1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 * Copyright 2012 Milan Jurik. All rights reserved. 25 */ 26 27 /* 28 * This file implements the import operation for this tool. 29 * The basic flow of the process is to decrypt the PKCS#12 30 * input file if it has a password, parse the elements in 31 * the file, find the soft token, log into it, import the 32 * PKCS#11 objects into the soft token, and log out. 33 */ 34 35 #include <stdio.h> 36 #include <stdlib.h> 37 #include <string.h> 38 #include <ctype.h> 39 #include <errno.h> 40 #include <fcntl.h> 41 #include <sys/types.h> 42 #include <sys/stat.h> 43 #include "common.h" 44 45 #include <kmfapi.h> 46 47 #define NEW_ATTRLIST(a, n) \ 48 { \ 49 a = (KMF_ATTRIBUTE *)malloc(n * sizeof (KMF_ATTRIBUTE)); \ 50 if (a == NULL) { \ 51 rv = KMF_ERR_MEMORY; \ 52 goto end; \ 53 } \ 54 (void) memset(a, 0, n * sizeof (KMF_ATTRIBUTE)); \ 55 } 56 57 static KMF_RETURN 58 pk_import_pk12_files(KMF_HANDLE_T kmfhandle, KMF_CREDENTIAL *cred, 59 char *outfile, char *certfile, char *keyfile, 60 KMF_ENCODE_FORMAT outformat) 61 { 62 KMF_RETURN rv = KMF_OK; 63 KMF_X509_DER_CERT *certs = NULL; 64 KMF_RAW_KEY_DATA *keys = NULL; 65 int ncerts = 0; 66 int nkeys = 0; 67 int i; 68 KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_OPENSSL; 69 KMF_ATTRIBUTE *attrlist = NULL; 70 int numattr = 0; 71 72 rv = kmf_import_objects(kmfhandle, outfile, cred, 73 &certs, &ncerts, &keys, &nkeys); 74 75 if (rv == KMF_OK) { 76 (void) printf(gettext("Found %d certificate(s) and %d " 77 "key(s) in %s\n"), ncerts, nkeys, outfile); 78 } 79 80 if (rv == KMF_OK && ncerts > 0) { 81 char newcertfile[MAXPATHLEN]; 82 83 NEW_ATTRLIST(attrlist, (3 + (3 * ncerts))); 84 85 kmf_set_attr_at_index(attrlist, numattr, 86 KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype)); 87 numattr++; 88 89 kmf_set_attr_at_index(attrlist, numattr, 90 KMF_ENCODE_FORMAT_ATTR, &outformat, sizeof (outformat)); 91 numattr++; 92 93 for (i = 0; rv == KMF_OK && i < ncerts; i++) { 94 int num = numattr; 95 96 /* 97 * If storing more than 1 cert, gotta change 98 * the name so we don't overwrite the previous one. 99 * Just append a _# to the name. 100 */ 101 if (i > 0) { 102 (void) snprintf(newcertfile, 103 sizeof (newcertfile), "%s_%d", certfile, i); 104 105 kmf_set_attr_at_index(attrlist, num, 106 KMF_CERT_FILENAME_ATTR, newcertfile, 107 strlen(newcertfile)); 108 num++; 109 } else { 110 kmf_set_attr_at_index(attrlist, num, 111 KMF_CERT_FILENAME_ATTR, certfile, 112 strlen(certfile)); 113 num++; 114 } 115 116 if (certs[i].kmf_private.label != NULL) { 117 kmf_set_attr_at_index(attrlist, num, 118 KMF_CERT_LABEL_ATTR, 119 certs[i].kmf_private.label, 120 strlen(certs[i].kmf_private.label)); 121 num++; 122 } 123 kmf_set_attr_at_index(attrlist, num, 124 KMF_CERT_DATA_ATTR, &certs[i].certificate, 125 sizeof (KMF_DATA)); 126 num++; 127 rv = kmf_store_cert(kmfhandle, num, attrlist); 128 } 129 free(attrlist); 130 } 131 if (rv == KMF_OK && nkeys > 0) { 132 char newkeyfile[MAXPATHLEN]; 133 numattr = 0; 134 NEW_ATTRLIST(attrlist, (4 + (4 * nkeys))); 135 136 kmf_set_attr_at_index(attrlist, numattr, 137 KMF_KEYSTORE_TYPE_ATTR, &kstype, 138 sizeof (kstype)); 139 numattr++; 140 141 kmf_set_attr_at_index(attrlist, numattr, 142 KMF_ENCODE_FORMAT_ATTR, &outformat, 143 sizeof (outformat)); 144 numattr++; 145 146 if (cred != NULL && cred->credlen > 0) { 147 kmf_set_attr_at_index(attrlist, numattr, 148 KMF_CREDENTIAL_ATTR, cred, 149 sizeof (KMF_CREDENTIAL)); 150 numattr++; 151 } 152 153 /* The order of certificates and keys should match */ 154 for (i = 0; rv == KMF_OK && i < nkeys; i++) { 155 int num = numattr; 156 157 if (i > 0) { 158 (void) snprintf(newkeyfile, 159 sizeof (newkeyfile), "%s_%d", keyfile, i); 160 161 kmf_set_attr_at_index(attrlist, num, 162 KMF_KEY_FILENAME_ATTR, newkeyfile, 163 strlen(newkeyfile)); 164 num++; 165 } else { 166 kmf_set_attr_at_index(attrlist, num, 167 KMF_KEY_FILENAME_ATTR, keyfile, 168 strlen(keyfile)); 169 num++; 170 } 171 172 if (i < ncerts) { 173 kmf_set_attr_at_index(attrlist, num, 174 KMF_CERT_DATA_ATTR, &certs[i], 175 sizeof (KMF_CERT_DATA_ATTR)); 176 num++; 177 } 178 179 kmf_set_attr_at_index(attrlist, num, 180 KMF_RAW_KEY_ATTR, &keys[i], 181 sizeof (KMF_RAW_KEY_DATA)); 182 num++; 183 184 rv = kmf_store_key(kmfhandle, num, attrlist); 185 } 186 free(attrlist); 187 } 188 end: 189 /* 190 * Cleanup memory. 191 */ 192 if (certs) { 193 for (i = 0; i < ncerts; i++) 194 kmf_free_kmf_cert(kmfhandle, &certs[i]); 195 free(certs); 196 } 197 if (keys) { 198 for (i = 0; i < nkeys; i++) 199 kmf_free_raw_key(&keys[i]); 200 free(keys); 201 } 202 203 204 return (rv); 205 } 206 207 208 static KMF_RETURN 209 pk_import_pk12_nss( 210 KMF_HANDLE_T kmfhandle, KMF_CREDENTIAL *kmfcred, 211 KMF_CREDENTIAL *tokencred, 212 char *token_spec, char *dir, char *prefix, 213 char *nickname, char *trustflags, char *filename) 214 { 215 KMF_RETURN rv = KMF_OK; 216 KMF_X509_DER_CERT *certs = NULL; 217 KMF_RAW_KEY_DATA *keys = NULL; 218 int ncerts = 0; 219 int nkeys = 0; 220 int i; 221 KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_NSS; 222 KMF_ATTRIBUTE *attrlist = NULL; 223 int numattr = 0; 224 225 rv = configure_nss(kmfhandle, dir, prefix); 226 if (rv != KMF_OK) 227 return (rv); 228 229 rv = kmf_import_objects(kmfhandle, filename, kmfcred, 230 &certs, &ncerts, &keys, &nkeys); 231 232 if (rv == KMF_OK) 233 (void) printf(gettext("Found %d certificate(s) and %d " 234 "key(s) in %s\n"), ncerts, nkeys, filename); 235 236 if (rv == KMF_OK) { 237 numattr = 0; 238 NEW_ATTRLIST(attrlist, (4 + (2 * nkeys))); 239 240 kmf_set_attr_at_index(attrlist, numattr, 241 KMF_KEYSTORE_TYPE_ATTR, &kstype, 242 sizeof (kstype)); 243 numattr++; 244 245 if (token_spec != NULL) { 246 kmf_set_attr_at_index(attrlist, numattr, 247 KMF_TOKEN_LABEL_ATTR, token_spec, 248 strlen(token_spec)); 249 numattr++; 250 } 251 252 if (nickname != NULL) { 253 kmf_set_attr_at_index(attrlist, numattr, 254 KMF_KEYLABEL_ATTR, nickname, 255 strlen(nickname)); 256 numattr++; 257 } 258 259 if (tokencred->credlen > 0) { 260 kmf_set_attr_at_index(attrlist, numattr, 261 KMF_CREDENTIAL_ATTR, tokencred, 262 sizeof (KMF_CREDENTIAL)); 263 numattr++; 264 } 265 266 /* The order of certificates and keys should match */ 267 for (i = 0; i < nkeys; i++) { 268 int num = numattr; 269 270 if (i < ncerts) { 271 kmf_set_attr_at_index(attrlist, num, 272 KMF_CERT_DATA_ATTR, &certs[i], 273 sizeof (KMF_DATA)); 274 num++; 275 } 276 277 kmf_set_attr_at_index(attrlist, num, 278 KMF_RAW_KEY_ATTR, &keys[i], 279 sizeof (KMF_RAW_KEY_DATA)); 280 num++; 281 282 rv = kmf_store_key(kmfhandle, num, attrlist); 283 } 284 free(attrlist); 285 attrlist = NULL; 286 } 287 288 if (rv == KMF_OK) { 289 numattr = 0; 290 NEW_ATTRLIST(attrlist, (3 + (2 * ncerts))); 291 292 kmf_set_attr_at_index(attrlist, numattr, 293 KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype)); 294 numattr++; 295 296 if (token_spec != NULL) { 297 kmf_set_attr_at_index(attrlist, numattr, 298 KMF_TOKEN_LABEL_ATTR, token_spec, 299 strlen(token_spec)); 300 numattr++; 301 } 302 303 if (trustflags != NULL) { 304 kmf_set_attr_at_index(attrlist, numattr, 305 KMF_TRUSTFLAG_ATTR, trustflags, 306 strlen(trustflags)); 307 numattr++; 308 } 309 310 for (i = 0; rv == KMF_OK && i < ncerts; i++) { 311 int num = numattr; 312 313 if (certs[i].kmf_private.label != NULL) { 314 kmf_set_attr_at_index(attrlist, num, 315 KMF_CERT_LABEL_ATTR, 316 certs[i].kmf_private.label, 317 strlen(certs[i].kmf_private.label)); 318 num++; 319 } else if (i == 0 && nickname != NULL) { 320 kmf_set_attr_at_index(attrlist, num, 321 KMF_CERT_LABEL_ATTR, nickname, 322 strlen(nickname)); 323 num++; 324 } 325 326 kmf_set_attr_at_index(attrlist, num, 327 KMF_CERT_DATA_ATTR, 328 &certs[i].certificate, sizeof (KMF_DATA)); 329 num++; 330 rv = kmf_store_cert(kmfhandle, num, attrlist); 331 } 332 free(attrlist); 333 attrlist = NULL; 334 if (rv != KMF_OK) { 335 display_error(kmfhandle, rv, 336 gettext("Error storing certificate in NSS token")); 337 } 338 } 339 340 end: 341 /* 342 * Cleanup memory. 343 */ 344 if (certs) { 345 for (i = 0; i < ncerts; i++) 346 kmf_free_kmf_cert(kmfhandle, &certs[i]); 347 free(certs); 348 } 349 if (keys) { 350 for (i = 0; i < nkeys; i++) 351 kmf_free_raw_key(&keys[i]); 352 free(keys); 353 } 354 355 return (rv); 356 } 357 358 static KMF_RETURN 359 pk_import_cert( 360 KMF_HANDLE_T kmfhandle, 361 KMF_KEYSTORE_TYPE kstype, 362 char *label, char *token_spec, char *filename, 363 char *dir, char *prefix, char *trustflags) 364 { 365 KMF_RETURN rv = KMF_OK; 366 KMF_ATTRIBUTE attrlist[32]; 367 KMF_CREDENTIAL tokencred; 368 int i = 0; 369 370 if (kstype == KMF_KEYSTORE_PK11TOKEN) { 371 rv = select_token(kmfhandle, token_spec, FALSE); 372 } else if (kstype == KMF_KEYSTORE_NSS) { 373 rv = configure_nss(kmfhandle, dir, prefix); 374 } 375 if (rv != KMF_OK) 376 return (rv); 377 378 kmf_set_attr_at_index(attrlist, i, 379 KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (KMF_KEYSTORE_TYPE)); 380 i++; 381 382 kmf_set_attr_at_index(attrlist, i, KMF_CERT_FILENAME_ATTR, 383 filename, strlen(filename)); 384 i++; 385 386 if (label != NULL) { 387 kmf_set_attr_at_index(attrlist, i, KMF_CERT_LABEL_ATTR, 388 label, strlen(label)); 389 i++; 390 } 391 392 if (kstype == KMF_KEYSTORE_NSS) { 393 if (trustflags != NULL) { 394 kmf_set_attr_at_index(attrlist, i, KMF_TRUSTFLAG_ATTR, 395 trustflags, strlen(trustflags)); 396 i++; 397 } 398 399 if (token_spec != NULL) { 400 kmf_set_attr_at_index(attrlist, i, 401 KMF_TOKEN_LABEL_ATTR, 402 token_spec, strlen(token_spec)); 403 i++; 404 } 405 } 406 407 rv = kmf_import_cert(kmfhandle, i, attrlist); 408 if (rv == KMF_ERR_AUTH_FAILED) { 409 /* 410 * The token requires a credential, prompt and try again. 411 */ 412 (void) get_token_password(kstype, token_spec, &tokencred); 413 kmf_set_attr_at_index(attrlist, i, KMF_CREDENTIAL_ATTR, 414 &tokencred, sizeof (KMF_CREDENTIAL)); 415 i++; 416 417 rv = kmf_import_cert(kmfhandle, i, attrlist); 418 419 } 420 return (rv); 421 } 422 423 static KMF_RETURN 424 pk_import_file_crl(void *kmfhandle, 425 char *infile, 426 char *outfile, 427 KMF_ENCODE_FORMAT outfmt) 428 { 429 int numattr = 0; 430 KMF_ATTRIBUTE attrlist[8]; 431 KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_OPENSSL; 432 433 kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR, 434 &kstype, sizeof (kstype)); 435 numattr++; 436 if (infile) { 437 kmf_set_attr_at_index(attrlist, numattr, 438 KMF_CRL_FILENAME_ATTR, infile, strlen(infile)); 439 numattr++; 440 } 441 if (outfile) { 442 kmf_set_attr_at_index(attrlist, numattr, 443 KMF_CRL_OUTFILE_ATTR, outfile, strlen(outfile)); 444 numattr++; 445 } 446 kmf_set_attr_at_index(attrlist, numattr, 447 KMF_ENCODE_FORMAT_ATTR, &outfmt, sizeof (outfmt)); 448 numattr++; 449 450 return (kmf_import_crl(kmfhandle, numattr, attrlist)); 451 } 452 453 static KMF_RETURN 454 pk_import_nss_crl(void *kmfhandle, 455 boolean_t verify_crl_flag, 456 char *infile, 457 char *outdir, 458 char *prefix) 459 { 460 KMF_RETURN rv; 461 int numattr = 0; 462 KMF_ATTRIBUTE attrlist[4]; 463 KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_NSS; 464 465 rv = configure_nss(kmfhandle, outdir, prefix); 466 if (rv != KMF_OK) 467 return (rv); 468 469 kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR, 470 &kstype, sizeof (kstype)); 471 numattr++; 472 if (infile) { 473 kmf_set_attr_at_index(attrlist, numattr, KMF_CRL_FILENAME_ATTR, 474 infile, strlen(infile)); 475 numattr++; 476 } 477 kmf_set_attr_at_index(attrlist, numattr, KMF_CRL_CHECK_ATTR, 478 &verify_crl_flag, sizeof (verify_crl_flag)); 479 numattr++; 480 481 return (kmf_import_crl(kmfhandle, numattr, attrlist)); 482 483 } 484 485 static KMF_RETURN 486 pk_import_pk12_pk11( 487 KMF_HANDLE_T kmfhandle, 488 KMF_CREDENTIAL *p12cred, 489 KMF_CREDENTIAL *tokencred, 490 char *label, char *token_spec, 491 char *filename) 492 { 493 KMF_RETURN rv = KMF_OK; 494 KMF_X509_DER_CERT *certs = NULL; 495 KMF_RAW_KEY_DATA *keys = NULL; 496 int ncerts = 0; 497 int nkeys = 0; 498 int i; 499 KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_PK11TOKEN; 500 KMF_ATTRIBUTE *attrlist = NULL; 501 int numattr = 0; 502 503 rv = select_token(kmfhandle, token_spec, FALSE); 504 505 if (rv != KMF_OK) { 506 return (rv); 507 } 508 509 rv = kmf_import_objects(kmfhandle, filename, p12cred, 510 &certs, &ncerts, &keys, &nkeys); 511 512 if (rv == KMF_OK) { 513 NEW_ATTRLIST(attrlist, (3 + (2 * nkeys))); 514 515 kmf_set_attr_at_index(attrlist, numattr, 516 KMF_KEYSTORE_TYPE_ATTR, &kstype, 517 sizeof (kstype)); 518 numattr++; 519 520 if (label != NULL) { 521 kmf_set_attr_at_index(attrlist, numattr, 522 KMF_KEYLABEL_ATTR, label, 523 strlen(label)); 524 numattr++; 525 } 526 527 if (tokencred != NULL && tokencred->credlen > 0) { 528 kmf_set_attr_at_index(attrlist, numattr, 529 KMF_CREDENTIAL_ATTR, tokencred, 530 sizeof (KMF_CREDENTIAL)); 531 numattr++; 532 } 533 534 /* The order of certificates and keys should match */ 535 for (i = 0; i < nkeys; i++) { 536 int num = numattr; 537 538 if (i < ncerts) { 539 kmf_set_attr_at_index(attrlist, num, 540 KMF_CERT_DATA_ATTR, &certs[i].certificate, 541 sizeof (KMF_DATA)); 542 num++; 543 } 544 545 kmf_set_attr_at_index(attrlist, num, 546 KMF_RAW_KEY_ATTR, &keys[i], 547 sizeof (KMF_RAW_KEY_DATA)); 548 num++; 549 550 rv = kmf_store_key(kmfhandle, num, attrlist); 551 552 } 553 free(attrlist); 554 } 555 556 if (rv == KMF_OK) { 557 numattr = 0; 558 NEW_ATTRLIST(attrlist, (1 + (2 * ncerts))); 559 560 (void) printf(gettext("Found %d certificate(s) and %d " 561 "key(s) in %s\n"), ncerts, nkeys, filename); 562 563 kmf_set_attr_at_index(attrlist, numattr, 564 KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype)); 565 numattr++; 566 567 for (i = 0; rv == KMF_OK && i < ncerts; i++) { 568 int num = numattr; 569 if (certs[i].kmf_private.label != NULL) { 570 kmf_set_attr_at_index(attrlist, num, 571 KMF_CERT_LABEL_ATTR, 572 certs[i].kmf_private.label, 573 strlen(certs[i].kmf_private.label)); 574 num++; 575 } else if (i == 0 && label != NULL) { 576 kmf_set_attr_at_index(attrlist, num, 577 KMF_CERT_LABEL_ATTR, label, strlen(label)); 578 num++; 579 } 580 581 kmf_set_attr_at_index(attrlist, num, 582 KMF_CERT_DATA_ATTR, &certs[i].certificate, 583 sizeof (KMF_DATA)); 584 num++; 585 586 rv = kmf_store_cert(kmfhandle, num, attrlist); 587 } 588 free(attrlist); 589 } 590 591 end: 592 /* 593 * Cleanup memory. 594 */ 595 if (certs) { 596 for (i = 0; i < ncerts; i++) 597 kmf_free_kmf_cert(kmfhandle, &certs[i]); 598 free(certs); 599 } 600 if (keys) { 601 for (i = 0; i < nkeys; i++) 602 kmf_free_raw_key(&keys[i]); 603 free(keys); 604 } 605 606 return (rv); 607 } 608 609 /*ARGSUSED*/ 610 static KMF_RETURN 611 pk_import_keys(KMF_HANDLE_T kmfhandle, 612 KMF_KEYSTORE_TYPE kstype, char *token_spec, 613 KMF_CREDENTIAL *cred, char *filename, 614 char *label, char *senstr, char *extstr) 615 { 616 KMF_RETURN rv = KMF_OK; 617 KMF_ATTRIBUTE attrlist[16]; 618 KMF_KEYSTORE_TYPE fileks = KMF_KEYSTORE_OPENSSL; 619 int numattr = 0; 620 KMF_KEY_HANDLE key; 621 KMF_RAW_KEY_DATA rawkey; 622 KMF_KEY_CLASS class = KMF_ASYM_PRI; 623 int numkeys = 1; 624 625 if (kstype == KMF_KEYSTORE_PK11TOKEN) { 626 rv = select_token(kmfhandle, token_spec, FALSE); 627 } 628 if (rv != KMF_OK) 629 return (rv); 630 /* 631 * First, set up to read the keyfile using the FILE plugin 632 * mechanisms. 633 */ 634 kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR, 635 &fileks, sizeof (fileks)); 636 numattr++; 637 638 kmf_set_attr_at_index(attrlist, numattr, KMF_COUNT_ATTR, 639 &numkeys, sizeof (numkeys)); 640 numattr++; 641 642 kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_HANDLE_ATTR, 643 &key, sizeof (key)); 644 numattr++; 645 646 kmf_set_attr_at_index(attrlist, numattr, KMF_RAW_KEY_ATTR, 647 &rawkey, sizeof (rawkey)); 648 numattr++; 649 650 kmf_set_attr_at_index(attrlist, numattr, KMF_KEYCLASS_ATTR, 651 &class, sizeof (class)); 652 numattr++; 653 654 kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_FILENAME_ATTR, 655 filename, strlen(filename)); 656 numattr++; 657 658 rv = kmf_find_key(kmfhandle, numattr, attrlist); 659 if (rv == KMF_OK) { 660 numattr = 0; 661 662 kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR, 663 &kstype, sizeof (kstype)); 664 numattr++; 665 666 if (cred != NULL && cred->credlen > 0) { 667 kmf_set_attr_at_index(attrlist, numattr, 668 KMF_CREDENTIAL_ATTR, cred, sizeof (KMF_CREDENTIAL)); 669 numattr++; 670 } 671 672 if (label != NULL) { 673 kmf_set_attr_at_index(attrlist, numattr, 674 KMF_KEYLABEL_ATTR, label, strlen(label)); 675 numattr++; 676 } 677 678 kmf_set_attr_at_index(attrlist, numattr, 679 KMF_RAW_KEY_ATTR, &rawkey, sizeof (rawkey)); 680 numattr++; 681 682 rv = kmf_store_key(kmfhandle, numattr, attrlist); 683 if (rv == KMF_OK) { 684 (void) printf(gettext("Importing %d keys\n"), numkeys); 685 } 686 687 kmf_free_kmf_key(kmfhandle, &key); 688 kmf_free_raw_key(&rawkey); 689 } else { 690 cryptoerror(LOG_STDERR, 691 gettext("Failed to load key from file (%s)\n"), 692 filename); 693 } 694 return (rv); 695 } 696 697 static KMF_RETURN 698 pk_import_rawkey(KMF_HANDLE_T kmfhandle, 699 KMF_KEYSTORE_TYPE kstype, char *token, 700 KMF_CREDENTIAL *cred, 701 char *filename, char *label, KMF_KEY_ALG keyAlg, 702 char *senstr, char *extstr) 703 { 704 KMF_RETURN rv = KMF_OK; 705 KMF_ATTRIBUTE attrlist[16]; 706 int numattr = 0; 707 uint32_t keylen; 708 boolean_t sensitive = B_FALSE; 709 boolean_t not_extractable = B_FALSE; 710 KMF_DATA keydata = { 0, NULL }; 711 KMF_KEY_HANDLE rawkey; 712 713 rv = kmf_read_input_file(kmfhandle, filename, &keydata); 714 if (rv != KMF_OK) 715 return (rv); 716 717 rv = select_token(kmfhandle, token, FALSE); 718 719 if (rv != KMF_OK) { 720 return (rv); 721 } 722 if (senstr != NULL) { 723 if (tolower(senstr[0]) == 'y') 724 sensitive = B_TRUE; 725 else if (tolower(senstr[0]) == 'n') 726 sensitive = B_FALSE; 727 else { 728 cryptoerror(LOG_STDERR, 729 gettext("Incorrect sensitive option value.\n")); 730 return (KMF_ERR_BAD_PARAMETER); 731 } 732 } 733 734 if (extstr != NULL) { 735 if (tolower(extstr[0]) == 'y') 736 not_extractable = B_FALSE; 737 else if (tolower(extstr[0]) == 'n') 738 not_extractable = B_TRUE; 739 else { 740 cryptoerror(LOG_STDERR, 741 gettext("Incorrect extractable option value.\n")); 742 return (KMF_ERR_BAD_PARAMETER); 743 } 744 } 745 kmf_set_attr_at_index(attrlist, numattr, 746 KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype)); 747 numattr++; 748 749 kmf_set_attr_at_index(attrlist, numattr, 750 KMF_KEY_HANDLE_ATTR, &rawkey, sizeof (rawkey)); 751 numattr++; 752 753 kmf_set_attr_at_index(attrlist, numattr, 754 KMF_KEYALG_ATTR, &keyAlg, sizeof (KMF_KEY_ALG)); 755 numattr++; 756 757 kmf_set_attr_at_index(attrlist, numattr, 758 KMF_KEY_DATA_ATTR, keydata.Data, keydata.Length); 759 numattr++; 760 761 /* Key length is given in bits not bytes */ 762 keylen = keydata.Length * 8; 763 kmf_set_attr_at_index(attrlist, numattr, 764 KMF_KEYLENGTH_ATTR, &keylen, sizeof (keydata.Length)); 765 numattr++; 766 767 kmf_set_attr_at_index(attrlist, numattr, 768 KMF_SENSITIVE_BOOL_ATTR, &sensitive, sizeof (sensitive)); 769 numattr++; 770 771 kmf_set_attr_at_index(attrlist, numattr, 772 KMF_NON_EXTRACTABLE_BOOL_ATTR, ¬_extractable, 773 sizeof (not_extractable)); 774 numattr++; 775 776 if (label != NULL) { 777 kmf_set_attr_at_index(attrlist, numattr, 778 KMF_KEYLABEL_ATTR, label, strlen(label)); 779 numattr++; 780 } 781 if (cred != NULL && cred->credlen > 0) { 782 kmf_set_attr_at_index(attrlist, numattr, 783 KMF_CREDENTIAL_ATTR, cred, sizeof (KMF_CREDENTIAL)); 784 numattr++; 785 } 786 rv = kmf_create_sym_key(kmfhandle, numattr, attrlist); 787 788 return (rv); 789 } 790 791 /* 792 * Import objects from into KMF repositories. 793 */ 794 int 795 pk_import(int argc, char *argv[]) 796 { 797 int opt; 798 extern int optind_av; 799 extern char *optarg_av; 800 char *token_spec = NULL; 801 char *filename = NULL; 802 char *keyfile = NULL; 803 char *certfile = NULL; 804 char *crlfile = NULL; 805 char *label = NULL; 806 char *dir = NULL; 807 char *prefix = NULL; 808 char *trustflags = NULL; 809 char *verify_crl = NULL; 810 char *keytype = "generic"; 811 char *senstr = NULL; 812 char *extstr = NULL; 813 boolean_t verify_crl_flag = B_FALSE; 814 int oclass = 0; 815 KMF_KEYSTORE_TYPE kstype = 0; 816 KMF_ENCODE_FORMAT kfmt = 0; 817 KMF_ENCODE_FORMAT okfmt = KMF_FORMAT_ASN1; 818 KMF_RETURN rv = KMF_OK; 819 KMF_CREDENTIAL pk12cred = { NULL, 0 }; 820 KMF_CREDENTIAL tokencred = { NULL, 0 }; 821 KMF_HANDLE_T kmfhandle = NULL; 822 KMF_KEY_ALG keyAlg = KMF_GENERIC_SECRET; 823 824 /* Parse command line options. Do NOT i18n/l10n. */ 825 while ((opt = getopt_av(argc, argv, 826 "T:(token)i:(infile)" 827 "k:(keystore)y:(objtype)" 828 "d:(dir)p:(prefix)" 829 "n:(certlabel)N:(label)" 830 "K:(outkey)c:(outcert)" 831 "v:(verifycrl)l:(outcrl)" 832 "E:(keytype)s:(sensitive)x:(extractable)" 833 "t:(trust)F:(outformat)")) != EOF) { 834 if (EMPTYSTRING(optarg_av)) 835 return (PK_ERR_USAGE); 836 switch (opt) { 837 case 'T': /* token specifier */ 838 if (token_spec) 839 return (PK_ERR_USAGE); 840 token_spec = optarg_av; 841 break; 842 case 'c': /* output cert file name */ 843 if (certfile) 844 return (PK_ERR_USAGE); 845 certfile = optarg_av; 846 break; 847 case 'l': /* output CRL file name */ 848 if (crlfile) 849 return (PK_ERR_USAGE); 850 crlfile = optarg_av; 851 break; 852 case 'K': /* output key file name */ 853 if (keyfile) 854 return (PK_ERR_USAGE); 855 keyfile = optarg_av; 856 break; 857 case 'i': /* input file name */ 858 if (filename) 859 return (PK_ERR_USAGE); 860 filename = optarg_av; 861 break; 862 case 'k': 863 kstype = KS2Int(optarg_av); 864 if (kstype == 0) 865 return (PK_ERR_USAGE); 866 break; 867 case 'y': 868 oclass = OT2Int(optarg_av); 869 if (oclass == -1) 870 return (PK_ERR_USAGE); 871 break; 872 case 'd': 873 dir = optarg_av; 874 break; 875 case 'p': 876 if (prefix) 877 return (PK_ERR_USAGE); 878 prefix = optarg_av; 879 break; 880 case 'n': 881 case 'N': 882 if (label) 883 return (PK_ERR_USAGE); 884 label = optarg_av; 885 break; 886 case 'F': 887 okfmt = Str2Format(optarg_av); 888 if (okfmt == KMF_FORMAT_UNDEF) 889 return (PK_ERR_USAGE); 890 break; 891 case 't': 892 if (trustflags) 893 return (PK_ERR_USAGE); 894 trustflags = optarg_av; 895 break; 896 case 'v': 897 verify_crl = optarg_av; 898 if (tolower(verify_crl[0]) == 'y') 899 verify_crl_flag = B_TRUE; 900 else if (tolower(verify_crl[0]) == 'n') 901 verify_crl_flag = B_FALSE; 902 else 903 return (PK_ERR_USAGE); 904 break; 905 case 'E': 906 keytype = optarg_av; 907 break; 908 case 's': 909 if (senstr) 910 return (PK_ERR_USAGE); 911 senstr = optarg_av; 912 break; 913 case 'x': 914 if (extstr) 915 return (PK_ERR_USAGE); 916 extstr = optarg_av; 917 break; 918 default: 919 return (PK_ERR_USAGE); 920 } 921 } 922 923 /* Assume keystore = PKCS#11 if not specified */ 924 if (kstype == 0) 925 kstype = KMF_KEYSTORE_PK11TOKEN; 926 927 /* Filename arg is required. */ 928 if (EMPTYSTRING(filename)) { 929 cryptoerror(LOG_STDERR, gettext("The 'infile' parameter" 930 "is required for the import operation.\n")); 931 return (PK_ERR_USAGE); 932 } 933 934 /* No additional args allowed. */ 935 argc -= optind_av; 936 argv += optind_av; 937 if (argc) 938 return (PK_ERR_USAGE); 939 940 DIR_OPTION_CHECK(kstype, dir); 941 942 /* if PUBLIC or PRIVATE obj was given, the old syntax was used. */ 943 if ((oclass & (PK_PUBLIC_OBJ | PK_PRIVATE_OBJ)) && 944 kstype != KMF_KEYSTORE_PK11TOKEN) { 945 946 (void) fprintf(stderr, gettext("The objtype parameter " 947 "is only relevant if keystore=pkcs11\n")); 948 return (PK_ERR_USAGE); 949 } 950 951 /* 952 * You must specify a certlabel (cert label) when importing 953 * into NSS or PKCS#11. 954 */ 955 if (kstype == KMF_KEYSTORE_NSS && 956 (oclass != PK_CRL_OBJ) && EMPTYSTRING(label)) { 957 cryptoerror(LOG_STDERR, gettext("The 'label' argument " 958 "is required for this operation\n")); 959 return (PK_ERR_USAGE); 960 } 961 962 if ((rv = kmf_get_file_format(filename, &kfmt)) != KMF_OK) { 963 char *kmferrstr = NULL; 964 KMF_RETURN rv2; 965 /* 966 * Allow for raw key data to be imported. 967 */ 968 if (rv == KMF_ERR_ENCODING) { 969 rv = KMF_OK; 970 kfmt = KMF_FORMAT_RAWKEY; 971 /* 972 * Set the object class only if it was not 973 * given on the command line or if it was 974 * specified as a symmetric key object. 975 */ 976 if (oclass == 0 || (oclass & PK_SYMKEY_OBJ)) { 977 oclass = PK_SYMKEY_OBJ; 978 } else { 979 cryptoerror(LOG_STDERR, gettext( 980 "The input file does not contain the " 981 "object type indicated on command " 982 "line.")); 983 return (KMF_ERR_BAD_PARAMETER); 984 } 985 } else { 986 if (rv == KMF_ERR_OPEN_FILE) { 987 cryptoerror(LOG_STDERR, 988 gettext("Cannot open file (%s)\n."), 989 filename); 990 } else { 991 rv2 = kmf_get_kmf_error_str(rv, &kmferrstr); 992 if (rv2 == KMF_OK && kmferrstr) { 993 cryptoerror(LOG_STDERR, 994 gettext("libkmf error: %s"), 995 kmferrstr); 996 kmf_free_str(kmferrstr); 997 } 998 } 999 return (rv); 1000 } 1001 } 1002 1003 /* Check parameters for raw key import operation */ 1004 if (kfmt == KMF_FORMAT_RAWKEY) { 1005 if (keytype != NULL && 1006 Str2SymKeyType(keytype, &keyAlg) != 0) { 1007 cryptoerror(LOG_STDERR, 1008 gettext("Unrecognized keytype(%s).\n"), keytype); 1009 return (PK_ERR_USAGE); 1010 } 1011 if (senstr != NULL && extstr != NULL && 1012 kstype != KMF_KEYSTORE_PK11TOKEN) { 1013 cryptoerror(LOG_STDERR, 1014 gettext("The sensitive or extractable option " 1015 "applies only when importing a key from a file " 1016 "into a PKCS#11 keystore.\n")); 1017 return (PK_ERR_USAGE); 1018 } 1019 } 1020 1021 /* If no objtype was given, treat it as a certificate */ 1022 if (oclass == 0 && (kfmt == KMF_FORMAT_ASN1 || 1023 kfmt == KMF_FORMAT_PEM)) 1024 oclass = PK_CERT_OBJ; 1025 1026 if (kstype == KMF_KEYSTORE_NSS) { 1027 if (oclass == PK_CRL_OBJ && 1028 (kfmt != KMF_FORMAT_ASN1 && kfmt != KMF_FORMAT_PEM)) { 1029 cryptoerror(LOG_STDERR, gettext( 1030 "CRL data can only be imported as DER or " 1031 "PEM format")); 1032 return (PK_ERR_USAGE); 1033 } 1034 1035 if (oclass == PK_CERT_OBJ && 1036 (kfmt != KMF_FORMAT_ASN1 && kfmt != KMF_FORMAT_PEM)) { 1037 cryptoerror(LOG_STDERR, gettext( 1038 "Certificates can only be imported as DER or " 1039 "PEM format")); 1040 return (PK_ERR_USAGE); 1041 } 1042 1043 /* we do not import private keys except in PKCS12 bundles */ 1044 if (oclass & (PK_PRIVATE_OBJ | PK_PRIKEY_OBJ)) { 1045 cryptoerror(LOG_STDERR, gettext( 1046 "Private key data can only be imported as part " 1047 "of a PKCS12 file.\n")); 1048 return (PK_ERR_USAGE); 1049 } 1050 } 1051 1052 if (kstype == KMF_KEYSTORE_OPENSSL && oclass != PK_CRL_OBJ) { 1053 if (EMPTYSTRING(keyfile) || EMPTYSTRING(certfile)) { 1054 cryptoerror(LOG_STDERR, gettext( 1055 "The 'outkey' and 'outcert' parameters " 1056 "are required for the import operation " 1057 "when the 'file' keystore is used.\n")); 1058 return (PK_ERR_USAGE); 1059 } 1060 } 1061 1062 if (kstype == KMF_KEYSTORE_PK11TOKEN && EMPTYSTRING(token_spec)) 1063 token_spec = PK_DEFAULT_PK11TOKEN; 1064 else if (kstype == KMF_KEYSTORE_NSS && EMPTYSTRING(token_spec)) 1065 token_spec = DEFAULT_NSS_TOKEN; 1066 1067 if (kfmt == KMF_FORMAT_PKCS12) { 1068 (void) get_pk12_password(&pk12cred); 1069 } 1070 1071 if ((kfmt == KMF_FORMAT_PKCS12 || kfmt == KMF_FORMAT_RAWKEY || 1072 (kfmt == KMF_FORMAT_PEM && (oclass & PK_KEY_OBJ))) && 1073 (kstype == KMF_KEYSTORE_PK11TOKEN || kstype == KMF_KEYSTORE_NSS)) { 1074 (void) get_token_password(kstype, token_spec, &tokencred); 1075 } 1076 1077 if ((rv = kmf_initialize(&kmfhandle, NULL, NULL)) != KMF_OK) { 1078 cryptoerror(LOG_STDERR, gettext("Error initializing " 1079 "KMF: 0x%02x\n"), rv); 1080 goto end; 1081 } 1082 1083 switch (kstype) { 1084 case KMF_KEYSTORE_PK11TOKEN: 1085 if (kfmt == KMF_FORMAT_PKCS12) 1086 rv = pk_import_pk12_pk11( 1087 kmfhandle, &pk12cred, 1088 &tokencred, label, 1089 token_spec, filename); 1090 else if (oclass == PK_CERT_OBJ) 1091 rv = pk_import_cert( 1092 kmfhandle, kstype, 1093 label, token_spec, 1094 filename, 1095 NULL, NULL, NULL); 1096 else if (oclass == PK_CRL_OBJ) 1097 rv = pk_import_file_crl( 1098 kmfhandle, filename, 1099 crlfile, okfmt); 1100 else if (kfmt == KMF_FORMAT_RAWKEY && 1101 oclass == PK_SYMKEY_OBJ) { 1102 rv = pk_import_rawkey(kmfhandle, 1103 kstype, token_spec, &tokencred, 1104 filename, label, 1105 keyAlg, senstr, extstr); 1106 } else if (kfmt == KMF_FORMAT_PEM || 1107 kfmt == KMF_FORMAT_PEM_KEYPAIR) { 1108 rv = pk_import_keys(kmfhandle, 1109 kstype, token_spec, &tokencred, 1110 filename, label, senstr, extstr); 1111 } else { 1112 rv = PK_ERR_USAGE; 1113 } 1114 break; 1115 case KMF_KEYSTORE_NSS: 1116 if (dir == NULL) 1117 dir = PK_DEFAULT_DIRECTORY; 1118 if (kfmt == KMF_FORMAT_PKCS12) 1119 rv = pk_import_pk12_nss( 1120 kmfhandle, &pk12cred, 1121 &tokencred, 1122 token_spec, dir, prefix, 1123 label, trustflags, filename); 1124 else if (oclass == PK_CERT_OBJ) { 1125 rv = pk_import_cert( 1126 kmfhandle, kstype, 1127 label, token_spec, 1128 filename, dir, prefix, trustflags); 1129 } else if (oclass == PK_CRL_OBJ) { 1130 rv = pk_import_nss_crl( 1131 kmfhandle, verify_crl_flag, 1132 filename, dir, prefix); 1133 } 1134 break; 1135 case KMF_KEYSTORE_OPENSSL: 1136 if (kfmt == KMF_FORMAT_PKCS12) 1137 rv = pk_import_pk12_files( 1138 kmfhandle, &pk12cred, 1139 filename, certfile, keyfile, 1140 okfmt); 1141 else if (oclass == PK_CRL_OBJ) { 1142 rv = pk_import_file_crl( 1143 kmfhandle, filename, 1144 crlfile, okfmt); 1145 } else 1146 /* 1147 * It doesn't make sense to import anything 1148 * else for the files plugin. 1149 */ 1150 return (PK_ERR_USAGE); 1151 break; 1152 default: 1153 rv = PK_ERR_USAGE; 1154 break; 1155 } 1156 1157 end: 1158 if (rv != KMF_OK) 1159 display_error(kmfhandle, rv, 1160 gettext("Error importing objects")); 1161 1162 if (tokencred.cred != NULL) 1163 free(tokencred.cred); 1164 1165 if (pk12cred.cred != NULL) 1166 free(pk12cred.cred); 1167 1168 (void) kmf_finalize(kmfhandle); 1169 1170 if (rv != KMF_OK) 1171 return (PK_ERR_USAGE); 1172 1173 return (0); 1174 } 1175