1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
23 */
24
25 /*
26 * Copyright (c) 2018, Joyent, Inc.
27 */
28
29 #include <fcntl.h>
30 #include <stdio.h>
31 #include <stdlib.h>
32 #include <strings.h>
33 #include <unistd.h>
34 #include <locale.h>
35 #include <libgen.h>
36 #include <sys/types.h>
37 #include <zone.h>
38 #include <sys/crypto/ioctladmin.h>
39 #include <cryptoutil.h>
40 #include "cryptoadm.h"
41
42 #define REQ_ARG_CNT 2
43
44 /* subcommand index */
45 enum subcommand_index {
46 CRYPTO_LIST,
47 CRYPTO_DISABLE,
48 CRYPTO_ENABLE,
49 CRYPTO_INSTALL,
50 CRYPTO_UNINSTALL,
51 CRYPTO_UNLOAD,
52 CRYPTO_REFRESH,
53 CRYPTO_START,
54 CRYPTO_STOP,
55 CRYPTO_HELP };
56
57 /*
58 * TRANSLATION_NOTE
59 * Command keywords are not to be translated.
60 */
61 static char *cmd_table[] = {
62 "list",
63 "disable",
64 "enable",
65 "install",
66 "uninstall",
67 "unload",
68 "refresh",
69 "start",
70 "stop",
71 "--help" };
72
73 /* provider type */
74 enum provider_type_index {
75 PROV_UEF_LIB,
76 PROV_KEF_SOFT,
77 PROV_KEF_HARD,
78 METASLOT,
79 PROV_BADNAME };
80
81 typedef struct {
82 char cp_name[MAXPATHLEN];
83 enum provider_type_index cp_type;
84 } cryptoadm_provider_t;
85
86 /*
87 * TRANSLATION_NOTE
88 * Operand keywords are not to be translated.
89 */
90 static const char *KN_PROVIDER = "provider=";
91 static const char *KN_MECH = "mechanism=";
92 static const char *KN_ALL = "all";
93 static const char *KN_TOKEN = "token=";
94 static const char *KN_SLOT = "slot=";
95 static const char *KN_DEFAULT_KS = "default-keystore";
96 static const char *KN_AUTO_KEY_MIGRATE = "auto-key-migrate";
97
98 /* static variables */
99 static boolean_t allflag = B_FALSE;
100 static boolean_t rndflag = B_FALSE;
101 static mechlist_t *mecharglist = NULL;
102
103 /* static functions */
104 static void usage(void);
105 static int get_provider_type(char *);
106 static int process_mech_operands(int, char **, boolean_t);
107 static int do_list(int, char **);
108 static int do_disable(int, char **);
109 static int do_enable(int, char **);
110 static int do_install(int, char **);
111 static int do_uninstall(int, char **);
112 static int do_unload(int, char **);
113 static int do_refresh(int);
114 static int do_start(int);
115 static int do_stop(int);
116 static int list_simple_for_all(boolean_t);
117 static int list_mechlist_for_all(boolean_t);
118 static int list_policy_for_all(void);
119
120 int
121 main(int argc, char *argv[])
122 {
123 char *subcmd;
124 int cmdnum;
125 int cmd_index = 0;
126 int rc = SUCCESS;
127
128 (void) setlocale(LC_ALL, "");
129
130 #if !defined(TEXT_DOMAIN) /* Should be defined by cc -D */
131 #define TEXT_DOMAIN "SYS_TEST" /* Use this only if it weren't */
132 #endif
133 (void) textdomain(TEXT_DOMAIN);
134
135 cryptodebug_init(basename(argv[0]));
136
137 if (argc < REQ_ARG_CNT) {
138 usage();
139 return (ERROR_USAGE);
140 }
141
142 /* get the subcommand index */
143 cmd_index = 0;
144 subcmd = argv[1];
145 cmdnum = sizeof (cmd_table)/sizeof (cmd_table[0]);
146
147 while ((cmd_index < cmdnum) &&
148 (strcmp(subcmd, cmd_table[cmd_index]) != 0)) {
149 cmd_index++;
150 }
151 if (cmd_index >= cmdnum) {
152 usage();
153 return (ERROR_USAGE);
154 }
155
156 /* do the subcommand */
157 switch (cmd_index) {
158 case CRYPTO_LIST:
159 rc = do_list(argc, argv);
160 break;
161 case CRYPTO_DISABLE:
162 rc = do_disable(argc, argv);
163 break;
164 case CRYPTO_ENABLE:
165 rc = do_enable(argc, argv);
166 break;
167 case CRYPTO_INSTALL:
168 rc = do_install(argc, argv);
169 break;
170 case CRYPTO_UNINSTALL:
171 rc = do_uninstall(argc, argv);
172 break;
173 case CRYPTO_UNLOAD:
174 rc = do_unload(argc, argv);
175 break;
176 case CRYPTO_REFRESH:
177 rc = do_refresh(argc);
178 break;
179 case CRYPTO_START:
180 rc = do_start(argc);
181 break;
182 case CRYPTO_STOP:
183 rc = do_stop(argc);
184 break;
185 case CRYPTO_HELP:
186 usage();
187 rc = SUCCESS;
188 break;
189 default: /* should not come here */
190 usage();
191 rc = ERROR_USAGE;
192 break;
193 }
194 return (rc);
195 }
196
197
198 static void
199 usage(void)
200 {
201 /*
202 * TRANSLATION_NOTE
203 * Command usage is not to be translated. Only the word "Usage:"
204 * along with localized expressions indicating what kind of value
205 * is expected for arguments.
206 */
207 (void) fprintf(stderr, gettext("Usage:\n"));
208 (void) fprintf(stderr,
209 " cryptoadm list [-mpv] [provider=<%s> | metaslot]"
210 " [mechanism=<%s>]\n",
211 gettext("provider-name"), gettext("mechanism-list"));
212 (void) fprintf(stderr,
213 " cryptoadm disable provider=<%s>"
214 " mechanism=<%s> | random | all\n",
215 gettext("provider-name"), gettext("mechanism-list"));
216 (void) fprintf(stderr,
217 " cryptoadm disable metaslot"
218 " [auto-key-migrate] [mechanism=<%s>]\n",
219 gettext("mechanism-list"));
220 (void) fprintf(stderr,
221 " cryptoadm enable provider=<%s>"
222 " mechanism=<%s> | random | all\n",
223 gettext("provider-name"), gettext("mechanism-list"));
224 (void) fprintf(stderr,
225 " cryptoadm enable metaslot [mechanism=<%s>]"
226 " [[token=<%s>] [slot=<%s>]"
227 " | [default-keystore]] | [auto-key-migrate]\n",
228 gettext("mechanism-list"), gettext("token-label"),
229 gettext("slot-description"));
230 (void) fprintf(stderr,
231 " cryptoadm install provider=<%s>\n",
232 gettext("provider-name"));
233 (void) fprintf(stderr,
234 " cryptoadm install provider=<%s> [mechanism=<%s>]\n",
235 gettext("provider-name"), gettext("mechanism-list"));
236 (void) fprintf(stderr,
237 " cryptoadm uninstall provider=<%s>\n",
238 gettext("provider-name"));
239 (void) fprintf(stderr,
240 " cryptoadm unload provider=<%s>\n",
241 gettext("provider-name"));
242 (void) fprintf(stderr,
243 " cryptoadm refresh\n"
244 " cryptoadm start\n"
245 " cryptoadm stop\n"
246 " cryptoadm --help\n");
247 }
248
249
250 /*
251 * Get the provider type. This function returns
252 * - PROV_UEF_LIB if provname contains an absolute path name
253 * - PROV_KEF_SOFT if provname is a base name only (e.g., "aes").
254 * - PROV_KEF_HARD if provname contains one slash only and the slash is not
255 * the 1st character (e.g., "mca/0").
256 * - PROV_BADNAME otherwise.
257 */
258 static int
259 get_provider_type(char *provname)
260 {
261 char *pslash1;
262 char *pslash2;
263
264 if (provname == NULL) {
265 return (FAILURE);
266 }
267
268 if (provname[0] == '/') {
269 return (PROV_UEF_LIB);
270 } else if ((pslash1 = strchr(provname, SEP_SLASH)) == NULL) {
271 /* no slash */
272 return (PROV_KEF_SOFT);
273 } else {
274 pslash2 = strrchr(provname, SEP_SLASH);
275 if (pslash1 == pslash2) {
276 return (PROV_KEF_HARD);
277 } else {
278 return (PROV_BADNAME);
279 }
280 }
281 }
282
283 /*
284 * Get the provider structure. This function returns NULL if no valid
285 * provider= is found in argv[], otherwise a cryptoadm_provider_t is returned.
286 * If provider= is found but has no argument, then a cryptoadm_provider_t
287 * with cp_type = PROV_BADNAME is returned.
288 */
289 static cryptoadm_provider_t *
290 get_provider(int argc, char **argv)
291 {
292 int c = 0;
293 boolean_t found = B_FALSE;
294 cryptoadm_provider_t *provider = NULL;
295 char *provstr = NULL, *savstr;
296 boolean_t is_metaslot = B_FALSE;
297
298 while (!found && ++c < argc) {
299 if (strncmp(argv[c], METASLOT_KEYWORD,
300 strlen(METASLOT_KEYWORD)) == 0) {
301 is_metaslot = B_TRUE;
302 found = B_TRUE;
303 } else if (strncmp(argv[c], KN_PROVIDER,
304 strlen(KN_PROVIDER)) == 0 &&
305 strlen(argv[c]) > strlen(KN_PROVIDER)) {
306 if ((provstr = strdup(argv[c])) == NULL) {
307 int err = errno;
308 /*
309 * TRANSLATION_NOTE
310 * "get_provider" is a function name and should
311 * not be translated.
312 */
313 cryptoerror(LOG_STDERR, "get_provider: %s.",
314 strerror(err));
315 return (NULL);
316 }
317 found = B_TRUE;
318 }
319 }
320 if (!found)
321 return (NULL);
322
323 provider = malloc(sizeof (cryptoadm_provider_t));
324 if (provider == NULL) {
325 cryptoerror(LOG_STDERR, gettext("out of memory."));
326 if (provstr) {
327 free(provstr);
328 }
329 return (NULL);
330 }
331
332 if (is_metaslot) {
333 (void) strlcpy(provider->cp_name, METASLOT_KEYWORD,
334 strlen(METASLOT_KEYWORD));
335 provider->cp_type = METASLOT;
336 } else {
337
338 savstr = provstr;
339 (void) strtok(provstr, "=");
340 provstr = strtok(NULL, "=");
341 if (provstr == NULL) {
342 cryptoerror(LOG_STDERR, gettext("bad provider name."));
343 provider->cp_type = PROV_BADNAME;
344 free(savstr);
345 return (provider);
346 }
347
348 (void) strlcpy(provider->cp_name, provstr,
349 sizeof (provider->cp_name));
350 provider->cp_type = get_provider_type(provider->cp_name);
351
352 free(savstr);
353 }
354 return (provider);
355 }
356
357 /*
358 * Process the "feature" operands.
359 *
360 * "argc" and "argv" contain values specified on the command line.
361 * All other arguments are used for returning parsing results.
362 * If any of these arguments are NULL, that keyword is not expected,
363 * and FAILURE will be returned.
364 */
365 static int
366 process_metaslot_operands(int argc, char **argv, char **meta_ks_token,
367 char **meta_ks_slot, boolean_t *use_default,
368 boolean_t *auto_key_migrate_flag)
369 {
370 int c = 2;
371 int rc = SUCCESS;
372
373 while (++c < argc) {
374 if ((strncmp(argv[c], KN_MECH, strlen(KN_MECH)) == 0) &&
375 strlen(argv[c]) > strlen(KN_MECH)) {
376
377 /* process mechanism operands */
378 if ((rc = process_mech_operands(argc, argv, B_TRUE))
379 != SUCCESS) {
380 goto finish;
381 }
382
383 } else if ((strncmp(argv[c], KN_TOKEN,
384 strlen(KN_TOKEN)) == 0) &&
385 strlen(argv[c]) > strlen(KN_TOKEN)) {
386 if ((meta_ks_token) && (strtok(argv[c], "=") != NULL)) {
387 char *tmp;
388 if ((tmp = strtok(NULL, "=")) != NULL) {
389 *meta_ks_token = strdup(tmp);
390 } else {
391 return (FAILURE);
392 }
393 } else {
394 return (FAILURE);
395 }
396
397 } else if ((strncmp(argv[c], KN_SLOT,
398 strlen(KN_SLOT)) == 0) &&
399 strlen(argv[c]) > strlen(KN_SLOT)) {
400
401 if ((meta_ks_slot) && (strtok(argv[c], "=") != NULL)) {
402 char *tmp;
403 if ((tmp = strtok(NULL, "=")) != NULL) {
404 *meta_ks_slot = strdup(tmp);
405 } else {
406 return (FAILURE);
407 }
408 } else {
409 return (FAILURE);
410 }
411
412 } else if (strncmp(argv[c], KN_DEFAULT_KS,
413 strlen(KN_DEFAULT_KS)) == 0) {
414
415 if (use_default) {
416 *use_default = B_TRUE;
417 } else {
418 return (FAILURE);
419 }
420 } else if (strncmp(argv[c], KN_AUTO_KEY_MIGRATE,
421 strlen(KN_AUTO_KEY_MIGRATE)) == 0) {
422
423 if (auto_key_migrate_flag) {
424 *auto_key_migrate_flag = B_TRUE;
425 } else {
426 return (FAILURE);
427 }
428 } else {
429 return (FAILURE);
430 }
431 }
432 finish:
433 return (rc);
434 }
435
436 /*
437 * Process the "feature" operands.
438 */
439 static int
440 process_feature_operands(int argc, char **argv)
441 {
442 int c = 2;
443
444 while (++c < argc) {
445 if (strcmp(argv[c], KN_ALL) == 0) {
446 allflag = B_TRUE;
447 rndflag = B_TRUE; /* all includes random also. */
448 } else if (strcmp(argv[c], RANDOM) == 0) {
449 rndflag = B_TRUE;
450 }
451 }
452 return (SUCCESS);
453 }
454
455 /*
456 * Process the mechanism operands for the disable, enable and install
457 * subcommands. This function sets the static variable allflag to be B_TRUE
458 * if the keyword "all" is specified, otherwise builds a link list of the
459 * mechanism operands and save it in the static variable mecharglist.
460 *
461 * This function returns
462 * ERROR_USAGE: mechanism operand is missing.
463 * FAILURE: out of memory.
464 * SUCCESS: otherwise.
465 */
466 static int
467 process_mech_operands(int argc, char **argv, boolean_t quiet)
468 {
469 mechlist_t *pmech;
470 mechlist_t *pcur = NULL;
471 mechlist_t *phead = NULL;
472 boolean_t found = B_FALSE;
473 char *mechliststr = NULL;
474 char *curmech = NULL;
475 int c = -1;
476 int rc = SUCCESS;
477
478 while (!found && ++c < argc) {
479 if ((strncmp(argv[c], KN_MECH, strlen(KN_MECH)) == 0) &&
480 strlen(argv[c]) > strlen(KN_MECH)) {
481 found = B_TRUE;
482 }
483 }
484 if (!found) {
485 if (!quiet)
486 /*
487 * TRANSLATION_NOTE
488 * "mechanism" could be either a literal keyword
489 * and hence not to be translated, or a descriptive
490 * word and translatable. A choice was made to
491 * view it as a literal keyword.
492 */
493 cryptoerror(LOG_STDERR,
494 gettext("the %s operand is missing.\n"),
495 "mechanism");
496 return (ERROR_USAGE);
497 }
498 (void) strtok(argv[c], "=");
499 mechliststr = strtok(NULL, "=");
500
501 if (strcmp(mechliststr, "all") == 0) {
502 allflag = B_TRUE;
503 mecharglist = NULL;
504 return (SUCCESS);
505 }
506
507 curmech = strtok(mechliststr, ",");
508 do {
509 if ((pmech = create_mech(curmech)) == NULL) {
510 rc = FAILURE;
511 break;
512 } else {
513 if (phead == NULL) {
514 phead = pcur = pmech;
515 } else {
516 pcur->next = pmech;
517 pcur = pmech;
518 }
519 }
520 } while ((curmech = strtok(NULL, ",")) != NULL);
521
522 if (rc == FAILURE) {
523 cryptoerror(LOG_STDERR, gettext("out of memory."));
524 free_mechlist(phead);
525 } else {
526 mecharglist = phead;
527 rc = SUCCESS;
528 }
529 return (rc);
530 }
531
532
533
534 /*
535 * The top level function for the "cryptoadm list" subcommand and options.
536 */
537 static int
538 do_list(int argc, char **argv)
539 {
540 boolean_t mflag = B_FALSE;
541 boolean_t pflag = B_FALSE;
542 boolean_t vflag = B_FALSE;
543 char ch;
544 cryptoadm_provider_t *prov = NULL;
545 int rc = SUCCESS;
546
547 argc -= 1;
548 argv += 1;
549
550 if (argc == 1) {
551 rc = list_simple_for_all(B_FALSE);
552 goto out;
553 }
554
555 /*
556 * cryptoadm list [-v] [-m] [-p] [provider=<>] [mechanism=<>]
557 */
558 if (argc > 5) {
559 usage();
560 return (rc);
561 }
562
563 while ((ch = getopt(argc, argv, "mpv")) != EOF) {
564 switch (ch) {
565 case 'm':
566 mflag = B_TRUE;
567 if (pflag) {
568 rc = ERROR_USAGE;
569 }
570 break;
571 case 'p':
572 pflag = B_TRUE;
573 if (mflag || vflag) {
574 rc = ERROR_USAGE;
575 }
576 break;
577 case 'v':
578 vflag = B_TRUE;
579 if (pflag)
580 rc = ERROR_USAGE;
581 break;
582 default:
583 rc = ERROR_USAGE;
584 break;
585 }
586 }
587
588 if (rc == ERROR_USAGE) {
589 usage();
590 return (rc);
591 }
592
593 if ((rc = process_feature_operands(argc, argv)) != SUCCESS) {
594 goto out;
595 }
596
597 prov = get_provider(argc, argv);
598
599 if (mflag || vflag) {
600 if (argc > 0) {
601 rc = process_mech_operands(argc, argv, B_TRUE);
602 if (rc == FAILURE)
603 goto out;
604 /* "-m" is implied when a mechanism list is given */
605 if (mecharglist != NULL || allflag)
606 mflag = B_TRUE;
607 }
608 }
609
610 if (prov == NULL) {
611 if (mflag) {
612 rc = list_mechlist_for_all(vflag);
613 } else if (pflag) {
614 rc = list_policy_for_all();
615 } else if (vflag) {
616 rc = list_simple_for_all(vflag);
617 }
618 } else if (prov->cp_type == METASLOT) {
619 if ((!mflag) && (!vflag) && (!pflag)) {
620 /* no flag is specified, just list metaslot status */
621 rc = list_metaslot_info(mflag, vflag, mecharglist);
622 } else if (mflag || vflag) {
623 rc = list_metaslot_info(mflag, vflag, mecharglist);
624 } else if (pflag) {
625 rc = list_metaslot_policy();
626 } else {
627 /* error message */
628 usage();
629 rc = ERROR_USAGE;
630 }
631 } else if (prov->cp_type == PROV_BADNAME) {
632 usage();
633 rc = ERROR_USAGE;
634 goto out;
635 } else { /* do the listing for a provider only */
636 char *provname = prov->cp_name;
637
638 if (mflag || vflag) {
639 if (vflag)
640 (void) printf(gettext("Provider: %s\n"),
641 provname);
642 switch (prov->cp_type) {
643 case PROV_UEF_LIB:
644 rc = list_mechlist_for_lib(provname,
645 mecharglist, NULL, B_FALSE, vflag, mflag);
646 break;
647 case PROV_KEF_SOFT:
648 rc = list_mechlist_for_soft(provname,
649 NULL, NULL);
650 break;
651 case PROV_KEF_HARD:
652 rc = list_mechlist_for_hard(provname);
653 break;
654 default: /* should not come here */
655 rc = FAILURE;
656 break;
657 }
658 } else if (pflag) {
659 switch (prov->cp_type) {
660 case PROV_UEF_LIB:
661 rc = list_policy_for_lib(provname);
662 break;
663 case PROV_KEF_SOFT:
664 if (getzoneid() == GLOBAL_ZONEID) {
665 rc = list_policy_for_soft(provname,
666 NULL, NULL);
667 } else {
668 /*
669 * TRANSLATION_NOTE
670 * "global" is keyword and not to
671 * be translated.
672 */
673 cryptoerror(LOG_STDERR, gettext(
674 "policy information for kernel "
675 "providers is available "
676 "in the %s zone only"), "global");
677 rc = FAILURE;
678 }
679 break;
680 case PROV_KEF_HARD:
681 if (getzoneid() == GLOBAL_ZONEID) {
682 rc = list_policy_for_hard(
683 provname, NULL, NULL, NULL);
684 } else {
685 /*
686 * TRANSLATION_NOTE
687 * "global" is keyword and not to
688 * be translated.
689 */
690 cryptoerror(LOG_STDERR, gettext(
691 "policy information for kernel "
692 "providers is available "
693 "in the %s zone only"), "global");
694 rc = FAILURE;
695 }
696
697 break;
698 default: /* should not come here */
699 rc = FAILURE;
700 break;
701 }
702 } else {
703 /* error message */
704 usage();
705 rc = ERROR_USAGE;
706 }
707 }
708
709 out:
710 if (prov != NULL)
711 free(prov);
712
713 if (mecharglist != NULL)
714 free_mechlist(mecharglist);
715 return (rc);
716 }
717
718
719 /*
720 * The top level function for the "cryptoadm disable" subcommand.
721 */
722 static int
723 do_disable(int argc, char **argv)
724 {
725 cryptoadm_provider_t *prov = NULL;
726 int rc = SUCCESS;
727 boolean_t auto_key_migrate_flag = B_FALSE;
728
729 if ((argc < 3) || (argc > 5)) {
730 usage();
731 return (ERROR_USAGE);
732 }
733
734 prov = get_provider(argc, argv);
735 if (prov == NULL) {
736 usage();
737 return (ERROR_USAGE);
738 }
739 if (prov->cp_type == PROV_BADNAME) {
740 return (FAILURE);
741 }
742
743 if ((rc = process_feature_operands(argc, argv)) != SUCCESS) {
744 goto out;
745 }
746
747 /*
748 * If allflag or rndflag has already been set there is no reason to
749 * process mech=
750 */
751 if (prov->cp_type == METASLOT) {
752 if ((argc > 3) &&
753 (rc = process_metaslot_operands(argc, argv,
754 NULL, NULL, NULL, &auto_key_migrate_flag)) != SUCCESS) {
755 usage();
756 return (rc);
757 }
758 } else if (!allflag && !rndflag &&
759 (rc = process_mech_operands(argc, argv, B_FALSE)) != SUCCESS) {
760 return (rc);
761 }
762
763 switch (prov->cp_type) {
764 case METASLOT:
765 rc = disable_metaslot(mecharglist, allflag,
766 auto_key_migrate_flag);
767 break;
768 case PROV_UEF_LIB:
769 rc = disable_uef_lib(prov->cp_name, rndflag, allflag,
770 mecharglist);
771 break;
772 case PROV_KEF_SOFT:
773 if (rndflag && !allflag) {
774 if ((mecharglist = create_mech(RANDOM)) == NULL) {
775 rc = FAILURE;
776 break;
777 }
778 }
779 if (getzoneid() == GLOBAL_ZONEID) {
780 rc = disable_kef_software(prov->cp_name, rndflag,
781 allflag, mecharglist);
782 } else {
783 /*
784 * TRANSLATION_NOTE
785 * "disable" could be either a literal keyword
786 * and hence not to be translated, or a verb and
787 * translatable. A choice was made to view it as
788 * a literal keyword. "global" is keyword and not
789 * to be translated.
790 */
791 cryptoerror(LOG_STDERR, gettext("%1$s for kernel "
792 "providers is supported in the %2$s zone only"),
793 "disable", "global");
794 rc = FAILURE;
795 }
796 break;
797 case PROV_KEF_HARD:
798 if (rndflag && !allflag) {
799 if ((mecharglist = create_mech(RANDOM)) == NULL) {
800 rc = FAILURE;
801 break;
802 }
803 }
804 if (getzoneid() == GLOBAL_ZONEID) {
805 rc = disable_kef_hardware(prov->cp_name, rndflag,
806 allflag, mecharglist);
807 } else {
808 /*
809 * TRANSLATION_NOTE
810 * "disable" could be either a literal keyword
811 * and hence not to be translated, or a verb and
812 * translatable. A choice was made to view it as
813 * a literal keyword. "global" is keyword and not
814 * to be translated.
815 */
816 cryptoerror(LOG_STDERR, gettext("%1$s for kernel "
817 "providers is supported in the %2$s zone only"),
818 "disable", "global");
819 rc = FAILURE;
820 }
821 break;
822 default: /* should not come here */
823 rc = FAILURE;
824 break;
825 }
826
827 out:
828 free(prov);
829 if (mecharglist != NULL) {
830 free_mechlist(mecharglist);
831 }
832 return (rc);
833 }
834
835
836 /*
837 * The top level function for the "cryptoadm enable" subcommand.
838 */
839 static int
840 do_enable(int argc, char **argv)
841 {
842 cryptoadm_provider_t *prov = NULL;
843 int rc = SUCCESS;
844 char *alt_token = NULL, *alt_slot = NULL;
845 boolean_t use_default = B_FALSE;
846 boolean_t auto_key_migrate_flag = B_FALSE;
847
848 if ((argc < 3) || (argc > 6)) {
849 usage();
850 return (ERROR_USAGE);
851 }
852
853 prov = get_provider(argc, argv);
854 if (prov == NULL) {
855 usage();
856 return (ERROR_USAGE);
857 }
858 if ((prov->cp_type != METASLOT) && (argc != 4)) {
859 usage();
860 return (ERROR_USAGE);
861 }
862 if (prov->cp_type == PROV_BADNAME) {
863 rc = FAILURE;
864 goto out;
865 }
866
867
868 if (prov->cp_type == METASLOT) {
869 if ((rc = process_metaslot_operands(argc, argv, &alt_token,
870 &alt_slot, &use_default, &auto_key_migrate_flag))
871 != SUCCESS) {
872 usage();
873 goto out;
874 }
875 if ((alt_slot || alt_token) && use_default) {
876 usage();
877 rc = FAILURE;
878 goto out;
879 }
880 } else {
881 if ((rc = process_feature_operands(argc, argv)) != SUCCESS) {
882 goto out;
883 }
884
885 /*
886 * If allflag or rndflag has already been set there is
887 * no reason to process mech=
888 */
889 if (!allflag && !rndflag &&
890 (rc = process_mech_operands(argc, argv, B_FALSE))
891 != SUCCESS) {
892 goto out;
893 }
894 }
895
896 switch (prov->cp_type) {
897 case METASLOT:
898 rc = enable_metaslot(alt_token, alt_slot, use_default,
899 mecharglist, allflag, auto_key_migrate_flag);
900 break;
901 case PROV_UEF_LIB:
902 rc = enable_uef_lib(prov->cp_name, rndflag, allflag,
903 mecharglist);
904 break;
905 case PROV_KEF_SOFT:
906 case PROV_KEF_HARD:
907 if (rndflag && !allflag) {
908 if ((mecharglist = create_mech(RANDOM)) == NULL) {
909 rc = FAILURE;
910 break;
911 }
912 }
913 if (getzoneid() == GLOBAL_ZONEID) {
914 rc = enable_kef(prov->cp_name, rndflag, allflag,
915 mecharglist);
916 } else {
917 /*
918 * TRANSLATION_NOTE
919 * "enable" could be either a literal keyword
920 * and hence not to be translated, or a verb and
921 * translatable. A choice was made to view it as
922 * a literal keyword. "global" is keyword and not
923 * to be translated.
924 */
925 cryptoerror(LOG_STDERR, gettext("%1$s for kernel "
926 "providers is supported in the %2$s zone only"),
927 "enable", "global");
928 rc = FAILURE;
929 }
930 break;
931 default: /* should not come here */
932 rc = FAILURE;
933 break;
934 }
935 out:
936 free(prov);
937 if (mecharglist != NULL) {
938 free_mechlist(mecharglist);
939 }
940 if (alt_token != NULL) {
941 free(alt_token);
942 }
943 if (alt_slot != NULL) {
944 free(alt_slot);
945 }
946 return (rc);
947 }
948
949
950
951 /*
952 * The top level function for the "cryptoadm install" subcommand.
953 */
954 static int
955 do_install(int argc, char **argv)
956 {
957 cryptoadm_provider_t *prov = NULL;
958 int rc;
959
960 if (argc < 3) {
961 usage();
962 return (ERROR_USAGE);
963 }
964
965 prov = get_provider(argc, argv);
966 if (prov == NULL ||
967 prov->cp_type == PROV_BADNAME || prov->cp_type == PROV_KEF_HARD) {
968 /*
969 * TRANSLATION_NOTE
970 * "install" could be either a literal keyword and hence
971 * not to be translated, or a verb and translatable. A
972 * choice was made to view it as a literal keyword.
973 */
974 cryptoerror(LOG_STDERR,
975 gettext("bad provider name for %s."), "install");
976 rc = FAILURE;
977 goto out;
978 }
979
980 if (prov->cp_type == PROV_UEF_LIB) {
981 rc = install_uef_lib(prov->cp_name);
982 goto out;
983 }
984
985 /* It is the PROV_KEF_SOFT type now */
986
987 /* check if there are mechanism operands */
988 if (argc < 4) {
989 /*
990 * TRANSLATION_NOTE
991 * "mechanism" could be either a literal keyword and hence
992 * not to be translated, or a descriptive word and
993 * translatable. A choice was made to view it as a literal
994 * keyword.
995 */
996 cryptoerror(LOG_STDERR,
997 gettext("need %s operands for installing a"
998 " kernel software provider."), "mechanism");
999 rc = ERROR_USAGE;
1000 goto out;
1001 }
1002
1003 if ((rc = process_mech_operands(argc, argv, B_FALSE)) != SUCCESS) {
1004 goto out;
1005 }
1006
1007 if (allflag == B_TRUE) {
1008 /*
1009 * TRANSLATION_NOTE
1010 * "all", "mechanism", and "install" are all keywords and
1011 * not to be translated.
1012 */
1013 cryptoerror(LOG_STDERR,
1014 gettext("can not use the %1$s keyword for %2$s "
1015 "in the %3$s subcommand."), "all", "mechanism", "install");
1016 rc = ERROR_USAGE;
1017 goto out;
1018 }
1019
1020 if (getzoneid() == GLOBAL_ZONEID) {
1021 rc = install_kef(prov->cp_name, mecharglist);
1022 } else {
1023 /*
1024 * TRANSLATION_NOTE
1025 * "install" could be either a literal keyword and hence
1026 * not to be translated, or a verb and translatable. A
1027 * choice was made to view it as a literal keyword.
1028 * "global" is keyword and not to be translated.
1029 */
1030 cryptoerror(LOG_STDERR, gettext("%1$s for kernel providers "
1031 "is supported in the %2$s zone only"), "install", "global");
1032 rc = FAILURE;
1033 }
1034 out:
1035 free(prov);
1036 return (rc);
1037 }
1038
1039
1040
1041 /*
1042 * The top level function for the "cryptoadm uninstall" subcommand.
1043 */
1044 static int
1045 do_uninstall(int argc, char **argv)
1046 {
1047 cryptoadm_provider_t *prov = NULL;
1048 int rc = SUCCESS;
1049
1050 if (argc != 3) {
1051 usage();
1052 return (ERROR_USAGE);
1053 }
1054
1055 prov = get_provider(argc, argv);
1056 if (prov == NULL ||
1057 prov->cp_type == PROV_BADNAME || prov->cp_type == PROV_KEF_HARD) {
1058 /*
1059 * TRANSLATION_NOTE
1060 * "uninstall" could be either a literal keyword and hence
1061 * not to be translated, or a verb and translatable. A
1062 * choice was made to view it as a literal keyword.
1063 */
1064 cryptoerror(LOG_STDERR,
1065 gettext("bad provider name for %s."), "uninstall");
1066 free(prov);
1067 return (FAILURE);
1068 }
1069
1070 if (prov->cp_type == PROV_UEF_LIB) {
1071 rc = uninstall_uef_lib(prov->cp_name);
1072
1073 } else if (prov->cp_type == PROV_KEF_SOFT) {
1074 if (getzoneid() == GLOBAL_ZONEID) {
1075 /* unload and remove from kcf.conf */
1076 rc = uninstall_kef(prov->cp_name);
1077 } else {
1078 /*
1079 * TRANSLATION_NOTE
1080 * "uninstall" could be either a literal keyword and
1081 * hence not to be translated, or a verb and
1082 * translatable. A choice was made to view it as a
1083 * literal keyword. "global" is keyword and not to
1084 * be translated.
1085 */
1086 cryptoerror(LOG_STDERR, gettext("%1$s for kernel "
1087 "providers is supported in the %2$s zone only"),
1088 "uninstall", "global");
1089 rc = FAILURE;
1090 }
1091 }
1092
1093 free(prov);
1094 return (rc);
1095 }
1096
1097
1098 /*
1099 * The top level function for the "cryptoadm unload" subcommand.
1100 */
1101 static int
1102 do_unload(int argc, char **argv)
1103 {
1104 cryptoadm_provider_t *prov = NULL;
1105 entry_t *pent = NULL;
1106 boolean_t in_kernel = B_FALSE;
1107 int rc = SUCCESS;
1108 char *provname = NULL;
1109
1110 if (argc != 3) {
1111 usage();
1112 return (ERROR_USAGE);
1113 }
1114
1115 /* check if it is a kernel software provider */
1116 prov = get_provider(argc, argv);
1117 if (prov == NULL) {
1118 cryptoerror(LOG_STDERR,
1119 gettext("unable to determine provider name."));
1120 goto out;
1121 }
1122 provname = prov->cp_name;
1123 if (prov->cp_type != PROV_KEF_SOFT) {
1124 cryptoerror(LOG_STDERR,
1125 gettext("%s is not a valid kernel software provider."),
1126 provname);
1127 rc = FAILURE;
1128 goto out;
1129 }
1130
1131 if (getzoneid() != GLOBAL_ZONEID) {
1132 /*
1133 * TRANSLATION_NOTE
1134 * "unload" could be either a literal keyword and hence
1135 * not to be translated, or a verb and translatable.
1136 * A choice was made to view it as a literal keyword.
1137 * "global" is keyword and not to be translated.
1138 */
1139 cryptoerror(LOG_STDERR, gettext("%1$s for kernel providers "
1140 "is supported in the %2$s zone only"), "unload", "global");
1141 rc = FAILURE;
1142 goto out;
1143 }
1144
1145 if (check_kernel_for_soft(provname, NULL, &in_kernel) == FAILURE) {
1146 cryptodebug("internal error");
1147 rc = FAILURE;
1148 goto out;
1149 } else if (in_kernel == B_FALSE) {
1150 cryptoerror(LOG_STDERR,
1151 gettext("provider %s is not loaded or does not exist."),
1152 provname);
1153 rc = FAILURE;
1154 goto out;
1155 }
1156
1157 /* Get kcf.conf entry. If none, build a new entry */
1158 if ((pent = getent_kef(provname, NULL, NULL)) == NULL) {
1159 if ((pent = create_entry(provname)) == NULL) {
1160 cryptoerror(LOG_STDERR, gettext("out of memory."));
1161 rc = FAILURE;
1162 goto out;
1163 }
1164 }
1165
1166 /* If it is unloaded already, return */
1167 if (!pent->load) { /* unloaded already */
1168 cryptoerror(LOG_STDERR,
1169 gettext("failed to unload %s."), provname);
1170 rc = FAILURE;
1171 goto out;
1172 } else if (unload_kef_soft(provname) != FAILURE) {
1173 /* Mark as unloaded in kcf.conf */
1174 pent->load = B_FALSE;
1175 rc = update_kcfconf(pent, MODIFY_MODE);
1176 } else {
1177 cryptoerror(LOG_STDERR,
1178 gettext("failed to unload %s."), provname);
1179 rc = FAILURE;
1180 }
1181 out:
1182 free(prov);
1183 free_entry(pent);
1184 return (rc);
1185 }
1186
1187
1188
1189 /*
1190 * The top level function for the "cryptoadm refresh" subcommand.
1191 */
1192 static int
1193 do_refresh(int argc)
1194 {
1195 if (argc != 2) {
1196 usage();
1197 return (ERROR_USAGE);
1198 }
1199
1200 if (getzoneid() == GLOBAL_ZONEID) {
1201 return (refresh());
1202 } else { /* non-global zone */
1203 /*
1204 * Note: in non-global zone, this must silently return SUCCESS
1205 * due to integration with SMF, for "svcadm refresh cryptosvc"
1206 */
1207 return (SUCCESS);
1208 }
1209 }
1210
1211
1212 /*
1213 * The top level function for the "cryptoadm start" subcommand.
1214 * This used to start up kcfd, but now all it does is load up the
1215 * initial providers.
1216 */
1217 static int
1218 do_start(int argc)
1219 {
1220 if (argc != 2) {
1221 usage();
1222 return (ERROR_USAGE);
1223 }
1224
1225 return (do_refresh(argc));
1226 }
1227
1228 /*
1229 * The top level function for the "cryptoadm stop" subcommand.
1230 * This no longer does anything useful, but we leave it here
1231 * for compatibility.
1232 */
1233 static int
1234 do_stop(int argc)
1235 {
1236 if (argc != 2) {
1237 usage();
1238 return (ERROR_USAGE);
1239 }
1240
1241 return (SUCCESS);
1242 }
1243
1244
1245
1246 /*
1247 * Print a list all the the providers.
1248 * Called for "cryptoadm list" or "cryptoadm list -v" (no -m or -p).
1249 */
1250 static int
1251 list_simple_for_all(boolean_t verbose)
1252 {
1253 uentrylist_t *pliblist = NULL;
1254 uentrylist_t *plibptr = NULL;
1255 entry_t *pent = NULL;
1256 crypto_get_dev_list_t *pdevlist_kernel = NULL;
1257 int rc = SUCCESS;
1258 int i;
1259
1260 /* get user-level providers */
1261 (void) printf(gettext("\nUser-level providers:\n"));
1262 if (get_pkcs11conf_info(&pliblist) != SUCCESS) {
1263 cryptoerror(LOG_STDERR, gettext(
1264 "failed to retrieve the list of user-level providers."));
1265 rc = FAILURE;
1266 }
1267
1268 for (plibptr = pliblist; plibptr != NULL; plibptr = plibptr->next) {
1269 /* skip metaslot and fips-140 entry */
1270 if ((strcmp(plibptr->puent->name, METASLOT_KEYWORD) != 0) &&
1271 (strcmp(plibptr->puent->name, FIPS_KEYWORD) != 0)) {
1272 (void) printf(gettext("Provider: %s\n"),
1273 plibptr->puent->name);
1274 if (verbose) {
1275 (void) list_mechlist_for_lib(
1276 plibptr->puent->name, mecharglist, NULL,
1277 B_FALSE, verbose, B_FALSE);
1278 (void) printf("\n");
1279 }
1280 }
1281 }
1282 free_uentrylist(pliblist);
1283
1284 /* get kernel software providers */
1285 (void) printf(gettext("\nKernel software providers:\n"));
1286
1287 if (getzoneid() == GLOBAL_ZONEID) {
1288 /* get kernel software providers from kernel ioctl */
1289 crypto_get_soft_list_t *psoftlist_kernel = NULL;
1290 uint_t sl_soft_count;
1291 char *psoftname;
1292 entrylist_t *pdevlist_conf = NULL;
1293 entrylist_t *psoftlist_conf = NULL;
1294
1295 if (get_soft_list(&psoftlist_kernel) == FAILURE) {
1296 cryptoerror(LOG_ERR, gettext("Failed to retrieve the "
1297 "software provider list from kernel."));
1298 rc = FAILURE;
1299 } else {
1300 sl_soft_count = psoftlist_kernel->sl_soft_count;
1301
1302 if (get_kcfconf_info(&pdevlist_conf, &psoftlist_conf)
1303 == FAILURE) {
1304 cryptoerror(LOG_ERR,
1305 "failed to retrieve the providers' "
1306 "information from file kcf.conf - %s.",
1307 _PATH_KCF_CONF);
1308 rc = FAILURE;
1309 } else {
1310
1311 for (i = 0,
1312 psoftname = psoftlist_kernel->sl_soft_names;
1313 i < sl_soft_count;
1314 ++i, psoftname += strlen(psoftname) + 1) {
1315 pent = getent_kef(psoftname,
1316 pdevlist_conf, psoftlist_conf);
1317 (void) printf("\t%s%s\n", psoftname,
1318 (pent == NULL) || (pent->load) ?
1319 "" : gettext(" (inactive)"));
1320 }
1321 free_entrylist(pdevlist_conf);
1322 free_entrylist(psoftlist_conf);
1323 }
1324 free(psoftlist_kernel);
1325 }
1326
1327 } else {
1328 /* kcf.conf not there in non-global zone, use /dev/cryptoadm */
1329 entrylist_t *pdevlist_zone = NULL;
1330 entrylist_t *psoftlist_zone = NULL;
1331 entrylist_t *ptr;
1332
1333 if (get_admindev_info(&pdevlist_zone, &psoftlist_zone) !=
1334 SUCCESS) {
1335 cryptoerror(LOG_STDERR,
1336 gettext("failed to retrieve the "
1337 "list of kernel software providers.\n"));
1338 rc = FAILURE;
1339 }
1340
1341 ptr = psoftlist_zone;
1342 while (ptr != NULL) {
1343 (void) printf("\t%s\n", ptr->pent->name);
1344 ptr = ptr->next;
1345 }
1346
1347 free_entrylist(pdevlist_zone);
1348 free_entrylist(psoftlist_zone);
1349 }
1350
1351 /* get kernel hardware providers */
1352 (void) printf(gettext("\nKernel hardware providers:\n"));
1353 if (get_dev_list(&pdevlist_kernel) == FAILURE) {
1354 cryptoerror(LOG_STDERR, gettext("failed to retrieve "
1355 "the list of kernel hardware providers.\n"));
1356 rc = FAILURE;
1357 } else {
1358 for (i = 0; i < pdevlist_kernel->dl_dev_count; i++) {
1359 (void) printf("\t%s/%d\n",
1360 pdevlist_kernel->dl_devs[i].le_dev_name,
1361 pdevlist_kernel->dl_devs[i].le_dev_instance);
1362 }
1363 }
1364 free(pdevlist_kernel);
1365
1366 return (rc);
1367 }
1368
1369
1370
1371 /*
1372 * List all the providers. And for each provider, list the mechanism list.
1373 * Called for "cryptoadm list -m" or "cryptoadm list -mv" .
1374 */
1375 static int
1376 list_mechlist_for_all(boolean_t verbose)
1377 {
1378 crypto_get_dev_list_t *pdevlist_kernel = NULL;
1379 uentrylist_t *pliblist = NULL;
1380 uentrylist_t *plibptr = NULL;
1381 entry_t *pent = NULL;
1382 mechlist_t *pmechlist = NULL;
1383 char provname[MAXNAMELEN];
1384 char devname[MAXNAMELEN];
1385 int inst_num;
1386 int count;
1387 int i;
1388 int rv;
1389 int rc = SUCCESS;
1390
1391 /* get user-level providers */
1392 (void) printf(gettext("\nUser-level providers:\n"));
1393 /*
1394 * TRANSLATION_NOTE
1395 * Strictly for appearance's sake, this line should be as long as
1396 * the length of the translated text above.
1397 */
1398 (void) printf(gettext("=====================\n"));
1399 if (get_pkcs11conf_info(&pliblist) != SUCCESS) {
1400 cryptoerror(LOG_STDERR, gettext("failed to retrieve "
1401 "the list of user-level providers.\n"));
1402 rc = FAILURE;
1403 }
1404
1405 plibptr = pliblist;
1406 while (plibptr != NULL) {
1407 /* skip metaslot and fips-140 entry */
1408 if ((strcmp(plibptr->puent->name, METASLOT_KEYWORD) != 0) &&
1409 (strcmp(plibptr->puent->name, FIPS_KEYWORD) != 0)) {
1410 (void) printf(gettext("\nProvider: %s\n"),
1411 plibptr->puent->name);
1412 rv = list_mechlist_for_lib(plibptr->puent->name,
1413 mecharglist, NULL, B_FALSE, verbose, B_TRUE);
1414 if (rv == FAILURE) {
1415 rc = FAILURE;
1416 }
1417 }
1418 plibptr = plibptr->next;
1419 }
1420 free_uentrylist(pliblist);
1421
1422 /* get kernel software providers */
1423 (void) printf(gettext("\nKernel software providers:\n"));
1424
1425 /*
1426 * TRANSLATION_NOTE
1427 * Strictly for appearance's sake, this line should be as long as
1428 * the length of the translated text above.
1429 */
1430 (void) printf(gettext("==========================\n"));
1431 if (getzoneid() == GLOBAL_ZONEID) {
1432 /* get kernel software providers from kernel ioctl */
1433 crypto_get_soft_list_t *psoftlist_kernel = NULL;
1434 uint_t sl_soft_count;
1435 char *psoftname;
1436 int i;
1437 entrylist_t *pdevlist_conf = NULL;
1438 entrylist_t *psoftlist_conf = NULL;
1439
1440 if (get_soft_list(&psoftlist_kernel) == FAILURE) {
1441 cryptoerror(LOG_ERR, gettext("Failed to retrieve the "
1442 "software provider list from kernel."));
1443 return (FAILURE);
1444 }
1445 sl_soft_count = psoftlist_kernel->sl_soft_count;
1446
1447 if (get_kcfconf_info(&pdevlist_conf, &psoftlist_conf)
1448 == FAILURE) {
1449 cryptoerror(LOG_ERR,
1450 "failed to retrieve the providers' "
1451 "information from file kcf.conf - %s.",
1452 _PATH_KCF_CONF);
1453 free(psoftlist_kernel);
1454 return (FAILURE);
1455 }
1456
1457 for (i = 0, psoftname = psoftlist_kernel->sl_soft_names;
1458 i < sl_soft_count;
1459 ++i, psoftname += strlen(psoftname) + 1) {
1460 pent = getent_kef(psoftname, pdevlist_conf,
1461 psoftlist_conf);
1462 if ((pent == NULL) || (pent->load)) {
1463 rv = list_mechlist_for_soft(psoftname,
1464 NULL, NULL);
1465 if (rv == FAILURE) {
1466 rc = FAILURE;
1467 }
1468 } else {
1469 (void) printf(gettext("%s: (inactive)\n"),
1470 psoftname);
1471 }
1472 }
1473
1474 free(psoftlist_kernel);
1475 free_entrylist(pdevlist_conf);
1476 free_entrylist(psoftlist_conf);
1477
1478 } else {
1479 /* kcf.conf not there in non-global zone, use /dev/cryptoadm */
1480 entrylist_t *pdevlist_zone = NULL;
1481 entrylist_t *psoftlist_zone = NULL;
1482 entrylist_t *ptr;
1483
1484 if (get_admindev_info(&pdevlist_zone, &psoftlist_zone) !=
1485 SUCCESS) {
1486 cryptoerror(LOG_STDERR, gettext("failed to retrieve "
1487 "the list of kernel software providers.\n"));
1488 rc = FAILURE;
1489 }
1490
1491 for (ptr = psoftlist_zone; ptr != NULL; ptr = ptr->next) {
1492 rv = list_mechlist_for_soft(ptr->pent->name,
1493 pdevlist_zone, psoftlist_zone);
1494 if (rv == FAILURE) {
1495 (void) printf(gettext(
1496 "%s: failed to get the mechanism list.\n"),
1497 ptr->pent->name);
1498 rc = FAILURE;
1499 }
1500 }
1501
1502 free_entrylist(pdevlist_zone);
1503 free_entrylist(psoftlist_zone);
1504 }
1505
1506 /* Get kernel hardware providers and their mechanism lists */
1507 (void) printf(gettext("\nKernel hardware providers:\n"));
1508 /*
1509 * TRANSLATION_NOTE
1510 * Strictly for appearance's sake, this line should be as long as
1511 * the length of the translated text above.
1512 */
1513 (void) printf(gettext("==========================\n"));
1514 if (get_dev_list(&pdevlist_kernel) != SUCCESS) {
1515 cryptoerror(LOG_STDERR, gettext("failed to retrieve "
1516 "the list of hardware providers.\n"));
1517 return (FAILURE);
1518 }
1519
1520 for (i = 0; i < pdevlist_kernel->dl_dev_count; i++) {
1521 (void) strlcpy(devname,
1522 pdevlist_kernel->dl_devs[i].le_dev_name, MAXNAMELEN);
1523 inst_num = pdevlist_kernel->dl_devs[i].le_dev_instance;
1524 count = pdevlist_kernel->dl_devs[i].le_mechanism_count;
1525 (void) snprintf(provname, sizeof (provname), "%s/%d", devname,
1526 inst_num);
1527 if (get_dev_info(devname, inst_num, count, &pmechlist) ==
1528 SUCCESS) {
1529 (void) filter_mechlist(&pmechlist, RANDOM);
1530 print_mechlist(provname, pmechlist);
1531 free_mechlist(pmechlist);
1532 } else {
1533 (void) printf(gettext("%s: failed to get the mechanism"
1534 " list.\n"), provname);
1535 rc = FAILURE;
1536 }
1537 }
1538 free(pdevlist_kernel);
1539 return (rc);
1540 }
1541
1542
1543 /*
1544 * List all the providers. And for each provider, list the policy information.
1545 * Called for "cryptoadm list -p".
1546 */
1547 static int
1548 list_policy_for_all(void)
1549 {
1550 crypto_get_dev_list_t *pdevlist_kernel = NULL;
1551 uentrylist_t *pliblist = NULL;
1552 entrylist_t *pdevlist_conf = NULL;
1553 entrylist_t *psoftlist_conf = NULL;
1554 entrylist_t *ptr = NULL;
1555 entrylist_t *phead = NULL;
1556 boolean_t found = B_FALSE;
1557 char provname[MAXNAMELEN];
1558 int i;
1559 int rc = SUCCESS;
1560
1561 /* Get user-level providers */
1562 (void) printf(gettext("\nUser-level providers:\n"));
1563 /*
1564 * TRANSLATION_NOTE
1565 * Strictly for appearance's sake, this line should be as long as
1566 * the length of the translated text above.
1567 */
1568 (void) printf(gettext("=====================\n"));
1569 if (get_pkcs11conf_info(&pliblist) == FAILURE) {
1570 cryptoerror(LOG_STDERR, gettext("failed to retrieve "
1571 "the list of user-level providers.\n"));
1572 rc = FAILURE;
1573 } else {
1574 uentrylist_t *plibptr = pliblist;
1575
1576 while (plibptr != NULL) {
1577 /* skip metaslot and fips-140 entry */
1578 if ((strcmp(plibptr->puent->name,
1579 METASLOT_KEYWORD) != 0) &&
1580 (strcmp(plibptr->puent->name,
1581 FIPS_KEYWORD) != 0)) {
1582 if (print_uef_policy(plibptr->puent)
1583 == FAILURE) {
1584 rc = FAILURE;
1585 }
1586 }
1587 plibptr = plibptr->next;
1588 }
1589 free_uentrylist(pliblist);
1590 }
1591
1592 /* kernel software providers */
1593 (void) printf(gettext("\nKernel software providers:\n"));
1594 /*
1595 * TRANSLATION_NOTE
1596 * Strictly for appearance's sake, this line should be as long as
1597 * the length of the translated text above.
1598 */
1599 (void) printf(gettext("==========================\n"));
1600
1601 /* Get all entries from the kernel */
1602 if (getzoneid() == GLOBAL_ZONEID) {
1603 /* get kernel software providers from kernel ioctl */
1604 crypto_get_soft_list_t *psoftlist_kernel = NULL;
1605 uint_t sl_soft_count;
1606 char *psoftname;
1607 int i;
1608
1609 if (get_soft_list(&psoftlist_kernel) == FAILURE) {
1610 cryptoerror(LOG_ERR, gettext("Failed to retrieve the "
1611 "software provider list from kernel."));
1612 rc = FAILURE;
1613 } else {
1614 sl_soft_count = psoftlist_kernel->sl_soft_count;
1615
1616 for (i = 0, psoftname = psoftlist_kernel->sl_soft_names;
1617 i < sl_soft_count;
1618 ++i, psoftname += strlen(psoftname) + 1) {
1619 (void) list_policy_for_soft(psoftname,
1620 pdevlist_conf, psoftlist_conf);
1621 }
1622 free(psoftlist_kernel);
1623 }
1624
1625 } else {
1626 /* kcf.conf not there in non-global zone, no policy info */
1627
1628 /*
1629 * TRANSLATION_NOTE
1630 * "global" is keyword and not to be translated.
1631 */
1632 cryptoerror(LOG_STDERR, gettext(
1633 "policy information for kernel software providers is "
1634 "available in the %s zone only"), "global");
1635 }
1636
1637 /* Kernel hardware providers */
1638 (void) printf(gettext("\nKernel hardware providers:\n"));
1639 /*
1640 * TRANSLATION_NOTE
1641 * Strictly for appearance's sake, this line should be as long as
1642 * the length of the translated text above.
1643 */
1644 (void) printf(gettext("==========================\n"));
1645
1646 if (getzoneid() != GLOBAL_ZONEID) {
1647 /*
1648 * TRANSLATION_NOTE
1649 * "global" is keyword and not to be translated.
1650 */
1651 cryptoerror(LOG_STDERR, gettext(
1652 "policy information for kernel hardware providers is "
1653 "available in the %s zone only"), "global");
1654 return (FAILURE);
1655 }
1656
1657 /* Get the hardware provider list from kernel */
1658 if (get_dev_list(&pdevlist_kernel) != SUCCESS) {
1659 cryptoerror(LOG_STDERR, gettext(
1660 "failed to retrieve the list of hardware providers.\n"));
1661 return (FAILURE);
1662 }
1663
1664 if (get_kcfconf_info(&pdevlist_conf, &psoftlist_conf) == FAILURE) {
1665 cryptoerror(LOG_ERR, "failed to retrieve the providers' "
1666 "information from file kcf.conf - %s.",
1667 _PATH_KCF_CONF);
1668 return (FAILURE);
1669 }
1670
1671
1672 /*
1673 * For each hardware provider from kernel, check if it has an entry
1674 * in the config file. If it has an entry, print out the policy from
1675 * config file and remove the entry from the hardware provider list
1676 * of the config file. If it does not have an entry in the config
1677 * file, no mechanisms of it have been disabled. But, we still call
1678 * list_policy_for_hard() to account for the "random" feature.
1679 */
1680 for (i = 0; i < pdevlist_kernel->dl_dev_count; i++) {
1681 (void) snprintf(provname, sizeof (provname), "%s/%d",
1682 pdevlist_kernel->dl_devs[i].le_dev_name,
1683 pdevlist_kernel->dl_devs[i].le_dev_instance);
1684
1685 found = B_FALSE;
1686 phead = ptr = pdevlist_conf;
1687 while (!found && ptr) {
1688 if (strcmp(ptr->pent->name, provname) == 0) {
1689 found = B_TRUE;
1690 } else {
1691 phead = ptr;
1692 ptr = ptr->next;
1693 }
1694 }
1695
1696 if (found) {
1697 (void) list_policy_for_hard(ptr->pent->name,
1698 pdevlist_conf, psoftlist_conf, pdevlist_kernel);
1699 if (phead == ptr) {
1700 pdevlist_conf = pdevlist_conf->next;
1701 } else {
1702 phead->next = ptr->next;
1703 }
1704 free_entry(ptr->pent);
1705 free(ptr);
1706 } else {
1707 (void) list_policy_for_hard(provname, pdevlist_conf,
1708 psoftlist_conf, pdevlist_kernel);
1709 }
1710 }
1711
1712 /*
1713 * If there are still entries left in the pdevlist_conf list from
1714 * the config file, these providers must have been detached.
1715 * Should print out their policy information also.
1716 */
1717 for (ptr = pdevlist_conf; ptr != NULL; ptr = ptr->next) {
1718 print_kef_policy(ptr->pent->name, ptr->pent, B_FALSE, B_TRUE);
1719 }
1720
1721 free_entrylist(pdevlist_conf);
1722 free_entrylist(psoftlist_conf);
1723 free(pdevlist_kernel);
1724
1725 return (rc);
1726 }