xref: /titanic_52/usr/src/cmd/cmd-crypto/pktool/import.c (revision 3c112a2b34403220c06c3e2fcac403358cfba168)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
23  * Use is subject to license terms.
24  */
25 
26 /*
27  * This file implements the import operation for this tool.
28  * The basic flow of the process is to decrypt the PKCS#12
29  * input file if it has a password, parse the elements in
30  * the file, find the soft token, log into it, import the
31  * PKCS#11 objects into the soft token, and log out.
32  */
33 
34 #include <stdio.h>
35 #include <stdlib.h>
36 #include <string.h>
37 #include <ctype.h>
38 #include <errno.h>
39 #include <fcntl.h>
40 #include <sys/types.h>
41 #include <sys/stat.h>
42 #include "common.h"
43 
44 #include <kmfapi.h>
45 
46 #define	NEW_ATTRLIST(a, n) \
47 { \
48 	a = (KMF_ATTRIBUTE *)malloc(n * sizeof (KMF_ATTRIBUTE)); \
49 	if (a == NULL) { \
50 		rv = KMF_ERR_MEMORY; \
51 		goto end; \
52 	} \
53 	(void) memset(a, 0, n * sizeof (KMF_ATTRIBUTE));  \
54 }
55 
56 static KMF_RETURN
57 pk_import_pk12_files(KMF_HANDLE_T kmfhandle, KMF_CREDENTIAL *cred,
58 	char *outfile, char *certfile, char *keyfile,
59 	KMF_ENCODE_FORMAT outformat)
60 {
61 	KMF_RETURN rv = KMF_OK;
62 	KMF_X509_DER_CERT *certs = NULL;
63 	KMF_RAW_KEY_DATA *keys = NULL;
64 	int ncerts = 0;
65 	int nkeys = 0;
66 	int i;
67 	KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_OPENSSL;
68 	KMF_ATTRIBUTE *attrlist = NULL;
69 	int numattr = 0;
70 
71 	rv = kmf_import_objects(kmfhandle, outfile, cred,
72 	    &certs, &ncerts, &keys, &nkeys);
73 
74 	if (rv == KMF_OK) {
75 		(void) printf(gettext("Found %d certificate(s) and %d "
76 		    "key(s) in %s\n"), ncerts, nkeys, outfile);
77 	}
78 
79 	if (rv == KMF_OK && ncerts > 0) {
80 		char newcertfile[MAXPATHLEN];
81 
82 		NEW_ATTRLIST(attrlist,  (3 + (3 * ncerts)));
83 
84 		kmf_set_attr_at_index(attrlist, numattr,
85 		    KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
86 		numattr++;
87 
88 		kmf_set_attr_at_index(attrlist, numattr,
89 		    KMF_ENCODE_FORMAT_ATTR, &outformat, sizeof (outformat));
90 		numattr++;
91 
92 		for (i = 0; rv == KMF_OK && i < ncerts; i++) {
93 			int num = numattr;
94 
95 			/*
96 			 * If storing more than 1 cert, gotta change
97 			 * the name so we don't overwrite the previous one.
98 			 * Just append a _# to the name.
99 			 */
100 			if (i > 0) {
101 				(void) snprintf(newcertfile,
102 				    sizeof (newcertfile), "%s_%d", certfile, i);
103 
104 				kmf_set_attr_at_index(attrlist, num,
105 				    KMF_CERT_FILENAME_ATTR, newcertfile,
106 				    strlen(newcertfile));
107 				num++;
108 			} else {
109 				kmf_set_attr_at_index(attrlist, num,
110 				    KMF_CERT_FILENAME_ATTR, certfile,
111 				    strlen(certfile));
112 				num++;
113 			}
114 
115 			if (certs[i].kmf_private.label != NULL) {
116 				kmf_set_attr_at_index(attrlist, num,
117 				    KMF_CERT_LABEL_ATTR,
118 				    certs[i].kmf_private.label,
119 				    strlen(certs[i].kmf_private.label));
120 				num++;
121 			}
122 			kmf_set_attr_at_index(attrlist, num,
123 			    KMF_CERT_DATA_ATTR, &certs[i].certificate,
124 			    sizeof (KMF_DATA));
125 			num++;
126 			rv = kmf_store_cert(kmfhandle, num, attrlist);
127 		}
128 		free(attrlist);
129 	}
130 	if (rv == KMF_OK && nkeys > 0) {
131 		char newkeyfile[MAXPATHLEN];
132 		numattr = 0;
133 		NEW_ATTRLIST(attrlist, (4 + (4 * nkeys)));
134 
135 		kmf_set_attr_at_index(attrlist, numattr,
136 		    KMF_KEYSTORE_TYPE_ATTR, &kstype,
137 		    sizeof (kstype));
138 		numattr++;
139 
140 		kmf_set_attr_at_index(attrlist, numattr,
141 		    KMF_ENCODE_FORMAT_ATTR, &outformat,
142 		    sizeof (outformat));
143 		numattr++;
144 
145 		if (cred != NULL && cred->credlen > 0) {
146 			kmf_set_attr_at_index(attrlist, numattr,
147 			    KMF_CREDENTIAL_ATTR, cred,
148 			    sizeof (KMF_CREDENTIAL));
149 			numattr++;
150 		}
151 
152 		/* The order of certificates and keys should match */
153 		for (i = 0; rv == KMF_OK && i < nkeys; i++) {
154 			int num = numattr;
155 
156 			if (i > 0) {
157 				(void) snprintf(newkeyfile,
158 				    sizeof (newkeyfile), "%s_%d", keyfile, i);
159 
160 				kmf_set_attr_at_index(attrlist, num,
161 				    KMF_KEY_FILENAME_ATTR, newkeyfile,
162 				    strlen(newkeyfile));
163 				num++;
164 			} else {
165 				kmf_set_attr_at_index(attrlist, num,
166 				    KMF_KEY_FILENAME_ATTR, keyfile,
167 				    strlen(keyfile));
168 				num++;
169 			}
170 
171 			if (i < ncerts) {
172 				kmf_set_attr_at_index(attrlist, num,
173 				    KMF_CERT_DATA_ATTR, &certs[i],
174 				    sizeof (KMF_CERT_DATA_ATTR));
175 				num++;
176 			}
177 
178 			kmf_set_attr_at_index(attrlist, num,
179 			    KMF_RAW_KEY_ATTR, &keys[i],
180 			    sizeof (KMF_RAW_KEY_DATA));
181 			num++;
182 
183 			rv = kmf_store_key(kmfhandle, num, attrlist);
184 		}
185 		free(attrlist);
186 	}
187 end:
188 	/*
189 	 * Cleanup memory.
190 	 */
191 	if (certs) {
192 		for (i = 0; i < ncerts; i++)
193 			kmf_free_kmf_cert(kmfhandle, &certs[i]);
194 		free(certs);
195 	}
196 	if (keys) {
197 		for (i = 0; i < nkeys; i++)
198 			kmf_free_raw_key(&keys[i]);
199 		free(keys);
200 	}
201 
202 
203 	return (rv);
204 }
205 
206 
207 static KMF_RETURN
208 pk_import_pk12_nss(
209 	KMF_HANDLE_T kmfhandle, KMF_CREDENTIAL *kmfcred,
210 	KMF_CREDENTIAL *tokencred,
211 	char *token_spec, char *dir, char *prefix,
212 	char *nickname, char *trustflags, char *filename)
213 {
214 	KMF_RETURN rv = KMF_OK;
215 	KMF_X509_DER_CERT *certs = NULL;
216 	KMF_RAW_KEY_DATA *keys = NULL;
217 	int ncerts = 0;
218 	int nkeys = 0;
219 	int i;
220 	KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_NSS;
221 	KMF_ATTRIBUTE *attrlist = NULL;
222 	int numattr = 0;
223 
224 	rv = configure_nss(kmfhandle, dir, prefix);
225 	if (rv != KMF_OK)
226 		return (rv);
227 
228 	rv = kmf_import_objects(kmfhandle, filename, kmfcred,
229 	    &certs, &ncerts, &keys, &nkeys);
230 
231 	if (rv == KMF_OK)
232 		(void) printf(gettext("Found %d certificate(s) and %d "
233 		    "key(s) in %s\n"), ncerts, nkeys, filename);
234 
235 	if (rv == KMF_OK) {
236 		numattr = 0;
237 		NEW_ATTRLIST(attrlist, (4 + (2 * nkeys)));
238 
239 		kmf_set_attr_at_index(attrlist, numattr,
240 		    KMF_KEYSTORE_TYPE_ATTR, &kstype,
241 		    sizeof (kstype));
242 		numattr++;
243 
244 		if (token_spec != NULL) {
245 			kmf_set_attr_at_index(attrlist, numattr,
246 			    KMF_TOKEN_LABEL_ATTR, token_spec,
247 			    strlen(token_spec));
248 			numattr++;
249 		}
250 
251 		if (nickname != NULL) {
252 			kmf_set_attr_at_index(attrlist, numattr,
253 			    KMF_KEYLABEL_ATTR, nickname,
254 			    strlen(nickname));
255 			numattr++;
256 		}
257 
258 		if (tokencred->credlen > 0) {
259 			kmf_set_attr_at_index(attrlist, numattr,
260 			    KMF_CREDENTIAL_ATTR, tokencred,
261 			    sizeof (KMF_CREDENTIAL));
262 			numattr++;
263 		}
264 
265 		/* The order of certificates and keys should match */
266 		for (i = 0; i < nkeys; i++) {
267 			int num = numattr;
268 
269 			if (i < ncerts) {
270 				kmf_set_attr_at_index(attrlist, num,
271 				    KMF_CERT_DATA_ATTR, &certs[i],
272 				    sizeof (KMF_DATA));
273 				num++;
274 			}
275 
276 			kmf_set_attr_at_index(attrlist, num,
277 			    KMF_RAW_KEY_ATTR, &keys[i],
278 			    sizeof (KMF_RAW_KEY_DATA));
279 			num++;
280 
281 			rv = kmf_store_key(kmfhandle, num, attrlist);
282 		}
283 		free(attrlist);
284 		attrlist = NULL;
285 	}
286 
287 	if (rv == KMF_OK) {
288 		numattr = 0;
289 		NEW_ATTRLIST(attrlist, (3 + (2 * ncerts)));
290 
291 		kmf_set_attr_at_index(attrlist, numattr,
292 		    KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
293 		numattr++;
294 
295 		if (token_spec != NULL) {
296 			kmf_set_attr_at_index(attrlist, numattr,
297 			    KMF_TOKEN_LABEL_ATTR, token_spec,
298 			    strlen(token_spec));
299 			numattr++;
300 		}
301 
302 		if (trustflags != NULL) {
303 			kmf_set_attr_at_index(attrlist, numattr,
304 			    KMF_TRUSTFLAG_ATTR, trustflags,
305 			    strlen(trustflags));
306 			numattr++;
307 		}
308 
309 		for (i = 0; rv == KMF_OK && i < ncerts; i++) {
310 			int num = numattr;
311 
312 			if (certs[i].kmf_private.label != NULL) {
313 				kmf_set_attr_at_index(attrlist, num,
314 				    KMF_CERT_LABEL_ATTR,
315 				    certs[i].kmf_private.label,
316 				    strlen(certs[i].kmf_private.label));
317 				num++;
318 			} else if (i == 0 && nickname != NULL) {
319 				kmf_set_attr_at_index(attrlist, num,
320 				    KMF_CERT_LABEL_ATTR, nickname,
321 				    strlen(nickname));
322 				num++;
323 			}
324 
325 			kmf_set_attr_at_index(attrlist, num,
326 			    KMF_CERT_DATA_ATTR,
327 			    &certs[i].certificate, sizeof (KMF_DATA));
328 			num++;
329 			rv = kmf_store_cert(kmfhandle, num, attrlist);
330 		}
331 		free(attrlist);
332 		attrlist = NULL;
333 		if (rv != KMF_OK) {
334 			display_error(kmfhandle, rv,
335 			    gettext("Error storing certificate in NSS token"));
336 		}
337 	}
338 
339 end:
340 	/*
341 	 * Cleanup memory.
342 	 */
343 	if (certs) {
344 		for (i = 0; i < ncerts; i++)
345 			kmf_free_kmf_cert(kmfhandle, &certs[i]);
346 		free(certs);
347 	}
348 	if (keys) {
349 		for (i = 0; i < nkeys; i++)
350 			kmf_free_raw_key(&keys[i]);
351 		free(keys);
352 	}
353 
354 	return (rv);
355 }
356 
357 static KMF_RETURN
358 pk_import_cert(
359 	KMF_HANDLE_T kmfhandle,
360 	KMF_KEYSTORE_TYPE kstype,
361 	char *label, char *token_spec, char *filename,
362 	char *dir, char *prefix, char *trustflags)
363 {
364 	KMF_RETURN rv = KMF_OK;
365 	KMF_ATTRIBUTE attrlist[32];
366 	KMF_CREDENTIAL tokencred;
367 	int i = 0;
368 
369 	if (kstype == KMF_KEYSTORE_PK11TOKEN) {
370 		rv = select_token(kmfhandle, token_spec, FALSE);
371 	} else if (kstype == KMF_KEYSTORE_NSS) {
372 		rv = configure_nss(kmfhandle, dir, prefix);
373 	}
374 	if (rv != KMF_OK)
375 		return (rv);
376 
377 	kmf_set_attr_at_index(attrlist, i,
378 	    KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (KMF_KEYSTORE_TYPE));
379 	i++;
380 
381 	kmf_set_attr_at_index(attrlist, i, KMF_CERT_FILENAME_ATTR,
382 	    filename, strlen(filename));
383 	i++;
384 
385 	if (label != NULL) {
386 		kmf_set_attr_at_index(attrlist, i, KMF_CERT_LABEL_ATTR,
387 		    label, strlen(label));
388 		i++;
389 	}
390 
391 	if (kstype == KMF_KEYSTORE_NSS) {
392 		if (trustflags != NULL) {
393 			kmf_set_attr_at_index(attrlist, i, KMF_TRUSTFLAG_ATTR,
394 			    trustflags, strlen(trustflags));
395 			i++;
396 		}
397 
398 		if (token_spec != NULL) {
399 			kmf_set_attr_at_index(attrlist, i,
400 			    KMF_TOKEN_LABEL_ATTR,
401 			    token_spec, strlen(token_spec));
402 			i++;
403 		}
404 	}
405 
406 	rv = kmf_import_cert(kmfhandle, i, attrlist);
407 	if (rv == KMF_ERR_AUTH_FAILED) {
408 		/*
409 		 * The token requires a credential, prompt and try again.
410 		 */
411 		(void) get_token_password(kstype, token_spec, &tokencred);
412 		kmf_set_attr_at_index(attrlist, i, KMF_CREDENTIAL_ATTR,
413 		    &tokencred, sizeof (KMF_CREDENTIAL));
414 		i++;
415 
416 		rv = kmf_import_cert(kmfhandle, i, attrlist);
417 
418 	}
419 	return (rv);
420 }
421 
422 static KMF_RETURN
423 pk_import_file_crl(void *kmfhandle,
424 	char *infile,
425 	char *outfile,
426 	KMF_ENCODE_FORMAT outfmt)
427 {
428 	int numattr = 0;
429 	KMF_ATTRIBUTE attrlist[8];
430 	KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_OPENSSL;
431 
432 	kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
433 	    &kstype, sizeof (kstype));
434 	numattr++;
435 	if (infile) {
436 		kmf_set_attr_at_index(attrlist, numattr,
437 		    KMF_CRL_FILENAME_ATTR, infile, strlen(infile));
438 		numattr++;
439 	}
440 	if (outfile) {
441 		kmf_set_attr_at_index(attrlist, numattr,
442 		    KMF_CRL_OUTFILE_ATTR, outfile, strlen(outfile));
443 		numattr++;
444 	}
445 	kmf_set_attr_at_index(attrlist, numattr,
446 	    KMF_ENCODE_FORMAT_ATTR, &outfmt, sizeof (outfmt));
447 	numattr++;
448 
449 	return (kmf_import_crl(kmfhandle, numattr, attrlist));
450 }
451 
452 static KMF_RETURN
453 pk_import_nss_crl(void *kmfhandle,
454 	boolean_t verify_crl_flag,
455 	char *infile,
456 	char *outdir,
457 	char *prefix)
458 {
459 	KMF_RETURN rv;
460 	int numattr = 0;
461 	KMF_ATTRIBUTE attrlist[4];
462 	KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_NSS;
463 
464 	rv = configure_nss(kmfhandle, outdir, prefix);
465 	if (rv != KMF_OK)
466 		return (rv);
467 
468 	kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
469 	    &kstype, sizeof (kstype));
470 	numattr++;
471 	if (infile) {
472 		kmf_set_attr_at_index(attrlist, numattr, KMF_CRL_FILENAME_ATTR,
473 		    infile, strlen(infile));
474 		numattr++;
475 	}
476 	kmf_set_attr_at_index(attrlist, numattr, KMF_CRL_CHECK_ATTR,
477 	    &verify_crl_flag, sizeof (verify_crl_flag));
478 	numattr++;
479 
480 	return (kmf_import_crl(kmfhandle, numattr, attrlist));
481 
482 }
483 
484 static KMF_RETURN
485 pk_import_pk12_pk11(
486 	KMF_HANDLE_T kmfhandle,
487 	KMF_CREDENTIAL *p12cred,
488 	KMF_CREDENTIAL *tokencred,
489 	char *label, char *token_spec,
490 	char *filename)
491 {
492 	KMF_RETURN rv = KMF_OK;
493 	KMF_X509_DER_CERT *certs = NULL;
494 	KMF_RAW_KEY_DATA *keys = NULL;
495 	int ncerts = 0;
496 	int nkeys = 0;
497 	int i;
498 	KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_PK11TOKEN;
499 	KMF_ATTRIBUTE *attrlist = NULL;
500 	int numattr = 0;
501 
502 	rv = select_token(kmfhandle, token_spec, FALSE);
503 
504 	if (rv != KMF_OK) {
505 		return (rv);
506 	}
507 
508 	rv = kmf_import_objects(kmfhandle, filename, p12cred,
509 	    &certs, &ncerts, &keys, &nkeys);
510 
511 	if (rv == KMF_OK) {
512 		NEW_ATTRLIST(attrlist, (3 + (2 * nkeys)));
513 
514 		kmf_set_attr_at_index(attrlist, numattr,
515 		    KMF_KEYSTORE_TYPE_ATTR, &kstype,
516 		    sizeof (kstype));
517 		numattr++;
518 
519 		if (label != NULL) {
520 			kmf_set_attr_at_index(attrlist, numattr,
521 			    KMF_KEYLABEL_ATTR, label,
522 			    strlen(label));
523 			numattr++;
524 		}
525 
526 		if (tokencred != NULL && tokencred->credlen > 0) {
527 			kmf_set_attr_at_index(attrlist, numattr,
528 			    KMF_CREDENTIAL_ATTR, tokencred,
529 			    sizeof (KMF_CREDENTIAL));
530 			numattr++;
531 		}
532 
533 		/* The order of certificates and keys should match */
534 		for (i = 0; i < nkeys; i++) {
535 			int num = numattr;
536 
537 			if (i < ncerts) {
538 				kmf_set_attr_at_index(attrlist, num,
539 				    KMF_CERT_DATA_ATTR, &certs[i].certificate,
540 				    sizeof (KMF_DATA));
541 				num++;
542 			}
543 
544 			kmf_set_attr_at_index(attrlist, num,
545 			    KMF_RAW_KEY_ATTR, &keys[i],
546 			    sizeof (KMF_RAW_KEY_DATA));
547 			num++;
548 
549 			rv = kmf_store_key(kmfhandle, num, attrlist);
550 
551 		}
552 		free(attrlist);
553 	}
554 
555 	if (rv == KMF_OK) {
556 		numattr = 0;
557 		NEW_ATTRLIST(attrlist, (1 + (2 * ncerts)));
558 
559 		(void) printf(gettext("Found %d certificate(s) and %d "
560 		    "key(s) in %s\n"), ncerts, nkeys, filename);
561 
562 		kmf_set_attr_at_index(attrlist, numattr,
563 		    KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
564 		numattr++;
565 
566 		for (i = 0; rv == KMF_OK && i < ncerts; i++) {
567 			int num = numattr;
568 			if (certs[i].kmf_private.label != NULL) {
569 				kmf_set_attr_at_index(attrlist, num,
570 				    KMF_CERT_LABEL_ATTR,
571 				    certs[i].kmf_private.label,
572 				    strlen(certs[i].kmf_private.label));
573 				num++;
574 			} else if (i == 0 && label != NULL) {
575 				kmf_set_attr_at_index(attrlist, num,
576 				    KMF_CERT_LABEL_ATTR, label, strlen(label));
577 				num++;
578 			}
579 
580 			kmf_set_attr_at_index(attrlist, num,
581 			    KMF_CERT_DATA_ATTR, &certs[i].certificate,
582 			    sizeof (KMF_DATA));
583 			num++;
584 
585 			rv = kmf_store_cert(kmfhandle, num, attrlist);
586 		}
587 		free(attrlist);
588 	}
589 
590 end:
591 	/*
592 	 * Cleanup memory.
593 	 */
594 	if (certs) {
595 		for (i = 0; i < ncerts; i++)
596 			kmf_free_kmf_cert(kmfhandle, &certs[i]);
597 		free(certs);
598 	}
599 	if (keys) {
600 		for (i = 0; i < nkeys; i++)
601 			kmf_free_raw_key(&keys[i]);
602 		free(keys);
603 	}
604 
605 	return (rv);
606 }
607 
608 /*ARGSUSED*/
609 static KMF_RETURN
610 pk_import_keys(KMF_HANDLE_T kmfhandle,
611 	KMF_KEYSTORE_TYPE kstype, char *token_spec,
612 	KMF_CREDENTIAL *cred, char *filename,
613 	char *label, char *senstr, char *extstr)
614 {
615 	KMF_RETURN rv = KMF_OK;
616 	KMF_ATTRIBUTE attrlist[16];
617 	KMF_KEYSTORE_TYPE fileks = KMF_KEYSTORE_OPENSSL;
618 	int numattr = 0;
619 	KMF_KEY_HANDLE key;
620 	KMF_RAW_KEY_DATA rawkey;
621 	KMF_KEY_CLASS class = KMF_ASYM_PRI;
622 	int numkeys = 1;
623 
624 	if (kstype == KMF_KEYSTORE_PK11TOKEN) {
625 		rv = select_token(kmfhandle, token_spec, FALSE);
626 	}
627 	if (rv != KMF_OK)
628 		return (rv);
629 	/*
630 	 * First, set up to read the keyfile using the FILE plugin
631 	 * mechanisms.
632 	 */
633 	kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
634 	    &fileks, sizeof (fileks));
635 	numattr++;
636 
637 	kmf_set_attr_at_index(attrlist, numattr, KMF_COUNT_ATTR,
638 	    &numkeys, sizeof (numkeys));
639 	numattr++;
640 
641 	kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_HANDLE_ATTR,
642 	    &key, sizeof (key));
643 	numattr++;
644 
645 	kmf_set_attr_at_index(attrlist, numattr, KMF_RAW_KEY_ATTR,
646 	    &rawkey, sizeof (rawkey));
647 	numattr++;
648 
649 	kmf_set_attr_at_index(attrlist, numattr, KMF_KEYCLASS_ATTR,
650 	    &class, sizeof (class));
651 	numattr++;
652 
653 	kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_FILENAME_ATTR,
654 	    filename, strlen(filename));
655 	numattr++;
656 
657 	rv = kmf_find_key(kmfhandle, numattr, attrlist);
658 	if (rv == KMF_OK) {
659 		numattr = 0;
660 
661 		kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
662 		    &kstype, sizeof (kstype));
663 		numattr++;
664 
665 		if (cred != NULL && cred->credlen > 0) {
666 			kmf_set_attr_at_index(attrlist, numattr,
667 			    KMF_CREDENTIAL_ATTR, cred, sizeof (KMF_CREDENTIAL));
668 			numattr++;
669 		}
670 
671 		if (label != NULL) {
672 			kmf_set_attr_at_index(attrlist, numattr,
673 			    KMF_KEYLABEL_ATTR, label, strlen(label));
674 			numattr++;
675 		}
676 
677 		kmf_set_attr_at_index(attrlist, numattr,
678 		    KMF_RAW_KEY_ATTR, &rawkey, sizeof (rawkey));
679 		numattr++;
680 
681 		rv = kmf_store_key(kmfhandle, numattr, attrlist);
682 		if (rv == KMF_OK) {
683 			(void) printf(gettext("Importing %d keys\n"), numkeys);
684 		}
685 
686 		kmf_free_kmf_key(kmfhandle, &key);
687 		kmf_free_raw_key(&rawkey);
688 	} else {
689 		cryptoerror(LOG_STDERR,
690 		    gettext("Failed to load key from file (%s)\n"),
691 		    filename);
692 	}
693 	return (rv);
694 }
695 
696 static KMF_RETURN
697 pk_import_rawkey(KMF_HANDLE_T kmfhandle,
698 	KMF_KEYSTORE_TYPE kstype, char *token,
699 	KMF_CREDENTIAL *cred,
700 	char *filename, char *label, KMF_KEY_ALG keyAlg,
701 	char *senstr, char *extstr)
702 {
703 	KMF_RETURN rv = KMF_OK;
704 	KMF_ATTRIBUTE attrlist[16];
705 	int numattr = 0;
706 	uint32_t keylen;
707 	boolean_t sensitive = B_FALSE;
708 	boolean_t not_extractable = B_FALSE;
709 	KMF_DATA keydata = {NULL, 0};
710 	KMF_KEY_HANDLE rawkey;
711 
712 	rv = kmf_read_input_file(kmfhandle, filename, &keydata);
713 	if (rv != KMF_OK)
714 		return (rv);
715 
716 	rv = select_token(kmfhandle, token, FALSE);
717 
718 	if (rv != KMF_OK) {
719 		return (rv);
720 	}
721 	if (senstr != NULL) {
722 		if (tolower(senstr[0]) == 'y')
723 			sensitive = B_TRUE;
724 		else if (tolower(senstr[0]) == 'n')
725 			sensitive = B_FALSE;
726 		else {
727 			cryptoerror(LOG_STDERR,
728 			    gettext("Incorrect sensitive option value.\n"));
729 			return (KMF_ERR_BAD_PARAMETER);
730 		}
731 	}
732 
733 	if (extstr != NULL) {
734 		if (tolower(extstr[0]) == 'y')
735 			not_extractable = B_FALSE;
736 		else if (tolower(extstr[0]) == 'n')
737 			not_extractable = B_TRUE;
738 		else {
739 			cryptoerror(LOG_STDERR,
740 			    gettext("Incorrect extractable option value.\n"));
741 			return (KMF_ERR_BAD_PARAMETER);
742 		}
743 	}
744 	kmf_set_attr_at_index(attrlist, numattr,
745 	    KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
746 	numattr++;
747 
748 	kmf_set_attr_at_index(attrlist, numattr,
749 	    KMF_KEY_HANDLE_ATTR, &rawkey, sizeof (rawkey));
750 	numattr++;
751 
752 	kmf_set_attr_at_index(attrlist, numattr,
753 	    KMF_KEYALG_ATTR, &keyAlg, sizeof (KMF_KEY_ALG));
754 	numattr++;
755 
756 	kmf_set_attr_at_index(attrlist, numattr,
757 	    KMF_KEY_DATA_ATTR, keydata.Data, keydata.Length);
758 	numattr++;
759 
760 	/* Key length is given in bits not bytes */
761 	keylen = keydata.Length * 8;
762 	kmf_set_attr_at_index(attrlist, numattr,
763 	    KMF_KEYLENGTH_ATTR, &keylen, sizeof (keydata.Length));
764 	numattr++;
765 
766 	kmf_set_attr_at_index(attrlist, numattr,
767 	    KMF_SENSITIVE_BOOL_ATTR, &sensitive, sizeof (sensitive));
768 	numattr++;
769 
770 	kmf_set_attr_at_index(attrlist, numattr,
771 	    KMF_NON_EXTRACTABLE_BOOL_ATTR, &not_extractable,
772 	    sizeof (not_extractable));
773 	numattr++;
774 
775 	if (label != NULL) {
776 		kmf_set_attr_at_index(attrlist, numattr,
777 		    KMF_KEYLABEL_ATTR, label, strlen(label));
778 		numattr++;
779 	}
780 	if (cred != NULL && cred->credlen > 0) {
781 		kmf_set_attr_at_index(attrlist, numattr,
782 		    KMF_CREDENTIAL_ATTR, cred, sizeof (KMF_CREDENTIAL));
783 		numattr++;
784 	}
785 	rv = kmf_create_sym_key(kmfhandle, numattr, attrlist);
786 
787 	return (rv);
788 }
789 
790 /*
791  * Import objects from into KMF repositories.
792  */
793 int
794 pk_import(int argc, char *argv[])
795 {
796 	int		opt;
797 	extern int	optind_av;
798 	extern char	*optarg_av;
799 	char		*token_spec = NULL;
800 	char		*filename = NULL;
801 	char		*keyfile = NULL;
802 	char		*certfile = NULL;
803 	char		*crlfile = NULL;
804 	char		*label = NULL;
805 	char		*dir = NULL;
806 	char		*prefix = NULL;
807 	char		*trustflags = NULL;
808 	char		*verify_crl = NULL;
809 	char		*keytype = "generic";
810 	char		*senstr = NULL;
811 	char		*extstr = NULL;
812 	boolean_t	verify_crl_flag = B_FALSE;
813 	int		oclass = 0;
814 	KMF_KEYSTORE_TYPE	kstype = 0;
815 	KMF_ENCODE_FORMAT	kfmt = 0;
816 	KMF_ENCODE_FORMAT	okfmt = KMF_FORMAT_ASN1;
817 	KMF_RETURN		rv = KMF_OK;
818 	KMF_CREDENTIAL	pk12cred = { NULL, 0 };
819 	KMF_CREDENTIAL	tokencred = { NULL, 0 };
820 	KMF_HANDLE_T	kmfhandle = NULL;
821 	KMF_KEY_ALG	keyAlg = KMF_GENERIC_SECRET;
822 
823 	/* Parse command line options.  Do NOT i18n/l10n. */
824 	while ((opt = getopt_av(argc, argv,
825 	    "T:(token)i:(infile)"
826 	    "k:(keystore)y:(objtype)"
827 	    "d:(dir)p:(prefix)"
828 	    "n:(certlabel)N:(label)"
829 	    "K:(outkey)c:(outcert)"
830 	    "v:(verifycrl)l:(outcrl)"
831 	    "E:(keytype)s:(sensitive)x:(extractable)"
832 	    "t:(trust)F:(outformat)")) != EOF) {
833 		if (EMPTYSTRING(optarg_av))
834 			return (PK_ERR_USAGE);
835 		switch (opt) {
836 		case 'T':	/* token specifier */
837 			if (token_spec)
838 				return (PK_ERR_USAGE);
839 			token_spec = optarg_av;
840 			break;
841 		case 'c':	/* output cert file name */
842 			if (certfile)
843 				return (PK_ERR_USAGE);
844 			certfile = optarg_av;
845 			break;
846 		case 'l':	/* output CRL file name */
847 			if (crlfile)
848 				return (PK_ERR_USAGE);
849 			crlfile = optarg_av;
850 			break;
851 		case 'K':	/* output key file name */
852 			if (keyfile)
853 				return (PK_ERR_USAGE);
854 			keyfile = optarg_av;
855 			break;
856 		case 'i':	/* input file name */
857 			if (filename)
858 				return (PK_ERR_USAGE);
859 			filename = optarg_av;
860 			break;
861 		case 'k':
862 			kstype = KS2Int(optarg_av);
863 			if (kstype == 0)
864 				return (PK_ERR_USAGE);
865 			break;
866 		case 'y':
867 			oclass = OT2Int(optarg_av);
868 			if (oclass == -1)
869 				return (PK_ERR_USAGE);
870 			break;
871 		case 'd':
872 			dir = optarg_av;
873 			break;
874 		case 'p':
875 			if (prefix)
876 				return (PK_ERR_USAGE);
877 			prefix = optarg_av;
878 			break;
879 		case 'n':
880 		case 'N':
881 			if (label)
882 				return (PK_ERR_USAGE);
883 			label = optarg_av;
884 			break;
885 		case 'F':
886 			okfmt = Str2Format(optarg_av);
887 			if (okfmt == KMF_FORMAT_UNDEF)
888 				return (PK_ERR_USAGE);
889 			break;
890 		case 't':
891 			if (trustflags)
892 				return (PK_ERR_USAGE);
893 			trustflags = optarg_av;
894 			break;
895 		case 'v':
896 			verify_crl = optarg_av;
897 			if (tolower(verify_crl[0]) == 'y')
898 				verify_crl_flag = B_TRUE;
899 			else if (tolower(verify_crl[0]) == 'n')
900 				verify_crl_flag = B_FALSE;
901 			else
902 				return (PK_ERR_USAGE);
903 			break;
904 		case 'E':
905 			keytype = optarg_av;
906 			break;
907 		case 's':
908 			if (senstr)
909 				return (PK_ERR_USAGE);
910 			senstr = optarg_av;
911 			break;
912 		case 'x':
913 			if (extstr)
914 				return (PK_ERR_USAGE);
915 			extstr = optarg_av;
916 			break;
917 		default:
918 			return (PK_ERR_USAGE);
919 			break;
920 		}
921 	}
922 
923 	/* Assume keystore = PKCS#11 if not specified */
924 	if (kstype == 0)
925 		kstype = KMF_KEYSTORE_PK11TOKEN;
926 
927 	/* Filename arg is required. */
928 	if (EMPTYSTRING(filename)) {
929 		cryptoerror(LOG_STDERR, gettext("The 'infile' parameter"
930 		    "is required for the import operation.\n"));
931 		return (PK_ERR_USAGE);
932 	}
933 
934 	/* No additional args allowed. */
935 	argc -= optind_av;
936 	argv += optind_av;
937 	if (argc)
938 		return (PK_ERR_USAGE);
939 
940 	DIR_OPTION_CHECK(kstype, dir);
941 
942 	/* if PUBLIC or PRIVATE obj was given, the old syntax was used. */
943 	if ((oclass & (PK_PUBLIC_OBJ | PK_PRIVATE_OBJ)) &&
944 	    kstype != KMF_KEYSTORE_PK11TOKEN) {
945 
946 		(void) fprintf(stderr, gettext("The objtype parameter "
947 		    "is only relevant if keystore=pkcs11\n"));
948 		return (PK_ERR_USAGE);
949 	}
950 
951 	/*
952 	 * You must specify a certlabel (cert label) when importing
953 	 * into NSS or PKCS#11.
954 	 */
955 	if (kstype == KMF_KEYSTORE_NSS &&
956 	    (oclass != PK_CRL_OBJ) && EMPTYSTRING(label)) {
957 		cryptoerror(LOG_STDERR, gettext("The 'label' argument "
958 		    "is required for this operation\n"));
959 		return (PK_ERR_USAGE);
960 	}
961 
962 	if ((rv = kmf_get_file_format(filename, &kfmt)) != KMF_OK) {
963 		char *kmferrstr = NULL;
964 		KMF_RETURN rv2;
965 		/*
966 		 * Allow for raw key data to be imported.
967 		 */
968 		if (rv == KMF_ERR_ENCODING) {
969 			rv = KMF_OK;
970 			kfmt = KMF_FORMAT_RAWKEY;
971 			/*
972 			 * Set the object class only if it was not
973 			 * given on the command line or if it was
974 			 * specified as a symmetric key object.
975 			 */
976 			if (oclass == 0 || (oclass & PK_SYMKEY_OBJ)) {
977 				oclass = PK_SYMKEY_OBJ;
978 			} else {
979 				cryptoerror(LOG_STDERR, gettext(
980 				    "The input file does not contain the "
981 				    "object type indicated on command "
982 				    "line."));
983 				return (KMF_ERR_BAD_PARAMETER);
984 			}
985 		} else {
986 			if (rv == KMF_ERR_OPEN_FILE) {
987 				cryptoerror(LOG_STDERR,
988 				    gettext("Cannot open file (%s)\n."),
989 				    filename);
990 			} else {
991 				rv2 = kmf_get_kmf_error_str(rv, &kmferrstr);
992 				if (rv2 == KMF_OK && kmferrstr) {
993 					cryptoerror(LOG_STDERR,
994 					    gettext("libkmf error: %s"),
995 					    kmferrstr);
996 					kmf_free_str(kmferrstr);
997 				}
998 			}
999 			return (rv);
1000 		}
1001 	}
1002 
1003 	/* Check parameters for raw key import operation */
1004 	if (kfmt == KMF_FORMAT_RAWKEY) {
1005 		if (keytype != NULL &&
1006 		    Str2SymKeyType(keytype, &keyAlg) != 0) {
1007 			cryptoerror(LOG_STDERR,
1008 			    gettext("Unrecognized keytype(%s).\n"), keytype);
1009 			return (PK_ERR_USAGE);
1010 		}
1011 		if (senstr != NULL && extstr != NULL &&
1012 		    kstype != KMF_KEYSTORE_PK11TOKEN) {
1013 			cryptoerror(LOG_STDERR,
1014 			    gettext("The sensitive or extractable option "
1015 			    "applies only when importing a key from a file "
1016 			    "into a PKCS#11 keystore.\n"));
1017 			return (PK_ERR_USAGE);
1018 		}
1019 	}
1020 
1021 	/* If no objtype was given, treat it as a certificate */
1022 	if (oclass == 0 && (kfmt == KMF_FORMAT_ASN1 ||
1023 	    kfmt == KMF_FORMAT_PEM))
1024 		oclass = PK_CERT_OBJ;
1025 
1026 	if (kstype == KMF_KEYSTORE_NSS) {
1027 		if (oclass == PK_CRL_OBJ &&
1028 		    (kfmt != KMF_FORMAT_ASN1 && kfmt != KMF_FORMAT_PEM)) {
1029 			cryptoerror(LOG_STDERR, gettext(
1030 			    "CRL data can only be imported as DER or "
1031 			    "PEM format"));
1032 			return (PK_ERR_USAGE);
1033 		}
1034 
1035 		if (oclass == PK_CERT_OBJ &&
1036 		    (kfmt != KMF_FORMAT_ASN1 && kfmt != KMF_FORMAT_PEM)) {
1037 			cryptoerror(LOG_STDERR, gettext(
1038 			    "Certificates can only be imported as DER or "
1039 			    "PEM format"));
1040 			return (PK_ERR_USAGE);
1041 		}
1042 
1043 		/* we do not import private keys except in PKCS12 bundles */
1044 		if (oclass & (PK_PRIVATE_OBJ | PK_PRIKEY_OBJ)) {
1045 			cryptoerror(LOG_STDERR, gettext(
1046 			    "Private key data can only be imported as part "
1047 			    "of a PKCS12 file.\n"));
1048 			return (PK_ERR_USAGE);
1049 		}
1050 	}
1051 
1052 	if (kstype == KMF_KEYSTORE_OPENSSL && oclass != PK_CRL_OBJ) {
1053 		if (EMPTYSTRING(keyfile) || EMPTYSTRING(certfile)) {
1054 			cryptoerror(LOG_STDERR, gettext(
1055 			    "The 'outkey' and 'outcert' parameters "
1056 			    "are required for the import operation "
1057 			    "when the 'file' keystore is used.\n"));
1058 			return (PK_ERR_USAGE);
1059 		}
1060 	}
1061 
1062 	if (kstype == KMF_KEYSTORE_PK11TOKEN && EMPTYSTRING(token_spec))
1063 		token_spec = PK_DEFAULT_PK11TOKEN;
1064 	else if (kstype == KMF_KEYSTORE_NSS && EMPTYSTRING(token_spec))
1065 		token_spec = DEFAULT_NSS_TOKEN;
1066 
1067 	if (kfmt == KMF_FORMAT_PKCS12) {
1068 		(void) get_pk12_password(&pk12cred);
1069 	}
1070 
1071 	if ((kfmt == KMF_FORMAT_PKCS12 || kfmt == KMF_FORMAT_RAWKEY ||
1072 	    (kfmt == KMF_FORMAT_PEM && (oclass & PK_KEY_OBJ))) &&
1073 	    (kstype == KMF_KEYSTORE_PK11TOKEN || kstype == KMF_KEYSTORE_NSS)) {
1074 		(void) get_token_password(kstype, token_spec, &tokencred);
1075 	}
1076 
1077 	if ((rv = kmf_initialize(&kmfhandle, NULL, NULL)) != KMF_OK) {
1078 		cryptoerror(LOG_STDERR, gettext("Error initializing "
1079 		    "KMF: 0x%02x\n"), rv);
1080 		goto end;
1081 	}
1082 
1083 	switch (kstype) {
1084 		case KMF_KEYSTORE_PK11TOKEN:
1085 			if (kfmt == KMF_FORMAT_PKCS12)
1086 				rv = pk_import_pk12_pk11(
1087 				    kmfhandle, &pk12cred,
1088 				    &tokencred, label,
1089 				    token_spec, filename);
1090 			else if (oclass == PK_CERT_OBJ)
1091 				rv = pk_import_cert(
1092 				    kmfhandle, kstype,
1093 				    label, token_spec,
1094 				    filename,
1095 				    NULL, NULL, NULL);
1096 			else if (oclass == PK_CRL_OBJ)
1097 				rv = pk_import_file_crl(
1098 				    kmfhandle, filename,
1099 				    crlfile, okfmt);
1100 			else if (kfmt == KMF_FORMAT_RAWKEY &&
1101 			    oclass == PK_SYMKEY_OBJ) {
1102 				rv = pk_import_rawkey(kmfhandle,
1103 				    kstype, token_spec, &tokencred,
1104 				    filename, label,
1105 				    keyAlg, senstr, extstr);
1106 			} else if (kfmt == KMF_FORMAT_PEM ||
1107 			    kfmt == KMF_FORMAT_PEM_KEYPAIR) {
1108 				rv = pk_import_keys(kmfhandle,
1109 				    kstype, token_spec, &tokencred,
1110 				    filename, label, senstr, extstr);
1111 			} else {
1112 				rv = PK_ERR_USAGE;
1113 			}
1114 			break;
1115 		case KMF_KEYSTORE_NSS:
1116 			if (dir == NULL)
1117 				dir = PK_DEFAULT_DIRECTORY;
1118 			if (kfmt == KMF_FORMAT_PKCS12)
1119 				rv = pk_import_pk12_nss(
1120 				    kmfhandle, &pk12cred,
1121 				    &tokencred,
1122 				    token_spec, dir, prefix,
1123 				    label, trustflags, filename);
1124 			else if (oclass == PK_CERT_OBJ) {
1125 				rv = pk_import_cert(
1126 				    kmfhandle, kstype,
1127 				    label, token_spec,
1128 				    filename, dir, prefix, trustflags);
1129 			} else if (oclass == PK_CRL_OBJ) {
1130 				rv = pk_import_nss_crl(
1131 				    kmfhandle, verify_crl_flag,
1132 				    filename, dir, prefix);
1133 			}
1134 			break;
1135 		case KMF_KEYSTORE_OPENSSL:
1136 			if (kfmt == KMF_FORMAT_PKCS12)
1137 				rv = pk_import_pk12_files(
1138 				    kmfhandle, &pk12cred,
1139 				    filename, certfile, keyfile,
1140 				    okfmt);
1141 			else if (oclass == PK_CRL_OBJ) {
1142 				rv = pk_import_file_crl(
1143 				    kmfhandle, filename,
1144 				    crlfile, okfmt);
1145 			} else
1146 				/*
1147 				 * It doesn't make sense to import anything
1148 				 * else for the files plugin.
1149 				 */
1150 				return (PK_ERR_USAGE);
1151 			break;
1152 		default:
1153 			rv = PK_ERR_USAGE;
1154 			break;
1155 	}
1156 
1157 end:
1158 	if (rv != KMF_OK)
1159 		display_error(kmfhandle, rv,
1160 		    gettext("Error importing objects"));
1161 
1162 	if (tokencred.cred != NULL)
1163 		free(tokencred.cred);
1164 
1165 	if (pk12cred.cred != NULL)
1166 		free(pk12cred.cred);
1167 
1168 	(void) kmf_finalize(kmfhandle);
1169 
1170 	if (rv != KMF_OK)
1171 		return (PK_ERR_USAGE);
1172 
1173 	return (0);
1174 }
1175