17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5c197cb9dShylee * Common Development and Distribution License (the "License"). 6c197cb9dShylee * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 217c478bd9Sstevel@tonic-gate /* 22*55553f71Sda73024 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 237c478bd9Sstevel@tonic-gate * Use is subject to license terms. 247c478bd9Sstevel@tonic-gate */ 257c478bd9Sstevel@tonic-gate 267c478bd9Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 277c478bd9Sstevel@tonic-gate 287c478bd9Sstevel@tonic-gate /* 297c478bd9Sstevel@tonic-gate * digest.c 307c478bd9Sstevel@tonic-gate * 317c478bd9Sstevel@tonic-gate * Implements digest(1) and mac(1) commands 327c478bd9Sstevel@tonic-gate * If command name is mac, performs mac operation 337c478bd9Sstevel@tonic-gate * else perform digest operation 347c478bd9Sstevel@tonic-gate * 357c478bd9Sstevel@tonic-gate * See the man pages for digest and mac for details on 367c478bd9Sstevel@tonic-gate * how these commands work. 377c478bd9Sstevel@tonic-gate */ 387c478bd9Sstevel@tonic-gate 397c478bd9Sstevel@tonic-gate #include <stdio.h> 407c478bd9Sstevel@tonic-gate #include <stdlib.h> 417c478bd9Sstevel@tonic-gate #include <unistd.h> 427c478bd9Sstevel@tonic-gate #include <fcntl.h> 437c478bd9Sstevel@tonic-gate #include <ctype.h> 447c478bd9Sstevel@tonic-gate #include <strings.h> 457c478bd9Sstevel@tonic-gate #include <libintl.h> 467c478bd9Sstevel@tonic-gate #include <libgen.h> 477c478bd9Sstevel@tonic-gate #include <locale.h> 487c478bd9Sstevel@tonic-gate #include <errno.h> 497c478bd9Sstevel@tonic-gate #include <sys/types.h> 507c478bd9Sstevel@tonic-gate #include <sys/stat.h> 517c478bd9Sstevel@tonic-gate #include <security/cryptoki.h> 527c478bd9Sstevel@tonic-gate #include <limits.h> 537c478bd9Sstevel@tonic-gate #include <cryptoutil.h> 54c197cb9dShylee #include <kmfapi.h> 557c478bd9Sstevel@tonic-gate 567c478bd9Sstevel@tonic-gate #define BUFFERSIZE (4096) /* Buffer size for reading file */ 577c478bd9Sstevel@tonic-gate 587c478bd9Sstevel@tonic-gate /* 597c478bd9Sstevel@tonic-gate * RESULTLEN - large enough size in bytes to hold result for 607c478bd9Sstevel@tonic-gate * digest and mac results for all mechanisms 617c478bd9Sstevel@tonic-gate */ 627c478bd9Sstevel@tonic-gate #define RESULTLEN (512) 637c478bd9Sstevel@tonic-gate 647c478bd9Sstevel@tonic-gate /* 657c478bd9Sstevel@tonic-gate * Exit Status codes 667c478bd9Sstevel@tonic-gate */ 677c478bd9Sstevel@tonic-gate #ifndef EXIT_SUCCESS 687c478bd9Sstevel@tonic-gate #define EXIT_SUCCESS 0 /* No errors */ 697c478bd9Sstevel@tonic-gate #define EXIT_FAILURE 1 /* All errors except usage */ 707c478bd9Sstevel@tonic-gate #endif /* EXIT_SUCCESS */ 717c478bd9Sstevel@tonic-gate 727c478bd9Sstevel@tonic-gate #define EXIT_USAGE 2 /* usage/syntax error */ 737c478bd9Sstevel@tonic-gate 747c478bd9Sstevel@tonic-gate #define MAC_NAME "mac" /* name of mac command */ 75c197cb9dShylee #define MAC_OPTIONS "lva:k:T:K:" /* for getopt */ 767c478bd9Sstevel@tonic-gate #define DIGEST_NAME "digest" /* name of mac command */ 777c478bd9Sstevel@tonic-gate #define DIGEST_OPTIONS "lva:" /* for getopt */ 787c478bd9Sstevel@tonic-gate 797c478bd9Sstevel@tonic-gate static boolean_t vflag = B_FALSE; /* -v (verbose) flag, optional */ 807c478bd9Sstevel@tonic-gate static boolean_t aflag = B_FALSE; /* -a <algorithm> flag, required */ 817c478bd9Sstevel@tonic-gate static boolean_t lflag = B_FALSE; /* -l flag, for mac and digest */ 82c197cb9dShylee static boolean_t kflag = B_FALSE; 83c197cb9dShylee static boolean_t Tflag = B_FALSE; 84c197cb9dShylee static boolean_t Kflag = B_FALSE; 857c478bd9Sstevel@tonic-gate 867c478bd9Sstevel@tonic-gate static char *keyfile = NULL; /* name of keyfile */ 87c197cb9dShylee static char *token_label = NULL; 88c197cb9dShylee static char *key_label = NULL; 89c197cb9dShylee 907c478bd9Sstevel@tonic-gate static CK_BYTE buf[BUFFERSIZE]; 917c478bd9Sstevel@tonic-gate 927c478bd9Sstevel@tonic-gate struct mech_alias { 937c478bd9Sstevel@tonic-gate CK_MECHANISM_TYPE type; 947c478bd9Sstevel@tonic-gate char *alias; 957c478bd9Sstevel@tonic-gate CK_ULONG keysize_min; 967c478bd9Sstevel@tonic-gate CK_ULONG keysize_max; 977c478bd9Sstevel@tonic-gate int keysize_unit; 987c478bd9Sstevel@tonic-gate boolean_t available; 997c478bd9Sstevel@tonic-gate }; 1007c478bd9Sstevel@tonic-gate 101f66d273dSizick #define MECH_ALIASES_COUNT 11 1027c478bd9Sstevel@tonic-gate 1037c478bd9Sstevel@tonic-gate static struct mech_alias mech_aliases[] = { 1047c478bd9Sstevel@tonic-gate { CKM_SHA_1, "sha1", ULONG_MAX, 0L, 8, B_FALSE }, 1057c478bd9Sstevel@tonic-gate { CKM_MD5, "md5", ULONG_MAX, 0L, 8, B_FALSE }, 1067c478bd9Sstevel@tonic-gate { CKM_DES_MAC, "des_mac", ULONG_MAX, 0L, 8, B_FALSE }, 1077c478bd9Sstevel@tonic-gate { CKM_SHA_1_HMAC, "sha1_hmac", ULONG_MAX, 0L, 8, B_FALSE }, 1087c478bd9Sstevel@tonic-gate { CKM_MD5_HMAC, "md5_hmac", ULONG_MAX, 0L, 8, B_FALSE }, 109f66d273dSizick { CKM_SHA256, "sha256", ULONG_MAX, 0L, 8, B_FALSE }, 110f66d273dSizick { CKM_SHA384, "sha384", ULONG_MAX, 0L, 8, B_FALSE }, 111f66d273dSizick { CKM_SHA512, "sha512", ULONG_MAX, 0L, 8, B_FALSE }, 112f66d273dSizick { CKM_SHA256_HMAC, "sha256_hmac", ULONG_MAX, 0L, 8, B_FALSE }, 113f66d273dSizick { CKM_SHA384_HMAC, "sha384_hmac", ULONG_MAX, 0L, 8, B_FALSE }, 114f66d273dSizick { CKM_SHA512_HMAC, "sha512_hmac", ULONG_MAX, 0L, 8, B_FALSE } 1157c478bd9Sstevel@tonic-gate }; 1167c478bd9Sstevel@tonic-gate 1177c478bd9Sstevel@tonic-gate static CK_BBOOL true = TRUE; 1187c478bd9Sstevel@tonic-gate 1197c478bd9Sstevel@tonic-gate static void usage(boolean_t mac_cmd); 1207c478bd9Sstevel@tonic-gate static int execute_cmd(char *algo_str, int filecount, 1217c478bd9Sstevel@tonic-gate char **filelist, boolean_t mac_cmd); 1227c478bd9Sstevel@tonic-gate static CK_RV do_mac(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pmech, 1237c478bd9Sstevel@tonic-gate int fd, CK_OBJECT_HANDLE key, CK_BYTE_PTR *psignature, 1247c478bd9Sstevel@tonic-gate CK_ULONG_PTR psignaturelen); 1257c478bd9Sstevel@tonic-gate static CK_RV do_digest(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pmech, 1267c478bd9Sstevel@tonic-gate int fd, CK_BYTE_PTR *pdigest, CK_ULONG_PTR pdigestlen); 1277c478bd9Sstevel@tonic-gate 1287c478bd9Sstevel@tonic-gate int 1297c478bd9Sstevel@tonic-gate main(int argc, char **argv) 1307c478bd9Sstevel@tonic-gate { 1317c478bd9Sstevel@tonic-gate 1327c478bd9Sstevel@tonic-gate extern char *optarg; 1337c478bd9Sstevel@tonic-gate extern int optind; 1347c478bd9Sstevel@tonic-gate int errflag = 0; /* We had an optstr parse error */ 1357c478bd9Sstevel@tonic-gate char c; /* current getopts flag */ 1367c478bd9Sstevel@tonic-gate char *algo_str; /* mechanism/algorithm string */ 1377c478bd9Sstevel@tonic-gate int filecount; 1387c478bd9Sstevel@tonic-gate boolean_t mac_cmd; /* if TRUE, do mac, else do digest */ 1397c478bd9Sstevel@tonic-gate char *optstr; 1407c478bd9Sstevel@tonic-gate char **filelist; /* list of files */ 1417c478bd9Sstevel@tonic-gate char *cmdname = NULL; /* name of command */ 1427c478bd9Sstevel@tonic-gate 1437c478bd9Sstevel@tonic-gate (void) setlocale(LC_ALL, ""); 1447c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN) /* Should be defiend by cc -D */ 1457c478bd9Sstevel@tonic-gate #define TEXT_DOMAIN "SYS_TEST" /* Use this only if it weren't */ 1467c478bd9Sstevel@tonic-gate #endif 1477c478bd9Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 1487c478bd9Sstevel@tonic-gate 1497c478bd9Sstevel@tonic-gate /* 1507c478bd9Sstevel@tonic-gate * Based on command name, determine 1517c478bd9Sstevel@tonic-gate * type of command. mac is mac 1527c478bd9Sstevel@tonic-gate * everything else is digest. 1537c478bd9Sstevel@tonic-gate */ 1547c478bd9Sstevel@tonic-gate cmdname = basename(argv[0]); 1557c478bd9Sstevel@tonic-gate 1567c478bd9Sstevel@tonic-gate cryptodebug_init(cmdname); 1577c478bd9Sstevel@tonic-gate 1587c478bd9Sstevel@tonic-gate if (strcmp(cmdname, MAC_NAME) == 0) 1597c478bd9Sstevel@tonic-gate mac_cmd = B_TRUE; 1607c478bd9Sstevel@tonic-gate else if (strcmp(cmdname, DIGEST_NAME) == 0) 1617c478bd9Sstevel@tonic-gate mac_cmd = B_FALSE; 1627c478bd9Sstevel@tonic-gate else { 1637c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 1647c478bd9Sstevel@tonic-gate "command name must be either digest or mac\n")); 1657c478bd9Sstevel@tonic-gate exit(EXIT_USAGE); 1667c478bd9Sstevel@tonic-gate } 1677c478bd9Sstevel@tonic-gate 1687c478bd9Sstevel@tonic-gate if (mac_cmd) { 1697c478bd9Sstevel@tonic-gate optstr = MAC_OPTIONS; 1707c478bd9Sstevel@tonic-gate } else { 1717c478bd9Sstevel@tonic-gate optstr = DIGEST_OPTIONS; 1727c478bd9Sstevel@tonic-gate } 1737c478bd9Sstevel@tonic-gate 1747c478bd9Sstevel@tonic-gate /* Parse command line arguments */ 1757c478bd9Sstevel@tonic-gate while (!errflag && (c = getopt(argc, argv, optstr)) != -1) { 1767c478bd9Sstevel@tonic-gate 1777c478bd9Sstevel@tonic-gate switch (c) { 1787c478bd9Sstevel@tonic-gate case 'v': 1797c478bd9Sstevel@tonic-gate vflag = B_TRUE; 1807c478bd9Sstevel@tonic-gate break; 1817c478bd9Sstevel@tonic-gate case 'a': 1827c478bd9Sstevel@tonic-gate aflag = B_TRUE; 1837c478bd9Sstevel@tonic-gate algo_str = optarg; 1847c478bd9Sstevel@tonic-gate break; 1857c478bd9Sstevel@tonic-gate case 'k': 186c197cb9dShylee kflag = B_TRUE; 1877c478bd9Sstevel@tonic-gate keyfile = optarg; 1887c478bd9Sstevel@tonic-gate break; 1897c478bd9Sstevel@tonic-gate case 'l': 1907c478bd9Sstevel@tonic-gate lflag = B_TRUE; 1917c478bd9Sstevel@tonic-gate break; 192c197cb9dShylee case 'T': 193c197cb9dShylee Tflag = B_TRUE; 194c197cb9dShylee token_label = optarg; 195c197cb9dShylee break; 196c197cb9dShylee case 'K': 197c197cb9dShylee Kflag = B_TRUE; 198c197cb9dShylee key_label = optarg; 199c197cb9dShylee break; 2007c478bd9Sstevel@tonic-gate default: 2017c478bd9Sstevel@tonic-gate errflag++; 2027c478bd9Sstevel@tonic-gate } 2037c478bd9Sstevel@tonic-gate } 2047c478bd9Sstevel@tonic-gate 2057c478bd9Sstevel@tonic-gate filecount = argc - optind; 2067c478bd9Sstevel@tonic-gate if (errflag || (!aflag && !lflag) || (lflag && argc > 2) || 207c197cb9dShylee (kflag && Kflag) || (Tflag && !Kflag) || filecount < 0) { 2087c478bd9Sstevel@tonic-gate usage(mac_cmd); 2097c478bd9Sstevel@tonic-gate exit(EXIT_USAGE); 2107c478bd9Sstevel@tonic-gate } 2117c478bd9Sstevel@tonic-gate 2127c478bd9Sstevel@tonic-gate if (filecount == 0) { 2137c478bd9Sstevel@tonic-gate filelist = NULL; 2147c478bd9Sstevel@tonic-gate } else { 2157c478bd9Sstevel@tonic-gate filelist = &argv[optind]; 2167c478bd9Sstevel@tonic-gate } 2177c478bd9Sstevel@tonic-gate 2187c478bd9Sstevel@tonic-gate return (execute_cmd(algo_str, filecount, filelist, mac_cmd)); 2197c478bd9Sstevel@tonic-gate } 2207c478bd9Sstevel@tonic-gate 2217c478bd9Sstevel@tonic-gate /* 2227c478bd9Sstevel@tonic-gate * usage message for digest/mac 2237c478bd9Sstevel@tonic-gate */ 2247c478bd9Sstevel@tonic-gate static void 2257c478bd9Sstevel@tonic-gate usage(boolean_t mac_cmd) 2267c478bd9Sstevel@tonic-gate { 227c197cb9dShylee (void) fprintf(stderr, gettext("Usage:\n")); 2287c478bd9Sstevel@tonic-gate if (mac_cmd) { 229c197cb9dShylee (void) fprintf(stderr, gettext(" mac -l\n")); 230c197cb9dShylee (void) fprintf(stderr, gettext(" mac [-v] -a <algorithm> " 231c197cb9dShylee "[-k <keyfile> | -K <keylabel> [-T <tokenspec>]] " 232c197cb9dShylee "[file...]\n")); 2337c478bd9Sstevel@tonic-gate } else { 234c197cb9dShylee (void) fprintf(stderr, gettext(" digest -l | [-v] " 235c197cb9dShylee "-a <algorithm> [file...]\n")); 2367c478bd9Sstevel@tonic-gate } 2377c478bd9Sstevel@tonic-gate } 2387c478bd9Sstevel@tonic-gate 2397c478bd9Sstevel@tonic-gate /* 2407c478bd9Sstevel@tonic-gate * Print out list of available algorithms. 2417c478bd9Sstevel@tonic-gate */ 2427c478bd9Sstevel@tonic-gate static void 2437c478bd9Sstevel@tonic-gate algorithm_list(boolean_t mac_cmd) 2447c478bd9Sstevel@tonic-gate { 2457c478bd9Sstevel@tonic-gate int mech; 2467c478bd9Sstevel@tonic-gate 2477c478bd9Sstevel@tonic-gate if (mac_cmd) 2487c478bd9Sstevel@tonic-gate (void) printf(gettext("Algorithm Keysize: Min " 2497c478bd9Sstevel@tonic-gate "Max (bits)\n" 2507c478bd9Sstevel@tonic-gate "------------------------------------------\n")); 2517c478bd9Sstevel@tonic-gate 2527c478bd9Sstevel@tonic-gate for (mech = 0; mech < MECH_ALIASES_COUNT; mech++) { 2537c478bd9Sstevel@tonic-gate 2547c478bd9Sstevel@tonic-gate if (mech_aliases[mech].available == B_FALSE) 2557c478bd9Sstevel@tonic-gate continue; 2567c478bd9Sstevel@tonic-gate 2577c478bd9Sstevel@tonic-gate if (mac_cmd) { 2587c478bd9Sstevel@tonic-gate (void) printf("%-15s", mech_aliases[mech].alias); 2597c478bd9Sstevel@tonic-gate 2607c478bd9Sstevel@tonic-gate if (mech_aliases[mech].keysize_min != ULONG_MAX && 2617c478bd9Sstevel@tonic-gate mech_aliases[mech].keysize_max != 0) 2627c478bd9Sstevel@tonic-gate (void) printf(" %5lu %5lu\n", 2637c478bd9Sstevel@tonic-gate (mech_aliases[mech].keysize_min * 2647c478bd9Sstevel@tonic-gate mech_aliases[mech].keysize_unit), 2657c478bd9Sstevel@tonic-gate (mech_aliases[mech].keysize_max * 2667c478bd9Sstevel@tonic-gate mech_aliases[mech].keysize_unit)); 2677c478bd9Sstevel@tonic-gate else 2687c478bd9Sstevel@tonic-gate (void) printf("\n"); 2697c478bd9Sstevel@tonic-gate 2707c478bd9Sstevel@tonic-gate } else 2717c478bd9Sstevel@tonic-gate (void) printf("%s\n", mech_aliases[mech].alias); 2727c478bd9Sstevel@tonic-gate 2737c478bd9Sstevel@tonic-gate } 2747c478bd9Sstevel@tonic-gate } 2757c478bd9Sstevel@tonic-gate 276c197cb9dShylee static int 277c197cb9dShylee get_token_key(CK_SESSION_HANDLE hSession, CK_KEY_TYPE keytype, 278c197cb9dShylee char *keylabel, CK_BYTE *password, int password_len, 279c197cb9dShylee CK_OBJECT_HANDLE *keyobj) 280c197cb9dShylee { 281c197cb9dShylee CK_RV rv; 282c197cb9dShylee CK_ATTRIBUTE pTmpl[10]; 283c197cb9dShylee CK_OBJECT_CLASS class = CKO_SECRET_KEY; 284c197cb9dShylee CK_BBOOL true = 1; 285c197cb9dShylee CK_BBOOL is_token = 1; 286c197cb9dShylee CK_ULONG key_obj_count = 1; 287c197cb9dShylee int i; 288c197cb9dShylee CK_KEY_TYPE ckKeyType = keytype; 289c197cb9dShylee 290c197cb9dShylee 291c197cb9dShylee rv = C_Login(hSession, CKU_USER, (CK_UTF8CHAR_PTR)password, 292c197cb9dShylee password_len); 293c197cb9dShylee if (rv != CKR_OK) { 294c197cb9dShylee (void) fprintf(stderr, "Cannot login to the token." 295c197cb9dShylee " error = %s\n", pkcs11_strerror(rv)); 296c197cb9dShylee return (-1); 297c197cb9dShylee } 298c197cb9dShylee 299c197cb9dShylee i = 0; 300c197cb9dShylee pTmpl[i].type = CKA_TOKEN; 301c197cb9dShylee pTmpl[i].pValue = &is_token; 302c197cb9dShylee pTmpl[i].ulValueLen = sizeof (CK_BBOOL); 303c197cb9dShylee i++; 304c197cb9dShylee 305c197cb9dShylee pTmpl[i].type = CKA_CLASS; 306c197cb9dShylee pTmpl[i].pValue = &class; 307c197cb9dShylee pTmpl[i].ulValueLen = sizeof (class); 308c197cb9dShylee i++; 309c197cb9dShylee 310c197cb9dShylee pTmpl[i].type = CKA_LABEL; 311c197cb9dShylee pTmpl[i].pValue = keylabel; 312c197cb9dShylee pTmpl[i].ulValueLen = strlen(keylabel); 313c197cb9dShylee i++; 314c197cb9dShylee 315c197cb9dShylee pTmpl[i].type = CKA_KEY_TYPE; 316c197cb9dShylee pTmpl[i].pValue = &ckKeyType; 317c197cb9dShylee pTmpl[i].ulValueLen = sizeof (ckKeyType); 318c197cb9dShylee i++; 319c197cb9dShylee 320c197cb9dShylee pTmpl[i].type = CKA_PRIVATE; 321c197cb9dShylee pTmpl[i].pValue = &true; 322c197cb9dShylee pTmpl[i].ulValueLen = sizeof (true); 323c197cb9dShylee i++; 324c197cb9dShylee 325c197cb9dShylee rv = C_FindObjectsInit(hSession, pTmpl, i); 326c197cb9dShylee if (rv != CKR_OK) { 327c197cb9dShylee goto out; 328c197cb9dShylee } 329c197cb9dShylee 330c197cb9dShylee rv = C_FindObjects(hSession, keyobj, 1, &key_obj_count); 331c197cb9dShylee (void) C_FindObjectsFinal(hSession); 332c197cb9dShylee 333c197cb9dShylee out: 334c197cb9dShylee if (rv != CKR_OK) { 335c197cb9dShylee (void) fprintf(stderr, 336c197cb9dShylee "Cannot retrieve key object. error = %s\n", 337c197cb9dShylee pkcs11_strerror(rv)); 338c197cb9dShylee return (-1); 339c197cb9dShylee } 340c197cb9dShylee 341c197cb9dShylee if (key_obj_count == 0) { 342c197cb9dShylee (void) fprintf(stderr, "Cannot find the key object.\n"); 343c197cb9dShylee return (-1); 344c197cb9dShylee } 345c197cb9dShylee 346c197cb9dShylee return (0); 347c197cb9dShylee } 348c197cb9dShylee 349c197cb9dShylee 3507c478bd9Sstevel@tonic-gate /* 3517c478bd9Sstevel@tonic-gate * Execute the command. 3527c478bd9Sstevel@tonic-gate * algo_str - name of algorithm 3537c478bd9Sstevel@tonic-gate * filecount - no. of files to process, if 0, use stdin 3547c478bd9Sstevel@tonic-gate * filelist - list of files 3557c478bd9Sstevel@tonic-gate * mac_cmd - if true do mac else do digest 3567c478bd9Sstevel@tonic-gate */ 3577c478bd9Sstevel@tonic-gate static int 3587c478bd9Sstevel@tonic-gate execute_cmd(char *algo_str, int filecount, char **filelist, boolean_t mac_cmd) 3597c478bd9Sstevel@tonic-gate { 3607c478bd9Sstevel@tonic-gate int fd; 3617c478bd9Sstevel@tonic-gate char *filename = NULL; 3627c478bd9Sstevel@tonic-gate CK_RV rv; 3637c478bd9Sstevel@tonic-gate CK_ULONG slotcount; 3647c478bd9Sstevel@tonic-gate CK_SLOT_ID slotID; 3657c478bd9Sstevel@tonic-gate CK_SLOT_ID_PTR pSlotList = NULL; 3667c478bd9Sstevel@tonic-gate CK_MECHANISM_TYPE mech_type; 3677c478bd9Sstevel@tonic-gate CK_MECHANISM_INFO info; 3687c478bd9Sstevel@tonic-gate CK_MECHANISM mech; 3697c478bd9Sstevel@tonic-gate CK_SESSION_HANDLE hSession = CK_INVALID_HANDLE; 3707c478bd9Sstevel@tonic-gate CK_BYTE_PTR resultbuf = NULL; 3717c478bd9Sstevel@tonic-gate CK_ULONG resultlen; 3727c478bd9Sstevel@tonic-gate CK_BYTE_PTR pkeydata = NULL; 3737c478bd9Sstevel@tonic-gate CK_OBJECT_HANDLE key = (CK_OBJECT_HANDLE) 0; 374*55553f71Sda73024 size_t keylen = 0; /* key length */ 3757c478bd9Sstevel@tonic-gate char *resultstr = NULL; /* result in hex string */ 3767c478bd9Sstevel@tonic-gate int resultstrlen; /* result string length */ 3777c478bd9Sstevel@tonic-gate int i; 3787c478bd9Sstevel@tonic-gate int exitcode = EXIT_SUCCESS; /* return code */ 3797c478bd9Sstevel@tonic-gate int slot, mek; /* index variables */ 3807c478bd9Sstevel@tonic-gate int mech_match = 0; 3811c9bd843Sdinak CK_BYTE salt[CK_PKCS5_PBKD2_SALT_SIZE]; 3827c478bd9Sstevel@tonic-gate CK_ULONG keysize; 3831c9bd843Sdinak CK_ULONG iterations = CK_PKCS5_PBKD2_ITERATIONS; 384c197cb9dShylee CK_KEY_TYPE keytype; 385c197cb9dShylee KMF_RETURN kmfrv; 386c197cb9dShylee CK_SLOT_ID token_slot_id; 3877c478bd9Sstevel@tonic-gate 3887c478bd9Sstevel@tonic-gate if (aflag) { 3897c478bd9Sstevel@tonic-gate /* 3907c478bd9Sstevel@tonic-gate * Determine if algorithm/mechanism is valid 3917c478bd9Sstevel@tonic-gate */ 3927c478bd9Sstevel@tonic-gate for (mech_match = 0; mech_match < MECH_ALIASES_COUNT; 3937c478bd9Sstevel@tonic-gate mech_match++) { 3947c478bd9Sstevel@tonic-gate if (strcmp(algo_str, 3957c478bd9Sstevel@tonic-gate mech_aliases[mech_match].alias) == 0) { 3967c478bd9Sstevel@tonic-gate mech_type = mech_aliases[mech_match].type; 3977c478bd9Sstevel@tonic-gate break; 3987c478bd9Sstevel@tonic-gate } 3997c478bd9Sstevel@tonic-gate 4007c478bd9Sstevel@tonic-gate } 4017c478bd9Sstevel@tonic-gate 4027c478bd9Sstevel@tonic-gate if (mech_match == MECH_ALIASES_COUNT) { 4037c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 4047c478bd9Sstevel@tonic-gate gettext("unknown algorithm -- %s"), algo_str); 4057c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 4067c478bd9Sstevel@tonic-gate } 4077c478bd9Sstevel@tonic-gate 4087c478bd9Sstevel@tonic-gate /* Get key to do a MAC operation */ 4097c478bd9Sstevel@tonic-gate if (mac_cmd) { 410c197cb9dShylee int status; 411c197cb9dShylee 4121c9bd843Sdinak if (Kflag) { 4131c9bd843Sdinak /* get the pin of the token */ 414c197cb9dShylee if (token_label == NULL || 415c197cb9dShylee !strlen(token_label)) { 4161c9bd843Sdinak token_label = pkcs11_default_token(); 417c197cb9dShylee } 418c197cb9dShylee 4191c9bd843Sdinak status = pkcs11_get_pass(token_label, 420*55553f71Sda73024 (char **)&pkeydata, &keylen, 4211c9bd843Sdinak 0, B_FALSE); 4221c9bd843Sdinak } else if (keyfile != NULL) { 4231c9bd843Sdinak /* get the key file */ 4241c9bd843Sdinak status = pkcs11_read_data(keyfile, 425*55553f71Sda73024 (void **)&pkeydata, &keylen); 426c197cb9dShylee } else { 4271c9bd843Sdinak /* get the key from input */ 4281c9bd843Sdinak status = pkcs11_get_pass(NULL, 429*55553f71Sda73024 (char **)&pkeydata, &keylen, 4301c9bd843Sdinak 0, B_FALSE); 4311c9bd843Sdinak } 4321c9bd843Sdinak 4331c9bd843Sdinak if (status == -1 || keylen == 0 || pkeydata == NULL) { 4347c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 4351c9bd843Sdinak Kflag ? gettext("invalid passphrase.") : 4367c478bd9Sstevel@tonic-gate gettext("invalid key.")); 4377c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 4387c478bd9Sstevel@tonic-gate } 4397c478bd9Sstevel@tonic-gate } 4407c478bd9Sstevel@tonic-gate } 4417c478bd9Sstevel@tonic-gate 4427c478bd9Sstevel@tonic-gate /* Initialize, and get list of slots */ 443c197cb9dShylee rv = C_Initialize(NULL); 444c197cb9dShylee if (rv != CKR_OK && rv != CKR_CRYPTOKI_ALREADY_INITIALIZED) { 4457c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 4467c478bd9Sstevel@tonic-gate gettext("failed to initialize PKCS #11 framework: %s"), 4477c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 4487c478bd9Sstevel@tonic-gate return (EXIT_FAILURE); 4497c478bd9Sstevel@tonic-gate } 4507c478bd9Sstevel@tonic-gate 4517c478bd9Sstevel@tonic-gate /* Get slot count */ 4527c478bd9Sstevel@tonic-gate rv = C_GetSlotList(0, NULL_PTR, &slotcount); 4537c478bd9Sstevel@tonic-gate if (rv != CKR_OK || slotcount == 0) { 4547c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 4557c478bd9Sstevel@tonic-gate "failed to find any cryptographic provider," 4567c478bd9Sstevel@tonic-gate "please check with your system administrator: %s"), 4577c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 4587c478bd9Sstevel@tonic-gate exitcode = EXIT_FAILURE; 4597c478bd9Sstevel@tonic-gate goto cleanup; 4607c478bd9Sstevel@tonic-gate } 4617c478bd9Sstevel@tonic-gate 4627c478bd9Sstevel@tonic-gate /* Found at least one slot, allocate memory for slot list */ 4637c478bd9Sstevel@tonic-gate pSlotList = malloc(slotcount * sizeof (CK_SLOT_ID)); 4647c478bd9Sstevel@tonic-gate if (pSlotList == NULL_PTR) { 4657c478bd9Sstevel@tonic-gate int err = errno; 4667c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("malloc: %s\n"), 4677c478bd9Sstevel@tonic-gate strerror(err)); 4687c478bd9Sstevel@tonic-gate exitcode = EXIT_FAILURE; 4697c478bd9Sstevel@tonic-gate goto cleanup; 4707c478bd9Sstevel@tonic-gate } 4717c478bd9Sstevel@tonic-gate 4727c478bd9Sstevel@tonic-gate /* Get the list of slots */ 4737c478bd9Sstevel@tonic-gate if ((rv = C_GetSlotList(0, pSlotList, &slotcount)) != CKR_OK) { 4747c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 4757c478bd9Sstevel@tonic-gate "failed to find any cryptographic provider," 4767c478bd9Sstevel@tonic-gate "please check with your system administrator: %s"), 4777c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 4787c478bd9Sstevel@tonic-gate exitcode = EXIT_FAILURE; 4797c478bd9Sstevel@tonic-gate goto cleanup; 4807c478bd9Sstevel@tonic-gate } 4817c478bd9Sstevel@tonic-gate 4827c478bd9Sstevel@tonic-gate /* 4837c478bd9Sstevel@tonic-gate * Obtain list of algorithms if -l option was given 4847c478bd9Sstevel@tonic-gate */ 4857c478bd9Sstevel@tonic-gate if (lflag) { 4867c478bd9Sstevel@tonic-gate 4877c478bd9Sstevel@tonic-gate for (slot = 0; slot < slotcount; slot++) { 4887c478bd9Sstevel@tonic-gate 4897c478bd9Sstevel@tonic-gate /* Iterate through each mechanism */ 4907c478bd9Sstevel@tonic-gate for (mek = 0; mek < MECH_ALIASES_COUNT; mek++) { 4917c478bd9Sstevel@tonic-gate rv = C_GetMechanismInfo(pSlotList[slot], 4927c478bd9Sstevel@tonic-gate mech_aliases[mek].type, &info); 4937c478bd9Sstevel@tonic-gate 4947c478bd9Sstevel@tonic-gate /* Only check algorithms that can be used */ 4957c478bd9Sstevel@tonic-gate if ((rv != CKR_OK) || 4967c478bd9Sstevel@tonic-gate (!mac_cmd && (info.flags & CKF_SIGN)) || 4977c478bd9Sstevel@tonic-gate (mac_cmd && (info.flags & CKF_DIGEST))) 4987c478bd9Sstevel@tonic-gate continue; 4997c478bd9Sstevel@tonic-gate 5007c478bd9Sstevel@tonic-gate /* 5017c478bd9Sstevel@tonic-gate * Set to minimum/maximum key sizes assuming 5027c478bd9Sstevel@tonic-gate * the values available are not 0. 5037c478bd9Sstevel@tonic-gate */ 5047c478bd9Sstevel@tonic-gate if (info.ulMinKeySize && (info.ulMinKeySize < 5057c478bd9Sstevel@tonic-gate mech_aliases[mek].keysize_min)) 5067c478bd9Sstevel@tonic-gate mech_aliases[mek].keysize_min = 5077c478bd9Sstevel@tonic-gate info.ulMinKeySize; 5087c478bd9Sstevel@tonic-gate 5097c478bd9Sstevel@tonic-gate if (info.ulMaxKeySize && (info.ulMaxKeySize > 5107c478bd9Sstevel@tonic-gate mech_aliases[mek].keysize_max)) 5117c478bd9Sstevel@tonic-gate mech_aliases[mek].keysize_max = 5127c478bd9Sstevel@tonic-gate info.ulMaxKeySize; 5137c478bd9Sstevel@tonic-gate 5147c478bd9Sstevel@tonic-gate mech_aliases[mek].available = B_TRUE; 5157c478bd9Sstevel@tonic-gate } 5167c478bd9Sstevel@tonic-gate 5177c478bd9Sstevel@tonic-gate } 5187c478bd9Sstevel@tonic-gate 5197c478bd9Sstevel@tonic-gate algorithm_list(mac_cmd); 5207c478bd9Sstevel@tonic-gate 5217c478bd9Sstevel@tonic-gate goto cleanup; 5227c478bd9Sstevel@tonic-gate } 5237c478bd9Sstevel@tonic-gate 524c197cb9dShylee /* 525c197cb9dShylee * Find a slot with matching mechanism 526c197cb9dShylee * 527c197cb9dShylee * If -K is specified, we find the slot id for the token first, then 528c197cb9dShylee * check if the slot supports the algorithm. 529c197cb9dShylee */ 530c197cb9dShylee i = 0; 531c197cb9dShylee if (Kflag) { 53230a5e8faSwyllys kmfrv = kmf_pk11_token_lookup(NULL, token_label, 53330a5e8faSwyllys &token_slot_id); 534c197cb9dShylee if (kmfrv != KMF_OK) { 535c197cb9dShylee cryptoerror(LOG_STDERR, 536c197cb9dShylee gettext("no matching PKCS#11 token")); 537c197cb9dShylee exitcode = EXIT_FAILURE; 538c197cb9dShylee goto cleanup; 539c197cb9dShylee } 540c197cb9dShylee rv = C_GetMechanismInfo(token_slot_id, mech_type, &info); 541c197cb9dShylee if (rv == CKR_OK && (info.flags & CKF_SIGN)) 542c197cb9dShylee slotID = token_slot_id; 543c197cb9dShylee else 544c197cb9dShylee i = slotcount; 545c197cb9dShylee 546c197cb9dShylee } else { 5477c478bd9Sstevel@tonic-gate for (i = 0; i < slotcount; i++) { 5487c478bd9Sstevel@tonic-gate slotID = pSlotList[i]; 5497c478bd9Sstevel@tonic-gate rv = C_GetMechanismInfo(slotID, mech_type, &info); 5507c478bd9Sstevel@tonic-gate if (rv != CKR_OK) { 5517c478bd9Sstevel@tonic-gate continue; /* to the next slot */ 5527c478bd9Sstevel@tonic-gate } else { 5537c478bd9Sstevel@tonic-gate if (mac_cmd) { 5547c478bd9Sstevel@tonic-gate /* 5557c478bd9Sstevel@tonic-gate * Make sure the slot supports 5567c478bd9Sstevel@tonic-gate * PKCS5 key generation if we 5577c478bd9Sstevel@tonic-gate * will be using it later. 5587c478bd9Sstevel@tonic-gate * We use it whenever the key 5597c478bd9Sstevel@tonic-gate * is entered at command line. 5607c478bd9Sstevel@tonic-gate */ 5617c478bd9Sstevel@tonic-gate if ((info.flags & CKF_SIGN) && 5627c478bd9Sstevel@tonic-gate (keyfile == NULL)) { 5637c478bd9Sstevel@tonic-gate CK_MECHANISM_INFO kg_info; 5647c478bd9Sstevel@tonic-gate rv = C_GetMechanismInfo(slotID, 5657c478bd9Sstevel@tonic-gate CKM_PKCS5_PBKD2, &kg_info); 5667c478bd9Sstevel@tonic-gate if (rv == CKR_OK) 5677c478bd9Sstevel@tonic-gate break; 5687c478bd9Sstevel@tonic-gate } else if (info.flags & CKF_SIGN) { 5697c478bd9Sstevel@tonic-gate break; 5707c478bd9Sstevel@tonic-gate } 5717c478bd9Sstevel@tonic-gate } else { 5727c478bd9Sstevel@tonic-gate if (info.flags & CKF_DIGEST) 5737c478bd9Sstevel@tonic-gate break; 5747c478bd9Sstevel@tonic-gate } 5757c478bd9Sstevel@tonic-gate } 5767c478bd9Sstevel@tonic-gate } 577c197cb9dShylee } 5787c478bd9Sstevel@tonic-gate 5797c478bd9Sstevel@tonic-gate /* Show error if no matching mechanism found */ 5807c478bd9Sstevel@tonic-gate if (i == slotcount) { 5817c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 5827c478bd9Sstevel@tonic-gate gettext("no cryptographic provider was " 5837c478bd9Sstevel@tonic-gate "found for this algorithm -- %s"), algo_str); 5847c478bd9Sstevel@tonic-gate exitcode = EXIT_FAILURE; 5857c478bd9Sstevel@tonic-gate goto cleanup; 5867c478bd9Sstevel@tonic-gate } 5877c478bd9Sstevel@tonic-gate 5887c478bd9Sstevel@tonic-gate /* Mechanism is supported. Go ahead & open a session */ 5897c478bd9Sstevel@tonic-gate rv = C_OpenSession(slotID, CKF_SERIAL_SESSION, 5907c478bd9Sstevel@tonic-gate NULL_PTR, NULL, &hSession); 5917c478bd9Sstevel@tonic-gate 5927c478bd9Sstevel@tonic-gate if (rv != CKR_OK) { 5937c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 5947c478bd9Sstevel@tonic-gate gettext("can not open PKCS#11 session: %s"), 5957c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 5967c478bd9Sstevel@tonic-gate exitcode = EXIT_FAILURE; 5977c478bd9Sstevel@tonic-gate goto cleanup; 5987c478bd9Sstevel@tonic-gate } 5997c478bd9Sstevel@tonic-gate 6007c478bd9Sstevel@tonic-gate /* Create a key object for mac operation */ 6017c478bd9Sstevel@tonic-gate if (mac_cmd) { 6027c478bd9Sstevel@tonic-gate /* 6037c478bd9Sstevel@tonic-gate * If we read keybytes from a file, 6047c478bd9Sstevel@tonic-gate * do NOT process them with C_GenerateKey, 6057c478bd9Sstevel@tonic-gate * treat them as raw keydata bytes and 6067c478bd9Sstevel@tonic-gate * create a key object for them. 6077c478bd9Sstevel@tonic-gate */ 6087c478bd9Sstevel@tonic-gate if (keyfile) { 6091c9bd843Sdinak /* XXX : why wasn't SUNW_C_KeyToObject used here? */ 6107c478bd9Sstevel@tonic-gate CK_OBJECT_CLASS class = CKO_SECRET_KEY; 6117c478bd9Sstevel@tonic-gate CK_KEY_TYPE tmpl_keytype = CKK_GENERIC_SECRET; 6127c478bd9Sstevel@tonic-gate CK_BBOOL false = FALSE; 6137c478bd9Sstevel@tonic-gate int nattr = 0; 6147c478bd9Sstevel@tonic-gate CK_ATTRIBUTE template[5]; 6157c478bd9Sstevel@tonic-gate 6167c478bd9Sstevel@tonic-gate if (mech_type == CKM_DES_MAC) { 6177c478bd9Sstevel@tonic-gate tmpl_keytype = CKK_DES; 6187c478bd9Sstevel@tonic-gate } 6197c478bd9Sstevel@tonic-gate template[nattr].type = CKA_CLASS; 6207c478bd9Sstevel@tonic-gate template[nattr].pValue = &class; 6217c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (class); 6227c478bd9Sstevel@tonic-gate nattr++; 6237c478bd9Sstevel@tonic-gate 6247c478bd9Sstevel@tonic-gate template[nattr].type = CKA_KEY_TYPE; 6257c478bd9Sstevel@tonic-gate template[nattr].pValue = &tmpl_keytype; 6267c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (tmpl_keytype); 6277c478bd9Sstevel@tonic-gate nattr++; 6287c478bd9Sstevel@tonic-gate 6297c478bd9Sstevel@tonic-gate template[nattr].type = CKA_SIGN; 6307c478bd9Sstevel@tonic-gate template[nattr].pValue = &true; 6317c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (true); 6327c478bd9Sstevel@tonic-gate nattr++; 6337c478bd9Sstevel@tonic-gate 6347c478bd9Sstevel@tonic-gate template[nattr].type = CKA_TOKEN; 6357c478bd9Sstevel@tonic-gate template[nattr].pValue = &false; 6367c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (false); 6377c478bd9Sstevel@tonic-gate nattr++; 6387c478bd9Sstevel@tonic-gate 6397c478bd9Sstevel@tonic-gate template[nattr].type = CKA_VALUE; 6407c478bd9Sstevel@tonic-gate template[nattr].pValue = pkeydata; 6417c478bd9Sstevel@tonic-gate template[nattr].ulValueLen = keylen; 6427c478bd9Sstevel@tonic-gate nattr++; 6437c478bd9Sstevel@tonic-gate 64430a5e8faSwyllys rv = C_CreateObject(hSession, template, nattr, &key); 645c197cb9dShylee 646c197cb9dShylee } else if (Kflag) { 647c197cb9dShylee 648c197cb9dShylee if (mech_type == CKM_DES_MAC) { 649c197cb9dShylee keytype = CKK_DES; 650c197cb9dShylee } else { 651c197cb9dShylee keytype = CKK_GENERIC_SECRET; 652c197cb9dShylee } 653c197cb9dShylee 654c197cb9dShylee rv = get_token_key(hSession, keytype, key_label, 655c197cb9dShylee pkeydata, keylen, &key); 656c197cb9dShylee if (rv != CKR_OK) { 657c197cb9dShylee exitcode = EXIT_FAILURE; 658c197cb9dShylee goto cleanup; 659c197cb9dShylee } 6607c478bd9Sstevel@tonic-gate } else { 6617c478bd9Sstevel@tonic-gate CK_KEY_TYPE keytype; 6627c478bd9Sstevel@tonic-gate if (mech_type == CKM_DES_MAC) { 6637c478bd9Sstevel@tonic-gate keytype = CKK_DES; 6647c478bd9Sstevel@tonic-gate keysize = 0; 6657c478bd9Sstevel@tonic-gate } else { 6667c478bd9Sstevel@tonic-gate keytype = CKK_GENERIC_SECRET; 6677c478bd9Sstevel@tonic-gate keysize = 16; /* 128 bits */ 6687c478bd9Sstevel@tonic-gate } 6697c478bd9Sstevel@tonic-gate /* 6707c478bd9Sstevel@tonic-gate * We use a fixed salt (0x0a, 0x0a, 0x0a ...) 6717c478bd9Sstevel@tonic-gate * for creating the key so that the end user 6727c478bd9Sstevel@tonic-gate * will be able to generate the same 'mac' 6737c478bd9Sstevel@tonic-gate * using the same passphrase. 6747c478bd9Sstevel@tonic-gate */ 6757c478bd9Sstevel@tonic-gate (void) memset(salt, 0x0a, sizeof (salt)); 6761c9bd843Sdinak rv = pkcs11_PasswdToPBKD2Object(hSession, 6771c9bd843Sdinak (char *)pkeydata, (size_t)keylen, (void *)salt, 6781c9bd843Sdinak sizeof (salt), iterations, keytype, keysize, 6791c9bd843Sdinak CKF_SIGN, &key); 6807c478bd9Sstevel@tonic-gate } 6817c478bd9Sstevel@tonic-gate 6827c478bd9Sstevel@tonic-gate if (rv != CKR_OK) { 6837c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 6847c478bd9Sstevel@tonic-gate gettext("unable to create key for crypto " 6857c478bd9Sstevel@tonic-gate "operation: %s"), pkcs11_strerror(rv)); 6867c478bd9Sstevel@tonic-gate exitcode = EXIT_FAILURE; 6877c478bd9Sstevel@tonic-gate goto cleanup; 6887c478bd9Sstevel@tonic-gate } 6897c478bd9Sstevel@tonic-gate } 6907c478bd9Sstevel@tonic-gate 6917c478bd9Sstevel@tonic-gate /* Allocate a buffer to store result. */ 6927c478bd9Sstevel@tonic-gate resultlen = RESULTLEN; 6937c478bd9Sstevel@tonic-gate if ((resultbuf = malloc(resultlen)) == NULL) { 6947c478bd9Sstevel@tonic-gate int err = errno; 6957c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("malloc: %s\n"), 6967c478bd9Sstevel@tonic-gate strerror(err)); 6977c478bd9Sstevel@tonic-gate exitcode = EXIT_FAILURE; 6987c478bd9Sstevel@tonic-gate goto cleanup; 6997c478bd9Sstevel@tonic-gate } 7007c478bd9Sstevel@tonic-gate 7017c478bd9Sstevel@tonic-gate /* Allocate a buffer to store result string */ 7027c478bd9Sstevel@tonic-gate resultstrlen = RESULTLEN; 7037c478bd9Sstevel@tonic-gate if ((resultstr = malloc(resultstrlen)) == NULL) { 7047c478bd9Sstevel@tonic-gate int err = errno; 7057c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("malloc: %s\n"), 7067c478bd9Sstevel@tonic-gate strerror(err)); 7077c478bd9Sstevel@tonic-gate exitcode = EXIT_FAILURE; 7087c478bd9Sstevel@tonic-gate goto cleanup; 7097c478bd9Sstevel@tonic-gate } 7107c478bd9Sstevel@tonic-gate 7117c478bd9Sstevel@tonic-gate mech.mechanism = mech_type; 7127c478bd9Sstevel@tonic-gate mech.pParameter = NULL_PTR; 7137c478bd9Sstevel@tonic-gate mech.ulParameterLen = 0; 7147c478bd9Sstevel@tonic-gate exitcode = EXIT_SUCCESS; 7157c478bd9Sstevel@tonic-gate i = 0; 7167c478bd9Sstevel@tonic-gate 7177c478bd9Sstevel@tonic-gate do { 7187c478bd9Sstevel@tonic-gate if (filecount > 0 && filelist != NULL) { 7197c478bd9Sstevel@tonic-gate filename = filelist[i]; 72030a5e8faSwyllys if ((fd = open(filename, O_RDONLY | O_NONBLOCK)) == 72130a5e8faSwyllys -1) { 7227c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 7237c478bd9Sstevel@tonic-gate "can not open input file %s\n"), filename); 7247c478bd9Sstevel@tonic-gate exitcode = EXIT_USAGE; 7257c478bd9Sstevel@tonic-gate continue; 7267c478bd9Sstevel@tonic-gate } 7277c478bd9Sstevel@tonic-gate } else { 7287c478bd9Sstevel@tonic-gate fd = 0; /* use stdin */ 7297c478bd9Sstevel@tonic-gate } 7307c478bd9Sstevel@tonic-gate 7317c478bd9Sstevel@tonic-gate /* 7327c478bd9Sstevel@tonic-gate * Perform the operation 7337c478bd9Sstevel@tonic-gate */ 7347c478bd9Sstevel@tonic-gate if (mac_cmd) { 7357c478bd9Sstevel@tonic-gate rv = do_mac(hSession, &mech, fd, key, &resultbuf, 7367c478bd9Sstevel@tonic-gate &resultlen); 7377c478bd9Sstevel@tonic-gate } else { 7387c478bd9Sstevel@tonic-gate rv = do_digest(hSession, &mech, fd, &resultbuf, 7397c478bd9Sstevel@tonic-gate &resultlen); 7407c478bd9Sstevel@tonic-gate } 7417c478bd9Sstevel@tonic-gate 7427c478bd9Sstevel@tonic-gate if (rv != CKR_OK) { 7437c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 7447c478bd9Sstevel@tonic-gate gettext("crypto operation failed for " 7457c478bd9Sstevel@tonic-gate "file %s: %s\n"), 7467c478bd9Sstevel@tonic-gate filename ? filename : "STDIN", 7477c478bd9Sstevel@tonic-gate pkcs11_strerror(rv)); 7487c478bd9Sstevel@tonic-gate exitcode = EXIT_FAILURE; 7497c478bd9Sstevel@tonic-gate continue; 7507c478bd9Sstevel@tonic-gate } 7517c478bd9Sstevel@tonic-gate 7527c478bd9Sstevel@tonic-gate /* if result size has changed, allocate a bigger resulstr buf */ 7537c478bd9Sstevel@tonic-gate if (resultlen != RESULTLEN) { 7547c478bd9Sstevel@tonic-gate resultstrlen = 2 * resultlen + 1; 7557c478bd9Sstevel@tonic-gate resultstr = realloc(resultstr, resultstrlen); 7567c478bd9Sstevel@tonic-gate 7577c478bd9Sstevel@tonic-gate if (resultstr == NULL) { 7587c478bd9Sstevel@tonic-gate int err = errno; 7597c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 7607c478bd9Sstevel@tonic-gate gettext("realloc: %s\n"), strerror(err)); 7617c478bd9Sstevel@tonic-gate exitcode = EXIT_FAILURE; 7627c478bd9Sstevel@tonic-gate goto cleanup; 7637c478bd9Sstevel@tonic-gate } 7647c478bd9Sstevel@tonic-gate } 7657c478bd9Sstevel@tonic-gate 7667c478bd9Sstevel@tonic-gate /* Output the result */ 7677c478bd9Sstevel@tonic-gate tohexstr(resultbuf, resultlen, resultstr, resultstrlen); 7687c478bd9Sstevel@tonic-gate 7697c478bd9Sstevel@tonic-gate /* Include mechanism name for verbose */ 7707c478bd9Sstevel@tonic-gate if (vflag) 7717c478bd9Sstevel@tonic-gate (void) fprintf(stdout, "%s ", algo_str); 7727c478bd9Sstevel@tonic-gate 7737c478bd9Sstevel@tonic-gate /* Include file name for multiple files, or if verbose */ 7747c478bd9Sstevel@tonic-gate if (filecount > 1 || (vflag && filecount > 0)) { 7757c478bd9Sstevel@tonic-gate (void) fprintf(stdout, "(%s) = ", filename); 7767c478bd9Sstevel@tonic-gate } 7777c478bd9Sstevel@tonic-gate 7787c478bd9Sstevel@tonic-gate (void) fprintf(stdout, "%s\n", resultstr); 7797c478bd9Sstevel@tonic-gate (void) close(fd); 7807c478bd9Sstevel@tonic-gate 7817c478bd9Sstevel@tonic-gate 7827c478bd9Sstevel@tonic-gate } while (++i < filecount); 7837c478bd9Sstevel@tonic-gate 7847c478bd9Sstevel@tonic-gate 7857c478bd9Sstevel@tonic-gate /* clear and free the key */ 7867c478bd9Sstevel@tonic-gate if (mac_cmd) { 7877c478bd9Sstevel@tonic-gate (void) memset(pkeydata, 0, keylen); 7887c478bd9Sstevel@tonic-gate free(pkeydata); 7897c478bd9Sstevel@tonic-gate pkeydata = NULL; 7907c478bd9Sstevel@tonic-gate } 7917c478bd9Sstevel@tonic-gate 7927c478bd9Sstevel@tonic-gate cleanup: 7937c478bd9Sstevel@tonic-gate if (resultbuf != NULL) { 7947c478bd9Sstevel@tonic-gate free(resultbuf); 7957c478bd9Sstevel@tonic-gate } 7967c478bd9Sstevel@tonic-gate 7977c478bd9Sstevel@tonic-gate if (resultstr != NULL) { 7987c478bd9Sstevel@tonic-gate free(resultstr); 7997c478bd9Sstevel@tonic-gate } 8007c478bd9Sstevel@tonic-gate 8017c478bd9Sstevel@tonic-gate if (pSlotList != NULL) { 8027c478bd9Sstevel@tonic-gate free(pSlotList); 8037c478bd9Sstevel@tonic-gate } 8047c478bd9Sstevel@tonic-gate 805c197cb9dShylee if (!Kflag && key != (CK_OBJECT_HANDLE) 0) { 8067c478bd9Sstevel@tonic-gate (void) C_DestroyObject(hSession, key); 8077c478bd9Sstevel@tonic-gate } 8087c478bd9Sstevel@tonic-gate 8097c478bd9Sstevel@tonic-gate if (hSession != CK_INVALID_HANDLE) 8107c478bd9Sstevel@tonic-gate (void) C_CloseSession(hSession); 8117c478bd9Sstevel@tonic-gate 8127c478bd9Sstevel@tonic-gate (void) C_Finalize(NULL_PTR); 8137c478bd9Sstevel@tonic-gate 8147c478bd9Sstevel@tonic-gate return (exitcode); 8157c478bd9Sstevel@tonic-gate } 8167c478bd9Sstevel@tonic-gate 8177c478bd9Sstevel@tonic-gate /* 8187c478bd9Sstevel@tonic-gate * do_digest - Compute digest of a file 8197c478bd9Sstevel@tonic-gate * 8207c478bd9Sstevel@tonic-gate * hSession - session 8217c478bd9Sstevel@tonic-gate * pmech - ptr to mechanism to be used for digest 8227c478bd9Sstevel@tonic-gate * fd - file descriptor 8237c478bd9Sstevel@tonic-gate * pdigest - buffer where digest result is returned 8247c478bd9Sstevel@tonic-gate * pdigestlen - length of digest buffer on input, 8257c478bd9Sstevel@tonic-gate * length of result on output 8267c478bd9Sstevel@tonic-gate */ 8277c478bd9Sstevel@tonic-gate static CK_RV 8287c478bd9Sstevel@tonic-gate do_digest(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pmech, 8297c478bd9Sstevel@tonic-gate int fd, CK_BYTE_PTR *pdigest, CK_ULONG_PTR pdigestlen) 8307c478bd9Sstevel@tonic-gate { 8317c478bd9Sstevel@tonic-gate CK_RV rv; 8327c478bd9Sstevel@tonic-gate ssize_t nread; 8337c478bd9Sstevel@tonic-gate int saved_errno; 8347c478bd9Sstevel@tonic-gate 8357c478bd9Sstevel@tonic-gate if ((rv = C_DigestInit(hSession, pmech)) != CKR_OK) { 8367c478bd9Sstevel@tonic-gate return (rv); 8377c478bd9Sstevel@tonic-gate } 8387c478bd9Sstevel@tonic-gate 8397c478bd9Sstevel@tonic-gate while ((nread = read(fd, buf, sizeof (buf))) > 0) { 8407c478bd9Sstevel@tonic-gate /* Get the digest */ 8417c478bd9Sstevel@tonic-gate rv = C_DigestUpdate(hSession, buf, (CK_ULONG)nread); 8427c478bd9Sstevel@tonic-gate if (rv != CKR_OK) 8437c478bd9Sstevel@tonic-gate return (rv); 8447c478bd9Sstevel@tonic-gate } 8457c478bd9Sstevel@tonic-gate 8467c478bd9Sstevel@tonic-gate saved_errno = errno; /* for later use */ 8477c478bd9Sstevel@tonic-gate 8487c478bd9Sstevel@tonic-gate /* 8497c478bd9Sstevel@tonic-gate * Perform the C_DigestFinal, even if there is a read error. 8507c478bd9Sstevel@tonic-gate * Otherwise C_DigestInit will return CKR_OPERATION_ACTIVE 8517c478bd9Sstevel@tonic-gate * next time it is called (for another file) 8527c478bd9Sstevel@tonic-gate */ 8537c478bd9Sstevel@tonic-gate 8547c478bd9Sstevel@tonic-gate rv = C_DigestFinal(hSession, *pdigest, pdigestlen); 8557c478bd9Sstevel@tonic-gate 8567c478bd9Sstevel@tonic-gate /* result too big to fit? Allocate a bigger buffer */ 8577c478bd9Sstevel@tonic-gate if (rv == CKR_BUFFER_TOO_SMALL) { 8587c478bd9Sstevel@tonic-gate *pdigest = realloc(*pdigest, *pdigestlen); 8597c478bd9Sstevel@tonic-gate 8607c478bd9Sstevel@tonic-gate if (*pdigest == NULL_PTR) { 8617c478bd9Sstevel@tonic-gate int err = errno; 8627c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 8637c478bd9Sstevel@tonic-gate gettext("realloc: %s\n"), strerror(err)); 8647c478bd9Sstevel@tonic-gate return (CKR_HOST_MEMORY); 8657c478bd9Sstevel@tonic-gate } 8667c478bd9Sstevel@tonic-gate 8677c478bd9Sstevel@tonic-gate rv = C_DigestFinal(hSession, *pdigest, pdigestlen); 8687c478bd9Sstevel@tonic-gate } 8697c478bd9Sstevel@tonic-gate 8707c478bd9Sstevel@tonic-gate 8717c478bd9Sstevel@tonic-gate /* There was a read error */ 8727c478bd9Sstevel@tonic-gate if (nread == -1) { 8737c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 8747c478bd9Sstevel@tonic-gate "error reading file: %s"), strerror(saved_errno)); 8757c478bd9Sstevel@tonic-gate return (CKR_GENERAL_ERROR); 8767c478bd9Sstevel@tonic-gate } else { 8777c478bd9Sstevel@tonic-gate return (rv); 8787c478bd9Sstevel@tonic-gate } 8797c478bd9Sstevel@tonic-gate } 8807c478bd9Sstevel@tonic-gate 8817c478bd9Sstevel@tonic-gate /* 8827c478bd9Sstevel@tonic-gate * do_mac - Compute mac of a file 8837c478bd9Sstevel@tonic-gate * 8847c478bd9Sstevel@tonic-gate * hSession - session 8857c478bd9Sstevel@tonic-gate * pmech - ptr to mechanism to be used 8867c478bd9Sstevel@tonic-gate * fd - file descriptor 8877c478bd9Sstevel@tonic-gate * key - key to be used 8887c478bd9Sstevel@tonic-gate * psignature - ptr buffer where mac result is returned 8897c478bd9Sstevel@tonic-gate * returns new buf if current buf is small 8907c478bd9Sstevel@tonic-gate * psignaturelen - length of mac buffer on input, 8917c478bd9Sstevel@tonic-gate * length of result on output 8927c478bd9Sstevel@tonic-gate */ 8937c478bd9Sstevel@tonic-gate static CK_RV 8947c478bd9Sstevel@tonic-gate do_mac(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pmech, 8957c478bd9Sstevel@tonic-gate int fd, CK_OBJECT_HANDLE key, CK_BYTE_PTR *psignature, 8967c478bd9Sstevel@tonic-gate CK_ULONG_PTR psignaturelen) 8977c478bd9Sstevel@tonic-gate { 8987c478bd9Sstevel@tonic-gate CK_RV rv; 8997c478bd9Sstevel@tonic-gate ssize_t nread; 9007c478bd9Sstevel@tonic-gate int saved_errno; 9017c478bd9Sstevel@tonic-gate 9027c478bd9Sstevel@tonic-gate if ((rv = C_SignInit(hSession, pmech, key)) != CKR_OK) { 9037c478bd9Sstevel@tonic-gate return (rv); 9047c478bd9Sstevel@tonic-gate } 9057c478bd9Sstevel@tonic-gate 9067c478bd9Sstevel@tonic-gate while ((nread = read(fd, buf, sizeof (buf))) > 0) { 9077c478bd9Sstevel@tonic-gate /* Get the MAC */ 9087c478bd9Sstevel@tonic-gate rv = C_SignUpdate(hSession, buf, (CK_ULONG)nread); 9097c478bd9Sstevel@tonic-gate if (rv != CKR_OK) 9107c478bd9Sstevel@tonic-gate return (rv); 9117c478bd9Sstevel@tonic-gate } 9127c478bd9Sstevel@tonic-gate 9137c478bd9Sstevel@tonic-gate saved_errno = errno; /* for later use */ 9147c478bd9Sstevel@tonic-gate 9157c478bd9Sstevel@tonic-gate /* 9167c478bd9Sstevel@tonic-gate * Perform the C_SignFinal, even if there is a read error. 9177c478bd9Sstevel@tonic-gate * Otherwise C_SignInit will return CKR_OPERATION_ACTIVE 9187c478bd9Sstevel@tonic-gate * next time it is called (for another file) 9197c478bd9Sstevel@tonic-gate */ 9207c478bd9Sstevel@tonic-gate 9217c478bd9Sstevel@tonic-gate rv = C_SignFinal(hSession, *psignature, psignaturelen); 9227c478bd9Sstevel@tonic-gate 9237c478bd9Sstevel@tonic-gate /* result too big to fit? Allocate a bigger buffer */ 9247c478bd9Sstevel@tonic-gate if (rv == CKR_BUFFER_TOO_SMALL) { 9257c478bd9Sstevel@tonic-gate *psignature = realloc(*psignature, *psignaturelen); 9267c478bd9Sstevel@tonic-gate 9277c478bd9Sstevel@tonic-gate if (*psignature == NULL_PTR) { 9287c478bd9Sstevel@tonic-gate int err = errno; 9297c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, 9307c478bd9Sstevel@tonic-gate gettext("realloc: %s\n"), strerror(err)); 9317c478bd9Sstevel@tonic-gate return (CKR_HOST_MEMORY); 9327c478bd9Sstevel@tonic-gate } 9337c478bd9Sstevel@tonic-gate 9347c478bd9Sstevel@tonic-gate rv = C_SignFinal(hSession, *psignature, psignaturelen); 9357c478bd9Sstevel@tonic-gate } 9367c478bd9Sstevel@tonic-gate 9377c478bd9Sstevel@tonic-gate /* There was a read error */ 9387c478bd9Sstevel@tonic-gate if (nread == -1) { 9397c478bd9Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("error reading file: %s"), 9407c478bd9Sstevel@tonic-gate strerror(saved_errno)); 9417c478bd9Sstevel@tonic-gate return (CKR_GENERAL_ERROR); 9427c478bd9Sstevel@tonic-gate } else { 9437c478bd9Sstevel@tonic-gate return (rv); 9447c478bd9Sstevel@tonic-gate } 9457c478bd9Sstevel@tonic-gate } 946