17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5c197cb9dShylee * Common Development and Distribution License (the "License"). 6c197cb9dShylee * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 2154da5c1fSjk115741 /* Portions Copyright 2005 Richard Lowe */ 227c478bd9Sstevel@tonic-gate /* 237b79d846SDina K Nimeh * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 247c478bd9Sstevel@tonic-gate * Use is subject to license terms. 25*33f5ff17SMilan Jurik * Copyright 2012 Milan Jurik. All rights reserved. 267c478bd9Sstevel@tonic-gate */ 277c478bd9Sstevel@tonic-gate 287c478bd9Sstevel@tonic-gate /* 297c478bd9Sstevel@tonic-gate * decrypt.c 307c478bd9Sstevel@tonic-gate * 317c478bd9Sstevel@tonic-gate * Implements encrypt(1) and decrypt(1) commands 327c478bd9Sstevel@tonic-gate * 337c478bd9Sstevel@tonic-gate * One binary performs both encrypt/decrypt operation. 347c478bd9Sstevel@tonic-gate * 35b54157c1Sda73024 * Usage: 36b54157c1Sda73024 * -a algorithm mechanism name without CKM_ prefix. Case 377c478bd9Sstevel@tonic-gate * does not matter 38b54157c1Sda73024 * -k keyfile file containing key data. If not specified user is 397c478bd9Sstevel@tonic-gate * prompted to enter key. key length > 0 is required 40b54157c1Sda73024 * -i infile input file to encrypt/decrypt. If omitted, stdin used. 41b54157c1Sda73024 * -o outfile output file to encrypt/decrypt. If omitted, stdout used. 427c478bd9Sstevel@tonic-gate * if infile & outfile are same, a temp file is used for 437c478bd9Sstevel@tonic-gate * output and infile is replaced with this file after 44b54157c1Sda73024 * operation is complete 45b54157c1Sda73024 * -l Display the list of algorithms 46b54157c1Sda73024 * -v Display verbose information 47b54157c1Sda73024 * -T tokenspec Specify a PKCS#11 token (optionally used with -K) 48b54157c1Sda73024 * -K keylabel Specify the symmetric PKCS#11 token key label 497c478bd9Sstevel@tonic-gate * 507c478bd9Sstevel@tonic-gate * Implementation notes: 51b54157c1Sda73024 * IV data - It is generated by random bytes equal to one block size. 527c478bd9Sstevel@tonic-gate * 53b54157c1Sda73024 * Encrypted output format - 54b54157c1Sda73024 * - Output format version number (1) - 4 bytes in network byte order. 557c478bd9Sstevel@tonic-gate * - Iterations used in key gen function, 4 bytes in network byte order. 56b54157c1Sda73024 * - IV ('ivlen' bytes). Length is algorithm-dependent (see mech_aliases) 577c478bd9Sstevel@tonic-gate * - Salt data used in key gen (16 bytes) 58b54157c1Sda73024 * - Cipher text data (remainder of the file) 597c478bd9Sstevel@tonic-gate */ 607c478bd9Sstevel@tonic-gate 617c478bd9Sstevel@tonic-gate #include <stdio.h> 627c478bd9Sstevel@tonic-gate #include <stdlib.h> 637c478bd9Sstevel@tonic-gate #include <unistd.h> 647c478bd9Sstevel@tonic-gate #include <errno.h> 657c478bd9Sstevel@tonic-gate #include <fcntl.h> 667c478bd9Sstevel@tonic-gate #include <ctype.h> 677c478bd9Sstevel@tonic-gate #include <strings.h> 687c478bd9Sstevel@tonic-gate #include <libintl.h> 697c478bd9Sstevel@tonic-gate #include <libgen.h> 707c478bd9Sstevel@tonic-gate #include <locale.h> 717c478bd9Sstevel@tonic-gate #include <limits.h> 727c478bd9Sstevel@tonic-gate #include <sys/types.h> 737c478bd9Sstevel@tonic-gate #include <sys/stat.h> 747c478bd9Sstevel@tonic-gate #include <netinet/in.h> 757c478bd9Sstevel@tonic-gate #include <security/cryptoki.h> 767c478bd9Sstevel@tonic-gate #include <cryptoutil.h> 77c197cb9dShylee #include <kmfapi.h> 787c478bd9Sstevel@tonic-gate 79f2728256SKrishna Yenduri /* 80f2728256SKrishna Yenduri * Buffer size for reading file. This is given a rather high value 81f2728256SKrishna Yenduri * to get better performance when a hardware provider is present. 82f2728256SKrishna Yenduri */ 83f2728256SKrishna Yenduri #define BUFFERSIZE (1024 * 64) 847c478bd9Sstevel@tonic-gate #define BLOCKSIZE (128) /* Largest guess for block size */ 85f2728256SKrishna Yenduri #define PROGRESSSIZE (1024 * 40) /* stdin progress indicator size */ 867c478bd9Sstevel@tonic-gate 877c478bd9Sstevel@tonic-gate #define SUNW_ENCRYPT_FILE_VERSION 1 887c478bd9Sstevel@tonic-gate 897c478bd9Sstevel@tonic-gate /* 907c478bd9Sstevel@tonic-gate * Exit Status codes 917c478bd9Sstevel@tonic-gate */ 927c478bd9Sstevel@tonic-gate #ifndef EXIT_SUCCESS 937c478bd9Sstevel@tonic-gate #define EXIT_SUCCESS 0 /* No errors */ 947c478bd9Sstevel@tonic-gate #define EXIT_FAILURE 1 /* All errors except usage */ 957c478bd9Sstevel@tonic-gate #endif /* EXIT_SUCCESS */ 967c478bd9Sstevel@tonic-gate 977c478bd9Sstevel@tonic-gate #define EXIT_USAGE 2 /* usage/syntax error */ 987c478bd9Sstevel@tonic-gate 997c478bd9Sstevel@tonic-gate #define ENCRYPT_NAME "encrypt" /* name of encrypt command */ 100c197cb9dShylee #define ENCRYPT_OPTIONS "a:T:K:k:i:o:lv" /* options for encrypt */ 1017c478bd9Sstevel@tonic-gate #define DECRYPT_NAME "decrypt" /* name of decrypt command */ 102c197cb9dShylee #define DECRYPT_OPTIONS "a:T:K:k:i:o:lv" /* options for decrypt */ 1037c478bd9Sstevel@tonic-gate 1047c478bd9Sstevel@tonic-gate /* 1057c478bd9Sstevel@tonic-gate * Structure containing info for encrypt/decrypt 1067c478bd9Sstevel@tonic-gate * command 1077c478bd9Sstevel@tonic-gate */ 1087c478bd9Sstevel@tonic-gate struct CommandInfo { 1097c478bd9Sstevel@tonic-gate char *name; /* name of the command */ 1107c478bd9Sstevel@tonic-gate char *options; /* command line options */ 1117c478bd9Sstevel@tonic-gate CK_FLAGS flags; 1127c478bd9Sstevel@tonic-gate CK_ATTRIBUTE_TYPE type; /* type of command */ 1137c478bd9Sstevel@tonic-gate 1147c478bd9Sstevel@tonic-gate /* function pointers for various operations */ 1157c478bd9Sstevel@tonic-gate CK_RV (*Init)(CK_SESSION_HANDLE, CK_MECHANISM_PTR, CK_OBJECT_HANDLE); 1167c478bd9Sstevel@tonic-gate CK_RV (*Update)(CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_BYTE_PTR, 1177c478bd9Sstevel@tonic-gate CK_ULONG_PTR); 1187c478bd9Sstevel@tonic-gate CK_RV (*Crypt)(CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG, CK_BYTE_PTR, 1197c478bd9Sstevel@tonic-gate CK_ULONG_PTR); 1207c478bd9Sstevel@tonic-gate CK_RV (*Final)(CK_SESSION_HANDLE, CK_BYTE_PTR, CK_ULONG_PTR); 1217c478bd9Sstevel@tonic-gate }; 1227c478bd9Sstevel@tonic-gate 1237c478bd9Sstevel@tonic-gate static struct CommandInfo encrypt_cmd = { 1247c478bd9Sstevel@tonic-gate ENCRYPT_NAME, 1257c478bd9Sstevel@tonic-gate ENCRYPT_OPTIONS, 1267c478bd9Sstevel@tonic-gate CKF_ENCRYPT, 1277c478bd9Sstevel@tonic-gate CKA_ENCRYPT, 1287c478bd9Sstevel@tonic-gate C_EncryptInit, 1297c478bd9Sstevel@tonic-gate C_EncryptUpdate, 1307c478bd9Sstevel@tonic-gate C_Encrypt, 1317c478bd9Sstevel@tonic-gate C_EncryptFinal 1327c478bd9Sstevel@tonic-gate }; 1337c478bd9Sstevel@tonic-gate 1347c478bd9Sstevel@tonic-gate static struct CommandInfo decrypt_cmd = { 1357c478bd9Sstevel@tonic-gate DECRYPT_NAME, 1367c478bd9Sstevel@tonic-gate DECRYPT_OPTIONS, 1377c478bd9Sstevel@tonic-gate CKF_DECRYPT, 1387c478bd9Sstevel@tonic-gate CKA_DECRYPT, 1397c478bd9Sstevel@tonic-gate C_DecryptInit, 1407c478bd9Sstevel@tonic-gate C_DecryptUpdate, 1417c478bd9Sstevel@tonic-gate C_Decrypt, 1427c478bd9Sstevel@tonic-gate C_DecryptFinal 1437c478bd9Sstevel@tonic-gate }; 1447c478bd9Sstevel@tonic-gate 1457c478bd9Sstevel@tonic-gate struct mech_alias { 1467c478bd9Sstevel@tonic-gate CK_MECHANISM_TYPE type; 1477c478bd9Sstevel@tonic-gate char *alias; 1487c478bd9Sstevel@tonic-gate CK_ULONG keysize_min; 1497c478bd9Sstevel@tonic-gate CK_ULONG keysize_max; 1507c478bd9Sstevel@tonic-gate int keysize_unit; 1517c478bd9Sstevel@tonic-gate int ivlen; 1527c478bd9Sstevel@tonic-gate boolean_t available; 1537c478bd9Sstevel@tonic-gate }; 1547c478bd9Sstevel@tonic-gate 1557c478bd9Sstevel@tonic-gate #define MECH_ALIASES_COUNT 4 1567c478bd9Sstevel@tonic-gate 1577c478bd9Sstevel@tonic-gate static struct mech_alias mech_aliases[] = { 1587c478bd9Sstevel@tonic-gate { CKM_AES_CBC_PAD, "aes", ULONG_MAX, 0L, 8, 16, B_FALSE }, 1597c478bd9Sstevel@tonic-gate { CKM_RC4, "arcfour", ULONG_MAX, 0L, 1, 0, B_FALSE }, 1607c478bd9Sstevel@tonic-gate { CKM_DES_CBC_PAD, "des", 8, 8, 8, 8, B_FALSE }, 1617c478bd9Sstevel@tonic-gate { CKM_DES3_CBC_PAD, "3des", 24, 24, 8, 8, B_FALSE }, 1627c478bd9Sstevel@tonic-gate }; 1637c478bd9Sstevel@tonic-gate 1647c478bd9Sstevel@tonic-gate static CK_BBOOL truevalue = TRUE; 1657c478bd9Sstevel@tonic-gate static CK_BBOOL falsevalue = FALSE; 1667c478bd9Sstevel@tonic-gate 1677c478bd9Sstevel@tonic-gate static boolean_t aflag = B_FALSE; /* -a <algorithm> flag, required */ 1687c478bd9Sstevel@tonic-gate static boolean_t kflag = B_FALSE; /* -k <keyfile> flag */ 1697c478bd9Sstevel@tonic-gate static boolean_t iflag = B_FALSE; /* -i <infile> flag, use stdin if absent */ 1707c478bd9Sstevel@tonic-gate static boolean_t oflag = B_FALSE; /* -o <outfile> flag, use stdout if absent */ 1717c478bd9Sstevel@tonic-gate static boolean_t lflag = B_FALSE; /* -l flag (list) */ 1727c478bd9Sstevel@tonic-gate static boolean_t vflag = B_FALSE; /* -v flag (verbose) */ 173b54157c1Sda73024 static boolean_t Tflag = B_FALSE; /* -T flag (tokenspec) */ 174b54157c1Sda73024 static boolean_t Kflag = B_FALSE; /* -K flag (keylabel) */ 1757c478bd9Sstevel@tonic-gate 1767c478bd9Sstevel@tonic-gate static char *keyfile = NULL; /* name of keyfile */ 1777c478bd9Sstevel@tonic-gate static char *inputfile = NULL; /* name of input file */ 1787c478bd9Sstevel@tonic-gate static char *outputfile = NULL; /* name of output file */ 179b54157c1Sda73024 static char *token_label = NULL; /* name of PKCS#11 token */ 180b54157c1Sda73024 static char *key_label = NULL; /* name of PKCS#11 token key label */ 1817c478bd9Sstevel@tonic-gate 1827c478bd9Sstevel@tonic-gate static int status_pos = 0; /* current position of progress bar element */ 1837c478bd9Sstevel@tonic-gate 1847c478bd9Sstevel@tonic-gate /* 1857c478bd9Sstevel@tonic-gate * function prototypes 1867c478bd9Sstevel@tonic-gate */ 1877c478bd9Sstevel@tonic-gate static void usage(struct CommandInfo *cmd); 1887c478bd9Sstevel@tonic-gate static int execute_cmd(struct CommandInfo *cmd, char *algo_str); 1897c478bd9Sstevel@tonic-gate static int crypt_multipart(struct CommandInfo *cmd, CK_SESSION_HANDLE hSession, 19054da5c1fSjk115741 int infd, int outfd, off_t insize); 1917c478bd9Sstevel@tonic-gate 1927c478bd9Sstevel@tonic-gate int 1937c478bd9Sstevel@tonic-gate main(int argc, char **argv) 1947c478bd9Sstevel@tonic-gate { 1957c478bd9Sstevel@tonic-gate 1967c478bd9Sstevel@tonic-gate extern char *optarg; 1977c478bd9Sstevel@tonic-gate extern int optind; 1987c478bd9Sstevel@tonic-gate char *optstr; 1997c478bd9Sstevel@tonic-gate char c; /* current getopts flag */ 2007c478bd9Sstevel@tonic-gate char *algo_str = NULL; /* algorithm string */ 2017c478bd9Sstevel@tonic-gate struct CommandInfo *cmd; 2027c478bd9Sstevel@tonic-gate char *cmdname; /* name of command */ 2037c478bd9Sstevel@tonic-gate boolean_t errflag = B_FALSE; 2047c478bd9Sstevel@tonic-gate 2057c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, ""); 206b54157c1Sda73024 #if !defined(TEXT_DOMAIN) /* Should be defined by cc -D */ 2077c478bd9Sstevel@tonic-gate #define TEXT_DOMAIN "SYS_TEST" /* Use this only if it weren't */ 2087c478bd9Sstevel@tonic-gate #endif 2097c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 2107c478bd9Sstevel@tonic-gate 2117c478bd9Sstevel@tonic-gate /* 2127c478bd9Sstevel@tonic-gate * Based on command name, determine 2137c478bd9Sstevel@tonic-gate * type of command. 2147c478bd9Sstevel@tonic-gate */ 2157c478bd9Sstevel@tonic-gate cmdname = basename(argv[0]); 2167c478bd9Sstevel@tonic-gate 2177c478bd9Sstevel@tonic-gate cryptodebug_init(cmdname); 2187c478bd9Sstevel@tonic-gate 2197c478bd9Sstevel@tonic-gate if (strcmp(cmdname, encrypt_cmd.name) == 0) { 2207c478bd9Sstevel@tonic-gate cmd = &encrypt_cmd; 2217c478bd9Sstevel@tonic-gate } else if (strcmp(cmdname, decrypt_cmd.name) == 0) { 2227c478bd9Sstevel@tonic-gate cmd = &decrypt_cmd; 2237c478bd9Sstevel@tonic-gate } else { 2247c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 2257c478bd9Sstevel@tonic-gate "command name must be either encrypt or decrypt")); 2267c478bd9Sstevel@tonic-gate exit(EXIT_USAGE); 2277c478bd9Sstevel@tonic-gate } 2287c478bd9Sstevel@tonic-gate 2297c478bd9Sstevel@tonic-gate optstr = cmd->options; 2307c478bd9Sstevel@tonic-gate 2317c478bd9Sstevel@tonic-gate /* Parse command line arguments */ 2327c478bd9Sstevel@tonic-gate while (!errflag && (c = getopt(argc, argv, optstr)) != -1) { 2337c478bd9Sstevel@tonic-gate 2347c478bd9Sstevel@tonic-gate switch (c) { 2357c478bd9Sstevel@tonic-gate case 'a': 2367c478bd9Sstevel@tonic-gate aflag = B_TRUE; 2377c478bd9Sstevel@tonic-gate algo_str = optarg; 2387c478bd9Sstevel@tonic-gate break; 2397c478bd9Sstevel@tonic-gate case 'k': 2407c478bd9Sstevel@tonic-gate kflag = B_TRUE; 2417c478bd9Sstevel@tonic-gate keyfile = optarg; 2427c478bd9Sstevel@tonic-gate break; 243c197cb9dShylee case 'T': 244c197cb9dShylee Tflag = B_TRUE; 245c197cb9dShylee token_label = optarg; 246c197cb9dShylee break; 247c197cb9dShylee case 'K': 248c197cb9dShylee Kflag = B_TRUE; 249c197cb9dShylee key_label = optarg; 250c197cb9dShylee break; 2517c478bd9Sstevel@tonic-gate case 'i': 2527c478bd9Sstevel@tonic-gate iflag = B_TRUE; 2537c478bd9Sstevel@tonic-gate inputfile = optarg; 2547c478bd9Sstevel@tonic-gate break; 2557c478bd9Sstevel@tonic-gate case 'o': 2567c478bd9Sstevel@tonic-gate oflag = B_TRUE; 2577c478bd9Sstevel@tonic-gate outputfile = optarg; 2587c478bd9Sstevel@tonic-gate break; 2597c478bd9Sstevel@tonic-gate case 'l': 2607c478bd9Sstevel@tonic-gate lflag = B_TRUE; 2617c478bd9Sstevel@tonic-gate break; 2627c478bd9Sstevel@tonic-gate case 'v': 2637c478bd9Sstevel@tonic-gate vflag = B_TRUE; 2647c478bd9Sstevel@tonic-gate break; 2657c478bd9Sstevel@tonic-gate default: 2667c478bd9Sstevel@tonic-gate errflag = B_TRUE; 2677c478bd9Sstevel@tonic-gate } 2687c478bd9Sstevel@tonic-gate } 2697c478bd9Sstevel@tonic-gate 2707c478bd9Sstevel@tonic-gate if (errflag || (!aflag && !lflag) || (lflag && argc > 2) || 271c197cb9dShylee (kflag && Kflag) || (Tflag && !Kflag) || 2727c478bd9Sstevel@tonic-gate (optind < argc)) { 2737c478bd9Sstevel@tonic-gate usage(cmd); 2747c478bd9Sstevel@tonic-gate exit(EXIT_USAGE); 2757c478bd9Sstevel@tonic-gate } 2767c478bd9Sstevel@tonic-gate 2777c478bd9Sstevel@tonic-gate return (execute_cmd(cmd, algo_str)); 2787c478bd9Sstevel@tonic-gate } 2797c478bd9Sstevel@tonic-gate 2807c478bd9Sstevel@tonic-gate /* 2817c478bd9Sstevel@tonic-gate * usage message 2827c478bd9Sstevel@tonic-gate */ 2837c478bd9Sstevel@tonic-gate static void 2847c478bd9Sstevel@tonic-gate usage(struct CommandInfo *cmd) 2857c478bd9Sstevel@tonic-gate { 286c197cb9dShylee (void) fprintf(stderr, gettext("Usage:\n")); 2877c478bd9Sstevel@tonic-gate if (cmd->type == CKA_ENCRYPT) { 288c197cb9dShylee (void) fprintf(stderr, gettext(" encrypt -l\n")); 289c197cb9dShylee (void) fprintf(stderr, gettext(" encrypt -a <algorithm> " 290c197cb9dShylee "[-v] [-k <keyfile> | -K <keylabel> [-T <tokenspec>]] " 291c197cb9dShylee "[-i <infile>] [-o <outfile>]\n")); 292c197cb9dShylee 2937c478bd9Sstevel@tonic-gate } else { 294c197cb9dShylee (void) fprintf(stderr, gettext(" decrypt -l\n")); 295c197cb9dShylee (void) fprintf(stderr, gettext(" decrypt -a <algorithm> " 296c197cb9dShylee "[-v] [-k <keyfile> | -K <keylabel> [-T <tokenspec>]] " 297c197cb9dShylee "[-i <infile>] [-o <outfile>]\n")); 2987c478bd9Sstevel@tonic-gate } 2997c478bd9Sstevel@tonic-gate } 3007c478bd9Sstevel@tonic-gate 3017c478bd9Sstevel@tonic-gate /* 3027c478bd9Sstevel@tonic-gate * Print out list of algorithms in default and verbose mode 3037c478bd9Sstevel@tonic-gate */ 3047c478bd9Sstevel@tonic-gate static void 3057c478bd9Sstevel@tonic-gate algorithm_list() 3067c478bd9Sstevel@tonic-gate { 3077c478bd9Sstevel@tonic-gate int mech; 3087c478bd9Sstevel@tonic-gate 3097c478bd9Sstevel@tonic-gate (void) printf(gettext("Algorithm Keysize: Min Max (bits)\n" 3107c478bd9Sstevel@tonic-gate "------------------------------------------\n")); 3117c478bd9Sstevel@tonic-gate 3127c478bd9Sstevel@tonic-gate for (mech = 0; mech < MECH_ALIASES_COUNT; mech++) { 3137c478bd9Sstevel@tonic-gate 3147c478bd9Sstevel@tonic-gate if (mech_aliases[mech].available == B_FALSE) 3157c478bd9Sstevel@tonic-gate continue; 3167c478bd9Sstevel@tonic-gate 3177c478bd9Sstevel@tonic-gate (void) printf("%-15s", mech_aliases[mech].alias); 3187c478bd9Sstevel@tonic-gate 3197c478bd9Sstevel@tonic-gate if (mech_aliases[mech].keysize_min != UINT_MAX && 3207c478bd9Sstevel@tonic-gate mech_aliases[mech].keysize_max != 0) 3217c478bd9Sstevel@tonic-gate (void) printf(" %5lu %5lu\n", 3227c478bd9Sstevel@tonic-gate (mech_aliases[mech].keysize_min * 3237c478bd9Sstevel@tonic-gate mech_aliases[mech].keysize_unit), 3247c478bd9Sstevel@tonic-gate (mech_aliases[mech].keysize_max * 3257c478bd9Sstevel@tonic-gate mech_aliases[mech].keysize_unit)); 3267c478bd9Sstevel@tonic-gate else 3277c478bd9Sstevel@tonic-gate (void) printf("\n"); 3287c478bd9Sstevel@tonic-gate 3297c478bd9Sstevel@tonic-gate } 3307c478bd9Sstevel@tonic-gate } 3317c478bd9Sstevel@tonic-gate 332c197cb9dShylee /* 333c197cb9dShylee * This function will login into the token with the provided password and 334c197cb9dShylee * find the token key object with the specified keytype and keylabel. 335c197cb9dShylee */ 336c197cb9dShylee static int 337c197cb9dShylee get_token_key(CK_SESSION_HANDLE hSession, CK_KEY_TYPE keytype, 338c197cb9dShylee char *keylabel, CK_BYTE *password, int password_len, 339c197cb9dShylee CK_OBJECT_HANDLE *keyobj) 340c197cb9dShylee { 341c197cb9dShylee CK_RV rv; 342c197cb9dShylee CK_ATTRIBUTE pTmpl[10]; 343c197cb9dShylee CK_OBJECT_CLASS class = CKO_SECRET_KEY; 344c197cb9dShylee CK_BBOOL true = 1; 345c197cb9dShylee CK_BBOOL is_token = 1; 346c197cb9dShylee CK_ULONG key_obj_count = 1; 347c197cb9dShylee int i; 348c197cb9dShylee CK_KEY_TYPE ckKeyType = keytype; 349c197cb9dShylee 350c197cb9dShylee 351c197cb9dShylee rv = C_Login(hSession, CKU_USER, (CK_UTF8CHAR_PTR)password, 352c197cb9dShylee (CK_ULONG)password_len); 353c197cb9dShylee if (rv != CKR_OK) { 354c197cb9dShylee (void) fprintf(stderr, "Cannot login to the token." 355c197cb9dShylee " error = %s\n", pkcs11_strerror(rv)); 356c197cb9dShylee return (-1); 357c197cb9dShylee } 358c197cb9dShylee 359c197cb9dShylee i = 0; 360c197cb9dShylee pTmpl[i].type = CKA_TOKEN; 361c197cb9dShylee pTmpl[i].pValue = &is_token; 362c197cb9dShylee pTmpl[i].ulValueLen = sizeof (CK_BBOOL); 363c197cb9dShylee i++; 364c197cb9dShylee 365c197cb9dShylee pTmpl[i].type = CKA_CLASS; 366c197cb9dShylee pTmpl[i].pValue = &class; 367c197cb9dShylee pTmpl[i].ulValueLen = sizeof (class); 368c197cb9dShylee i++; 369c197cb9dShylee 370c197cb9dShylee pTmpl[i].type = CKA_LABEL; 371c197cb9dShylee pTmpl[i].pValue = keylabel; 372c197cb9dShylee pTmpl[i].ulValueLen = strlen(keylabel); 373c197cb9dShylee i++; 374c197cb9dShylee 375c197cb9dShylee pTmpl[i].type = CKA_KEY_TYPE; 376c197cb9dShylee pTmpl[i].pValue = &ckKeyType; 377c197cb9dShylee pTmpl[i].ulValueLen = sizeof (ckKeyType); 378c197cb9dShylee i++; 379c197cb9dShylee 380c197cb9dShylee pTmpl[i].type = CKA_PRIVATE; 381c197cb9dShylee pTmpl[i].pValue = &true; 382c197cb9dShylee pTmpl[i].ulValueLen = sizeof (true); 383c197cb9dShylee i++; 384c197cb9dShylee 385c197cb9dShylee rv = C_FindObjectsInit(hSession, pTmpl, i); 386c197cb9dShylee if (rv != CKR_OK) { 387c197cb9dShylee goto out; 388c197cb9dShylee } 389c197cb9dShylee 390c197cb9dShylee rv = C_FindObjects(hSession, keyobj, 1, &key_obj_count); 391c197cb9dShylee 392c197cb9dShylee (void) C_FindObjectsFinal(hSession); 393c197cb9dShylee 394c197cb9dShylee out: 395c197cb9dShylee if (rv != CKR_OK) { 396c197cb9dShylee (void) fprintf(stderr, 397c197cb9dShylee "Cannot retrieve key object. error = %s\n", 398c197cb9dShylee pkcs11_strerror(rv)); 399c197cb9dShylee return (-1); 400c197cb9dShylee } 401c197cb9dShylee 402c197cb9dShylee if (key_obj_count == 0) { 403c197cb9dShylee (void) fprintf(stderr, "Cannot find the key object.\n"); 404c197cb9dShylee return (-1); 405c197cb9dShylee } 406c197cb9dShylee 407c197cb9dShylee return (0); 408c197cb9dShylee } 409c197cb9dShylee 4107c478bd9Sstevel@tonic-gate 4117c478bd9Sstevel@tonic-gate /* 4127c478bd9Sstevel@tonic-gate * Execute the command. 4137c478bd9Sstevel@tonic-gate * cmd - command pointing to type of operation. 4147c478bd9Sstevel@tonic-gate * algo_str - alias of the algorithm passed. 4157c478bd9Sstevel@tonic-gate */ 4167c478bd9Sstevel@tonic-gate static int 4177c478bd9Sstevel@tonic-gate execute_cmd(struct CommandInfo *cmd, char *algo_str) 4187c478bd9Sstevel@tonic-gate { 4197c478bd9Sstevel@tonic-gate CK_RV rv; 4207c478bd9Sstevel@tonic-gate CK_ULONG slotcount; 4217c478bd9Sstevel@tonic-gate CK_SLOT_ID slotID; 4227c478bd9Sstevel@tonic-gate CK_SLOT_ID_PTR pSlotList = NULL; 4237c478bd9Sstevel@tonic-gate CK_MECHANISM_TYPE mech_type = 0; 4247c478bd9Sstevel@tonic-gate CK_MECHANISM_INFO info, kg_info; 4257c478bd9Sstevel@tonic-gate CK_MECHANISM mech; 4267c478bd9Sstevel@tonic-gate CK_SESSION_HANDLE hSession = CK_INVALID_HANDLE; 4277c478bd9Sstevel@tonic-gate CK_BYTE_PTR pkeydata = NULL; 4281c9bd843Sdinak CK_BYTE salt[CK_PKCS5_PBKD2_SALT_SIZE]; 4297c478bd9Sstevel@tonic-gate CK_ULONG keysize = 0; 4307c478bd9Sstevel@tonic-gate int i, slot, mek; /* index variables */ 4317c478bd9Sstevel@tonic-gate int status; 4327c478bd9Sstevel@tonic-gate struct stat insbuf; /* stat buf for infile */ 4337c478bd9Sstevel@tonic-gate struct stat outsbuf; /* stat buf for outfile */ 4347c478bd9Sstevel@tonic-gate char tmpnam[PATH_MAX]; /* tmp file name */ 4357c478bd9Sstevel@tonic-gate CK_OBJECT_HANDLE key = (CK_OBJECT_HANDLE) 0; 4367c478bd9Sstevel@tonic-gate int infd = 0; /* input file, stdin default */ 4377c478bd9Sstevel@tonic-gate int outfd = 1; /* output file, stdout default */ 4387c478bd9Sstevel@tonic-gate char *outfilename = NULL; 4397c478bd9Sstevel@tonic-gate boolean_t errflag = B_TRUE; 4407c478bd9Sstevel@tonic-gate boolean_t inoutsame = B_FALSE; /* if both input & output are same */ 4419a2817adSValerie Bubb Fenwick boolean_t leavefilealone = B_FALSE; 4427c478bd9Sstevel@tonic-gate CK_BYTE_PTR pivbuf = NULL_PTR; 4437c478bd9Sstevel@tonic-gate CK_ULONG ivlen = 0L; 4447c478bd9Sstevel@tonic-gate int mech_match = 0; 445b54157c1Sda73024 uint32_t iterations = CK_PKCS5_PBKD2_ITERATIONS; 4467c478bd9Sstevel@tonic-gate CK_ULONG keylen; 447b54157c1Sda73024 uint32_t version = SUNW_ENCRYPT_FILE_VERSION; 4487c478bd9Sstevel@tonic-gate CK_KEY_TYPE keytype; 449c197cb9dShylee KMF_RETURN kmfrv; 450c197cb9dShylee CK_SLOT_ID token_slot_id; 4517c478bd9Sstevel@tonic-gate 4527c478bd9Sstevel@tonic-gate if (aflag) { 4537c478bd9Sstevel@tonic-gate /* Determine if algorithm is valid */ 4547c478bd9Sstevel@tonic-gate for (mech_match = 0; mech_match < MECH_ALIASES_COUNT; 4557c478bd9Sstevel@tonic-gate mech_match++) { 4567c478bd9Sstevel@tonic-gate if (strcmp(algo_str, 4577c478bd9Sstevel@tonic-gate mech_aliases[mech_match].alias) == 0) { 4587c478bd9Sstevel@tonic-gate mech_type = mech_aliases[mech_match].type; 4597c478bd9Sstevel@tonic-gate break; 4607c478bd9Sstevel@tonic-gate } 4617c478bd9Sstevel@tonic-gate } 4627c478bd9Sstevel@tonic-gate 4637c478bd9Sstevel@tonic-gate if (mech_match == MECH_ALIASES_COUNT) { 4647c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 4657c478bd9Sstevel@tonic-gate gettext("unknown algorithm -- %s"), algo_str); 4667c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 4677c478bd9Sstevel@tonic-gate } 4687c478bd9Sstevel@tonic-gate 4697c478bd9Sstevel@tonic-gate /* 470c197cb9dShylee * Process keyfile or get the token pin if -K is specified. 4717c478bd9Sstevel@tonic-gate * 4727c478bd9Sstevel@tonic-gate * If a keyfile is provided, get the key data from 4737c478bd9Sstevel@tonic-gate * the file. Otherwise, prompt for a passphrase. The 4747c478bd9Sstevel@tonic-gate * passphrase is used as the key data. 4757c478bd9Sstevel@tonic-gate */ 476c197cb9dShylee if (Kflag) { 477c197cb9dShylee /* get the pin of the token */ 478c197cb9dShylee if (token_label == NULL || !strlen(token_label)) { 4791c9bd843Sdinak token_label = pkcs11_default_token(); 480c197cb9dShylee } 481c197cb9dShylee 4821c9bd843Sdinak status = pkcs11_get_pass(token_label, 4831c9bd843Sdinak (char **)&pkeydata, (size_t *)&keysize, 0, B_FALSE); 484c197cb9dShylee } else if (kflag) { 485c197cb9dShylee /* get the key file */ 4861c9bd843Sdinak status = pkcs11_read_data(keyfile, (void **)&pkeydata, 4871c9bd843Sdinak (size_t *)&keysize); 4887c478bd9Sstevel@tonic-gate } else { 489c197cb9dShylee /* get the key from input */ 4901c9bd843Sdinak status = pkcs11_get_pass(NULL, (char **)&pkeydata, 491c545f712SDina K Nimeh (size_t *)&keysize, 0, 492c545f712SDina K Nimeh (cmd->type == CKA_ENCRYPT) ? B_TRUE : B_FALSE); 4937c478bd9Sstevel@tonic-gate } 4947c478bd9Sstevel@tonic-gate 495a7e661a2SAnthony Scarpino if (status != 0 || keysize == 0L) { 496c197cb9dShylee cryptoerror(LOG_STDERR, 497c545f712SDina K Nimeh kflag ? gettext("invalid key.") : 498c545f712SDina K Nimeh gettext("invalid passphrase.")); 4997c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 5007c478bd9Sstevel@tonic-gate } 5017c478bd9Sstevel@tonic-gate } 5027c478bd9Sstevel@tonic-gate 5037c478bd9Sstevel@tonic-gate bzero(salt, sizeof (salt)); 5047c478bd9Sstevel@tonic-gate /* Initialize pkcs */ 505c197cb9dShylee rv = C_Initialize(NULL); 506c197cb9dShylee if (rv != CKR_OK && rv != CKR_CRYPTOKI_ALREADY_INITIALIZED) { 5077c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("failed to initialize " 5087c478bd9Sstevel@tonic-gate "PKCS #11 framework: %s"), pkcs11_strerror(rv)); 5097c478bd9Sstevel@tonic-gate goto cleanup; 5107c478bd9Sstevel@tonic-gate } 5117c478bd9Sstevel@tonic-gate 5127c478bd9Sstevel@tonic-gate /* Get slot count */ 5137c478bd9Sstevel@tonic-gate rv = C_GetSlotList(0, NULL_PTR, &slotcount); 5147c478bd9Sstevel@tonic-gate if (rv != CKR_OK || slotcount == 0) { 5157c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 5167c478bd9Sstevel@tonic-gate "failed to find any cryptographic provider," 5177c478bd9Sstevel@tonic-gate "please check with your system administrator: %s"), 5187c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 5197c478bd9Sstevel@tonic-gate goto cleanup; 5207c478bd9Sstevel@tonic-gate } 5217c478bd9Sstevel@tonic-gate 5227c478bd9Sstevel@tonic-gate /* Found at least one slot, allocate memory for slot list */ 5237c478bd9Sstevel@tonic-gate pSlotList = malloc(slotcount * sizeof (CK_SLOT_ID)); 5247c478bd9Sstevel@tonic-gate if (pSlotList == NULL_PTR) { 5257c478bd9Sstevel@tonic-gate int err = errno; 5267c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("malloc: %s"), strerror(err)); 5277c478bd9Sstevel@tonic-gate goto cleanup; 5287c478bd9Sstevel@tonic-gate } 5297c478bd9Sstevel@tonic-gate 5307c478bd9Sstevel@tonic-gate /* Get the list of slots */ 5317c478bd9Sstevel@tonic-gate if ((rv = C_GetSlotList(0, pSlotList, &slotcount)) != CKR_OK) { 5327c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 5337c478bd9Sstevel@tonic-gate "failed to find any cryptographic provider," 5347c478bd9Sstevel@tonic-gate "please check with your system administrator: %s"), 5357c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 5367c478bd9Sstevel@tonic-gate goto cleanup; 5377c478bd9Sstevel@tonic-gate } 5387c478bd9Sstevel@tonic-gate 5397c478bd9Sstevel@tonic-gate if (lflag) { 5407c478bd9Sstevel@tonic-gate 5417c478bd9Sstevel@tonic-gate /* Iterate through slots */ 5427c478bd9Sstevel@tonic-gate for (slot = 0; slot < slotcount; slot++) { 5437c478bd9Sstevel@tonic-gate 5447c478bd9Sstevel@tonic-gate /* Iterate through each mechanism */ 5457c478bd9Sstevel@tonic-gate for (mek = 0; mek < MECH_ALIASES_COUNT; mek++) { 5467c478bd9Sstevel@tonic-gate rv = C_GetMechanismInfo(pSlotList[slot], 5477c478bd9Sstevel@tonic-gate mech_aliases[mek].type, &info); 5487c478bd9Sstevel@tonic-gate 5497c478bd9Sstevel@tonic-gate if (rv != CKR_OK) 5507c478bd9Sstevel@tonic-gate continue; 5517c478bd9Sstevel@tonic-gate 5527c478bd9Sstevel@tonic-gate /* 5537c478bd9Sstevel@tonic-gate * Set to minimum/maximum key sizes assuming 5547c478bd9Sstevel@tonic-gate * the values available are not 0. 5557c478bd9Sstevel@tonic-gate */ 5567c478bd9Sstevel@tonic-gate if (info.ulMinKeySize && (info.ulMinKeySize < 5577c478bd9Sstevel@tonic-gate mech_aliases[mek].keysize_min)) 5587c478bd9Sstevel@tonic-gate mech_aliases[mek].keysize_min = 5597c478bd9Sstevel@tonic-gate info.ulMinKeySize; 5607c478bd9Sstevel@tonic-gate 5617c478bd9Sstevel@tonic-gate if (info.ulMaxKeySize && (info.ulMaxKeySize > 5627c478bd9Sstevel@tonic-gate mech_aliases[mek].keysize_max)) 5637c478bd9Sstevel@tonic-gate mech_aliases[mek].keysize_max = 5647c478bd9Sstevel@tonic-gate info.ulMaxKeySize; 5657c478bd9Sstevel@tonic-gate 5667c478bd9Sstevel@tonic-gate mech_aliases[mek].available = B_TRUE; 5677c478bd9Sstevel@tonic-gate } 5687c478bd9Sstevel@tonic-gate 5697c478bd9Sstevel@tonic-gate } 5707c478bd9Sstevel@tonic-gate 5717c478bd9Sstevel@tonic-gate algorithm_list(); 5727c478bd9Sstevel@tonic-gate 5737c478bd9Sstevel@tonic-gate errflag = B_FALSE; 5747c478bd9Sstevel@tonic-gate goto cleanup; 5757c478bd9Sstevel@tonic-gate } 5767c478bd9Sstevel@tonic-gate 577c197cb9dShylee 578c197cb9dShylee /* 579c197cb9dShylee * Find a slot with matching mechanism 580c197cb9dShylee * 581c197cb9dShylee * If -K is specified, we find the slot id for the token first, then 582c197cb9dShylee * check if the slot supports the algorithm. 583c197cb9dShylee */ 584c197cb9dShylee i = 0; 585c197cb9dShylee if (Kflag) { 58630a5e8faSwyllys kmfrv = kmf_pk11_token_lookup(NULL, token_label, 58730a5e8faSwyllys &token_slot_id); 588c197cb9dShylee if (kmfrv != KMF_OK) { 589c197cb9dShylee cryptoerror(LOG_STDERR, 590c197cb9dShylee gettext("no matching PKCS#11 token")); 591c197cb9dShylee errflag = B_TRUE; 592c197cb9dShylee goto cleanup; 593c197cb9dShylee } 594c197cb9dShylee rv = C_GetMechanismInfo(token_slot_id, mech_type, &info); 595c197cb9dShylee if (rv == CKR_OK && (info.flags & cmd->flags)) 596c197cb9dShylee slotID = token_slot_id; 597c197cb9dShylee else 598c197cb9dShylee i = slotcount; 599c197cb9dShylee } else { 6007c478bd9Sstevel@tonic-gate for (i = 0; i < slotcount; i++) { 6017c478bd9Sstevel@tonic-gate slotID = pSlotList[i]; 6027c478bd9Sstevel@tonic-gate rv = C_GetMechanismInfo(slotID, mech_type, &info); 6037c478bd9Sstevel@tonic-gate if (rv != CKR_OK) { 6047c478bd9Sstevel@tonic-gate continue; /* to the next slot */ 6057c478bd9Sstevel@tonic-gate } else { 6067c478bd9Sstevel@tonic-gate /* 6077c478bd9Sstevel@tonic-gate * If the slot support the crypto, also 6087c478bd9Sstevel@tonic-gate * make sure it supports the correct 6097c478bd9Sstevel@tonic-gate * key generation mech if needed. 6107c478bd9Sstevel@tonic-gate * 6117c478bd9Sstevel@tonic-gate * We need PKCS5 when RC4 is used or 6127c478bd9Sstevel@tonic-gate * when the key is entered on cmd line. 6137c478bd9Sstevel@tonic-gate */ 6147c478bd9Sstevel@tonic-gate if ((info.flags & cmd->flags) && 615c197cb9dShylee (mech_type == CKM_RC4) || 616c197cb9dShylee (keyfile == NULL)) { 6177c478bd9Sstevel@tonic-gate rv = C_GetMechanismInfo(slotID, 6187c478bd9Sstevel@tonic-gate CKM_PKCS5_PBKD2, &kg_info); 6197c478bd9Sstevel@tonic-gate if (rv == CKR_OK) 6207c478bd9Sstevel@tonic-gate break; 6217c478bd9Sstevel@tonic-gate } else if (info.flags & cmd->flags) { 6227c478bd9Sstevel@tonic-gate break; 6237c478bd9Sstevel@tonic-gate } 6247c478bd9Sstevel@tonic-gate } 6257c478bd9Sstevel@tonic-gate } 626c197cb9dShylee } 6277c478bd9Sstevel@tonic-gate 6287c478bd9Sstevel@tonic-gate /* Show error if no matching mechanism found */ 6297c478bd9Sstevel@tonic-gate if (i == slotcount) { 6307c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 6317c478bd9Sstevel@tonic-gate gettext("no cryptographic provider was " 6327c478bd9Sstevel@tonic-gate "found for this algorithm -- %s"), algo_str); 6337c478bd9Sstevel@tonic-gate goto cleanup; 6347c478bd9Sstevel@tonic-gate } 6357c478bd9Sstevel@tonic-gate 6367c478bd9Sstevel@tonic-gate /* Open a session */ 6377c478bd9Sstevel@tonic-gate rv = C_OpenSession(slotID, CKF_SERIAL_SESSION, 6387c478bd9Sstevel@tonic-gate NULL_PTR, NULL, &hSession); 6397c478bd9Sstevel@tonic-gate 6407c478bd9Sstevel@tonic-gate if (rv != CKR_OK) { 6417c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 6427c478bd9Sstevel@tonic-gate gettext("can not open PKCS #11 session: %s"), 6437c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 6447c478bd9Sstevel@tonic-gate goto cleanup; 6457c478bd9Sstevel@tonic-gate } 6467c478bd9Sstevel@tonic-gate 6477c478bd9Sstevel@tonic-gate /* 6487c478bd9Sstevel@tonic-gate * Generate IV data for encrypt. 6497c478bd9Sstevel@tonic-gate */ 6507c478bd9Sstevel@tonic-gate ivlen = mech_aliases[mech_match].ivlen; 6517c478bd9Sstevel@tonic-gate if ((pivbuf = malloc((size_t)ivlen)) == NULL) { 6527c478bd9Sstevel@tonic-gate int err = errno; 6537c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("malloc: %s"), 6547c478bd9Sstevel@tonic-gate strerror(err)); 6557c478bd9Sstevel@tonic-gate goto cleanup; 6567c478bd9Sstevel@tonic-gate } 6577c478bd9Sstevel@tonic-gate 6587c478bd9Sstevel@tonic-gate if (cmd->type == CKA_ENCRYPT) { 6597b79d846SDina K Nimeh if ((pkcs11_get_urandom((void *)pivbuf, 6607c478bd9Sstevel@tonic-gate mech_aliases[mech_match].ivlen)) != 0) { 6617c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 6627c478bd9Sstevel@tonic-gate "Unable to generate random " 6637c478bd9Sstevel@tonic-gate "data for initialization vector.")); 6647c478bd9Sstevel@tonic-gate goto cleanup; 6657c478bd9Sstevel@tonic-gate } 6667c478bd9Sstevel@tonic-gate } 6677c478bd9Sstevel@tonic-gate 6687c478bd9Sstevel@tonic-gate /* 6697c478bd9Sstevel@tonic-gate * Create the key object 6707c478bd9Sstevel@tonic-gate */ 6717c478bd9Sstevel@tonic-gate rv = pkcs11_mech2keytype(mech_type, &keytype); 6727c478bd9Sstevel@tonic-gate if (rv != CKR_OK) { 6737c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 6747c478bd9Sstevel@tonic-gate gettext("unable to find key type for algorithm.")); 6757c478bd9Sstevel@tonic-gate goto cleanup; 6767c478bd9Sstevel@tonic-gate } 6777c478bd9Sstevel@tonic-gate 6787c478bd9Sstevel@tonic-gate /* Open input file */ 6797c478bd9Sstevel@tonic-gate if (iflag) { 6807c478bd9Sstevel@tonic-gate if ((infd = open(inputfile, O_RDONLY | O_NONBLOCK)) == -1) { 6817c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 6827c478bd9Sstevel@tonic-gate "can not open input file %s"), inputfile); 6837c478bd9Sstevel@tonic-gate goto cleanup; 6847c478bd9Sstevel@tonic-gate } 6857c478bd9Sstevel@tonic-gate 6867c478bd9Sstevel@tonic-gate /* Get info on input file */ 6877c478bd9Sstevel@tonic-gate if (fstat(infd, &insbuf) == -1) { 6887c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 6897c478bd9Sstevel@tonic-gate "can not stat input file %s"), inputfile); 6907c478bd9Sstevel@tonic-gate goto cleanup; 6917c478bd9Sstevel@tonic-gate } 6927c478bd9Sstevel@tonic-gate } 6937c478bd9Sstevel@tonic-gate 6947c478bd9Sstevel@tonic-gate /* 6957c478bd9Sstevel@tonic-gate * Prepare output file 6967c478bd9Sstevel@tonic-gate * If the input & output file are same, 6977c478bd9Sstevel@tonic-gate * the output is written to a temp 6987c478bd9Sstevel@tonic-gate * file first, then renamed to the original file 6997c478bd9Sstevel@tonic-gate * after the crypt operation 7007c478bd9Sstevel@tonic-gate */ 7017c478bd9Sstevel@tonic-gate inoutsame = B_FALSE; 7027c478bd9Sstevel@tonic-gate if (oflag) { 7037c478bd9Sstevel@tonic-gate outfilename = outputfile; 7047c478bd9Sstevel@tonic-gate if ((stat(outputfile, &outsbuf) != -1) && 7057c478bd9Sstevel@tonic-gate (insbuf.st_ino == outsbuf.st_ino)) { 7067c478bd9Sstevel@tonic-gate char *dir; 7077c478bd9Sstevel@tonic-gate 7087c478bd9Sstevel@tonic-gate /* create temp file on same dir */ 7097c478bd9Sstevel@tonic-gate dir = dirname(outputfile); 7107c478bd9Sstevel@tonic-gate (void) snprintf(tmpnam, sizeof (tmpnam), 7117c478bd9Sstevel@tonic-gate "%s/encrXXXXXX", dir); 7127c478bd9Sstevel@tonic-gate outfilename = tmpnam; 7137c478bd9Sstevel@tonic-gate if ((outfd = mkstemp(tmpnam)) == -1) { 7147c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 7157c478bd9Sstevel@tonic-gate "cannot create temp file")); 7167c478bd9Sstevel@tonic-gate goto cleanup; 7177c478bd9Sstevel@tonic-gate } 7187c478bd9Sstevel@tonic-gate inoutsame = B_TRUE; 7197c478bd9Sstevel@tonic-gate } else { 7207c478bd9Sstevel@tonic-gate /* Create file for output */ 7217c478bd9Sstevel@tonic-gate if ((outfd = open(outfilename, 72230a5e8faSwyllys O_CREAT|O_WRONLY|O_TRUNC, 0644)) == -1) { 7237c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 7247c478bd9Sstevel@tonic-gate "cannot open output file %s"), 7257c478bd9Sstevel@tonic-gate outfilename); 7269a2817adSValerie Bubb Fenwick /* Cannot open file, should leave it alone */ 7279a2817adSValerie Bubb Fenwick leavefilealone = B_TRUE; 7287c478bd9Sstevel@tonic-gate goto cleanup; 7297c478bd9Sstevel@tonic-gate } 7307c478bd9Sstevel@tonic-gate } 7317c478bd9Sstevel@tonic-gate } 7327c478bd9Sstevel@tonic-gate 7337c478bd9Sstevel@tonic-gate /* 7347c478bd9Sstevel@tonic-gate * Read the version number from the head of the file 7357c478bd9Sstevel@tonic-gate * to know how to interpret the data that follows. 7367c478bd9Sstevel@tonic-gate */ 7377c478bd9Sstevel@tonic-gate if (cmd->type == CKA_DECRYPT) { 7387c478bd9Sstevel@tonic-gate if (read(infd, &version, sizeof (version)) != 7397c478bd9Sstevel@tonic-gate sizeof (version)) { 7407c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 7417c478bd9Sstevel@tonic-gate "failed to get format version from " 7427c478bd9Sstevel@tonic-gate "input file.")); 7437c478bd9Sstevel@tonic-gate goto cleanup; 7447c478bd9Sstevel@tonic-gate } 7457c478bd9Sstevel@tonic-gate /* convert to host byte order */ 7467c478bd9Sstevel@tonic-gate version = ntohl(version); 7477c478bd9Sstevel@tonic-gate 7487c478bd9Sstevel@tonic-gate switch (version) { 7497c478bd9Sstevel@tonic-gate case 1: 7507c478bd9Sstevel@tonic-gate /* 7517c478bd9Sstevel@tonic-gate * Version 1 output format: 752b54157c1Sda73024 * - Output format version 1 (4 bytes) 7537c478bd9Sstevel@tonic-gate * - Iterations used in key gen function (4 bytes) 754b54157c1Sda73024 * - IV ('ivlen' bytes). The length algorithm-dependent 7557c478bd9Sstevel@tonic-gate * - Salt data used in key gen (16 bytes) 756b54157c1Sda73024 * - Cipher text data (remainder of the file) 7577c478bd9Sstevel@tonic-gate * 7587c478bd9Sstevel@tonic-gate * An encrypted file has IV as first block (0 or 7597c478bd9Sstevel@tonic-gate * more bytes depending on mechanism) followed 7607c478bd9Sstevel@tonic-gate * by cipher text. Get the IV from the encrypted 7617c478bd9Sstevel@tonic-gate * file. 7627c478bd9Sstevel@tonic-gate */ 7637c478bd9Sstevel@tonic-gate /* 7647c478bd9Sstevel@tonic-gate * Read iteration count and salt data. 7657c478bd9Sstevel@tonic-gate */ 7667c478bd9Sstevel@tonic-gate if (read(infd, &iterations, 76730a5e8faSwyllys sizeof (iterations)) != sizeof (iterations)) { 7687c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 7697c478bd9Sstevel@tonic-gate "failed to get iterations from " 7707c478bd9Sstevel@tonic-gate "input file.")); 7717c478bd9Sstevel@tonic-gate goto cleanup; 7727c478bd9Sstevel@tonic-gate } 7737c478bd9Sstevel@tonic-gate /* convert to host byte order */ 7747c478bd9Sstevel@tonic-gate iterations = ntohl(iterations); 7757c478bd9Sstevel@tonic-gate if (ivlen > 0 && 7767c478bd9Sstevel@tonic-gate read(infd, pivbuf, ivlen) != ivlen) { 7777c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 7787c478bd9Sstevel@tonic-gate "failed to get initialization " 7797c478bd9Sstevel@tonic-gate "vector from input file.")); 7807c478bd9Sstevel@tonic-gate goto cleanup; 7817c478bd9Sstevel@tonic-gate } 7827c478bd9Sstevel@tonic-gate if (read(infd, salt, sizeof (salt)) 7837c478bd9Sstevel@tonic-gate != sizeof (salt)) { 7847c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 7857c478bd9Sstevel@tonic-gate "failed to get salt data from " 7867c478bd9Sstevel@tonic-gate "input file.")); 7877c478bd9Sstevel@tonic-gate goto cleanup; 7887c478bd9Sstevel@tonic-gate } 7897c478bd9Sstevel@tonic-gate break; 7907c478bd9Sstevel@tonic-gate default: 7917c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 7927c478bd9Sstevel@tonic-gate "Unrecognized format version read from " 7937c478bd9Sstevel@tonic-gate "input file - expected %d, got %d."), 7947c478bd9Sstevel@tonic-gate SUNW_ENCRYPT_FILE_VERSION, version); 7957c478bd9Sstevel@tonic-gate goto cleanup; 7967c478bd9Sstevel@tonic-gate } 7977c478bd9Sstevel@tonic-gate } 798c197cb9dShylee 7997c478bd9Sstevel@tonic-gate /* 800c197cb9dShylee * If Kflag is set, let's find the token key now. 801c197cb9dShylee * 802c197cb9dShylee * If Kflag is not set and if encrypting, we need some random 8037c478bd9Sstevel@tonic-gate * salt data to create the key. If decrypting, 8047c478bd9Sstevel@tonic-gate * the salt should come from head of the file 8057c478bd9Sstevel@tonic-gate * to be decrypted. 8067c478bd9Sstevel@tonic-gate */ 807c197cb9dShylee if (Kflag) { 808c197cb9dShylee rv = get_token_key(hSession, keytype, key_label, pkeydata, 809c197cb9dShylee keysize, &key); 810c197cb9dShylee if (rv != CKR_OK) { 811c197cb9dShylee cryptoerror(LOG_STDERR, gettext( 812c197cb9dShylee "Can not find the token key")); 813c197cb9dShylee goto cleanup; 814c197cb9dShylee } else { 815c197cb9dShylee goto do_crypto; 816c197cb9dShylee } 817c197cb9dShylee } else if (cmd->type == CKA_ENCRYPT) { 8187b79d846SDina K Nimeh rv = pkcs11_get_urandom((void *)salt, sizeof (salt)); 8197c478bd9Sstevel@tonic-gate if (rv != 0) { 8207c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 8217c478bd9Sstevel@tonic-gate gettext("unable to generate random " 8227c478bd9Sstevel@tonic-gate "data for key salt.")); 8237c478bd9Sstevel@tonic-gate goto cleanup; 8247c478bd9Sstevel@tonic-gate } 8257c478bd9Sstevel@tonic-gate } 8267c478bd9Sstevel@tonic-gate 827c197cb9dShylee 8287c478bd9Sstevel@tonic-gate /* 8297c478bd9Sstevel@tonic-gate * If key input is read from a file, treat it as 8307c478bd9Sstevel@tonic-gate * raw key data, unless it is to be used with RC4, 8317c478bd9Sstevel@tonic-gate * in which case it must be used to generate a pkcs5 8327c478bd9Sstevel@tonic-gate * key to address security concerns with RC4 keys. 8337c478bd9Sstevel@tonic-gate */ 8347c478bd9Sstevel@tonic-gate if (kflag && keyfile != NULL && keytype != CKK_RC4) { 8351c9bd843Sdinak /* XXX : why wasn't SUNW_C_KeyToObject used here? */ 8367c478bd9Sstevel@tonic-gate CK_OBJECT_CLASS objclass = CKO_SECRET_KEY; 8377c478bd9Sstevel@tonic-gate CK_ATTRIBUTE template[5]; 8387c478bd9Sstevel@tonic-gate int nattr = 0; 8397c478bd9Sstevel@tonic-gate 8407c478bd9Sstevel@tonic-gate template[nattr].type = CKA_CLASS; 8417c478bd9Sstevel@tonic-gate template[nattr].pValue = &objclass; 8427c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (objclass); 8437c478bd9Sstevel@tonic-gate nattr++; 8447c478bd9Sstevel@tonic-gate 8457c478bd9Sstevel@tonic-gate template[nattr].type = CKA_KEY_TYPE; 8467c478bd9Sstevel@tonic-gate template[nattr].pValue = &keytype; 8477c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (keytype); 8487c478bd9Sstevel@tonic-gate nattr++; 8497c478bd9Sstevel@tonic-gate 8507c478bd9Sstevel@tonic-gate template[nattr].type = cmd->type; 8517c478bd9Sstevel@tonic-gate template[nattr].pValue = &truevalue; 8527c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (truevalue); 8537c478bd9Sstevel@tonic-gate nattr++; 8547c478bd9Sstevel@tonic-gate 8557c478bd9Sstevel@tonic-gate template[nattr].type = CKA_TOKEN; 8567c478bd9Sstevel@tonic-gate template[nattr].pValue = &falsevalue; 8577c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (falsevalue); 8587c478bd9Sstevel@tonic-gate nattr++; 8597c478bd9Sstevel@tonic-gate 8607c478bd9Sstevel@tonic-gate template[nattr].type = CKA_VALUE; 8617c478bd9Sstevel@tonic-gate template[nattr].pValue = pkeydata; 8627c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = keysize; 8637c478bd9Sstevel@tonic-gate nattr++; 8647c478bd9Sstevel@tonic-gate 86530a5e8faSwyllys rv = C_CreateObject(hSession, template, nattr, &key); 8667c478bd9Sstevel@tonic-gate } else { 8677c478bd9Sstevel@tonic-gate /* 8687c478bd9Sstevel@tonic-gate * If the encryption type has a fixed key length, 8697c478bd9Sstevel@tonic-gate * then its not necessary to set the key length 8707c478bd9Sstevel@tonic-gate * parameter when generating the key. 8717c478bd9Sstevel@tonic-gate */ 8727c478bd9Sstevel@tonic-gate if (keytype == CKK_DES || keytype == CKK_DES3) 8737c478bd9Sstevel@tonic-gate keylen = 0; 8747c478bd9Sstevel@tonic-gate else 8757c478bd9Sstevel@tonic-gate keylen = 16; 8767c478bd9Sstevel@tonic-gate 8777c478bd9Sstevel@tonic-gate /* 8787c478bd9Sstevel@tonic-gate * Generate a cryptographically secure key using 8797c478bd9Sstevel@tonic-gate * the key read from the file given (-k keyfile) or 8807c478bd9Sstevel@tonic-gate * the passphrase entered by the user. 8817c478bd9Sstevel@tonic-gate */ 8821c9bd843Sdinak rv = pkcs11_PasswdToPBKD2Object(hSession, (char *)pkeydata, 8831c9bd843Sdinak (size_t)keysize, (void *)salt, sizeof (salt), iterations, 8841c9bd843Sdinak keytype, keylen, cmd->flags, &key); 8857c478bd9Sstevel@tonic-gate } 8867c478bd9Sstevel@tonic-gate 8877c478bd9Sstevel@tonic-gate if (rv != CKR_OK) { 8887c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 8897c478bd9Sstevel@tonic-gate "failed to generate a key: %s"), 8907c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 8917c478bd9Sstevel@tonic-gate goto cleanup; 8927c478bd9Sstevel@tonic-gate } 8937c478bd9Sstevel@tonic-gate 894c197cb9dShylee 895c197cb9dShylee do_crypto: 8967c478bd9Sstevel@tonic-gate /* Setup up mechanism */ 8977c478bd9Sstevel@tonic-gate mech.mechanism = mech_type; 8987c478bd9Sstevel@tonic-gate mech.pParameter = (CK_VOID_PTR)pivbuf; 8997c478bd9Sstevel@tonic-gate mech.ulParameterLen = ivlen; 9007c478bd9Sstevel@tonic-gate 9017c478bd9Sstevel@tonic-gate if ((rv = cmd->Init(hSession, &mech, key)) != CKR_OK) { 9027c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 9037c478bd9Sstevel@tonic-gate "failed to initialize crypto operation: %s"), 9047c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 9057c478bd9Sstevel@tonic-gate goto cleanup; 9067c478bd9Sstevel@tonic-gate } 9077c478bd9Sstevel@tonic-gate 9087c478bd9Sstevel@tonic-gate /* Write the version header encrypt command */ 9097c478bd9Sstevel@tonic-gate if (cmd->type == CKA_ENCRYPT) { 9107c478bd9Sstevel@tonic-gate /* convert to network order for storage */ 911b54157c1Sda73024 uint32_t netversion = htonl(version); 912b54157c1Sda73024 uint32_t netiter; 9137c478bd9Sstevel@tonic-gate 9147c478bd9Sstevel@tonic-gate if (write(outfd, &netversion, sizeof (netversion)) 9157c478bd9Sstevel@tonic-gate != sizeof (netversion)) { 9167c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 9177c478bd9Sstevel@tonic-gate "failed to write version number " 9187c478bd9Sstevel@tonic-gate "to output file.")); 9197c478bd9Sstevel@tonic-gate goto cleanup; 9207c478bd9Sstevel@tonic-gate } 9217c478bd9Sstevel@tonic-gate /* 9227c478bd9Sstevel@tonic-gate * Write the iteration and salt data, even if they 9237c478bd9Sstevel@tonic-gate * were not used to generate a key. 9247c478bd9Sstevel@tonic-gate */ 9257c478bd9Sstevel@tonic-gate netiter = htonl(iterations); 9267c478bd9Sstevel@tonic-gate if (write(outfd, &netiter, 9277c478bd9Sstevel@tonic-gate sizeof (netiter)) != sizeof (netiter)) { 9287c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 9297c478bd9Sstevel@tonic-gate "failed to write iterations to output")); 9307c478bd9Sstevel@tonic-gate goto cleanup; 9317c478bd9Sstevel@tonic-gate } 93230a5e8faSwyllys if (ivlen > 0 && write(outfd, pivbuf, ivlen) != ivlen) { 9337c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 9347c478bd9Sstevel@tonic-gate "failed to write initialization vector " 9357c478bd9Sstevel@tonic-gate "to output")); 9367c478bd9Sstevel@tonic-gate goto cleanup; 9377c478bd9Sstevel@tonic-gate } 9387c478bd9Sstevel@tonic-gate if (write(outfd, salt, sizeof (salt)) != sizeof (salt)) { 9397c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 9407c478bd9Sstevel@tonic-gate "failed to write salt data to output")); 9417c478bd9Sstevel@tonic-gate goto cleanup; 9427c478bd9Sstevel@tonic-gate } 9437c478bd9Sstevel@tonic-gate } 9447c478bd9Sstevel@tonic-gate 94554da5c1fSjk115741 if (crypt_multipart(cmd, hSession, infd, outfd, insbuf.st_size) == -1) { 9467c478bd9Sstevel@tonic-gate goto cleanup; 9477c478bd9Sstevel@tonic-gate } 9487c478bd9Sstevel@tonic-gate 9497c478bd9Sstevel@tonic-gate errflag = B_FALSE; 9507c478bd9Sstevel@tonic-gate 9517c478bd9Sstevel@tonic-gate /* 9527c478bd9Sstevel@tonic-gate * Clean up 9537c478bd9Sstevel@tonic-gate */ 9547c478bd9Sstevel@tonic-gate cleanup: 9557c478bd9Sstevel@tonic-gate /* Clear the key data, so others cannot snoop */ 9567c478bd9Sstevel@tonic-gate if (pkeydata != NULL) { 9577c478bd9Sstevel@tonic-gate bzero(pkeydata, keysize); 9587c478bd9Sstevel@tonic-gate free(pkeydata); 9597c478bd9Sstevel@tonic-gate pkeydata = NULL; 9607c478bd9Sstevel@tonic-gate } 9617c478bd9Sstevel@tonic-gate 9627c478bd9Sstevel@tonic-gate /* Destroy key object */ 963c197cb9dShylee if (Kflag != B_FALSE && key != (CK_OBJECT_HANDLE) 0) { 9647c478bd9Sstevel@tonic-gate (void) C_DestroyObject(hSession, key); 9657c478bd9Sstevel@tonic-gate } 9667c478bd9Sstevel@tonic-gate 9677c478bd9Sstevel@tonic-gate /* free allocated memory */ 9687c478bd9Sstevel@tonic-gate if (pSlotList != NULL) 9697c478bd9Sstevel@tonic-gate free(pSlotList); 9707c478bd9Sstevel@tonic-gate if (pivbuf != NULL) 9717c478bd9Sstevel@tonic-gate free(pivbuf); 9727c478bd9Sstevel@tonic-gate 9737c478bd9Sstevel@tonic-gate /* close all the files */ 97454da5c1fSjk115741 if (iflag && (infd != -1)) 9757c478bd9Sstevel@tonic-gate (void) close(infd); 97654da5c1fSjk115741 if (oflag && (outfd != -1)) 9777c478bd9Sstevel@tonic-gate (void) close(outfd); 9787c478bd9Sstevel@tonic-gate 9797c478bd9Sstevel@tonic-gate /* rename tmp output to input file */ 9807c478bd9Sstevel@tonic-gate if (inoutsame) { 9817c478bd9Sstevel@tonic-gate if (rename(outfilename, inputfile) == -1) { 9827c478bd9Sstevel@tonic-gate (void) unlink(outfilename); 9837c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("rename failed.")); 9847c478bd9Sstevel@tonic-gate } 9857c478bd9Sstevel@tonic-gate } 9867c478bd9Sstevel@tonic-gate 9879a2817adSValerie Bubb Fenwick /* If error occurred and the file was new, remove the output file */ 9889a2817adSValerie Bubb Fenwick if (errflag && (outfilename != NULL) && !leavefilealone) { 9897c478bd9Sstevel@tonic-gate (void) unlink(outfilename); 9907c478bd9Sstevel@tonic-gate } 9917c478bd9Sstevel@tonic-gate 9927c478bd9Sstevel@tonic-gate /* close pkcs11 session */ 9937c478bd9Sstevel@tonic-gate if (hSession != CK_INVALID_HANDLE) 9947c478bd9Sstevel@tonic-gate (void) C_CloseSession(hSession); 9957c478bd9Sstevel@tonic-gate 9967c478bd9Sstevel@tonic-gate (void) C_Finalize(NULL); 9977c478bd9Sstevel@tonic-gate 9987c478bd9Sstevel@tonic-gate return (errflag); 9997c478bd9Sstevel@tonic-gate } 10007c478bd9Sstevel@tonic-gate 10017c478bd9Sstevel@tonic-gate /* 10027c478bd9Sstevel@tonic-gate * Function for printing progress bar when the verbose flag 10037c478bd9Sstevel@tonic-gate * is set. 10047c478bd9Sstevel@tonic-gate * 10057c478bd9Sstevel@tonic-gate * The vertical bar is printed at 25, 50, and 75% complete. 10067c478bd9Sstevel@tonic-gate * 10077c478bd9Sstevel@tonic-gate * The function is passed the number of positions on the screen it needs to 10087c478bd9Sstevel@tonic-gate * advance and loops. 10097c478bd9Sstevel@tonic-gate */ 10107c478bd9Sstevel@tonic-gate 10117c478bd9Sstevel@tonic-gate static void 10127c478bd9Sstevel@tonic-gate print_status(int pos_to_advance) 10137c478bd9Sstevel@tonic-gate { 10147c478bd9Sstevel@tonic-gate 10157c478bd9Sstevel@tonic-gate while (pos_to_advance > 0) { 10167c478bd9Sstevel@tonic-gate switch (status_pos) { 10177c478bd9Sstevel@tonic-gate case 0: 10187c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("[")); 10197c478bd9Sstevel@tonic-gate break; 10207c478bd9Sstevel@tonic-gate case 19: 10217c478bd9Sstevel@tonic-gate case 39: 10227c478bd9Sstevel@tonic-gate case 59: 10237c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext("|")); 10247c478bd9Sstevel@tonic-gate break; 10257c478bd9Sstevel@tonic-gate default: 10267c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext(".")); 10277c478bd9Sstevel@tonic-gate } 10287c478bd9Sstevel@tonic-gate pos_to_advance--; 10297c478bd9Sstevel@tonic-gate status_pos++; 10307c478bd9Sstevel@tonic-gate } 10317c478bd9Sstevel@tonic-gate } 10327c478bd9Sstevel@tonic-gate 10337c478bd9Sstevel@tonic-gate /* 10347c478bd9Sstevel@tonic-gate * Encrypt/Decrypt in multi part. 10357c478bd9Sstevel@tonic-gate * 10367c478bd9Sstevel@tonic-gate * This function reads the input file (infd) and writes the 10377c478bd9Sstevel@tonic-gate * encrypted/decrypted output to file (outfd). 10387c478bd9Sstevel@tonic-gate * 10397c478bd9Sstevel@tonic-gate * cmd - pointing to commandinfo 10407c478bd9Sstevel@tonic-gate * hSession - pkcs session 10417c478bd9Sstevel@tonic-gate * infd - input file descriptor 10427c478bd9Sstevel@tonic-gate * outfd - output file descriptor 10437c478bd9Sstevel@tonic-gate * 10447c478bd9Sstevel@tonic-gate */ 10457c478bd9Sstevel@tonic-gate 10467c478bd9Sstevel@tonic-gate static int 10477c478bd9Sstevel@tonic-gate crypt_multipart(struct CommandInfo *cmd, CK_SESSION_HANDLE hSession, 104854da5c1fSjk115741 int infd, int outfd, off_t insize) 10497c478bd9Sstevel@tonic-gate { 10507c478bd9Sstevel@tonic-gate CK_RV rv; 10517c478bd9Sstevel@tonic-gate CK_ULONG resultlen; 10527c478bd9Sstevel@tonic-gate CK_ULONG resultbuflen; 10537c478bd9Sstevel@tonic-gate CK_BYTE_PTR resultbuf; 10547c478bd9Sstevel@tonic-gate CK_ULONG datalen; 10557c478bd9Sstevel@tonic-gate CK_BYTE databuf[BUFFERSIZE]; 10567c478bd9Sstevel@tonic-gate CK_BYTE outbuf[BUFFERSIZE+BLOCKSIZE]; 10577c478bd9Sstevel@tonic-gate CK_ULONG status_index = 0; /* current total file size read */ 10587c478bd9Sstevel@tonic-gate float status_last = 0.0; /* file size of last element used */ 10597c478bd9Sstevel@tonic-gate float status_incr = 0.0; /* file size element increments */ 10607c478bd9Sstevel@tonic-gate int pos; /* # of progress bar elements to be print */ 10617c478bd9Sstevel@tonic-gate ssize_t nread; 10627c478bd9Sstevel@tonic-gate boolean_t errflag = B_FALSE; 10637c478bd9Sstevel@tonic-gate 10647c478bd9Sstevel@tonic-gate datalen = sizeof (databuf); 10657c478bd9Sstevel@tonic-gate resultbuflen = sizeof (outbuf); 10667c478bd9Sstevel@tonic-gate resultbuf = outbuf; 10677c478bd9Sstevel@tonic-gate 10687c478bd9Sstevel@tonic-gate /* Divide into 79 increments for progress bar element spacing */ 10697c478bd9Sstevel@tonic-gate if (vflag && iflag) 107054da5c1fSjk115741 status_incr = (insize / 79.0); 10717c478bd9Sstevel@tonic-gate 10727c478bd9Sstevel@tonic-gate while ((nread = read(infd, databuf, datalen)) > 0) { 10737c478bd9Sstevel@tonic-gate 10747c478bd9Sstevel@tonic-gate /* Start with the initial buffer */ 10757c478bd9Sstevel@tonic-gate resultlen = resultbuflen; 10767c478bd9Sstevel@tonic-gate rv = cmd->Update(hSession, databuf, (CK_ULONG)nread, 10777c478bd9Sstevel@tonic-gate resultbuf, &resultlen); 10787c478bd9Sstevel@tonic-gate 10797c478bd9Sstevel@tonic-gate /* Need a bigger buffer? */ 10807c478bd9Sstevel@tonic-gate if (rv == CKR_BUFFER_TOO_SMALL) { 10817c478bd9Sstevel@tonic-gate 10827c478bd9Sstevel@tonic-gate /* free the old buffer */ 10837c478bd9Sstevel@tonic-gate if (resultbuf != NULL && resultbuf != outbuf) { 10847c478bd9Sstevel@tonic-gate bzero(resultbuf, resultbuflen); 10857c478bd9Sstevel@tonic-gate free(resultbuf); 10867c478bd9Sstevel@tonic-gate } 10877c478bd9Sstevel@tonic-gate 10887c478bd9Sstevel@tonic-gate /* allocate a new big buffer */ 10897c478bd9Sstevel@tonic-gate if ((resultbuf = malloc((size_t)resultlen)) == NULL) { 10907c478bd9Sstevel@tonic-gate int err = errno; 10917c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("malloc: %s"), 10927c478bd9Sstevel@tonic-gate strerror(err)); 10937c478bd9Sstevel@tonic-gate return (-1); 10947c478bd9Sstevel@tonic-gate } 10957c478bd9Sstevel@tonic-gate resultbuflen = resultlen; 10967c478bd9Sstevel@tonic-gate 10977c478bd9Sstevel@tonic-gate /* Try again with bigger buffer */ 10987c478bd9Sstevel@tonic-gate rv = cmd->Update(hSession, databuf, (CK_ULONG)nread, 10997c478bd9Sstevel@tonic-gate resultbuf, &resultlen); 11007c478bd9Sstevel@tonic-gate } 11017c478bd9Sstevel@tonic-gate 11027c478bd9Sstevel@tonic-gate if (rv != CKR_OK) { 11037c478bd9Sstevel@tonic-gate errflag = B_TRUE; 11047c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 11057c478bd9Sstevel@tonic-gate "crypto operation failed: %s"), 11067c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 11077c478bd9Sstevel@tonic-gate break; 11087c478bd9Sstevel@tonic-gate } 11097c478bd9Sstevel@tonic-gate 11107c478bd9Sstevel@tonic-gate /* write the output */ 11117c478bd9Sstevel@tonic-gate if (write(outfd, resultbuf, resultlen) != resultlen) { 11127c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 11137c478bd9Sstevel@tonic-gate "failed to write result to output file.")); 11147c478bd9Sstevel@tonic-gate errflag = B_TRUE; 11157c478bd9Sstevel@tonic-gate break; 11167c478bd9Sstevel@tonic-gate } 11177c478bd9Sstevel@tonic-gate 11187c478bd9Sstevel@tonic-gate if (vflag) { 11197c478bd9Sstevel@tonic-gate status_index += resultlen; 11207c478bd9Sstevel@tonic-gate 11217c478bd9Sstevel@tonic-gate /* 11227c478bd9Sstevel@tonic-gate * If input is from stdin, do a our own progress bar 11237c478bd9Sstevel@tonic-gate * by printing periods at a pre-defined increment 11247c478bd9Sstevel@tonic-gate * until the file is done. 11257c478bd9Sstevel@tonic-gate */ 11267c478bd9Sstevel@tonic-gate if (!iflag) { 11277c478bd9Sstevel@tonic-gate 11287c478bd9Sstevel@tonic-gate /* 11297c478bd9Sstevel@tonic-gate * Print at least 1 element in case the file 11307c478bd9Sstevel@tonic-gate * is small, it looks better than nothing. 11317c478bd9Sstevel@tonic-gate */ 11327c478bd9Sstevel@tonic-gate if (status_pos == 0) { 11337c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext(".")); 11347c478bd9Sstevel@tonic-gate status_pos = 1; 11357c478bd9Sstevel@tonic-gate } 11367c478bd9Sstevel@tonic-gate 1137f2728256SKrishna Yenduri while ((status_index - status_last) > 11387c478bd9Sstevel@tonic-gate (PROGRESSSIZE)) { 11397c478bd9Sstevel@tonic-gate (void) fprintf(stderr, gettext(".")); 1140f2728256SKrishna Yenduri status_last += PROGRESSSIZE; 11417c478bd9Sstevel@tonic-gate } 11427c478bd9Sstevel@tonic-gate continue; 11437c478bd9Sstevel@tonic-gate } 11447c478bd9Sstevel@tonic-gate 11457c478bd9Sstevel@tonic-gate /* Calculate the number of elements need to be print */ 114654da5c1fSjk115741 if (insize <= BUFFERSIZE) 11477c478bd9Sstevel@tonic-gate pos = 78; 11487c478bd9Sstevel@tonic-gate else 11497c478bd9Sstevel@tonic-gate pos = (int)((status_index - status_last) / 11507c478bd9Sstevel@tonic-gate status_incr); 11517c478bd9Sstevel@tonic-gate 11527c478bd9Sstevel@tonic-gate /* Add progress bar elements, if needed */ 11537c478bd9Sstevel@tonic-gate if (pos > 0) { 11547c478bd9Sstevel@tonic-gate print_status(pos); 11557c478bd9Sstevel@tonic-gate status_last += (status_incr * pos); 11567c478bd9Sstevel@tonic-gate } 11577c478bd9Sstevel@tonic-gate } 11587c478bd9Sstevel@tonic-gate } 11597c478bd9Sstevel@tonic-gate 11607c478bd9Sstevel@tonic-gate /* Print verbose completion */ 11617c478bd9Sstevel@tonic-gate if (vflag) { 11627c478bd9Sstevel@tonic-gate if (iflag) 11637c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "]"); 11647c478bd9Sstevel@tonic-gate 11657c478bd9Sstevel@tonic-gate (void) fprintf(stderr, "\n%s\n", gettext("Done.")); 11667c478bd9Sstevel@tonic-gate } 11677c478bd9Sstevel@tonic-gate 11687c478bd9Sstevel@tonic-gate /* Error in reading */ 11697c478bd9Sstevel@tonic-gate if (nread == -1) { 11707c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 11717c478bd9Sstevel@tonic-gate "error reading from input file")); 11727c478bd9Sstevel@tonic-gate errflag = B_TRUE; 11737c478bd9Sstevel@tonic-gate } 11747c478bd9Sstevel@tonic-gate 11757c478bd9Sstevel@tonic-gate if (!errflag) { 11767c478bd9Sstevel@tonic-gate 11777c478bd9Sstevel@tonic-gate /* Do the final part */ 11787c478bd9Sstevel@tonic-gate 11797c478bd9Sstevel@tonic-gate rv = cmd->Final(hSession, resultbuf, &resultlen); 11807c478bd9Sstevel@tonic-gate 11817c478bd9Sstevel@tonic-gate if (rv == CKR_OK) { 11827c478bd9Sstevel@tonic-gate /* write the output */ 11837c478bd9Sstevel@tonic-gate if (write(outfd, resultbuf, resultlen) != resultlen) { 11847c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 11857c478bd9Sstevel@tonic-gate "failed to write result to output file.")); 11867c478bd9Sstevel@tonic-gate errflag = B_TRUE; 11877c478bd9Sstevel@tonic-gate } 11887c478bd9Sstevel@tonic-gate } else { 11897c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 11907c478bd9Sstevel@tonic-gate "crypto operation failed: %s"), 11917c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 11927c478bd9Sstevel@tonic-gate errflag = B_TRUE; 11937c478bd9Sstevel@tonic-gate } 11947c478bd9Sstevel@tonic-gate 11957c478bd9Sstevel@tonic-gate } 11967c478bd9Sstevel@tonic-gate 11977c478bd9Sstevel@tonic-gate if (resultbuf != NULL && resultbuf != outbuf) { 11987c478bd9Sstevel@tonic-gate bzero(resultbuf, resultbuflen); 11997c478bd9Sstevel@tonic-gate free(resultbuf); 12007c478bd9Sstevel@tonic-gate } 12017c478bd9Sstevel@tonic-gate 12027c478bd9Sstevel@tonic-gate if (errflag) { 12037c478bd9Sstevel@tonic-gate return (-1); 12047c478bd9Sstevel@tonic-gate } else { 12057c478bd9Sstevel@tonic-gate return (0); 12067c478bd9Sstevel@tonic-gate } 12077c478bd9Sstevel@tonic-gate } 1208