1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #ifndef _CRYPTOUTIL_H 27 #define _CRYPTOUTIL_H 28 29 #ifdef __cplusplus 30 extern "C" { 31 #endif 32 33 #include <sys/types.h> 34 #include <syslog.h> 35 #include <security/cryptoki.h> 36 #include <sys/param.h> 37 38 #define LOG_STDERR -1 39 #define SUCCESS 0 40 #define FAILURE 1 41 #define MECH_ID_HEX_LEN 11 /* length of mechanism id in hex form */ 42 43 #define _PATH_PKCS11_CONF "/etc/crypto/pkcs11.conf" 44 #define _PATH_KCF_CONF "/etc/crypto/kcf.conf" 45 #define _PATH_KCFD_LOCK "/var/run/kcfd.lock" 46 47 /* $ISA substitution for parsing pkcs11.conf data */ 48 #define PKCS11_ISA "/$ISA/" 49 #if defined(_LP64) 50 #define PKCS11_ISA_DIR "/64/" 51 #else /* !_LP64 */ 52 #define PKCS11_ISA_DIR "/" 53 #endif 54 55 /* keywords and delimiters for parsing configuration files */ 56 #define SEP_COLON ":" 57 #define SEP_SEMICOLON ";" 58 #define SEP_EQUAL "=" 59 #define SEP_COMMA "," 60 #define METASLOT_KEYWORD "metaslot" 61 #define FIPS_KEYWORD "fips-140" 62 #define EF_DISABLED "disabledlist=" 63 #define EF_ENABLED "enabledlist=" 64 #define EF_NORANDOM "NO_RANDOM" 65 #define METASLOT_TOKEN "metaslot_token=" 66 #define METASLOT_SLOT "metaslot_slot=" 67 #define METASLOT_STATUS "metaslot_status=" 68 #define EF_FIPS_STATUS "fips_status=" 69 #define METASLOT_AUTO_KEY_MIGRATE "metaslot_auto_key_migrate=" 70 #define ENABLED_KEYWORD "enabled" 71 #define DISABLED_KEYWORD "disabled" 72 #define SLOT_DESCRIPTION_SIZE 64 73 #define TOKEN_LABEL_SIZE 32 74 #define TOKEN_MANUFACTURER_SIZE 32 75 #define TOKEN_SERIAL_SIZE 16 76 #define CRYPTO_FIPS_MODE_DISABLED 0 77 #define CRYPTO_FIPS_MODE_ENABLED 1 78 79 /* 80 * Define the following softtoken values that are used by softtoken 81 * library, cryptoadm and pktool command. 82 */ 83 #define SOFT_SLOT_DESCRIPTION \ 84 "Sun Crypto Softtoken " \ 85 " " 86 #define SOFT_TOKEN_LABEL "Sun Software PKCS#11 softtoken " 87 #define SOFT_TOKEN_SERIAL " " 88 #define SOFT_MANUFACTURER_ID "Sun Microsystems, Inc. " 89 #define SOFT_DEFAULT_PIN "changeme" 90 91 typedef char libname_t[MAXPATHLEN]; 92 typedef char midstr_t[MECH_ID_HEX_LEN]; 93 94 typedef struct umechlist { 95 midstr_t name; /* mechanism name in hex form */ 96 struct umechlist *next; 97 } umechlist_t; 98 99 typedef struct uentry { 100 libname_t name; 101 boolean_t flag_norandom; /* TRUE if random is disabled */ 102 boolean_t flag_enabledlist; /* TRUE if an enabledlist */ 103 umechlist_t *policylist; /* disabledlist or enabledlist */ 104 boolean_t flag_metaslot_enabled; /* TRUE if metaslot's enabled */ 105 boolean_t flag_metaslot_auto_key_migrate; 106 CK_UTF8CHAR metaslot_ks_slot[SLOT_DESCRIPTION_SIZE + 1]; 107 CK_UTF8CHAR metaslot_ks_token[TOKEN_LABEL_SIZE + 1]; 108 int count; 109 boolean_t flag_fips_enabled; 110 } uentry_t; 111 112 typedef struct uentrylist { 113 uentry_t *puent; 114 struct uentrylist *next; 115 } uentrylist_t; 116 117 extern void cryptodebug(const char *fmt, ...); 118 extern void cryptoerror(int priority, const char *fmt, ...); 119 extern void cryptodebug_init(const char *prefix); 120 extern void cryptoerror_off(); 121 extern void cryptoerror_on(); 122 123 extern const char *pkcs11_mech2str(CK_MECHANISM_TYPE mech); 124 extern CK_RV pkcs11_str2mech(char *mech_str, CK_MECHANISM_TYPE_PTR mech); 125 126 extern int get_pkcs11conf_info(uentrylist_t **); 127 extern umechlist_t *create_umech(char *); 128 extern void free_umechlist(umechlist_t *); 129 extern void free_uentrylist(uentrylist_t *); 130 extern void free_uentry(uentry_t *); 131 extern uentry_t *getent_uef(char *); 132 133 extern void tohexstr(uchar_t *bytes, size_t blen, char *hexstr, size_t hexlen); 134 extern int hexstr_to_bytes(char *hexstr, size_t hexlen, uchar_t **bytes, 135 size_t *blen); 136 extern CK_RV pkcs11_mech2keytype(CK_MECHANISM_TYPE mech_type, 137 CK_KEY_TYPE *ktype); 138 extern CK_RV pkcs11_mech2keygen(CK_MECHANISM_TYPE mech_type, 139 CK_MECHANISM_TYPE *gen_mech); 140 extern char *pkcs11_strerror(CK_RV rv); 141 142 extern int 143 get_metaslot_info(boolean_t *status_enabled, boolean_t *migrate_enabled, 144 char **objectstore_slot_info, char **objectstore_token_info); 145 146 extern char *get_fullpath(char *dir, char *filepath); 147 extern int str2lifetime(char *ltimestr, uint32_t *ltime); 148 149 extern char *pkcs11_default_token(void); 150 extern int pkcs11_get_pass(char *token_name, char **pdata, size_t *psize, 151 size_t min_psize, boolean_t with_confirmation); 152 153 extern int pkcs11_seed_urandom(void *sbuf, size_t slen); 154 extern int pkcs11_get_random(void *dbuf, size_t dlen); 155 extern int pkcs11_get_urandom(void *dbuf, size_t dlen); 156 extern int pkcs11_get_nzero_urandom(void *dbuf, size_t dlen); 157 extern void pkcs11_close_random(void); 158 extern void pkcs11_close_urandom(void); 159 extern void pkcs11_close_urandom_seed(void); 160 extern int pkcs11_read_data(char *filename, void **dbuf, size_t *dlen); 161 162 extern int open_nointr(const char *path, int oflag, ...); 163 extern ssize_t readn_nointr(int fd, void *dbuf, size_t dlen); 164 extern ssize_t writen_nointr(int fd, void *dbuf, size_t dlen); 165 extern int update_conf(char *conf_file, char *entry); 166 167 extern CK_RV get_fips_mode(int *); 168 169 #ifdef __cplusplus 170 } 171 #endif 172 173 #endif /* _CRYPTOUTIL_H */ 174