xref: /titanic_51/usr/src/cmd/cmd-inet/usr.lib/wanboot/encr/encr.c (revision 7c478bd95313f5f23a4c958a745db2134aa03244)
1*7c478bd9Sstevel@tonic-gate /*
2*7c478bd9Sstevel@tonic-gate  * CDDL HEADER START
3*7c478bd9Sstevel@tonic-gate  *
4*7c478bd9Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
5*7c478bd9Sstevel@tonic-gate  * Common Development and Distribution License, Version 1.0 only
6*7c478bd9Sstevel@tonic-gate  * (the "License").  You may not use this file except in compliance
7*7c478bd9Sstevel@tonic-gate  * with the License.
8*7c478bd9Sstevel@tonic-gate  *
9*7c478bd9Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10*7c478bd9Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
11*7c478bd9Sstevel@tonic-gate  * See the License for the specific language governing permissions
12*7c478bd9Sstevel@tonic-gate  * and limitations under the License.
13*7c478bd9Sstevel@tonic-gate  *
14*7c478bd9Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
15*7c478bd9Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16*7c478bd9Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
17*7c478bd9Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
18*7c478bd9Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
19*7c478bd9Sstevel@tonic-gate  *
20*7c478bd9Sstevel@tonic-gate  * CDDL HEADER END
21*7c478bd9Sstevel@tonic-gate  */
22*7c478bd9Sstevel@tonic-gate /*
23*7c478bd9Sstevel@tonic-gate  * Copyright 2003 Sun Microsystems, Inc.  All rights reserved.
24*7c478bd9Sstevel@tonic-gate  * Use is subject to license terms.
25*7c478bd9Sstevel@tonic-gate  */
26*7c478bd9Sstevel@tonic-gate #pragma ident	"%Z%%M%	%I%	%E% SMI"
27*7c478bd9Sstevel@tonic-gate 
28*7c478bd9Sstevel@tonic-gate #include <stdio.h>
29*7c478bd9Sstevel@tonic-gate #include <stdlib.h>
30*7c478bd9Sstevel@tonic-gate #include <unistd.h>
31*7c478bd9Sstevel@tonic-gate #include <fcntl.h>
32*7c478bd9Sstevel@tonic-gate #include <libintl.h>
33*7c478bd9Sstevel@tonic-gate #include <locale.h>
34*7c478bd9Sstevel@tonic-gate #include <sys/des.h>
35*7c478bd9Sstevel@tonic-gate #include <strings.h>
36*7c478bd9Sstevel@tonic-gate #include <errno.h>
37*7c478bd9Sstevel@tonic-gate #include <wanbootutil.h>
38*7c478bd9Sstevel@tonic-gate #include <sys/sysmacros.h>
39*7c478bd9Sstevel@tonic-gate #include <sys/wanboot_impl.h>
40*7c478bd9Sstevel@tonic-gate 
41*7c478bd9Sstevel@tonic-gate /* Return codes */
42*7c478bd9Sstevel@tonic-gate #define	ENCR_SUCCESS	0
43*7c478bd9Sstevel@tonic-gate #define	ENCR_NOKEY	1
44*7c478bd9Sstevel@tonic-gate #define	ENCR_ERROR	2
45*7c478bd9Sstevel@tonic-gate 
46*7c478bd9Sstevel@tonic-gate /* Private buffer length */
47*7c478bd9Sstevel@tonic-gate #define	ENCR_BUF_LEN		1024
48*7c478bd9Sstevel@tonic-gate 
49*7c478bd9Sstevel@tonic-gate /* Encryption algorithm suboption. */
50*7c478bd9Sstevel@tonic-gate #define	TYPE	0
51*7c478bd9Sstevel@tonic-gate 
52*7c478bd9Sstevel@tonic-gate static char *opts[] = { "type", NULL };
53*7c478bd9Sstevel@tonic-gate 
54*7c478bd9Sstevel@tonic-gate /*
55*7c478bd9Sstevel@tonic-gate  * This routine is used to parse the suboptions of '-o' option.
56*7c478bd9Sstevel@tonic-gate  *
57*7c478bd9Sstevel@tonic-gate  * The option should be of the form: type=<3des|aes>
58*7c478bd9Sstevel@tonic-gate  *
59*7c478bd9Sstevel@tonic-gate  * This routine will pass the value of the suboption back in the
60*7c478bd9Sstevel@tonic-gate  * supplied arguments, 'ka'.
61*7c478bd9Sstevel@tonic-gate  *
62*7c478bd9Sstevel@tonic-gate  * Returns:
63*7c478bd9Sstevel@tonic-gate  *	ENCR_SUCCESS or ENCR_ERROR.
64*7c478bd9Sstevel@tonic-gate  */
65*7c478bd9Sstevel@tonic-gate static int
66*7c478bd9Sstevel@tonic-gate process_option(char *arg, wbku_key_attr_t *ka)
67*7c478bd9Sstevel@tonic-gate {
68*7c478bd9Sstevel@tonic-gate 	char *value;
69*7c478bd9Sstevel@tonic-gate 	wbku_retcode_t ret;
70*7c478bd9Sstevel@tonic-gate 
71*7c478bd9Sstevel@tonic-gate 	while (*arg != '\0') {
72*7c478bd9Sstevel@tonic-gate 		switch (getsubopt(&arg, opts, &value)) {
73*7c478bd9Sstevel@tonic-gate 		case TYPE:
74*7c478bd9Sstevel@tonic-gate 			/*
75*7c478bd9Sstevel@tonic-gate 			 * Key type.
76*7c478bd9Sstevel@tonic-gate 			 */
77*7c478bd9Sstevel@tonic-gate 			ret = wbku_str_to_keyattr(value, ka, WBKU_ENCR_KEY);
78*7c478bd9Sstevel@tonic-gate 			if (ret != WBKU_SUCCESS) {
79*7c478bd9Sstevel@tonic-gate 				wbku_printerr("%s\n", wbku_retmsg(ret));
80*7c478bd9Sstevel@tonic-gate 				return (ENCR_ERROR);
81*7c478bd9Sstevel@tonic-gate 			}
82*7c478bd9Sstevel@tonic-gate 			break;
83*7c478bd9Sstevel@tonic-gate 		default:
84*7c478bd9Sstevel@tonic-gate 			wbku_printerr("Invalid option %s\n", value);
85*7c478bd9Sstevel@tonic-gate 			return (ENCR_ERROR);
86*7c478bd9Sstevel@tonic-gate 		}
87*7c478bd9Sstevel@tonic-gate 	}
88*7c478bd9Sstevel@tonic-gate 
89*7c478bd9Sstevel@tonic-gate 	return (ENCR_SUCCESS);
90*7c478bd9Sstevel@tonic-gate }
91*7c478bd9Sstevel@tonic-gate 
92*7c478bd9Sstevel@tonic-gate /*
93*7c478bd9Sstevel@tonic-gate  * This routine is used to find the key of type defined by 'ka' and
94*7c478bd9Sstevel@tonic-gate  * return it in 'key'. The key file should have been opened by the
95*7c478bd9Sstevel@tonic-gate  * caller and the handle passed in 'key_fp'.
96*7c478bd9Sstevel@tonic-gate  *
97*7c478bd9Sstevel@tonic-gate  * Returns:
98*7c478bd9Sstevel@tonic-gate  *	ENCR_SUCCESS, ENCR_ERROR or ENCR_NOKEY.
99*7c478bd9Sstevel@tonic-gate  */
100*7c478bd9Sstevel@tonic-gate static int
101*7c478bd9Sstevel@tonic-gate get_key(FILE *key_fp, wbku_key_attr_t *ka, uint8_t *key)
102*7c478bd9Sstevel@tonic-gate {
103*7c478bd9Sstevel@tonic-gate 	wbku_retcode_t ret;
104*7c478bd9Sstevel@tonic-gate 
105*7c478bd9Sstevel@tonic-gate 	/*
106*7c478bd9Sstevel@tonic-gate 	 * Find the client key, if it exists.
107*7c478bd9Sstevel@tonic-gate 	 */
108*7c478bd9Sstevel@tonic-gate 	ret = wbku_find_key(key_fp, NULL, ka, key, B_FALSE);
109*7c478bd9Sstevel@tonic-gate 	if (ret != WBKU_SUCCESS) {
110*7c478bd9Sstevel@tonic-gate 		wbku_printerr("%s\n", wbku_retmsg(ret));
111*7c478bd9Sstevel@tonic-gate 		if (ret == WBKU_NOKEY)
112*7c478bd9Sstevel@tonic-gate 			return (ENCR_NOKEY);
113*7c478bd9Sstevel@tonic-gate 		else
114*7c478bd9Sstevel@tonic-gate 			return (ENCR_ERROR);
115*7c478bd9Sstevel@tonic-gate 	}
116*7c478bd9Sstevel@tonic-gate 	return (ENCR_SUCCESS);
117*7c478bd9Sstevel@tonic-gate }
118*7c478bd9Sstevel@tonic-gate 
119*7c478bd9Sstevel@tonic-gate /*
120*7c478bd9Sstevel@tonic-gate  * This routine is the common encryption routine used to encrypt data
121*7c478bd9Sstevel@tonic-gate  * using the CBC handle initialized by the calling routine.  The data
122*7c478bd9Sstevel@tonic-gate  * to be encrypted is read from stdin and the encrypted data is written to
123*7c478bd9Sstevel@tonic-gate  * stdout.
124*7c478bd9Sstevel@tonic-gate  *
125*7c478bd9Sstevel@tonic-gate  * Returns:
126*7c478bd9Sstevel@tonic-gate  *	ENCR_SUCCESS or ENCR_ERROR.
127*7c478bd9Sstevel@tonic-gate  */
128*7c478bd9Sstevel@tonic-gate static int
129*7c478bd9Sstevel@tonic-gate encr_gen(cbc_handle_t *ch)
130*7c478bd9Sstevel@tonic-gate {
131*7c478bd9Sstevel@tonic-gate 	uint8_t iv[WANBOOT_MAXBLOCKLEN];
132*7c478bd9Sstevel@tonic-gate 	uint8_t buf[ENCR_BUF_LEN];
133*7c478bd9Sstevel@tonic-gate 	uint8_t *bufp;
134*7c478bd9Sstevel@tonic-gate 	int read_size;
135*7c478bd9Sstevel@tonic-gate 	ssize_t i, j, k;
136*7c478bd9Sstevel@tonic-gate 
137*7c478bd9Sstevel@tonic-gate 	/*
138*7c478bd9Sstevel@tonic-gate 	 * Use a random number as the IV
139*7c478bd9Sstevel@tonic-gate 	 */
140*7c478bd9Sstevel@tonic-gate 	if (wbio_nread_rand(iv, ch->blocklen) != 0) {
141*7c478bd9Sstevel@tonic-gate 		wbku_printerr("Cannot generate initialization vector");
142*7c478bd9Sstevel@tonic-gate 		return (ENCR_ERROR);
143*7c478bd9Sstevel@tonic-gate 	}
144*7c478bd9Sstevel@tonic-gate 
145*7c478bd9Sstevel@tonic-gate 	/*
146*7c478bd9Sstevel@tonic-gate 	 * Output the IV to stdout.
147*7c478bd9Sstevel@tonic-gate 	 */
148*7c478bd9Sstevel@tonic-gate 	if (wbio_nwrite(STDOUT_FILENO, iv, ch->blocklen) != 0) {
149*7c478bd9Sstevel@tonic-gate 		wbku_printerr("Write error encountered\n");
150*7c478bd9Sstevel@tonic-gate 		return (ENCR_ERROR);
151*7c478bd9Sstevel@tonic-gate 	}
152*7c478bd9Sstevel@tonic-gate 
153*7c478bd9Sstevel@tonic-gate 	/*
154*7c478bd9Sstevel@tonic-gate 	 * Try to read in multiple of block_size as CBC requires
155*7c478bd9Sstevel@tonic-gate 	 * that data be encrypted in block_size chunks.
156*7c478bd9Sstevel@tonic-gate 	 */
157*7c478bd9Sstevel@tonic-gate 	read_size = ENCR_BUF_LEN / ch->blocklen * ch->blocklen;
158*7c478bd9Sstevel@tonic-gate 	while ((i = read(STDIN_FILENO, buf, read_size)) > 0) {
159*7c478bd9Sstevel@tonic-gate 		/*
160*7c478bd9Sstevel@tonic-gate 		 * If data received is not a multiple of the block size,
161*7c478bd9Sstevel@tonic-gate 		 * try to receive more.  If reach EOF, pad the rest with
162*7c478bd9Sstevel@tonic-gate 		 * 0.
163*7c478bd9Sstevel@tonic-gate 		 */
164*7c478bd9Sstevel@tonic-gate 		if ((j = i % ch->blocklen) != 0) {
165*7c478bd9Sstevel@tonic-gate 			/*
166*7c478bd9Sstevel@tonic-gate 			 * Determine how more data need to be received to
167*7c478bd9Sstevel@tonic-gate 			 * fill out the buffer so that it contains a
168*7c478bd9Sstevel@tonic-gate 			 * multiple of block_size chunks.
169*7c478bd9Sstevel@tonic-gate 			 */
170*7c478bd9Sstevel@tonic-gate 			j = ch->blocklen - j;
171*7c478bd9Sstevel@tonic-gate 			bufp = buf + i;
172*7c478bd9Sstevel@tonic-gate 			k = j;
173*7c478bd9Sstevel@tonic-gate 
174*7c478bd9Sstevel@tonic-gate 			/*
175*7c478bd9Sstevel@tonic-gate 			 * Try to fill the gap.
176*7c478bd9Sstevel@tonic-gate 			 *
177*7c478bd9Sstevel@tonic-gate 			 */
178*7c478bd9Sstevel@tonic-gate 			while ((j = read(STDIN_FILENO, bufp, j)) != k &&
179*7c478bd9Sstevel@tonic-gate 			    j != 0) {
180*7c478bd9Sstevel@tonic-gate 				bufp += j;
181*7c478bd9Sstevel@tonic-gate 				k -= j;
182*7c478bd9Sstevel@tonic-gate 				j = k;
183*7c478bd9Sstevel@tonic-gate 			}
184*7c478bd9Sstevel@tonic-gate 
185*7c478bd9Sstevel@tonic-gate 			/*
186*7c478bd9Sstevel@tonic-gate 			 * This is the total length of the buffer.
187*7c478bd9Sstevel@tonic-gate 			 */
188*7c478bd9Sstevel@tonic-gate 			i = (i + ch->blocklen) - (i % ch->blocklen);
189*7c478bd9Sstevel@tonic-gate 
190*7c478bd9Sstevel@tonic-gate 			if (j == 0) {
191*7c478bd9Sstevel@tonic-gate 				/* EOF, do padding. */
192*7c478bd9Sstevel@tonic-gate 				(void) memset(bufp, 0, k);
193*7c478bd9Sstevel@tonic-gate 				(void) cbc_encrypt(ch, buf, i, iv);
194*7c478bd9Sstevel@tonic-gate 			} else if (j > 0) {
195*7c478bd9Sstevel@tonic-gate 				/* The gap has been filled in */
196*7c478bd9Sstevel@tonic-gate 				(void) cbc_encrypt(ch, buf, i, iv);
197*7c478bd9Sstevel@tonic-gate 			} else {
198*7c478bd9Sstevel@tonic-gate 				/* Oops. */
199*7c478bd9Sstevel@tonic-gate 				wbku_printerr("Input error");
200*7c478bd9Sstevel@tonic-gate 				return (ENCR_ERROR);
201*7c478bd9Sstevel@tonic-gate 			}
202*7c478bd9Sstevel@tonic-gate 		} else {
203*7c478bd9Sstevel@tonic-gate 			/* A multiple of the block size was received */
204*7c478bd9Sstevel@tonic-gate 			(void) cbc_encrypt(ch, buf, i, iv);
205*7c478bd9Sstevel@tonic-gate 		}
206*7c478bd9Sstevel@tonic-gate 		if (wbio_nwrite(STDOUT_FILENO, buf, i) != 0) {
207*7c478bd9Sstevel@tonic-gate 			wbku_printerr("Write error encountered\n");
208*7c478bd9Sstevel@tonic-gate 			return (ENCR_ERROR);
209*7c478bd9Sstevel@tonic-gate 		}
210*7c478bd9Sstevel@tonic-gate 	}
211*7c478bd9Sstevel@tonic-gate 
212*7c478bd9Sstevel@tonic-gate 	return (ENCR_SUCCESS);
213*7c478bd9Sstevel@tonic-gate }
214*7c478bd9Sstevel@tonic-gate 
215*7c478bd9Sstevel@tonic-gate /*
216*7c478bd9Sstevel@tonic-gate  * This routine initializes a CBC handle for 3DES and calls the
217*7c478bd9Sstevel@tonic-gate  * common encryption routine to encrypt data.
218*7c478bd9Sstevel@tonic-gate  *
219*7c478bd9Sstevel@tonic-gate  * Returns:
220*7c478bd9Sstevel@tonic-gate  *	ENCR_SUCCESS or ENCR_ERROR.
221*7c478bd9Sstevel@tonic-gate  */
222*7c478bd9Sstevel@tonic-gate static int
223*7c478bd9Sstevel@tonic-gate encr_gen_3des(const wbku_key_attr_t *ka, const uint8_t *key)
224*7c478bd9Sstevel@tonic-gate {
225*7c478bd9Sstevel@tonic-gate 	cbc_handle_t ch;
226*7c478bd9Sstevel@tonic-gate 	void *eh;
227*7c478bd9Sstevel@tonic-gate 	int ret;
228*7c478bd9Sstevel@tonic-gate 
229*7c478bd9Sstevel@tonic-gate 	/*
230*7c478bd9Sstevel@tonic-gate 	 * Initialize a 3DES handle.
231*7c478bd9Sstevel@tonic-gate 	 */
232*7c478bd9Sstevel@tonic-gate 	if (des3_init(&eh) != 0) {
233*7c478bd9Sstevel@tonic-gate 		return (ENCR_ERROR);
234*7c478bd9Sstevel@tonic-gate 	}
235*7c478bd9Sstevel@tonic-gate 	des3_key(eh, key);
236*7c478bd9Sstevel@tonic-gate 
237*7c478bd9Sstevel@tonic-gate 	/*
238*7c478bd9Sstevel@tonic-gate 	 * Initialize the CBC handle.
239*7c478bd9Sstevel@tonic-gate 	 */
240*7c478bd9Sstevel@tonic-gate 	cbc_makehandle(&ch, eh, ka->ka_len, DES3_BLOCK_SIZE,
241*7c478bd9Sstevel@tonic-gate 	    DES3_IV_SIZE, des3_encrypt, des3_decrypt);
242*7c478bd9Sstevel@tonic-gate 
243*7c478bd9Sstevel@tonic-gate 	/*
244*7c478bd9Sstevel@tonic-gate 	 * Encrypt the data.
245*7c478bd9Sstevel@tonic-gate 	 */
246*7c478bd9Sstevel@tonic-gate 	ret = encr_gen(&ch);
247*7c478bd9Sstevel@tonic-gate 
248*7c478bd9Sstevel@tonic-gate 	/*
249*7c478bd9Sstevel@tonic-gate 	 *  Free the 3DES resources.
250*7c478bd9Sstevel@tonic-gate 	 */
251*7c478bd9Sstevel@tonic-gate 	des3_fini(eh);
252*7c478bd9Sstevel@tonic-gate 
253*7c478bd9Sstevel@tonic-gate 	return (ret);
254*7c478bd9Sstevel@tonic-gate }
255*7c478bd9Sstevel@tonic-gate 
256*7c478bd9Sstevel@tonic-gate /*
257*7c478bd9Sstevel@tonic-gate  * This routine initializes a CBC handle for AES and calls the
258*7c478bd9Sstevel@tonic-gate  * common encryption routine to encrypt data.
259*7c478bd9Sstevel@tonic-gate  *
260*7c478bd9Sstevel@tonic-gate  * Returns:
261*7c478bd9Sstevel@tonic-gate  *	ENCR_SUCCESS or ENCR_ERROR.
262*7c478bd9Sstevel@tonic-gate  */
263*7c478bd9Sstevel@tonic-gate static int
264*7c478bd9Sstevel@tonic-gate encr_gen_aes(const wbku_key_attr_t *ka, const uint8_t *key)
265*7c478bd9Sstevel@tonic-gate {
266*7c478bd9Sstevel@tonic-gate 	cbc_handle_t ch;
267*7c478bd9Sstevel@tonic-gate 	void *eh;
268*7c478bd9Sstevel@tonic-gate 	int ret;
269*7c478bd9Sstevel@tonic-gate 
270*7c478bd9Sstevel@tonic-gate 	/*
271*7c478bd9Sstevel@tonic-gate 	 * Initialize an AES handle.
272*7c478bd9Sstevel@tonic-gate 	 */
273*7c478bd9Sstevel@tonic-gate 	if (aes_init(&eh) != 0) {
274*7c478bd9Sstevel@tonic-gate 		return (ENCR_ERROR);
275*7c478bd9Sstevel@tonic-gate 	}
276*7c478bd9Sstevel@tonic-gate 	aes_key(eh, key, ka->ka_len);
277*7c478bd9Sstevel@tonic-gate 
278*7c478bd9Sstevel@tonic-gate 	/*
279*7c478bd9Sstevel@tonic-gate 	 * Initialize the CBC handle.
280*7c478bd9Sstevel@tonic-gate 	 */
281*7c478bd9Sstevel@tonic-gate 	cbc_makehandle(&ch, eh, ka->ka_len, AES_BLOCK_SIZE,
282*7c478bd9Sstevel@tonic-gate 	    AES_IV_SIZE, aes_encrypt, aes_decrypt);
283*7c478bd9Sstevel@tonic-gate 
284*7c478bd9Sstevel@tonic-gate 	/*
285*7c478bd9Sstevel@tonic-gate 	 * Encrypt the data.
286*7c478bd9Sstevel@tonic-gate 	 */
287*7c478bd9Sstevel@tonic-gate 	ret = encr_gen(&ch);
288*7c478bd9Sstevel@tonic-gate 
289*7c478bd9Sstevel@tonic-gate 	/*
290*7c478bd9Sstevel@tonic-gate 	 *  Free the AES resources.
291*7c478bd9Sstevel@tonic-gate 	 */
292*7c478bd9Sstevel@tonic-gate 	aes_fini(eh);
293*7c478bd9Sstevel@tonic-gate 
294*7c478bd9Sstevel@tonic-gate 	return (ret);
295*7c478bd9Sstevel@tonic-gate }
296*7c478bd9Sstevel@tonic-gate 
297*7c478bd9Sstevel@tonic-gate /*
298*7c478bd9Sstevel@tonic-gate  * Prints usage().
299*7c478bd9Sstevel@tonic-gate  */
300*7c478bd9Sstevel@tonic-gate static void
301*7c478bd9Sstevel@tonic-gate usage(const char *cmd)
302*7c478bd9Sstevel@tonic-gate {
303*7c478bd9Sstevel@tonic-gate 	(void) fprintf(stderr,
304*7c478bd9Sstevel@tonic-gate 	    gettext("Usage: %s -o type=<%s|%s> -k key_file\n"),
305*7c478bd9Sstevel@tonic-gate 	    cmd, WBKU_KW_3DES, WBKU_KW_AES_128);
306*7c478bd9Sstevel@tonic-gate }
307*7c478bd9Sstevel@tonic-gate 
308*7c478bd9Sstevel@tonic-gate /*
309*7c478bd9Sstevel@tonic-gate  * This program is used to encrypt data read from stdin and print it to
310*7c478bd9Sstevel@tonic-gate  * stdout. The path to the key file and the algorithm to use are
311*7c478bd9Sstevel@tonic-gate  * provided by the user.
312*7c478bd9Sstevel@tonic-gate  *
313*7c478bd9Sstevel@tonic-gate  * Returns:
314*7c478bd9Sstevel@tonic-gate  *	ENCR_SUCCESS, ENCR_ERROR or ENCR_NOKEY.
315*7c478bd9Sstevel@tonic-gate  */
316*7c478bd9Sstevel@tonic-gate int
317*7c478bd9Sstevel@tonic-gate main(int argc, char **argv)
318*7c478bd9Sstevel@tonic-gate {
319*7c478bd9Sstevel@tonic-gate 	uint8_t key[WANBOOT_MAXKEYLEN];
320*7c478bd9Sstevel@tonic-gate 	int c;
321*7c478bd9Sstevel@tonic-gate 	char *keyfile_name = NULL;
322*7c478bd9Sstevel@tonic-gate 	wbku_key_attr_t ka;
323*7c478bd9Sstevel@tonic-gate 	FILE *key_fp;
324*7c478bd9Sstevel@tonic-gate 	int ret;
325*7c478bd9Sstevel@tonic-gate 
326*7c478bd9Sstevel@tonic-gate 	/*
327*7c478bd9Sstevel@tonic-gate 	 * Do the necessary magic for localization support.
328*7c478bd9Sstevel@tonic-gate 	 */
329*7c478bd9Sstevel@tonic-gate 	(void) setlocale(LC_ALL, "");
330*7c478bd9Sstevel@tonic-gate #if !defined(TEXT_DOMAIN)
331*7c478bd9Sstevel@tonic-gate #define	TEXT_DOMAIN "SYS_TEST"
332*7c478bd9Sstevel@tonic-gate #endif
333*7c478bd9Sstevel@tonic-gate 	(void) textdomain(TEXT_DOMAIN);
334*7c478bd9Sstevel@tonic-gate 
335*7c478bd9Sstevel@tonic-gate 	/*
336*7c478bd9Sstevel@tonic-gate 	 * Initialize program name for use by wbku_printerr().
337*7c478bd9Sstevel@tonic-gate 	 */
338*7c478bd9Sstevel@tonic-gate 	wbku_errinit(argv[0]);
339*7c478bd9Sstevel@tonic-gate 
340*7c478bd9Sstevel@tonic-gate 	/*
341*7c478bd9Sstevel@tonic-gate 	 * Should be five arguments.
342*7c478bd9Sstevel@tonic-gate 	 */
343*7c478bd9Sstevel@tonic-gate 	if (argc < 5) {
344*7c478bd9Sstevel@tonic-gate 		usage(argv[0]);
345*7c478bd9Sstevel@tonic-gate 		return (ENCR_ERROR);
346*7c478bd9Sstevel@tonic-gate 	}
347*7c478bd9Sstevel@tonic-gate 
348*7c478bd9Sstevel@tonic-gate 	/*
349*7c478bd9Sstevel@tonic-gate 	 * Parse the options.
350*7c478bd9Sstevel@tonic-gate 	 */
351*7c478bd9Sstevel@tonic-gate 	ka.ka_type = WBKU_KEY_UNKNOWN;
352*7c478bd9Sstevel@tonic-gate 	while ((c = getopt(argc, argv, "o:k:")) != EOF) {
353*7c478bd9Sstevel@tonic-gate 		switch (c) {
354*7c478bd9Sstevel@tonic-gate 		case 'o':
355*7c478bd9Sstevel@tonic-gate 			/*
356*7c478bd9Sstevel@tonic-gate 			 * Suboptions.
357*7c478bd9Sstevel@tonic-gate 			 */
358*7c478bd9Sstevel@tonic-gate 			ret = process_option(optarg, &ka);
359*7c478bd9Sstevel@tonic-gate 			if (ret != ENCR_SUCCESS) {
360*7c478bd9Sstevel@tonic-gate 				usage(argv[0]);
361*7c478bd9Sstevel@tonic-gate 				return (ret);
362*7c478bd9Sstevel@tonic-gate 			}
363*7c478bd9Sstevel@tonic-gate 			break;
364*7c478bd9Sstevel@tonic-gate 		case 'k':
365*7c478bd9Sstevel@tonic-gate 			/*
366*7c478bd9Sstevel@tonic-gate 			 * Path to key file.
367*7c478bd9Sstevel@tonic-gate 			 */
368*7c478bd9Sstevel@tonic-gate 			keyfile_name = optarg;
369*7c478bd9Sstevel@tonic-gate 			break;
370*7c478bd9Sstevel@tonic-gate 		default:
371*7c478bd9Sstevel@tonic-gate 			usage(argv[0]);
372*7c478bd9Sstevel@tonic-gate 			return (ENCR_ERROR);
373*7c478bd9Sstevel@tonic-gate 		}
374*7c478bd9Sstevel@tonic-gate 	}
375*7c478bd9Sstevel@tonic-gate 
376*7c478bd9Sstevel@tonic-gate 	/*
377*7c478bd9Sstevel@tonic-gate 	 * Gotta have a key file.
378*7c478bd9Sstevel@tonic-gate 	 */
379*7c478bd9Sstevel@tonic-gate 	if (keyfile_name == NULL) {
380*7c478bd9Sstevel@tonic-gate 		wbku_printerr("Must specify the key_file\n");
381*7c478bd9Sstevel@tonic-gate 		return (ENCR_ERROR);
382*7c478bd9Sstevel@tonic-gate 	}
383*7c478bd9Sstevel@tonic-gate 
384*7c478bd9Sstevel@tonic-gate 	/*
385*7c478bd9Sstevel@tonic-gate 	 * Gotta have a key type.
386*7c478bd9Sstevel@tonic-gate 	 */
387*7c478bd9Sstevel@tonic-gate 	if (ka.ka_type == WBKU_KEY_UNKNOWN) {
388*7c478bd9Sstevel@tonic-gate 		wbku_printerr("Unsupported encryption algorithm\n");
389*7c478bd9Sstevel@tonic-gate 		return (ENCR_ERROR);
390*7c478bd9Sstevel@tonic-gate 	}
391*7c478bd9Sstevel@tonic-gate 
392*7c478bd9Sstevel@tonic-gate 	/*
393*7c478bd9Sstevel@tonic-gate 	 * Open the key file for reading.
394*7c478bd9Sstevel@tonic-gate 	 */
395*7c478bd9Sstevel@tonic-gate 	if ((key_fp = fopen(keyfile_name, "r")) == NULL) {
396*7c478bd9Sstevel@tonic-gate 		wbku_printerr("Cannot open %s", keyfile_name);
397*7c478bd9Sstevel@tonic-gate 		return (ENCR_ERROR);
398*7c478bd9Sstevel@tonic-gate 	}
399*7c478bd9Sstevel@tonic-gate 
400*7c478bd9Sstevel@tonic-gate 	/*
401*7c478bd9Sstevel@tonic-gate 	 * Get the key from the key file and call the right
402*7c478bd9Sstevel@tonic-gate 	 * encryption routine.
403*7c478bd9Sstevel@tonic-gate 	 */
404*7c478bd9Sstevel@tonic-gate 	ret = get_key(key_fp, &ka, key);
405*7c478bd9Sstevel@tonic-gate 	if (ret == ENCR_SUCCESS) {
406*7c478bd9Sstevel@tonic-gate 		switch (ka.ka_type) {
407*7c478bd9Sstevel@tonic-gate 		case WBKU_KEY_3DES:
408*7c478bd9Sstevel@tonic-gate 			ret = encr_gen_3des(&ka, key);
409*7c478bd9Sstevel@tonic-gate 			break;
410*7c478bd9Sstevel@tonic-gate 		case WBKU_KEY_AES_128:
411*7c478bd9Sstevel@tonic-gate 			ret = encr_gen_aes(&ka, key);
412*7c478bd9Sstevel@tonic-gate 			break;
413*7c478bd9Sstevel@tonic-gate 		default:
414*7c478bd9Sstevel@tonic-gate 			ret = ENCR_ERROR;	/* Internal error only */
415*7c478bd9Sstevel@tonic-gate 		}
416*7c478bd9Sstevel@tonic-gate 	}
417*7c478bd9Sstevel@tonic-gate 
418*7c478bd9Sstevel@tonic-gate 	(void) fclose(key_fp);
419*7c478bd9Sstevel@tonic-gate 	return (ret);
420*7c478bd9Sstevel@tonic-gate }
421