1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
23 */
24
25
26 #include <fcntl.h>
27 #include <stdio.h>
28 #include <stdlib.h>
29 #include <strings.h>
30 #include <unistd.h>
31 #include <locale.h>
32 #include <libgen.h>
33 #include <sys/types.h>
34 #include <zone.h>
35 #include <sys/crypto/ioctladmin.h>
36 #include <cryptoutil.h>
37 #include "cryptoadm.h"
38
39 #define REQ_ARG_CNT 2
40
41 /* subcommand index */
42 enum subcommand_index {
43 CRYPTO_LIST,
44 CRYPTO_DISABLE,
45 CRYPTO_ENABLE,
46 CRYPTO_INSTALL,
47 CRYPTO_UNINSTALL,
48 CRYPTO_UNLOAD,
49 CRYPTO_REFRESH,
50 CRYPTO_START,
51 CRYPTO_STOP,
52 CRYPTO_HELP };
53
54 /*
55 * TRANSLATION_NOTE
56 * Command keywords are not to be translated.
57 */
58 static char *cmd_table[] = {
59 "list",
60 "disable",
61 "enable",
62 "install",
63 "uninstall",
64 "unload",
65 "refresh",
66 "start",
67 "stop",
68 "--help" };
69
70 /* provider type */
71 enum provider_type_index {
72 PROV_UEF_LIB,
73 PROV_KEF_SOFT,
74 PROV_KEF_HARD,
75 METASLOT,
76 PROV_BADNAME };
77
78 typedef struct {
79 char cp_name[MAXPATHLEN];
80 enum provider_type_index cp_type;
81 } cryptoadm_provider_t;
82
83 /*
84 * TRANSLATION_NOTE
85 * Operand keywords are not to be translated.
86 */
87 static const char *KN_PROVIDER = "provider=";
88 static const char *KN_MECH = "mechanism=";
89 static const char *KN_ALL = "all";
90 static const char *KN_TOKEN = "token=";
91 static const char *KN_SLOT = "slot=";
92 static const char *KN_DEFAULT_KS = "default-keystore";
93 static const char *KN_AUTO_KEY_MIGRATE = "auto-key-migrate";
94
95 /* static variables */
96 static boolean_t allflag = B_FALSE;
97 static boolean_t rndflag = B_FALSE;
98 static mechlist_t *mecharglist = NULL;
99
100 /* static functions */
101 static void usage(void);
102 static int get_provider_type(char *);
103 static int process_mech_operands(int, char **, boolean_t);
104 static int do_list(int, char **);
105 static int do_disable(int, char **);
106 static int do_enable(int, char **);
107 static int do_install(int, char **);
108 static int do_uninstall(int, char **);
109 static int do_unload(int, char **);
110 static int do_refresh(int);
111 static int do_start(int);
112 static int do_stop(int);
113 static int list_simple_for_all(boolean_t);
114 static int list_mechlist_for_all(boolean_t);
115 static int list_policy_for_all(void);
116
117 int
118 main(int argc, char *argv[])
119 {
120 char *subcmd;
121 int cmdnum;
122 int cmd_index = 0;
123 int rc = SUCCESS;
124
125 (void) setlocale(LC_ALL, "");
126
127 #if !defined(TEXT_DOMAIN) /* Should be defined by cc -D */
128 #define TEXT_DOMAIN "SYS_TEST" /* Use this only if it weren't */
129 #endif
130 (void) textdomain(TEXT_DOMAIN);
131
132 cryptodebug_init(basename(argv[0]));
133
134 if (argc < REQ_ARG_CNT) {
135 usage();
136 return (ERROR_USAGE);
137 }
138
139 /* get the subcommand index */
140 cmd_index = 0;
141 subcmd = argv[1];
142 cmdnum = sizeof (cmd_table)/sizeof (cmd_table[0]);
143
144 while ((cmd_index < cmdnum) &&
145 (strcmp(subcmd, cmd_table[cmd_index]) != 0)) {
146 cmd_index++;
147 }
148 if (cmd_index >= cmdnum) {
149 usage();
150 return (ERROR_USAGE);
151 }
152
153 /* do the subcommand */
154 switch (cmd_index) {
155 case CRYPTO_LIST:
156 rc = do_list(argc, argv);
157 break;
158 case CRYPTO_DISABLE:
159 rc = do_disable(argc, argv);
160 break;
161 case CRYPTO_ENABLE:
162 rc = do_enable(argc, argv);
163 break;
164 case CRYPTO_INSTALL:
165 rc = do_install(argc, argv);
166 break;
167 case CRYPTO_UNINSTALL:
168 rc = do_uninstall(argc, argv);
169 break;
170 case CRYPTO_UNLOAD:
171 rc = do_unload(argc, argv);
172 break;
173 case CRYPTO_REFRESH:
174 rc = do_refresh(argc);
175 break;
176 case CRYPTO_START:
177 rc = do_start(argc);
178 break;
179 case CRYPTO_STOP:
180 rc = do_stop(argc);
181 break;
182 case CRYPTO_HELP:
183 usage();
184 rc = SUCCESS;
185 break;
186 default: /* should not come here */
187 usage();
188 rc = ERROR_USAGE;
189 break;
190 }
191 return (rc);
192 }
193
194
195 static void
196 usage(void)
197 {
198 /*
199 * TRANSLATION_NOTE
200 * Command usage is not to be translated. Only the word "Usage:"
201 * along with localized expressions indicating what kind of value
202 * is expected for arguments.
203 */
204 (void) fprintf(stderr, gettext("Usage:\n"));
205 (void) fprintf(stderr,
206 " cryptoadm list [-mpv] [provider=<%s> | metaslot]"
207 " [mechanism=<%s>]\n",
208 gettext("provider-name"), gettext("mechanism-list"));
209 (void) fprintf(stderr,
210 " cryptoadm disable provider=<%s>"
211 " mechanism=<%s> | random | all\n",
212 gettext("provider-name"), gettext("mechanism-list"));
213 (void) fprintf(stderr,
214 " cryptoadm disable metaslot"
215 " [auto-key-migrate] [mechanism=<%s>]\n",
216 gettext("mechanism-list"));
217 (void) fprintf(stderr,
218 " cryptoadm enable provider=<%s>"
219 " mechanism=<%s> | random | all\n",
220 gettext("provider-name"), gettext("mechanism-list"));
221 (void) fprintf(stderr,
222 " cryptoadm enable metaslot [mechanism=<%s>]"
223 " [[token=<%s>] [slot=<%s>]"
224 " | [default-keystore]] | [auto-key-migrate]\n",
225 gettext("mechanism-list"), gettext("token-label"),
226 gettext("slot-description"));
227 (void) fprintf(stderr,
228 " cryptoadm install provider=<%s>\n",
229 gettext("provider-name"));
230 (void) fprintf(stderr,
231 " cryptoadm install provider=<%s> [mechanism=<%s>]\n",
232 gettext("provider-name"), gettext("mechanism-list"));
233 (void) fprintf(stderr,
234 " cryptoadm uninstall provider=<%s>\n",
235 gettext("provider-name"));
236 (void) fprintf(stderr,
237 " cryptoadm unload provider=<%s>\n",
238 gettext("provider-name"));
239 (void) fprintf(stderr,
240 " cryptoadm refresh\n"
241 " cryptoadm start\n"
242 " cryptoadm stop\n"
243 " cryptoadm --help\n");
244 }
245
246
247 /*
248 * Get the provider type. This function returns
249 * - PROV_UEF_LIB if provname contains an absolute path name
250 * - PROV_KEF_SOFT if provname is a base name only (e.g., "aes").
251 * - PROV_KEF_HARD if provname contains one slash only and the slash is not
252 * the 1st character (e.g., "mca/0").
253 * - PROV_BADNAME otherwise.
254 */
255 static int
256 get_provider_type(char *provname)
257 {
258 char *pslash1;
259 char *pslash2;
260
261 if (provname == NULL) {
262 return (FAILURE);
263 }
264
265 if (provname[0] == '/') {
266 return (PROV_UEF_LIB);
267 } else if ((pslash1 = strchr(provname, SEP_SLASH)) == NULL) {
268 /* no slash */
269 return (PROV_KEF_SOFT);
270 } else {
271 pslash2 = strrchr(provname, SEP_SLASH);
272 if (pslash1 == pslash2) {
273 return (PROV_KEF_HARD);
274 } else {
275 return (PROV_BADNAME);
276 }
277 }
278 }
279
280 /*
281 * Get the provider structure. This function returns NULL if no valid
282 * provider= is found in argv[], otherwise a cryptoadm_provider_t is returned.
283 * If provider= is found but has no argument, then a cryptoadm_provider_t
284 * with cp_type = PROV_BADNAME is returned.
285 */
286 static cryptoadm_provider_t *
287 get_provider(int argc, char **argv)
288 {
289 int c = 0;
290 boolean_t found = B_FALSE;
291 cryptoadm_provider_t *provider = NULL;
292 char *provstr = NULL, *savstr;
293 boolean_t is_metaslot = B_FALSE;
294
295 while (!found && ++c < argc) {
296 if (strncmp(argv[c], METASLOT_KEYWORD,
297 strlen(METASLOT_KEYWORD)) == 0) {
298 is_metaslot = B_TRUE;
299 found = B_TRUE;
300 } else if (strncmp(argv[c], KN_PROVIDER,
301 strlen(KN_PROVIDER)) == 0 &&
302 strlen(argv[c]) > strlen(KN_PROVIDER)) {
303 if ((provstr = strdup(argv[c])) == NULL) {
304 int err = errno;
305 /*
306 * TRANSLATION_NOTE
307 * "get_provider" is a function name and should
308 * not be translated.
309 */
310 cryptoerror(LOG_STDERR, "get_provider: %s.",
311 strerror(err));
312 return (NULL);
313 }
314 found = B_TRUE;
315 }
316 }
317 if (!found)
318 return (NULL);
319
320 provider = malloc(sizeof (cryptoadm_provider_t));
321 if (provider == NULL) {
322 cryptoerror(LOG_STDERR, gettext("out of memory."));
323 if (provstr) {
324 free(provstr);
325 }
326 return (NULL);
327 }
328
329 if (is_metaslot) {
330 (void) strlcpy(provider->cp_name, METASLOT_KEYWORD,
331 strlen(METASLOT_KEYWORD));
332 provider->cp_type = METASLOT;
333 } else {
334
335 savstr = provstr;
336 (void) strtok(provstr, "=");
337 provstr = strtok(NULL, "=");
338 if (provstr == NULL) {
339 cryptoerror(LOG_STDERR, gettext("bad provider name."));
340 provider->cp_type = PROV_BADNAME;
341 free(savstr);
342 return (provider);
343 }
344
345 (void) strlcpy(provider->cp_name, provstr,
346 sizeof (provider->cp_name));
347 provider->cp_type = get_provider_type(provider->cp_name);
348
349 free(savstr);
350 }
351 return (provider);
352 }
353
354 /*
355 * Process the "feature" operands.
356 *
357 * "argc" and "argv" contain values specified on the command line.
358 * All other arguments are used for returning parsing results.
359 * If any of these arguments are NULL, that keyword is not expected,
360 * and FAILURE will be returned.
361 */
362 static int
363 process_metaslot_operands(int argc, char **argv, char **meta_ks_token,
364 char **meta_ks_slot, boolean_t *use_default,
365 boolean_t *auto_key_migrate_flag)
366 {
367 int c = 2;
368 int rc = SUCCESS;
369
370 while (++c < argc) {
371 if ((strncmp(argv[c], KN_MECH, strlen(KN_MECH)) == 0) &&
372 strlen(argv[c]) > strlen(KN_MECH)) {
373
374 /* process mechanism operands */
375 if ((rc = process_mech_operands(argc, argv, B_TRUE))
376 != SUCCESS) {
377 goto finish;
378 }
379
380 } else if ((strncmp(argv[c], KN_TOKEN,
381 strlen(KN_TOKEN)) == 0) &&
382 strlen(argv[c]) > strlen(KN_TOKEN)) {
383 if ((meta_ks_token) && (strtok(argv[c], "=") != NULL)) {
384 char *tmp;
385 if ((tmp = strtok(NULL, "=")) != NULL) {
386 *meta_ks_token = strdup(tmp);
387 } else {
388 return (FAILURE);
389 }
390 } else {
391 return (FAILURE);
392 }
393
394 } else if ((strncmp(argv[c], KN_SLOT,
395 strlen(KN_SLOT)) == 0) &&
396 strlen(argv[c]) > strlen(KN_SLOT)) {
397
398 if ((meta_ks_slot) && (strtok(argv[c], "=") != NULL)) {
399 char *tmp;
400 if ((tmp = strtok(NULL, "=")) != NULL) {
401 *meta_ks_slot = strdup(tmp);
402 } else {
403 return (FAILURE);
404 }
405 } else {
406 return (FAILURE);
407 }
408
409 } else if (strncmp(argv[c], KN_DEFAULT_KS,
410 strlen(KN_DEFAULT_KS)) == 0) {
411
412 if (use_default) {
413 *use_default = B_TRUE;
414 } else {
415 return (FAILURE);
416 }
417 } else if (strncmp(argv[c], KN_AUTO_KEY_MIGRATE,
418 strlen(KN_AUTO_KEY_MIGRATE)) == 0) {
419
420 if (auto_key_migrate_flag) {
421 *auto_key_migrate_flag = B_TRUE;
422 } else {
423 return (FAILURE);
424 }
425 } else {
426 return (FAILURE);
427 }
428 }
429 finish:
430 return (rc);
431 }
432
433 /*
434 * Process the "feature" operands.
435 */
436 static int
437 process_feature_operands(int argc, char **argv)
438 {
439 int c = 2;
440
441 while (++c < argc) {
442 if (strcmp(argv[c], KN_ALL) == 0) {
443 allflag = B_TRUE;
444 rndflag = B_TRUE; /* all includes random also. */
445 } else if (strcmp(argv[c], RANDOM) == 0) {
446 rndflag = B_TRUE;
447 }
448 }
449 return (SUCCESS);
450 }
451
452 /*
453 * Process the mechanism operands for the disable, enable and install
454 * subcommands. This function sets the static variable allflag to be B_TRUE
455 * if the keyword "all" is specified, otherwise builds a link list of the
456 * mechanism operands and save it in the static variable mecharglist.
457 *
458 * This function returns
459 * ERROR_USAGE: mechanism operand is missing.
460 * FAILURE: out of memory.
461 * SUCCESS: otherwise.
462 */
463 static int
464 process_mech_operands(int argc, char **argv, boolean_t quiet)
465 {
466 mechlist_t *pmech;
467 mechlist_t *pcur = NULL;
468 mechlist_t *phead = NULL;
469 boolean_t found = B_FALSE;
470 char *mechliststr = NULL;
471 char *curmech = NULL;
472 int c = -1;
473 int rc = SUCCESS;
474
475 while (!found && ++c < argc) {
476 if ((strncmp(argv[c], KN_MECH, strlen(KN_MECH)) == 0) &&
477 strlen(argv[c]) > strlen(KN_MECH)) {
478 found = B_TRUE;
479 }
480 }
481 if (!found) {
482 if (!quiet)
483 /*
484 * TRANSLATION_NOTE
485 * "mechanism" could be either a literal keyword
486 * and hence not to be translated, or a descriptive
487 * word and translatable. A choice was made to
488 * view it as a literal keyword.
489 */
490 cryptoerror(LOG_STDERR,
491 gettext("the %s operand is missing.\n"),
492 "mechanism");
493 return (ERROR_USAGE);
494 }
495 (void) strtok(argv[c], "=");
496 mechliststr = strtok(NULL, "=");
497
498 if (strcmp(mechliststr, "all") == 0) {
499 allflag = B_TRUE;
500 mecharglist = NULL;
501 return (SUCCESS);
502 }
503
504 curmech = strtok(mechliststr, ",");
505 do {
506 if ((pmech = create_mech(curmech)) == NULL) {
507 rc = FAILURE;
508 break;
509 } else {
510 if (phead == NULL) {
511 phead = pcur = pmech;
512 } else {
513 pcur->next = pmech;
514 pcur = pmech;
515 }
516 }
517 } while ((curmech = strtok(NULL, ",")) != NULL);
518
519 if (rc == FAILURE) {
520 cryptoerror(LOG_STDERR, gettext("out of memory."));
521 free_mechlist(phead);
522 } else {
523 mecharglist = phead;
524 rc = SUCCESS;
525 }
526 return (rc);
527 }
528
529
530
531 /*
532 * The top level function for the "cryptoadm list" subcommand and options.
533 */
534 static int
535 do_list(int argc, char **argv)
536 {
537 boolean_t mflag = B_FALSE;
538 boolean_t pflag = B_FALSE;
539 boolean_t vflag = B_FALSE;
540 char ch;
541 cryptoadm_provider_t *prov = NULL;
542 int rc = SUCCESS;
543
544 argc -= 1;
545 argv += 1;
546
547 if (argc == 1) {
548 rc = list_simple_for_all(B_FALSE);
549 goto out;
550 }
551
552 /*
553 * cryptoadm list [-v] [-m] [-p] [provider=<>] [mechanism=<>]
554 */
555 if (argc > 5) {
556 usage();
557 return (rc);
558 }
559
560 while ((ch = getopt(argc, argv, "mpv")) != EOF) {
561 switch (ch) {
562 case 'm':
563 mflag = B_TRUE;
564 if (pflag) {
565 rc = ERROR_USAGE;
566 }
567 break;
568 case 'p':
569 pflag = B_TRUE;
570 if (mflag || vflag) {
571 rc = ERROR_USAGE;
572 }
573 break;
574 case 'v':
575 vflag = B_TRUE;
576 if (pflag)
577 rc = ERROR_USAGE;
578 break;
579 default:
580 rc = ERROR_USAGE;
581 break;
582 }
583 }
584
585 if (rc == ERROR_USAGE) {
586 usage();
587 return (rc);
588 }
589
590 if ((rc = process_feature_operands(argc, argv)) != SUCCESS) {
591 goto out;
592 }
593
594 prov = get_provider(argc, argv);
595
596 if (mflag || vflag) {
597 if (argc > 0) {
598 rc = process_mech_operands(argc, argv, B_TRUE);
599 if (rc == FAILURE)
600 goto out;
601 /* "-m" is implied when a mechanism list is given */
602 if (mecharglist != NULL || allflag)
603 mflag = B_TRUE;
604 }
605 }
606
607 if (prov == NULL) {
608 if (mflag) {
609 rc = list_mechlist_for_all(vflag);
610 } else if (pflag) {
611 rc = list_policy_for_all();
612 } else if (vflag) {
613 rc = list_simple_for_all(vflag);
614 }
615 } else if (prov->cp_type == METASLOT) {
616 if ((!mflag) && (!vflag) && (!pflag)) {
617 /* no flag is specified, just list metaslot status */
618 rc = list_metaslot_info(mflag, vflag, mecharglist);
619 } else if (mflag || vflag) {
620 rc = list_metaslot_info(mflag, vflag, mecharglist);
621 } else if (pflag) {
622 rc = list_metaslot_policy();
623 } else {
624 /* error message */
625 usage();
626 rc = ERROR_USAGE;
627 }
628 } else if (prov->cp_type == PROV_BADNAME) {
629 usage();
630 rc = ERROR_USAGE;
631 goto out;
632 } else { /* do the listing for a provider only */
633 char *provname = prov->cp_name;
634
635 if (mflag || vflag) {
636 if (vflag)
637 (void) printf(gettext("Provider: %s\n"),
638 provname);
639 switch (prov->cp_type) {
640 case PROV_UEF_LIB:
641 rc = list_mechlist_for_lib(provname,
642 mecharglist, NULL, B_FALSE, vflag, mflag);
643 break;
644 case PROV_KEF_SOFT:
645 rc = list_mechlist_for_soft(provname,
646 NULL, NULL);
647 break;
648 case PROV_KEF_HARD:
649 rc = list_mechlist_for_hard(provname);
650 break;
651 default: /* should not come here */
652 rc = FAILURE;
653 break;
654 }
655 } else if (pflag) {
656 switch (prov->cp_type) {
657 case PROV_UEF_LIB:
658 rc = list_policy_for_lib(provname);
659 break;
660 case PROV_KEF_SOFT:
661 if (getzoneid() == GLOBAL_ZONEID) {
662 rc = list_policy_for_soft(provname,
663 NULL, NULL);
664 } else {
665 /*
666 * TRANSLATION_NOTE
667 * "global" is keyword and not to
668 * be translated.
669 */
670 cryptoerror(LOG_STDERR, gettext(
671 "policy information for kernel "
672 "providers is available "
673 "in the %s zone only"), "global");
674 rc = FAILURE;
675 }
676 break;
677 case PROV_KEF_HARD:
678 if (getzoneid() == GLOBAL_ZONEID) {
679 rc = list_policy_for_hard(
680 provname, NULL, NULL, NULL);
681 } else {
682 /*
683 * TRANSLATION_NOTE
684 * "global" is keyword and not to
685 * be translated.
686 */
687 cryptoerror(LOG_STDERR, gettext(
688 "policy information for kernel "
689 "providers is available "
690 "in the %s zone only"), "global");
691 rc = FAILURE;
692 }
693
694 break;
695 default: /* should not come here */
696 rc = FAILURE;
697 break;
698 }
699 } else {
700 /* error message */
701 usage();
702 rc = ERROR_USAGE;
703 }
704 }
705
706 out:
707 if (prov != NULL)
708 free(prov);
709
710 if (mecharglist != NULL)
711 free_mechlist(mecharglist);
712 return (rc);
713 }
714
715
716 /*
717 * The top level function for the "cryptoadm disable" subcommand.
718 */
719 static int
720 do_disable(int argc, char **argv)
721 {
722 cryptoadm_provider_t *prov = NULL;
723 int rc = SUCCESS;
724 boolean_t auto_key_migrate_flag = B_FALSE;
725
726 if ((argc < 3) || (argc > 5)) {
727 usage();
728 return (ERROR_USAGE);
729 }
730
731 prov = get_provider(argc, argv);
732 if (prov == NULL) {
733 usage();
734 return (ERROR_USAGE);
735 }
736 if (prov->cp_type == PROV_BADNAME) {
737 return (FAILURE);
738 }
739
740 if ((rc = process_feature_operands(argc, argv)) != SUCCESS) {
741 goto out;
742 }
743
744 /*
745 * If allflag or rndflag has already been set there is no reason to
746 * process mech=
747 */
748 if (prov->cp_type == METASLOT) {
749 if ((argc > 3) &&
750 (rc = process_metaslot_operands(argc, argv,
751 NULL, NULL, NULL, &auto_key_migrate_flag)) != SUCCESS) {
752 usage();
753 return (rc);
754 }
755 } else if (!allflag && !rndflag &&
756 (rc = process_mech_operands(argc, argv, B_FALSE)) != SUCCESS) {
757 return (rc);
758 }
759
760 switch (prov->cp_type) {
761 case METASLOT:
762 rc = disable_metaslot(mecharglist, allflag,
763 auto_key_migrate_flag);
764 break;
765 case PROV_UEF_LIB:
766 rc = disable_uef_lib(prov->cp_name, rndflag, allflag,
767 mecharglist);
768 break;
769 case PROV_KEF_SOFT:
770 if (rndflag && !allflag) {
771 if ((mecharglist = create_mech(RANDOM)) == NULL) {
772 rc = FAILURE;
773 break;
774 }
775 }
776 if (getzoneid() == GLOBAL_ZONEID) {
777 rc = disable_kef_software(prov->cp_name, rndflag,
778 allflag, mecharglist);
779 } else {
780 /*
781 * TRANSLATION_NOTE
782 * "disable" could be either a literal keyword
783 * and hence not to be translated, or a verb and
784 * translatable. A choice was made to view it as
785 * a literal keyword. "global" is keyword and not
786 * to be translated.
787 */
788 cryptoerror(LOG_STDERR, gettext("%1$s for kernel "
789 "providers is supported in the %2$s zone only"),
790 "disable", "global");
791 rc = FAILURE;
792 }
793 break;
794 case PROV_KEF_HARD:
795 if (rndflag && !allflag) {
796 if ((mecharglist = create_mech(RANDOM)) == NULL) {
797 rc = FAILURE;
798 break;
799 }
800 }
801 if (getzoneid() == GLOBAL_ZONEID) {
802 rc = disable_kef_hardware(prov->cp_name, rndflag,
803 allflag, mecharglist);
804 } else {
805 /*
806 * TRANSLATION_NOTE
807 * "disable" could be either a literal keyword
808 * and hence not to be translated, or a verb and
809 * translatable. A choice was made to view it as
810 * a literal keyword. "global" is keyword and not
811 * to be translated.
812 */
813 cryptoerror(LOG_STDERR, gettext("%1$s for kernel "
814 "providers is supported in the %2$s zone only"),
815 "disable", "global");
816 rc = FAILURE;
817 }
818 break;
819 default: /* should not come here */
820 rc = FAILURE;
821 break;
822 }
823
824 out:
825 free(prov);
826 if (mecharglist != NULL) {
827 free_mechlist(mecharglist);
828 }
829 return (rc);
830 }
831
832
833 /*
834 * The top level function for the "cryptoadm enable" subcommand.
835 */
836 static int
837 do_enable(int argc, char **argv)
838 {
839 cryptoadm_provider_t *prov = NULL;
840 int rc = SUCCESS;
841 char *alt_token = NULL, *alt_slot = NULL;
842 boolean_t use_default = B_FALSE;
843 boolean_t auto_key_migrate_flag = B_FALSE;
844
845 if ((argc < 3) || (argc > 6)) {
846 usage();
847 return (ERROR_USAGE);
848 }
849
850 prov = get_provider(argc, argv);
851 if (prov == NULL) {
852 usage();
853 return (ERROR_USAGE);
854 }
855 if ((prov->cp_type != METASLOT) && (argc != 4)) {
856 usage();
857 return (ERROR_USAGE);
858 }
859 if (prov->cp_type == PROV_BADNAME) {
860 rc = FAILURE;
861 goto out;
862 }
863
864
865 if (prov->cp_type == METASLOT) {
866 if ((rc = process_metaslot_operands(argc, argv, &alt_token,
867 &alt_slot, &use_default, &auto_key_migrate_flag))
868 != SUCCESS) {
869 usage();
870 goto out;
871 }
872 if ((alt_slot || alt_token) && use_default) {
873 usage();
874 rc = FAILURE;
875 goto out;
876 }
877 } else {
878 if ((rc = process_feature_operands(argc, argv)) != SUCCESS) {
879 goto out;
880 }
881
882 /*
883 * If allflag or rndflag has already been set there is
884 * no reason to process mech=
885 */
886 if (!allflag && !rndflag &&
887 (rc = process_mech_operands(argc, argv, B_FALSE))
888 != SUCCESS) {
889 goto out;
890 }
891 }
892
893 switch (prov->cp_type) {
894 case METASLOT:
895 rc = enable_metaslot(alt_token, alt_slot, use_default,
896 mecharglist, allflag, auto_key_migrate_flag);
897 break;
898 case PROV_UEF_LIB:
899 rc = enable_uef_lib(prov->cp_name, rndflag, allflag,
900 mecharglist);
901 break;
902 case PROV_KEF_SOFT:
903 case PROV_KEF_HARD:
904 if (rndflag && !allflag) {
905 if ((mecharglist = create_mech(RANDOM)) == NULL) {
906 rc = FAILURE;
907 break;
908 }
909 }
910 if (getzoneid() == GLOBAL_ZONEID) {
911 rc = enable_kef(prov->cp_name, rndflag, allflag,
912 mecharglist);
913 } else {
914 /*
915 * TRANSLATION_NOTE
916 * "enable" could be either a literal keyword
917 * and hence not to be translated, or a verb and
918 * translatable. A choice was made to view it as
919 * a literal keyword. "global" is keyword and not
920 * to be translated.
921 */
922 cryptoerror(LOG_STDERR, gettext("%1$s for kernel "
923 "providers is supported in the %2$s zone only"),
924 "enable", "global");
925 rc = FAILURE;
926 }
927 break;
928 default: /* should not come here */
929 rc = FAILURE;
930 break;
931 }
932 out:
933 free(prov);
934 if (mecharglist != NULL) {
935 free_mechlist(mecharglist);
936 }
937 if (alt_token != NULL) {
938 free(alt_token);
939 }
940 if (alt_slot != NULL) {
941 free(alt_slot);
942 }
943 return (rc);
944 }
945
946
947
948 /*
949 * The top level function for the "cryptoadm install" subcommand.
950 */
951 static int
952 do_install(int argc, char **argv)
953 {
954 cryptoadm_provider_t *prov = NULL;
955 int rc;
956
957 if (argc < 3) {
958 usage();
959 return (ERROR_USAGE);
960 }
961
962 prov = get_provider(argc, argv);
963 if (prov == NULL ||
964 prov->cp_type == PROV_BADNAME || prov->cp_type == PROV_KEF_HARD) {
965 /*
966 * TRANSLATION_NOTE
967 * "install" could be either a literal keyword and hence
968 * not to be translated, or a verb and translatable. A
969 * choice was made to view it as a literal keyword.
970 */
971 cryptoerror(LOG_STDERR,
972 gettext("bad provider name for %s."), "install");
973 rc = FAILURE;
974 goto out;
975 }
976
977 if (prov->cp_type == PROV_UEF_LIB) {
978 rc = install_uef_lib(prov->cp_name);
979 goto out;
980 }
981
982 /* It is the PROV_KEF_SOFT type now */
983
984 /* check if there are mechanism operands */
985 if (argc < 4) {
986 /*
987 * TRANSLATION_NOTE
988 * "mechanism" could be either a literal keyword and hence
989 * not to be translated, or a descriptive word and
990 * translatable. A choice was made to view it as a literal
991 * keyword.
992 */
993 cryptoerror(LOG_STDERR,
994 gettext("need %s operands for installing a"
995 " kernel software provider."), "mechanism");
996 rc = ERROR_USAGE;
997 goto out;
998 }
999
1000 if ((rc = process_mech_operands(argc, argv, B_FALSE)) != SUCCESS) {
1001 goto out;
1002 }
1003
1004 if (allflag == B_TRUE) {
1005 /*
1006 * TRANSLATION_NOTE
1007 * "all", "mechanism", and "install" are all keywords and
1008 * not to be translated.
1009 */
1010 cryptoerror(LOG_STDERR,
1011 gettext("can not use the %1$s keyword for %2$s "
1012 "in the %3$s subcommand."), "all", "mechanism", "install");
1013 rc = ERROR_USAGE;
1014 goto out;
1015 }
1016
1017 if (getzoneid() == GLOBAL_ZONEID) {
1018 rc = install_kef(prov->cp_name, mecharglist);
1019 } else {
1020 /*
1021 * TRANSLATION_NOTE
1022 * "install" could be either a literal keyword and hence
1023 * not to be translated, or a verb and translatable. A
1024 * choice was made to view it as a literal keyword.
1025 * "global" is keyword and not to be translated.
1026 */
1027 cryptoerror(LOG_STDERR, gettext("%1$s for kernel providers "
1028 "is supported in the %2$s zone only"), "install", "global");
1029 rc = FAILURE;
1030 }
1031 out:
1032 free(prov);
1033 return (rc);
1034 }
1035
1036
1037
1038 /*
1039 * The top level function for the "cryptoadm uninstall" subcommand.
1040 */
1041 static int
1042 do_uninstall(int argc, char **argv)
1043 {
1044 cryptoadm_provider_t *prov = NULL;
1045 int rc = SUCCESS;
1046
1047 if (argc != 3) {
1048 usage();
1049 return (ERROR_USAGE);
1050 }
1051
1052 prov = get_provider(argc, argv);
1053 if (prov == NULL ||
1054 prov->cp_type == PROV_BADNAME || prov->cp_type == PROV_KEF_HARD) {
1055 /*
1056 * TRANSLATION_NOTE
1057 * "uninstall" could be either a literal keyword and hence
1058 * not to be translated, or a verb and translatable. A
1059 * choice was made to view it as a literal keyword.
1060 */
1061 cryptoerror(LOG_STDERR,
1062 gettext("bad provider name for %s."), "uninstall");
1063 free(prov);
1064 return (FAILURE);
1065 }
1066
1067 if (prov->cp_type == PROV_UEF_LIB) {
1068 rc = uninstall_uef_lib(prov->cp_name);
1069
1070 } else if (prov->cp_type == PROV_KEF_SOFT) {
1071 if (getzoneid() == GLOBAL_ZONEID) {
1072 /* unload and remove from kcf.conf */
1073 rc = uninstall_kef(prov->cp_name);
1074 } else {
1075 /*
1076 * TRANSLATION_NOTE
1077 * "uninstall" could be either a literal keyword and
1078 * hence not to be translated, or a verb and
1079 * translatable. A choice was made to view it as a
1080 * literal keyword. "global" is keyword and not to
1081 * be translated.
1082 */
1083 cryptoerror(LOG_STDERR, gettext("%1$s for kernel "
1084 "providers is supported in the %2$s zone only"),
1085 "uninstall", "global");
1086 rc = FAILURE;
1087 }
1088 }
1089
1090 free(prov);
1091 return (rc);
1092 }
1093
1094
1095 /*
1096 * The top level function for the "cryptoadm unload" subcommand.
1097 */
1098 static int
1099 do_unload(int argc, char **argv)
1100 {
1101 cryptoadm_provider_t *prov = NULL;
1102 entry_t *pent = NULL;
1103 boolean_t in_kernel = B_FALSE;
1104 int rc = SUCCESS;
1105 char *provname = NULL;
1106
1107 if (argc != 3) {
1108 usage();
1109 return (ERROR_USAGE);
1110 }
1111
1112 /* check if it is a kernel software provider */
1113 prov = get_provider(argc, argv);
1114 if (prov == NULL) {
1115 cryptoerror(LOG_STDERR,
1116 gettext("unable to determine provider name."));
1117 goto out;
1118 }
1119 provname = prov->cp_name;
1120 if (prov->cp_type != PROV_KEF_SOFT) {
1121 cryptoerror(LOG_STDERR,
1122 gettext("%s is not a valid kernel software provider."),
1123 provname);
1124 rc = FAILURE;
1125 goto out;
1126 }
1127
1128 if (getzoneid() != GLOBAL_ZONEID) {
1129 /*
1130 * TRANSLATION_NOTE
1131 * "unload" could be either a literal keyword and hence
1132 * not to be translated, or a verb and translatable.
1133 * A choice was made to view it as a literal keyword.
1134 * "global" is keyword and not to be translated.
1135 */
1136 cryptoerror(LOG_STDERR, gettext("%1$s for kernel providers "
1137 "is supported in the %2$s zone only"), "unload", "global");
1138 rc = FAILURE;
1139 goto out;
1140 }
1141
1142 if (check_kernel_for_soft(provname, NULL, &in_kernel) == FAILURE) {
1143 cryptodebug("internal error");
1144 rc = FAILURE;
1145 goto out;
1146 } else if (in_kernel == B_FALSE) {
1147 cryptoerror(LOG_STDERR,
1148 gettext("provider %s is not loaded or does not exist."),
1149 provname);
1150 rc = FAILURE;
1151 goto out;
1152 }
1153
1154 /* Get kcf.conf entry. If none, build a new entry */
1155 if ((pent = getent_kef(provname, NULL, NULL)) == NULL) {
1156 if ((pent = create_entry(provname)) == NULL) {
1157 cryptoerror(LOG_STDERR, gettext("out of memory."));
1158 rc = FAILURE;
1159 goto out;
1160 }
1161 }
1162
1163 /* If it is unloaded already, return */
1164 if (!pent->load) { /* unloaded already */
1165 cryptoerror(LOG_STDERR,
1166 gettext("failed to unload %s."), provname);
1167 rc = FAILURE;
1168 goto out;
1169 } else if (unload_kef_soft(provname) != FAILURE) {
1170 /* Mark as unloaded in kcf.conf */
1171 pent->load = B_FALSE;
1172 rc = update_kcfconf(pent, MODIFY_MODE);
1173 } else {
1174 cryptoerror(LOG_STDERR,
1175 gettext("failed to unload %s."), provname);
1176 rc = FAILURE;
1177 }
1178 out:
1179 free(prov);
1180 free_entry(pent);
1181 return (rc);
1182 }
1183
1184
1185
1186 /*
1187 * The top level function for the "cryptoadm refresh" subcommand.
1188 */
1189 static int
1190 do_refresh(int argc)
1191 {
1192 if (argc != 2) {
1193 usage();
1194 return (ERROR_USAGE);
1195 }
1196
1197 if (getzoneid() == GLOBAL_ZONEID) {
1198 return (refresh());
1199 } else { /* non-global zone */
1200 /*
1201 * Note: in non-global zone, this must silently return SUCCESS
1202 * due to integration with SMF, for "svcadm refresh cryptosvc"
1203 */
1204 return (SUCCESS);
1205 }
1206 }
1207
1208
1209 /*
1210 * The top level function for the "cryptoadm start" subcommand.
1211 * This used to start up kcfd, but now all it does is load up the
1212 * initial providers.
1213 */
1214 static int
1215 do_start(int argc)
1216 {
1217 if (argc != 2) {
1218 usage();
1219 return (ERROR_USAGE);
1220 }
1221
1222 return (do_refresh(argc));
1223 }
1224
1225 /*
1226 * The top level function for the "cryptoadm stop" subcommand.
1227 * This no longer does anything useful, but we leave it here
1228 * for compatibility.
1229 */
1230 static int
1231 do_stop(int argc)
1232 {
1233 if (argc != 2) {
1234 usage();
1235 return (ERROR_USAGE);
1236 }
1237
1238 return (SUCCESS);
1239 }
1240
1241
1242
1243 /*
1244 * Print a list all the the providers.
1245 * Called for "cryptoadm list" or "cryptoadm list -v" (no -m or -p).
1246 */
1247 static int
1248 list_simple_for_all(boolean_t verbose)
1249 {
1250 uentrylist_t *pliblist = NULL;
1251 uentrylist_t *plibptr = NULL;
1252 entry_t *pent = NULL;
1253 crypto_get_dev_list_t *pdevlist_kernel = NULL;
1254 int rc = SUCCESS;
1255 int i;
1256
1257 /* get user-level providers */
1258 (void) printf(gettext("\nUser-level providers:\n"));
1259 if (get_pkcs11conf_info(&pliblist) != SUCCESS) {
1260 cryptoerror(LOG_STDERR, gettext(
1261 "failed to retrieve the list of user-level providers."));
1262 rc = FAILURE;
1263 }
1264
1265 for (plibptr = pliblist; plibptr != NULL; plibptr = plibptr->next) {
1266 /* skip metaslot and fips-140 entry */
1267 if ((strcmp(plibptr->puent->name, METASLOT_KEYWORD) != 0) &&
1268 (strcmp(plibptr->puent->name, FIPS_KEYWORD) != 0)) {
1269 (void) printf(gettext("Provider: %s\n"),
1270 plibptr->puent->name);
1271 if (verbose) {
1272 (void) list_mechlist_for_lib(
1273 plibptr->puent->name, mecharglist, NULL,
1274 B_FALSE, verbose, B_FALSE);
1275 (void) printf("\n");
1276 }
1277 }
1278 }
1279 free_uentrylist(pliblist);
1280
1281 /* get kernel software providers */
1282 (void) printf(gettext("\nKernel software providers:\n"));
1283
1284 if (getzoneid() == GLOBAL_ZONEID) {
1285 /* get kernel software providers from kernel ioctl */
1286 crypto_get_soft_list_t *psoftlist_kernel = NULL;
1287 uint_t sl_soft_count;
1288 char *psoftname;
1289 entrylist_t *pdevlist_conf = NULL;
1290 entrylist_t *psoftlist_conf = NULL;
1291
1292 if (get_soft_list(&psoftlist_kernel) == FAILURE) {
1293 cryptoerror(LOG_ERR, gettext("Failed to retrieve the "
1294 "software provider list from kernel."));
1295 rc = FAILURE;
1296 } else {
1297 sl_soft_count = psoftlist_kernel->sl_soft_count;
1298
1299 if (get_kcfconf_info(&pdevlist_conf, &psoftlist_conf)
1300 == FAILURE) {
1301 cryptoerror(LOG_ERR,
1302 "failed to retrieve the providers' "
1303 "information from file kcf.conf - %s.",
1304 _PATH_KCF_CONF);
1305 free(psoftlist_kernel);
1306 rc = FAILURE;
1307 } else {
1308
1309 for (i = 0,
1310 psoftname = psoftlist_kernel->sl_soft_names;
1311 i < sl_soft_count;
1312 ++i, psoftname += strlen(psoftname) + 1) {
1313 pent = getent_kef(psoftname,
1314 pdevlist_conf, psoftlist_conf);
1315 (void) printf("\t%s%s\n", psoftname,
1316 (pent == NULL) || (pent->load) ?
1317 "" : gettext(" (inactive)"));
1318 }
1319 free_entrylist(pdevlist_conf);
1320 free_entrylist(psoftlist_conf);
1321 }
1322 free(psoftlist_kernel);
1323 }
1324
1325 } else {
1326 /* kcf.conf not there in non-global zone, use /dev/cryptoadm */
1327 entrylist_t *pdevlist_zone = NULL;
1328 entrylist_t *psoftlist_zone = NULL;
1329 entrylist_t *ptr;
1330
1331 if (get_admindev_info(&pdevlist_zone, &psoftlist_zone) !=
1332 SUCCESS) {
1333 cryptoerror(LOG_STDERR,
1334 gettext("failed to retrieve the "
1335 "list of kernel software providers.\n"));
1336 rc = FAILURE;
1337 }
1338
1339 ptr = psoftlist_zone;
1340 while (ptr != NULL) {
1341 (void) printf("\t%s\n", ptr->pent->name);
1342 ptr = ptr->next;
1343 }
1344
1345 free_entrylist(pdevlist_zone);
1346 free_entrylist(psoftlist_zone);
1347 }
1348
1349 /* get kernel hardware providers */
1350 (void) printf(gettext("\nKernel hardware providers:\n"));
1351 if (get_dev_list(&pdevlist_kernel) == FAILURE) {
1352 cryptoerror(LOG_STDERR, gettext("failed to retrieve "
1353 "the list of kernel hardware providers.\n"));
1354 rc = FAILURE;
1355 } else {
1356 for (i = 0; i < pdevlist_kernel->dl_dev_count; i++) {
1357 (void) printf("\t%s/%d\n",
1358 pdevlist_kernel->dl_devs[i].le_dev_name,
1359 pdevlist_kernel->dl_devs[i].le_dev_instance);
1360 }
1361 }
1362 free(pdevlist_kernel);
1363
1364 return (rc);
1365 }
1366
1367
1368
1369 /*
1370 * List all the providers. And for each provider, list the mechanism list.
1371 * Called for "cryptoadm list -m" or "cryptoadm list -mv" .
1372 */
1373 static int
1374 list_mechlist_for_all(boolean_t verbose)
1375 {
1376 crypto_get_dev_list_t *pdevlist_kernel = NULL;
1377 uentrylist_t *pliblist = NULL;
1378 uentrylist_t *plibptr = NULL;
1379 entry_t *pent = NULL;
1380 mechlist_t *pmechlist = NULL;
1381 char provname[MAXNAMELEN];
1382 char devname[MAXNAMELEN];
1383 int inst_num;
1384 int count;
1385 int i;
1386 int rv;
1387 int rc = SUCCESS;
1388
1389 /* get user-level providers */
1390 (void) printf(gettext("\nUser-level providers:\n"));
1391 /*
1392 * TRANSLATION_NOTE
1393 * Strictly for appearance's sake, this line should be as long as
1394 * the length of the translated text above.
1395 */
1396 (void) printf(gettext("=====================\n"));
1397 if (get_pkcs11conf_info(&pliblist) != SUCCESS) {
1398 cryptoerror(LOG_STDERR, gettext("failed to retrieve "
1399 "the list of user-level providers.\n"));
1400 rc = FAILURE;
1401 }
1402
1403 plibptr = pliblist;
1404 while (plibptr != NULL) {
1405 /* skip metaslot and fips-140 entry */
1406 if ((strcmp(plibptr->puent->name, METASLOT_KEYWORD) != 0) &&
1407 (strcmp(plibptr->puent->name, FIPS_KEYWORD) != 0)) {
1408 (void) printf(gettext("\nProvider: %s\n"),
1409 plibptr->puent->name);
1410 rv = list_mechlist_for_lib(plibptr->puent->name,
1411 mecharglist, NULL, B_FALSE, verbose, B_TRUE);
1412 if (rv == FAILURE) {
1413 rc = FAILURE;
1414 }
1415 }
1416 plibptr = plibptr->next;
1417 }
1418 free_uentrylist(pliblist);
1419
1420 /* get kernel software providers */
1421 (void) printf(gettext("\nKernel software providers:\n"));
1422
1423 /*
1424 * TRANSLATION_NOTE
1425 * Strictly for appearance's sake, this line should be as long as
1426 * the length of the translated text above.
1427 */
1428 (void) printf(gettext("==========================\n"));
1429 if (getzoneid() == GLOBAL_ZONEID) {
1430 /* get kernel software providers from kernel ioctl */
1431 crypto_get_soft_list_t *psoftlist_kernel = NULL;
1432 uint_t sl_soft_count;
1433 char *psoftname;
1434 int i;
1435 entrylist_t *pdevlist_conf = NULL;
1436 entrylist_t *psoftlist_conf = NULL;
1437
1438 if (get_soft_list(&psoftlist_kernel) == FAILURE) {
1439 cryptoerror(LOG_ERR, gettext("Failed to retrieve the "
1440 "software provider list from kernel."));
1441 return (FAILURE);
1442 }
1443 sl_soft_count = psoftlist_kernel->sl_soft_count;
1444
1445 if (get_kcfconf_info(&pdevlist_conf, &psoftlist_conf)
1446 == FAILURE) {
1447 cryptoerror(LOG_ERR,
1448 "failed to retrieve the providers' "
1449 "information from file kcf.conf - %s.",
1450 _PATH_KCF_CONF);
1451 free(psoftlist_kernel);
1452 return (FAILURE);
1453 }
1454
1455 for (i = 0, psoftname = psoftlist_kernel->sl_soft_names;
1456 i < sl_soft_count;
1457 ++i, psoftname += strlen(psoftname) + 1) {
1458 pent = getent_kef(psoftname, pdevlist_conf,
1459 psoftlist_conf);
1460 if ((pent == NULL) || (pent->load)) {
1461 rv = list_mechlist_for_soft(psoftname,
1462 NULL, NULL);
1463 if (rv == FAILURE) {
1464 rc = FAILURE;
1465 }
1466 } else {
1467 (void) printf(gettext("%s: (inactive)\n"),
1468 psoftname);
1469 }
1470 }
1471
1472 free(psoftlist_kernel);
1473 free_entrylist(pdevlist_conf);
1474 free_entrylist(psoftlist_conf);
1475
1476 } else {
1477 /* kcf.conf not there in non-global zone, use /dev/cryptoadm */
1478 entrylist_t *pdevlist_zone = NULL;
1479 entrylist_t *psoftlist_zone = NULL;
1480 entrylist_t *ptr;
1481
1482 if (get_admindev_info(&pdevlist_zone, &psoftlist_zone) !=
1483 SUCCESS) {
1484 cryptoerror(LOG_STDERR, gettext("failed to retrieve "
1485 "the list of kernel software providers.\n"));
1486 rc = FAILURE;
1487 }
1488
1489 for (ptr = psoftlist_zone; ptr != NULL; ptr = ptr->next) {
1490 rv = list_mechlist_for_soft(ptr->pent->name,
1491 pdevlist_zone, psoftlist_zone);
1492 if (rv == FAILURE) {
1493 (void) printf(gettext(
1494 "%s: failed to get the mechanism list.\n"),
1495 ptr->pent->name);
1496 rc = FAILURE;
1497 }
1498 }
1499
1500 free_entrylist(pdevlist_zone);
1501 free_entrylist(psoftlist_zone);
1502 }
1503
1504 /* Get kernel hardware providers and their mechanism lists */
1505 (void) printf(gettext("\nKernel hardware providers:\n"));
1506 /*
1507 * TRANSLATION_NOTE
1508 * Strictly for appearance's sake, this line should be as long as
1509 * the length of the translated text above.
1510 */
1511 (void) printf(gettext("==========================\n"));
1512 if (get_dev_list(&pdevlist_kernel) != SUCCESS) {
1513 cryptoerror(LOG_STDERR, gettext("failed to retrieve "
1514 "the list of hardware providers.\n"));
1515 return (FAILURE);
1516 }
1517
1518 for (i = 0; i < pdevlist_kernel->dl_dev_count; i++) {
1519 (void) strlcpy(devname,
1520 pdevlist_kernel->dl_devs[i].le_dev_name, MAXNAMELEN);
1521 inst_num = pdevlist_kernel->dl_devs[i].le_dev_instance;
1522 count = pdevlist_kernel->dl_devs[i].le_mechanism_count;
1523 (void) snprintf(provname, sizeof (provname), "%s/%d", devname,
1524 inst_num);
1525 if (get_dev_info(devname, inst_num, count, &pmechlist) ==
1526 SUCCESS) {
1527 (void) filter_mechlist(&pmechlist, RANDOM);
1528 print_mechlist(provname, pmechlist);
1529 free_mechlist(pmechlist);
1530 } else {
1531 (void) printf(gettext("%s: failed to get the mechanism"
1532 " list.\n"), provname);
1533 rc = FAILURE;
1534 }
1535 }
1536 free(pdevlist_kernel);
1537 return (rc);
1538 }
1539
1540
1541 /*
1542 * List all the providers. And for each provider, list the policy information.
1543 * Called for "cryptoadm list -p".
1544 */
1545 static int
1546 list_policy_for_all(void)
1547 {
1548 crypto_get_dev_list_t *pdevlist_kernel = NULL;
1549 uentrylist_t *pliblist = NULL;
1550 entrylist_t *pdevlist_conf = NULL;
1551 entrylist_t *psoftlist_conf = NULL;
1552 entrylist_t *ptr = NULL;
1553 entrylist_t *phead = NULL;
1554 boolean_t found = B_FALSE;
1555 char provname[MAXNAMELEN];
1556 int i;
1557 int rc = SUCCESS;
1558
1559 /* Get user-level providers */
1560 (void) printf(gettext("\nUser-level providers:\n"));
1561 /*
1562 * TRANSLATION_NOTE
1563 * Strictly for appearance's sake, this line should be as long as
1564 * the length of the translated text above.
1565 */
1566 (void) printf(gettext("=====================\n"));
1567 if (get_pkcs11conf_info(&pliblist) == FAILURE) {
1568 cryptoerror(LOG_STDERR, gettext("failed to retrieve "
1569 "the list of user-level providers.\n"));
1570 rc = FAILURE;
1571 } else {
1572 uentrylist_t *plibptr = pliblist;
1573
1574 while (plibptr != NULL) {
1575 /* skip metaslot and fips-140 entry */
1576 if ((strcmp(plibptr->puent->name,
1577 METASLOT_KEYWORD) != 0) &&
1578 (strcmp(plibptr->puent->name,
1579 FIPS_KEYWORD) != 0)) {
1580 if (print_uef_policy(plibptr->puent)
1581 == FAILURE) {
1582 rc = FAILURE;
1583 }
1584 }
1585 plibptr = plibptr->next;
1586 }
1587 free_uentrylist(pliblist);
1588 }
1589
1590 /* kernel software providers */
1591 (void) printf(gettext("\nKernel software providers:\n"));
1592 /*
1593 * TRANSLATION_NOTE
1594 * Strictly for appearance's sake, this line should be as long as
1595 * the length of the translated text above.
1596 */
1597 (void) printf(gettext("==========================\n"));
1598
1599 /* Get all entries from the kernel */
1600 if (getzoneid() == GLOBAL_ZONEID) {
1601 /* get kernel software providers from kernel ioctl */
1602 crypto_get_soft_list_t *psoftlist_kernel = NULL;
1603 uint_t sl_soft_count;
1604 char *psoftname;
1605 int i;
1606
1607 if (get_soft_list(&psoftlist_kernel) == FAILURE) {
1608 cryptoerror(LOG_ERR, gettext("Failed to retrieve the "
1609 "software provider list from kernel."));
1610 rc = FAILURE;
1611 } else {
1612 sl_soft_count = psoftlist_kernel->sl_soft_count;
1613
1614 for (i = 0, psoftname = psoftlist_kernel->sl_soft_names;
1615 i < sl_soft_count;
1616 ++i, psoftname += strlen(psoftname) + 1) {
1617 (void) list_policy_for_soft(psoftname,
1618 pdevlist_conf, psoftlist_conf);
1619 }
1620 free(psoftlist_kernel);
1621 }
1622
1623 } else {
1624 /* kcf.conf not there in non-global zone, no policy info */
1625
1626 /*
1627 * TRANSLATION_NOTE
1628 * "global" is keyword and not to be translated.
1629 */
1630 cryptoerror(LOG_STDERR, gettext(
1631 "policy information for kernel software providers is "
1632 "available in the %s zone only"), "global");
1633 }
1634
1635 /* Kernel hardware providers */
1636 (void) printf(gettext("\nKernel hardware providers:\n"));
1637 /*
1638 * TRANSLATION_NOTE
1639 * Strictly for appearance's sake, this line should be as long as
1640 * the length of the translated text above.
1641 */
1642 (void) printf(gettext("==========================\n"));
1643
1644 if (getzoneid() != GLOBAL_ZONEID) {
1645 /*
1646 * TRANSLATION_NOTE
1647 * "global" is keyword and not to be translated.
1648 */
1649 cryptoerror(LOG_STDERR, gettext(
1650 "policy information for kernel hardware providers is "
1651 "available in the %s zone only"), "global");
1652 return (FAILURE);
1653 }
1654
1655 /* Get the hardware provider list from kernel */
1656 if (get_dev_list(&pdevlist_kernel) != SUCCESS) {
1657 cryptoerror(LOG_STDERR, gettext(
1658 "failed to retrieve the list of hardware providers.\n"));
1659 return (FAILURE);
1660 }
1661
1662 if (get_kcfconf_info(&pdevlist_conf, &psoftlist_conf) == FAILURE) {
1663 cryptoerror(LOG_ERR, "failed to retrieve the providers' "
1664 "information from file kcf.conf - %s.",
1665 _PATH_KCF_CONF);
1666 return (FAILURE);
1667 }
1668
1669
1670 /*
1671 * For each hardware provider from kernel, check if it has an entry
1672 * in the config file. If it has an entry, print out the policy from
1673 * config file and remove the entry from the hardware provider list
1674 * of the config file. If it does not have an entry in the config
1675 * file, no mechanisms of it have been disabled. But, we still call
1676 * list_policy_for_hard() to account for the "random" feature.
1677 */
1678 for (i = 0; i < pdevlist_kernel->dl_dev_count; i++) {
1679 (void) snprintf(provname, sizeof (provname), "%s/%d",
1680 pdevlist_kernel->dl_devs[i].le_dev_name,
1681 pdevlist_kernel->dl_devs[i].le_dev_instance);
1682
1683 found = B_FALSE;
1684 phead = ptr = pdevlist_conf;
1685 while (!found && ptr) {
1686 if (strcmp(ptr->pent->name, provname) == 0) {
1687 found = B_TRUE;
1688 } else {
1689 phead = ptr;
1690 ptr = ptr->next;
1691 }
1692 }
1693
1694 if (found) {
1695 (void) list_policy_for_hard(ptr->pent->name,
1696 pdevlist_conf, psoftlist_conf, pdevlist_kernel);
1697 if (phead == ptr) {
1698 pdevlist_conf = pdevlist_conf->next;
1699 } else {
1700 phead->next = ptr->next;
1701 }
1702 free_entry(ptr->pent);
1703 free(ptr);
1704 } else {
1705 (void) list_policy_for_hard(provname, pdevlist_conf,
1706 psoftlist_conf, pdevlist_kernel);
1707 }
1708 }
1709
1710 /*
1711 * If there are still entries left in the pdevlist_conf list from
1712 * the config file, these providers must have been detached.
1713 * Should print out their policy information also.
1714 */
1715 for (ptr = pdevlist_conf; ptr != NULL; ptr = ptr->next) {
1716 print_kef_policy(ptr->pent->name, ptr->pent, B_FALSE, B_TRUE);
1717 }
1718
1719 free_entrylist(pdevlist_conf);
1720 free_entrylist(psoftlist_conf);
1721 free(pdevlist_kernel);
1722
1723 return (rc);
1724 }