1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 * 21 * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved. 22 */ 23 /* 24 * Copyright 2010 Nexenta Systems, Inc. All rights reserved. 25 * Copyright 2014, OmniTI Computer Consulting, Inc. All rights reserved. 26 * Copyright 2018, Joyent, Inc. 27 */ 28 29 #ifndef _CRYPTOUTIL_H 30 #define _CRYPTOUTIL_H 31 32 #ifdef __cplusplus 33 extern "C" { 34 #endif 35 36 #include <sys/types.h> 37 #include <syslog.h> 38 #include <security/cryptoki.h> 39 #include <sys/param.h> 40 41 #define LOG_STDERR -1 42 #define SUCCESS 0 43 #define FAILURE 1 44 #define MECH_ID_HEX_LEN 11 /* length of mechanism id in hex form */ 45 46 #define _PATH_PKCS11_CONF "/etc/crypto/pkcs11.conf" 47 #define _PATH_KCF_CONF "/etc/crypto/kcf.conf" 48 #define _PATH_KCFD_LOCK "/var/run/kcfd.lock" 49 50 /* $ISA substitution for parsing pkcs11.conf data */ 51 #define PKCS11_ISA "/$ISA/" 52 #if defined(_LP64) 53 #define PKCS11_ISA_DIR "/64/" 54 #else /* !_LP64 */ 55 #define PKCS11_ISA_DIR "/" 56 #endif 57 58 /* keywords and delimiters for parsing configuration files */ 59 #define SEP_COLON ":" 60 #define SEP_SEMICOLON ";" 61 #define SEP_EQUAL "=" 62 #define SEP_COMMA "," 63 #define METASLOT_KEYWORD "metaslot" 64 #define FIPS_KEYWORD "fips-140" 65 #define EF_DISABLED "disabledlist=" 66 #define EF_ENABLED "enabledlist=" 67 #define EF_NORANDOM "NO_RANDOM" 68 #define METASLOT_TOKEN "metaslot_token=" 69 #define METASLOT_SLOT "metaslot_slot=" 70 #define METASLOT_STATUS "metaslot_status=" 71 #define EF_FIPS_STATUS "fips_status=" 72 #define METASLOT_AUTO_KEY_MIGRATE "metaslot_auto_key_migrate=" 73 #define ENABLED_KEYWORD "enabled" 74 #define DISABLED_KEYWORD "disabled" 75 #define SLOT_DESCRIPTION_SIZE 64 76 #define TOKEN_LABEL_SIZE 32 77 #define TOKEN_MANUFACTURER_SIZE 32 78 #define TOKEN_SERIAL_SIZE 16 79 #define CRYPTO_FIPS_MODE_DISABLED 0 80 #define CRYPTO_FIPS_MODE_ENABLED 1 81 82 /* 83 * Define the following softtoken values that are used by softtoken 84 * library, cryptoadm and pktool command. 85 */ 86 #define SOFT_SLOT_DESCRIPTION \ 87 "Sun Crypto Softtoken " \ 88 " " 89 #define SOFT_TOKEN_LABEL "Sun Software PKCS#11 softtoken " 90 #define SOFT_TOKEN_SERIAL " " 91 #define SOFT_MANUFACTURER_ID "Sun Microsystems, Inc. " 92 #define SOFT_DEFAULT_PIN "changeme" 93 94 typedef char libname_t[MAXPATHLEN]; 95 typedef char midstr_t[MECH_ID_HEX_LEN]; 96 97 typedef struct umechlist { 98 midstr_t name; /* mechanism name in hex form */ 99 struct umechlist *next; 100 } umechlist_t; 101 102 typedef struct uentry { 103 libname_t name; 104 boolean_t flag_norandom; /* TRUE if random is disabled */ 105 boolean_t flag_enabledlist; /* TRUE if an enabledlist */ 106 umechlist_t *policylist; /* disabledlist or enabledlist */ 107 boolean_t flag_metaslot_enabled; /* TRUE if metaslot's enabled */ 108 boolean_t flag_metaslot_auto_key_migrate; 109 CK_UTF8CHAR metaslot_ks_slot[SLOT_DESCRIPTION_SIZE + 1]; 110 CK_UTF8CHAR metaslot_ks_token[TOKEN_LABEL_SIZE + 1]; 111 int count; 112 boolean_t flag_fips_enabled; 113 } uentry_t; 114 115 typedef struct uentrylist { 116 uentry_t *puent; 117 struct uentrylist *next; 118 } uentrylist_t; 119 120 /* Return codes for pkcs11_parse_uri() */ 121 #define PK11_URI_OK 0 122 #define PK11_URI_INVALID 1 123 #define PK11_MALLOC_ERROR 2 124 #define PK11_URI_VALUE_OVERFLOW 3 125 #define PK11_NOT_PKCS11_URI 4 126 127 /* 128 * There is no limit for the attribute length in the spec. 256 bytes should be 129 * enough for the object name. 130 */ 131 #define PK11_MAX_OBJECT_LEN 256 132 /* 133 * CKA_ID is of type "byte array" which can be of arbitrary length. 256 bytes 134 * should be sufficient though. 135 */ 136 #define PK11_MAX_ID_LEN 256 137 138 /* Structure for the PKCS#11 URI. */ 139 typedef struct pkcs11_uri_t { 140 /* CKA_LABEL attribute to the C_FindObjectsInit function. */ 141 CK_UTF8CHAR_PTR object; 142 /* 143 * CKA_CLASS attribute to the C_FindObjectsInit function. The 144 * "objecttype" URI attribute can have a value one of "private", 145 * "public", "cert", "secretkey", and "data". The "objecttype" field can 146 * have a value of CKO_PUBLIC_KEY, CKO_PRIVATE_KEY, CKO_CERTIFICATE, 147 * CKO_SECRET_KEY, and CKO_DATA. This attribute cannot be empty in the 148 * URI. 149 */ 150 CK_ULONG objecttype; 151 /* CKO_DATA is 0 so we need this flag. Not part of the URI itself. */ 152 boolean_t objecttype_present; 153 /* 154 * Token, manufufacturer, serial and model are of fixed size length in 155 * the specification. We allocate memory on the fly to distinguish 156 * between an attribute not present and an empty value. We check for 157 * overflows. We always terminate the string with '\0' even when that is 158 * not used in the PKCS#11's CK_TOKEN_INFO structure (fields are padded 159 * with spaces). 160 */ 161 /* Token label from CK_TOKEN_INFO. */ 162 CK_UTF8CHAR_PTR token; 163 /* ManufacturerID from CK_TOKEN_INFO. */ 164 CK_UTF8CHAR_PTR manuf; 165 /* SerialNumber from CK_TOKEN_INFO. */ 166 CK_CHAR_PTR serial; 167 /* Model from CK_TOKEN_INFO. */ 168 CK_UTF8CHAR_PTR model; 169 /* This is a byte array, we need a length parameter as well. */ 170 CK_BYTE_PTR id; 171 int id_len; 172 /* 173 * Location of the file with a token PIN. Application can overload this, 174 * eg. "/bin/askpass|" may mean to read the PIN from a command. However, 175 * the pkcs11_parse_uri() function does not interpret this field in any 176 * way. 177 */ 178 char *pinfile; 179 } pkcs11_uri_t; 180 181 extern void cryptodebug(const char *fmt, ...); 182 extern void cryptoerror(int priority, const char *fmt, ...); 183 extern void cryptodebug_init(const char *prefix); 184 extern void cryptoerror_off(); 185 extern void cryptoerror_on(); 186 187 extern const char *pkcs11_mech2str(CK_MECHANISM_TYPE mech); 188 extern CK_RV pkcs11_str2mech(char *mech_str, CK_MECHANISM_TYPE_PTR mech); 189 190 extern int get_pkcs11conf_info(uentrylist_t **); 191 extern umechlist_t *create_umech(char *); 192 extern void free_umechlist(umechlist_t *); 193 extern void free_uentrylist(uentrylist_t *); 194 extern void free_uentry(uentry_t *); 195 extern uentry_t *getent_uef(char *); 196 197 extern void tohexstr(uchar_t *bytes, size_t blen, char *hexstr, size_t hexlen); 198 extern int hexstr_to_bytes(char *hexstr, size_t hexlen, uchar_t **bytes, 199 size_t *blen); 200 extern CK_RV pkcs11_mech2keytype(CK_MECHANISM_TYPE mech_type, 201 CK_KEY_TYPE *ktype); 202 extern CK_RV pkcs11_mech2keygen(CK_MECHANISM_TYPE mech_type, 203 CK_MECHANISM_TYPE *gen_mech); 204 extern char *pkcs11_strerror(CK_RV rv); 205 206 extern int 207 get_metaslot_info(boolean_t *status_enabled, boolean_t *migrate_enabled, 208 char **objectstore_slot_info, char **objectstore_token_info); 209 210 extern char *get_fullpath(char *dir, char *filepath); 211 extern int str2lifetime(char *ltimestr, uint32_t *ltime); 212 213 extern char *pkcs11_default_token(void); 214 extern int pkcs11_get_pass(char *token_name, char **pdata, size_t *psize, 215 size_t min_psize, boolean_t with_confirmation); 216 217 extern int pkcs11_seed_urandom(void *sbuf, size_t slen); 218 extern int pkcs11_get_random(void *dbuf, size_t dlen); 219 extern int pkcs11_get_urandom(void *dbuf, size_t dlen); 220 extern int pkcs11_get_nzero_urandom(void *dbuf, size_t dlen); 221 extern int pkcs11_read_data(char *filename, void **dbuf, size_t *dlen); 222 223 extern int open_nointr(const char *path, int oflag, ...); 224 extern ssize_t readn_nointr(int fd, void *dbuf, size_t dlen); 225 extern ssize_t writen_nointr(int fd, void *dbuf, size_t dlen); 226 extern int update_conf(char *conf_file, char *entry); 227 228 extern int pkcs11_parse_uri(const char *str, pkcs11_uri_t *uri); 229 extern void pkcs11_free_uri(pkcs11_uri_t *uri); 230 231 extern CK_RV crypto2pkcs11_error_number(uint_t); 232 233 #ifdef __cplusplus 234 } 235 #endif 236 237 #endif /* _CRYPTOUTIL_H */ 238