xref: /illumos-gate/usr/src/cmd/cmd-crypto/pktool/export.c (revision aedf2b3bb56b025fcaf87b49ec6c8aeea07f16d7)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  *
21  *
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*
27  * This file implements the export operation for this tool.
28  * The basic flow of the process is to find the soft token,
29  * log into it, find the PKCS#11 objects in the soft token
30  * to be exported matching keys with their certificates, export
31  * them to the PKCS#12 file encrypting them with a file password
32  * if desired, and log out.
33  */
34 
35 #include <stdio.h>
36 #include <stdlib.h>
37 #include <string.h>
38 #include <errno.h>
39 #include <fcntl.h>
40 #include "common.h"
41 
42 #include <kmfapi.h>
43 
44 static KMF_RETURN
45 pk_find_export_cert(KMF_HANDLE_T kmfhandle, KMF_ATTRIBUTE *attrlist,
46 	int numattr, KMF_X509_DER_CERT *cert)
47 {
48 	KMF_RETURN rv = KMF_OK;
49 	uint32_t numcerts = 0;
50 
51 	numcerts = 0;
52 	(void) memset(cert, 0, sizeof (KMF_X509_DER_CERT));
53 
54 	kmf_set_attr_at_index(attrlist, numattr, KMF_COUNT_ATTR,
55 	    &numcerts, sizeof (uint32_t));
56 	numattr++;
57 
58 	rv = kmf_find_cert(kmfhandle, numattr, attrlist);
59 	if (rv != KMF_OK) {
60 		return (rv);
61 	}
62 	if (numcerts == 0) {
63 		cryptoerror(LOG_STDERR,
64 		    gettext("No matching certificates found."));
65 		return (KMF_ERR_CERT_NOT_FOUND);
66 
67 	} else if (numcerts == 1) {
68 		kmf_set_attr_at_index(attrlist, numattr,
69 		    KMF_X509_DER_CERT_ATTR, cert,
70 		    sizeof (KMF_X509_DER_CERT));
71 		numattr++;
72 		rv = kmf_find_cert(kmfhandle, numattr, attrlist);
73 
74 	} else if (numcerts > 1) {
75 		cryptoerror(LOG_STDERR,
76 		    gettext("%d certificates found, refine the "
77 		    "search parameters to eliminate ambiguity\n"),
78 		    numcerts);
79 		return (KMF_ERR_BAD_PARAMETER);
80 	}
81 	return (rv);
82 }
83 
84 static KMF_RETURN
85 pk_export_file_objects(KMF_HANDLE_T kmfhandle, int oclass,
86 	char *issuer, char *subject, KMF_BIGINT *serial,
87 	char *infile, char *filename)
88 {
89 	KMF_RETURN rv = KMF_OK;
90 	KMF_X509_DER_CERT kmfcert;
91 	KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_OPENSSL;
92 	int numattr = 0;
93 	KMF_ATTRIBUTE attrlist[16];
94 
95 	/* If searching for public objects or certificates, find certs now */
96 	if (oclass & (PK_CERT_OBJ | PK_PUBLIC_OBJ)) {
97 		kmf_set_attr_at_index(attrlist, numattr,
98 		    KMF_KEYSTORE_TYPE_ATTR, &kstype,
99 		    sizeof (kstype));
100 		numattr++;
101 
102 		if (issuer != NULL) {
103 			kmf_set_attr_at_index(attrlist, numattr,
104 			    KMF_ISSUER_NAME_ATTR, issuer,
105 			    strlen(issuer));
106 			numattr++;
107 		}
108 
109 		if (subject != NULL) {
110 			kmf_set_attr_at_index(attrlist, numattr,
111 			    KMF_SUBJECT_NAME_ATTR, subject,
112 			    strlen(subject));
113 			numattr++;
114 		}
115 
116 		if (serial != NULL) {
117 			kmf_set_attr_at_index(attrlist, numattr,
118 			    KMF_BIGINT_ATTR, serial,
119 			    sizeof (KMF_BIGINT));
120 			numattr++;
121 		}
122 
123 		if (infile != NULL) {
124 			kmf_set_attr_at_index(attrlist, numattr,
125 			    KMF_CERT_FILENAME_ATTR, infile,
126 			    strlen(infile));
127 			numattr++;
128 		}
129 
130 		rv = pk_find_export_cert(kmfhandle, attrlist, numattr,
131 		    &kmfcert);
132 		if (rv == KMF_OK) {
133 			kstype = KMF_KEYSTORE_OPENSSL;
134 			numattr = 0;
135 
136 			kmf_set_attr_at_index(attrlist, numattr,
137 			    KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
138 			numattr++;
139 
140 			kmf_set_attr_at_index(attrlist, numattr,
141 			    KMF_CERT_DATA_ATTR, &kmfcert.certificate,
142 			    sizeof (KMF_DATA));
143 			numattr++;
144 
145 			kmf_set_attr_at_index(attrlist, numattr,
146 			    KMF_CERT_FILENAME_ATTR, filename,
147 			    strlen(filename));
148 			numattr++;
149 
150 			rv = kmf_store_cert(kmfhandle, numattr,
151 			    attrlist);
152 
153 			kmf_free_kmf_cert(kmfhandle, &kmfcert);
154 		}
155 	}
156 	return (rv);
157 }
158 
159 static KMF_RETURN
160 pk_export_pk12_nss(KMF_HANDLE_T kmfhandle,
161 	char *token_spec, char *dir, char *prefix,
162 	char *certlabel, char *issuer, char *subject,
163 	KMF_BIGINT *serial, KMF_CREDENTIAL *tokencred,
164 	char *filename)
165 {
166 	KMF_RETURN rv = KMF_OK;
167 	KMF_KEYSTORE_TYPE kstype;
168 	KMF_CREDENTIAL p12cred = { NULL, 0};
169 	KMF_ATTRIBUTE attrlist[16];
170 	int numattr = 0;
171 
172 	rv = configure_nss(kmfhandle, dir, prefix);
173 	if (rv != KMF_OK)
174 		return (rv);
175 
176 	if (token_spec == NULL)
177 		token_spec = DEFAULT_NSS_TOKEN;
178 
179 	kstype = KMF_KEYSTORE_NSS;
180 	kmf_set_attr_at_index(attrlist, numattr,
181 	    KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
182 	numattr++;
183 
184 	if (certlabel != NULL) {
185 		kmf_set_attr_at_index(attrlist, numattr,
186 		    KMF_CERT_LABEL_ATTR, certlabel, strlen(certlabel));
187 		numattr++;
188 	}
189 
190 	if (issuer != NULL) {
191 		kmf_set_attr_at_index(attrlist, numattr,
192 		    KMF_ISSUER_NAME_ATTR, issuer, strlen(issuer));
193 		numattr++;
194 	}
195 
196 	if (subject != NULL) {
197 		kmf_set_attr_at_index(attrlist, numattr,
198 		    KMF_SUBJECT_NAME_ATTR, subject, strlen(subject));
199 		numattr++;
200 	}
201 
202 	if (serial != NULL) {
203 		kmf_set_attr_at_index(attrlist, numattr,
204 		    KMF_BIGINT_ATTR, serial, sizeof (KMF_BIGINT));
205 		numattr++;
206 	}
207 
208 	if (tokencred != NULL) {
209 		kmf_set_attr_at_index(attrlist, numattr,
210 		    KMF_CREDENTIAL_ATTR, tokencred, sizeof (KMF_CREDENTIAL));
211 		numattr++;
212 	}
213 
214 	kmf_set_attr_at_index(attrlist, numattr, KMF_TOKEN_LABEL_ATTR,
215 	    token_spec, strlen(token_spec));
216 	numattr++;
217 
218 	(void) get_pk12_password(&p12cred);
219 	kmf_set_attr_at_index(attrlist, numattr,
220 	    KMF_PK12CRED_ATTR, &p12cred, sizeof (KMF_CREDENTIAL));
221 	numattr++;
222 
223 	kmf_set_attr_at_index(attrlist, numattr,
224 	    KMF_OUTPUT_FILENAME_ATTR, filename, strlen(filename));
225 	numattr++;
226 
227 	rv = kmf_export_pk12(kmfhandle, numattr, attrlist);
228 
229 	if (p12cred.cred)
230 		free(p12cred.cred);
231 
232 	return (rv);
233 }
234 
235 static KMF_RETURN
236 pk_export_pk12_files(KMF_HANDLE_T kmfhandle,
237 	char *certfile, char *keyfile,
238 	char *outfile)
239 {
240 	KMF_RETURN rv;
241 	KMF_KEYSTORE_TYPE kstype;
242 	KMF_CREDENTIAL p12cred = { NULL, 0};
243 	KMF_ATTRIBUTE attrlist[16];
244 	int numattr = 0;
245 
246 	kstype = KMF_KEYSTORE_OPENSSL;
247 	kmf_set_attr_at_index(attrlist, numattr,
248 	    KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
249 	numattr++;
250 
251 	if (certfile != NULL) {
252 		kmf_set_attr_at_index(attrlist, numattr,
253 		    KMF_CERT_FILENAME_ATTR, certfile, strlen(certfile));
254 		numattr++;
255 	}
256 
257 	if (keyfile != NULL) {
258 		kmf_set_attr_at_index(attrlist, numattr,
259 		    KMF_KEY_FILENAME_ATTR, keyfile, strlen(keyfile));
260 		numattr++;
261 	}
262 
263 	(void) get_pk12_password(&p12cred);
264 	kmf_set_attr_at_index(attrlist, numattr,
265 	    KMF_PK12CRED_ATTR, &p12cred, sizeof (KMF_CREDENTIAL));
266 	numattr++;
267 
268 	kmf_set_attr_at_index(attrlist, numattr,
269 	    KMF_OUTPUT_FILENAME_ATTR, outfile, strlen(outfile));
270 	numattr++;
271 
272 	rv = kmf_export_pk12(kmfhandle, numattr, attrlist);
273 
274 	if (p12cred.cred)
275 		free(p12cred.cred);
276 
277 	return (rv);
278 }
279 
280 static KMF_RETURN
281 pk_export_nss_objects(KMF_HANDLE_T kmfhandle, char *token_spec,
282 	int oclass, char *certlabel, char *issuer, char *subject,
283 	KMF_BIGINT *serial, KMF_ENCODE_FORMAT kfmt, char *dir,
284 	char *prefix, char *filename)
285 {
286 	KMF_RETURN rv = KMF_OK;
287 	KMF_X509_DER_CERT kmfcert;
288 	KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_NSS;
289 	KMF_ATTRIBUTE attrlist[16];
290 	int numattr = 0;
291 
292 	rv = configure_nss(kmfhandle, dir, prefix);
293 	if (rv != KMF_OK)
294 		return (rv);
295 
296 	/* If searching for public objects or certificates, find certs now */
297 	if (oclass & (PK_CERT_OBJ | PK_PUBLIC_OBJ)) {
298 		kmf_set_attr_at_index(attrlist, numattr,
299 		    KMF_KEYSTORE_TYPE_ATTR, &kstype,
300 		    sizeof (kstype));
301 		numattr++;
302 
303 		if (certlabel != NULL) {
304 			kmf_set_attr_at_index(attrlist, numattr,
305 			    KMF_CERT_LABEL_ATTR, certlabel,
306 			    strlen(certlabel));
307 			numattr++;
308 		}
309 
310 		if (issuer != NULL) {
311 			kmf_set_attr_at_index(attrlist, numattr,
312 			    KMF_ISSUER_NAME_ATTR, issuer,
313 			    strlen(issuer));
314 			numattr++;
315 		}
316 
317 		if (subject != NULL) {
318 			kmf_set_attr_at_index(attrlist, numattr,
319 			    KMF_SUBJECT_NAME_ATTR, subject,
320 			    strlen(subject));
321 			numattr++;
322 		}
323 
324 		if (serial != NULL) {
325 			kmf_set_attr_at_index(attrlist, numattr,
326 			    KMF_BIGINT_ATTR, serial,
327 			    sizeof (KMF_BIGINT));
328 			numattr++;
329 		}
330 
331 		if (token_spec != NULL) {
332 			kmf_set_attr_at_index(attrlist, numattr,
333 			    KMF_TOKEN_LABEL_ATTR, token_spec,
334 			    strlen(token_spec));
335 			numattr++;
336 		}
337 
338 		rv = pk_find_export_cert(kmfhandle, attrlist, numattr,
339 		    &kmfcert);
340 		if (rv == KMF_OK) {
341 			kstype = KMF_KEYSTORE_OPENSSL;
342 			numattr = 0;
343 
344 			kmf_set_attr_at_index(attrlist, numattr,
345 			    KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
346 			numattr++;
347 
348 			kmf_set_attr_at_index(attrlist, numattr,
349 			    KMF_CERT_DATA_ATTR, &kmfcert.certificate,
350 			    sizeof (KMF_DATA));
351 			numattr++;
352 
353 			kmf_set_attr_at_index(attrlist, numattr,
354 			    KMF_CERT_FILENAME_ATTR, filename,
355 			    strlen(filename));
356 			numattr++;
357 
358 			kmf_set_attr_at_index(attrlist, numattr,
359 			    KMF_ENCODE_FORMAT_ATTR, &kfmt, sizeof (kfmt));
360 			numattr++;
361 
362 			rv = kmf_store_cert(kmfhandle, numattr, attrlist);
363 
364 			kmf_free_kmf_cert(kmfhandle, &kmfcert);
365 		}
366 	}
367 	return (rv);
368 }
369 
370 static KMF_RETURN
371 pk_export_pk12_pk11(KMF_HANDLE_T kmfhandle, char *token_spec,
372 	char *certlabel, char *issuer, char *subject,
373 	KMF_BIGINT *serial, KMF_CREDENTIAL *tokencred, char *filename)
374 {
375 	KMF_RETURN rv = KMF_OK;
376 	KMF_KEYSTORE_TYPE kstype;
377 	KMF_CREDENTIAL p12cred = { NULL, 0};
378 	KMF_ATTRIBUTE attrlist[16];
379 	int numattr = 0;
380 
381 	rv = select_token(kmfhandle, token_spec, TRUE);
382 	if (rv != KMF_OK) {
383 		return (rv);
384 	}
385 
386 	kstype = KMF_KEYSTORE_PK11TOKEN;
387 	kmf_set_attr_at_index(attrlist, numattr,
388 	    KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
389 	numattr++;
390 
391 	if (certlabel != NULL) {
392 		kmf_set_attr_at_index(attrlist, numattr,
393 		    KMF_CERT_LABEL_ATTR, certlabel, strlen(certlabel));
394 		numattr++;
395 	}
396 
397 	if (issuer != NULL) {
398 		kmf_set_attr_at_index(attrlist, numattr,
399 		    KMF_ISSUER_NAME_ATTR, issuer, strlen(issuer));
400 		numattr++;
401 	}
402 
403 	if (subject != NULL) {
404 		kmf_set_attr_at_index(attrlist, numattr,
405 		    KMF_SUBJECT_NAME_ATTR, subject, strlen(subject));
406 		numattr++;
407 	}
408 
409 	if (serial != NULL) {
410 		kmf_set_attr_at_index(attrlist, numattr,
411 		    KMF_BIGINT_ATTR, serial, sizeof (KMF_BIGINT));
412 		numattr++;
413 	}
414 
415 	if (tokencred != NULL) {
416 		kmf_set_attr_at_index(attrlist, numattr,
417 		    KMF_CREDENTIAL_ATTR, tokencred, sizeof (KMF_CREDENTIAL));
418 		numattr++;
419 	}
420 
421 	(void) get_pk12_password(&p12cred);
422 	kmf_set_attr_at_index(attrlist, numattr,
423 	    KMF_PK12CRED_ATTR, &p12cred, sizeof (KMF_CREDENTIAL));
424 	numattr++;
425 
426 	kmf_set_attr_at_index(attrlist, numattr,
427 	    KMF_OUTPUT_FILENAME_ATTR, filename, strlen(filename));
428 	numattr++;
429 
430 	rv = kmf_export_pk12(kmfhandle, numattr, attrlist);
431 
432 	if (p12cred.cred)
433 		free(p12cred.cred);
434 
435 	return (rv);
436 }
437 
438 static KMF_RETURN
439 pk_export_pk11_keys(KMF_HANDLE_T kmfhandle, char *token,
440 	KMF_CREDENTIAL *cred, KMF_ENCODE_FORMAT format,
441 	char *label, char *filename, int oclass)
442 {
443 	KMF_RETURN rv = KMF_OK;
444 	KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_PK11TOKEN;
445 	KMF_KEY_CLASS kclass = KMF_KEYCLASS_NONE;
446 	int numattr = 0;
447 	uint32_t numkeys = 1;
448 	KMF_ATTRIBUTE attrlist[16];
449 	KMF_KEY_HANDLE key;
450 	boolean_t is_token = B_TRUE;
451 
452 	if (EMPTYSTRING(label)) {
453 		cryptoerror(LOG_STDERR, gettext("A label "
454 		    "must be specified to export a key."));
455 		return (KMF_ERR_BAD_PARAMETER);
456 	}
457 
458 	rv = select_token(kmfhandle, token, TRUE);
459 	if (rv != KMF_OK) {
460 		return (rv);
461 	}
462 
463 	kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
464 	    &kstype, sizeof (kstype));
465 	numattr++;
466 
467 	if (cred != NULL) {
468 		kmf_set_attr_at_index(attrlist, numattr, KMF_CREDENTIAL_ATTR,
469 		    cred, sizeof (KMF_CREDENTIAL));
470 		numattr++;
471 	}
472 
473 	kmf_set_attr_at_index(attrlist, numattr, KMF_KEYLABEL_ATTR,
474 	    label, strlen(label));
475 	numattr++;
476 
477 	kmf_set_attr_at_index(attrlist, numattr, KMF_COUNT_ATTR,
478 	    &numkeys, sizeof (numkeys));
479 	numattr++;
480 
481 	kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_HANDLE_ATTR,
482 	    &key, sizeof (key));
483 	numattr++;
484 
485 	kmf_set_attr_at_index(attrlist, numattr, KMF_TOKEN_BOOL_ATTR,
486 	    &is_token, sizeof (is_token));
487 	numattr++;
488 
489 	kmf_set_attr_at_index(attrlist, numattr, KMF_ENCODE_FORMAT_ATTR,
490 	    &format, sizeof (format));
491 	numattr++;
492 
493 	/* Check to see if we are exporting private or public only */
494 	if ((oclass & PK_KEY_OBJ) == PK_PRIKEY_OBJ)
495 		kclass = KMF_ASYM_PRI;
496 	else if ((oclass & PK_KEY_OBJ) == PK_PUBKEY_OBJ)
497 		kclass = KMF_ASYM_PUB;
498 	else if ((oclass & PK_KEY_OBJ) == PK_SYMKEY_OBJ)
499 		kclass = KMF_SYMMETRIC;
500 	else /* only 1 key at a time can be exported here, so default to pri */
501 		kclass = KMF_ASYM_PRI;
502 
503 	kmf_set_attr_at_index(attrlist, numattr, KMF_KEYCLASS_ATTR,
504 	    &kclass, sizeof (kclass));
505 	numattr++;
506 
507 	rv = kmf_find_key(kmfhandle, numattr, attrlist);
508 	/*
509 	 * If nothing found but caller wanted ALL keys, try symmetric
510 	 * this time.
511 	 */
512 	if (rv == KMF_ERR_KEY_NOT_FOUND && (oclass == PK_KEY_OBJ)) {
513 		kclass = KMF_SYMMETRIC;
514 		rv = kmf_find_key(kmfhandle, numattr, attrlist);
515 	}
516 	/*
517 	 * If nothing found but caller wanted ALL keys, try asymmetric
518 	 * public this time.
519 	 */
520 	if (rv == KMF_ERR_KEY_NOT_FOUND && (oclass == PK_KEY_OBJ)) {
521 		kclass = KMF_ASYM_PUB;
522 		rv = kmf_find_key(kmfhandle, numattr, attrlist);
523 	}
524 	if (rv == KMF_OK && key.keyclass == KMF_SYMMETRIC) {
525 		KMF_RAW_SYM_KEY rkey;
526 
527 		(void) memset(&rkey, 0, sizeof (KMF_RAW_SYM_KEY));
528 		rv = kmf_get_sym_key_value(kmfhandle, &key, &rkey);
529 		if (rv == KMF_OK) {
530 			int fd, n, total = 0;
531 
532 			fd = open(filename, O_CREAT | O_RDWR |O_TRUNC, 0600);
533 			if (fd == -1) {
534 				rv = KMF_ERR_OPEN_FILE;
535 				goto done;
536 			}
537 			do {
538 				n = write(fd, rkey.keydata.val + total,
539 				    rkey.keydata.len - total);
540 				if (n < 0) {
541 					if (errno == EINTR)
542 						continue;
543 					(void) close(fd);
544 					rv = KMF_ERR_WRITE_FILE;
545 					goto done;
546 				}
547 				total += n;
548 
549 			} while (total < rkey.keydata.len);
550 			(void) close(fd);
551 		}
552 done:
553 		kmf_free_bigint(&rkey.keydata);
554 		kmf_free_kmf_key(kmfhandle, &key);
555 	} else if (rv == KMF_OK) {
556 		KMF_KEYSTORE_TYPE sslks = KMF_KEYSTORE_OPENSSL;
557 		(void) printf(gettext("Found %d asymmetric keys\n"), numkeys);
558 
559 		numattr = 0;
560 		kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
561 		    &sslks, sizeof (sslks));
562 		numattr++;
563 
564 		kmf_set_attr_at_index(attrlist, numattr, KMF_RAW_KEY_ATTR,
565 		    key.keyp, sizeof (KMF_RAW_KEY_DATA));
566 		numattr++;
567 
568 		kmf_set_attr_at_index(attrlist, numattr, KMF_ENCODE_FORMAT_ATTR,
569 		    &format, sizeof (format));
570 		numattr++;
571 
572 		kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_FILENAME_ATTR,
573 		    filename, strlen(filename));
574 		numattr++;
575 
576 		kmf_set_attr_at_index(attrlist, numattr, KMF_KEYCLASS_ATTR,
577 		    &key.keyclass, sizeof (KMF_KEY_CLASS));
578 		numattr++;
579 
580 		rv = kmf_store_key(kmfhandle, numattr, attrlist);
581 		kmf_free_kmf_key(kmfhandle, &key);
582 	}
583 
584 	return (rv);
585 }
586 
587 static KMF_RETURN
588 pk_export_pk11_objects(KMF_HANDLE_T kmfhandle, char *token_spec,
589 	KMF_CREDENTIAL *cred, char *certlabel, char *issuer, char *subject,
590 	KMF_BIGINT *serial, KMF_ENCODE_FORMAT kfmt,
591 	char *filename)
592 {
593 	KMF_RETURN rv = KMF_OK;
594 	KMF_X509_DER_CERT kmfcert;
595 	KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_PK11TOKEN;
596 	int numattr = 0;
597 	KMF_ATTRIBUTE attrlist[16];
598 
599 	rv = select_token(kmfhandle, token_spec, TRUE);
600 
601 	if (rv != KMF_OK)
602 		return (rv);
603 
604 	kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
605 	    &kstype, sizeof (kstype));
606 	numattr++;
607 
608 	if (cred != NULL) {
609 		kmf_set_attr_at_index(attrlist, numattr, KMF_CREDENTIAL_ATTR,
610 		    cred, sizeof (KMF_CREDENTIAL));
611 		numattr++;
612 	}
613 	if (certlabel != NULL) {
614 		kmf_set_attr_at_index(attrlist, numattr,
615 		    KMF_CERT_LABEL_ATTR, certlabel,
616 		    strlen(certlabel));
617 		numattr++;
618 	}
619 
620 	if (issuer != NULL) {
621 		kmf_set_attr_at_index(attrlist, numattr,
622 		    KMF_ISSUER_NAME_ATTR, issuer,
623 		    strlen(issuer));
624 		numattr++;
625 	}
626 
627 	if (subject != NULL) {
628 		kmf_set_attr_at_index(attrlist, numattr,
629 		    KMF_SUBJECT_NAME_ATTR, subject,
630 		    strlen(subject));
631 		numattr++;
632 	}
633 
634 	if (serial != NULL) {
635 		kmf_set_attr_at_index(attrlist, numattr,
636 		    KMF_BIGINT_ATTR, serial,
637 		    sizeof (KMF_BIGINT));
638 		numattr++;
639 	}
640 
641 	rv = pk_find_export_cert(kmfhandle, attrlist, numattr, &kmfcert);
642 
643 	if (rv == KMF_OK) {
644 		kstype = KMF_KEYSTORE_OPENSSL;
645 		numattr = 0;
646 
647 		kmf_set_attr_at_index(attrlist, numattr,
648 		    KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
649 		numattr++;
650 
651 		kmf_set_attr_at_index(attrlist, numattr,
652 		    KMF_CERT_DATA_ATTR, &kmfcert.certificate,
653 		    sizeof (KMF_DATA));
654 		numattr++;
655 
656 		kmf_set_attr_at_index(attrlist, numattr,
657 		    KMF_CERT_FILENAME_ATTR, filename, strlen(filename));
658 		numattr++;
659 
660 		kmf_set_attr_at_index(attrlist, numattr,
661 		    KMF_ENCODE_FORMAT_ATTR, &kfmt, sizeof (kfmt));
662 		numattr++;
663 
664 		rv = kmf_store_cert(kmfhandle, numattr, attrlist);
665 
666 		kmf_free_kmf_cert(kmfhandle, &kmfcert);
667 	}
668 	return (rv);
669 }
670 
671 /*
672  * Export objects from one keystore to a file.
673  */
674 int
675 pk_export(int argc, char *argv[])
676 {
677 	int		opt;
678 	extern int	optind_av;
679 	extern char	*optarg_av;
680 	char		*token_spec = NULL;
681 	char		*filename = NULL;
682 	char		*dir = NULL;
683 	char		*prefix = NULL;
684 	char		*certlabel = NULL;
685 	char		*subject = NULL;
686 	char		*issuer = NULL;
687 	char		*infile = NULL;
688 	char		*keyfile = NULL;
689 	char		*certfile = NULL;
690 	char		*serstr = NULL;
691 	KMF_KEYSTORE_TYPE	kstype = 0;
692 	KMF_ENCODE_FORMAT	kfmt = KMF_FORMAT_PKCS12;
693 	KMF_RETURN		rv = KMF_OK;
694 	int		oclass = PK_CERT_OBJ;
695 	KMF_BIGINT	serial = { NULL, 0 };
696 	KMF_HANDLE_T	kmfhandle = NULL;
697 	KMF_CREDENTIAL	tokencred = {NULL, 0};
698 
699 	/* Parse command line options.  Do NOT i18n/l10n. */
700 	while ((opt = getopt_av(argc, argv,
701 	    "k:(keystore)y:(objtype)T:(token)"
702 	    "d:(dir)p:(prefix)"
703 	    "l:(label)n:(nickname)s:(subject)"
704 	    "i:(issuer)S:(serial)"
705 	    "K:(keyfile)c:(certfile)"
706 	    "F:(outformat)"
707 	    "I:(infile)o:(outfile)")) != EOF) {
708 		if (EMPTYSTRING(optarg_av))
709 			return (PK_ERR_USAGE);
710 		switch (opt) {
711 		case 'k':
712 			kstype = KS2Int(optarg_av);
713 			if (kstype == 0)
714 				return (PK_ERR_USAGE);
715 			break;
716 		case 'y':
717 			oclass = OT2Int(optarg_av);
718 			if (oclass == -1)
719 				return (PK_ERR_USAGE);
720 			break;
721 		case 'T':	/* token specifier */
722 			if (token_spec)
723 				return (PK_ERR_USAGE);
724 			token_spec = optarg_av;
725 			break;
726 		case 'd':
727 			if (dir)
728 				return (PK_ERR_USAGE);
729 			dir = optarg_av;
730 			break;
731 		case 'p':
732 			if (prefix)
733 				return (PK_ERR_USAGE);
734 			prefix = optarg_av;
735 			break;
736 		case 'n':
737 		case 'l':
738 			if (certlabel)
739 				return (PK_ERR_USAGE);
740 			certlabel = optarg_av;
741 			break;
742 		case 's':
743 			if (subject)
744 				return (PK_ERR_USAGE);
745 			subject = optarg_av;
746 			break;
747 		case 'i':
748 			if (issuer)
749 				return (PK_ERR_USAGE);
750 			issuer = optarg_av;
751 			break;
752 		case 'S':
753 			serstr = optarg_av;
754 			break;
755 		case 'F':
756 			kfmt = Str2Format(optarg_av);
757 			if (kfmt == KMF_FORMAT_UNDEF)
758 				return (PK_ERR_USAGE);
759 			break;
760 		case 'I':	/* output file name */
761 			if (infile)
762 				return (PK_ERR_USAGE);
763 			infile = optarg_av;
764 			break;
765 		case 'o':	/* output file name */
766 			if (filename)
767 				return (PK_ERR_USAGE);
768 			filename = optarg_av;
769 			break;
770 		case 'c':	/* input cert file name */
771 			if (certfile)
772 				return (PK_ERR_USAGE);
773 			certfile = optarg_av;
774 			break;
775 		case 'K':	/* input key file name */
776 			if (keyfile)
777 				return (PK_ERR_USAGE);
778 			keyfile = optarg_av;
779 			break;
780 		default:
781 			return (PK_ERR_USAGE);
782 			break;
783 		}
784 	}
785 
786 	/* Assume keystore = PKCS#11 if not specified */
787 	if (kstype == 0)
788 		kstype = KMF_KEYSTORE_PK11TOKEN;
789 
790 	/* Filename arg is required. */
791 	if (EMPTYSTRING(filename)) {
792 		cryptoerror(LOG_STDERR, gettext("You must specify "
793 		    "an 'outfile' parameter when exporting.\n"));
794 		return (PK_ERR_USAGE);
795 	}
796 
797 	/* No additional args allowed. */
798 	argc -= optind_av;
799 	argv += optind_av;
800 	if (argc)
801 		return (PK_ERR_USAGE);
802 
803 	DIR_OPTION_CHECK(kstype, dir);
804 
805 	/* if PUBLIC or PRIVATE obj was given, the old syntax was used. */
806 	if ((oclass & (PK_PUBLIC_OBJ | PK_PRIVATE_OBJ)) &&
807 	    kstype != KMF_KEYSTORE_PK11TOKEN) {
808 
809 		(void) fprintf(stderr, gettext("The objtype parameter "
810 		    "is only relevant if keystore=pkcs11\n"));
811 		return (PK_ERR_USAGE);
812 	}
813 
814 	if (kstype == KMF_KEYSTORE_PK11TOKEN && EMPTYSTRING(token_spec))
815 		token_spec = PK_DEFAULT_PK11TOKEN;
816 	else if (kstype == KMF_KEYSTORE_NSS && EMPTYSTRING(token_spec))
817 		token_spec = DEFAULT_NSS_TOKEN;
818 
819 	if (kstype == KMF_KEYSTORE_OPENSSL) {
820 		if (kfmt != KMF_FORMAT_PKCS12) {
821 			cryptoerror(LOG_STDERR, gettext("PKCS12 "
822 			    "is the only export format "
823 			    "supported for the 'file' "
824 			    "keystore.\n"));
825 			return (PK_ERR_USAGE);
826 		}
827 		if (EMPTYSTRING(keyfile) || EMPTYSTRING(certfile)) {
828 			cryptoerror(LOG_STDERR, gettext("A cert file"
829 			    "and a key file must be specified "
830 			    "when exporting to PKCS12 from the "
831 			    "'file' keystore.\n"));
832 			return (PK_ERR_USAGE);
833 		}
834 	}
835 
836 	/* Check if the file exists and might be overwritten. */
837 	if (access(filename, F_OK) == 0) {
838 		cryptoerror(LOG_STDERR,
839 		    gettext("Warning: file \"%s\" exists, "
840 		    "will be overwritten."), filename);
841 		if (yesno(gettext("Continue with export? "),
842 		    gettext("Respond with yes or no.\n"), B_FALSE) == B_FALSE) {
843 			return (0);
844 		} else {
845 			/* remove the file */
846 			(void) unlink(filename);
847 		}
848 	} else {
849 		rv = verify_file(filename);
850 		if (rv != KMF_OK) {
851 			cryptoerror(LOG_STDERR, gettext("The file (%s) "
852 			    "cannot be created.\n"), filename);
853 			return (PK_ERR_USAGE);
854 		}
855 	}
856 
857 	if (serstr != NULL) {
858 		uchar_t *bytes = NULL;
859 		size_t bytelen;
860 
861 		rv = kmf_hexstr_to_bytes((uchar_t *)serstr, &bytes, &bytelen);
862 		if (rv != KMF_OK || bytes == NULL) {
863 			(void) fprintf(stderr, gettext("serial number "
864 			    "must be specified as a hex number "
865 			    "(ex: 0x0102030405ffeeddee)\n"));
866 			return (PK_ERR_USAGE);
867 		}
868 		serial.val = bytes;
869 		serial.len = bytelen;
870 	}
871 
872 	/*
873 	 * We need a password in the following situations:
874 	 * 1.  When accessing PKCS11 token
875 	 * 2.  If NSS keystore, when making a PKCS12 file or when
876 	 * accessing any private object or key.
877 	 */
878 	if (kstype == KMF_KEYSTORE_PK11TOKEN ||
879 	    ((kstype == KMF_KEYSTORE_NSS) &&
880 	    ((oclass & (PK_KEY_OBJ | PK_PRIVATE_OBJ)) ||
881 	    (kfmt == KMF_FORMAT_PKCS12)))) {
882 			(void) get_token_password(kstype, token_spec,
883 			    &tokencred);
884 	}
885 
886 	if ((rv = kmf_initialize(&kmfhandle, NULL, NULL)) != KMF_OK) {
887 		cryptoerror(LOG_STDERR, gettext("Error initializing "
888 		    "KMF: 0x%02x\n"), rv);
889 		return (rv);
890 	}
891 
892 	switch (kstype) {
893 		case KMF_KEYSTORE_PK11TOKEN:
894 			if (kfmt == KMF_FORMAT_PKCS12)
895 				rv = pk_export_pk12_pk11(kmfhandle,
896 				    token_spec, certlabel,
897 				    issuer, subject,
898 				    &serial, &tokencred,
899 				    filename);
900 			else if ((oclass & PK_KEY_OBJ) ||
901 			    kfmt == KMF_FORMAT_RAWKEY)
902 				rv = pk_export_pk11_keys(kmfhandle,
903 				    token_spec, &tokencred, kfmt,
904 				    certlabel, filename, oclass);
905 			else
906 				rv = pk_export_pk11_objects(kmfhandle,
907 				    token_spec, &tokencred, certlabel,
908 				    issuer, subject, &serial, kfmt,
909 				    filename);
910 			break;
911 		case KMF_KEYSTORE_NSS:
912 			if (dir == NULL)
913 				dir = PK_DEFAULT_DIRECTORY;
914 			if (kfmt == KMF_FORMAT_PKCS12)
915 				rv = pk_export_pk12_nss(kmfhandle,
916 				    token_spec, dir, prefix,
917 				    certlabel, issuer,
918 				    subject, &serial,
919 				    &tokencred, filename);
920 			else
921 				rv = pk_export_nss_objects(kmfhandle,
922 				    token_spec,
923 				    oclass, certlabel, issuer, subject,
924 				    &serial, kfmt, dir, prefix, filename);
925 			break;
926 		case KMF_KEYSTORE_OPENSSL:
927 			if (kfmt == KMF_FORMAT_PKCS12)
928 				rv = pk_export_pk12_files(kmfhandle,
929 				    certfile, keyfile, filename);
930 			else
931 				rv = pk_export_file_objects(kmfhandle, oclass,
932 				    issuer, subject, &serial,
933 				    infile, filename);
934 			break;
935 		default:
936 			rv = PK_ERR_USAGE;
937 			break;
938 	}
939 
940 	if (rv != KMF_OK) {
941 		display_error(kmfhandle, rv,
942 		    gettext("Error exporting objects"));
943 	}
944 
945 	if (serial.val != NULL)
946 		free(serial.val);
947 
948 	(void) kmf_finalize(kmfhandle);
949 
950 	return (rv);
951 }
952