17c478bd9Sstevel@tonic-gate /*
27c478bd9Sstevel@tonic-gate * CDDL HEADER START
37c478bd9Sstevel@tonic-gate *
47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the
5c197cb9dShylee * Common Development and Distribution License (the "License").
6c197cb9dShylee * You may not use this file except in compliance with the License.
77c478bd9Sstevel@tonic-gate *
87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions
117c478bd9Sstevel@tonic-gate * and limitations under the License.
127c478bd9Sstevel@tonic-gate *
137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bd9Sstevel@tonic-gate *
197c478bd9Sstevel@tonic-gate * CDDL HEADER END
207c478bd9Sstevel@tonic-gate */
2154da5c1fSjk115741 /* Portions Copyright 2005 Richard Lowe */
227c478bd9Sstevel@tonic-gate /*
237b79d846SDina K Nimeh * Copyright 2009 Sun Microsystems, Inc. All rights reserved.
247c478bd9Sstevel@tonic-gate * Use is subject to license terms.
2533f5ff17SMilan Jurik * Copyright 2012 Milan Jurik. All rights reserved.
267c478bd9Sstevel@tonic-gate */
277c478bd9Sstevel@tonic-gate
287c478bd9Sstevel@tonic-gate /*
297c478bd9Sstevel@tonic-gate * decrypt.c
307c478bd9Sstevel@tonic-gate *
317c478bd9Sstevel@tonic-gate * Implements encrypt(1) and decrypt(1) commands
327c478bd9Sstevel@tonic-gate *
337c478bd9Sstevel@tonic-gate * One binary performs both encrypt/decrypt operation.
347c478bd9Sstevel@tonic-gate *
35b54157c1Sda73024 * Usage:
36b54157c1Sda73024 * -a algorithm mechanism name without CKM_ prefix. Case
377c478bd9Sstevel@tonic-gate * does not matter
38b54157c1Sda73024 * -k keyfile file containing key data. If not specified user is
397c478bd9Sstevel@tonic-gate * prompted to enter key. key length > 0 is required
40b54157c1Sda73024 * -i infile input file to encrypt/decrypt. If omitted, stdin used.
41b54157c1Sda73024 * -o outfile output file to encrypt/decrypt. If omitted, stdout used.
427c478bd9Sstevel@tonic-gate * if infile & outfile are same, a temp file is used for
437c478bd9Sstevel@tonic-gate * output and infile is replaced with this file after
44b54157c1Sda73024 * operation is complete
45b54157c1Sda73024 * -l Display the list of algorithms
46b54157c1Sda73024 * -v Display verbose information
47b54157c1Sda73024 * -T tokenspec Specify a PKCS#11 token (optionally used with -K)
48b54157c1Sda73024 * -K keylabel Specify the symmetric PKCS#11 token key label
497c478bd9Sstevel@tonic-gate *
507c478bd9Sstevel@tonic-gate * Implementation notes:
51b54157c1Sda73024 * IV data - It is generated by random bytes equal to one block size.
527c478bd9Sstevel@tonic-gate *
53b54157c1Sda73024 * Encrypted output format -
54b54157c1Sda73024 * - Output format version number (1) - 4 bytes in network byte order.
557c478bd9Sstevel@tonic-gate * - Iterations used in key gen function, 4 bytes in network byte order.
56b54157c1Sda73024 * - IV ('ivlen' bytes). Length is algorithm-dependent (see mech_aliases)
577c478bd9Sstevel@tonic-gate * - Salt data used in key gen (16 bytes)
58b54157c1Sda73024 * - Cipher text data (remainder of the file)
597c478bd9Sstevel@tonic-gate */
607c478bd9Sstevel@tonic-gate
617c478bd9Sstevel@tonic-gate #include <stdio.h>
627c478bd9Sstevel@tonic-gate #include <stdlib.h>
637c478bd9Sstevel@tonic-gate #include <unistd.h>
647c478bd9Sstevel@tonic-gate #include <errno.h>
657c478bd9Sstevel@tonic-gate #include <fcntl.h>
667c478bd9Sstevel@tonic-gate #include <ctype.h>
677c478bd9Sstevel@tonic-gate #include <strings.h>
687c478bd9Sstevel@tonic-gate #include <libintl.h>
697c478bd9Sstevel@tonic-gate #include <libgen.h>
707c478bd9Sstevel@tonic-gate #include <locale.h>
717c478bd9Sstevel@tonic-gate #include <limits.h>
727c478bd9Sstevel@tonic-gate #include <sys/types.h>
737c478bd9Sstevel@tonic-gate #include <sys/stat.h>
747c478bd9Sstevel@tonic-gate #include <netinet/in.h>
757c478bd9Sstevel@tonic-gate #include <security/cryptoki.h>
767c478bd9Sstevel@tonic-gate #include <cryptoutil.h>
77c197cb9dShylee #include <kmfapi.h>
787c478bd9Sstevel@tonic-gate
79f2728256SKrishna Yenduri /*
80f2728256SKrishna Yenduri * Buffer size for reading file. This is given a rather high value
81f2728256SKrishna Yenduri * to get better performance when a hardware provider is present.
82f2728256SKrishna Yenduri */
83f2728256SKrishna Yenduri #define BUFFERSIZE (1024 * 64)
847c478bd9Sstevel@tonic-gate #define BLOCKSIZE (128) /* Largest guess for block size */
85f2728256SKrishna Yenduri #define PROGRESSSIZE (1024 * 40) /* stdin progress indicator size */
867c478bd9Sstevel@tonic-gate
877c478bd9Sstevel@tonic-gate #define SUNW_ENCRYPT_FILE_VERSION 1
887c478bd9Sstevel@tonic-gate
897c478bd9Sstevel@tonic-gate /*
907c478bd9Sstevel@tonic-gate * Exit Status codes
917c478bd9Sstevel@tonic-gate */
927c478bd9Sstevel@tonic-gate #ifndef EXIT_SUCCESS
937c478bd9Sstevel@tonic-gate #define EXIT_SUCCESS 0 /* No errors */
947c478bd9Sstevel@tonic-gate #define EXIT_FAILURE 1 /* All errors except usage */
957c478bd9Sstevel@tonic-gate #endif /* EXIT_SUCCESS */
967c478bd9Sstevel@tonic-gate
977c478bd9Sstevel@tonic-gate #define EXIT_USAGE 2 /* usage/syntax error */
987c478bd9Sstevel@tonic-gate
997c478bd9Sstevel@tonic-gate #define ENCRYPT_NAME "encrypt" /* name of encrypt command */
100c197cb9dShylee #define ENCRYPT_OPTIONS "a:T:K:k:i:o:lv" /* options for encrypt */
1017c478bd9Sstevel@tonic-gate #define DECRYPT_NAME "decrypt" /* name of decrypt command */
102c197cb9dShylee #define DECRYPT_OPTIONS "a:T:K:k:i:o:lv" /* options for decrypt */
1037c478bd9Sstevel@tonic-gate
1047c478bd9Sstevel@tonic-gate /*
1057c478bd9Sstevel@tonic-gate * Structure containing info for encrypt/decrypt
1067c478bd9Sstevel@tonic-gate * command
1077c478bd9Sstevel@tonic-gate */
1087c478bd9Sstevel@tonic-gate struct CommandInfo {
1097c478bd9Sstevel@tonic-gate char *name; /* name of the command */
1107c478bd9Sstevel@tonic-gate char *options; /* command line options */
1117c478bd9Sstevel@tonic-gate CK_FLAGS flags;
1127c478bd9Sstevel@tonic-gate CK_ATTRIBUTE_TYPE type; /* type of command */
1137c478bd9Sstevel@tonic-gate
1147c478bd9Sstevel@tonic-gate /* function pointers for various operations */
1157c478bd9Sstevel@tonic-gate CK_RV (*Init)(CK_SESSION_HANDLE, CK_MECHANISM_PTR, CK_OBJECT_HANDLE);
1167c478bd9Sstevel@tonic-gate CK_RV (*Update)(CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_BYTE_PTR,
1177c478bd9Sstevel@tonic-gate CK_ULONG_PTR);
1187c478bd9Sstevel@tonic-gate CK_RV (*Crypt)(CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_BYTE_PTR,
1197c478bd9Sstevel@tonic-gate CK_ULONG_PTR);
1207c478bd9Sstevel@tonic-gate CK_RV (*Final)(CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG_PTR);
1217c478bd9Sstevel@tonic-gate };
1227c478bd9Sstevel@tonic-gate
1237c478bd9Sstevel@tonic-gate static struct CommandInfo encrypt_cmd = {
1247c478bd9Sstevel@tonic-gate ENCRYPT_NAME,
1257c478bd9Sstevel@tonic-gate ENCRYPT_OPTIONS,
1267c478bd9Sstevel@tonic-gate CKF_ENCRYPT,
1277c478bd9Sstevel@tonic-gate CKA_ENCRYPT,
1287c478bd9Sstevel@tonic-gate C_EncryptInit,
1297c478bd9Sstevel@tonic-gate C_EncryptUpdate,
1307c478bd9Sstevel@tonic-gate C_Encrypt,
1317c478bd9Sstevel@tonic-gate C_EncryptFinal
1327c478bd9Sstevel@tonic-gate };
1337c478bd9Sstevel@tonic-gate
1347c478bd9Sstevel@tonic-gate static struct CommandInfo decrypt_cmd = {
1357c478bd9Sstevel@tonic-gate DECRYPT_NAME,
1367c478bd9Sstevel@tonic-gate DECRYPT_OPTIONS,
1377c478bd9Sstevel@tonic-gate CKF_DECRYPT,
1387c478bd9Sstevel@tonic-gate CKA_DECRYPT,
1397c478bd9Sstevel@tonic-gate C_DecryptInit,
1407c478bd9Sstevel@tonic-gate C_DecryptUpdate,
1417c478bd9Sstevel@tonic-gate C_Decrypt,
1427c478bd9Sstevel@tonic-gate C_DecryptFinal
1437c478bd9Sstevel@tonic-gate };
1447c478bd9Sstevel@tonic-gate
1457c478bd9Sstevel@tonic-gate struct mech_alias {
1467c478bd9Sstevel@tonic-gate CK_MECHANISM_TYPE type;
1477c478bd9Sstevel@tonic-gate char *alias;
1487c478bd9Sstevel@tonic-gate CK_ULONG keysize_min;
1497c478bd9Sstevel@tonic-gate CK_ULONG keysize_max;
1507c478bd9Sstevel@tonic-gate int keysize_unit;
1517c478bd9Sstevel@tonic-gate int ivlen;
1527c478bd9Sstevel@tonic-gate boolean_t available;
1537c478bd9Sstevel@tonic-gate };
1547c478bd9Sstevel@tonic-gate
1557c478bd9Sstevel@tonic-gate #define MECH_ALIASES_COUNT 4
1567c478bd9Sstevel@tonic-gate
1577c478bd9Sstevel@tonic-gate static struct mech_alias mech_aliases[] = {
1587c478bd9Sstevel@tonic-gate { CKM_AES_CBC_PAD, "aes", ULONG_MAX, 0L, 8, 16, B_FALSE },
1597c478bd9Sstevel@tonic-gate { CKM_RC4, "arcfour", ULONG_MAX, 0L, 1, 0, B_FALSE },
1607c478bd9Sstevel@tonic-gate { CKM_DES_CBC_PAD, "des", 8, 8, 8, 8, B_FALSE },
1617c478bd9Sstevel@tonic-gate { CKM_DES3_CBC_PAD, "3des", 24, 24, 8, 8, B_FALSE },
1627c478bd9Sstevel@tonic-gate };
1637c478bd9Sstevel@tonic-gate
1647c478bd9Sstevel@tonic-gate static CK_BBOOL truevalue = TRUE;
1657c478bd9Sstevel@tonic-gate static CK_BBOOL falsevalue = FALSE;
1667c478bd9Sstevel@tonic-gate
1677c478bd9Sstevel@tonic-gate static boolean_t aflag = B_FALSE; /* -a <algorithm> flag, required */
1687c478bd9Sstevel@tonic-gate static boolean_t kflag = B_FALSE; /* -k <keyfile> flag */
1697c478bd9Sstevel@tonic-gate static boolean_t iflag = B_FALSE; /* -i <infile> flag, use stdin if absent */
1707c478bd9Sstevel@tonic-gate static boolean_t oflag = B_FALSE; /* -o <outfile> flag, use stdout if absent */
1717c478bd9Sstevel@tonic-gate static boolean_t lflag = B_FALSE; /* -l flag (list) */
1727c478bd9Sstevel@tonic-gate static boolean_t vflag = B_FALSE; /* -v flag (verbose) */
173b54157c1Sda73024 static boolean_t Tflag = B_FALSE; /* -T flag (tokenspec) */
174b54157c1Sda73024 static boolean_t Kflag = B_FALSE; /* -K flag (keylabel) */
1757c478bd9Sstevel@tonic-gate
1767c478bd9Sstevel@tonic-gate static char *keyfile = NULL; /* name of keyfile */
1777c478bd9Sstevel@tonic-gate static char *inputfile = NULL; /* name of input file */
1787c478bd9Sstevel@tonic-gate static char *outputfile = NULL; /* name of output file */
179b54157c1Sda73024 static char *token_label = NULL; /* name of PKCS#11 token */
180b54157c1Sda73024 static char *key_label = NULL; /* name of PKCS#11 token key label */
1817c478bd9Sstevel@tonic-gate
1827c478bd9Sstevel@tonic-gate static int status_pos = 0; /* current position of progress bar element */
1837c478bd9Sstevel@tonic-gate
1847c478bd9Sstevel@tonic-gate /*
1857c478bd9Sstevel@tonic-gate * function prototypes
1867c478bd9Sstevel@tonic-gate */
1877c478bd9Sstevel@tonic-gate static void usage(struct CommandInfo *cmd);
1887c478bd9Sstevel@tonic-gate static int execute_cmd(struct CommandInfo *cmd, char *algo_str);
1897c478bd9Sstevel@tonic-gate static int crypt_multipart(struct CommandInfo *cmd, CK_SESSION_HANDLE hSession,
19054da5c1fSjk115741 int infd, int outfd, off_t insize);
1917c478bd9Sstevel@tonic-gate
1927c478bd9Sstevel@tonic-gate int
main(int argc,char ** argv)1937c478bd9Sstevel@tonic-gate main(int argc, char **argv)
1947c478bd9Sstevel@tonic-gate {
1957c478bd9Sstevel@tonic-gate
1967c478bd9Sstevel@tonic-gate extern char *optarg;
1977c478bd9Sstevel@tonic-gate extern int optind;
1987c478bd9Sstevel@tonic-gate char *optstr;
199*ef150c2bSRichard Lowe int c; /* current getopts flag */
2007c478bd9Sstevel@tonic-gate char *algo_str = NULL; /* algorithm string */
2017c478bd9Sstevel@tonic-gate struct CommandInfo *cmd;
2027c478bd9Sstevel@tonic-gate char *cmdname; /* name of command */
2037c478bd9Sstevel@tonic-gate boolean_t errflag = B_FALSE;
2047c478bd9Sstevel@tonic-gate
2057c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, "");
206b54157c1Sda73024 #if !defined(TEXT_DOMAIN) /* Should be defined by cc -D */
2077c478bd9Sstevel@tonic-gate #define TEXT_DOMAIN "SYS_TEST" /* Use this only if it weren't */
2087c478bd9Sstevel@tonic-gate #endif
2097c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN);
2107c478bd9Sstevel@tonic-gate
2117c478bd9Sstevel@tonic-gate /*
2127c478bd9Sstevel@tonic-gate * Based on command name, determine
2137c478bd9Sstevel@tonic-gate * type of command.
2147c478bd9Sstevel@tonic-gate */
2157c478bd9Sstevel@tonic-gate cmdname = basename(argv[0]);
2167c478bd9Sstevel@tonic-gate
2177c478bd9Sstevel@tonic-gate cryptodebug_init(cmdname);
2187c478bd9Sstevel@tonic-gate
2197c478bd9Sstevel@tonic-gate if (strcmp(cmdname, encrypt_cmd.name) == 0) {
2207c478bd9Sstevel@tonic-gate cmd = &encrypt_cmd;
2217c478bd9Sstevel@tonic-gate } else if (strcmp(cmdname, decrypt_cmd.name) == 0) {
2227c478bd9Sstevel@tonic-gate cmd = &decrypt_cmd;
2237c478bd9Sstevel@tonic-gate } else {
2247c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
2257c478bd9Sstevel@tonic-gate "command name must be either encrypt or decrypt"));
2267c478bd9Sstevel@tonic-gate exit(EXIT_USAGE);
2277c478bd9Sstevel@tonic-gate }
2287c478bd9Sstevel@tonic-gate
2297c478bd9Sstevel@tonic-gate optstr = cmd->options;
2307c478bd9Sstevel@tonic-gate
2317c478bd9Sstevel@tonic-gate /* Parse command line arguments */
2327c478bd9Sstevel@tonic-gate while (!errflag && (c = getopt(argc, argv, optstr)) != -1) {
2337c478bd9Sstevel@tonic-gate
2347c478bd9Sstevel@tonic-gate switch (c) {
2357c478bd9Sstevel@tonic-gate case 'a':
2367c478bd9Sstevel@tonic-gate aflag = B_TRUE;
2377c478bd9Sstevel@tonic-gate algo_str = optarg;
2387c478bd9Sstevel@tonic-gate break;
2397c478bd9Sstevel@tonic-gate case 'k':
2407c478bd9Sstevel@tonic-gate kflag = B_TRUE;
2417c478bd9Sstevel@tonic-gate keyfile = optarg;
2427c478bd9Sstevel@tonic-gate break;
243c197cb9dShylee case 'T':
244c197cb9dShylee Tflag = B_TRUE;
245c197cb9dShylee token_label = optarg;
246c197cb9dShylee break;
247c197cb9dShylee case 'K':
248c197cb9dShylee Kflag = B_TRUE;
249c197cb9dShylee key_label = optarg;
250c197cb9dShylee break;
2517c478bd9Sstevel@tonic-gate case 'i':
2527c478bd9Sstevel@tonic-gate iflag = B_TRUE;
2537c478bd9Sstevel@tonic-gate inputfile = optarg;
2547c478bd9Sstevel@tonic-gate break;
2557c478bd9Sstevel@tonic-gate case 'o':
2567c478bd9Sstevel@tonic-gate oflag = B_TRUE;
2577c478bd9Sstevel@tonic-gate outputfile = optarg;
2587c478bd9Sstevel@tonic-gate break;
2597c478bd9Sstevel@tonic-gate case 'l':
2607c478bd9Sstevel@tonic-gate lflag = B_TRUE;
2617c478bd9Sstevel@tonic-gate break;
2627c478bd9Sstevel@tonic-gate case 'v':
2637c478bd9Sstevel@tonic-gate vflag = B_TRUE;
2647c478bd9Sstevel@tonic-gate break;
2657c478bd9Sstevel@tonic-gate default:
2667c478bd9Sstevel@tonic-gate errflag = B_TRUE;
2677c478bd9Sstevel@tonic-gate }
2687c478bd9Sstevel@tonic-gate }
2697c478bd9Sstevel@tonic-gate
2707c478bd9Sstevel@tonic-gate if (errflag || (!aflag && !lflag) || (lflag && argc > 2) ||
271c197cb9dShylee (kflag && Kflag) || (Tflag && !Kflag) ||
2727c478bd9Sstevel@tonic-gate (optind < argc)) {
2737c478bd9Sstevel@tonic-gate usage(cmd);
2747c478bd9Sstevel@tonic-gate exit(EXIT_USAGE);
2757c478bd9Sstevel@tonic-gate }
2767c478bd9Sstevel@tonic-gate
2777c478bd9Sstevel@tonic-gate return (execute_cmd(cmd, algo_str));
2787c478bd9Sstevel@tonic-gate }
2797c478bd9Sstevel@tonic-gate
2807c478bd9Sstevel@tonic-gate /*
2817c478bd9Sstevel@tonic-gate * usage message
2827c478bd9Sstevel@tonic-gate */
2837c478bd9Sstevel@tonic-gate static void
usage(struct CommandInfo * cmd)2847c478bd9Sstevel@tonic-gate usage(struct CommandInfo *cmd)
2857c478bd9Sstevel@tonic-gate {
286c197cb9dShylee (void) fprintf(stderr, gettext("Usage:\n"));
2877c478bd9Sstevel@tonic-gate if (cmd->type == CKA_ENCRYPT) {
288c197cb9dShylee (void) fprintf(stderr, gettext(" encrypt -l\n"));
289c197cb9dShylee (void) fprintf(stderr, gettext(" encrypt -a <algorithm> "
290c197cb9dShylee "[-v] [-k <keyfile> | -K <keylabel> [-T <tokenspec>]] "
291c197cb9dShylee "[-i <infile>] [-o <outfile>]\n"));
292c197cb9dShylee
2937c478bd9Sstevel@tonic-gate } else {
294c197cb9dShylee (void) fprintf(stderr, gettext(" decrypt -l\n"));
295c197cb9dShylee (void) fprintf(stderr, gettext(" decrypt -a <algorithm> "
296c197cb9dShylee "[-v] [-k <keyfile> | -K <keylabel> [-T <tokenspec>]] "
297c197cb9dShylee "[-i <infile>] [-o <outfile>]\n"));
2987c478bd9Sstevel@tonic-gate }
2997c478bd9Sstevel@tonic-gate }
3007c478bd9Sstevel@tonic-gate
3017c478bd9Sstevel@tonic-gate /*
3027c478bd9Sstevel@tonic-gate * Print out list of algorithms in default and verbose mode
3037c478bd9Sstevel@tonic-gate */
3047c478bd9Sstevel@tonic-gate static void
algorithm_list()3057c478bd9Sstevel@tonic-gate algorithm_list()
3067c478bd9Sstevel@tonic-gate {
3077c478bd9Sstevel@tonic-gate int mech;
3087c478bd9Sstevel@tonic-gate
3097c478bd9Sstevel@tonic-gate (void) printf(gettext("Algorithm Keysize: Min Max (bits)\n"
3107c478bd9Sstevel@tonic-gate "------------------------------------------\n"));
3117c478bd9Sstevel@tonic-gate
3127c478bd9Sstevel@tonic-gate for (mech = 0; mech < MECH_ALIASES_COUNT; mech++) {
3137c478bd9Sstevel@tonic-gate
3147c478bd9Sstevel@tonic-gate if (mech_aliases[mech].available == B_FALSE)
3157c478bd9Sstevel@tonic-gate continue;
3167c478bd9Sstevel@tonic-gate
3177c478bd9Sstevel@tonic-gate (void) printf("%-15s", mech_aliases[mech].alias);
3187c478bd9Sstevel@tonic-gate
3197c478bd9Sstevel@tonic-gate if (mech_aliases[mech].keysize_min != UINT_MAX &&
3207c478bd9Sstevel@tonic-gate mech_aliases[mech].keysize_max != 0)
3217c478bd9Sstevel@tonic-gate (void) printf(" %5lu %5lu\n",
3227c478bd9Sstevel@tonic-gate (mech_aliases[mech].keysize_min *
3237c478bd9Sstevel@tonic-gate mech_aliases[mech].keysize_unit),
3247c478bd9Sstevel@tonic-gate (mech_aliases[mech].keysize_max *
3257c478bd9Sstevel@tonic-gate mech_aliases[mech].keysize_unit));
3267c478bd9Sstevel@tonic-gate else
3277c478bd9Sstevel@tonic-gate (void) printf("\n");
3287c478bd9Sstevel@tonic-gate
3297c478bd9Sstevel@tonic-gate }
3307c478bd9Sstevel@tonic-gate }
3317c478bd9Sstevel@tonic-gate
332c197cb9dShylee /*
333c197cb9dShylee * This function will login into the token with the provided password and
334c197cb9dShylee * find the token key object with the specified keytype and keylabel.
335c197cb9dShylee */
336c197cb9dShylee static int
get_token_key(CK_SESSION_HANDLE hSession,CK_KEY_TYPE keytype,char * keylabel,CK_BYTE * password,int password_len,CK_OBJECT_HANDLE * keyobj)337c197cb9dShylee get_token_key(CK_SESSION_HANDLE hSession, CK_KEY_TYPE keytype,
338c197cb9dShylee char *keylabel, CK_BYTE *password, int password_len,
339c197cb9dShylee CK_OBJECT_HANDLE *keyobj)
340c197cb9dShylee {
341c197cb9dShylee CK_RV rv;
342c197cb9dShylee CK_ATTRIBUTE pTmpl[10];
343c197cb9dShylee CK_OBJECT_CLASS class = CKO_SECRET_KEY;
344c197cb9dShylee CK_BBOOL true = 1;
345c197cb9dShylee CK_BBOOL is_token = 1;
346c197cb9dShylee CK_ULONG key_obj_count = 1;
347c197cb9dShylee int i;
348c197cb9dShylee CK_KEY_TYPE ckKeyType = keytype;
349c197cb9dShylee
350c197cb9dShylee
351c197cb9dShylee rv = C_Login(hSession, CKU_USER, (CK_UTF8CHAR_PTR)password,
352c197cb9dShylee (CK_ULONG)password_len);
353c197cb9dShylee if (rv != CKR_OK) {
354c197cb9dShylee (void) fprintf(stderr, "Cannot login to the token."
355c197cb9dShylee " error = %s\n", pkcs11_strerror(rv));
356c197cb9dShylee return (-1);
357c197cb9dShylee }
358c197cb9dShylee
359c197cb9dShylee i = 0;
360c197cb9dShylee pTmpl[i].type = CKA_TOKEN;
361c197cb9dShylee pTmpl[i].pValue = &is_token;
362c197cb9dShylee pTmpl[i].ulValueLen = sizeof (CK_BBOOL);
363c197cb9dShylee i++;
364c197cb9dShylee
365c197cb9dShylee pTmpl[i].type = CKA_CLASS;
366c197cb9dShylee pTmpl[i].pValue = &class;
367c197cb9dShylee pTmpl[i].ulValueLen = sizeof (class);
368c197cb9dShylee i++;
369c197cb9dShylee
370c197cb9dShylee pTmpl[i].type = CKA_LABEL;
371c197cb9dShylee pTmpl[i].pValue = keylabel;
372c197cb9dShylee pTmpl[i].ulValueLen = strlen(keylabel);
373c197cb9dShylee i++;
374c197cb9dShylee
375c197cb9dShylee pTmpl[i].type = CKA_KEY_TYPE;
376c197cb9dShylee pTmpl[i].pValue = &ckKeyType;
377c197cb9dShylee pTmpl[i].ulValueLen = sizeof (ckKeyType);
378c197cb9dShylee i++;
379c197cb9dShylee
380c197cb9dShylee pTmpl[i].type = CKA_PRIVATE;
381c197cb9dShylee pTmpl[i].pValue = &true;
382c197cb9dShylee pTmpl[i].ulValueLen = sizeof (true);
383c197cb9dShylee i++;
384c197cb9dShylee
385c197cb9dShylee rv = C_FindObjectsInit(hSession, pTmpl, i);
386c197cb9dShylee if (rv != CKR_OK) {
387c197cb9dShylee goto out;
388c197cb9dShylee }
389c197cb9dShylee
390c197cb9dShylee rv = C_FindObjects(hSession, keyobj, 1, &key_obj_count);
391c197cb9dShylee
392c197cb9dShylee (void) C_FindObjectsFinal(hSession);
393c197cb9dShylee
394c197cb9dShylee out:
395c197cb9dShylee if (rv != CKR_OK) {
396c197cb9dShylee (void) fprintf(stderr,
397c197cb9dShylee "Cannot retrieve key object. error = %s\n",
398c197cb9dShylee pkcs11_strerror(rv));
399c197cb9dShylee return (-1);
400c197cb9dShylee }
401c197cb9dShylee
402c197cb9dShylee if (key_obj_count == 0) {
403c197cb9dShylee (void) fprintf(stderr, "Cannot find the key object.\n");
404c197cb9dShylee return (-1);
405c197cb9dShylee }
406c197cb9dShylee
407c197cb9dShylee return (0);
408c197cb9dShylee }
409c197cb9dShylee
4107c478bd9Sstevel@tonic-gate
4117c478bd9Sstevel@tonic-gate /*
4127c478bd9Sstevel@tonic-gate * Execute the command.
4137c478bd9Sstevel@tonic-gate * cmd - command pointing to type of operation.
4147c478bd9Sstevel@tonic-gate * algo_str - alias of the algorithm passed.
4157c478bd9Sstevel@tonic-gate */
4167c478bd9Sstevel@tonic-gate static int
execute_cmd(struct CommandInfo * cmd,char * algo_str)4177c478bd9Sstevel@tonic-gate execute_cmd(struct CommandInfo *cmd, char *algo_str)
4187c478bd9Sstevel@tonic-gate {
4197c478bd9Sstevel@tonic-gate CK_RV rv;
4207c478bd9Sstevel@tonic-gate CK_ULONG slotcount;
4217c478bd9Sstevel@tonic-gate CK_SLOT_ID slotID;
4227c478bd9Sstevel@tonic-gate CK_SLOT_ID_PTR pSlotList = NULL;
4237c478bd9Sstevel@tonic-gate CK_MECHANISM_TYPE mech_type = 0;
4247c478bd9Sstevel@tonic-gate CK_MECHANISM_INFO info, kg_info;
4257c478bd9Sstevel@tonic-gate CK_MECHANISM mech;
4267c478bd9Sstevel@tonic-gate CK_SESSION_HANDLE hSession = CK_INVALID_HANDLE;
4277c478bd9Sstevel@tonic-gate CK_BYTE_PTR pkeydata = NULL;
4281c9bd843Sdinak CK_BYTE salt[CK_PKCS5_PBKD2_SALT_SIZE];
4297c478bd9Sstevel@tonic-gate CK_ULONG keysize = 0;
4307c478bd9Sstevel@tonic-gate int i, slot, mek; /* index variables */
4317c478bd9Sstevel@tonic-gate int status;
4327c478bd9Sstevel@tonic-gate struct stat insbuf; /* stat buf for infile */
4337c478bd9Sstevel@tonic-gate struct stat outsbuf; /* stat buf for outfile */
4347c478bd9Sstevel@tonic-gate char tmpnam[PATH_MAX]; /* tmp file name */
4357c478bd9Sstevel@tonic-gate CK_OBJECT_HANDLE key = (CK_OBJECT_HANDLE) 0;
4367c478bd9Sstevel@tonic-gate int infd = 0; /* input file, stdin default */
4377c478bd9Sstevel@tonic-gate int outfd = 1; /* output file, stdout default */
4387c478bd9Sstevel@tonic-gate char *outfilename = NULL;
4397c478bd9Sstevel@tonic-gate boolean_t errflag = B_TRUE;
4407c478bd9Sstevel@tonic-gate boolean_t inoutsame = B_FALSE; /* if both input & output are same */
4419a2817adSValerie Bubb Fenwick boolean_t leavefilealone = B_FALSE;
4427c478bd9Sstevel@tonic-gate CK_BYTE_PTR pivbuf = NULL_PTR;
4437c478bd9Sstevel@tonic-gate CK_ULONG ivlen = 0L;
4447c478bd9Sstevel@tonic-gate int mech_match = 0;
445b54157c1Sda73024 uint32_t iterations = CK_PKCS5_PBKD2_ITERATIONS;
4467c478bd9Sstevel@tonic-gate CK_ULONG keylen;
447b54157c1Sda73024 uint32_t version = SUNW_ENCRYPT_FILE_VERSION;
4487c478bd9Sstevel@tonic-gate CK_KEY_TYPE keytype;
449c197cb9dShylee KMF_RETURN kmfrv;
450c197cb9dShylee CK_SLOT_ID token_slot_id;
4517c478bd9Sstevel@tonic-gate
4527c478bd9Sstevel@tonic-gate if (aflag) {
4537c478bd9Sstevel@tonic-gate /* Determine if algorithm is valid */
4547c478bd9Sstevel@tonic-gate for (mech_match = 0; mech_match < MECH_ALIASES_COUNT;
4557c478bd9Sstevel@tonic-gate mech_match++) {
4567c478bd9Sstevel@tonic-gate if (strcmp(algo_str,
4577c478bd9Sstevel@tonic-gate mech_aliases[mech_match].alias) == 0) {
4587c478bd9Sstevel@tonic-gate mech_type = mech_aliases[mech_match].type;
4597c478bd9Sstevel@tonic-gate break;
4607c478bd9Sstevel@tonic-gate }
4617c478bd9Sstevel@tonic-gate }
4627c478bd9Sstevel@tonic-gate
4637c478bd9Sstevel@tonic-gate if (mech_match == MECH_ALIASES_COUNT) {
4647c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR,
4657c478bd9Sstevel@tonic-gate gettext("unknown algorithm -- %s"), algo_str);
4667c478bd9Sstevel@tonic-gate return (EXIT_FAILURE);
4677c478bd9Sstevel@tonic-gate }
4687c478bd9Sstevel@tonic-gate
4697c478bd9Sstevel@tonic-gate /*
470c197cb9dShylee * Process keyfile or get the token pin if -K is specified.
4717c478bd9Sstevel@tonic-gate *
4727c478bd9Sstevel@tonic-gate * If a keyfile is provided, get the key data from
4737c478bd9Sstevel@tonic-gate * the file. Otherwise, prompt for a passphrase. The
4747c478bd9Sstevel@tonic-gate * passphrase is used as the key data.
4757c478bd9Sstevel@tonic-gate */
476c197cb9dShylee if (Kflag) {
477c197cb9dShylee /* get the pin of the token */
478c197cb9dShylee if (token_label == NULL || !strlen(token_label)) {
4791c9bd843Sdinak token_label = pkcs11_default_token();
480c197cb9dShylee }
481c197cb9dShylee
4821c9bd843Sdinak status = pkcs11_get_pass(token_label,
4831c9bd843Sdinak (char **)&pkeydata, (size_t *)&keysize, 0, B_FALSE);
484c197cb9dShylee } else if (kflag) {
485c197cb9dShylee /* get the key file */
4861c9bd843Sdinak status = pkcs11_read_data(keyfile, (void **)&pkeydata,
4871c9bd843Sdinak (size_t *)&keysize);
4887c478bd9Sstevel@tonic-gate } else {
489c197cb9dShylee /* get the key from input */
4901c9bd843Sdinak status = pkcs11_get_pass(NULL, (char **)&pkeydata,
491c545f712SDina K Nimeh (size_t *)&keysize, 0,
492c545f712SDina K Nimeh (cmd->type == CKA_ENCRYPT) ? B_TRUE : B_FALSE);
4937c478bd9Sstevel@tonic-gate }
4947c478bd9Sstevel@tonic-gate
495a7e661a2SAnthony Scarpino if (status != 0 || keysize == 0L) {
496c197cb9dShylee cryptoerror(LOG_STDERR,
497c545f712SDina K Nimeh kflag ? gettext("invalid key.") :
498c545f712SDina K Nimeh gettext("invalid passphrase."));
4997c478bd9Sstevel@tonic-gate return (EXIT_FAILURE);
5007c478bd9Sstevel@tonic-gate }
5017c478bd9Sstevel@tonic-gate }
5027c478bd9Sstevel@tonic-gate
5037c478bd9Sstevel@tonic-gate bzero(salt, sizeof (salt));
5047c478bd9Sstevel@tonic-gate /* Initialize pkcs */
505c197cb9dShylee rv = C_Initialize(NULL);
506c197cb9dShylee if (rv != CKR_OK && rv != CKR_CRYPTOKI_ALREADY_INITIALIZED) {
5077c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("failed to initialize "
5087c478bd9Sstevel@tonic-gate "PKCS #11 framework: %s"), pkcs11_strerror(rv));
5097c478bd9Sstevel@tonic-gate goto cleanup;
5107c478bd9Sstevel@tonic-gate }
5117c478bd9Sstevel@tonic-gate
5127c478bd9Sstevel@tonic-gate /* Get slot count */
5137c478bd9Sstevel@tonic-gate rv = C_GetSlotList(0, NULL_PTR, &slotcount);
5147c478bd9Sstevel@tonic-gate if (rv != CKR_OK || slotcount == 0) {
5157c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
5167c478bd9Sstevel@tonic-gate "failed to find any cryptographic provider,"
5177c478bd9Sstevel@tonic-gate "please check with your system administrator: %s"),
5187c478bd9Sstevel@tonic-gate pkcs11_strerror(rv));
5197c478bd9Sstevel@tonic-gate goto cleanup;
5207c478bd9Sstevel@tonic-gate }
5217c478bd9Sstevel@tonic-gate
5227c478bd9Sstevel@tonic-gate /* Found at least one slot, allocate memory for slot list */
5237c478bd9Sstevel@tonic-gate pSlotList = malloc(slotcount * sizeof (CK_SLOT_ID));
5247c478bd9Sstevel@tonic-gate if (pSlotList == NULL_PTR) {
5257c478bd9Sstevel@tonic-gate int err = errno;
5267c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("malloc: %s"), strerror(err));
5277c478bd9Sstevel@tonic-gate goto cleanup;
5287c478bd9Sstevel@tonic-gate }
5297c478bd9Sstevel@tonic-gate
5307c478bd9Sstevel@tonic-gate /* Get the list of slots */
5317c478bd9Sstevel@tonic-gate if ((rv = C_GetSlotList(0, pSlotList, &slotcount)) != CKR_OK) {
5327c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
5337c478bd9Sstevel@tonic-gate "failed to find any cryptographic provider,"
5347c478bd9Sstevel@tonic-gate "please check with your system administrator: %s"),
5357c478bd9Sstevel@tonic-gate pkcs11_strerror(rv));
5367c478bd9Sstevel@tonic-gate goto cleanup;
5377c478bd9Sstevel@tonic-gate }
5387c478bd9Sstevel@tonic-gate
5397c478bd9Sstevel@tonic-gate if (lflag) {
5407c478bd9Sstevel@tonic-gate
5417c478bd9Sstevel@tonic-gate /* Iterate through slots */
5427c478bd9Sstevel@tonic-gate for (slot = 0; slot < slotcount; slot++) {
5437c478bd9Sstevel@tonic-gate
5447c478bd9Sstevel@tonic-gate /* Iterate through each mechanism */
5457c478bd9Sstevel@tonic-gate for (mek = 0; mek < MECH_ALIASES_COUNT; mek++) {
5467c478bd9Sstevel@tonic-gate rv = C_GetMechanismInfo(pSlotList[slot],
5477c478bd9Sstevel@tonic-gate mech_aliases[mek].type, &info);
5487c478bd9Sstevel@tonic-gate
5497c478bd9Sstevel@tonic-gate if (rv != CKR_OK)
5507c478bd9Sstevel@tonic-gate continue;
5517c478bd9Sstevel@tonic-gate
5527c478bd9Sstevel@tonic-gate /*
5537c478bd9Sstevel@tonic-gate * Set to minimum/maximum key sizes assuming
5547c478bd9Sstevel@tonic-gate * the values available are not 0.
5557c478bd9Sstevel@tonic-gate */
5567c478bd9Sstevel@tonic-gate if (info.ulMinKeySize && (info.ulMinKeySize <
5577c478bd9Sstevel@tonic-gate mech_aliases[mek].keysize_min))
5587c478bd9Sstevel@tonic-gate mech_aliases[mek].keysize_min =
5597c478bd9Sstevel@tonic-gate info.ulMinKeySize;
5607c478bd9Sstevel@tonic-gate
5617c478bd9Sstevel@tonic-gate if (info.ulMaxKeySize && (info.ulMaxKeySize >
5627c478bd9Sstevel@tonic-gate mech_aliases[mek].keysize_max))
5637c478bd9Sstevel@tonic-gate mech_aliases[mek].keysize_max =
5647c478bd9Sstevel@tonic-gate info.ulMaxKeySize;
5657c478bd9Sstevel@tonic-gate
5667c478bd9Sstevel@tonic-gate mech_aliases[mek].available = B_TRUE;
5677c478bd9Sstevel@tonic-gate }
5687c478bd9Sstevel@tonic-gate
5697c478bd9Sstevel@tonic-gate }
5707c478bd9Sstevel@tonic-gate
5717c478bd9Sstevel@tonic-gate algorithm_list();
5727c478bd9Sstevel@tonic-gate
5737c478bd9Sstevel@tonic-gate errflag = B_FALSE;
5747c478bd9Sstevel@tonic-gate goto cleanup;
5757c478bd9Sstevel@tonic-gate }
5767c478bd9Sstevel@tonic-gate
577c197cb9dShylee
578c197cb9dShylee /*
579c197cb9dShylee * Find a slot with matching mechanism
580c197cb9dShylee *
581c197cb9dShylee * If -K is specified, we find the slot id for the token first, then
582c197cb9dShylee * check if the slot supports the algorithm.
583c197cb9dShylee */
584c197cb9dShylee i = 0;
585c197cb9dShylee if (Kflag) {
58630a5e8faSwyllys kmfrv = kmf_pk11_token_lookup(NULL, token_label,
58730a5e8faSwyllys &token_slot_id);
588c197cb9dShylee if (kmfrv != KMF_OK) {
589c197cb9dShylee cryptoerror(LOG_STDERR,
590c197cb9dShylee gettext("no matching PKCS#11 token"));
591c197cb9dShylee errflag = B_TRUE;
592c197cb9dShylee goto cleanup;
593c197cb9dShylee }
594c197cb9dShylee rv = C_GetMechanismInfo(token_slot_id, mech_type, &info);
595c197cb9dShylee if (rv == CKR_OK && (info.flags & cmd->flags))
596c197cb9dShylee slotID = token_slot_id;
597c197cb9dShylee else
598c197cb9dShylee i = slotcount;
599c197cb9dShylee } else {
6007c478bd9Sstevel@tonic-gate for (i = 0; i < slotcount; i++) {
6017c478bd9Sstevel@tonic-gate slotID = pSlotList[i];
6027c478bd9Sstevel@tonic-gate rv = C_GetMechanismInfo(slotID, mech_type, &info);
6037c478bd9Sstevel@tonic-gate if (rv != CKR_OK) {
6047c478bd9Sstevel@tonic-gate continue; /* to the next slot */
6057c478bd9Sstevel@tonic-gate } else {
6067c478bd9Sstevel@tonic-gate /*
6077c478bd9Sstevel@tonic-gate * If the slot support the crypto, also
6087c478bd9Sstevel@tonic-gate * make sure it supports the correct
6097c478bd9Sstevel@tonic-gate * key generation mech if needed.
6107c478bd9Sstevel@tonic-gate *
6117c478bd9Sstevel@tonic-gate * We need PKCS5 when RC4 is used or
6127c478bd9Sstevel@tonic-gate * when the key is entered on cmd line.
6137c478bd9Sstevel@tonic-gate */
6147c478bd9Sstevel@tonic-gate if ((info.flags & cmd->flags) &&
615c197cb9dShylee (mech_type == CKM_RC4) ||
616c197cb9dShylee (keyfile == NULL)) {
6177c478bd9Sstevel@tonic-gate rv = C_GetMechanismInfo(slotID,
6187c478bd9Sstevel@tonic-gate CKM_PKCS5_PBKD2, &kg_info);
6197c478bd9Sstevel@tonic-gate if (rv == CKR_OK)
6207c478bd9Sstevel@tonic-gate break;
6217c478bd9Sstevel@tonic-gate } else if (info.flags & cmd->flags) {
6227c478bd9Sstevel@tonic-gate break;
6237c478bd9Sstevel@tonic-gate }
6247c478bd9Sstevel@tonic-gate }
6257c478bd9Sstevel@tonic-gate }
626c197cb9dShylee }
6277c478bd9Sstevel@tonic-gate
6287c478bd9Sstevel@tonic-gate /* Show error if no matching mechanism found */
6297c478bd9Sstevel@tonic-gate if (i == slotcount) {
6307c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR,
6317c478bd9Sstevel@tonic-gate gettext("no cryptographic provider was "
6327c478bd9Sstevel@tonic-gate "found for this algorithm -- %s"), algo_str);
6337c478bd9Sstevel@tonic-gate goto cleanup;
6347c478bd9Sstevel@tonic-gate }
6357c478bd9Sstevel@tonic-gate
6367c478bd9Sstevel@tonic-gate /* Open a session */
6377c478bd9Sstevel@tonic-gate rv = C_OpenSession(slotID, CKF_SERIAL_SESSION,
6387c478bd9Sstevel@tonic-gate NULL_PTR, NULL, &hSession);
6397c478bd9Sstevel@tonic-gate
6407c478bd9Sstevel@tonic-gate if (rv != CKR_OK) {
6417c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR,
6427c478bd9Sstevel@tonic-gate gettext("can not open PKCS #11 session: %s"),
6437c478bd9Sstevel@tonic-gate pkcs11_strerror(rv));
6447c478bd9Sstevel@tonic-gate goto cleanup;
6457c478bd9Sstevel@tonic-gate }
6467c478bd9Sstevel@tonic-gate
6477c478bd9Sstevel@tonic-gate /*
6487c478bd9Sstevel@tonic-gate * Generate IV data for encrypt.
6497c478bd9Sstevel@tonic-gate */
6507c478bd9Sstevel@tonic-gate ivlen = mech_aliases[mech_match].ivlen;
6517c478bd9Sstevel@tonic-gate if ((pivbuf = malloc((size_t)ivlen)) == NULL) {
6527c478bd9Sstevel@tonic-gate int err = errno;
6537c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("malloc: %s"),
6547c478bd9Sstevel@tonic-gate strerror(err));
6557c478bd9Sstevel@tonic-gate goto cleanup;
6567c478bd9Sstevel@tonic-gate }
6577c478bd9Sstevel@tonic-gate
6587c478bd9Sstevel@tonic-gate if (cmd->type == CKA_ENCRYPT) {
6597b79d846SDina K Nimeh if ((pkcs11_get_urandom((void *)pivbuf,
6607c478bd9Sstevel@tonic-gate mech_aliases[mech_match].ivlen)) != 0) {
6617c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
6627c478bd9Sstevel@tonic-gate "Unable to generate random "
6637c478bd9Sstevel@tonic-gate "data for initialization vector."));
6647c478bd9Sstevel@tonic-gate goto cleanup;
6657c478bd9Sstevel@tonic-gate }
6667c478bd9Sstevel@tonic-gate }
6677c478bd9Sstevel@tonic-gate
6687c478bd9Sstevel@tonic-gate /*
6697c478bd9Sstevel@tonic-gate * Create the key object
6707c478bd9Sstevel@tonic-gate */
6717c478bd9Sstevel@tonic-gate rv = pkcs11_mech2keytype(mech_type, &keytype);
6727c478bd9Sstevel@tonic-gate if (rv != CKR_OK) {
6737c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR,
6747c478bd9Sstevel@tonic-gate gettext("unable to find key type for algorithm."));
6757c478bd9Sstevel@tonic-gate goto cleanup;
6767c478bd9Sstevel@tonic-gate }
6777c478bd9Sstevel@tonic-gate
6787c478bd9Sstevel@tonic-gate /* Open input file */
6797c478bd9Sstevel@tonic-gate if (iflag) {
6807c478bd9Sstevel@tonic-gate if ((infd = open(inputfile, O_RDONLY | O_NONBLOCK)) == -1) {
6817c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
6827c478bd9Sstevel@tonic-gate "can not open input file %s"), inputfile);
6837c478bd9Sstevel@tonic-gate goto cleanup;
6847c478bd9Sstevel@tonic-gate }
6857c478bd9Sstevel@tonic-gate
6867c478bd9Sstevel@tonic-gate /* Get info on input file */
6877c478bd9Sstevel@tonic-gate if (fstat(infd, &insbuf) == -1) {
6887c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
6897c478bd9Sstevel@tonic-gate "can not stat input file %s"), inputfile);
6907c478bd9Sstevel@tonic-gate goto cleanup;
6917c478bd9Sstevel@tonic-gate }
6927c478bd9Sstevel@tonic-gate }
6937c478bd9Sstevel@tonic-gate
6947c478bd9Sstevel@tonic-gate /*
6957c478bd9Sstevel@tonic-gate * Prepare output file
6967c478bd9Sstevel@tonic-gate * If the input & output file are same,
6977c478bd9Sstevel@tonic-gate * the output is written to a temp
6987c478bd9Sstevel@tonic-gate * file first, then renamed to the original file
6997c478bd9Sstevel@tonic-gate * after the crypt operation
7007c478bd9Sstevel@tonic-gate */
7017c478bd9Sstevel@tonic-gate inoutsame = B_FALSE;
7027c478bd9Sstevel@tonic-gate if (oflag) {
7037c478bd9Sstevel@tonic-gate outfilename = outputfile;
7047c478bd9Sstevel@tonic-gate if ((stat(outputfile, &outsbuf) != -1) &&
7057c478bd9Sstevel@tonic-gate (insbuf.st_ino == outsbuf.st_ino)) {
7067c478bd9Sstevel@tonic-gate char *dir;
7077c478bd9Sstevel@tonic-gate
7087c478bd9Sstevel@tonic-gate /* create temp file on same dir */
7097c478bd9Sstevel@tonic-gate dir = dirname(outputfile);
7107c478bd9Sstevel@tonic-gate (void) snprintf(tmpnam, sizeof (tmpnam),
7117c478bd9Sstevel@tonic-gate "%s/encrXXXXXX", dir);
7127c478bd9Sstevel@tonic-gate outfilename = tmpnam;
7137c478bd9Sstevel@tonic-gate if ((outfd = mkstemp(tmpnam)) == -1) {
7147c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
7157c478bd9Sstevel@tonic-gate "cannot create temp file"));
7167c478bd9Sstevel@tonic-gate goto cleanup;
7177c478bd9Sstevel@tonic-gate }
7187c478bd9Sstevel@tonic-gate inoutsame = B_TRUE;
7197c478bd9Sstevel@tonic-gate } else {
7207c478bd9Sstevel@tonic-gate /* Create file for output */
7217c478bd9Sstevel@tonic-gate if ((outfd = open(outfilename,
72230a5e8faSwyllys O_CREAT|O_WRONLY|O_TRUNC, 0644)) == -1) {
7237c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
7247c478bd9Sstevel@tonic-gate "cannot open output file %s"),
7257c478bd9Sstevel@tonic-gate outfilename);
7269a2817adSValerie Bubb Fenwick /* Cannot open file, should leave it alone */
7279a2817adSValerie Bubb Fenwick leavefilealone = B_TRUE;
7287c478bd9Sstevel@tonic-gate goto cleanup;
7297c478bd9Sstevel@tonic-gate }
7307c478bd9Sstevel@tonic-gate }
7317c478bd9Sstevel@tonic-gate }
7327c478bd9Sstevel@tonic-gate
7337c478bd9Sstevel@tonic-gate /*
7347c478bd9Sstevel@tonic-gate * Read the version number from the head of the file
7357c478bd9Sstevel@tonic-gate * to know how to interpret the data that follows.
7367c478bd9Sstevel@tonic-gate */
7377c478bd9Sstevel@tonic-gate if (cmd->type == CKA_DECRYPT) {
7387c478bd9Sstevel@tonic-gate if (read(infd, &version, sizeof (version)) !=
7397c478bd9Sstevel@tonic-gate sizeof (version)) {
7407c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
7417c478bd9Sstevel@tonic-gate "failed to get format version from "
7427c478bd9Sstevel@tonic-gate "input file."));
7437c478bd9Sstevel@tonic-gate goto cleanup;
7447c478bd9Sstevel@tonic-gate }
7457c478bd9Sstevel@tonic-gate /* convert to host byte order */
7467c478bd9Sstevel@tonic-gate version = ntohl(version);
7477c478bd9Sstevel@tonic-gate
7487c478bd9Sstevel@tonic-gate switch (version) {
7497c478bd9Sstevel@tonic-gate case 1:
7507c478bd9Sstevel@tonic-gate /*
7517c478bd9Sstevel@tonic-gate * Version 1 output format:
752b54157c1Sda73024 * - Output format version 1 (4 bytes)
7537c478bd9Sstevel@tonic-gate * - Iterations used in key gen function (4 bytes)
754b54157c1Sda73024 * - IV ('ivlen' bytes). The length algorithm-dependent
7557c478bd9Sstevel@tonic-gate * - Salt data used in key gen (16 bytes)
756b54157c1Sda73024 * - Cipher text data (remainder of the file)
7577c478bd9Sstevel@tonic-gate *
7587c478bd9Sstevel@tonic-gate * An encrypted file has IV as first block (0 or
7597c478bd9Sstevel@tonic-gate * more bytes depending on mechanism) followed
7607c478bd9Sstevel@tonic-gate * by cipher text. Get the IV from the encrypted
7617c478bd9Sstevel@tonic-gate * file.
7627c478bd9Sstevel@tonic-gate */
7637c478bd9Sstevel@tonic-gate /*
7647c478bd9Sstevel@tonic-gate * Read iteration count and salt data.
7657c478bd9Sstevel@tonic-gate */
7667c478bd9Sstevel@tonic-gate if (read(infd, &iterations,
76730a5e8faSwyllys sizeof (iterations)) != sizeof (iterations)) {
7687c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
7697c478bd9Sstevel@tonic-gate "failed to get iterations from "
7707c478bd9Sstevel@tonic-gate "input file."));
7717c478bd9Sstevel@tonic-gate goto cleanup;
7727c478bd9Sstevel@tonic-gate }
7737c478bd9Sstevel@tonic-gate /* convert to host byte order */
7747c478bd9Sstevel@tonic-gate iterations = ntohl(iterations);
7757c478bd9Sstevel@tonic-gate if (ivlen > 0 &&
7767c478bd9Sstevel@tonic-gate read(infd, pivbuf, ivlen) != ivlen) {
7777c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
7787c478bd9Sstevel@tonic-gate "failed to get initialization "
7797c478bd9Sstevel@tonic-gate "vector from input file."));
7807c478bd9Sstevel@tonic-gate goto cleanup;
7817c478bd9Sstevel@tonic-gate }
7827c478bd9Sstevel@tonic-gate if (read(infd, salt, sizeof (salt))
7837c478bd9Sstevel@tonic-gate != sizeof (salt)) {
7847c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
7857c478bd9Sstevel@tonic-gate "failed to get salt data from "
7867c478bd9Sstevel@tonic-gate "input file."));
7877c478bd9Sstevel@tonic-gate goto cleanup;
7887c478bd9Sstevel@tonic-gate }
7897c478bd9Sstevel@tonic-gate break;
7907c478bd9Sstevel@tonic-gate default:
7917c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
7927c478bd9Sstevel@tonic-gate "Unrecognized format version read from "
7937c478bd9Sstevel@tonic-gate "input file - expected %d, got %d."),
7947c478bd9Sstevel@tonic-gate SUNW_ENCRYPT_FILE_VERSION, version);
7957c478bd9Sstevel@tonic-gate goto cleanup;
7967c478bd9Sstevel@tonic-gate }
7977c478bd9Sstevel@tonic-gate }
798c197cb9dShylee
7997c478bd9Sstevel@tonic-gate /*
800c197cb9dShylee * If Kflag is set, let's find the token key now.
801c197cb9dShylee *
802c197cb9dShylee * If Kflag is not set and if encrypting, we need some random
8037c478bd9Sstevel@tonic-gate * salt data to create the key. If decrypting,
8047c478bd9Sstevel@tonic-gate * the salt should come from head of the file
8057c478bd9Sstevel@tonic-gate * to be decrypted.
8067c478bd9Sstevel@tonic-gate */
807c197cb9dShylee if (Kflag) {
808c197cb9dShylee rv = get_token_key(hSession, keytype, key_label, pkeydata,
809c197cb9dShylee keysize, &key);
810c197cb9dShylee if (rv != CKR_OK) {
811c197cb9dShylee cryptoerror(LOG_STDERR, gettext(
812c197cb9dShylee "Can not find the token key"));
813c197cb9dShylee goto cleanup;
814c197cb9dShylee } else {
815c197cb9dShylee goto do_crypto;
816c197cb9dShylee }
817c197cb9dShylee } else if (cmd->type == CKA_ENCRYPT) {
8187b79d846SDina K Nimeh rv = pkcs11_get_urandom((void *)salt, sizeof (salt));
8197c478bd9Sstevel@tonic-gate if (rv != 0) {
8207c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR,
8217c478bd9Sstevel@tonic-gate gettext("unable to generate random "
8227c478bd9Sstevel@tonic-gate "data for key salt."));
8237c478bd9Sstevel@tonic-gate goto cleanup;
8247c478bd9Sstevel@tonic-gate }
8257c478bd9Sstevel@tonic-gate }
8267c478bd9Sstevel@tonic-gate
827c197cb9dShylee
8287c478bd9Sstevel@tonic-gate /*
8297c478bd9Sstevel@tonic-gate * If key input is read from a file, treat it as
8307c478bd9Sstevel@tonic-gate * raw key data, unless it is to be used with RC4,
8317c478bd9Sstevel@tonic-gate * in which case it must be used to generate a pkcs5
8327c478bd9Sstevel@tonic-gate * key to address security concerns with RC4 keys.
8337c478bd9Sstevel@tonic-gate */
8347c478bd9Sstevel@tonic-gate if (kflag && keyfile != NULL && keytype != CKK_RC4) {
8351c9bd843Sdinak /* XXX : why wasn't SUNW_C_KeyToObject used here? */
8367c478bd9Sstevel@tonic-gate CK_OBJECT_CLASS objclass = CKO_SECRET_KEY;
8377c478bd9Sstevel@tonic-gate CK_ATTRIBUTE template[5];
8387c478bd9Sstevel@tonic-gate int nattr = 0;
8397c478bd9Sstevel@tonic-gate
8407c478bd9Sstevel@tonic-gate template[nattr].type = CKA_CLASS;
8417c478bd9Sstevel@tonic-gate template[nattr].pValue = &objclass;
8427c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (objclass);
8437c478bd9Sstevel@tonic-gate nattr++;
8447c478bd9Sstevel@tonic-gate
8457c478bd9Sstevel@tonic-gate template[nattr].type = CKA_KEY_TYPE;
8467c478bd9Sstevel@tonic-gate template[nattr].pValue = &keytype;
8477c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (keytype);
8487c478bd9Sstevel@tonic-gate nattr++;
8497c478bd9Sstevel@tonic-gate
8507c478bd9Sstevel@tonic-gate template[nattr].type = cmd->type;
8517c478bd9Sstevel@tonic-gate template[nattr].pValue = &truevalue;
8527c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (truevalue);
8537c478bd9Sstevel@tonic-gate nattr++;
8547c478bd9Sstevel@tonic-gate
8557c478bd9Sstevel@tonic-gate template[nattr].type = CKA_TOKEN;
8567c478bd9Sstevel@tonic-gate template[nattr].pValue = &falsevalue;
8577c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (falsevalue);
8587c478bd9Sstevel@tonic-gate nattr++;
8597c478bd9Sstevel@tonic-gate
8607c478bd9Sstevel@tonic-gate template[nattr].type = CKA_VALUE;
8617c478bd9Sstevel@tonic-gate template[nattr].pValue = pkeydata;
8627c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = keysize;
8637c478bd9Sstevel@tonic-gate nattr++;
8647c478bd9Sstevel@tonic-gate
86530a5e8faSwyllys rv = C_CreateObject(hSession, template, nattr, &key);
8667c478bd9Sstevel@tonic-gate } else {
8677c478bd9Sstevel@tonic-gate /*
8687c478bd9Sstevel@tonic-gate * If the encryption type has a fixed key length,
8697c478bd9Sstevel@tonic-gate * then its not necessary to set the key length
8707c478bd9Sstevel@tonic-gate * parameter when generating the key.
8717c478bd9Sstevel@tonic-gate */
8727c478bd9Sstevel@tonic-gate if (keytype == CKK_DES || keytype == CKK_DES3)
8737c478bd9Sstevel@tonic-gate keylen = 0;
8747c478bd9Sstevel@tonic-gate else
8757c478bd9Sstevel@tonic-gate keylen = 16;
8767c478bd9Sstevel@tonic-gate
8777c478bd9Sstevel@tonic-gate /*
8787c478bd9Sstevel@tonic-gate * Generate a cryptographically secure key using
8797c478bd9Sstevel@tonic-gate * the key read from the file given (-k keyfile) or
8807c478bd9Sstevel@tonic-gate * the passphrase entered by the user.
8817c478bd9Sstevel@tonic-gate */
8821c9bd843Sdinak rv = pkcs11_PasswdToPBKD2Object(hSession, (char *)pkeydata,
8831c9bd843Sdinak (size_t)keysize, (void *)salt, sizeof (salt), iterations,
8841c9bd843Sdinak keytype, keylen, cmd->flags, &key);
8857c478bd9Sstevel@tonic-gate }
8867c478bd9Sstevel@tonic-gate
8877c478bd9Sstevel@tonic-gate if (rv != CKR_OK) {
8887c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
8897c478bd9Sstevel@tonic-gate "failed to generate a key: %s"),
8907c478bd9Sstevel@tonic-gate pkcs11_strerror(rv));
8917c478bd9Sstevel@tonic-gate goto cleanup;
8927c478bd9Sstevel@tonic-gate }
8937c478bd9Sstevel@tonic-gate
894c197cb9dShylee
895c197cb9dShylee do_crypto:
8967c478bd9Sstevel@tonic-gate /* Setup up mechanism */
8977c478bd9Sstevel@tonic-gate mech.mechanism = mech_type;
8987c478bd9Sstevel@tonic-gate mech.pParameter = (CK_VOID_PTR)pivbuf;
8997c478bd9Sstevel@tonic-gate mech.ulParameterLen = ivlen;
9007c478bd9Sstevel@tonic-gate
9017c478bd9Sstevel@tonic-gate if ((rv = cmd->Init(hSession, &mech, key)) != CKR_OK) {
9027c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
9037c478bd9Sstevel@tonic-gate "failed to initialize crypto operation: %s"),
9047c478bd9Sstevel@tonic-gate pkcs11_strerror(rv));
9057c478bd9Sstevel@tonic-gate goto cleanup;
9067c478bd9Sstevel@tonic-gate }
9077c478bd9Sstevel@tonic-gate
9087c478bd9Sstevel@tonic-gate /* Write the version header encrypt command */
9097c478bd9Sstevel@tonic-gate if (cmd->type == CKA_ENCRYPT) {
9107c478bd9Sstevel@tonic-gate /* convert to network order for storage */
911b54157c1Sda73024 uint32_t netversion = htonl(version);
912b54157c1Sda73024 uint32_t netiter;
9137c478bd9Sstevel@tonic-gate
9147c478bd9Sstevel@tonic-gate if (write(outfd, &netversion, sizeof (netversion))
9157c478bd9Sstevel@tonic-gate != sizeof (netversion)) {
9167c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
9177c478bd9Sstevel@tonic-gate "failed to write version number "
9187c478bd9Sstevel@tonic-gate "to output file."));
9197c478bd9Sstevel@tonic-gate goto cleanup;
9207c478bd9Sstevel@tonic-gate }
9217c478bd9Sstevel@tonic-gate /*
9227c478bd9Sstevel@tonic-gate * Write the iteration and salt data, even if they
9237c478bd9Sstevel@tonic-gate * were not used to generate a key.
9247c478bd9Sstevel@tonic-gate */
9257c478bd9Sstevel@tonic-gate netiter = htonl(iterations);
9267c478bd9Sstevel@tonic-gate if (write(outfd, &netiter,
9277c478bd9Sstevel@tonic-gate sizeof (netiter)) != sizeof (netiter)) {
9287c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
9297c478bd9Sstevel@tonic-gate "failed to write iterations to output"));
9307c478bd9Sstevel@tonic-gate goto cleanup;
9317c478bd9Sstevel@tonic-gate }
93230a5e8faSwyllys if (ivlen > 0 && write(outfd, pivbuf, ivlen) != ivlen) {
9337c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
9347c478bd9Sstevel@tonic-gate "failed to write initialization vector "
9357c478bd9Sstevel@tonic-gate "to output"));
9367c478bd9Sstevel@tonic-gate goto cleanup;
9377c478bd9Sstevel@tonic-gate }
9387c478bd9Sstevel@tonic-gate if (write(outfd, salt, sizeof (salt)) != sizeof (salt)) {
9397c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
9407c478bd9Sstevel@tonic-gate "failed to write salt data to output"));
9417c478bd9Sstevel@tonic-gate goto cleanup;
9427c478bd9Sstevel@tonic-gate }
9437c478bd9Sstevel@tonic-gate }
9447c478bd9Sstevel@tonic-gate
94554da5c1fSjk115741 if (crypt_multipart(cmd, hSession, infd, outfd, insbuf.st_size) == -1) {
9467c478bd9Sstevel@tonic-gate goto cleanup;
9477c478bd9Sstevel@tonic-gate }
9487c478bd9Sstevel@tonic-gate
9497c478bd9Sstevel@tonic-gate errflag = B_FALSE;
9507c478bd9Sstevel@tonic-gate
9517c478bd9Sstevel@tonic-gate /*
9527c478bd9Sstevel@tonic-gate * Clean up
9537c478bd9Sstevel@tonic-gate */
9547c478bd9Sstevel@tonic-gate cleanup:
9557c478bd9Sstevel@tonic-gate /* Clear the key data, so others cannot snoop */
9567c478bd9Sstevel@tonic-gate if (pkeydata != NULL) {
9577c478bd9Sstevel@tonic-gate bzero(pkeydata, keysize);
9587c478bd9Sstevel@tonic-gate free(pkeydata);
9597c478bd9Sstevel@tonic-gate pkeydata = NULL;
9607c478bd9Sstevel@tonic-gate }
9617c478bd9Sstevel@tonic-gate
9627c478bd9Sstevel@tonic-gate /* Destroy key object */
963c197cb9dShylee if (Kflag != B_FALSE && key != (CK_OBJECT_HANDLE) 0) {
9647c478bd9Sstevel@tonic-gate (void) C_DestroyObject(hSession, key);
9657c478bd9Sstevel@tonic-gate }
9667c478bd9Sstevel@tonic-gate
9677c478bd9Sstevel@tonic-gate /* free allocated memory */
9687c478bd9Sstevel@tonic-gate if (pSlotList != NULL)
9697c478bd9Sstevel@tonic-gate free(pSlotList);
9707c478bd9Sstevel@tonic-gate if (pivbuf != NULL)
9717c478bd9Sstevel@tonic-gate free(pivbuf);
9727c478bd9Sstevel@tonic-gate
9737c478bd9Sstevel@tonic-gate /* close all the files */
97454da5c1fSjk115741 if (iflag && (infd != -1))
9757c478bd9Sstevel@tonic-gate (void) close(infd);
97654da5c1fSjk115741 if (oflag && (outfd != -1))
9777c478bd9Sstevel@tonic-gate (void) close(outfd);
9787c478bd9Sstevel@tonic-gate
9797c478bd9Sstevel@tonic-gate /* rename tmp output to input file */
9807c478bd9Sstevel@tonic-gate if (inoutsame) {
9817c478bd9Sstevel@tonic-gate if (rename(outfilename, inputfile) == -1) {
9827c478bd9Sstevel@tonic-gate (void) unlink(outfilename);
9837c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("rename failed."));
9847c478bd9Sstevel@tonic-gate }
9857c478bd9Sstevel@tonic-gate }
9867c478bd9Sstevel@tonic-gate
9879a2817adSValerie Bubb Fenwick /* If error occurred and the file was new, remove the output file */
9889a2817adSValerie Bubb Fenwick if (errflag && (outfilename != NULL) && !leavefilealone) {
9897c478bd9Sstevel@tonic-gate (void) unlink(outfilename);
9907c478bd9Sstevel@tonic-gate }
9917c478bd9Sstevel@tonic-gate
9927c478bd9Sstevel@tonic-gate /* close pkcs11 session */
9937c478bd9Sstevel@tonic-gate if (hSession != CK_INVALID_HANDLE)
9947c478bd9Sstevel@tonic-gate (void) C_CloseSession(hSession);
9957c478bd9Sstevel@tonic-gate
9967c478bd9Sstevel@tonic-gate (void) C_Finalize(NULL);
9977c478bd9Sstevel@tonic-gate
9987c478bd9Sstevel@tonic-gate return (errflag);
9997c478bd9Sstevel@tonic-gate }
10007c478bd9Sstevel@tonic-gate
10017c478bd9Sstevel@tonic-gate /*
10027c478bd9Sstevel@tonic-gate * Function for printing progress bar when the verbose flag
10037c478bd9Sstevel@tonic-gate * is set.
10047c478bd9Sstevel@tonic-gate *
10057c478bd9Sstevel@tonic-gate * The vertical bar is printed at 25, 50, and 75% complete.
10067c478bd9Sstevel@tonic-gate *
10077c478bd9Sstevel@tonic-gate * The function is passed the number of positions on the screen it needs to
10087c478bd9Sstevel@tonic-gate * advance and loops.
10097c478bd9Sstevel@tonic-gate */
10107c478bd9Sstevel@tonic-gate
10117c478bd9Sstevel@tonic-gate static void
print_status(int pos_to_advance)10127c478bd9Sstevel@tonic-gate print_status(int pos_to_advance)
10137c478bd9Sstevel@tonic-gate {
10147c478bd9Sstevel@tonic-gate
10157c478bd9Sstevel@tonic-gate while (pos_to_advance > 0) {
10167c478bd9Sstevel@tonic-gate switch (status_pos) {
10177c478bd9Sstevel@tonic-gate case 0:
10187c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("["));
10197c478bd9Sstevel@tonic-gate break;
10207c478bd9Sstevel@tonic-gate case 19:
10217c478bd9Sstevel@tonic-gate case 39:
10227c478bd9Sstevel@tonic-gate case 59:
10237c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("|"));
10247c478bd9Sstevel@tonic-gate break;
10257c478bd9Sstevel@tonic-gate default:
10267c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("."));
10277c478bd9Sstevel@tonic-gate }
10287c478bd9Sstevel@tonic-gate pos_to_advance--;
10297c478bd9Sstevel@tonic-gate status_pos++;
10307c478bd9Sstevel@tonic-gate }
10317c478bd9Sstevel@tonic-gate }
10327c478bd9Sstevel@tonic-gate
10337c478bd9Sstevel@tonic-gate /*
10347c478bd9Sstevel@tonic-gate * Encrypt/Decrypt in multi part.
10357c478bd9Sstevel@tonic-gate *
10367c478bd9Sstevel@tonic-gate * This function reads the input file (infd) and writes the
10377c478bd9Sstevel@tonic-gate * encrypted/decrypted output to file (outfd).
10387c478bd9Sstevel@tonic-gate *
10397c478bd9Sstevel@tonic-gate * cmd - pointing to commandinfo
10407c478bd9Sstevel@tonic-gate * hSession - pkcs session
10417c478bd9Sstevel@tonic-gate * infd - input file descriptor
10427c478bd9Sstevel@tonic-gate * outfd - output file descriptor
10437c478bd9Sstevel@tonic-gate *
10447c478bd9Sstevel@tonic-gate */
10457c478bd9Sstevel@tonic-gate
10467c478bd9Sstevel@tonic-gate static int
crypt_multipart(struct CommandInfo * cmd,CK_SESSION_HANDLE hSession,int infd,int outfd,off_t insize)10477c478bd9Sstevel@tonic-gate crypt_multipart(struct CommandInfo *cmd, CK_SESSION_HANDLE hSession,
104854da5c1fSjk115741 int infd, int outfd, off_t insize)
10497c478bd9Sstevel@tonic-gate {
10507c478bd9Sstevel@tonic-gate CK_RV rv;
10517c478bd9Sstevel@tonic-gate CK_ULONG resultlen;
10527c478bd9Sstevel@tonic-gate CK_ULONG resultbuflen;
10537c478bd9Sstevel@tonic-gate CK_BYTE_PTR resultbuf;
10547c478bd9Sstevel@tonic-gate CK_ULONG datalen;
10557c478bd9Sstevel@tonic-gate CK_BYTE databuf[BUFFERSIZE];
10567c478bd9Sstevel@tonic-gate CK_BYTE outbuf[BUFFERSIZE+BLOCKSIZE];
10577c478bd9Sstevel@tonic-gate CK_ULONG status_index = 0; /* current total file size read */
10587c478bd9Sstevel@tonic-gate float status_last = 0.0; /* file size of last element used */
10597c478bd9Sstevel@tonic-gate float status_incr = 0.0; /* file size element increments */
10607c478bd9Sstevel@tonic-gate int pos; /* # of progress bar elements to be print */
10617c478bd9Sstevel@tonic-gate ssize_t nread;
10627c478bd9Sstevel@tonic-gate boolean_t errflag = B_FALSE;
10637c478bd9Sstevel@tonic-gate
10647c478bd9Sstevel@tonic-gate datalen = sizeof (databuf);
10657c478bd9Sstevel@tonic-gate resultbuflen = sizeof (outbuf);
10667c478bd9Sstevel@tonic-gate resultbuf = outbuf;
10677c478bd9Sstevel@tonic-gate
10687c478bd9Sstevel@tonic-gate /* Divide into 79 increments for progress bar element spacing */
10697c478bd9Sstevel@tonic-gate if (vflag && iflag)
107054da5c1fSjk115741 status_incr = (insize / 79.0);
10717c478bd9Sstevel@tonic-gate
10727c478bd9Sstevel@tonic-gate while ((nread = read(infd, databuf, datalen)) > 0) {
10737c478bd9Sstevel@tonic-gate
10747c478bd9Sstevel@tonic-gate /* Start with the initial buffer */
10757c478bd9Sstevel@tonic-gate resultlen = resultbuflen;
10767c478bd9Sstevel@tonic-gate rv = cmd->Update(hSession, databuf, (CK_ULONG)nread,
10777c478bd9Sstevel@tonic-gate resultbuf, &resultlen);
10787c478bd9Sstevel@tonic-gate
10797c478bd9Sstevel@tonic-gate /* Need a bigger buffer? */
10807c478bd9Sstevel@tonic-gate if (rv == CKR_BUFFER_TOO_SMALL) {
10817c478bd9Sstevel@tonic-gate
10827c478bd9Sstevel@tonic-gate /* free the old buffer */
10837c478bd9Sstevel@tonic-gate if (resultbuf != NULL && resultbuf != outbuf) {
10847c478bd9Sstevel@tonic-gate bzero(resultbuf, resultbuflen);
10857c478bd9Sstevel@tonic-gate free(resultbuf);
10867c478bd9Sstevel@tonic-gate }
10877c478bd9Sstevel@tonic-gate
10887c478bd9Sstevel@tonic-gate /* allocate a new big buffer */
10897c478bd9Sstevel@tonic-gate if ((resultbuf = malloc((size_t)resultlen)) == NULL) {
10907c478bd9Sstevel@tonic-gate int err = errno;
10917c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("malloc: %s"),
10927c478bd9Sstevel@tonic-gate strerror(err));
10937c478bd9Sstevel@tonic-gate return (-1);
10947c478bd9Sstevel@tonic-gate }
10957c478bd9Sstevel@tonic-gate resultbuflen = resultlen;
10967c478bd9Sstevel@tonic-gate
10977c478bd9Sstevel@tonic-gate /* Try again with bigger buffer */
10987c478bd9Sstevel@tonic-gate rv = cmd->Update(hSession, databuf, (CK_ULONG)nread,
10997c478bd9Sstevel@tonic-gate resultbuf, &resultlen);
11007c478bd9Sstevel@tonic-gate }
11017c478bd9Sstevel@tonic-gate
11027c478bd9Sstevel@tonic-gate if (rv != CKR_OK) {
11037c478bd9Sstevel@tonic-gate errflag = B_TRUE;
11047c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
11057c478bd9Sstevel@tonic-gate "crypto operation failed: %s"),
11067c478bd9Sstevel@tonic-gate pkcs11_strerror(rv));
11077c478bd9Sstevel@tonic-gate break;
11087c478bd9Sstevel@tonic-gate }
11097c478bd9Sstevel@tonic-gate
11107c478bd9Sstevel@tonic-gate /* write the output */
11117c478bd9Sstevel@tonic-gate if (write(outfd, resultbuf, resultlen) != resultlen) {
11127c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
11137c478bd9Sstevel@tonic-gate "failed to write result to output file."));
11147c478bd9Sstevel@tonic-gate errflag = B_TRUE;
11157c478bd9Sstevel@tonic-gate break;
11167c478bd9Sstevel@tonic-gate }
11177c478bd9Sstevel@tonic-gate
11187c478bd9Sstevel@tonic-gate if (vflag) {
11197c478bd9Sstevel@tonic-gate status_index += resultlen;
11207c478bd9Sstevel@tonic-gate
11217c478bd9Sstevel@tonic-gate /*
11227c478bd9Sstevel@tonic-gate * If input is from stdin, do a our own progress bar
11237c478bd9Sstevel@tonic-gate * by printing periods at a pre-defined increment
11247c478bd9Sstevel@tonic-gate * until the file is done.
11257c478bd9Sstevel@tonic-gate */
11267c478bd9Sstevel@tonic-gate if (!iflag) {
11277c478bd9Sstevel@tonic-gate
11287c478bd9Sstevel@tonic-gate /*
11297c478bd9Sstevel@tonic-gate * Print at least 1 element in case the file
11307c478bd9Sstevel@tonic-gate * is small, it looks better than nothing.
11317c478bd9Sstevel@tonic-gate */
11327c478bd9Sstevel@tonic-gate if (status_pos == 0) {
11337c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("."));
11347c478bd9Sstevel@tonic-gate status_pos = 1;
11357c478bd9Sstevel@tonic-gate }
11367c478bd9Sstevel@tonic-gate
1137f2728256SKrishna Yenduri while ((status_index - status_last) >
11387c478bd9Sstevel@tonic-gate (PROGRESSSIZE)) {
11397c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("."));
1140f2728256SKrishna Yenduri status_last += PROGRESSSIZE;
11417c478bd9Sstevel@tonic-gate }
11427c478bd9Sstevel@tonic-gate continue;
11437c478bd9Sstevel@tonic-gate }
11447c478bd9Sstevel@tonic-gate
11457c478bd9Sstevel@tonic-gate /* Calculate the number of elements need to be print */
114654da5c1fSjk115741 if (insize <= BUFFERSIZE)
11477c478bd9Sstevel@tonic-gate pos = 78;
11487c478bd9Sstevel@tonic-gate else
11497c478bd9Sstevel@tonic-gate pos = (int)((status_index - status_last) /
11507c478bd9Sstevel@tonic-gate status_incr);
11517c478bd9Sstevel@tonic-gate
11527c478bd9Sstevel@tonic-gate /* Add progress bar elements, if needed */
11537c478bd9Sstevel@tonic-gate if (pos > 0) {
11547c478bd9Sstevel@tonic-gate print_status(pos);
11557c478bd9Sstevel@tonic-gate status_last += (status_incr * pos);
11567c478bd9Sstevel@tonic-gate }
11577c478bd9Sstevel@tonic-gate }
11587c478bd9Sstevel@tonic-gate }
11597c478bd9Sstevel@tonic-gate
11607c478bd9Sstevel@tonic-gate /* Print verbose completion */
11617c478bd9Sstevel@tonic-gate if (vflag) {
11627c478bd9Sstevel@tonic-gate if (iflag)
11637c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "]");
11647c478bd9Sstevel@tonic-gate
11657c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "\n%s\n", gettext("Done."));
11667c478bd9Sstevel@tonic-gate }
11677c478bd9Sstevel@tonic-gate
11687c478bd9Sstevel@tonic-gate /* Error in reading */
11697c478bd9Sstevel@tonic-gate if (nread == -1) {
11707c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
11717c478bd9Sstevel@tonic-gate "error reading from input file"));
11727c478bd9Sstevel@tonic-gate errflag = B_TRUE;
11737c478bd9Sstevel@tonic-gate }
11747c478bd9Sstevel@tonic-gate
11757c478bd9Sstevel@tonic-gate if (!errflag) {
11767c478bd9Sstevel@tonic-gate
11777c478bd9Sstevel@tonic-gate /* Do the final part */
11787c478bd9Sstevel@tonic-gate
11797c478bd9Sstevel@tonic-gate rv = cmd->Final(hSession, resultbuf, &resultlen);
11807c478bd9Sstevel@tonic-gate
11817c478bd9Sstevel@tonic-gate if (rv == CKR_OK) {
11827c478bd9Sstevel@tonic-gate /* write the output */
11837c478bd9Sstevel@tonic-gate if (write(outfd, resultbuf, resultlen) != resultlen) {
11847c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
11857c478bd9Sstevel@tonic-gate "failed to write result to output file."));
11867c478bd9Sstevel@tonic-gate errflag = B_TRUE;
11877c478bd9Sstevel@tonic-gate }
11887c478bd9Sstevel@tonic-gate } else {
11897c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext(
11907c478bd9Sstevel@tonic-gate "crypto operation failed: %s"),
11917c478bd9Sstevel@tonic-gate pkcs11_strerror(rv));
11927c478bd9Sstevel@tonic-gate errflag = B_TRUE;
11937c478bd9Sstevel@tonic-gate }
11947c478bd9Sstevel@tonic-gate
11957c478bd9Sstevel@tonic-gate }
11967c478bd9Sstevel@tonic-gate
11977c478bd9Sstevel@tonic-gate if (resultbuf != NULL && resultbuf != outbuf) {
11987c478bd9Sstevel@tonic-gate bzero(resultbuf, resultbuflen);
11997c478bd9Sstevel@tonic-gate free(resultbuf);
12007c478bd9Sstevel@tonic-gate }
12017c478bd9Sstevel@tonic-gate
12027c478bd9Sstevel@tonic-gate if (errflag) {
12037c478bd9Sstevel@tonic-gate return (-1);
12047c478bd9Sstevel@tonic-gate } else {
12057c478bd9Sstevel@tonic-gate return (0);
12067c478bd9Sstevel@tonic-gate }
12077c478bd9Sstevel@tonic-gate }
1208