17c478bd9Sstevel@tonic-gate /* 27c478bd9Sstevel@tonic-gate * CDDL HEADER START 37c478bd9Sstevel@tonic-gate * 47c478bd9Sstevel@tonic-gate * The contents of this file are subject to the terms of the 51d8ed0f0Svikram * Common Development and Distribution License (the "License"). 61d8ed0f0Svikram * You may not use this file except in compliance with the License. 77c478bd9Sstevel@tonic-gate * 87c478bd9Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 97c478bd9Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 107c478bd9Sstevel@tonic-gate * See the License for the specific language governing permissions 117c478bd9Sstevel@tonic-gate * and limitations under the License. 127c478bd9Sstevel@tonic-gate * 137c478bd9Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 147c478bd9Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 157c478bd9Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 167c478bd9Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 177c478bd9Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 187c478bd9Sstevel@tonic-gate * 197c478bd9Sstevel@tonic-gate * CDDL HEADER END 207c478bd9Sstevel@tonic-gate */ 217c478bd9Sstevel@tonic-gate /* 22b1efbcd6SAlok Aggarwal * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 231d8ed0f0Svikram * Use is subject to license terms. 24*789dced6SJerry Jelinek * Copyright 2012 Joyent, Inc. All rights reserved. 253d7072f8Seschrock */ 263d7072f8Seschrock 273d7072f8Seschrock /* 287c478bd9Sstevel@tonic-gate * lofiadm - administer lofi(7d). Very simple, add and remove file<->device 297c478bd9Sstevel@tonic-gate * associations, and display status. All the ioctls are private between 307c478bd9Sstevel@tonic-gate * lofi and lofiadm, and so are very simple - device information is 317c478bd9Sstevel@tonic-gate * communicated via a minor number. 327c478bd9Sstevel@tonic-gate */ 337c478bd9Sstevel@tonic-gate 347c478bd9Sstevel@tonic-gate #include <sys/types.h> 357c478bd9Sstevel@tonic-gate #include <sys/param.h> 367c478bd9Sstevel@tonic-gate #include <sys/lofi.h> 377c478bd9Sstevel@tonic-gate #include <sys/stat.h> 384058a205Sjrgn.keil@googlemail.com #include <sys/sysmacros.h> 3987117650Saalok #include <netinet/in.h> 407c478bd9Sstevel@tonic-gate #include <stdio.h> 417c478bd9Sstevel@tonic-gate #include <fcntl.h> 427c478bd9Sstevel@tonic-gate #include <locale.h> 437c478bd9Sstevel@tonic-gate #include <string.h> 4487117650Saalok #include <strings.h> 457c478bd9Sstevel@tonic-gate #include <errno.h> 467c478bd9Sstevel@tonic-gate #include <stdlib.h> 477c478bd9Sstevel@tonic-gate #include <unistd.h> 487c478bd9Sstevel@tonic-gate #include <stropts.h> 491d8ed0f0Svikram #include <libdevinfo.h> 5087117650Saalok #include <libgen.h> 5187117650Saalok #include <ctype.h> 52579df0adSaalok #include <dlfcn.h> 537d82f0f8SDina K Nimeh #include <limits.h> 547d82f0f8SDina K Nimeh #include <security/cryptoki.h> 557d82f0f8SDina K Nimeh #include <cryptoutil.h> 567d82f0f8SDina K Nimeh #include <sys/crypto/ioctl.h> 577d82f0f8SDina K Nimeh #include <sys/crypto/ioctladmin.h> 587c478bd9Sstevel@tonic-gate #include "utils.h" 59b1efbcd6SAlok Aggarwal #include <LzmaEnc.h> 607c478bd9Sstevel@tonic-gate 617d82f0f8SDina K Nimeh /* Only need the IV len #defines out of these files, nothing else. */ 627d82f0f8SDina K Nimeh #include <aes/aes_impl.h> 637d82f0f8SDina K Nimeh #include <des/des_impl.h> 647d82f0f8SDina K Nimeh #include <blowfish/blowfish_impl.h> 657d82f0f8SDina K Nimeh 667c478bd9Sstevel@tonic-gate static const char USAGE[] = 677d82f0f8SDina K Nimeh "Usage: %s -a file [ device ] " 687d82f0f8SDina K Nimeh " [-c aes-128-cbc|aes-192-cbc|aes-256-cbc|des3-cbc|blowfish-cbc]" 697d82f0f8SDina K Nimeh " [-e] [-k keyfile] [-T [token]:[manuf]:[serial]:key]\n" 707c478bd9Sstevel@tonic-gate " %s -d file | device\n" 71b1efbcd6SAlok Aggarwal " %s -C [gzip|gzip-6|gzip-9|lzma] [-s segment_size] file\n" 7287117650Saalok " %s -U file\n" 73f9153c6bSDina K Nimeh " %s [ file | device ]\n"; 747c478bd9Sstevel@tonic-gate 757d82f0f8SDina K Nimeh typedef struct token_spec { 767d82f0f8SDina K Nimeh char *name; 777d82f0f8SDina K Nimeh char *mfr; 787d82f0f8SDina K Nimeh char *serno; 797d82f0f8SDina K Nimeh char *key; 807d82f0f8SDina K Nimeh } token_spec_t; 817d82f0f8SDina K Nimeh 827d82f0f8SDina K Nimeh typedef struct mech_alias { 837d82f0f8SDina K Nimeh char *alias; 847d82f0f8SDina K Nimeh CK_MECHANISM_TYPE type; 857d82f0f8SDina K Nimeh char *name; /* for ioctl */ 867d82f0f8SDina K Nimeh char *iv_name; /* for ioctl */ 877d82f0f8SDina K Nimeh size_t iv_len; /* for ioctl */ 887d82f0f8SDina K Nimeh iv_method_t iv_type; /* for ioctl */ 897d82f0f8SDina K Nimeh size_t min_keysize; /* in bytes */ 907d82f0f8SDina K Nimeh size_t max_keysize; /* in bytes */ 917d82f0f8SDina K Nimeh token_spec_t *token; 927d82f0f8SDina K Nimeh CK_SLOT_ID slot; 937d82f0f8SDina K Nimeh } mech_alias_t; 947d82f0f8SDina K Nimeh 957d82f0f8SDina K Nimeh static mech_alias_t mech_aliases[] = { 967d82f0f8SDina K Nimeh /* Preferred one should always be listed first. */ 977d82f0f8SDina K Nimeh { "aes-256-cbc", CKM_AES_CBC, "CKM_AES_CBC", "CKM_AES_ECB", AES_IV_LEN, 987d82f0f8SDina K Nimeh IVM_ENC_BLKNO, ULONG_MAX, 0L, NULL, (CK_SLOT_ID) -1 }, 997d82f0f8SDina K Nimeh { "aes-192-cbc", CKM_AES_CBC, "CKM_AES_CBC", "CKM_AES_ECB", AES_IV_LEN, 1007d82f0f8SDina K Nimeh IVM_ENC_BLKNO, ULONG_MAX, 0L, NULL, (CK_SLOT_ID) -1 }, 1017d82f0f8SDina K Nimeh { "aes-128-cbc", CKM_AES_CBC, "CKM_AES_CBC", "CKM_AES_ECB", AES_IV_LEN, 1027d82f0f8SDina K Nimeh IVM_ENC_BLKNO, ULONG_MAX, 0L, NULL, (CK_SLOT_ID) -1 }, 1037d82f0f8SDina K Nimeh { "des3-cbc", CKM_DES3_CBC, "CKM_DES3_CBC", "CKM_DES3_ECB", DES_IV_LEN, 1047d82f0f8SDina K Nimeh IVM_ENC_BLKNO, ULONG_MAX, 0L, NULL, (CK_SLOT_ID)-1 }, 1057d82f0f8SDina K Nimeh { "blowfish-cbc", CKM_BLOWFISH_CBC, "CKM_BLOWFISH_CBC", 1067d82f0f8SDina K Nimeh "CKM_BLOWFISH_ECB", BLOWFISH_IV_LEN, IVM_ENC_BLKNO, ULONG_MAX, 1077d82f0f8SDina K Nimeh 0L, NULL, (CK_SLOT_ID)-1 } 1087d82f0f8SDina K Nimeh /* 1097d82f0f8SDina K Nimeh * A cipher without an iv requirement would look like this: 1107d82f0f8SDina K Nimeh * { "aes-xex", CKM_AES_XEX, "CKM_AES_XEX", NULL, 0, 1117d82f0f8SDina K Nimeh * IVM_NONE, ULONG_MAX, 0L, NULL, (CK_SLOT_ID)-1 } 1127d82f0f8SDina K Nimeh */ 1137d82f0f8SDina K Nimeh }; 1147d82f0f8SDina K Nimeh 1157d82f0f8SDina K Nimeh int mech_aliases_count = (sizeof (mech_aliases) / sizeof (mech_alias_t)); 1167d82f0f8SDina K Nimeh 1177d82f0f8SDina K Nimeh /* Preferred cipher, if one isn't specified on command line. */ 1187d82f0f8SDina K Nimeh #define DEFAULT_CIPHER (&mech_aliases[0]) 1197d82f0f8SDina K Nimeh 1207d82f0f8SDina K Nimeh #define DEFAULT_CIPHER_NUM 64 /* guess # kernel ciphers available */ 1217d82f0f8SDina K Nimeh #define DEFAULT_MECHINFO_NUM 16 /* guess # kernel mechs available */ 1227d82f0f8SDina K Nimeh #define MIN_PASSLEN 8 /* min acceptable passphrase size */ 1237c478bd9Sstevel@tonic-gate 12487117650Saalok static int gzip_compress(void *src, size_t srclen, void *dst, 12587117650Saalok size_t *destlen, int level); 126b1efbcd6SAlok Aggarwal static int lzma_compress(void *src, size_t srclen, void *dst, 127b1efbcd6SAlok Aggarwal size_t *destlen, int level); 12887117650Saalok 12987117650Saalok lofi_compress_info_t lofi_compress_table[LOFI_COMPRESS_FUNCTIONS] = { 13087117650Saalok {NULL, gzip_compress, 6, "gzip"}, /* default */ 13187117650Saalok {NULL, gzip_compress, 6, "gzip-6"}, 132b1efbcd6SAlok Aggarwal {NULL, gzip_compress, 9, "gzip-9"}, 133b1efbcd6SAlok Aggarwal {NULL, lzma_compress, 0, "lzma"} 13487117650Saalok }; 13587117650Saalok 1367d82f0f8SDina K Nimeh /* For displaying lofi mappings */ 13787117650Saalok #define FORMAT "%-20s %-30s %s\n" 1387d82f0f8SDina K Nimeh 13987117650Saalok #define COMPRESS_ALGORITHM "gzip" 14087117650Saalok #define COMPRESS_THRESHOLD 2048 14187117650Saalok #define SEGSIZE 131072 14287117650Saalok #define BLOCK_SIZE 512 14387117650Saalok #define KILOBYTE 1024 14487117650Saalok #define MEGABYTE (KILOBYTE * KILOBYTE) 14587117650Saalok #define GIGABYTE (KILOBYTE * MEGABYTE) 146579df0adSaalok #define LIBZ "libz.so" 147579df0adSaalok 148b1efbcd6SAlok Aggarwal static void 149b1efbcd6SAlok Aggarwal usage(const char *pname) 15087117650Saalok { 151b1efbcd6SAlok Aggarwal (void) fprintf(stderr, gettext(USAGE), pname, pname, pname, 152b1efbcd6SAlok Aggarwal pname, pname); 153b1efbcd6SAlok Aggarwal exit(E_USAGE); 154b1efbcd6SAlok Aggarwal } 155b1efbcd6SAlok Aggarwal 156b1efbcd6SAlok Aggarwal static int 157b1efbcd6SAlok Aggarwal gzip_compress(void *src, size_t srclen, void *dst, size_t *dstlen, int level) 158b1efbcd6SAlok Aggarwal { 159b1efbcd6SAlok Aggarwal static int (*compress2p)(void *, ulong_t *, void *, size_t, int) = NULL; 160579df0adSaalok void *libz_hdl = NULL; 16187117650Saalok 162579df0adSaalok /* 163579df0adSaalok * The first time we are called, attempt to dlopen() 164579df0adSaalok * libz.so and get a pointer to the compress2() function 165579df0adSaalok */ 166579df0adSaalok if (compress2p == NULL) { 167579df0adSaalok if ((libz_hdl = openlib(LIBZ)) == NULL) 168579df0adSaalok die(gettext("could not find %s. " 169579df0adSaalok "gzip compression unavailable\n"), LIBZ); 170579df0adSaalok 171579df0adSaalok if ((compress2p = 172579df0adSaalok (int (*)(void *, ulong_t *, void *, size_t, int)) 173579df0adSaalok dlsym(libz_hdl, "compress2")) == NULL) { 174579df0adSaalok closelib(); 175579df0adSaalok die(gettext("could not find the correct %s. " 176579df0adSaalok "gzip compression unavailable\n"), LIBZ); 177579df0adSaalok } 178579df0adSaalok } 179579df0adSaalok 180579df0adSaalok if ((*compress2p)(dst, (ulong_t *)dstlen, src, srclen, level) != 0) 181579df0adSaalok return (-1); 18287117650Saalok return (0); 18387117650Saalok } 1847c478bd9Sstevel@tonic-gate 185b1efbcd6SAlok Aggarwal /*ARGSUSED*/ 1867c478bd9Sstevel@tonic-gate static void 187b1efbcd6SAlok Aggarwal *SzAlloc(void *p, size_t size) 1887c478bd9Sstevel@tonic-gate { 189b1efbcd6SAlok Aggarwal return (malloc(size)); 190b1efbcd6SAlok Aggarwal } 191b1efbcd6SAlok Aggarwal 192b1efbcd6SAlok Aggarwal /*ARGSUSED*/ 193b1efbcd6SAlok Aggarwal static void 194b1efbcd6SAlok Aggarwal SzFree(void *p, void *address, size_t size) 195b1efbcd6SAlok Aggarwal { 196b1efbcd6SAlok Aggarwal free(address); 197b1efbcd6SAlok Aggarwal } 198b1efbcd6SAlok Aggarwal 199b1efbcd6SAlok Aggarwal static ISzAlloc g_Alloc = { 200b1efbcd6SAlok Aggarwal SzAlloc, 201b1efbcd6SAlok Aggarwal SzFree 202b1efbcd6SAlok Aggarwal }; 203b1efbcd6SAlok Aggarwal 204b1efbcd6SAlok Aggarwal #define LZMA_UNCOMPRESSED_SIZE 8 205b1efbcd6SAlok Aggarwal #define LZMA_HEADER_SIZE (LZMA_PROPS_SIZE + LZMA_UNCOMPRESSED_SIZE) 206b1efbcd6SAlok Aggarwal 207b1efbcd6SAlok Aggarwal /*ARGSUSED*/ 208b1efbcd6SAlok Aggarwal static int 209b1efbcd6SAlok Aggarwal lzma_compress(void *src, size_t srclen, void *dst, 210b1efbcd6SAlok Aggarwal size_t *dstlen, int level) 211b1efbcd6SAlok Aggarwal { 212b1efbcd6SAlok Aggarwal CLzmaEncProps props; 213b1efbcd6SAlok Aggarwal size_t outsize2; 214b1efbcd6SAlok Aggarwal size_t outsizeprocessed; 215b1efbcd6SAlok Aggarwal size_t outpropssize = LZMA_PROPS_SIZE; 216b1efbcd6SAlok Aggarwal uint64_t t = 0; 217b1efbcd6SAlok Aggarwal SRes res; 218b1efbcd6SAlok Aggarwal Byte *dstp; 219b1efbcd6SAlok Aggarwal int i; 220b1efbcd6SAlok Aggarwal 221b1efbcd6SAlok Aggarwal outsize2 = *dstlen; 222b1efbcd6SAlok Aggarwal 223b1efbcd6SAlok Aggarwal LzmaEncProps_Init(&props); 224b1efbcd6SAlok Aggarwal 225b1efbcd6SAlok Aggarwal /* 226b1efbcd6SAlok Aggarwal * The LZMA compressed file format is as follows - 227b1efbcd6SAlok Aggarwal * 228b1efbcd6SAlok Aggarwal * Offset Size(bytes) Description 229b1efbcd6SAlok Aggarwal * 0 1 LZMA properties (lc, lp, lp (encoded)) 230b1efbcd6SAlok Aggarwal * 1 4 Dictionary size (little endian) 231b1efbcd6SAlok Aggarwal * 5 8 Uncompressed size (little endian) 232b1efbcd6SAlok Aggarwal * 13 Compressed data 233b1efbcd6SAlok Aggarwal */ 234b1efbcd6SAlok Aggarwal 235b1efbcd6SAlok Aggarwal /* set the dictionary size to be 8MB */ 236b1efbcd6SAlok Aggarwal props.dictSize = 1 << 23; 237b1efbcd6SAlok Aggarwal 238b1efbcd6SAlok Aggarwal if (*dstlen < LZMA_HEADER_SIZE) 239b1efbcd6SAlok Aggarwal return (SZ_ERROR_OUTPUT_EOF); 240b1efbcd6SAlok Aggarwal 241b1efbcd6SAlok Aggarwal dstp = (Byte *)dst; 242b1efbcd6SAlok Aggarwal t = srclen; 243b1efbcd6SAlok Aggarwal /* 244b1efbcd6SAlok Aggarwal * Set the uncompressed size in the LZMA header 245b1efbcd6SAlok Aggarwal * The LZMA properties (specified in 'props') 246b1efbcd6SAlok Aggarwal * will be set by the call to LzmaEncode() 247b1efbcd6SAlok Aggarwal */ 248b1efbcd6SAlok Aggarwal for (i = 0; i < LZMA_UNCOMPRESSED_SIZE; i++, t >>= 8) { 249b1efbcd6SAlok Aggarwal dstp[LZMA_PROPS_SIZE + i] = (Byte)t; 250b1efbcd6SAlok Aggarwal } 251b1efbcd6SAlok Aggarwal 252b1efbcd6SAlok Aggarwal outsizeprocessed = outsize2 - LZMA_HEADER_SIZE; 253b1efbcd6SAlok Aggarwal res = LzmaEncode(dstp + LZMA_HEADER_SIZE, &outsizeprocessed, 254b1efbcd6SAlok Aggarwal src, srclen, &props, dstp, &outpropssize, 0, NULL, 255b1efbcd6SAlok Aggarwal &g_Alloc, &g_Alloc); 256b1efbcd6SAlok Aggarwal 257b1efbcd6SAlok Aggarwal if (res != 0) 258b1efbcd6SAlok Aggarwal return (-1); 259b1efbcd6SAlok Aggarwal 260b1efbcd6SAlok Aggarwal *dstlen = outsizeprocessed + LZMA_HEADER_SIZE; 261b1efbcd6SAlok Aggarwal return (0); 2627c478bd9Sstevel@tonic-gate } 2637c478bd9Sstevel@tonic-gate 2647c478bd9Sstevel@tonic-gate /* 2657c478bd9Sstevel@tonic-gate * Translate a lofi device name to a minor number. We might be asked 2667c478bd9Sstevel@tonic-gate * to do this when there is no association (such as when the user specifies 2677c478bd9Sstevel@tonic-gate * a particular device), so we can only look at the string. 2687c478bd9Sstevel@tonic-gate */ 2697c478bd9Sstevel@tonic-gate static int 2707c478bd9Sstevel@tonic-gate name_to_minor(const char *devicename) 2717c478bd9Sstevel@tonic-gate { 2727c478bd9Sstevel@tonic-gate int minor; 2737c478bd9Sstevel@tonic-gate 2747c478bd9Sstevel@tonic-gate if (sscanf(devicename, "/dev/" LOFI_BLOCK_NAME "/%d", &minor) == 1) { 2757c478bd9Sstevel@tonic-gate return (minor); 2767c478bd9Sstevel@tonic-gate } 2777c478bd9Sstevel@tonic-gate if (sscanf(devicename, "/dev/" LOFI_CHAR_NAME "/%d", &minor) == 1) { 2787c478bd9Sstevel@tonic-gate return (minor); 2797c478bd9Sstevel@tonic-gate } 2807c478bd9Sstevel@tonic-gate return (0); 2817c478bd9Sstevel@tonic-gate } 2827c478bd9Sstevel@tonic-gate 2837c478bd9Sstevel@tonic-gate /* 2847c478bd9Sstevel@tonic-gate * This might be the first time we've used this minor number. If so, 2857c478bd9Sstevel@tonic-gate * it might also be that the /dev links are in the process of being created 2867c478bd9Sstevel@tonic-gate * by devfsadmd (or that they'll be created "soon"). We cannot return 2877c478bd9Sstevel@tonic-gate * until they're there or the invoker of lofiadm might try to use them 2887c478bd9Sstevel@tonic-gate * and not find them. This can happen if a shell script is running on 2897c478bd9Sstevel@tonic-gate * an MP. 2907c478bd9Sstevel@tonic-gate */ 2917c478bd9Sstevel@tonic-gate static int sleeptime = 2; /* number of seconds to sleep between stat's */ 2927c478bd9Sstevel@tonic-gate static int maxsleep = 120; /* maximum number of seconds to sleep */ 2937c478bd9Sstevel@tonic-gate 2947c478bd9Sstevel@tonic-gate static void 2957c478bd9Sstevel@tonic-gate wait_until_dev_complete(int minor) 2967c478bd9Sstevel@tonic-gate { 2977c478bd9Sstevel@tonic-gate struct stat64 buf; 2987c478bd9Sstevel@tonic-gate int cursleep; 29987117650Saalok char blkpath[MAXPATHLEN]; 30087117650Saalok char charpath[MAXPATHLEN]; 3011d8ed0f0Svikram di_devlink_handle_t hdl; 3021d8ed0f0Svikram 3037c478bd9Sstevel@tonic-gate (void) snprintf(blkpath, sizeof (blkpath), "/dev/%s/%d", 3047c478bd9Sstevel@tonic-gate LOFI_BLOCK_NAME, minor); 3057c478bd9Sstevel@tonic-gate (void) snprintf(charpath, sizeof (charpath), "/dev/%s/%d", 3067c478bd9Sstevel@tonic-gate LOFI_CHAR_NAME, minor); 3071d8ed0f0Svikram 3081d8ed0f0Svikram /* Check if links already present */ 3091d8ed0f0Svikram if (stat64(blkpath, &buf) == 0 && stat64(charpath, &buf) == 0) 3101d8ed0f0Svikram return; 3111d8ed0f0Svikram 3121d8ed0f0Svikram /* First use di_devlink_init() */ 3131d8ed0f0Svikram if (hdl = di_devlink_init("lofi", DI_MAKE_LINK)) { 3141d8ed0f0Svikram (void) di_devlink_fini(&hdl); 3151d8ed0f0Svikram goto out; 3161d8ed0f0Svikram } 3171d8ed0f0Svikram 3181d8ed0f0Svikram /* 3191d8ed0f0Svikram * Under normal conditions, di_devlink_init(DI_MAKE_LINK) above will 3201d8ed0f0Svikram * only fail if the caller is non-root. In that case, wait for 3211d8ed0f0Svikram * link creation via sysevents. 3221d8ed0f0Svikram */ 3237d82f0f8SDina K Nimeh for (cursleep = 0; cursleep < maxsleep; cursleep += sleeptime) { 3247d82f0f8SDina K Nimeh if (stat64(blkpath, &buf) == 0 && stat64(charpath, &buf) == 0) 3257c478bd9Sstevel@tonic-gate return; 3267d82f0f8SDina K Nimeh (void) sleep(sleeptime); 3277c478bd9Sstevel@tonic-gate } 3281d8ed0f0Svikram 3297c478bd9Sstevel@tonic-gate /* one last try */ 3301d8ed0f0Svikram out: 3317c478bd9Sstevel@tonic-gate if (stat64(blkpath, &buf) == -1) { 3327c478bd9Sstevel@tonic-gate die(gettext("%s was not created"), blkpath); 3337c478bd9Sstevel@tonic-gate } 3347c478bd9Sstevel@tonic-gate if (stat64(charpath, &buf) == -1) { 3357c478bd9Sstevel@tonic-gate die(gettext("%s was not created"), charpath); 3367c478bd9Sstevel@tonic-gate } 3377c478bd9Sstevel@tonic-gate } 3387c478bd9Sstevel@tonic-gate 3397c478bd9Sstevel@tonic-gate /* 3407d82f0f8SDina K Nimeh * Map the file and return the minor number the driver picked for the file 3417d82f0f8SDina K Nimeh * DO NOT use this function if the filename is actually the device name. 3427d82f0f8SDina K Nimeh */ 3437d82f0f8SDina K Nimeh static int 3447d82f0f8SDina K Nimeh lofi_map_file(int lfd, struct lofi_ioctl li, const char *filename) 3457d82f0f8SDina K Nimeh { 3467d82f0f8SDina K Nimeh int minor; 3477d82f0f8SDina K Nimeh 3487d82f0f8SDina K Nimeh li.li_minor = 0; 3497d82f0f8SDina K Nimeh (void) strlcpy(li.li_filename, filename, sizeof (li.li_filename)); 3507d82f0f8SDina K Nimeh minor = ioctl(lfd, LOFI_MAP_FILE, &li); 3517d82f0f8SDina K Nimeh if (minor == -1) { 3527d82f0f8SDina K Nimeh if (errno == ENOTSUP) 3537d82f0f8SDina K Nimeh warn(gettext("encrypting compressed files is " 3547d82f0f8SDina K Nimeh "unsupported")); 3557d82f0f8SDina K Nimeh die(gettext("could not map file %s"), filename); 3567d82f0f8SDina K Nimeh } 3577d82f0f8SDina K Nimeh wait_until_dev_complete(minor); 3587d82f0f8SDina K Nimeh return (minor); 3597d82f0f8SDina K Nimeh } 3607d82f0f8SDina K Nimeh 3617d82f0f8SDina K Nimeh /* 3627c478bd9Sstevel@tonic-gate * Add a device association. If devicename is NULL, let the driver 3637c478bd9Sstevel@tonic-gate * pick a device. 3647c478bd9Sstevel@tonic-gate */ 3657c478bd9Sstevel@tonic-gate static void 36687117650Saalok add_mapping(int lfd, const char *devicename, const char *filename, 3677d82f0f8SDina K Nimeh mech_alias_t *cipher, const char *rkey, size_t rksz) 3687c478bd9Sstevel@tonic-gate { 3697c478bd9Sstevel@tonic-gate struct lofi_ioctl li; 3707d82f0f8SDina K Nimeh 3717d82f0f8SDina K Nimeh li.li_crypto_enabled = B_FALSE; 3727d82f0f8SDina K Nimeh if (cipher != NULL) { 3737d82f0f8SDina K Nimeh /* set up encryption for mapped file */ 3747d82f0f8SDina K Nimeh li.li_crypto_enabled = B_TRUE; 3757d82f0f8SDina K Nimeh (void) strlcpy(li.li_cipher, cipher->name, 3767d82f0f8SDina K Nimeh sizeof (li.li_cipher)); 3777d82f0f8SDina K Nimeh if (rksz > sizeof (li.li_key)) { 3787d82f0f8SDina K Nimeh die(gettext("key too large")); 3797d82f0f8SDina K Nimeh } 3807d82f0f8SDina K Nimeh bcopy(rkey, li.li_key, rksz); 3817d82f0f8SDina K Nimeh li.li_key_len = rksz << 3; /* convert to bits */ 3827d82f0f8SDina K Nimeh 3837d82f0f8SDina K Nimeh li.li_iv_type = cipher->iv_type; 3847d82f0f8SDina K Nimeh li.li_iv_len = cipher->iv_len; /* 0 when no iv needed */ 3857d82f0f8SDina K Nimeh switch (cipher->iv_type) { 3867d82f0f8SDina K Nimeh case IVM_ENC_BLKNO: 3877d82f0f8SDina K Nimeh (void) strlcpy(li.li_iv_cipher, cipher->iv_name, 3887d82f0f8SDina K Nimeh sizeof (li.li_iv_cipher)); 3897d82f0f8SDina K Nimeh break; 3907d82f0f8SDina K Nimeh case IVM_NONE: 3917d82f0f8SDina K Nimeh /* FALLTHROUGH */ 3927d82f0f8SDina K Nimeh default: 3937d82f0f8SDina K Nimeh break; 3947d82f0f8SDina K Nimeh } 3957d82f0f8SDina K Nimeh } 3967c478bd9Sstevel@tonic-gate 3977c478bd9Sstevel@tonic-gate if (devicename == NULL) { 3987d82f0f8SDina K Nimeh int minor; 39987117650Saalok 4007d82f0f8SDina K Nimeh /* pick one via the driver */ 4017d82f0f8SDina K Nimeh minor = lofi_map_file(lfd, li, filename); 4027d82f0f8SDina K Nimeh /* if mapping succeeds, print the one picked */ 4037d82f0f8SDina K Nimeh (void) printf("/dev/%s/%d\n", LOFI_BLOCK_NAME, minor); 4047c478bd9Sstevel@tonic-gate return; 4057c478bd9Sstevel@tonic-gate } 4067d82f0f8SDina K Nimeh 4077c478bd9Sstevel@tonic-gate /* use device we were given */ 4087d82f0f8SDina K Nimeh li.li_minor = name_to_minor(devicename); 4097d82f0f8SDina K Nimeh if (li.li_minor == 0) { 4107c478bd9Sstevel@tonic-gate die(gettext("malformed device name %s\n"), devicename); 4117c478bd9Sstevel@tonic-gate } 41287117650Saalok (void) strlcpy(li.li_filename, filename, sizeof (li.li_filename)); 4137d82f0f8SDina K Nimeh 4147d82f0f8SDina K Nimeh /* if device is already in use li.li_minor won't change */ 4157c478bd9Sstevel@tonic-gate if (ioctl(lfd, LOFI_MAP_FILE_MINOR, &li) == -1) { 4167d82f0f8SDina K Nimeh if (errno == ENOTSUP) 4177d82f0f8SDina K Nimeh warn(gettext("encrypting compressed files is " 4187d82f0f8SDina K Nimeh "unsupported")); 4197c478bd9Sstevel@tonic-gate die(gettext("could not map file %s to %s"), filename, 4207c478bd9Sstevel@tonic-gate devicename); 4217c478bd9Sstevel@tonic-gate } 4227d82f0f8SDina K Nimeh wait_until_dev_complete(li.li_minor); 4237c478bd9Sstevel@tonic-gate } 4247c478bd9Sstevel@tonic-gate 4257c478bd9Sstevel@tonic-gate /* 4267c478bd9Sstevel@tonic-gate * Remove an association. Delete by device name if non-NULL, or by 4277c478bd9Sstevel@tonic-gate * filename otherwise. 4287c478bd9Sstevel@tonic-gate */ 4297c478bd9Sstevel@tonic-gate static void 4303d7072f8Seschrock delete_mapping(int lfd, const char *devicename, const char *filename, 4313d7072f8Seschrock boolean_t force) 4327c478bd9Sstevel@tonic-gate { 4337c478bd9Sstevel@tonic-gate struct lofi_ioctl li; 4347c478bd9Sstevel@tonic-gate 4353d7072f8Seschrock li.li_force = force; 43693239addSjohnlev li.li_cleanup = B_FALSE; 43793239addSjohnlev 4387c478bd9Sstevel@tonic-gate if (devicename == NULL) { 4397c478bd9Sstevel@tonic-gate /* delete by filename */ 44087117650Saalok (void) strlcpy(li.li_filename, filename, 44187117650Saalok sizeof (li.li_filename)); 4427c478bd9Sstevel@tonic-gate li.li_minor = 0; 4437c478bd9Sstevel@tonic-gate if (ioctl(lfd, LOFI_UNMAP_FILE, &li) == -1) { 4447c478bd9Sstevel@tonic-gate die(gettext("could not unmap file %s"), filename); 4457c478bd9Sstevel@tonic-gate } 4467c478bd9Sstevel@tonic-gate return; 4477c478bd9Sstevel@tonic-gate } 4487c478bd9Sstevel@tonic-gate 449f9153c6bSDina K Nimeh /* delete by device */ 4507c478bd9Sstevel@tonic-gate li.li_minor = name_to_minor(devicename); 4517c478bd9Sstevel@tonic-gate if (li.li_minor == 0) { 4527c478bd9Sstevel@tonic-gate die(gettext("malformed device name %s\n"), devicename); 4537c478bd9Sstevel@tonic-gate } 4547c478bd9Sstevel@tonic-gate if (ioctl(lfd, LOFI_UNMAP_FILE_MINOR, &li) == -1) { 4557c478bd9Sstevel@tonic-gate die(gettext("could not unmap device %s"), devicename); 4567c478bd9Sstevel@tonic-gate } 4577c478bd9Sstevel@tonic-gate } 4587c478bd9Sstevel@tonic-gate 4597d82f0f8SDina K Nimeh /* 4607d82f0f8SDina K Nimeh * Show filename given devicename, or devicename given filename. 4617d82f0f8SDina K Nimeh */ 4627c478bd9Sstevel@tonic-gate static void 4637c478bd9Sstevel@tonic-gate print_one_mapping(int lfd, const char *devicename, const char *filename) 4647c478bd9Sstevel@tonic-gate { 4657c478bd9Sstevel@tonic-gate struct lofi_ioctl li; 4667c478bd9Sstevel@tonic-gate 4677c478bd9Sstevel@tonic-gate if (devicename == NULL) { 4687c478bd9Sstevel@tonic-gate /* given filename, print devicename */ 4697c478bd9Sstevel@tonic-gate li.li_minor = 0; 47087117650Saalok (void) strlcpy(li.li_filename, filename, 47187117650Saalok sizeof (li.li_filename)); 4727c478bd9Sstevel@tonic-gate if (ioctl(lfd, LOFI_GET_MINOR, &li) == -1) { 4737c478bd9Sstevel@tonic-gate die(gettext("could not find device for %s"), filename); 4747c478bd9Sstevel@tonic-gate } 4757c478bd9Sstevel@tonic-gate (void) printf("/dev/%s/%d\n", LOFI_BLOCK_NAME, li.li_minor); 4767c478bd9Sstevel@tonic-gate return; 4777c478bd9Sstevel@tonic-gate } 4787c478bd9Sstevel@tonic-gate 4797c478bd9Sstevel@tonic-gate /* given devicename, print filename */ 4807c478bd9Sstevel@tonic-gate li.li_minor = name_to_minor(devicename); 4817c478bd9Sstevel@tonic-gate if (li.li_minor == 0) { 4827c478bd9Sstevel@tonic-gate die(gettext("malformed device name %s\n"), devicename); 4837c478bd9Sstevel@tonic-gate } 4847c478bd9Sstevel@tonic-gate if (ioctl(lfd, LOFI_GET_FILENAME, &li) == -1) { 4857c478bd9Sstevel@tonic-gate die(gettext("could not find filename for %s"), devicename); 4867c478bd9Sstevel@tonic-gate } 4877c478bd9Sstevel@tonic-gate (void) printf("%s\n", li.li_filename); 4887c478bd9Sstevel@tonic-gate } 4897c478bd9Sstevel@tonic-gate 49087117650Saalok /* 4917d82f0f8SDina K Nimeh * Print the list of all the mappings, including a header. 4927d82f0f8SDina K Nimeh */ 4937d82f0f8SDina K Nimeh static void 4947d82f0f8SDina K Nimeh print_mappings(int fd) 4957d82f0f8SDina K Nimeh { 4967d82f0f8SDina K Nimeh struct lofi_ioctl li; 4977d82f0f8SDina K Nimeh int minor; 4987d82f0f8SDina K Nimeh int maxminor; 4997d82f0f8SDina K Nimeh char path[MAXPATHLEN]; 5007d82f0f8SDina K Nimeh char options[MAXPATHLEN]; 5017d82f0f8SDina K Nimeh 5027d82f0f8SDina K Nimeh li.li_minor = 0; 5037d82f0f8SDina K Nimeh if (ioctl(fd, LOFI_GET_MAXMINOR, &li) == -1) { 5047d82f0f8SDina K Nimeh die("ioctl"); 5057d82f0f8SDina K Nimeh } 5067d82f0f8SDina K Nimeh maxminor = li.li_minor; 5077d82f0f8SDina K Nimeh 5087d82f0f8SDina K Nimeh (void) printf(FORMAT, gettext("Block Device"), gettext("File"), 5097d82f0f8SDina K Nimeh gettext("Options")); 5107d82f0f8SDina K Nimeh for (minor = 1; minor <= maxminor; minor++) { 5117d82f0f8SDina K Nimeh li.li_minor = minor; 5127d82f0f8SDina K Nimeh if (ioctl(fd, LOFI_GET_FILENAME, &li) == -1) { 5137d82f0f8SDina K Nimeh if (errno == ENXIO) 5147d82f0f8SDina K Nimeh continue; 5157d82f0f8SDina K Nimeh warn("ioctl"); 5167d82f0f8SDina K Nimeh break; 5177d82f0f8SDina K Nimeh } 5187d82f0f8SDina K Nimeh (void) snprintf(path, sizeof (path), "/dev/%s/%d", 5197d82f0f8SDina K Nimeh LOFI_BLOCK_NAME, minor); 5207d82f0f8SDina K Nimeh /* 5217d82f0f8SDina K Nimeh * Encrypted lofi and compressed lofi are mutually exclusive. 5227d82f0f8SDina K Nimeh */ 5237d82f0f8SDina K Nimeh if (li.li_crypto_enabled) 5247d82f0f8SDina K Nimeh (void) snprintf(options, sizeof (options), 5257d82f0f8SDina K Nimeh gettext("Encrypted")); 5267d82f0f8SDina K Nimeh else if (li.li_algorithm[0] != '\0') 5277d82f0f8SDina K Nimeh (void) snprintf(options, sizeof (options), 5287d82f0f8SDina K Nimeh gettext("Compressed(%s)"), li.li_algorithm); 5297d82f0f8SDina K Nimeh else 5307d82f0f8SDina K Nimeh (void) snprintf(options, sizeof (options), "-"); 5317d82f0f8SDina K Nimeh 5327d82f0f8SDina K Nimeh (void) printf(FORMAT, path, li.li_filename, options); 5337d82f0f8SDina K Nimeh } 5347d82f0f8SDina K Nimeh } 5357d82f0f8SDina K Nimeh 5367d82f0f8SDina K Nimeh /* 5377d82f0f8SDina K Nimeh * Verify the cipher selected by user. 5387d82f0f8SDina K Nimeh */ 5397d82f0f8SDina K Nimeh static mech_alias_t * 5407d82f0f8SDina K Nimeh ciph2mech(const char *alias) 5417d82f0f8SDina K Nimeh { 5427d82f0f8SDina K Nimeh int i; 5437d82f0f8SDina K Nimeh 5447d82f0f8SDina K Nimeh for (i = 0; i < mech_aliases_count; i++) { 5457d82f0f8SDina K Nimeh if (strcasecmp(alias, mech_aliases[i].alias) == 0) 5467d82f0f8SDina K Nimeh return (&mech_aliases[i]); 5477d82f0f8SDina K Nimeh } 5487d82f0f8SDina K Nimeh return (NULL); 5497d82f0f8SDina K Nimeh } 5507d82f0f8SDina K Nimeh 5517d82f0f8SDina K Nimeh /* 5527d82f0f8SDina K Nimeh * Verify user selected cipher is also available in kernel. 5537d82f0f8SDina K Nimeh * 5547d82f0f8SDina K Nimeh * While traversing kernel list of mechs, if the cipher is supported in the 5557d82f0f8SDina K Nimeh * kernel for both encryption and decryption, it also picks up the min/max 5567d82f0f8SDina K Nimeh * key size. 5577d82f0f8SDina K Nimeh */ 5587d82f0f8SDina K Nimeh static boolean_t 5597d82f0f8SDina K Nimeh kernel_cipher_check(mech_alias_t *cipher) 5607d82f0f8SDina K Nimeh { 5617d82f0f8SDina K Nimeh boolean_t ciph_ok = B_FALSE; 5627d82f0f8SDina K Nimeh boolean_t iv_ok = B_FALSE; 5637d82f0f8SDina K Nimeh int i; 5647d82f0f8SDina K Nimeh int count; 5657d82f0f8SDina K Nimeh crypto_get_mechanism_list_t *kciphers = NULL; 5667d82f0f8SDina K Nimeh crypto_get_all_mechanism_info_t *kinfo = NULL; 5677d82f0f8SDina K Nimeh int fd = -1; 5687d82f0f8SDina K Nimeh size_t keymin; 5697d82f0f8SDina K Nimeh size_t keymax; 5707d82f0f8SDina K Nimeh 5717d82f0f8SDina K Nimeh /* if cipher doesn't need iv generating mech, bypass that check now */ 5727d82f0f8SDina K Nimeh if (cipher->iv_name == NULL) 5737d82f0f8SDina K Nimeh iv_ok = B_TRUE; 5747d82f0f8SDina K Nimeh 5757d82f0f8SDina K Nimeh /* allocate some space for the list of kernel ciphers */ 5767d82f0f8SDina K Nimeh count = DEFAULT_CIPHER_NUM; 5777d82f0f8SDina K Nimeh kciphers = malloc(sizeof (crypto_get_mechanism_list_t) + 5787d82f0f8SDina K Nimeh sizeof (crypto_mech_name_t) * (count - 1)); 5797d82f0f8SDina K Nimeh if (kciphers == NULL) 5807d82f0f8SDina K Nimeh die(gettext("failed to allocate memory for list of " 5817d82f0f8SDina K Nimeh "kernel mechanisms")); 5827d82f0f8SDina K Nimeh kciphers->ml_count = count; 5837d82f0f8SDina K Nimeh 5847d82f0f8SDina K Nimeh /* query crypto device to get list of kernel ciphers */ 5857d82f0f8SDina K Nimeh if ((fd = open("/dev/crypto", O_RDWR)) == -1) { 5867d82f0f8SDina K Nimeh warn(gettext("failed to open %s"), "/dev/crypto"); 5877d82f0f8SDina K Nimeh goto kcc_out; 5887d82f0f8SDina K Nimeh } 5897d82f0f8SDina K Nimeh 5907d82f0f8SDina K Nimeh if (ioctl(fd, CRYPTO_GET_MECHANISM_LIST, kciphers) == -1) { 5917d82f0f8SDina K Nimeh warn(gettext("CRYPTO_GET_MECHANISM_LIST ioctl failed")); 5927d82f0f8SDina K Nimeh goto kcc_out; 5937d82f0f8SDina K Nimeh } 5947d82f0f8SDina K Nimeh 5957d82f0f8SDina K Nimeh if (kciphers->ml_return_value == CRYPTO_BUFFER_TOO_SMALL) { 5967d82f0f8SDina K Nimeh count = kciphers->ml_count; 5977d82f0f8SDina K Nimeh free(kciphers); 5987d82f0f8SDina K Nimeh kciphers = malloc(sizeof (crypto_get_mechanism_list_t) + 5997d82f0f8SDina K Nimeh sizeof (crypto_mech_name_t) * (count - 1)); 6007d82f0f8SDina K Nimeh if (kciphers == NULL) { 6017d82f0f8SDina K Nimeh warn(gettext("failed to allocate memory for list of " 6027d82f0f8SDina K Nimeh "kernel mechanisms")); 6037d82f0f8SDina K Nimeh goto kcc_out; 6047d82f0f8SDina K Nimeh } 6057d82f0f8SDina K Nimeh kciphers->ml_count = count; 6067d82f0f8SDina K Nimeh 6077d82f0f8SDina K Nimeh if (ioctl(fd, CRYPTO_GET_MECHANISM_LIST, kciphers) == -1) { 6087d82f0f8SDina K Nimeh warn(gettext("CRYPTO_GET_MECHANISM_LIST ioctl failed")); 6097d82f0f8SDina K Nimeh goto kcc_out; 6107d82f0f8SDina K Nimeh } 6117d82f0f8SDina K Nimeh } 6127d82f0f8SDina K Nimeh 6137d82f0f8SDina K Nimeh if (kciphers->ml_return_value != CRYPTO_SUCCESS) { 6147d82f0f8SDina K Nimeh warn(gettext( 6157d82f0f8SDina K Nimeh "CRYPTO_GET_MECHANISM_LIST ioctl return value = %d\n"), 6167d82f0f8SDina K Nimeh kciphers->ml_return_value); 6177d82f0f8SDina K Nimeh goto kcc_out; 6187d82f0f8SDina K Nimeh } 6197d82f0f8SDina K Nimeh 6207d82f0f8SDina K Nimeh /* 6217d82f0f8SDina K Nimeh * scan list of kernel ciphers looking for the selected one and if 6227d82f0f8SDina K Nimeh * it needs an iv generated using another cipher, also look for that 6237d82f0f8SDina K Nimeh * additional cipher to be used for generating the iv 6247d82f0f8SDina K Nimeh */ 6257d82f0f8SDina K Nimeh count = kciphers->ml_count; 6267d82f0f8SDina K Nimeh for (i = 0; i < count && !(ciph_ok && iv_ok); i++) { 6277d82f0f8SDina K Nimeh if (!ciph_ok && 6287d82f0f8SDina K Nimeh strcasecmp(cipher->name, kciphers->ml_list[i]) == 0) 6297d82f0f8SDina K Nimeh ciph_ok = B_TRUE; 6307d82f0f8SDina K Nimeh if (!iv_ok && 6317d82f0f8SDina K Nimeh strcasecmp(cipher->iv_name, kciphers->ml_list[i]) == 0) 6327d82f0f8SDina K Nimeh iv_ok = B_TRUE; 6337d82f0f8SDina K Nimeh } 6347d82f0f8SDina K Nimeh free(kciphers); 6357d82f0f8SDina K Nimeh kciphers = NULL; 6367d82f0f8SDina K Nimeh 6377d82f0f8SDina K Nimeh if (!ciph_ok) 6387d82f0f8SDina K Nimeh warn(gettext("%s mechanism not supported in kernel\n"), 6397d82f0f8SDina K Nimeh cipher->name); 6407d82f0f8SDina K Nimeh if (!iv_ok) 6417d82f0f8SDina K Nimeh warn(gettext("%s mechanism not supported in kernel\n"), 6427d82f0f8SDina K Nimeh cipher->iv_name); 6437d82f0f8SDina K Nimeh 6447d82f0f8SDina K Nimeh if (ciph_ok) { 6457d82f0f8SDina K Nimeh /* Get the details about the user selected cipher */ 6467d82f0f8SDina K Nimeh count = DEFAULT_MECHINFO_NUM; 6477d82f0f8SDina K Nimeh kinfo = malloc(sizeof (crypto_get_all_mechanism_info_t) + 6487d82f0f8SDina K Nimeh sizeof (crypto_mechanism_info_t) * (count - 1)); 6497d82f0f8SDina K Nimeh if (kinfo == NULL) { 6507d82f0f8SDina K Nimeh warn(gettext("failed to allocate memory for " 6517d82f0f8SDina K Nimeh "kernel mechanism info")); 6527d82f0f8SDina K Nimeh goto kcc_out; 6537d82f0f8SDina K Nimeh } 6547d82f0f8SDina K Nimeh kinfo->mi_count = count; 6557d82f0f8SDina K Nimeh (void) strlcpy(kinfo->mi_mechanism_name, cipher->name, 6567d82f0f8SDina K Nimeh CRYPTO_MAX_MECH_NAME); 6577d82f0f8SDina K Nimeh 6587d82f0f8SDina K Nimeh if (ioctl(fd, CRYPTO_GET_ALL_MECHANISM_INFO, kinfo) == -1) { 6597d82f0f8SDina K Nimeh warn(gettext( 6607d82f0f8SDina K Nimeh "CRYPTO_GET_ALL_MECHANISM_INFO ioctl failed")); 6617d82f0f8SDina K Nimeh goto kcc_out; 6627d82f0f8SDina K Nimeh } 6637d82f0f8SDina K Nimeh 6647d82f0f8SDina K Nimeh if (kinfo->mi_return_value == CRYPTO_BUFFER_TOO_SMALL) { 6657d82f0f8SDina K Nimeh count = kinfo->mi_count; 6667d82f0f8SDina K Nimeh free(kinfo); 6677d82f0f8SDina K Nimeh kinfo = malloc( 6687d82f0f8SDina K Nimeh sizeof (crypto_get_all_mechanism_info_t) + 6697d82f0f8SDina K Nimeh sizeof (crypto_mechanism_info_t) * (count - 1)); 6707d82f0f8SDina K Nimeh if (kinfo == NULL) { 6717d82f0f8SDina K Nimeh warn(gettext("failed to allocate memory for " 6727d82f0f8SDina K Nimeh "kernel mechanism info")); 6737d82f0f8SDina K Nimeh goto kcc_out; 6747d82f0f8SDina K Nimeh } 6757d82f0f8SDina K Nimeh kinfo->mi_count = count; 6767d82f0f8SDina K Nimeh (void) strlcpy(kinfo->mi_mechanism_name, cipher->name, 6777d82f0f8SDina K Nimeh CRYPTO_MAX_MECH_NAME); 6787d82f0f8SDina K Nimeh 6797d82f0f8SDina K Nimeh if (ioctl(fd, CRYPTO_GET_ALL_MECHANISM_INFO, kinfo) == 6807d82f0f8SDina K Nimeh -1) { 6817d82f0f8SDina K Nimeh warn(gettext("CRYPTO_GET_ALL_MECHANISM_INFO " 6827d82f0f8SDina K Nimeh "ioctl failed")); 6837d82f0f8SDina K Nimeh goto kcc_out; 6847d82f0f8SDina K Nimeh } 6857d82f0f8SDina K Nimeh } 6867d82f0f8SDina K Nimeh 6877d82f0f8SDina K Nimeh if (kinfo->mi_return_value != CRYPTO_SUCCESS) { 6887d82f0f8SDina K Nimeh warn(gettext("CRYPTO_GET_ALL_MECHANISM_INFO ioctl " 6897d82f0f8SDina K Nimeh "return value = %d\n"), kinfo->mi_return_value); 6907d82f0f8SDina K Nimeh goto kcc_out; 6917d82f0f8SDina K Nimeh } 6927d82f0f8SDina K Nimeh 6937d82f0f8SDina K Nimeh /* Set key min and max size */ 6947d82f0f8SDina K Nimeh count = kinfo->mi_count; 6957d82f0f8SDina K Nimeh i = 0; 6967d82f0f8SDina K Nimeh if (i < count) { 6977d82f0f8SDina K Nimeh keymin = kinfo->mi_list[i].mi_min_key_size; 6987d82f0f8SDina K Nimeh keymax = kinfo->mi_list[i].mi_max_key_size; 6997d82f0f8SDina K Nimeh if (kinfo->mi_list[i].mi_keysize_unit & 7007d82f0f8SDina K Nimeh CRYPTO_KEYSIZE_UNIT_IN_BITS) { 7017d82f0f8SDina K Nimeh keymin = CRYPTO_BITS2BYTES(keymin); 7027d82f0f8SDina K Nimeh keymax = CRYPTO_BITS2BYTES(keymax); 7037d82f0f8SDina K Nimeh 7047d82f0f8SDina K Nimeh } 7057d82f0f8SDina K Nimeh cipher->min_keysize = keymin; 7067d82f0f8SDina K Nimeh cipher->max_keysize = keymax; 7077d82f0f8SDina K Nimeh } 7087d82f0f8SDina K Nimeh free(kinfo); 7097d82f0f8SDina K Nimeh kinfo = NULL; 7107d82f0f8SDina K Nimeh 7117d82f0f8SDina K Nimeh if (i == count) { 7127d82f0f8SDina K Nimeh (void) close(fd); 7137d82f0f8SDina K Nimeh die(gettext( 7147d82f0f8SDina K Nimeh "failed to find usable %s kernel mechanism, " 7157d82f0f8SDina K Nimeh "use \"cryptoadm list -m\" to find available " 7167d82f0f8SDina K Nimeh "mechanisms\n"), 7177d82f0f8SDina K Nimeh cipher->name); 7187d82f0f8SDina K Nimeh } 7197d82f0f8SDina K Nimeh } 7207d82f0f8SDina K Nimeh 7217d82f0f8SDina K Nimeh /* Note: key min/max, unit size, usage for iv cipher are not checked. */ 7227d82f0f8SDina K Nimeh 7237d82f0f8SDina K Nimeh return (ciph_ok && iv_ok); 7247d82f0f8SDina K Nimeh 7257d82f0f8SDina K Nimeh kcc_out: 7267d82f0f8SDina K Nimeh if (kinfo != NULL) 7277d82f0f8SDina K Nimeh free(kinfo); 7287d82f0f8SDina K Nimeh if (kciphers != NULL) 7297d82f0f8SDina K Nimeh free(kciphers); 7307d82f0f8SDina K Nimeh if (fd != -1) 7317d82f0f8SDina K Nimeh (void) close(fd); 7327d82f0f8SDina K Nimeh return (B_FALSE); 7337d82f0f8SDina K Nimeh } 7347d82f0f8SDina K Nimeh 7357d82f0f8SDina K Nimeh /* 7367d82f0f8SDina K Nimeh * Break up token spec into its components (non-destructive) 7377d82f0f8SDina K Nimeh */ 7387d82f0f8SDina K Nimeh static token_spec_t * 7397d82f0f8SDina K Nimeh parsetoken(char *spec) 7407d82f0f8SDina K Nimeh { 7417d82f0f8SDina K Nimeh #define FLD_NAME 0 7427d82f0f8SDina K Nimeh #define FLD_MANUF 1 7437d82f0f8SDina K Nimeh #define FLD_SERIAL 2 7447d82f0f8SDina K Nimeh #define FLD_LABEL 3 7457d82f0f8SDina K Nimeh #define NFIELDS 4 7467d82f0f8SDina K Nimeh #define nullfield(i) ((field[(i)+1] - field[(i)]) <= 1) 7477d82f0f8SDina K Nimeh #define copyfield(fld, i) \ 7487d82f0f8SDina K Nimeh { \ 7497d82f0f8SDina K Nimeh int n; \ 7507d82f0f8SDina K Nimeh (fld) = NULL; \ 7517d82f0f8SDina K Nimeh if ((n = (field[(i)+1] - field[(i)])) > 1) { \ 7527d82f0f8SDina K Nimeh if (((fld) = malloc(n)) != NULL) { \ 7537d82f0f8SDina K Nimeh (void) strncpy((fld), field[(i)], n); \ 7547d82f0f8SDina K Nimeh ((fld))[n - 1] = '\0'; \ 7557d82f0f8SDina K Nimeh } \ 7567d82f0f8SDina K Nimeh } \ 7577d82f0f8SDina K Nimeh } 7587d82f0f8SDina K Nimeh 7597d82f0f8SDina K Nimeh int i; 7607d82f0f8SDina K Nimeh char *field[NFIELDS + 1]; /* +1 to catch extra delimiters */ 7617d82f0f8SDina K Nimeh token_spec_t *ti = NULL; 7627d82f0f8SDina K Nimeh 7637d82f0f8SDina K Nimeh if (spec == NULL) 7647d82f0f8SDina K Nimeh return (NULL); 7657d82f0f8SDina K Nimeh 7667d82f0f8SDina K Nimeh /* 7677d82f0f8SDina K Nimeh * Correct format is "[name]:[manuf]:[serial]:key". Can't use 7687d82f0f8SDina K Nimeh * strtok because it treats ":::key" and "key:::" and "key" all 7697d82f0f8SDina K Nimeh * as the same thing, and we can't have the :s compressed away. 7707d82f0f8SDina K Nimeh */ 7717d82f0f8SDina K Nimeh field[0] = spec; 7727d82f0f8SDina K Nimeh for (i = 1; i < NFIELDS + 1; i++) { 7737d82f0f8SDina K Nimeh field[i] = strchr(field[i-1], ':'); 7747d82f0f8SDina K Nimeh if (field[i] == NULL) 7757d82f0f8SDina K Nimeh break; 7767d82f0f8SDina K Nimeh field[i]++; 7777d82f0f8SDina K Nimeh } 7787d82f0f8SDina K Nimeh if (i < NFIELDS) /* not enough fields */ 7797d82f0f8SDina K Nimeh return (NULL); 7807d82f0f8SDina K Nimeh if (field[NFIELDS] != NULL) /* too many fields */ 7817d82f0f8SDina K Nimeh return (NULL); 7827d82f0f8SDina K Nimeh field[NFIELDS] = strchr(field[NFIELDS-1], '\0') + 1; 7837d82f0f8SDina K Nimeh 7847d82f0f8SDina K Nimeh /* key label can't be empty */ 7857d82f0f8SDina K Nimeh if (nullfield(FLD_LABEL)) 7867d82f0f8SDina K Nimeh return (NULL); 7877d82f0f8SDina K Nimeh 7887d82f0f8SDina K Nimeh ti = malloc(sizeof (token_spec_t)); 7897d82f0f8SDina K Nimeh if (ti == NULL) 7907d82f0f8SDina K Nimeh return (NULL); 7917d82f0f8SDina K Nimeh 7927d82f0f8SDina K Nimeh copyfield(ti->name, FLD_NAME); 7937d82f0f8SDina K Nimeh copyfield(ti->mfr, FLD_MANUF); 7947d82f0f8SDina K Nimeh copyfield(ti->serno, FLD_SERIAL); 7957d82f0f8SDina K Nimeh copyfield(ti->key, FLD_LABEL); 7967d82f0f8SDina K Nimeh 7977d82f0f8SDina K Nimeh /* 7987d82f0f8SDina K Nimeh * If token specified and it only contains a key label, then 7997d82f0f8SDina K Nimeh * search all tokens for the key, otherwise only those with 8007d82f0f8SDina K Nimeh * matching name, mfr, and serno are used. 8017d82f0f8SDina K Nimeh */ 8027d82f0f8SDina K Nimeh /* 8037d82f0f8SDina K Nimeh * That's how we'd like it to be, however, if only the key label 8047d82f0f8SDina K Nimeh * is specified, default to using softtoken. It's easier. 8057d82f0f8SDina K Nimeh */ 8067d82f0f8SDina K Nimeh if (ti->name == NULL && ti->mfr == NULL && ti->serno == NULL) 8077d82f0f8SDina K Nimeh ti->name = strdup(pkcs11_default_token()); 8087d82f0f8SDina K Nimeh return (ti); 8097d82f0f8SDina K Nimeh } 8107d82f0f8SDina K Nimeh 8117d82f0f8SDina K Nimeh /* 8127d82f0f8SDina K Nimeh * PBE the passphrase into a raw key 8137d82f0f8SDina K Nimeh */ 8147d82f0f8SDina K Nimeh static void 8157d82f0f8SDina K Nimeh getkeyfromuser(mech_alias_t *cipher, char **raw_key, size_t *raw_key_sz) 8167d82f0f8SDina K Nimeh { 8177d82f0f8SDina K Nimeh CK_SESSION_HANDLE sess; 8187d82f0f8SDina K Nimeh CK_RV rv; 8197d82f0f8SDina K Nimeh char *pass = NULL; 8207d82f0f8SDina K Nimeh size_t passlen = 0; 8217d82f0f8SDina K Nimeh void *salt = NULL; /* don't use NULL, see note on salt below */ 8227d82f0f8SDina K Nimeh size_t saltlen = 0; 8237d82f0f8SDina K Nimeh CK_KEY_TYPE ktype; 8247d82f0f8SDina K Nimeh void *kvalue; 8257d82f0f8SDina K Nimeh size_t klen; 8267d82f0f8SDina K Nimeh 8277d82f0f8SDina K Nimeh /* did init_crypto find a slot that supports this cipher? */ 8287d82f0f8SDina K Nimeh if (cipher->slot == (CK_SLOT_ID)-1 || cipher->max_keysize == 0) { 8297d82f0f8SDina K Nimeh rv = CKR_MECHANISM_INVALID; 8307d82f0f8SDina K Nimeh goto cleanup; 8317d82f0f8SDina K Nimeh } 8327d82f0f8SDina K Nimeh 8337d82f0f8SDina K Nimeh rv = pkcs11_mech2keytype(cipher->type, &ktype); 8347d82f0f8SDina K Nimeh if (rv != CKR_OK) 8357d82f0f8SDina K Nimeh goto cleanup; 8367d82f0f8SDina K Nimeh 8377d82f0f8SDina K Nimeh /* 8387d82f0f8SDina K Nimeh * use the passphrase to generate a PBE PKCS#5 secret key and 8397d82f0f8SDina K Nimeh * retrieve the raw key data to eventually pass it to the kernel; 8407d82f0f8SDina K Nimeh */ 8417d82f0f8SDina K Nimeh rv = C_OpenSession(cipher->slot, CKF_SERIAL_SESSION, NULL, NULL, &sess); 8427d82f0f8SDina K Nimeh if (rv != CKR_OK) 8437d82f0f8SDina K Nimeh goto cleanup; 8447d82f0f8SDina K Nimeh 8457d82f0f8SDina K Nimeh /* get user passphrase with 8 byte minimum */ 8467d82f0f8SDina K Nimeh if (pkcs11_get_pass(NULL, &pass, &passlen, MIN_PASSLEN, B_TRUE) < 0) { 8477d82f0f8SDina K Nimeh die(gettext("passphrases do not match\n")); 8487d82f0f8SDina K Nimeh } 8497d82f0f8SDina K Nimeh 8507d82f0f8SDina K Nimeh /* 8517d82f0f8SDina K Nimeh * salt should not be NULL, or else pkcs11_PasswdToKey() will 8527d82f0f8SDina K Nimeh * complain about CKR_MECHANISM_PARAM_INVALID; the following is 8537d82f0f8SDina K Nimeh * to make up for not having a salt until a proper one is used 8547d82f0f8SDina K Nimeh */ 8557d82f0f8SDina K Nimeh salt = pass; 8567d82f0f8SDina K Nimeh saltlen = passlen; 8577d82f0f8SDina K Nimeh 8587d82f0f8SDina K Nimeh klen = cipher->max_keysize; 8597d82f0f8SDina K Nimeh rv = pkcs11_PasswdToKey(sess, pass, passlen, salt, saltlen, ktype, 8607d82f0f8SDina K Nimeh cipher->max_keysize, &kvalue, &klen); 8617d82f0f8SDina K Nimeh 8627d82f0f8SDina K Nimeh (void) C_CloseSession(sess); 8637d82f0f8SDina K Nimeh 8647d82f0f8SDina K Nimeh if (rv != CKR_OK) { 8657d82f0f8SDina K Nimeh goto cleanup; 8667d82f0f8SDina K Nimeh } 8677d82f0f8SDina K Nimeh 8687d82f0f8SDina K Nimeh /* assert(klen == cipher->max_keysize); */ 8697d82f0f8SDina K Nimeh *raw_key_sz = klen; 8707d82f0f8SDina K Nimeh *raw_key = (char *)kvalue; 8717d82f0f8SDina K Nimeh return; 8727d82f0f8SDina K Nimeh 8737d82f0f8SDina K Nimeh cleanup: 8747d82f0f8SDina K Nimeh die(gettext("failed to generate %s key from passphrase: %s"), 8757d82f0f8SDina K Nimeh cipher->alias, pkcs11_strerror(rv)); 8767d82f0f8SDina K Nimeh } 8777d82f0f8SDina K Nimeh 8787d82f0f8SDina K Nimeh /* 8797d82f0f8SDina K Nimeh * Read raw key from file; also handles ephemeral keys. 8807d82f0f8SDina K Nimeh */ 8817d82f0f8SDina K Nimeh void 8827d82f0f8SDina K Nimeh getkeyfromfile(const char *pathname, mech_alias_t *cipher, char **key, 8837d82f0f8SDina K Nimeh size_t *ksz) 8847d82f0f8SDina K Nimeh { 8857d82f0f8SDina K Nimeh int fd; 8867d82f0f8SDina K Nimeh struct stat sbuf; 8877d82f0f8SDina K Nimeh boolean_t notplain = B_FALSE; 8887d82f0f8SDina K Nimeh ssize_t cursz; 8897d82f0f8SDina K Nimeh ssize_t nread; 8907d82f0f8SDina K Nimeh 8917d82f0f8SDina K Nimeh /* ephemeral keys are just random data */ 8927d82f0f8SDina K Nimeh if (pathname == NULL) { 8937d82f0f8SDina K Nimeh *ksz = cipher->max_keysize; 8947d82f0f8SDina K Nimeh *key = malloc(*ksz); 8957d82f0f8SDina K Nimeh if (*key == NULL) 8967d82f0f8SDina K Nimeh die(gettext("failed to allocate memory for" 8977d82f0f8SDina K Nimeh " ephemeral key")); 8987b79d846SDina K Nimeh if (pkcs11_get_urandom(*key, *ksz) < 0) { 8997d82f0f8SDina K Nimeh free(*key); 9007d82f0f8SDina K Nimeh die(gettext("failed to get enough random data")); 9017d82f0f8SDina K Nimeh } 9027d82f0f8SDina K Nimeh return; 9037d82f0f8SDina K Nimeh } 9047d82f0f8SDina K Nimeh 9057d82f0f8SDina K Nimeh /* 9067d82f0f8SDina K Nimeh * If the remaining section of code didn't also check for secure keyfile 9077d82f0f8SDina K Nimeh * permissions and whether the key is within cipher min and max lengths, 9087d82f0f8SDina K Nimeh * (or, if those things moved out of this block), we could have had: 9097d82f0f8SDina K Nimeh * if (pkcs11_read_data(pathname, key, ksz) < 0) 9107d82f0f8SDina K Nimeh * handle_error(); 9117d82f0f8SDina K Nimeh */ 9127d82f0f8SDina K Nimeh 9137d82f0f8SDina K Nimeh if ((fd = open(pathname, O_RDONLY, 0)) == -1) 9147d82f0f8SDina K Nimeh die(gettext("open of keyfile (%s) failed"), pathname); 9157d82f0f8SDina K Nimeh 9167d82f0f8SDina K Nimeh if (fstat(fd, &sbuf) == -1) 9177d82f0f8SDina K Nimeh die(gettext("fstat of keyfile (%s) failed"), pathname); 9187d82f0f8SDina K Nimeh 9197d82f0f8SDina K Nimeh if (S_ISREG(sbuf.st_mode)) { 9207d82f0f8SDina K Nimeh if ((sbuf.st_mode & (S_IWGRP | S_IWOTH)) != 0) 9217d82f0f8SDina K Nimeh die(gettext("insecure permissions on keyfile %s\n"), 9227d82f0f8SDina K Nimeh pathname); 9237d82f0f8SDina K Nimeh 9247d82f0f8SDina K Nimeh *ksz = sbuf.st_size; 9257d82f0f8SDina K Nimeh if (*ksz < cipher->min_keysize || cipher->max_keysize < *ksz) { 9267d82f0f8SDina K Nimeh warn(gettext("%s: invalid keysize: %d\n"), 9277d82f0f8SDina K Nimeh pathname, (int)*ksz); 9287d82f0f8SDina K Nimeh die(gettext("\t%d <= keysize <= %d\n"), 9297d82f0f8SDina K Nimeh cipher->min_keysize, cipher->max_keysize); 9307d82f0f8SDina K Nimeh } 9317d82f0f8SDina K Nimeh } else { 9327d82f0f8SDina K Nimeh *ksz = cipher->max_keysize; 9337d82f0f8SDina K Nimeh notplain = B_TRUE; 9347d82f0f8SDina K Nimeh } 9357d82f0f8SDina K Nimeh 9367d82f0f8SDina K Nimeh *key = malloc(*ksz); 9377d82f0f8SDina K Nimeh if (*key == NULL) 9387d82f0f8SDina K Nimeh die(gettext("failed to allocate memory for key from file")); 9397d82f0f8SDina K Nimeh 9407d82f0f8SDina K Nimeh for (cursz = 0, nread = 0; cursz < *ksz; cursz += nread) { 9417d82f0f8SDina K Nimeh nread = read(fd, *key, *ksz); 9427d82f0f8SDina K Nimeh if (nread > 0) 9437d82f0f8SDina K Nimeh continue; 9447d82f0f8SDina K Nimeh /* 9457d82f0f8SDina K Nimeh * nread == 0. If it's not a regular file we were trying to 9467d82f0f8SDina K Nimeh * get the maximum keysize of data possible for this cipher. 9477d82f0f8SDina K Nimeh * But if we've got at least the minimum keysize of data, 9487d82f0f8SDina K Nimeh * round down to the nearest keysize unit and call it good. 9497d82f0f8SDina K Nimeh * If we haven't met the minimum keysize, that's an error. 9507d82f0f8SDina K Nimeh * If it's a regular file, nread = 0 is also an error. 9517d82f0f8SDina K Nimeh */ 9527d82f0f8SDina K Nimeh if (nread == 0 && notplain && cursz >= cipher->min_keysize) { 9537d82f0f8SDina K Nimeh *ksz = (cursz / cipher->min_keysize) * 9547d82f0f8SDina K Nimeh cipher->min_keysize; 9557d82f0f8SDina K Nimeh break; 9567d82f0f8SDina K Nimeh } 9577d82f0f8SDina K Nimeh die(gettext("%s: can't read all keybytes"), pathname); 9587d82f0f8SDina K Nimeh } 9597d82f0f8SDina K Nimeh (void) close(fd); 9607d82f0f8SDina K Nimeh } 9617d82f0f8SDina K Nimeh 9627d82f0f8SDina K Nimeh /* 9637d82f0f8SDina K Nimeh * Read the raw key from token, or from a file that was wrapped with a 9647d82f0f8SDina K Nimeh * key from token 9657d82f0f8SDina K Nimeh */ 9667d82f0f8SDina K Nimeh void 9677d82f0f8SDina K Nimeh getkeyfromtoken(CK_SESSION_HANDLE sess, 9687d82f0f8SDina K Nimeh token_spec_t *token, const char *keyfile, mech_alias_t *cipher, 9697d82f0f8SDina K Nimeh char **raw_key, size_t *raw_key_sz) 9707d82f0f8SDina K Nimeh { 9717d82f0f8SDina K Nimeh CK_RV rv = CKR_OK; 9727d82f0f8SDina K Nimeh CK_BBOOL trueval = B_TRUE; 9737d82f0f8SDina K Nimeh CK_OBJECT_CLASS kclass; /* secret key or RSA private key */ 9747d82f0f8SDina K Nimeh CK_KEY_TYPE ktype; /* from selected cipher or CKK_RSA */ 9757d82f0f8SDina K Nimeh CK_KEY_TYPE raw_ktype; /* from selected cipher */ 9767d82f0f8SDina K Nimeh CK_ATTRIBUTE key_tmpl[] = { 9777d82f0f8SDina K Nimeh { CKA_CLASS, NULL, 0 }, /* re-used for token key and unwrap */ 9787d82f0f8SDina K Nimeh { CKA_KEY_TYPE, NULL, 0 }, /* ditto */ 9797d82f0f8SDina K Nimeh { CKA_LABEL, NULL, 0 }, 9807d82f0f8SDina K Nimeh { CKA_TOKEN, NULL, 0 }, 9817d82f0f8SDina K Nimeh { CKA_PRIVATE, NULL, 0 } 9827d82f0f8SDina K Nimeh }; 9837d82f0f8SDina K Nimeh CK_ULONG attrs = sizeof (key_tmpl) / sizeof (CK_ATTRIBUTE); 9847d82f0f8SDina K Nimeh int i; 9857d82f0f8SDina K Nimeh char *pass = NULL; 9867d82f0f8SDina K Nimeh size_t passlen = 0; 9877d82f0f8SDina K Nimeh CK_OBJECT_HANDLE obj, rawobj; 9887d82f0f8SDina K Nimeh CK_ULONG num_objs = 1; /* just want to find 1 token key */ 9897d82f0f8SDina K Nimeh CK_MECHANISM unwrap = { CKM_RSA_PKCS, NULL, 0 }; 9907d82f0f8SDina K Nimeh char *rkey; 9917d82f0f8SDina K Nimeh size_t rksz; 9927d82f0f8SDina K Nimeh 9937d82f0f8SDina K Nimeh if (token == NULL || token->key == NULL) 9947d82f0f8SDina K Nimeh return; 9957d82f0f8SDina K Nimeh 9967d82f0f8SDina K Nimeh /* did init_crypto find a slot that supports this cipher? */ 9977d82f0f8SDina K Nimeh if (cipher->slot == (CK_SLOT_ID)-1 || cipher->max_keysize == 0) { 9987d82f0f8SDina K Nimeh die(gettext("failed to find any cryptographic provider, " 9997d82f0f8SDina K Nimeh "use \"cryptoadm list -p\" to find providers: %s\n"), 10007d82f0f8SDina K Nimeh pkcs11_strerror(CKR_MECHANISM_INVALID)); 10017d82f0f8SDina K Nimeh } 10027d82f0f8SDina K Nimeh 10037d82f0f8SDina K Nimeh if (pkcs11_get_pass(token->name, &pass, &passlen, 0, B_FALSE) < 0) 10047d82f0f8SDina K Nimeh die(gettext("unable to get passphrase")); 10057d82f0f8SDina K Nimeh 10067d82f0f8SDina K Nimeh /* use passphrase to login to token */ 10077d82f0f8SDina K Nimeh if (pass != NULL && passlen > 0) { 10087d82f0f8SDina K Nimeh rv = C_Login(sess, CKU_USER, (CK_UTF8CHAR_PTR)pass, passlen); 10097d82f0f8SDina K Nimeh if (rv != CKR_OK) { 10107d82f0f8SDina K Nimeh die(gettext("cannot login to the token %s: %s\n"), 10117d82f0f8SDina K Nimeh token->name, pkcs11_strerror(rv)); 10127d82f0f8SDina K Nimeh } 10137d82f0f8SDina K Nimeh } 10147d82f0f8SDina K Nimeh 10157d82f0f8SDina K Nimeh rv = pkcs11_mech2keytype(cipher->type, &raw_ktype); 10167d82f0f8SDina K Nimeh if (rv != CKR_OK) { 10177d82f0f8SDina K Nimeh die(gettext("failed to get key type for cipher %s: %s\n"), 10187d82f0f8SDina K Nimeh cipher->name, pkcs11_strerror(rv)); 10197d82f0f8SDina K Nimeh } 10207d82f0f8SDina K Nimeh 10217d82f0f8SDina K Nimeh /* 10227d82f0f8SDina K Nimeh * If no keyfile was given, then the token key is secret key to 10237d82f0f8SDina K Nimeh * be used for encryption/decryption. Otherwise, the keyfile 10247d82f0f8SDina K Nimeh * contains a wrapped secret key, and the token is actually the 10257d82f0f8SDina K Nimeh * unwrapping RSA private key. 10267d82f0f8SDina K Nimeh */ 10277d82f0f8SDina K Nimeh if (keyfile == NULL) { 10287d82f0f8SDina K Nimeh kclass = CKO_SECRET_KEY; 10297d82f0f8SDina K Nimeh ktype = raw_ktype; 10307d82f0f8SDina K Nimeh } else { 10317d82f0f8SDina K Nimeh kclass = CKO_PRIVATE_KEY; 10327d82f0f8SDina K Nimeh ktype = CKK_RSA; 10337d82f0f8SDina K Nimeh } 10347d82f0f8SDina K Nimeh 10357d82f0f8SDina K Nimeh /* Find the key in the token first */ 10367d82f0f8SDina K Nimeh for (i = 0; i < attrs; i++) { 10377d82f0f8SDina K Nimeh switch (key_tmpl[i].type) { 10387d82f0f8SDina K Nimeh case CKA_CLASS: 10397d82f0f8SDina K Nimeh key_tmpl[i].pValue = &kclass; 10407d82f0f8SDina K Nimeh key_tmpl[i].ulValueLen = sizeof (kclass); 10417d82f0f8SDina K Nimeh break; 10427d82f0f8SDina K Nimeh case CKA_KEY_TYPE: 10437d82f0f8SDina K Nimeh key_tmpl[i].pValue = &ktype; 10447d82f0f8SDina K Nimeh key_tmpl[i].ulValueLen = sizeof (ktype); 10457d82f0f8SDina K Nimeh break; 10467d82f0f8SDina K Nimeh case CKA_LABEL: 10477d82f0f8SDina K Nimeh key_tmpl[i].pValue = token->key; 10487d82f0f8SDina K Nimeh key_tmpl[i].ulValueLen = strlen(token->key); 10497d82f0f8SDina K Nimeh break; 10507d82f0f8SDina K Nimeh case CKA_TOKEN: 10517d82f0f8SDina K Nimeh key_tmpl[i].pValue = &trueval; 10527d82f0f8SDina K Nimeh key_tmpl[i].ulValueLen = sizeof (trueval); 10537d82f0f8SDina K Nimeh break; 10547d82f0f8SDina K Nimeh case CKA_PRIVATE: 10557d82f0f8SDina K Nimeh key_tmpl[i].pValue = &trueval; 10567d82f0f8SDina K Nimeh key_tmpl[i].ulValueLen = sizeof (trueval); 10577d82f0f8SDina K Nimeh break; 10587d82f0f8SDina K Nimeh default: 10597d82f0f8SDina K Nimeh break; 10607d82f0f8SDina K Nimeh } 10617d82f0f8SDina K Nimeh } 10627d82f0f8SDina K Nimeh rv = C_FindObjectsInit(sess, key_tmpl, attrs); 10637d82f0f8SDina K Nimeh if (rv != CKR_OK) 10647d82f0f8SDina K Nimeh die(gettext("cannot find key %s: %s\n"), token->key, 10657d82f0f8SDina K Nimeh pkcs11_strerror(rv)); 10667d82f0f8SDina K Nimeh rv = C_FindObjects(sess, &obj, 1, &num_objs); 10677d82f0f8SDina K Nimeh (void) C_FindObjectsFinal(sess); 10687d82f0f8SDina K Nimeh 10697d82f0f8SDina K Nimeh if (num_objs == 0) { 10707d82f0f8SDina K Nimeh die(gettext("cannot find key %s\n"), token->key); 10717d82f0f8SDina K Nimeh } else if (rv != CKR_OK) { 10727d82f0f8SDina K Nimeh die(gettext("cannot find key %s: %s\n"), token->key, 10737d82f0f8SDina K Nimeh pkcs11_strerror(rv)); 10747d82f0f8SDina K Nimeh } 10757d82f0f8SDina K Nimeh 10767d82f0f8SDina K Nimeh /* 10777d82f0f8SDina K Nimeh * No keyfile means when token key is found, convert it to raw key, 10787d82f0f8SDina K Nimeh * and done. Otherwise still need do an unwrap to create yet another 10797d82f0f8SDina K Nimeh * obj and that needs to be converted to raw key before we're done. 10807d82f0f8SDina K Nimeh */ 10817d82f0f8SDina K Nimeh if (keyfile == NULL) { 10827d82f0f8SDina K Nimeh /* obj contains raw key, extract it */ 10837d82f0f8SDina K Nimeh rv = pkcs11_ObjectToKey(sess, obj, (void **)&rkey, &rksz, 10847d82f0f8SDina K Nimeh B_FALSE); 10857d82f0f8SDina K Nimeh if (rv != CKR_OK) { 10867d82f0f8SDina K Nimeh die(gettext("failed to get key value for %s" 10877d82f0f8SDina K Nimeh " from token %s, %s\n"), token->key, 10887d82f0f8SDina K Nimeh token->name, pkcs11_strerror(rv)); 10897d82f0f8SDina K Nimeh } 10907d82f0f8SDina K Nimeh } else { 10917d82f0f8SDina K Nimeh getkeyfromfile(keyfile, cipher, &rkey, &rksz); 10927d82f0f8SDina K Nimeh 10937d82f0f8SDina K Nimeh /* 10947d82f0f8SDina K Nimeh * Got the wrapping RSA obj and the wrapped key from file. 10957d82f0f8SDina K Nimeh * Unwrap the key from file with RSA obj to get rawkey obj. 10967d82f0f8SDina K Nimeh */ 10977d82f0f8SDina K Nimeh 10987d82f0f8SDina K Nimeh /* re-use the first two attributes of key_tmpl */ 10997d82f0f8SDina K Nimeh kclass = CKO_SECRET_KEY; 11007d82f0f8SDina K Nimeh ktype = raw_ktype; 11017d82f0f8SDina K Nimeh 11027d82f0f8SDina K Nimeh rv = C_UnwrapKey(sess, &unwrap, obj, (CK_BYTE_PTR)rkey, 11037d82f0f8SDina K Nimeh rksz, key_tmpl, 2, &rawobj); 11047d82f0f8SDina K Nimeh if (rv != CKR_OK) { 11057d82f0f8SDina K Nimeh die(gettext("failed to unwrap key in keyfile %s," 11067d82f0f8SDina K Nimeh " %s\n"), keyfile, pkcs11_strerror(rv)); 11077d82f0f8SDina K Nimeh } 11087d82f0f8SDina K Nimeh /* rawobj contains raw key, extract it */ 11097d82f0f8SDina K Nimeh rv = pkcs11_ObjectToKey(sess, rawobj, (void **)&rkey, &rksz, 11107d82f0f8SDina K Nimeh B_TRUE); 11117d82f0f8SDina K Nimeh if (rv != CKR_OK) { 11127d82f0f8SDina K Nimeh die(gettext("failed to get unwrapped key value for" 11137d82f0f8SDina K Nimeh " key in keyfile %s, %s\n"), keyfile, 11147d82f0f8SDina K Nimeh pkcs11_strerror(rv)); 11157d82f0f8SDina K Nimeh } 11167d82f0f8SDina K Nimeh } 11177d82f0f8SDina K Nimeh 11187d82f0f8SDina K Nimeh /* validate raw key size */ 11197d82f0f8SDina K Nimeh if (rksz < cipher->min_keysize || cipher->max_keysize < rksz) { 11207d82f0f8SDina K Nimeh warn(gettext("%s: invalid keysize: %d\n"), keyfile, (int)rksz); 11217d82f0f8SDina K Nimeh die(gettext("\t%d <= keysize <= %d\n"), cipher->min_keysize, 11227d82f0f8SDina K Nimeh cipher->max_keysize); 11237d82f0f8SDina K Nimeh } 11247d82f0f8SDina K Nimeh 11257d82f0f8SDina K Nimeh *raw_key_sz = rksz; 11267d82f0f8SDina K Nimeh *raw_key = (char *)rkey; 11277d82f0f8SDina K Nimeh } 11287d82f0f8SDina K Nimeh 11297d82f0f8SDina K Nimeh /* 11307d82f0f8SDina K Nimeh * Set up cipher key limits and verify PKCS#11 can be done 11317d82f0f8SDina K Nimeh * match_token_cipher is the function pointer used by 11327d82f0f8SDina K Nimeh * pkcs11_GetCriteriaSession() init_crypto. 11337d82f0f8SDina K Nimeh */ 11347d82f0f8SDina K Nimeh boolean_t 11357d82f0f8SDina K Nimeh match_token_cipher(CK_SLOT_ID slot_id, void *args, CK_RV *rv) 11367d82f0f8SDina K Nimeh { 11377d82f0f8SDina K Nimeh token_spec_t *token; 11387d82f0f8SDina K Nimeh mech_alias_t *cipher; 11397d82f0f8SDina K Nimeh CK_TOKEN_INFO tokinfo; 11407d82f0f8SDina K Nimeh CK_MECHANISM_INFO mechinfo; 11417d82f0f8SDina K Nimeh boolean_t token_match; 11427d82f0f8SDina K Nimeh 11437d82f0f8SDina K Nimeh /* 11447d82f0f8SDina K Nimeh * While traversing slot list, pick up the following info per slot: 11457d82f0f8SDina K Nimeh * - if token specified, whether it matches this slot's token info 11467d82f0f8SDina K Nimeh * - if the slot supports the PKCS#5 PBKD2 cipher 11477d82f0f8SDina K Nimeh * 11487d82f0f8SDina K Nimeh * If the user said on the command line 11497d82f0f8SDina K Nimeh * -T tok:mfr:ser:lab -k keyfile 11507d82f0f8SDina K Nimeh * -c cipher -T tok:mfr:ser:lab -k keyfile 11517d82f0f8SDina K Nimeh * the given cipher or the default cipher apply to keyfile, 11527d82f0f8SDina K Nimeh * If the user said instead 11537d82f0f8SDina K Nimeh * -T tok:mfr:ser:lab 11547d82f0f8SDina K Nimeh * -c cipher -T tok:mfr:ser:lab 11557d82f0f8SDina K Nimeh * the key named "lab" may or may not agree with the given 11567d82f0f8SDina K Nimeh * cipher or the default cipher. In those cases, cipher will 11577d82f0f8SDina K Nimeh * be overridden with the actual cipher type of the key "lab". 11587d82f0f8SDina K Nimeh */ 11597d82f0f8SDina K Nimeh *rv = CKR_FUNCTION_FAILED; 11607d82f0f8SDina K Nimeh 11617d82f0f8SDina K Nimeh if (args == NULL) { 11627d82f0f8SDina K Nimeh return (B_FALSE); 11637d82f0f8SDina K Nimeh } 11647d82f0f8SDina K Nimeh 11657d82f0f8SDina K Nimeh cipher = (mech_alias_t *)args; 11667d82f0f8SDina K Nimeh token = cipher->token; 11677d82f0f8SDina K Nimeh 11687d82f0f8SDina K Nimeh if (C_GetMechanismInfo(slot_id, cipher->type, &mechinfo) != CKR_OK) { 11697d82f0f8SDina K Nimeh return (B_FALSE); 11707d82f0f8SDina K Nimeh } 11717d82f0f8SDina K Nimeh 11727d82f0f8SDina K Nimeh if (token == NULL) { 11737d82f0f8SDina K Nimeh if (C_GetMechanismInfo(slot_id, CKM_PKCS5_PBKD2, &mechinfo) != 11747d82f0f8SDina K Nimeh CKR_OK) { 11757d82f0f8SDina K Nimeh return (B_FALSE); 11767d82f0f8SDina K Nimeh } 11777d82f0f8SDina K Nimeh goto foundit; 11787d82f0f8SDina K Nimeh } 11797d82f0f8SDina K Nimeh 11807d82f0f8SDina K Nimeh /* does the token match the token spec? */ 11817d82f0f8SDina K Nimeh if (token->key == NULL || (C_GetTokenInfo(slot_id, &tokinfo) != CKR_OK)) 11827d82f0f8SDina K Nimeh return (B_FALSE); 11837d82f0f8SDina K Nimeh 11847d82f0f8SDina K Nimeh token_match = B_TRUE; 11857d82f0f8SDina K Nimeh 11867d82f0f8SDina K Nimeh if (token->name != NULL && (token->name)[0] != '\0' && 11877d82f0f8SDina K Nimeh strncmp((char *)token->name, (char *)tokinfo.label, 11887d82f0f8SDina K Nimeh TOKEN_LABEL_SIZE) != 0) 11897d82f0f8SDina K Nimeh token_match = B_FALSE; 11907d82f0f8SDina K Nimeh if (token->mfr != NULL && (token->mfr)[0] != '\0' && 11917d82f0f8SDina K Nimeh strncmp((char *)token->mfr, (char *)tokinfo.manufacturerID, 11927d82f0f8SDina K Nimeh TOKEN_MANUFACTURER_SIZE) != 0) 11937d82f0f8SDina K Nimeh token_match = B_FALSE; 11947d82f0f8SDina K Nimeh if (token->serno != NULL && (token->serno)[0] != '\0' && 11957d82f0f8SDina K Nimeh strncmp((char *)token->serno, (char *)tokinfo.serialNumber, 11967d82f0f8SDina K Nimeh TOKEN_SERIAL_SIZE) != 0) 11977d82f0f8SDina K Nimeh token_match = B_FALSE; 11987d82f0f8SDina K Nimeh 11997d82f0f8SDina K Nimeh if (!token_match) 12007d82f0f8SDina K Nimeh return (B_FALSE); 12017d82f0f8SDina K Nimeh 12027d82f0f8SDina K Nimeh foundit: 12037d82f0f8SDina K Nimeh cipher->slot = slot_id; 12047d82f0f8SDina K Nimeh return (B_TRUE); 12057d82f0f8SDina K Nimeh } 12067d82f0f8SDina K Nimeh 12077d82f0f8SDina K Nimeh /* 12087d82f0f8SDina K Nimeh * Clean up crypto loose ends 12097d82f0f8SDina K Nimeh */ 12107d82f0f8SDina K Nimeh static void 12117d82f0f8SDina K Nimeh end_crypto(CK_SESSION_HANDLE sess) 12127d82f0f8SDina K Nimeh { 12137d82f0f8SDina K Nimeh (void) C_CloseSession(sess); 12147d82f0f8SDina K Nimeh (void) C_Finalize(NULL); 12157d82f0f8SDina K Nimeh } 12167d82f0f8SDina K Nimeh 12177d82f0f8SDina K Nimeh /* 12187d82f0f8SDina K Nimeh * Set up crypto, opening session on slot that matches token and cipher 12197d82f0f8SDina K Nimeh */ 12207d82f0f8SDina K Nimeh static void 12217d82f0f8SDina K Nimeh init_crypto(token_spec_t *token, mech_alias_t *cipher, 12227d82f0f8SDina K Nimeh CK_SESSION_HANDLE_PTR sess) 12237d82f0f8SDina K Nimeh { 12247d82f0f8SDina K Nimeh CK_RV rv; 12257d82f0f8SDina K Nimeh 12267d82f0f8SDina K Nimeh cipher->token = token; 12277d82f0f8SDina K Nimeh 12287d82f0f8SDina K Nimeh /* Turn off Metaslot so that we can see actual tokens */ 12297d82f0f8SDina K Nimeh if (setenv("METASLOT_ENABLED", "false", 1) < 0) { 12307d82f0f8SDina K Nimeh die(gettext("could not disable Metaslot")); 12317d82f0f8SDina K Nimeh } 12327d82f0f8SDina K Nimeh 12337d82f0f8SDina K Nimeh rv = pkcs11_GetCriteriaSession(match_token_cipher, (void *)cipher, 12347d82f0f8SDina K Nimeh sess); 12357d82f0f8SDina K Nimeh if (rv != CKR_OK) { 12367d82f0f8SDina K Nimeh end_crypto(*sess); 12377d82f0f8SDina K Nimeh if (rv == CKR_HOST_MEMORY) { 12387d82f0f8SDina K Nimeh die("malloc"); 12397d82f0f8SDina K Nimeh } 12407d82f0f8SDina K Nimeh die(gettext("failed to find any cryptographic provider, " 12417d82f0f8SDina K Nimeh "use \"cryptoadm list -p\" to find providers: %s\n"), 12427d82f0f8SDina K Nimeh pkcs11_strerror(rv)); 12437d82f0f8SDina K Nimeh } 12447d82f0f8SDina K Nimeh } 12457d82f0f8SDina K Nimeh 12467d82f0f8SDina K Nimeh /* 124787117650Saalok * Uncompress a file. 124887117650Saalok * 124987117650Saalok * First map the file in to establish a device 125087117650Saalok * association, then read from it. On-the-fly 125187117650Saalok * decompression will automatically uncompress 125287117650Saalok * the file if it's compressed 125387117650Saalok * 125487117650Saalok * If the file is mapped and a device association 125587117650Saalok * has been established, disallow uncompressing 125687117650Saalok * the file until it is unmapped. 125787117650Saalok */ 125887117650Saalok static void 125987117650Saalok lofi_uncompress(int lfd, const char *filename) 12607c478bd9Sstevel@tonic-gate { 126187117650Saalok struct lofi_ioctl li; 126287117650Saalok char buf[MAXBSIZE]; 126387117650Saalok char devicename[32]; 126487117650Saalok char tmpfilename[MAXPATHLEN]; 12657d82f0f8SDina K Nimeh char *x; 126687117650Saalok char *dir = NULL; 126787117650Saalok char *file = NULL; 126887117650Saalok int minor = 0; 126987117650Saalok struct stat64 statbuf; 127087117650Saalok int compfd = -1; 127187117650Saalok int uncompfd = -1; 127287117650Saalok ssize_t rbytes; 127387117650Saalok 127487117650Saalok /* 127587117650Saalok * Disallow uncompressing the file if it is 127687117650Saalok * already mapped. 127787117650Saalok */ 1278*789dced6SJerry Jelinek li.li_crypto_enabled = B_FALSE; 127987117650Saalok li.li_minor = 0; 128087117650Saalok (void) strlcpy(li.li_filename, filename, sizeof (li.li_filename)); 128187117650Saalok if (ioctl(lfd, LOFI_GET_MINOR, &li) != -1) 128287117650Saalok die(gettext("%s must be unmapped before uncompressing"), 128387117650Saalok filename); 128487117650Saalok 128587117650Saalok /* Zero length files don't need to be uncompressed */ 128687117650Saalok if (stat64(filename, &statbuf) == -1) 128787117650Saalok die(gettext("stat: %s"), filename); 128887117650Saalok if (statbuf.st_size == 0) 128987117650Saalok return; 129087117650Saalok 12917d82f0f8SDina K Nimeh minor = lofi_map_file(lfd, li, filename); 129287117650Saalok (void) snprintf(devicename, sizeof (devicename), "/dev/%s/%d", 129387117650Saalok LOFI_BLOCK_NAME, minor); 129487117650Saalok 129587117650Saalok /* If the file isn't compressed, we just return */ 129687117650Saalok if ((ioctl(lfd, LOFI_CHECK_COMPRESSED, &li) == -1) || 1297a423e759Saalok (li.li_algorithm[0] == '\0')) { 129887117650Saalok delete_mapping(lfd, devicename, filename, B_TRUE); 1299a423e759Saalok die("%s is not compressed\n", filename); 130087117650Saalok } 130187117650Saalok 130287117650Saalok if ((compfd = open64(devicename, O_RDONLY | O_NONBLOCK)) == -1) { 130387117650Saalok delete_mapping(lfd, devicename, filename, B_TRUE); 130487117650Saalok die(gettext("open: %s"), filename); 130587117650Saalok } 130687117650Saalok /* Create a temp file in the same directory */ 13077d82f0f8SDina K Nimeh x = strdup(filename); 13087d82f0f8SDina K Nimeh dir = strdup(dirname(x)); 13097d82f0f8SDina K Nimeh free(x); 13107d82f0f8SDina K Nimeh x = strdup(filename); 13117d82f0f8SDina K Nimeh file = strdup(basename(x)); 13127d82f0f8SDina K Nimeh free(x); 131387117650Saalok (void) snprintf(tmpfilename, sizeof (tmpfilename), 131487117650Saalok "%s/.%sXXXXXX", dir, file); 13157d82f0f8SDina K Nimeh free(dir); 13167d82f0f8SDina K Nimeh free(file); 131787117650Saalok 131887117650Saalok if ((uncompfd = mkstemp64(tmpfilename)) == -1) { 131987117650Saalok (void) close(compfd); 132087117650Saalok delete_mapping(lfd, devicename, filename, B_TRUE); 1321a423e759Saalok die("%s could not be uncompressed\n", filename); 132287117650Saalok } 132387117650Saalok 132487117650Saalok /* 132587117650Saalok * Set the mode bits and the owner of this temporary 132687117650Saalok * file to be that of the original uncompressed file 132787117650Saalok */ 132887117650Saalok (void) fchmod(uncompfd, statbuf.st_mode); 132987117650Saalok 133087117650Saalok if (fchown(uncompfd, statbuf.st_uid, statbuf.st_gid) == -1) { 133187117650Saalok (void) close(compfd); 133287117650Saalok (void) close(uncompfd); 133387117650Saalok delete_mapping(lfd, devicename, filename, B_TRUE); 1334a423e759Saalok die("%s could not be uncompressed\n", filename); 133587117650Saalok } 133687117650Saalok 133787117650Saalok /* Now read from the device in MAXBSIZE-sized chunks */ 133887117650Saalok for (;;) { 133987117650Saalok rbytes = read(compfd, buf, sizeof (buf)); 134087117650Saalok 134187117650Saalok if (rbytes <= 0) 134287117650Saalok break; 134387117650Saalok 134487117650Saalok if (write(uncompfd, buf, rbytes) != rbytes) { 134587117650Saalok rbytes = -1; 134687117650Saalok break; 134787117650Saalok } 134887117650Saalok } 134987117650Saalok 135087117650Saalok (void) close(compfd); 135187117650Saalok (void) close(uncompfd); 135287117650Saalok 135387117650Saalok /* Delete the mapping */ 135487117650Saalok delete_mapping(lfd, devicename, filename, B_TRUE); 135587117650Saalok 135687117650Saalok /* 135787117650Saalok * If an error occured while reading or writing, rbytes will 135887117650Saalok * be negative 135987117650Saalok */ 136087117650Saalok if (rbytes < 0) { 136187117650Saalok (void) unlink(tmpfilename); 136287117650Saalok die(gettext("could not read from %s"), filename); 136387117650Saalok } 136487117650Saalok 136587117650Saalok /* Rename the temp file to the actual file */ 136687117650Saalok if (rename(tmpfilename, filename) == -1) 136787117650Saalok (void) unlink(tmpfilename); 136887117650Saalok } 136987117650Saalok 137087117650Saalok /* 137187117650Saalok * Compress a file 137287117650Saalok */ 137387117650Saalok static void 13749525893dSaalok lofi_compress(int *lfd, const char *filename, int compress_index, 137587117650Saalok uint32_t segsize) 137687117650Saalok { 137787117650Saalok struct lofi_ioctl lic; 137887117650Saalok lofi_compress_info_t *li; 13799525893dSaalok struct flock lock; 138087117650Saalok char tmpfilename[MAXPATHLEN]; 138187117650Saalok char comp_filename[MAXPATHLEN]; 138287117650Saalok char algorithm[MAXALGLEN]; 13837d82f0f8SDina K Nimeh char *x; 138487117650Saalok char *dir = NULL, *file = NULL; 138587117650Saalok uchar_t *uncompressed_seg = NULL; 138687117650Saalok uchar_t *compressed_seg = NULL; 138787117650Saalok uint32_t compressed_segsize; 138887117650Saalok uint32_t len_compressed, count; 138987117650Saalok uint32_t index_entries, index_sz; 139087117650Saalok uint64_t *index = NULL; 139187117650Saalok uint64_t offset; 139287117650Saalok size_t real_segsize; 139387117650Saalok struct stat64 statbuf; 139487117650Saalok int compfd = -1, uncompfd = -1; 139587117650Saalok int tfd = -1; 139687117650Saalok ssize_t rbytes, wbytes, lastread; 139787117650Saalok int i, type; 139887117650Saalok 139987117650Saalok /* 140087117650Saalok * Disallow compressing the file if it is 140187117650Saalok * already mapped 140287117650Saalok */ 140387117650Saalok lic.li_minor = 0; 140487117650Saalok (void) strlcpy(lic.li_filename, filename, sizeof (lic.li_filename)); 14059525893dSaalok if (ioctl(*lfd, LOFI_GET_MINOR, &lic) != -1) 140687117650Saalok die(gettext("%s must be unmapped before compressing"), 140787117650Saalok filename); 140887117650Saalok 14099525893dSaalok /* 14109525893dSaalok * Close the control device so other operations 14119525893dSaalok * can use it 14129525893dSaalok */ 14139525893dSaalok (void) close(*lfd); 14149525893dSaalok *lfd = -1; 14159525893dSaalok 141687117650Saalok li = &lofi_compress_table[compress_index]; 141787117650Saalok 141887117650Saalok /* 141987117650Saalok * The size of the buffer to hold compressed data must 142087117650Saalok * be slightly larger than the compressed segment size. 142187117650Saalok * 142287117650Saalok * The compress functions use part of the buffer as 142387117650Saalok * scratch space to do calculations. 142487117650Saalok * Ref: http://www.zlib.net/manual.html#compress2 142587117650Saalok */ 142687117650Saalok compressed_segsize = segsize + (segsize >> 6); 142787117650Saalok compressed_seg = (uchar_t *)malloc(compressed_segsize + SEGHDR); 142887117650Saalok uncompressed_seg = (uchar_t *)malloc(segsize); 142987117650Saalok 143087117650Saalok if (compressed_seg == NULL || uncompressed_seg == NULL) 143187117650Saalok die(gettext("No memory")); 143287117650Saalok 14339525893dSaalok if ((uncompfd = open64(filename, O_RDWR|O_LARGEFILE, 0)) == -1) 143487117650Saalok die(gettext("open: %s"), filename); 143587117650Saalok 14369525893dSaalok lock.l_type = F_WRLCK; 14379525893dSaalok lock.l_whence = SEEK_SET; 14389525893dSaalok lock.l_start = 0; 14399525893dSaalok lock.l_len = 0; 14409525893dSaalok 14419525893dSaalok /* 14429525893dSaalok * Use an advisory lock to ensure that only a 14439525893dSaalok * single lofiadm process compresses a given 14449525893dSaalok * file at any given time 14459525893dSaalok * 14469525893dSaalok * A close on the file descriptor automatically 14479525893dSaalok * closes all lock state on the file 14489525893dSaalok */ 14499525893dSaalok if (fcntl(uncompfd, F_SETLKW, &lock) == -1) 14509525893dSaalok die(gettext("fcntl: %s"), filename); 14519525893dSaalok 145287117650Saalok if (fstat64(uncompfd, &statbuf) == -1) { 145387117650Saalok (void) close(uncompfd); 145487117650Saalok die(gettext("fstat: %s"), filename); 145587117650Saalok } 145687117650Saalok 145787117650Saalok /* Zero length files don't need to be compressed */ 145887117650Saalok if (statbuf.st_size == 0) { 145987117650Saalok (void) close(uncompfd); 146087117650Saalok return; 146187117650Saalok } 146287117650Saalok 146387117650Saalok /* 146487117650Saalok * Create temporary files in the same directory that 146587117650Saalok * will hold the intermediate data 146687117650Saalok */ 14677d82f0f8SDina K Nimeh x = strdup(filename); 14687d82f0f8SDina K Nimeh dir = strdup(dirname(x)); 14697d82f0f8SDina K Nimeh free(x); 14707d82f0f8SDina K Nimeh x = strdup(filename); 14717d82f0f8SDina K Nimeh file = strdup(basename(x)); 14727d82f0f8SDina K Nimeh free(x); 147387117650Saalok (void) snprintf(tmpfilename, sizeof (tmpfilename), 147487117650Saalok "%s/.%sXXXXXX", dir, file); 147587117650Saalok (void) snprintf(comp_filename, sizeof (comp_filename), 147687117650Saalok "%s/.%sXXXXXX", dir, file); 14777d82f0f8SDina K Nimeh free(dir); 14787d82f0f8SDina K Nimeh free(file); 147987117650Saalok 148087117650Saalok if ((tfd = mkstemp64(tmpfilename)) == -1) 148187117650Saalok goto cleanup; 148287117650Saalok 148387117650Saalok if ((compfd = mkstemp64(comp_filename)) == -1) 148487117650Saalok goto cleanup; 148587117650Saalok 148687117650Saalok /* 148787117650Saalok * Set the mode bits and owner of the compressed 148887117650Saalok * file to be that of the original uncompressed file 148987117650Saalok */ 149087117650Saalok (void) fchmod(compfd, statbuf.st_mode); 149187117650Saalok 149287117650Saalok if (fchown(compfd, statbuf.st_uid, statbuf.st_gid) == -1) 149387117650Saalok goto cleanup; 149487117650Saalok 149587117650Saalok /* 149687117650Saalok * Calculate the number of index entries required. 149787117650Saalok * index entries are stored as an array. adding 149887117650Saalok * a '2' here accounts for the fact that the last 149987117650Saalok * segment may not be a multiple of the segment size 150087117650Saalok */ 150187117650Saalok index_sz = (statbuf.st_size / segsize) + 2; 150287117650Saalok index = malloc(sizeof (*index) * index_sz); 150387117650Saalok 150487117650Saalok if (index == NULL) 150587117650Saalok goto cleanup; 150687117650Saalok 150787117650Saalok offset = 0; 150887117650Saalok lastread = segsize; 150987117650Saalok count = 0; 151087117650Saalok 151187117650Saalok /* 151287117650Saalok * Now read from the uncompressed file in 'segsize' 151387117650Saalok * sized chunks, compress what was read in and 151487117650Saalok * write it out to a temporary file 151587117650Saalok */ 151687117650Saalok for (;;) { 151787117650Saalok rbytes = read(uncompfd, uncompressed_seg, segsize); 151887117650Saalok 151987117650Saalok if (rbytes <= 0) 152087117650Saalok break; 152187117650Saalok 152287117650Saalok if (lastread < segsize) 152387117650Saalok goto cleanup; 152487117650Saalok 152587117650Saalok /* 152687117650Saalok * Account for the first byte that 152787117650Saalok * indicates whether a segment is 152887117650Saalok * compressed or not 152987117650Saalok */ 153087117650Saalok real_segsize = segsize - 1; 153187117650Saalok (void) li->l_compress(uncompressed_seg, rbytes, 153287117650Saalok compressed_seg + SEGHDR, &real_segsize, li->l_level); 153387117650Saalok 153487117650Saalok /* 153587117650Saalok * If the length of the compressed data is more 153687117650Saalok * than a threshold then there isn't any benefit 153787117650Saalok * to be had from compressing this segment - leave 153887117650Saalok * it uncompressed. 153987117650Saalok * 154087117650Saalok * NB. In case an error occurs during compression (above) 154187117650Saalok * the 'real_segsize' isn't changed. The logic below 154287117650Saalok * ensures that that segment is left uncompressed. 154387117650Saalok */ 154487117650Saalok len_compressed = real_segsize; 15454058a205Sjrgn.keil@googlemail.com if (segsize <= COMPRESS_THRESHOLD || 15464058a205Sjrgn.keil@googlemail.com real_segsize > (segsize - COMPRESS_THRESHOLD)) { 154787117650Saalok (void) memcpy(compressed_seg + SEGHDR, uncompressed_seg, 154887117650Saalok rbytes); 154987117650Saalok type = UNCOMPRESSED; 155087117650Saalok len_compressed = rbytes; 155187117650Saalok } else { 155287117650Saalok type = COMPRESSED; 155387117650Saalok } 155487117650Saalok 155587117650Saalok /* 155687117650Saalok * Set the first byte or the SEGHDR to 155787117650Saalok * indicate if it's compressed or not 155887117650Saalok */ 155987117650Saalok *compressed_seg = type; 156087117650Saalok wbytes = write(tfd, compressed_seg, len_compressed + SEGHDR); 156187117650Saalok if (wbytes != (len_compressed + SEGHDR)) { 156287117650Saalok rbytes = -1; 156387117650Saalok break; 156487117650Saalok } 156587117650Saalok 156687117650Saalok index[count] = BE_64(offset); 156787117650Saalok offset += wbytes; 156887117650Saalok lastread = rbytes; 156987117650Saalok count++; 157087117650Saalok } 157187117650Saalok 157287117650Saalok (void) close(uncompfd); 157387117650Saalok 157487117650Saalok if (rbytes < 0) 157587117650Saalok goto cleanup; 157687117650Saalok /* 157787117650Saalok * The last index entry is a sentinel entry. It does not point to 157887117650Saalok * an actual compressed segment but helps in computing the size of 157987117650Saalok * the compressed segment. The size of each compressed segment is 158087117650Saalok * computed by subtracting the current index value from the next 158187117650Saalok * one (the compressed blocks are stored sequentially) 158287117650Saalok */ 158387117650Saalok index[count++] = BE_64(offset); 158487117650Saalok 158587117650Saalok /* 158687117650Saalok * Now write the compressed data along with the 158787117650Saalok * header information to this file which will 158887117650Saalok * later be renamed to the original uncompressed 158987117650Saalok * file name 159087117650Saalok * 159187117650Saalok * The header is as follows - 159287117650Saalok * 159387117650Saalok * Signature (name of the compression algorithm) 159487117650Saalok * Compression segment size (a multiple of 512) 159587117650Saalok * Number of index entries 159687117650Saalok * Size of the last block 159787117650Saalok * The array containing the index entries 159887117650Saalok * 159987117650Saalok * the header is always stored in network byte 160087117650Saalok * order 160187117650Saalok */ 160287117650Saalok (void) bzero(algorithm, sizeof (algorithm)); 160387117650Saalok (void) strlcpy(algorithm, li->l_name, sizeof (algorithm)); 160487117650Saalok if (write(compfd, algorithm, sizeof (algorithm)) 160587117650Saalok != sizeof (algorithm)) 160687117650Saalok goto cleanup; 160787117650Saalok 160887117650Saalok segsize = htonl(segsize); 160987117650Saalok if (write(compfd, &segsize, sizeof (segsize)) != sizeof (segsize)) 161087117650Saalok goto cleanup; 161187117650Saalok 161287117650Saalok index_entries = htonl(count); 161387117650Saalok if (write(compfd, &index_entries, sizeof (index_entries)) != 161487117650Saalok sizeof (index_entries)) 161587117650Saalok goto cleanup; 161687117650Saalok 161787117650Saalok lastread = htonl(lastread); 161887117650Saalok if (write(compfd, &lastread, sizeof (lastread)) != sizeof (lastread)) 161987117650Saalok goto cleanup; 162087117650Saalok 162187117650Saalok for (i = 0; i < count; i++) { 162287117650Saalok if (write(compfd, index + i, sizeof (*index)) != 162387117650Saalok sizeof (*index)) 162487117650Saalok goto cleanup; 162587117650Saalok } 162687117650Saalok 162787117650Saalok /* Header is written, now write the compressed data */ 162887117650Saalok if (lseek(tfd, 0, SEEK_SET) != 0) 162987117650Saalok goto cleanup; 163087117650Saalok 163187117650Saalok rbytes = wbytes = 0; 163287117650Saalok 163387117650Saalok for (;;) { 163487117650Saalok rbytes = read(tfd, compressed_seg, compressed_segsize + SEGHDR); 163587117650Saalok 163687117650Saalok if (rbytes <= 0) 163787117650Saalok break; 163887117650Saalok 163987117650Saalok if (write(compfd, compressed_seg, rbytes) != rbytes) 164087117650Saalok goto cleanup; 164187117650Saalok } 164287117650Saalok 164387117650Saalok if (fstat64(compfd, &statbuf) == -1) 164487117650Saalok goto cleanup; 164587117650Saalok 164687117650Saalok /* 164787117650Saalok * Round up the compressed file size to be a multiple of 164887117650Saalok * DEV_BSIZE. lofi(7D) likes it that way. 164987117650Saalok */ 165087117650Saalok if ((offset = statbuf.st_size % DEV_BSIZE) > 0) { 165187117650Saalok 165287117650Saalok offset = DEV_BSIZE - offset; 165387117650Saalok 165487117650Saalok for (i = 0; i < offset; i++) 165587117650Saalok uncompressed_seg[i] = '\0'; 165687117650Saalok if (write(compfd, uncompressed_seg, offset) != offset) 165787117650Saalok goto cleanup; 165887117650Saalok } 165987117650Saalok (void) close(compfd); 166087117650Saalok (void) close(tfd); 166187117650Saalok (void) unlink(tmpfilename); 166287117650Saalok cleanup: 166387117650Saalok if (rbytes < 0) { 166487117650Saalok if (tfd != -1) 166587117650Saalok (void) unlink(tmpfilename); 166687117650Saalok if (compfd != -1) 166787117650Saalok (void) unlink(comp_filename); 166887117650Saalok die(gettext("error compressing file %s"), filename); 166987117650Saalok } else { 167087117650Saalok /* Rename the compressed file to the actual file */ 167187117650Saalok if (rename(comp_filename, filename) == -1) { 167287117650Saalok (void) unlink(comp_filename); 167387117650Saalok die(gettext("error compressing file %s"), filename); 167487117650Saalok } 167587117650Saalok } 167687117650Saalok if (compressed_seg != NULL) 167787117650Saalok free(compressed_seg); 167887117650Saalok if (uncompressed_seg != NULL) 167987117650Saalok free(uncompressed_seg); 168087117650Saalok if (index != NULL) 168187117650Saalok free(index); 168287117650Saalok if (compfd != -1) 168387117650Saalok (void) close(compfd); 168487117650Saalok if (uncompfd != -1) 168587117650Saalok (void) close(uncompfd); 168687117650Saalok if (tfd != -1) 168787117650Saalok (void) close(tfd); 168887117650Saalok } 168987117650Saalok 169087117650Saalok static int 169187117650Saalok lofi_compress_select(const char *algname) 169287117650Saalok { 169387117650Saalok int i; 169487117650Saalok 169587117650Saalok for (i = 0; i < LOFI_COMPRESS_FUNCTIONS; i++) { 169687117650Saalok if (strcmp(lofi_compress_table[i].l_name, algname) == 0) 169787117650Saalok return (i); 169887117650Saalok } 169987117650Saalok return (-1); 170087117650Saalok } 170187117650Saalok 170287117650Saalok static void 170387117650Saalok check_algorithm_validity(const char *algname, int *compress_index) 170487117650Saalok { 170587117650Saalok *compress_index = lofi_compress_select(algname); 170687117650Saalok if (*compress_index < 0) 170787117650Saalok die(gettext("invalid algorithm name: %s\n"), algname); 170887117650Saalok } 170987117650Saalok 171087117650Saalok static void 171187117650Saalok check_file_validity(const char *filename) 171287117650Saalok { 17137c478bd9Sstevel@tonic-gate struct stat64 buf; 171487117650Saalok int error; 17157d82f0f8SDina K Nimeh int fd; 17167c478bd9Sstevel@tonic-gate 17177c478bd9Sstevel@tonic-gate fd = open64(filename, O_RDONLY); 17187c478bd9Sstevel@tonic-gate if (fd == -1) { 17197c478bd9Sstevel@tonic-gate die(gettext("open: %s"), filename); 17207c478bd9Sstevel@tonic-gate } 17217c478bd9Sstevel@tonic-gate error = fstat64(fd, &buf); 17227c478bd9Sstevel@tonic-gate if (error == -1) { 17237c478bd9Sstevel@tonic-gate die(gettext("fstat: %s"), filename); 17247c478bd9Sstevel@tonic-gate } else if (!S_ISLOFIABLE(buf.st_mode)) { 17257c478bd9Sstevel@tonic-gate die(gettext("%s is not a regular file, " 17267c478bd9Sstevel@tonic-gate "block, or character device\n"), 17277c478bd9Sstevel@tonic-gate filename); 17287c478bd9Sstevel@tonic-gate } else if ((buf.st_size % DEV_BSIZE) != 0) { 1729f9153c6bSDina K Nimeh die(gettext("size of %s is not a multiple of %d\n"), 17307c478bd9Sstevel@tonic-gate filename, DEV_BSIZE); 17317c478bd9Sstevel@tonic-gate } 17327c478bd9Sstevel@tonic-gate (void) close(fd); 173387117650Saalok 173487117650Saalok if (name_to_minor(filename) != 0) { 1735f9153c6bSDina K Nimeh die(gettext("cannot use %s on itself\n"), LOFI_DRIVER_NAME); 17367c478bd9Sstevel@tonic-gate } 173787117650Saalok } 173887117650Saalok 173987117650Saalok static uint32_t 174087117650Saalok convert_to_num(const char *str) 174187117650Saalok { 174287117650Saalok int len; 174387117650Saalok uint32_t segsize, mult = 1; 174487117650Saalok 174587117650Saalok len = strlen(str); 174687117650Saalok if (len && isalpha(str[len - 1])) { 174787117650Saalok switch (str[len - 1]) { 174887117650Saalok case 'k': 174987117650Saalok case 'K': 175087117650Saalok mult = KILOBYTE; 175187117650Saalok break; 175287117650Saalok case 'b': 175387117650Saalok case 'B': 175487117650Saalok mult = BLOCK_SIZE; 175587117650Saalok break; 175687117650Saalok case 'm': 175787117650Saalok case 'M': 175887117650Saalok mult = MEGABYTE; 175987117650Saalok break; 176087117650Saalok case 'g': 176187117650Saalok case 'G': 176287117650Saalok mult = GIGABYTE; 176387117650Saalok break; 176487117650Saalok default: 176587117650Saalok die(gettext("invalid segment size %s\n"), str); 176687117650Saalok } 176787117650Saalok } 176887117650Saalok 176987117650Saalok segsize = atol(str); 177087117650Saalok segsize *= mult; 177187117650Saalok 177287117650Saalok return (segsize); 177387117650Saalok } 177487117650Saalok 177587117650Saalok int 177687117650Saalok main(int argc, char *argv[]) 177787117650Saalok { 177887117650Saalok int lfd; 177987117650Saalok int c; 178087117650Saalok const char *devicename = NULL; 178187117650Saalok const char *filename = NULL; 178287117650Saalok const char *algname = COMPRESS_ALGORITHM; 178387117650Saalok int openflag; 178487117650Saalok int minor; 178587117650Saalok int compress_index; 178687117650Saalok uint32_t segsize = SEGSIZE; 178787117650Saalok static char *lofictl = "/dev/" LOFI_CTL_NAME; 178887117650Saalok boolean_t force = B_FALSE; 17897d82f0f8SDina K Nimeh const char *pname; 17907d82f0f8SDina K Nimeh boolean_t errflag = B_FALSE; 17917d82f0f8SDina K Nimeh boolean_t addflag = B_FALSE; 17927d82f0f8SDina K Nimeh boolean_t deleteflag = B_FALSE; 17937d82f0f8SDina K Nimeh boolean_t ephflag = B_FALSE; 17947d82f0f8SDina K Nimeh boolean_t compressflag = B_FALSE; 17957d82f0f8SDina K Nimeh boolean_t uncompressflag = B_FALSE; 17967d82f0f8SDina K Nimeh /* the next two work together for -c, -k, -T, -e options only */ 17977d82f0f8SDina K Nimeh boolean_t need_crypto = B_FALSE; /* if any -c, -k, -T, -e */ 17987d82f0f8SDina K Nimeh boolean_t cipher_only = B_TRUE; /* if -c only */ 17997d82f0f8SDina K Nimeh const char *keyfile = NULL; 18007d82f0f8SDina K Nimeh mech_alias_t *cipher = NULL; 18017d82f0f8SDina K Nimeh token_spec_t *token = NULL; 18027d82f0f8SDina K Nimeh char *rkey = NULL; 18037d82f0f8SDina K Nimeh size_t rksz = 0; 1804f9153c6bSDina K Nimeh char realfilename[MAXPATHLEN]; 180587117650Saalok 180687117650Saalok pname = getpname(argv[0]); 180787117650Saalok 180887117650Saalok (void) setlocale(LC_ALL, ""); 180987117650Saalok (void) textdomain(TEXT_DOMAIN); 181087117650Saalok 18117d82f0f8SDina K Nimeh while ((c = getopt(argc, argv, "a:c:Cd:efk:o:s:T:U")) != EOF) { 181287117650Saalok switch (c) { 181387117650Saalok case 'a': 18147d82f0f8SDina K Nimeh addflag = B_TRUE; 1815f9153c6bSDina K Nimeh if ((filename = realpath(optarg, realfilename)) == NULL) 1816f9153c6bSDina K Nimeh die("%s", optarg); 18177c478bd9Sstevel@tonic-gate if (((argc - optind) > 0) && (*argv[optind] != '-')) { 18187c478bd9Sstevel@tonic-gate /* optional device */ 18197c478bd9Sstevel@tonic-gate devicename = argv[optind]; 18207c478bd9Sstevel@tonic-gate optind++; 18217c478bd9Sstevel@tonic-gate } 18227c478bd9Sstevel@tonic-gate break; 182387117650Saalok case 'C': 18247d82f0f8SDina K Nimeh compressflag = B_TRUE; 18257d82f0f8SDina K Nimeh if (((argc - optind) > 1) && (*argv[optind] != '-')) { 18267d82f0f8SDina K Nimeh /* optional algorithm */ 18277d82f0f8SDina K Nimeh algname = argv[optind]; 182887117650Saalok optind++; 182987117650Saalok } 183087117650Saalok check_algorithm_validity(algname, &compress_index); 183187117650Saalok break; 18327d82f0f8SDina K Nimeh case 'c': 18337d82f0f8SDina K Nimeh /* is the chosen cipher allowed? */ 18347d82f0f8SDina K Nimeh if ((cipher = ciph2mech(optarg)) == NULL) { 18357d82f0f8SDina K Nimeh errflag = B_TRUE; 18367d82f0f8SDina K Nimeh warn(gettext("cipher %s not allowed\n"), 18377d82f0f8SDina K Nimeh optarg); 18387d82f0f8SDina K Nimeh } 18397d82f0f8SDina K Nimeh need_crypto = B_TRUE; 18407d82f0f8SDina K Nimeh /* cipher_only is already set */ 18417d82f0f8SDina K Nimeh break; 18427c478bd9Sstevel@tonic-gate case 'd': 18437d82f0f8SDina K Nimeh deleteflag = B_TRUE; 18447c478bd9Sstevel@tonic-gate minor = name_to_minor(optarg); 18457c478bd9Sstevel@tonic-gate if (minor != 0) 18467c478bd9Sstevel@tonic-gate devicename = optarg; 1847f9153c6bSDina K Nimeh else { 1848f9153c6bSDina K Nimeh if ((filename = realpath(optarg, 1849f9153c6bSDina K Nimeh realfilename)) == NULL) 1850f9153c6bSDina K Nimeh die("%s", optarg); 1851f9153c6bSDina K Nimeh } 18527c478bd9Sstevel@tonic-gate break; 18537d82f0f8SDina K Nimeh case 'e': 18547d82f0f8SDina K Nimeh ephflag = B_TRUE; 18557d82f0f8SDina K Nimeh need_crypto = B_TRUE; 18567d82f0f8SDina K Nimeh cipher_only = B_FALSE; /* need to unset cipher_only */ 18577d82f0f8SDina K Nimeh break; 18583d7072f8Seschrock case 'f': 18593d7072f8Seschrock force = B_TRUE; 18603d7072f8Seschrock break; 18617d82f0f8SDina K Nimeh case 'k': 18627d82f0f8SDina K Nimeh keyfile = optarg; 18637d82f0f8SDina K Nimeh need_crypto = B_TRUE; 18647d82f0f8SDina K Nimeh cipher_only = B_FALSE; /* need to unset cipher_only */ 18657d82f0f8SDina K Nimeh break; 186687117650Saalok case 's': 186787117650Saalok segsize = convert_to_num(optarg); 18684058a205Sjrgn.keil@googlemail.com if (segsize < DEV_BSIZE || !ISP2(segsize)) 186987117650Saalok die(gettext("segment size %s is invalid " 187087117650Saalok "or not a multiple of minimum block " 187187117650Saalok "size %ld\n"), optarg, DEV_BSIZE); 18727d82f0f8SDina K Nimeh break; 18737d82f0f8SDina K Nimeh case 'T': 18747d82f0f8SDina K Nimeh if ((token = parsetoken(optarg)) == NULL) { 18757d82f0f8SDina K Nimeh errflag = B_TRUE; 18767d82f0f8SDina K Nimeh warn( 18777d82f0f8SDina K Nimeh gettext("invalid token key specifier %s\n"), 18787d82f0f8SDina K Nimeh optarg); 18797d82f0f8SDina K Nimeh } 18807d82f0f8SDina K Nimeh need_crypto = B_TRUE; 18817d82f0f8SDina K Nimeh cipher_only = B_FALSE; /* need to unset cipher_only */ 188287117650Saalok break; 188387117650Saalok case 'U': 18847d82f0f8SDina K Nimeh uncompressflag = B_TRUE; 188587117650Saalok break; 18867c478bd9Sstevel@tonic-gate case '?': 18877c478bd9Sstevel@tonic-gate default: 18887d82f0f8SDina K Nimeh errflag = B_TRUE; 18897c478bd9Sstevel@tonic-gate break; 18907c478bd9Sstevel@tonic-gate } 18917c478bd9Sstevel@tonic-gate } 18927d82f0f8SDina K Nimeh 18937d82f0f8SDina K Nimeh /* Check for mutually exclusive combinations of options */ 189487117650Saalok if (errflag || 189587117650Saalok (addflag && deleteflag) || 18967d82f0f8SDina K Nimeh (!addflag && need_crypto) || 189787117650Saalok ((compressflag || uncompressflag) && (addflag || deleteflag))) 18987d82f0f8SDina K Nimeh usage(pname); 18997d82f0f8SDina K Nimeh 19007d82f0f8SDina K Nimeh /* ephemeral key, and key from either file or token are incompatible */ 19017d82f0f8SDina K Nimeh if (ephflag && (keyfile != NULL || token != NULL)) { 19027d82f0f8SDina K Nimeh die(gettext("ephemeral key cannot be used with keyfile" 19037d82f0f8SDina K Nimeh " or token key\n")); 19047d82f0f8SDina K Nimeh } 19057d82f0f8SDina K Nimeh 19067d82f0f8SDina K Nimeh /* 19077d82f0f8SDina K Nimeh * "-c" but no "-k", "-T", "-e", or "-T -k" means derive key from 19087d82f0f8SDina K Nimeh * command line passphrase 19097d82f0f8SDina K Nimeh */ 19107c478bd9Sstevel@tonic-gate 19117c478bd9Sstevel@tonic-gate switch (argc - optind) { 19127c478bd9Sstevel@tonic-gate case 0: /* no more args */ 19137d82f0f8SDina K Nimeh if (compressflag || uncompressflag) /* needs filename */ 19147d82f0f8SDina K Nimeh usage(pname); 19157c478bd9Sstevel@tonic-gate break; 19167d82f0f8SDina K Nimeh case 1: 19177c478bd9Sstevel@tonic-gate if (addflag || deleteflag) 19187d82f0f8SDina K Nimeh usage(pname); 19197d82f0f8SDina K Nimeh /* one arg means compress/uncompress the file ... */ 19207d82f0f8SDina K Nimeh if (compressflag || uncompressflag) { 19217d82f0f8SDina K Nimeh if ((filename = realpath(argv[optind], 19227d82f0f8SDina K Nimeh realfilename)) == NULL) 19237d82f0f8SDina K Nimeh die("%s", argv[optind]); 19247d82f0f8SDina K Nimeh /* ... or without options means print the association */ 19257d82f0f8SDina K Nimeh } else { 19267c478bd9Sstevel@tonic-gate minor = name_to_minor(argv[optind]); 19277c478bd9Sstevel@tonic-gate if (minor != 0) 19287c478bd9Sstevel@tonic-gate devicename = argv[optind]; 1929f9153c6bSDina K Nimeh else { 1930f9153c6bSDina K Nimeh if ((filename = realpath(argv[optind], 1931f9153c6bSDina K Nimeh realfilename)) == NULL) 1932f9153c6bSDina K Nimeh die("%s", argv[optind]); 1933f9153c6bSDina K Nimeh } 19347d82f0f8SDina K Nimeh } 19357c478bd9Sstevel@tonic-gate break; 19367c478bd9Sstevel@tonic-gate default: 19377d82f0f8SDina K Nimeh usage(pname); 19387c478bd9Sstevel@tonic-gate break; 19397c478bd9Sstevel@tonic-gate } 19407c478bd9Sstevel@tonic-gate 19417d82f0f8SDina K Nimeh if (addflag || compressflag || uncompressflag) 19427d82f0f8SDina K Nimeh check_file_validity(filename); 19437d82f0f8SDina K Nimeh 19447c478bd9Sstevel@tonic-gate if (filename && !valid_abspath(filename)) 19457c478bd9Sstevel@tonic-gate exit(E_ERROR); 19467c478bd9Sstevel@tonic-gate 19477c478bd9Sstevel@tonic-gate /* 19487c478bd9Sstevel@tonic-gate * Here, we know the arguments are correct, the filename is an 19497c478bd9Sstevel@tonic-gate * absolute path, it exists and is a regular file. We don't yet 19507c478bd9Sstevel@tonic-gate * know that the device name is ok or not. 19517c478bd9Sstevel@tonic-gate */ 19527d82f0f8SDina K Nimeh 19537c478bd9Sstevel@tonic-gate openflag = O_EXCL; 195487117650Saalok if (addflag || deleteflag || compressflag || uncompressflag) 19557c478bd9Sstevel@tonic-gate openflag |= O_RDWR; 19567c478bd9Sstevel@tonic-gate else 19577c478bd9Sstevel@tonic-gate openflag |= O_RDONLY; 19587c478bd9Sstevel@tonic-gate lfd = open(lofictl, openflag); 19597c478bd9Sstevel@tonic-gate if (lfd == -1) { 19607c478bd9Sstevel@tonic-gate if ((errno == EPERM) || (errno == EACCES)) { 1961f9153c6bSDina K Nimeh die(gettext("you do not have permission to perform " 1962f9153c6bSDina K Nimeh "that operation.\n")); 19637c478bd9Sstevel@tonic-gate } else { 1964f9153c6bSDina K Nimeh die(gettext("open: %s"), lofictl); 19657c478bd9Sstevel@tonic-gate } 19667c478bd9Sstevel@tonic-gate /*NOTREACHED*/ 19677c478bd9Sstevel@tonic-gate } 19687d82f0f8SDina K Nimeh 19697d82f0f8SDina K Nimeh /* 19707d82f0f8SDina K Nimeh * No passphrase is needed for ephemeral key, or when key is 19717d82f0f8SDina K Nimeh * in a file and not wrapped by another key from a token. 19727d82f0f8SDina K Nimeh * However, a passphrase is needed in these cases: 19737d82f0f8SDina K Nimeh * 1. cipher with no ephemeral key, key file, or token, 19747d82f0f8SDina K Nimeh * in which case the passphrase is used to build the key 19757d82f0f8SDina K Nimeh * 2. token with an optional cipher or optional key file, 19767d82f0f8SDina K Nimeh * in which case the passphrase unlocks the token 19777d82f0f8SDina K Nimeh * If only the cipher is specified, reconfirm the passphrase 19787d82f0f8SDina K Nimeh * to ensure the user hasn't mis-entered it. Otherwise, the 19797d82f0f8SDina K Nimeh * token will enforce the token passphrase. 19807d82f0f8SDina K Nimeh */ 19817d82f0f8SDina K Nimeh if (need_crypto) { 19827d82f0f8SDina K Nimeh CK_SESSION_HANDLE sess; 19837d82f0f8SDina K Nimeh 19847d82f0f8SDina K Nimeh /* pick a cipher if none specified */ 19857d82f0f8SDina K Nimeh if (cipher == NULL) 19867d82f0f8SDina K Nimeh cipher = DEFAULT_CIPHER; 19877d82f0f8SDina K Nimeh 19887d82f0f8SDina K Nimeh if (!kernel_cipher_check(cipher)) 19897d82f0f8SDina K Nimeh die(gettext( 19907d82f0f8SDina K Nimeh "use \"cryptoadm list -m\" to find available " 19917d82f0f8SDina K Nimeh "mechanisms\n")); 19927d82f0f8SDina K Nimeh 19937d82f0f8SDina K Nimeh init_crypto(token, cipher, &sess); 19947d82f0f8SDina K Nimeh 19957d82f0f8SDina K Nimeh if (cipher_only) { 19967d82f0f8SDina K Nimeh getkeyfromuser(cipher, &rkey, &rksz); 19977d82f0f8SDina K Nimeh } else if (token != NULL) { 19987d82f0f8SDina K Nimeh getkeyfromtoken(sess, token, keyfile, cipher, 19997d82f0f8SDina K Nimeh &rkey, &rksz); 20007d82f0f8SDina K Nimeh } else { 20017d82f0f8SDina K Nimeh /* this also handles ephemeral keys */ 20027d82f0f8SDina K Nimeh getkeyfromfile(keyfile, cipher, &rkey, &rksz); 20037d82f0f8SDina K Nimeh } 20047d82f0f8SDina K Nimeh 20057d82f0f8SDina K Nimeh end_crypto(sess); 20067d82f0f8SDina K Nimeh } 20077d82f0f8SDina K Nimeh 20087d82f0f8SDina K Nimeh /* 20097d82f0f8SDina K Nimeh * Now to the real work. 20107d82f0f8SDina K Nimeh */ 20117c478bd9Sstevel@tonic-gate if (addflag) 20127d82f0f8SDina K Nimeh add_mapping(lfd, devicename, filename, cipher, rkey, rksz); 201387117650Saalok else if (compressflag) 20149525893dSaalok lofi_compress(&lfd, filename, compress_index, segsize); 201587117650Saalok else if (uncompressflag) 201687117650Saalok lofi_uncompress(lfd, filename); 20177c478bd9Sstevel@tonic-gate else if (deleteflag) 20183d7072f8Seschrock delete_mapping(lfd, devicename, filename, force); 20197c478bd9Sstevel@tonic-gate else if (filename || devicename) 20207c478bd9Sstevel@tonic-gate print_one_mapping(lfd, devicename, filename); 20217c478bd9Sstevel@tonic-gate else 20227c478bd9Sstevel@tonic-gate print_mappings(lfd); 2023579df0adSaalok 20249525893dSaalok if (lfd != -1) 20257c478bd9Sstevel@tonic-gate (void) close(lfd); 2026579df0adSaalok closelib(); 20277c478bd9Sstevel@tonic-gate return (E_SUCCESS); 20287c478bd9Sstevel@tonic-gate } 2029