, boolean_t, boolean_t); 132 extern int list_policy_for_lib(char *); 133 extern int disable_uef_lib(char *, boolean_t, boolean_t, mechlist_t *); 134 extern int enable_uef_lib(char *, boolean_t, boolean_t, mechlist_t *); 135 extern int install_uef_lib(char *); 136 extern int uninstall_uef_lib(char *); 137 extern int print_uef_policy(uentry_t *); 138 extern void display_token_flags(CK_FLAGS flags); 139 extern int convert_mechlist(CK_MECHANISM_TYPE **, CK_ULONG *, mechlist_t *); 140 extern void display_verbose_mech_header(); 141 extern void display_mech_info(CK_MECHANISM_INFO *); 142 extern int display_policy(uentry_t *); 143 extern int update_pkcs11conf(uentry_t *); 144 extern int update_policylist(uentry_t *, mechlist_t *, int); 145 146 /* adm_kef */ 147 extern int list_mechlist_for_soft(char *provname, 148 entrylist_t *phardlist, entrylist_t *psoftlist, 149 entrylist_t *pfipslist); 150 extern int list_mechlist_for_hard(char *); 151 extern int list_policy_for_soft(char *provname, 152 entrylist_t *phardlist, entrylist_t *psoftlist, 153 entrylist_t *pfipslist); 154 extern int list_policy_for_hard(char *provname, 155 entrylist_t *phardlist, entrylist_t *psoftlist, 156 entrylist_t *pfipslist, 157 crypto_get_dev_list_t *pdevlist); 158 extern int disable_kef_software(char *, boolean_t, boolean_t, mechlist_t *); 159 extern int disable_kef_hardware(char *, boolean_t, boolean_t, mechlist_t *); 160 extern int enable_kef(char *, boolean_t, boolean_t, mechlist_t *); 161 extern int install_kef(char *, mechlist_t *); 162 extern int uninstall_kef(char *); 163 extern int unload_kef_soft(char *provname); 164 extern int refresh(void); 165 extern int start_daemon(void); 166 extern int stop_daemon(void); 167 168 /* adm_ioctl */ 169 extern crypto_load_soft_config_t *setup_soft_conf(entry_t *); 170 extern crypto_load_soft_disabled_t *setup_soft_dis(entry_t *); 171 extern crypto_load_dev_disabled_t *setup_dev_dis(entry_t *); 172 extern crypto_unload_soft_module_t *setup_unload_soft(entry_t *); 173 extern int get_dev_info(char *, int, int, mechlist_t **); 174 extern int get_dev_list(crypto_get_dev_list_t **); 175 extern int get_soft_info(char *provname, mechlist_t **ppmechlist, 176 entrylist_t *phardlist, entrylist_t *psoftlist, 177 entrylist_t *pfipslist); 178 extern int get_soft_list(crypto_get_soft_list_t **); 179 extern int do_fips_actions(int, int); 180 181 /* adm_metaslot */ 182 extern int list_metaslot_info(boolean_t, boolean_t, mechlist_t *); 183 extern int list_metaslot_policy(); 184 extern int disable_metaslot(mechlist_t *, boolean_t, boolean_t); 185 extern int enable_metaslot(char *, char *, boolean_t, mechlist_t *, boolean_t, 186 boolean_t); 187 188 #ifdef __cplusplus 189 } 190 #endif 191 192 #endif /* _CRYPTOADM_H */ 193