xref: /onnv-gate/usr/src/cmd/cmd-crypto/cryptoadm/cryptoadm.c (revision 12929:f2051cc42292)
10Sstevel@tonic-gate /*
20Sstevel@tonic-gate  * CDDL HEADER START
30Sstevel@tonic-gate  *
40Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
51971Skrishna  * Common Development and Distribution License (the "License").
61971Skrishna  * You may not use this file except in compliance with the License.
70Sstevel@tonic-gate  *
80Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
90Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
100Sstevel@tonic-gate  * See the License for the specific language governing permissions
110Sstevel@tonic-gate  * and limitations under the License.
120Sstevel@tonic-gate  *
130Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
140Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
150Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
160Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
170Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
180Sstevel@tonic-gate  *
190Sstevel@tonic-gate  * CDDL HEADER END
200Sstevel@tonic-gate  */
210Sstevel@tonic-gate /*
22*12929SMisaki.Miyashita@Oracle.COM  * Copyright (c) 2003, 2010, Oracle and/or its affiliates. All rights reserved.
230Sstevel@tonic-gate  */
240Sstevel@tonic-gate 
250Sstevel@tonic-gate 
260Sstevel@tonic-gate #include <fcntl.h>
270Sstevel@tonic-gate #include <stdio.h>
280Sstevel@tonic-gate #include <stdlib.h>
290Sstevel@tonic-gate #include <strings.h>
300Sstevel@tonic-gate #include <unistd.h>
310Sstevel@tonic-gate #include <locale.h>
320Sstevel@tonic-gate #include <libgen.h>
330Sstevel@tonic-gate #include <sys/types.h>
340Sstevel@tonic-gate #include <zone.h>
350Sstevel@tonic-gate #include <sys/crypto/ioctladmin.h>
360Sstevel@tonic-gate #include <cryptoutil.h>
370Sstevel@tonic-gate #include "cryptoadm.h"
380Sstevel@tonic-gate 
390Sstevel@tonic-gate #define	REQ_ARG_CNT	2
400Sstevel@tonic-gate 
410Sstevel@tonic-gate /* subcommand index */
420Sstevel@tonic-gate enum subcommand_index {
430Sstevel@tonic-gate 	CRYPTO_LIST,
440Sstevel@tonic-gate 	CRYPTO_DISABLE,
450Sstevel@tonic-gate 	CRYPTO_ENABLE,
460Sstevel@tonic-gate 	CRYPTO_INSTALL,
470Sstevel@tonic-gate 	CRYPTO_UNINSTALL,
480Sstevel@tonic-gate 	CRYPTO_UNLOAD,
490Sstevel@tonic-gate 	CRYPTO_REFRESH,
500Sstevel@tonic-gate 	CRYPTO_START,
510Sstevel@tonic-gate 	CRYPTO_STOP,
520Sstevel@tonic-gate 	CRYPTO_HELP };
530Sstevel@tonic-gate 
540Sstevel@tonic-gate /*
557334SDaniel.Anderson@Sun.COM  * TRANSLATION_NOTE
560Sstevel@tonic-gate  * Command keywords are not to be translated.
570Sstevel@tonic-gate  */
580Sstevel@tonic-gate static char *cmd_table[] = {
590Sstevel@tonic-gate 	"list",
600Sstevel@tonic-gate 	"disable",
610Sstevel@tonic-gate 	"enable",
620Sstevel@tonic-gate 	"install",
630Sstevel@tonic-gate 	"uninstall",
640Sstevel@tonic-gate 	"unload",
650Sstevel@tonic-gate 	"refresh",
660Sstevel@tonic-gate 	"start",
670Sstevel@tonic-gate 	"stop",
680Sstevel@tonic-gate 	"--help" };
690Sstevel@tonic-gate 
700Sstevel@tonic-gate /* provider type */
710Sstevel@tonic-gate enum provider_type_index {
720Sstevel@tonic-gate 	PROV_UEF_LIB,
730Sstevel@tonic-gate 	PROV_KEF_SOFT,
740Sstevel@tonic-gate 	PROV_KEF_HARD,
750Sstevel@tonic-gate 	METASLOT,
760Sstevel@tonic-gate 	PROV_BADNAME };
770Sstevel@tonic-gate 
780Sstevel@tonic-gate typedef struct {
790Sstevel@tonic-gate 	char cp_name[MAXPATHLEN];
800Sstevel@tonic-gate 	enum provider_type_index cp_type;
810Sstevel@tonic-gate } cryptoadm_provider_t;
820Sstevel@tonic-gate 
830Sstevel@tonic-gate /*
847334SDaniel.Anderson@Sun.COM  * TRANSLATION_NOTE
850Sstevel@tonic-gate  * Operand keywords are not to be translated.
860Sstevel@tonic-gate  */
870Sstevel@tonic-gate static const char *KN_PROVIDER = "provider=";
880Sstevel@tonic-gate static const char *KN_MECH = "mechanism=";
890Sstevel@tonic-gate static const char *KN_ALL = "all";
900Sstevel@tonic-gate static const char *KN_TOKEN = "token=";
910Sstevel@tonic-gate static const char *KN_SLOT = "slot=";
920Sstevel@tonic-gate static const char *KN_DEFAULT_KS = "default-keystore";
930Sstevel@tonic-gate static const char *KN_AUTO_KEY_MIGRATE = "auto-key-migrate";
940Sstevel@tonic-gate 
950Sstevel@tonic-gate /* static variables */
960Sstevel@tonic-gate static boolean_t	allflag = B_FALSE;
970Sstevel@tonic-gate static boolean_t	rndflag = B_FALSE;
980Sstevel@tonic-gate static mechlist_t	*mecharglist = NULL;
990Sstevel@tonic-gate 
1000Sstevel@tonic-gate /* static functions */
1010Sstevel@tonic-gate static void usage(void);
1020Sstevel@tonic-gate static int get_provider_type(char *);
1030Sstevel@tonic-gate static int process_mech_operands(int, char **, boolean_t);
1040Sstevel@tonic-gate static int do_list(int, char **);
1050Sstevel@tonic-gate static int do_disable(int, char **);
1060Sstevel@tonic-gate static int do_enable(int, char **);
1070Sstevel@tonic-gate static int do_install(int, char **);
1080Sstevel@tonic-gate static int do_uninstall(int, char **);
1090Sstevel@tonic-gate static int do_unload(int, char **);
1100Sstevel@tonic-gate static int do_refresh(int);
1110Sstevel@tonic-gate static int do_start(int);
1120Sstevel@tonic-gate static int do_stop(int);
1130Sstevel@tonic-gate static int list_simple_for_all(boolean_t);
1140Sstevel@tonic-gate static int list_mechlist_for_all(boolean_t);
1150Sstevel@tonic-gate static int list_policy_for_all(void);
1160Sstevel@tonic-gate 
1170Sstevel@tonic-gate int
main(int argc,char * argv[])1180Sstevel@tonic-gate main(int argc, char *argv[])
1190Sstevel@tonic-gate {
1200Sstevel@tonic-gate 	char	*subcmd;
1210Sstevel@tonic-gate 	int	cmdnum;
1220Sstevel@tonic-gate 	int	cmd_index = 0;
1230Sstevel@tonic-gate 	int	rc = SUCCESS;
1240Sstevel@tonic-gate 
1250Sstevel@tonic-gate 	(void) setlocale(LC_ALL, "");
1260Sstevel@tonic-gate 
1270Sstevel@tonic-gate #if !defined(TEXT_DOMAIN)	/* Should be defined by cc -D */
1280Sstevel@tonic-gate #define	TEXT_DOMAIN "SYS_TEST"	/* Use this only if it weren't */
1290Sstevel@tonic-gate #endif
1300Sstevel@tonic-gate 	(void) textdomain(TEXT_DOMAIN);
1310Sstevel@tonic-gate 
1320Sstevel@tonic-gate 	cryptodebug_init(basename(argv[0]));
1330Sstevel@tonic-gate 
1340Sstevel@tonic-gate 	if (argc < REQ_ARG_CNT) {
1350Sstevel@tonic-gate 		usage();
1360Sstevel@tonic-gate 		return (ERROR_USAGE);
1370Sstevel@tonic-gate 	}
1380Sstevel@tonic-gate 
1390Sstevel@tonic-gate 	/* get the subcommand index */
1400Sstevel@tonic-gate 	cmd_index = 0;
1410Sstevel@tonic-gate 	subcmd = argv[1];
1420Sstevel@tonic-gate 	cmdnum = sizeof (cmd_table)/sizeof (cmd_table[0]);
1430Sstevel@tonic-gate 
1440Sstevel@tonic-gate 	while ((cmd_index < cmdnum) &&
1450Sstevel@tonic-gate 	    (strcmp(subcmd, cmd_table[cmd_index]) != 0)) {
1460Sstevel@tonic-gate 		cmd_index++;
1470Sstevel@tonic-gate 	}
1480Sstevel@tonic-gate 	if (cmd_index >= cmdnum) {
1490Sstevel@tonic-gate 		usage();
1500Sstevel@tonic-gate 		return (ERROR_USAGE);
1510Sstevel@tonic-gate 	}
1520Sstevel@tonic-gate 
1530Sstevel@tonic-gate 	/* do the subcommand */
1540Sstevel@tonic-gate 	switch (cmd_index) {
1550Sstevel@tonic-gate 	case CRYPTO_LIST:
1560Sstevel@tonic-gate 		rc = do_list(argc, argv);
1570Sstevel@tonic-gate 		break;
1580Sstevel@tonic-gate 	case CRYPTO_DISABLE:
1590Sstevel@tonic-gate 		rc = do_disable(argc, argv);
1600Sstevel@tonic-gate 		break;
1610Sstevel@tonic-gate 	case CRYPTO_ENABLE:
1620Sstevel@tonic-gate 		rc = do_enable(argc, argv);
1630Sstevel@tonic-gate 		break;
1640Sstevel@tonic-gate 	case CRYPTO_INSTALL:
1650Sstevel@tonic-gate 		rc = do_install(argc, argv);
1660Sstevel@tonic-gate 		break;
1670Sstevel@tonic-gate 	case CRYPTO_UNINSTALL:
1680Sstevel@tonic-gate 		rc = do_uninstall(argc, argv);
1690Sstevel@tonic-gate 		break;
1700Sstevel@tonic-gate 	case CRYPTO_UNLOAD:
1710Sstevel@tonic-gate 		rc = do_unload(argc, argv);
1720Sstevel@tonic-gate 		break;
1730Sstevel@tonic-gate 	case CRYPTO_REFRESH:
1740Sstevel@tonic-gate 		rc = do_refresh(argc);
1750Sstevel@tonic-gate 		break;
1760Sstevel@tonic-gate 	case CRYPTO_START:
1770Sstevel@tonic-gate 		rc = do_start(argc);
1780Sstevel@tonic-gate 		break;
1790Sstevel@tonic-gate 	case CRYPTO_STOP:
1800Sstevel@tonic-gate 		rc = do_stop(argc);
1810Sstevel@tonic-gate 		break;
1820Sstevel@tonic-gate 	case CRYPTO_HELP:
1830Sstevel@tonic-gate 		usage();
1840Sstevel@tonic-gate 		rc = SUCCESS;
1850Sstevel@tonic-gate 		break;
1860Sstevel@tonic-gate 	default: /* should not come here */
1870Sstevel@tonic-gate 		usage();
1880Sstevel@tonic-gate 		rc = ERROR_USAGE;
1890Sstevel@tonic-gate 		break;
1900Sstevel@tonic-gate 	}
1910Sstevel@tonic-gate 	return (rc);
1920Sstevel@tonic-gate }
1930Sstevel@tonic-gate 
1940Sstevel@tonic-gate 
1950Sstevel@tonic-gate static void
usage(void)1960Sstevel@tonic-gate usage(void)
1970Sstevel@tonic-gate {
1980Sstevel@tonic-gate 	/*
1997334SDaniel.Anderson@Sun.COM 	 * TRANSLATION_NOTE
2000Sstevel@tonic-gate 	 * Command usage is not to be translated.  Only the word "Usage:"
2010Sstevel@tonic-gate 	 * along with localized expressions indicating what kind of value
2020Sstevel@tonic-gate 	 * is expected for arguments.
2030Sstevel@tonic-gate 	 */
2040Sstevel@tonic-gate 	(void) fprintf(stderr, gettext("Usage:\n"));
2050Sstevel@tonic-gate 	(void) fprintf(stderr,
2060Sstevel@tonic-gate 	    "  cryptoadm list [-mpv] [provider=<%s> | metaslot]"
2070Sstevel@tonic-gate 	    " [mechanism=<%s>]\n",
2080Sstevel@tonic-gate 	    gettext("provider-name"), gettext("mechanism-list"));
2090Sstevel@tonic-gate 	(void) fprintf(stderr,
21010500SHai-May.Chao@Sun.COM 	    "  cryptoadm list fips-140\n");
21110500SHai-May.Chao@Sun.COM 	(void) fprintf(stderr,
2120Sstevel@tonic-gate 	    "  cryptoadm disable provider=<%s>"
2130Sstevel@tonic-gate 	    " mechanism=<%s> | random | all\n",
2140Sstevel@tonic-gate 	    gettext("provider-name"), gettext("mechanism-list"));
2150Sstevel@tonic-gate 	(void) fprintf(stderr,
2160Sstevel@tonic-gate 	    "  cryptoadm disable metaslot"
2170Sstevel@tonic-gate 	    " [auto-key-migrate] [mechanism=<%s>]\n",
2180Sstevel@tonic-gate 	    gettext("mechanism-list"));
2190Sstevel@tonic-gate 	(void) fprintf(stderr,
22010500SHai-May.Chao@Sun.COM 	    "  cryptoadm disable fips-140\n");
22110500SHai-May.Chao@Sun.COM 	(void) fprintf(stderr,
2220Sstevel@tonic-gate 	    "  cryptoadm enable provider=<%s>"
2230Sstevel@tonic-gate 	    " mechanism=<%s> | random | all\n",
2240Sstevel@tonic-gate 	    gettext("provider-name"), gettext("mechanism-list"));
2250Sstevel@tonic-gate 	(void) fprintf(stderr,
2260Sstevel@tonic-gate 	    "  cryptoadm enable metaslot [mechanism=<%s>]"
2270Sstevel@tonic-gate 	    " [[token=<%s>] [slot=<%s>]"
2280Sstevel@tonic-gate 	    " | [default-keystore]] | [auto-key-migrate]\n",
2290Sstevel@tonic-gate 	    gettext("mechanism-list"), gettext("token-label"),
2300Sstevel@tonic-gate 	    gettext("slot-description"));
2310Sstevel@tonic-gate 	(void) fprintf(stderr,
23210500SHai-May.Chao@Sun.COM 	    "  cryptoadm enable fips-140\n");
23310500SHai-May.Chao@Sun.COM 	(void) fprintf(stderr,
2340Sstevel@tonic-gate 	    "  cryptoadm install provider=<%s>\n",
2350Sstevel@tonic-gate 	    gettext("provider-name"));
2360Sstevel@tonic-gate 	(void) fprintf(stderr,
2370Sstevel@tonic-gate 	    "  cryptoadm install provider=<%s> [mechanism=<%s>]\n",
2380Sstevel@tonic-gate 	    gettext("provider-name"), gettext("mechanism-list"));
2390Sstevel@tonic-gate 	(void) fprintf(stderr,
2400Sstevel@tonic-gate 	    "  cryptoadm uninstall provider=<%s>\n",
2410Sstevel@tonic-gate 	    gettext("provider-name"));
2420Sstevel@tonic-gate 	(void) fprintf(stderr,
2430Sstevel@tonic-gate 	    "  cryptoadm unload provider=<%s>\n",
2440Sstevel@tonic-gate 	    gettext("provider-name"));
2450Sstevel@tonic-gate 	(void) fprintf(stderr,
2460Sstevel@tonic-gate 	    "  cryptoadm refresh\n"
2470Sstevel@tonic-gate 	    "  cryptoadm start\n"
2480Sstevel@tonic-gate 	    "  cryptoadm stop\n"
2490Sstevel@tonic-gate 	    "  cryptoadm --help\n");
2500Sstevel@tonic-gate }
2510Sstevel@tonic-gate 
2520Sstevel@tonic-gate 
2530Sstevel@tonic-gate /*
2540Sstevel@tonic-gate  * Get the provider type.  This function returns
2550Sstevel@tonic-gate  * - PROV_UEF_LIB if provname contains an absolute path name
2567968Sopensolaris@drydog.com  * - PROV_KEF_SOFT if provname is a base name only (e.g., "aes").
2570Sstevel@tonic-gate  * - PROV_KEF_HARD if provname contains one slash only and the slash is not
2587968Sopensolaris@drydog.com  *	the 1st character (e.g., "mca/0").
2597334SDaniel.Anderson@Sun.COM  * - PROV_BADNAME otherwise.
2600Sstevel@tonic-gate  */
2610Sstevel@tonic-gate static int
get_provider_type(char * provname)2620Sstevel@tonic-gate get_provider_type(char *provname)
2630Sstevel@tonic-gate {
2640Sstevel@tonic-gate 	char *pslash1;
2650Sstevel@tonic-gate 	char *pslash2;
2660Sstevel@tonic-gate 
2670Sstevel@tonic-gate 	if (provname == NULL) {
2680Sstevel@tonic-gate 		return (FAILURE);
2690Sstevel@tonic-gate 	}
2700Sstevel@tonic-gate 
2710Sstevel@tonic-gate 	if (provname[0] == '/') {
2720Sstevel@tonic-gate 		return (PROV_UEF_LIB);
2730Sstevel@tonic-gate 	} else if ((pslash1 = strchr(provname, SEP_SLASH)) == NULL) {
2740Sstevel@tonic-gate 		/* no slash */
2750Sstevel@tonic-gate 		return (PROV_KEF_SOFT);
2760Sstevel@tonic-gate 	} else {
2770Sstevel@tonic-gate 		pslash2 = strrchr(provname, SEP_SLASH);
2780Sstevel@tonic-gate 		if (pslash1 == pslash2) {
2790Sstevel@tonic-gate 			return (PROV_KEF_HARD);
2800Sstevel@tonic-gate 		} else {
2810Sstevel@tonic-gate 			return (PROV_BADNAME);
2820Sstevel@tonic-gate 		}
2830Sstevel@tonic-gate 	}
2840Sstevel@tonic-gate }
2850Sstevel@tonic-gate 
2860Sstevel@tonic-gate /*
2870Sstevel@tonic-gate  * Get the provider structure.  This function returns NULL if no valid
2880Sstevel@tonic-gate  * provider= is found in argv[], otherwise a cryptoadm_provider_t is returned.
2890Sstevel@tonic-gate  * If provider= is found but has no argument, then a cryptoadm_provider_t
2900Sstevel@tonic-gate  * with cp_type = PROV_BADNAME is returned.
2910Sstevel@tonic-gate  */
2920Sstevel@tonic-gate static cryptoadm_provider_t *
get_provider(int argc,char ** argv)2930Sstevel@tonic-gate get_provider(int argc, char **argv)
2940Sstevel@tonic-gate {
2957968Sopensolaris@drydog.com 	int			c = 0;
2967968Sopensolaris@drydog.com 	boolean_t		found = B_FALSE;
2977968Sopensolaris@drydog.com 	cryptoadm_provider_t	*provider = NULL;
2987968Sopensolaris@drydog.com 	char			*provstr = NULL, *savstr;
2997968Sopensolaris@drydog.com 	boolean_t		is_metaslot = B_FALSE;
3000Sstevel@tonic-gate 
3010Sstevel@tonic-gate 	while (!found && ++c < argc) {
3020Sstevel@tonic-gate 		if (strncmp(argv[c], METASLOT_KEYWORD,
3030Sstevel@tonic-gate 		    strlen(METASLOT_KEYWORD)) == 0) {
3040Sstevel@tonic-gate 			is_metaslot = B_TRUE;
3050Sstevel@tonic-gate 			found = B_TRUE;
3060Sstevel@tonic-gate 		} else if (strncmp(argv[c], KN_PROVIDER,
3070Sstevel@tonic-gate 		    strlen(KN_PROVIDER)) == 0 &&
3080Sstevel@tonic-gate 		    strlen(argv[c]) > strlen(KN_PROVIDER)) {
3090Sstevel@tonic-gate 			if ((provstr = strdup(argv[c])) == NULL) {
3100Sstevel@tonic-gate 				int err = errno;
3110Sstevel@tonic-gate 				/*
3127334SDaniel.Anderson@Sun.COM 				 * TRANSLATION_NOTE
3130Sstevel@tonic-gate 				 * "get_provider" is a function name and should
3140Sstevel@tonic-gate 				 * not be translated.
3150Sstevel@tonic-gate 				 */
3160Sstevel@tonic-gate 				cryptoerror(LOG_STDERR, "get_provider: %s.",
3170Sstevel@tonic-gate 				    strerror(err));
3180Sstevel@tonic-gate 				return (NULL);
3190Sstevel@tonic-gate 			}
3200Sstevel@tonic-gate 			found = B_TRUE;
3210Sstevel@tonic-gate 		}
3220Sstevel@tonic-gate 	}
3230Sstevel@tonic-gate 	if (!found)
3240Sstevel@tonic-gate 		return (NULL);
3250Sstevel@tonic-gate 
3260Sstevel@tonic-gate 	provider = malloc(sizeof (cryptoadm_provider_t));
3270Sstevel@tonic-gate 	if (provider == NULL) {
3280Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("out of memory."));
3290Sstevel@tonic-gate 		if (provstr) {
3300Sstevel@tonic-gate 			free(provstr);
3310Sstevel@tonic-gate 		}
3320Sstevel@tonic-gate 		return (NULL);
3330Sstevel@tonic-gate 	}
3340Sstevel@tonic-gate 
3350Sstevel@tonic-gate 	if (is_metaslot) {
3360Sstevel@tonic-gate 		(void) strlcpy(provider->cp_name, METASLOT_KEYWORD,
3370Sstevel@tonic-gate 		    strlen(METASLOT_KEYWORD));
3380Sstevel@tonic-gate 		provider->cp_type = METASLOT;
3390Sstevel@tonic-gate 	} else {
3400Sstevel@tonic-gate 
3410Sstevel@tonic-gate 		savstr = provstr;
3420Sstevel@tonic-gate 		(void) strtok(provstr, "=");
3430Sstevel@tonic-gate 		provstr = strtok(NULL, "=");
3440Sstevel@tonic-gate 		if (provstr == NULL) {
3450Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext("bad provider name."));
3460Sstevel@tonic-gate 			provider->cp_type = PROV_BADNAME;
3470Sstevel@tonic-gate 			free(savstr);
3480Sstevel@tonic-gate 			return (provider);
3490Sstevel@tonic-gate 		}
3500Sstevel@tonic-gate 
3510Sstevel@tonic-gate 		(void) strlcpy(provider->cp_name, provstr,
3520Sstevel@tonic-gate 		    sizeof (provider->cp_name));
3530Sstevel@tonic-gate 		provider->cp_type = get_provider_type(provider->cp_name);
3540Sstevel@tonic-gate 
3550Sstevel@tonic-gate 		free(savstr);
3560Sstevel@tonic-gate 	}
3570Sstevel@tonic-gate 	return (provider);
3580Sstevel@tonic-gate }
3590Sstevel@tonic-gate 
3600Sstevel@tonic-gate /*
3610Sstevel@tonic-gate  * Process the "feature" operands.
3620Sstevel@tonic-gate  *
3630Sstevel@tonic-gate  * "argc" and "argv" contain values specified on the command line.
3640Sstevel@tonic-gate  * All other arguments are used for returning parsing results.
3650Sstevel@tonic-gate  * If any of these arguments are NULL, that keyword is not expected,
3660Sstevel@tonic-gate  * and FAILURE will be returned.
3670Sstevel@tonic-gate  */
3680Sstevel@tonic-gate static int
process_metaslot_operands(int argc,char ** argv,char ** meta_ks_token,char ** meta_ks_slot,boolean_t * use_default,boolean_t * auto_key_migrate_flag)3690Sstevel@tonic-gate process_metaslot_operands(int argc, char **argv, char **meta_ks_token,
3700Sstevel@tonic-gate     char **meta_ks_slot, boolean_t *use_default,
3710Sstevel@tonic-gate     boolean_t *auto_key_migrate_flag)
3720Sstevel@tonic-gate {
3730Sstevel@tonic-gate 	int c = 2;
3740Sstevel@tonic-gate 	int rc = SUCCESS;
3750Sstevel@tonic-gate 
3760Sstevel@tonic-gate 	while (++c < argc) {
3770Sstevel@tonic-gate 		if ((strncmp(argv[c], KN_MECH, strlen(KN_MECH)) == 0) &&
3780Sstevel@tonic-gate 		    strlen(argv[c]) > strlen(KN_MECH)) {
3790Sstevel@tonic-gate 
3800Sstevel@tonic-gate 			/* process mechanism operands */
3810Sstevel@tonic-gate 			if ((rc = process_mech_operands(argc, argv, B_TRUE))
3820Sstevel@tonic-gate 			    != SUCCESS) {
3830Sstevel@tonic-gate 				goto finish;
3840Sstevel@tonic-gate 			}
3850Sstevel@tonic-gate 
3860Sstevel@tonic-gate 		} else if ((strncmp(argv[c], KN_TOKEN,
3870Sstevel@tonic-gate 		    strlen(KN_TOKEN)) == 0) &&
3880Sstevel@tonic-gate 		    strlen(argv[c]) > strlen(KN_TOKEN)) {
3890Sstevel@tonic-gate 			if ((meta_ks_token) && (strtok(argv[c], "=") != NULL)) {
3900Sstevel@tonic-gate 				char *tmp;
3910Sstevel@tonic-gate 				if ((tmp = strtok(NULL, "=")) != NULL) {
3920Sstevel@tonic-gate 					*meta_ks_token = strdup(tmp);
3930Sstevel@tonic-gate 				} else {
3940Sstevel@tonic-gate 					return (FAILURE);
3950Sstevel@tonic-gate 				}
3960Sstevel@tonic-gate 			} else {
3970Sstevel@tonic-gate 				return (FAILURE);
3980Sstevel@tonic-gate 			}
3990Sstevel@tonic-gate 
4000Sstevel@tonic-gate 		} else if ((strncmp(argv[c], KN_SLOT,
4010Sstevel@tonic-gate 		    strlen(KN_SLOT)) == 0) &&
4020Sstevel@tonic-gate 		    strlen(argv[c]) > strlen(KN_SLOT)) {
4030Sstevel@tonic-gate 
4040Sstevel@tonic-gate 			if ((meta_ks_slot) && (strtok(argv[c], "=") != NULL)) {
4050Sstevel@tonic-gate 				char *tmp;
4060Sstevel@tonic-gate 				if ((tmp = strtok(NULL, "=")) != NULL) {
4070Sstevel@tonic-gate 					*meta_ks_slot = strdup(tmp);
4080Sstevel@tonic-gate 				} else {
4090Sstevel@tonic-gate 					return (FAILURE);
4100Sstevel@tonic-gate 				}
4110Sstevel@tonic-gate 			} else {
4120Sstevel@tonic-gate 				return (FAILURE);
4130Sstevel@tonic-gate 			}
4140Sstevel@tonic-gate 
4150Sstevel@tonic-gate 		} else if (strncmp(argv[c], KN_DEFAULT_KS,
4160Sstevel@tonic-gate 		    strlen(KN_DEFAULT_KS)) == 0) {
4170Sstevel@tonic-gate 
4180Sstevel@tonic-gate 			if (use_default) {
4190Sstevel@tonic-gate 				*use_default = B_TRUE;
4200Sstevel@tonic-gate 			} else {
4210Sstevel@tonic-gate 				return (FAILURE);
4220Sstevel@tonic-gate 			}
4230Sstevel@tonic-gate 		} else if (strncmp(argv[c], KN_AUTO_KEY_MIGRATE,
4240Sstevel@tonic-gate 		    strlen(KN_AUTO_KEY_MIGRATE)) == 0) {
4250Sstevel@tonic-gate 
4260Sstevel@tonic-gate 			if (auto_key_migrate_flag) {
4270Sstevel@tonic-gate 				*auto_key_migrate_flag = B_TRUE;
4280Sstevel@tonic-gate 			} else {
4290Sstevel@tonic-gate 				return (FAILURE);
4300Sstevel@tonic-gate 			}
4310Sstevel@tonic-gate 		} else {
4320Sstevel@tonic-gate 			return (FAILURE);
4330Sstevel@tonic-gate 		}
4340Sstevel@tonic-gate 	}
4350Sstevel@tonic-gate finish:
4360Sstevel@tonic-gate 	return (rc);
4370Sstevel@tonic-gate }
4380Sstevel@tonic-gate 
4390Sstevel@tonic-gate /*
4400Sstevel@tonic-gate  * Process the "feature" operands.
4410Sstevel@tonic-gate  */
4420Sstevel@tonic-gate static int
process_feature_operands(int argc,char ** argv)4430Sstevel@tonic-gate process_feature_operands(int argc, char **argv)
4440Sstevel@tonic-gate {
4450Sstevel@tonic-gate 	int c = 2;
4460Sstevel@tonic-gate 
4470Sstevel@tonic-gate 	while (++c < argc) {
4480Sstevel@tonic-gate 		if (strcmp(argv[c], KN_ALL) == 0) {
4490Sstevel@tonic-gate 			allflag = B_TRUE;
4500Sstevel@tonic-gate 			rndflag = B_TRUE; /* all includes random also. */
4510Sstevel@tonic-gate 		} else if (strcmp(argv[c], RANDOM) == 0) {
4520Sstevel@tonic-gate 			rndflag = B_TRUE;
4530Sstevel@tonic-gate 		}
4540Sstevel@tonic-gate 	}
4550Sstevel@tonic-gate 	return (SUCCESS);
4560Sstevel@tonic-gate }
4570Sstevel@tonic-gate 
4580Sstevel@tonic-gate /*
4590Sstevel@tonic-gate  * Process the mechanism operands for the disable, enable and install
4600Sstevel@tonic-gate  * subcommands.  This function sets the static variable allflag to be B_TRUE
4610Sstevel@tonic-gate  * if the keyword "all" is specified, otherwise builds a link list of the
4620Sstevel@tonic-gate  * mechanism operands and save it in the static variable mecharglist.
4630Sstevel@tonic-gate  *
4640Sstevel@tonic-gate  * This function returns
4657968Sopensolaris@drydog.com  *	ERROR_USAGE: mechanism operand is missing.
4667968Sopensolaris@drydog.com  *	FAILURE: out of memory.
4677968Sopensolaris@drydog.com  *	SUCCESS: otherwise.
4680Sstevel@tonic-gate  */
4690Sstevel@tonic-gate static int
process_mech_operands(int argc,char ** argv,boolean_t quiet)4700Sstevel@tonic-gate process_mech_operands(int argc, char **argv, boolean_t quiet)
4710Sstevel@tonic-gate {
4727968Sopensolaris@drydog.com 	mechlist_t	*pmech;
4737968Sopensolaris@drydog.com 	mechlist_t	*pcur = NULL;
4747968Sopensolaris@drydog.com 	mechlist_t	*phead = NULL;
4757968Sopensolaris@drydog.com 	boolean_t	found = B_FALSE;
4767968Sopensolaris@drydog.com 	char		*mechliststr = NULL;
4777968Sopensolaris@drydog.com 	char		*curmech = NULL;
4787968Sopensolaris@drydog.com 	int		c = -1;
4797968Sopensolaris@drydog.com 	int		rc = SUCCESS;
4800Sstevel@tonic-gate 
4810Sstevel@tonic-gate 	while (!found && ++c < argc) {
4820Sstevel@tonic-gate 		if ((strncmp(argv[c], KN_MECH, strlen(KN_MECH)) == 0) &&
4830Sstevel@tonic-gate 		    strlen(argv[c]) > strlen(KN_MECH)) {
4840Sstevel@tonic-gate 			found = B_TRUE;
4850Sstevel@tonic-gate 		}
4860Sstevel@tonic-gate 	}
4870Sstevel@tonic-gate 	if (!found) {
4880Sstevel@tonic-gate 		if (!quiet)
4890Sstevel@tonic-gate 			/*
4907334SDaniel.Anderson@Sun.COM 			 * TRANSLATION_NOTE
4910Sstevel@tonic-gate 			 * "mechanism" could be either a literal keyword
4920Sstevel@tonic-gate 			 * and hence not to be translated, or a descriptive
4930Sstevel@tonic-gate 			 * word and translatable.  A choice was made to
4940Sstevel@tonic-gate 			 * view it as a literal keyword.
4950Sstevel@tonic-gate 			 */
4960Sstevel@tonic-gate 			cryptoerror(LOG_STDERR,
4977968Sopensolaris@drydog.com 			    gettext("the %s operand is missing.\n"),
4987968Sopensolaris@drydog.com 			    "mechanism");
4990Sstevel@tonic-gate 		return (ERROR_USAGE);
5000Sstevel@tonic-gate 	}
5010Sstevel@tonic-gate 	(void) strtok(argv[c], "=");
5020Sstevel@tonic-gate 	mechliststr = strtok(NULL, "=");
5030Sstevel@tonic-gate 
5040Sstevel@tonic-gate 	if (strcmp(mechliststr, "all") == 0) {
5050Sstevel@tonic-gate 		allflag = B_TRUE;
5060Sstevel@tonic-gate 		mecharglist = NULL;
5070Sstevel@tonic-gate 		return (SUCCESS);
5080Sstevel@tonic-gate 	}
5090Sstevel@tonic-gate 
5100Sstevel@tonic-gate 	curmech = strtok(mechliststr, ",");
5110Sstevel@tonic-gate 	do {
5120Sstevel@tonic-gate 		if ((pmech = create_mech(curmech)) == NULL) {
5130Sstevel@tonic-gate 			rc = FAILURE;
5140Sstevel@tonic-gate 			break;
5150Sstevel@tonic-gate 		} else {
5160Sstevel@tonic-gate 			if (phead == NULL) {
5170Sstevel@tonic-gate 				phead = pcur = pmech;
5180Sstevel@tonic-gate 			} else {
5190Sstevel@tonic-gate 				pcur->next = pmech;
5200Sstevel@tonic-gate 				pcur = pmech;
5210Sstevel@tonic-gate 			}
5220Sstevel@tonic-gate 		}
5230Sstevel@tonic-gate 	} while ((curmech = strtok(NULL, ",")) != NULL);
5240Sstevel@tonic-gate 
5250Sstevel@tonic-gate 	if (rc == FAILURE) {
5260Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("out of memory."));
5270Sstevel@tonic-gate 		free_mechlist(phead);
5280Sstevel@tonic-gate 	} else {
5290Sstevel@tonic-gate 		mecharglist = phead;
5300Sstevel@tonic-gate 		rc = SUCCESS;
5310Sstevel@tonic-gate 	}
5320Sstevel@tonic-gate 	return (rc);
5330Sstevel@tonic-gate }
5340Sstevel@tonic-gate 
5350Sstevel@tonic-gate 
5360Sstevel@tonic-gate 
5370Sstevel@tonic-gate /*
5387968Sopensolaris@drydog.com  * The top level function for the "cryptoadm list" subcommand and options.
5390Sstevel@tonic-gate  */
5400Sstevel@tonic-gate static int
do_list(int argc,char ** argv)5410Sstevel@tonic-gate do_list(int argc, char **argv)
5420Sstevel@tonic-gate {
5437968Sopensolaris@drydog.com 	boolean_t		mflag = B_FALSE;
5447968Sopensolaris@drydog.com 	boolean_t		pflag = B_FALSE;
5457968Sopensolaris@drydog.com 	boolean_t		vflag = B_FALSE;
5467968Sopensolaris@drydog.com 	char			ch;
5477968Sopensolaris@drydog.com 	cryptoadm_provider_t	*prov = NULL;
5487968Sopensolaris@drydog.com 	int			rc = SUCCESS;
5490Sstevel@tonic-gate 
55010500SHai-May.Chao@Sun.COM 	if ((argc == 3) && (strncmp(argv[2], FIPS_KEYWORD,
55110500SHai-May.Chao@Sun.COM 	    strlen(FIPS_KEYWORD))) == 0) {
552*12929SMisaki.Miyashita@Oracle.COM 		int	success_count = 0;
55310500SHai-May.Chao@Sun.COM 		/*
55410500SHai-May.Chao@Sun.COM 		 * cryptoadm list fips-140
55510500SHai-May.Chao@Sun.COM 		 */
55610500SHai-May.Chao@Sun.COM 		rc = do_fips_actions(FIPS140_STATUS, NOT_REFRESH);
557*12929SMisaki.Miyashita@Oracle.COM 		if (rc == SUCCESS)
558*12929SMisaki.Miyashita@Oracle.COM 			success_count++;
559*12929SMisaki.Miyashita@Oracle.COM 		(void) printf(gettext("\nKernel hardware providers:\n"));
560*12929SMisaki.Miyashita@Oracle.COM 		(void) printf(gettext("=========================:\n"));
561*12929SMisaki.Miyashita@Oracle.COM 		rc = do_fips_hw_actions(FIPS140_STATUS, HW_PROVIDER_NCP);
562*12929SMisaki.Miyashita@Oracle.COM 		if (rc == SUCCESS)
563*12929SMisaki.Miyashita@Oracle.COM 			success_count++;
564*12929SMisaki.Miyashita@Oracle.COM 		rc = do_fips_hw_actions(FIPS140_STATUS, HW_PROVIDER_N2CP);
565*12929SMisaki.Miyashita@Oracle.COM 		if (rc == SUCCESS)
566*12929SMisaki.Miyashita@Oracle.COM 			success_count++;
567*12929SMisaki.Miyashita@Oracle.COM 		rc = do_fips_hw_actions(FIPS140_STATUS, HW_PROVIDER_N2RNG);
568*12929SMisaki.Miyashita@Oracle.COM 		if (rc == SUCCESS)
569*12929SMisaki.Miyashita@Oracle.COM 			success_count++;
570*12929SMisaki.Miyashita@Oracle.COM 		/* succeed to get status from config file? */
571*12929SMisaki.Miyashita@Oracle.COM 		return ((success_count > 0) ? SUCCESS: FAILURE);
57210500SHai-May.Chao@Sun.COM 	}
57310500SHai-May.Chao@Sun.COM 
5740Sstevel@tonic-gate 	argc -= 1;
5750Sstevel@tonic-gate 	argv += 1;
5760Sstevel@tonic-gate 
5770Sstevel@tonic-gate 	if (argc == 1) {
5780Sstevel@tonic-gate 		rc = list_simple_for_all(B_FALSE);
5790Sstevel@tonic-gate 		goto out;
5800Sstevel@tonic-gate 	}
5810Sstevel@tonic-gate 
5820Sstevel@tonic-gate 	/*
5837968Sopensolaris@drydog.com 	 * cryptoadm list [-v] [-m] [-p] [provider=<>] [mechanism=<>]
5840Sstevel@tonic-gate 	 */
5850Sstevel@tonic-gate 	if (argc > 5) {
5860Sstevel@tonic-gate 		usage();
5870Sstevel@tonic-gate 		return (rc);
5880Sstevel@tonic-gate 	}
5890Sstevel@tonic-gate 
5900Sstevel@tonic-gate 	while ((ch = getopt(argc, argv, "mpv")) != EOF) {
5910Sstevel@tonic-gate 		switch (ch) {
5920Sstevel@tonic-gate 		case 'm':
5930Sstevel@tonic-gate 			mflag = B_TRUE;
5940Sstevel@tonic-gate 			if (pflag) {
5950Sstevel@tonic-gate 				rc = ERROR_USAGE;
5960Sstevel@tonic-gate 			}
5970Sstevel@tonic-gate 			break;
5980Sstevel@tonic-gate 		case 'p':
5990Sstevel@tonic-gate 			pflag = B_TRUE;
6000Sstevel@tonic-gate 			if (mflag || vflag) {
6010Sstevel@tonic-gate 				rc = ERROR_USAGE;
6020Sstevel@tonic-gate 			}
6030Sstevel@tonic-gate 			break;
6040Sstevel@tonic-gate 		case 'v':
6050Sstevel@tonic-gate 			vflag = B_TRUE;
6060Sstevel@tonic-gate 			if (pflag)
6070Sstevel@tonic-gate 				rc = ERROR_USAGE;
6080Sstevel@tonic-gate 			break;
6090Sstevel@tonic-gate 		default:
6100Sstevel@tonic-gate 			rc = ERROR_USAGE;
6110Sstevel@tonic-gate 			break;
6120Sstevel@tonic-gate 		}
6130Sstevel@tonic-gate 	}
6140Sstevel@tonic-gate 
6150Sstevel@tonic-gate 	if (rc == ERROR_USAGE) {
6160Sstevel@tonic-gate 		usage();
6170Sstevel@tonic-gate 		return (rc);
6180Sstevel@tonic-gate 	}
6190Sstevel@tonic-gate 
6200Sstevel@tonic-gate 	if ((rc = process_feature_operands(argc, argv)) != SUCCESS) {
6210Sstevel@tonic-gate 		goto out;
6220Sstevel@tonic-gate 	}
6230Sstevel@tonic-gate 
6240Sstevel@tonic-gate 	prov = get_provider(argc, argv);
6250Sstevel@tonic-gate 
6260Sstevel@tonic-gate 	if (mflag || vflag) {
6270Sstevel@tonic-gate 		if (argc > 0) {
6280Sstevel@tonic-gate 			rc = process_mech_operands(argc, argv, B_TRUE);
6290Sstevel@tonic-gate 			if (rc == FAILURE)
6300Sstevel@tonic-gate 				goto out;
6310Sstevel@tonic-gate 			/* "-m" is implied when a mechanism list is given */
6320Sstevel@tonic-gate 			if (mecharglist != NULL || allflag)
6330Sstevel@tonic-gate 				mflag = B_TRUE;
6340Sstevel@tonic-gate 		}
6350Sstevel@tonic-gate 	}
6360Sstevel@tonic-gate 
6370Sstevel@tonic-gate 	if (prov == NULL) {
6380Sstevel@tonic-gate 		if (mflag) {
6390Sstevel@tonic-gate 			rc = list_mechlist_for_all(vflag);
6400Sstevel@tonic-gate 		} else if (pflag) {
6410Sstevel@tonic-gate 			rc = list_policy_for_all();
6420Sstevel@tonic-gate 		} else if (vflag) {
6430Sstevel@tonic-gate 			rc = list_simple_for_all(vflag);
6440Sstevel@tonic-gate 		}
6450Sstevel@tonic-gate 	} else if (prov->cp_type == METASLOT) {
6460Sstevel@tonic-gate 		if ((!mflag) && (!vflag) && (!pflag)) {
6470Sstevel@tonic-gate 			/* no flag is specified, just list metaslot status */
6480Sstevel@tonic-gate 			rc = list_metaslot_info(mflag, vflag, mecharglist);
6490Sstevel@tonic-gate 		} else if (mflag || vflag) {
6500Sstevel@tonic-gate 			rc = list_metaslot_info(mflag, vflag, mecharglist);
6510Sstevel@tonic-gate 		} else if (pflag) {
6520Sstevel@tonic-gate 			rc = list_metaslot_policy();
6530Sstevel@tonic-gate 		} else {
6540Sstevel@tonic-gate 			/* error message */
6550Sstevel@tonic-gate 			usage();
6560Sstevel@tonic-gate 			rc = ERROR_USAGE;
6570Sstevel@tonic-gate 		}
6580Sstevel@tonic-gate 	} else if (prov->cp_type == PROV_BADNAME) {
6590Sstevel@tonic-gate 		usage();
6600Sstevel@tonic-gate 		rc = ERROR_USAGE;
6610Sstevel@tonic-gate 		goto out;
6620Sstevel@tonic-gate 	} else { /* do the listing for a provider only */
6637968Sopensolaris@drydog.com 		char	*provname = prov->cp_name;
6647968Sopensolaris@drydog.com 
6650Sstevel@tonic-gate 		if (mflag || vflag) {
6660Sstevel@tonic-gate 			if (vflag)
6670Sstevel@tonic-gate 				(void) printf(gettext("Provider: %s\n"),
6687968Sopensolaris@drydog.com 				    provname);
6690Sstevel@tonic-gate 			switch (prov->cp_type) {
6700Sstevel@tonic-gate 			case PROV_UEF_LIB:
6717968Sopensolaris@drydog.com 				rc = list_mechlist_for_lib(provname,
6727968Sopensolaris@drydog.com 				    mecharglist, NULL, B_FALSE, vflag, mflag);
6730Sstevel@tonic-gate 				break;
6740Sstevel@tonic-gate 			case PROV_KEF_SOFT:
6757968Sopensolaris@drydog.com 				rc = list_mechlist_for_soft(provname,
67610979SHai-May.Chao@Sun.COM 				    NULL, NULL);
6770Sstevel@tonic-gate 				break;
6780Sstevel@tonic-gate 			case PROV_KEF_HARD:
6797968Sopensolaris@drydog.com 				rc = list_mechlist_for_hard(provname);
6800Sstevel@tonic-gate 				break;
6810Sstevel@tonic-gate 			default: /* should not come here */
6820Sstevel@tonic-gate 				rc = FAILURE;
6830Sstevel@tonic-gate 				break;
6840Sstevel@tonic-gate 			}
6850Sstevel@tonic-gate 		} else if (pflag) {
6860Sstevel@tonic-gate 			switch (prov->cp_type) {
6870Sstevel@tonic-gate 			case PROV_UEF_LIB:
6887968Sopensolaris@drydog.com 				rc = list_policy_for_lib(provname);
6890Sstevel@tonic-gate 				break;
6900Sstevel@tonic-gate 			case PROV_KEF_SOFT:
6910Sstevel@tonic-gate 				if (getzoneid() == GLOBAL_ZONEID) {
6927968Sopensolaris@drydog.com 					rc = list_policy_for_soft(provname,
69310979SHai-May.Chao@Sun.COM 					    NULL, NULL);
6940Sstevel@tonic-gate 				} else {
6950Sstevel@tonic-gate 					/*
6967334SDaniel.Anderson@Sun.COM 					 * TRANSLATION_NOTE
6970Sstevel@tonic-gate 					 * "global" is keyword and not to
6980Sstevel@tonic-gate 					 * be translated.
6990Sstevel@tonic-gate 					 */
7000Sstevel@tonic-gate 					cryptoerror(LOG_STDERR, gettext(
7010Sstevel@tonic-gate 					    "policy information for kernel "
7020Sstevel@tonic-gate 					    "providers is available "
7030Sstevel@tonic-gate 					    "in the %s zone only"), "global");
7040Sstevel@tonic-gate 					rc = FAILURE;
7050Sstevel@tonic-gate 				}
7060Sstevel@tonic-gate 				break;
7070Sstevel@tonic-gate 			case PROV_KEF_HARD:
7080Sstevel@tonic-gate 				if (getzoneid() == GLOBAL_ZONEID) {
7090Sstevel@tonic-gate 					rc = list_policy_for_hard(
71010979SHai-May.Chao@Sun.COM 					    provname, NULL, NULL, NULL);
7110Sstevel@tonic-gate 				} else {
7120Sstevel@tonic-gate 					/*
7137334SDaniel.Anderson@Sun.COM 					 * TRANSLATION_NOTE
7140Sstevel@tonic-gate 					 * "global" is keyword and not to
7150Sstevel@tonic-gate 					 * be translated.
7160Sstevel@tonic-gate 					 */
7170Sstevel@tonic-gate 					cryptoerror(LOG_STDERR, gettext(
7180Sstevel@tonic-gate 					    "policy information for kernel "
7190Sstevel@tonic-gate 					    "providers is available "
7200Sstevel@tonic-gate 					    "in the %s zone only"), "global");
7210Sstevel@tonic-gate 					rc = FAILURE;
7220Sstevel@tonic-gate 				}
7230Sstevel@tonic-gate 
7240Sstevel@tonic-gate 				break;
7250Sstevel@tonic-gate 			default: /* should not come here */
7260Sstevel@tonic-gate 				rc = FAILURE;
7270Sstevel@tonic-gate 				break;
7280Sstevel@tonic-gate 			}
7290Sstevel@tonic-gate 		} else {
7300Sstevel@tonic-gate 			/* error message */
7310Sstevel@tonic-gate 			usage();
7320Sstevel@tonic-gate 			rc = ERROR_USAGE;
7330Sstevel@tonic-gate 		}
7340Sstevel@tonic-gate 	}
7350Sstevel@tonic-gate 
7360Sstevel@tonic-gate out:
7370Sstevel@tonic-gate 	if (prov != NULL)
7380Sstevel@tonic-gate 		free(prov);
7390Sstevel@tonic-gate 
7400Sstevel@tonic-gate 	if (mecharglist != NULL)
7410Sstevel@tonic-gate 		free_mechlist(mecharglist);
7420Sstevel@tonic-gate 	return (rc);
7430Sstevel@tonic-gate }
7440Sstevel@tonic-gate 
7450Sstevel@tonic-gate 
7460Sstevel@tonic-gate /*
7477968Sopensolaris@drydog.com  * The top level function for the "cryptoadm disable" subcommand.
7480Sstevel@tonic-gate  */
7490Sstevel@tonic-gate static int
do_disable(int argc,char ** argv)7500Sstevel@tonic-gate do_disable(int argc, char **argv)
7510Sstevel@tonic-gate {
7520Sstevel@tonic-gate 	cryptoadm_provider_t	*prov = NULL;
7537968Sopensolaris@drydog.com 	int			rc = SUCCESS;
7547968Sopensolaris@drydog.com 	boolean_t		auto_key_migrate_flag = B_FALSE;
7550Sstevel@tonic-gate 
75610500SHai-May.Chao@Sun.COM 	if ((argc == 3) && (strncmp(argv[2], FIPS_KEYWORD,
75710500SHai-May.Chao@Sun.COM 	    strlen(FIPS_KEYWORD))) == 0) {
758*12929SMisaki.Miyashita@Oracle.COM 		int	success_count = 0;
75910500SHai-May.Chao@Sun.COM 		/*
76010500SHai-May.Chao@Sun.COM 		 * cryptoadm disable fips-140
76110500SHai-May.Chao@Sun.COM 		 */
76210500SHai-May.Chao@Sun.COM 		rc = do_fips_actions(FIPS140_DISABLE, NOT_REFRESH);
763*12929SMisaki.Miyashita@Oracle.COM 		if (rc == SUCCESS)
764*12929SMisaki.Miyashita@Oracle.COM 			success_count++;
765*12929SMisaki.Miyashita@Oracle.COM 		(void) printf(gettext("\nKernel hardware providers:\n"));
766*12929SMisaki.Miyashita@Oracle.COM 		(void) printf(gettext("=========================:\n"));
767*12929SMisaki.Miyashita@Oracle.COM 		rc = do_fips_hw_actions(FIPS140_DISABLE, HW_PROVIDER_NCP);
768*12929SMisaki.Miyashita@Oracle.COM 		if (rc == SUCCESS)
769*12929SMisaki.Miyashita@Oracle.COM 			success_count++;
770*12929SMisaki.Miyashita@Oracle.COM 		rc = do_fips_hw_actions(FIPS140_DISABLE, HW_PROVIDER_N2CP);
771*12929SMisaki.Miyashita@Oracle.COM 		if (rc == SUCCESS)
772*12929SMisaki.Miyashita@Oracle.COM 			success_count++;
773*12929SMisaki.Miyashita@Oracle.COM 		rc = do_fips_hw_actions(FIPS140_DISABLE, HW_PROVIDER_N2RNG);
774*12929SMisaki.Miyashita@Oracle.COM 		if (rc == SUCCESS)
775*12929SMisaki.Miyashita@Oracle.COM 			success_count++;
776*12929SMisaki.Miyashita@Oracle.COM 
777*12929SMisaki.Miyashita@Oracle.COM 		if (success_count > 0) {
778*12929SMisaki.Miyashita@Oracle.COM 			(void) printf(gettext(
779*12929SMisaki.Miyashita@Oracle.COM 			    "\nThe FIPS-140 mode has changed.\n"));
780*12929SMisaki.Miyashita@Oracle.COM 			(void) printf(gettext(
781*12929SMisaki.Miyashita@Oracle.COM 			    "The system will require a reboot.\n"));
782*12929SMisaki.Miyashita@Oracle.COM 			return (SUCCESS);
783*12929SMisaki.Miyashita@Oracle.COM 		} else {
784*12929SMisaki.Miyashita@Oracle.COM 			return (FAILURE);
785*12929SMisaki.Miyashita@Oracle.COM 		}
78610500SHai-May.Chao@Sun.COM 	}
78710500SHai-May.Chao@Sun.COM 
7880Sstevel@tonic-gate 	if ((argc < 3) || (argc > 5)) {
7890Sstevel@tonic-gate 		usage();
7900Sstevel@tonic-gate 		return (ERROR_USAGE);
7910Sstevel@tonic-gate 	}
7920Sstevel@tonic-gate 
7930Sstevel@tonic-gate 	prov = get_provider(argc, argv);
7940Sstevel@tonic-gate 	if (prov == NULL) {
7950Sstevel@tonic-gate 		usage();
7960Sstevel@tonic-gate 		return (ERROR_USAGE);
7970Sstevel@tonic-gate 	}
7980Sstevel@tonic-gate 	if (prov->cp_type == PROV_BADNAME) {
7990Sstevel@tonic-gate 		return (FAILURE);
8000Sstevel@tonic-gate 	}
8010Sstevel@tonic-gate 
8020Sstevel@tonic-gate 	if ((rc = process_feature_operands(argc, argv)) != SUCCESS) {
8030Sstevel@tonic-gate 		goto out;
8040Sstevel@tonic-gate 	}
8050Sstevel@tonic-gate 
8060Sstevel@tonic-gate 	/*
8070Sstevel@tonic-gate 	 * If allflag or rndflag has already been set there is no reason to
8080Sstevel@tonic-gate 	 * process mech=
8090Sstevel@tonic-gate 	 */
8100Sstevel@tonic-gate 	if (prov->cp_type == METASLOT) {
8110Sstevel@tonic-gate 		if ((argc > 3) &&
8120Sstevel@tonic-gate 		    (rc = process_metaslot_operands(argc, argv,
8130Sstevel@tonic-gate 		    NULL, NULL, NULL, &auto_key_migrate_flag)) != SUCCESS) {
8140Sstevel@tonic-gate 			usage();
8150Sstevel@tonic-gate 			return (rc);
8160Sstevel@tonic-gate 		}
8170Sstevel@tonic-gate 	} else if (!allflag && !rndflag &&
8187968Sopensolaris@drydog.com 	    (rc = process_mech_operands(argc, argv, B_FALSE)) != SUCCESS) {
8190Sstevel@tonic-gate 			return (rc);
8200Sstevel@tonic-gate 	}
8210Sstevel@tonic-gate 
8220Sstevel@tonic-gate 	switch (prov->cp_type) {
8230Sstevel@tonic-gate 	case METASLOT:
8240Sstevel@tonic-gate 		rc = disable_metaslot(mecharglist, allflag,
8250Sstevel@tonic-gate 		    auto_key_migrate_flag);
8260Sstevel@tonic-gate 		break;
8270Sstevel@tonic-gate 	case PROV_UEF_LIB:
8280Sstevel@tonic-gate 		rc = disable_uef_lib(prov->cp_name, rndflag, allflag,
8290Sstevel@tonic-gate 		    mecharglist);
8300Sstevel@tonic-gate 		break;
8310Sstevel@tonic-gate 	case PROV_KEF_SOFT:
8320Sstevel@tonic-gate 		if (rndflag && !allflag) {
8330Sstevel@tonic-gate 			if ((mecharglist = create_mech(RANDOM)) == NULL) {
8340Sstevel@tonic-gate 				rc = FAILURE;
8350Sstevel@tonic-gate 				break;
8360Sstevel@tonic-gate 			}
8370Sstevel@tonic-gate 		}
8380Sstevel@tonic-gate 		if (getzoneid() == GLOBAL_ZONEID) {
8390Sstevel@tonic-gate 			rc = disable_kef_software(prov->cp_name, rndflag,
8400Sstevel@tonic-gate 			    allflag, mecharglist);
8410Sstevel@tonic-gate 		} else {
8420Sstevel@tonic-gate 			/*
8437334SDaniel.Anderson@Sun.COM 			 * TRANSLATION_NOTE
8440Sstevel@tonic-gate 			 * "disable" could be either a literal keyword
8450Sstevel@tonic-gate 			 * and hence not to be translated, or a verb and
8460Sstevel@tonic-gate 			 * translatable.  A choice was made to view it as
8470Sstevel@tonic-gate 			 * a literal keyword.  "global" is keyword and not
8480Sstevel@tonic-gate 			 * to be translated.
8490Sstevel@tonic-gate 			 */
8500Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext("%1$s for kernel "
8510Sstevel@tonic-gate 			    "providers is supported in the %2$s zone only"),
8520Sstevel@tonic-gate 			    "disable", "global");
8530Sstevel@tonic-gate 			rc = FAILURE;
8540Sstevel@tonic-gate 		}
8550Sstevel@tonic-gate 		break;
8560Sstevel@tonic-gate 	case PROV_KEF_HARD:
8570Sstevel@tonic-gate 		if (rndflag && !allflag) {
8580Sstevel@tonic-gate 			if ((mecharglist = create_mech(RANDOM)) == NULL) {
8590Sstevel@tonic-gate 				rc = FAILURE;
8600Sstevel@tonic-gate 				break;
8610Sstevel@tonic-gate 			}
8620Sstevel@tonic-gate 		}
8630Sstevel@tonic-gate 		if (getzoneid() == GLOBAL_ZONEID) {
8640Sstevel@tonic-gate 			rc = disable_kef_hardware(prov->cp_name, rndflag,
8650Sstevel@tonic-gate 			    allflag, mecharglist);
8660Sstevel@tonic-gate 		} else {
8670Sstevel@tonic-gate 			/*
8687334SDaniel.Anderson@Sun.COM 			 * TRANSLATION_NOTE
8690Sstevel@tonic-gate 			 * "disable" could be either a literal keyword
8700Sstevel@tonic-gate 			 * and hence not to be translated, or a verb and
8710Sstevel@tonic-gate 			 * translatable.  A choice was made to view it as
8720Sstevel@tonic-gate 			 * a literal keyword.  "global" is keyword and not
8730Sstevel@tonic-gate 			 * to be translated.
8740Sstevel@tonic-gate 			 */
8750Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext("%1$s for kernel "
8760Sstevel@tonic-gate 			    "providers is supported in the %2$s zone only"),
8770Sstevel@tonic-gate 			    "disable", "global");
8780Sstevel@tonic-gate 			rc = FAILURE;
8790Sstevel@tonic-gate 		}
8800Sstevel@tonic-gate 		break;
8810Sstevel@tonic-gate 	default: /* should not come here */
8820Sstevel@tonic-gate 		rc = FAILURE;
8830Sstevel@tonic-gate 		break;
8840Sstevel@tonic-gate 	}
8850Sstevel@tonic-gate 
8860Sstevel@tonic-gate out:
8870Sstevel@tonic-gate 	free(prov);
8880Sstevel@tonic-gate 	if (mecharglist != NULL) {
8890Sstevel@tonic-gate 		free_mechlist(mecharglist);
8900Sstevel@tonic-gate 	}
8910Sstevel@tonic-gate 	return (rc);
8920Sstevel@tonic-gate }
8930Sstevel@tonic-gate 
8940Sstevel@tonic-gate 
8950Sstevel@tonic-gate /*
8967968Sopensolaris@drydog.com  * The top level function for the "cryptoadm enable" subcommand.
8970Sstevel@tonic-gate  */
8980Sstevel@tonic-gate static int
do_enable(int argc,char ** argv)8990Sstevel@tonic-gate do_enable(int argc, char **argv)
9000Sstevel@tonic-gate {
9017968Sopensolaris@drydog.com 	cryptoadm_provider_t	*prov = NULL;
9027968Sopensolaris@drydog.com 	int			rc = SUCCESS;
9037968Sopensolaris@drydog.com 	char 			*alt_token = NULL, *alt_slot = NULL;
9047968Sopensolaris@drydog.com 	boolean_t		use_default = B_FALSE;
9057968Sopensolaris@drydog.com 	boolean_t		auto_key_migrate_flag = B_FALSE;
9060Sstevel@tonic-gate 
90710500SHai-May.Chao@Sun.COM 	if ((argc == 3) && (strncmp(argv[2], FIPS_KEYWORD,
90810500SHai-May.Chao@Sun.COM 	    strlen(FIPS_KEYWORD))) == 0) {
909*12929SMisaki.Miyashita@Oracle.COM 		int	success_count = 0;
91010500SHai-May.Chao@Sun.COM 		/*
91110500SHai-May.Chao@Sun.COM 		 * cryptoadm enable fips-140
91210500SHai-May.Chao@Sun.COM 		 */
91310500SHai-May.Chao@Sun.COM 		rc = do_fips_actions(FIPS140_ENABLE, NOT_REFRESH);
914*12929SMisaki.Miyashita@Oracle.COM 		if (rc == SUCCESS)
915*12929SMisaki.Miyashita@Oracle.COM 			success_count++;
916*12929SMisaki.Miyashita@Oracle.COM 		(void) printf(gettext("\nKernel hardware providers:\n"));
917*12929SMisaki.Miyashita@Oracle.COM 		(void) printf(gettext("=========================:\n"));
918*12929SMisaki.Miyashita@Oracle.COM 		rc = do_fips_hw_actions(FIPS140_ENABLE, HW_PROVIDER_NCP);
919*12929SMisaki.Miyashita@Oracle.COM 		if (rc == SUCCESS)
920*12929SMisaki.Miyashita@Oracle.COM 			success_count++;
921*12929SMisaki.Miyashita@Oracle.COM 		rc = do_fips_hw_actions(FIPS140_ENABLE, HW_PROVIDER_N2CP);
922*12929SMisaki.Miyashita@Oracle.COM 		if (rc == SUCCESS)
923*12929SMisaki.Miyashita@Oracle.COM 			success_count++;
924*12929SMisaki.Miyashita@Oracle.COM 		rc = do_fips_hw_actions(FIPS140_ENABLE, HW_PROVIDER_N2RNG);
925*12929SMisaki.Miyashita@Oracle.COM 		if (rc == SUCCESS)
926*12929SMisaki.Miyashita@Oracle.COM 			success_count++;
927*12929SMisaki.Miyashita@Oracle.COM 
928*12929SMisaki.Miyashita@Oracle.COM 		if (success_count > 0) {
929*12929SMisaki.Miyashita@Oracle.COM 			(void) printf(gettext(
930*12929SMisaki.Miyashita@Oracle.COM 			    "\nThe FIPS-140 mode has changed.\n"));
931*12929SMisaki.Miyashita@Oracle.COM 			(void) printf(gettext(
932*12929SMisaki.Miyashita@Oracle.COM 			    "The system will require a reboot.\n"));
933*12929SMisaki.Miyashita@Oracle.COM 			return (SUCCESS);
934*12929SMisaki.Miyashita@Oracle.COM 		} else {
935*12929SMisaki.Miyashita@Oracle.COM 			return (FAILURE);
936*12929SMisaki.Miyashita@Oracle.COM 		}
93710500SHai-May.Chao@Sun.COM 	}
93810500SHai-May.Chao@Sun.COM 
9390Sstevel@tonic-gate 	if ((argc < 3) || (argc > 6)) {
9400Sstevel@tonic-gate 		usage();
9410Sstevel@tonic-gate 		return (ERROR_USAGE);
9420Sstevel@tonic-gate 	}
9430Sstevel@tonic-gate 
9440Sstevel@tonic-gate 	prov = get_provider(argc, argv);
9450Sstevel@tonic-gate 	if (prov == NULL) {
9460Sstevel@tonic-gate 		usage();
9470Sstevel@tonic-gate 		return (ERROR_USAGE);
9480Sstevel@tonic-gate 	}
9490Sstevel@tonic-gate 	if ((prov->cp_type != METASLOT) && (argc != 4)) {
9500Sstevel@tonic-gate 		usage();
9510Sstevel@tonic-gate 		return (ERROR_USAGE);
9520Sstevel@tonic-gate 	}
9530Sstevel@tonic-gate 	if (prov->cp_type == PROV_BADNAME) {
9540Sstevel@tonic-gate 		rc = FAILURE;
9550Sstevel@tonic-gate 		goto out;
9560Sstevel@tonic-gate 	}
9570Sstevel@tonic-gate 
9580Sstevel@tonic-gate 
9590Sstevel@tonic-gate 	if (prov->cp_type == METASLOT) {
9600Sstevel@tonic-gate 		if ((rc = process_metaslot_operands(argc, argv, &alt_token,
9610Sstevel@tonic-gate 		    &alt_slot, &use_default, &auto_key_migrate_flag))
9620Sstevel@tonic-gate 		    != SUCCESS) {
9630Sstevel@tonic-gate 			usage();
9640Sstevel@tonic-gate 			goto out;
9650Sstevel@tonic-gate 		}
9660Sstevel@tonic-gate 		if ((alt_slot || alt_token) && use_default) {
9670Sstevel@tonic-gate 			usage();
9680Sstevel@tonic-gate 			rc = FAILURE;
9690Sstevel@tonic-gate 			goto out;
9700Sstevel@tonic-gate 		}
9710Sstevel@tonic-gate 	} else {
9720Sstevel@tonic-gate 		if ((rc = process_feature_operands(argc, argv)) != SUCCESS) {
9730Sstevel@tonic-gate 			goto out;
9740Sstevel@tonic-gate 		}
9750Sstevel@tonic-gate 
9760Sstevel@tonic-gate 		/*
9770Sstevel@tonic-gate 		 * If allflag or rndflag has already been set there is
9780Sstevel@tonic-gate 		 * no reason to process mech=
9790Sstevel@tonic-gate 		 */
9800Sstevel@tonic-gate 		if (!allflag && !rndflag &&
9810Sstevel@tonic-gate 		    (rc = process_mech_operands(argc, argv, B_FALSE))
9820Sstevel@tonic-gate 		    != SUCCESS) {
9830Sstevel@tonic-gate 			goto out;
9840Sstevel@tonic-gate 		}
9850Sstevel@tonic-gate 	}
9860Sstevel@tonic-gate 
9870Sstevel@tonic-gate 	switch (prov->cp_type) {
9880Sstevel@tonic-gate 	case METASLOT:
9890Sstevel@tonic-gate 		rc = enable_metaslot(alt_token, alt_slot, use_default,
9900Sstevel@tonic-gate 		    mecharglist, allflag, auto_key_migrate_flag);
9910Sstevel@tonic-gate 		break;
9920Sstevel@tonic-gate 	case PROV_UEF_LIB:
9930Sstevel@tonic-gate 		rc = enable_uef_lib(prov->cp_name, rndflag, allflag,
9940Sstevel@tonic-gate 		    mecharglist);
9950Sstevel@tonic-gate 		break;
9960Sstevel@tonic-gate 	case PROV_KEF_SOFT:
9970Sstevel@tonic-gate 	case PROV_KEF_HARD:
9980Sstevel@tonic-gate 		if (rndflag && !allflag) {
9990Sstevel@tonic-gate 			if ((mecharglist = create_mech(RANDOM)) == NULL) {
10000Sstevel@tonic-gate 				rc = FAILURE;
10010Sstevel@tonic-gate 				break;
10020Sstevel@tonic-gate 			}
10030Sstevel@tonic-gate 		}
10040Sstevel@tonic-gate 		if (getzoneid() == GLOBAL_ZONEID) {
10050Sstevel@tonic-gate 			rc = enable_kef(prov->cp_name, rndflag, allflag,
10060Sstevel@tonic-gate 			    mecharglist);
10070Sstevel@tonic-gate 		} else {
10080Sstevel@tonic-gate 			/*
10097334SDaniel.Anderson@Sun.COM 			 * TRANSLATION_NOTE
10100Sstevel@tonic-gate 			 * "enable" could be either a literal keyword
10110Sstevel@tonic-gate 			 * and hence not to be translated, or a verb and
10120Sstevel@tonic-gate 			 * translatable.  A choice was made to view it as
10130Sstevel@tonic-gate 			 * a literal keyword.  "global" is keyword and not
10140Sstevel@tonic-gate 			 * to be translated.
10150Sstevel@tonic-gate 			 */
10160Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext("%1$s for kernel "
10170Sstevel@tonic-gate 			    "providers is supported in the %2$s zone only"),
10180Sstevel@tonic-gate 			    "enable", "global");
10190Sstevel@tonic-gate 			rc = FAILURE;
10200Sstevel@tonic-gate 		}
10210Sstevel@tonic-gate 		break;
10220Sstevel@tonic-gate 	default: /* should not come here */
10230Sstevel@tonic-gate 		rc = FAILURE;
10240Sstevel@tonic-gate 		break;
10250Sstevel@tonic-gate 	}
10260Sstevel@tonic-gate out:
10270Sstevel@tonic-gate 	free(prov);
10280Sstevel@tonic-gate 	if (mecharglist != NULL) {
10290Sstevel@tonic-gate 		free_mechlist(mecharglist);
10300Sstevel@tonic-gate 	}
10310Sstevel@tonic-gate 	if (alt_token != NULL) {
10320Sstevel@tonic-gate 		free(alt_token);
10330Sstevel@tonic-gate 	}
10340Sstevel@tonic-gate 	if (alt_slot != NULL) {
10350Sstevel@tonic-gate 		free(alt_slot);
10360Sstevel@tonic-gate 	}
10370Sstevel@tonic-gate 	return (rc);
10380Sstevel@tonic-gate }
10390Sstevel@tonic-gate 
10400Sstevel@tonic-gate 
10410Sstevel@tonic-gate 
10420Sstevel@tonic-gate /*
10437968Sopensolaris@drydog.com  * The top level function for the "cryptoadm install" subcommand.
10440Sstevel@tonic-gate  */
10450Sstevel@tonic-gate static int
do_install(int argc,char ** argv)10460Sstevel@tonic-gate do_install(int argc, char **argv)
10470Sstevel@tonic-gate {
10487968Sopensolaris@drydog.com 	cryptoadm_provider_t	*prov = NULL;
10490Sstevel@tonic-gate 	int	rc;
10500Sstevel@tonic-gate 
10510Sstevel@tonic-gate 	if (argc < 3) {
10520Sstevel@tonic-gate 		usage();
10530Sstevel@tonic-gate 		return (ERROR_USAGE);
10540Sstevel@tonic-gate 	}
10550Sstevel@tonic-gate 
10560Sstevel@tonic-gate 	prov = get_provider(argc, argv);
10570Sstevel@tonic-gate 	if (prov == NULL ||
10580Sstevel@tonic-gate 	    prov->cp_type == PROV_BADNAME || prov->cp_type == PROV_KEF_HARD) {
10590Sstevel@tonic-gate 		/*
10607334SDaniel.Anderson@Sun.COM 		 * TRANSLATION_NOTE
10610Sstevel@tonic-gate 		 * "install" could be either a literal keyword and hence
10620Sstevel@tonic-gate 		 * not to be translated, or a verb and translatable.  A
10630Sstevel@tonic-gate 		 * choice was made to view it as a literal keyword.
10640Sstevel@tonic-gate 		 */
10650Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
10660Sstevel@tonic-gate 		    gettext("bad provider name for %s."), "install");
10670Sstevel@tonic-gate 		rc = FAILURE;
10680Sstevel@tonic-gate 		goto out;
10690Sstevel@tonic-gate 	}
10700Sstevel@tonic-gate 
10710Sstevel@tonic-gate 	if (prov->cp_type == PROV_UEF_LIB) {
10720Sstevel@tonic-gate 		rc = install_uef_lib(prov->cp_name);
10730Sstevel@tonic-gate 		goto out;
10740Sstevel@tonic-gate 	}
10750Sstevel@tonic-gate 
10760Sstevel@tonic-gate 	/* It is the PROV_KEF_SOFT type now  */
10770Sstevel@tonic-gate 
10780Sstevel@tonic-gate 	/* check if there are mechanism operands */
10790Sstevel@tonic-gate 	if (argc < 4) {
10800Sstevel@tonic-gate 		/*
10817334SDaniel.Anderson@Sun.COM 		 * TRANSLATION_NOTE
10820Sstevel@tonic-gate 		 * "mechanism" could be either a literal keyword and hence
10830Sstevel@tonic-gate 		 * not to be translated, or a descriptive word and
10840Sstevel@tonic-gate 		 * translatable.  A choice was made to view it as a literal
10850Sstevel@tonic-gate 		 * keyword.
10860Sstevel@tonic-gate 		 */
10870Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
10880Sstevel@tonic-gate 		    gettext("need %s operands for installing a"
10890Sstevel@tonic-gate 		    " kernel software provider."), "mechanism");
10900Sstevel@tonic-gate 		rc = ERROR_USAGE;
10910Sstevel@tonic-gate 		goto out;
10920Sstevel@tonic-gate 	}
10930Sstevel@tonic-gate 
10940Sstevel@tonic-gate 	if ((rc = process_mech_operands(argc, argv, B_FALSE)) != SUCCESS) {
10950Sstevel@tonic-gate 		goto out;
10960Sstevel@tonic-gate 	}
10970Sstevel@tonic-gate 
10980Sstevel@tonic-gate 	if (allflag == B_TRUE) {
10990Sstevel@tonic-gate 		/*
11007334SDaniel.Anderson@Sun.COM 		 * TRANSLATION_NOTE
11010Sstevel@tonic-gate 		 * "all", "mechanism", and "install" are all keywords and
11020Sstevel@tonic-gate 		 * not to be translated.
11030Sstevel@tonic-gate 		 */
11040Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
11050Sstevel@tonic-gate 		    gettext("can not use the %1$s keyword for %2$s "
11060Sstevel@tonic-gate 		    "in the %3$s subcommand."), "all", "mechanism", "install");
11070Sstevel@tonic-gate 		rc = ERROR_USAGE;
11080Sstevel@tonic-gate 		goto out;
11090Sstevel@tonic-gate 	}
11100Sstevel@tonic-gate 
11110Sstevel@tonic-gate 	if (getzoneid() == GLOBAL_ZONEID) {
11120Sstevel@tonic-gate 		rc = install_kef(prov->cp_name, mecharglist);
11130Sstevel@tonic-gate 	} else {
11140Sstevel@tonic-gate 		/*
11157334SDaniel.Anderson@Sun.COM 		 * TRANSLATION_NOTE
11160Sstevel@tonic-gate 		 * "install" could be either a literal keyword and hence
11170Sstevel@tonic-gate 		 * not to be translated, or a verb and translatable.  A
11180Sstevel@tonic-gate 		 * choice was made to view it as a literal keyword.
11190Sstevel@tonic-gate 		 * "global" is keyword and not to be translated.
11200Sstevel@tonic-gate 		 */
11210Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("%1$s for kernel providers "
11220Sstevel@tonic-gate 		    "is supported in the %2$s zone only"), "install", "global");
11230Sstevel@tonic-gate 		rc = FAILURE;
11240Sstevel@tonic-gate 	}
11250Sstevel@tonic-gate out:
11260Sstevel@tonic-gate 	free(prov);
11270Sstevel@tonic-gate 	return (rc);
11280Sstevel@tonic-gate }
11290Sstevel@tonic-gate 
11300Sstevel@tonic-gate 
11310Sstevel@tonic-gate 
11320Sstevel@tonic-gate /*
11337968Sopensolaris@drydog.com  * The top level function for the "cryptoadm uninstall" subcommand.
11340Sstevel@tonic-gate  */
11350Sstevel@tonic-gate static int
do_uninstall(int argc,char ** argv)11360Sstevel@tonic-gate do_uninstall(int argc, char **argv)
11370Sstevel@tonic-gate {
11387968Sopensolaris@drydog.com 	cryptoadm_provider_t	*prov = NULL;
11390Sstevel@tonic-gate 	int	rc = SUCCESS;
11400Sstevel@tonic-gate 
11410Sstevel@tonic-gate 	if (argc != 3) {
11420Sstevel@tonic-gate 		usage();
11430Sstevel@tonic-gate 		return (ERROR_USAGE);
11440Sstevel@tonic-gate 	}
11450Sstevel@tonic-gate 
11460Sstevel@tonic-gate 	prov = get_provider(argc, argv);
11470Sstevel@tonic-gate 	if (prov == NULL ||
11480Sstevel@tonic-gate 	    prov->cp_type == PROV_BADNAME || prov->cp_type == PROV_KEF_HARD) {
11490Sstevel@tonic-gate 		/*
11507334SDaniel.Anderson@Sun.COM 		 * TRANSLATION_NOTE
11510Sstevel@tonic-gate 		 * "uninstall" could be either a literal keyword and hence
11520Sstevel@tonic-gate 		 * not to be translated, or a verb and translatable.  A
11530Sstevel@tonic-gate 		 * choice was made to view it as a literal keyword.
11540Sstevel@tonic-gate 		 */
11550Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
11560Sstevel@tonic-gate 		    gettext("bad provider name for %s."), "uninstall");
11570Sstevel@tonic-gate 		free(prov);
11580Sstevel@tonic-gate 		return (FAILURE);
11590Sstevel@tonic-gate 	}
11600Sstevel@tonic-gate 
11610Sstevel@tonic-gate 	if (prov->cp_type == PROV_UEF_LIB) {
11620Sstevel@tonic-gate 		rc = uninstall_uef_lib(prov->cp_name);
11637968Sopensolaris@drydog.com 
11640Sstevel@tonic-gate 	} else if (prov->cp_type == PROV_KEF_SOFT) {
11650Sstevel@tonic-gate 		if (getzoneid() == GLOBAL_ZONEID) {
11667968Sopensolaris@drydog.com 			/* unload and remove from kcf.conf */
11670Sstevel@tonic-gate 			rc = uninstall_kef(prov->cp_name);
11680Sstevel@tonic-gate 		} else {
11690Sstevel@tonic-gate 			/*
11707334SDaniel.Anderson@Sun.COM 			 * TRANSLATION_NOTE
11710Sstevel@tonic-gate 			 * "uninstall" could be either a literal keyword and
11720Sstevel@tonic-gate 			 * hence not to be translated, or a verb and
11730Sstevel@tonic-gate 			 * translatable.  A choice was made to view it as a
11740Sstevel@tonic-gate 			 * literal keyword.  "global" is keyword and not to
11750Sstevel@tonic-gate 			 * be translated.
11760Sstevel@tonic-gate 			 */
11770Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext("%1$s for kernel "
11780Sstevel@tonic-gate 			    "providers is supported in the %2$s zone only"),
11790Sstevel@tonic-gate 			    "uninstall", "global");
11800Sstevel@tonic-gate 			rc = FAILURE;
11810Sstevel@tonic-gate 		}
11820Sstevel@tonic-gate 	}
11830Sstevel@tonic-gate 
11840Sstevel@tonic-gate 	free(prov);
11850Sstevel@tonic-gate 	return (rc);
11860Sstevel@tonic-gate }
11870Sstevel@tonic-gate 
11880Sstevel@tonic-gate 
11890Sstevel@tonic-gate /*
11907968Sopensolaris@drydog.com  * The top level function for the "cryptoadm unload" subcommand.
11910Sstevel@tonic-gate  */
11920Sstevel@tonic-gate static int
do_unload(int argc,char ** argv)11930Sstevel@tonic-gate do_unload(int argc, char **argv)
11940Sstevel@tonic-gate {
11957968Sopensolaris@drydog.com 	cryptoadm_provider_t	*prov = NULL;
11967968Sopensolaris@drydog.com 	entry_t			*pent = NULL;
11977968Sopensolaris@drydog.com 	boolean_t		in_kernel = B_FALSE;
11987968Sopensolaris@drydog.com 	int			rc = SUCCESS;
11997968Sopensolaris@drydog.com 	char			*provname = NULL;
12000Sstevel@tonic-gate 
12010Sstevel@tonic-gate 	if (argc != 3) {
12020Sstevel@tonic-gate 		usage();
12030Sstevel@tonic-gate 		return (ERROR_USAGE);
12040Sstevel@tonic-gate 	}
12050Sstevel@tonic-gate 
12060Sstevel@tonic-gate 	/* check if it is a kernel software provider */
12070Sstevel@tonic-gate 	prov = get_provider(argc, argv);
12080Sstevel@tonic-gate 	if (prov == NULL) {
12090Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
12100Sstevel@tonic-gate 		    gettext("unable to determine provider name."));
12110Sstevel@tonic-gate 		goto out;
12120Sstevel@tonic-gate 	}
12137968Sopensolaris@drydog.com 	provname = prov->cp_name;
12140Sstevel@tonic-gate 	if (prov->cp_type != PROV_KEF_SOFT) {
12150Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
12160Sstevel@tonic-gate 		    gettext("%s is not a valid kernel software provider."),
12177968Sopensolaris@drydog.com 		    provname);
12180Sstevel@tonic-gate 		rc = FAILURE;
12190Sstevel@tonic-gate 		goto out;
12200Sstevel@tonic-gate 	}
12210Sstevel@tonic-gate 
12220Sstevel@tonic-gate 	if (getzoneid() != GLOBAL_ZONEID) {
12230Sstevel@tonic-gate 		/*
12247334SDaniel.Anderson@Sun.COM 		 * TRANSLATION_NOTE
12250Sstevel@tonic-gate 		 * "unload" could be either a literal keyword and hence
12260Sstevel@tonic-gate 		 * not to be translated, or a verb and translatable.
12270Sstevel@tonic-gate 		 * A choice was made to view it as a literal keyword.
12280Sstevel@tonic-gate 		 * "global" is keyword and not to be translated.
12290Sstevel@tonic-gate 		 */
12300Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("%1$s for kernel providers "
12310Sstevel@tonic-gate 		    "is supported in the %2$s zone only"), "unload", "global");
12320Sstevel@tonic-gate 		rc = FAILURE;
12330Sstevel@tonic-gate 		goto out;
12340Sstevel@tonic-gate 	}
12350Sstevel@tonic-gate 
12367968Sopensolaris@drydog.com 	if (check_kernel_for_soft(provname, NULL, &in_kernel) == FAILURE) {
12377968Sopensolaris@drydog.com 		cryptodebug("internal error");
12380Sstevel@tonic-gate 		rc = FAILURE;
12390Sstevel@tonic-gate 		goto out;
12407968Sopensolaris@drydog.com 	} else if (in_kernel == B_FALSE) {
12410Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
12427968Sopensolaris@drydog.com 		    gettext("provider %s is not loaded or does not exist."),
12437968Sopensolaris@drydog.com 		    provname);
12440Sstevel@tonic-gate 		rc = FAILURE;
12450Sstevel@tonic-gate 		goto out;
12460Sstevel@tonic-gate 	}
12470Sstevel@tonic-gate 
12487968Sopensolaris@drydog.com 	/* Get kcf.conf entry.  If none, build a new entry */
124910979SHai-May.Chao@Sun.COM 	if ((pent = getent_kef(provname, NULL, NULL)) == NULL) {
12507968Sopensolaris@drydog.com 		if ((pent = create_entry(provname)) == NULL) {
12517968Sopensolaris@drydog.com 			cryptoerror(LOG_STDERR, gettext("out of memory."));
12527968Sopensolaris@drydog.com 			rc = FAILURE;
12537968Sopensolaris@drydog.com 			goto out;
12547968Sopensolaris@drydog.com 		}
12557968Sopensolaris@drydog.com 	}
12567968Sopensolaris@drydog.com 
12577968Sopensolaris@drydog.com 	/* If it is unloaded already, return  */
12587968Sopensolaris@drydog.com 	if (!pent->load) { /* unloaded already */
12590Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
12607968Sopensolaris@drydog.com 		    gettext("failed to unload %s."), provname);
12610Sstevel@tonic-gate 		rc = FAILURE;
12627968Sopensolaris@drydog.com 		goto out;
12637968Sopensolaris@drydog.com 	} else if (unload_kef_soft(provname) != FAILURE) {
12647968Sopensolaris@drydog.com 		/* Mark as unloaded in kcf.conf */
12657968Sopensolaris@drydog.com 		pent->load = B_FALSE;
12667968Sopensolaris@drydog.com 		rc = update_kcfconf(pent, MODIFY_MODE);
12670Sstevel@tonic-gate 	} else {
12687968Sopensolaris@drydog.com 		cryptoerror(LOG_STDERR,
12697968Sopensolaris@drydog.com 		    gettext("failed to unload %s."), provname);
12707968Sopensolaris@drydog.com 		rc = FAILURE;
12710Sstevel@tonic-gate 	}
12720Sstevel@tonic-gate out:
12730Sstevel@tonic-gate 	free(prov);
12747968Sopensolaris@drydog.com 	free_entry(pent);
12750Sstevel@tonic-gate 	return (rc);
12760Sstevel@tonic-gate }
12770Sstevel@tonic-gate 
12780Sstevel@tonic-gate 
12790Sstevel@tonic-gate 
12800Sstevel@tonic-gate /*
12817968Sopensolaris@drydog.com  * The top level function for the "cryptoadm refresh" subcommand.
12820Sstevel@tonic-gate  */
12830Sstevel@tonic-gate static int
do_refresh(int argc)12840Sstevel@tonic-gate do_refresh(int argc)
12850Sstevel@tonic-gate {
12860Sstevel@tonic-gate 	if (argc != 2) {
12870Sstevel@tonic-gate 		usage();
12880Sstevel@tonic-gate 		return (ERROR_USAGE);
12890Sstevel@tonic-gate 	}
12900Sstevel@tonic-gate 
12917968Sopensolaris@drydog.com 	if (getzoneid() == GLOBAL_ZONEID) {
12927968Sopensolaris@drydog.com 		return (refresh());
12937968Sopensolaris@drydog.com 	} else { /* non-global zone */
12947968Sopensolaris@drydog.com 		/*
12957968Sopensolaris@drydog.com 		 * Note:  in non-global zone, this must silently return SUCCESS
12967968Sopensolaris@drydog.com 		 * due to integration with SMF, for "svcadm refresh cryptosvc"
12977968Sopensolaris@drydog.com 		 */
12980Sstevel@tonic-gate 		return (SUCCESS);
12997968Sopensolaris@drydog.com 	}
13000Sstevel@tonic-gate }
13010Sstevel@tonic-gate 
13020Sstevel@tonic-gate 
13030Sstevel@tonic-gate /*
13047968Sopensolaris@drydog.com  * The top level function for the "cryptoadm start" subcommand.
13050Sstevel@tonic-gate  */
13060Sstevel@tonic-gate static int
do_start(int argc)13070Sstevel@tonic-gate do_start(int argc)
13080Sstevel@tonic-gate {
13090Sstevel@tonic-gate 	int ret;
13100Sstevel@tonic-gate 
13110Sstevel@tonic-gate 	if (argc != 2) {
13120Sstevel@tonic-gate 		usage();
13130Sstevel@tonic-gate 		return (ERROR_USAGE);
13140Sstevel@tonic-gate 	}
13150Sstevel@tonic-gate 
13160Sstevel@tonic-gate 	ret = do_refresh(argc);
13170Sstevel@tonic-gate 	if (ret != SUCCESS)
13180Sstevel@tonic-gate 		return (ret);
13190Sstevel@tonic-gate 
13200Sstevel@tonic-gate 	return (start_daemon());
13210Sstevel@tonic-gate }
13220Sstevel@tonic-gate 
13230Sstevel@tonic-gate /*
13247968Sopensolaris@drydog.com  * The top level function for the "cryptoadm stop" subcommand.
13250Sstevel@tonic-gate  */
13260Sstevel@tonic-gate static int
do_stop(int argc)13270Sstevel@tonic-gate do_stop(int argc)
13280Sstevel@tonic-gate {
13290Sstevel@tonic-gate 	if (argc != 2) {
13300Sstevel@tonic-gate 		usage();
13310Sstevel@tonic-gate 		return (ERROR_USAGE);
13320Sstevel@tonic-gate 	}
13330Sstevel@tonic-gate 
13340Sstevel@tonic-gate 	return (stop_daemon());
13350Sstevel@tonic-gate }
13360Sstevel@tonic-gate 
13370Sstevel@tonic-gate 
13380Sstevel@tonic-gate 
13390Sstevel@tonic-gate /*
13407968Sopensolaris@drydog.com  * Print a list all the the providers.
13417968Sopensolaris@drydog.com  * Called for "cryptoadm list" or "cryptoadm list -v" (no -m or -p).
13420Sstevel@tonic-gate  */
13430Sstevel@tonic-gate static int
list_simple_for_all(boolean_t verbose)13440Sstevel@tonic-gate list_simple_for_all(boolean_t verbose)
13450Sstevel@tonic-gate {
13467968Sopensolaris@drydog.com 	uentrylist_t		*pliblist = NULL;
13477968Sopensolaris@drydog.com 	uentrylist_t		*plibptr = NULL;
13487968Sopensolaris@drydog.com 	entry_t			*pent = NULL;
13490Sstevel@tonic-gate 	crypto_get_dev_list_t	*pdevlist_kernel = NULL;
13507968Sopensolaris@drydog.com 	int			rc = SUCCESS;
13517968Sopensolaris@drydog.com 	int			i;
13520Sstevel@tonic-gate 
13530Sstevel@tonic-gate 	/* get user-level providers */
13540Sstevel@tonic-gate 	(void) printf(gettext("\nUser-level providers:\n"));
13550Sstevel@tonic-gate 	if (get_pkcs11conf_info(&pliblist) != SUCCESS) {
13560Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext(
13570Sstevel@tonic-gate 		    "failed to retrieve the list of user-level providers."));
13587968Sopensolaris@drydog.com 		rc = FAILURE;
13590Sstevel@tonic-gate 	}
13607968Sopensolaris@drydog.com 
13617968Sopensolaris@drydog.com 	for (plibptr = pliblist; plibptr != NULL; plibptr = plibptr->next) {
136210979SHai-May.Chao@Sun.COM 		/* skip metaslot and fips-140 entry */
136310979SHai-May.Chao@Sun.COM 		if ((strcmp(plibptr->puent->name, METASLOT_KEYWORD) != 0) &&
136410979SHai-May.Chao@Sun.COM 		    (strcmp(plibptr->puent->name, FIPS_KEYWORD) != 0)) {
13650Sstevel@tonic-gate 			(void) printf(gettext("Provider: %s\n"),
13660Sstevel@tonic-gate 			    plibptr->puent->name);
13670Sstevel@tonic-gate 			if (verbose) {
13680Sstevel@tonic-gate 				(void) list_mechlist_for_lib(
13690Sstevel@tonic-gate 				    plibptr->puent->name, mecharglist, NULL,
13700Sstevel@tonic-gate 				    B_FALSE, verbose, B_FALSE);
13710Sstevel@tonic-gate 				(void) printf("\n");
13720Sstevel@tonic-gate 			}
13730Sstevel@tonic-gate 		}
13740Sstevel@tonic-gate 	}
13750Sstevel@tonic-gate 	free_uentrylist(pliblist);
13760Sstevel@tonic-gate 
13770Sstevel@tonic-gate 	/* get kernel software providers */
13780Sstevel@tonic-gate 	(void) printf(gettext("\nKernel software providers:\n"));
13790Sstevel@tonic-gate 
13800Sstevel@tonic-gate 	if (getzoneid() == GLOBAL_ZONEID) {
13817968Sopensolaris@drydog.com 		/* get kernel software providers from kernel ioctl */
13827968Sopensolaris@drydog.com 		crypto_get_soft_list_t		*psoftlist_kernel = NULL;
13837968Sopensolaris@drydog.com 		uint_t				sl_soft_count;
13847968Sopensolaris@drydog.com 		char				*psoftname;
13857968Sopensolaris@drydog.com 		entrylist_t			*pdevlist_conf = NULL;
13867968Sopensolaris@drydog.com 		entrylist_t			*psoftlist_conf = NULL;
13877968Sopensolaris@drydog.com 
13887968Sopensolaris@drydog.com 		if (get_soft_list(&psoftlist_kernel) == FAILURE) {
13897968Sopensolaris@drydog.com 			cryptoerror(LOG_ERR, gettext("Failed to retrieve the "
13907968Sopensolaris@drydog.com 			    "software provider list from kernel."));
13917968Sopensolaris@drydog.com 			rc = FAILURE;
13927968Sopensolaris@drydog.com 		} else {
13937968Sopensolaris@drydog.com 			sl_soft_count = psoftlist_kernel->sl_soft_count;
13940Sstevel@tonic-gate 
139510979SHai-May.Chao@Sun.COM 			if (get_kcfconf_info(&pdevlist_conf, &psoftlist_conf)
139610979SHai-May.Chao@Sun.COM 			    == FAILURE) {
13977968Sopensolaris@drydog.com 				cryptoerror(LOG_ERR,
13987968Sopensolaris@drydog.com 				    "failed to retrieve the providers' "
13997968Sopensolaris@drydog.com 				    "information from file kcf.conf - %s.",
14007968Sopensolaris@drydog.com 				    _PATH_KCF_CONF);
14017968Sopensolaris@drydog.com 				free(psoftlist_kernel);
14027968Sopensolaris@drydog.com 				rc = FAILURE;
14037968Sopensolaris@drydog.com 			} else {
14047968Sopensolaris@drydog.com 
14057968Sopensolaris@drydog.com 				for (i = 0,
14067968Sopensolaris@drydog.com 				    psoftname = psoftlist_kernel->sl_soft_names;
14077968Sopensolaris@drydog.com 				    i < sl_soft_count;
14087968Sopensolaris@drydog.com 				    ++i, psoftname += strlen(psoftname) + 1) {
14097968Sopensolaris@drydog.com 					pent = getent_kef(psoftname,
141010979SHai-May.Chao@Sun.COM 					    pdevlist_conf, psoftlist_conf);
14117968Sopensolaris@drydog.com 					(void) printf("\t%s%s\n", psoftname,
14127968Sopensolaris@drydog.com 					    (pent == NULL) || (pent->load) ?
14137968Sopensolaris@drydog.com 					    "" : gettext(" (inactive)"));
14147968Sopensolaris@drydog.com 				}
14157968Sopensolaris@drydog.com 				free_entrylist(pdevlist_conf);
14167968Sopensolaris@drydog.com 				free_entrylist(psoftlist_conf);
14177968Sopensolaris@drydog.com 			}
14187968Sopensolaris@drydog.com 			free(psoftlist_kernel);
14190Sstevel@tonic-gate 		}
14200Sstevel@tonic-gate 
14210Sstevel@tonic-gate 	} else {
14220Sstevel@tonic-gate 		/* kcf.conf not there in non-global zone, use /dev/cryptoadm */
14237968Sopensolaris@drydog.com 		entrylist_t	*pdevlist_zone = NULL;
14247968Sopensolaris@drydog.com 		entrylist_t	*psoftlist_zone = NULL;
14257968Sopensolaris@drydog.com 		entrylist_t	*ptr;
14260Sstevel@tonic-gate 
14270Sstevel@tonic-gate 		if (get_admindev_info(&pdevlist_zone, &psoftlist_zone) !=
14280Sstevel@tonic-gate 		    SUCCESS) {
14290Sstevel@tonic-gate 			cryptoerror(LOG_STDERR,
14300Sstevel@tonic-gate 			    gettext("failed to retrieve the "
14310Sstevel@tonic-gate 			    "list of kernel software providers.\n"));
14327968Sopensolaris@drydog.com 			rc = FAILURE;
14330Sstevel@tonic-gate 		}
14340Sstevel@tonic-gate 
14350Sstevel@tonic-gate 		ptr = psoftlist_zone;
14360Sstevel@tonic-gate 		while (ptr != NULL) {
14370Sstevel@tonic-gate 			(void) printf("\t%s\n", ptr->pent->name);
14380Sstevel@tonic-gate 			ptr = ptr->next;
14390Sstevel@tonic-gate 		}
14400Sstevel@tonic-gate 
14410Sstevel@tonic-gate 		free_entrylist(pdevlist_zone);
14420Sstevel@tonic-gate 		free_entrylist(psoftlist_zone);
14430Sstevel@tonic-gate 	}
14440Sstevel@tonic-gate 
14450Sstevel@tonic-gate 	/* get kernel hardware providers */
14460Sstevel@tonic-gate 	(void) printf(gettext("\nKernel hardware providers:\n"));
14470Sstevel@tonic-gate 	if (get_dev_list(&pdevlist_kernel) == FAILURE) {
14480Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("failed to retrieve "
14490Sstevel@tonic-gate 		    "the list of kernel hardware providers.\n"));
14507968Sopensolaris@drydog.com 		rc = FAILURE;
14510Sstevel@tonic-gate 	} else {
14520Sstevel@tonic-gate 		for (i = 0; i < pdevlist_kernel->dl_dev_count; i++) {
14530Sstevel@tonic-gate 			(void) printf("\t%s/%d\n",
14540Sstevel@tonic-gate 			    pdevlist_kernel->dl_devs[i].le_dev_name,
14550Sstevel@tonic-gate 			    pdevlist_kernel->dl_devs[i].le_dev_instance);
14560Sstevel@tonic-gate 		}
14570Sstevel@tonic-gate 	}
14580Sstevel@tonic-gate 	free(pdevlist_kernel);
14590Sstevel@tonic-gate 
14607968Sopensolaris@drydog.com 	return (rc);
14610Sstevel@tonic-gate }
14620Sstevel@tonic-gate 
14630Sstevel@tonic-gate 
14640Sstevel@tonic-gate 
14650Sstevel@tonic-gate /*
14660Sstevel@tonic-gate  * List all the providers. And for each provider, list the mechanism list.
14677968Sopensolaris@drydog.com  * Called for "cryptoadm list -m" or "cryptoadm list -mv" .
14680Sstevel@tonic-gate  */
14690Sstevel@tonic-gate static int
list_mechlist_for_all(boolean_t verbose)14700Sstevel@tonic-gate list_mechlist_for_all(boolean_t verbose)
14710Sstevel@tonic-gate {
14727968Sopensolaris@drydog.com 	crypto_get_dev_list_t	*pdevlist_kernel = NULL;
14737968Sopensolaris@drydog.com 	uentrylist_t		*pliblist = NULL;
14747968Sopensolaris@drydog.com 	uentrylist_t		*plibptr = NULL;
14757968Sopensolaris@drydog.com 	entry_t			*pent = NULL;
14767968Sopensolaris@drydog.com 	mechlist_t		*pmechlist = NULL;
14777968Sopensolaris@drydog.com 	char			provname[MAXNAMELEN];
14787968Sopensolaris@drydog.com 	char			devname[MAXNAMELEN];
14797968Sopensolaris@drydog.com 	int			inst_num;
14807968Sopensolaris@drydog.com 	int			count;
14817968Sopensolaris@drydog.com 	int			i;
14827968Sopensolaris@drydog.com 	int			rv;
14837968Sopensolaris@drydog.com 	int			rc = SUCCESS;
14840Sstevel@tonic-gate 
14850Sstevel@tonic-gate 	/* get user-level providers */
14860Sstevel@tonic-gate 	(void) printf(gettext("\nUser-level providers:\n"));
14870Sstevel@tonic-gate 	/*
14887334SDaniel.Anderson@Sun.COM 	 * TRANSLATION_NOTE
14890Sstevel@tonic-gate 	 * Strictly for appearance's sake, this line should be as long as
14900Sstevel@tonic-gate 	 * the length of the translated text above.
14910Sstevel@tonic-gate 	 */
14920Sstevel@tonic-gate 	(void) printf(gettext("=====================\n"));
14930Sstevel@tonic-gate 	if (get_pkcs11conf_info(&pliblist) != SUCCESS) {
14940Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("failed to retrieve "
14950Sstevel@tonic-gate 		    "the list of user-level providers.\n"));
14960Sstevel@tonic-gate 		rc = FAILURE;
14970Sstevel@tonic-gate 	}
14980Sstevel@tonic-gate 
14990Sstevel@tonic-gate 	plibptr = pliblist;
15000Sstevel@tonic-gate 	while (plibptr != NULL) {
150110979SHai-May.Chao@Sun.COM 		/* skip metaslot and fips-140 entry */
150210979SHai-May.Chao@Sun.COM 		if ((strcmp(plibptr->puent->name, METASLOT_KEYWORD) != 0) &&
150310979SHai-May.Chao@Sun.COM 		    (strcmp(plibptr->puent->name, FIPS_KEYWORD) != 0)) {
15040Sstevel@tonic-gate 			(void) printf(gettext("\nProvider: %s\n"),
15050Sstevel@tonic-gate 			    plibptr->puent->name);
15060Sstevel@tonic-gate 			rv = list_mechlist_for_lib(plibptr->puent->name,
15070Sstevel@tonic-gate 			    mecharglist, NULL, B_FALSE, verbose, B_TRUE);
15080Sstevel@tonic-gate 			if (rv == FAILURE) {
15090Sstevel@tonic-gate 				rc = FAILURE;
15100Sstevel@tonic-gate 			}
15110Sstevel@tonic-gate 		}
15120Sstevel@tonic-gate 		plibptr = plibptr->next;
15130Sstevel@tonic-gate 	}
15140Sstevel@tonic-gate 	free_uentrylist(pliblist);
15150Sstevel@tonic-gate 
15160Sstevel@tonic-gate 	/* get kernel software providers */
15170Sstevel@tonic-gate 	(void) printf(gettext("\nKernel software providers:\n"));
15187968Sopensolaris@drydog.com 
15190Sstevel@tonic-gate 	/*
15207334SDaniel.Anderson@Sun.COM 	 * TRANSLATION_NOTE
15210Sstevel@tonic-gate 	 * Strictly for appearance's sake, this line should be as long as
15220Sstevel@tonic-gate 	 * the length of the translated text above.
15230Sstevel@tonic-gate 	 */
15240Sstevel@tonic-gate 	(void) printf(gettext("==========================\n"));
15250Sstevel@tonic-gate 	if (getzoneid() == GLOBAL_ZONEID) {
15267968Sopensolaris@drydog.com 		/* get kernel software providers from kernel ioctl */
15277968Sopensolaris@drydog.com 		crypto_get_soft_list_t		*psoftlist_kernel = NULL;
15287968Sopensolaris@drydog.com 		uint_t				sl_soft_count;
15297968Sopensolaris@drydog.com 		char				*psoftname;
15307968Sopensolaris@drydog.com 		int				i;
15317968Sopensolaris@drydog.com 		entrylist_t			*pdevlist_conf = NULL;
15327968Sopensolaris@drydog.com 		entrylist_t			*psoftlist_conf = NULL;
15330Sstevel@tonic-gate 
15347968Sopensolaris@drydog.com 		if (get_soft_list(&psoftlist_kernel) == FAILURE) {
15357968Sopensolaris@drydog.com 			cryptoerror(LOG_ERR, gettext("Failed to retrieve the "
15367968Sopensolaris@drydog.com 			    "software provider list from kernel."));
15377968Sopensolaris@drydog.com 			return (FAILURE);
15387968Sopensolaris@drydog.com 		}
15397968Sopensolaris@drydog.com 		sl_soft_count = psoftlist_kernel->sl_soft_count;
15407968Sopensolaris@drydog.com 
154110979SHai-May.Chao@Sun.COM 		if (get_kcfconf_info(&pdevlist_conf, &psoftlist_conf)
154210979SHai-May.Chao@Sun.COM 		    == FAILURE) {
15437968Sopensolaris@drydog.com 			cryptoerror(LOG_ERR,
15447968Sopensolaris@drydog.com 			    "failed to retrieve the providers' "
15457968Sopensolaris@drydog.com 			    "information from file kcf.conf - %s.",
15467968Sopensolaris@drydog.com 			    _PATH_KCF_CONF);
15477968Sopensolaris@drydog.com 			free(psoftlist_kernel);
15487968Sopensolaris@drydog.com 			return (FAILURE);
15490Sstevel@tonic-gate 		}
15500Sstevel@tonic-gate 
15517968Sopensolaris@drydog.com 		for (i = 0, psoftname = psoftlist_kernel->sl_soft_names;
15527968Sopensolaris@drydog.com 		    i < sl_soft_count;
15537968Sopensolaris@drydog.com 		    ++i, psoftname += strlen(psoftname) + 1) {
15547968Sopensolaris@drydog.com 			pent = getent_kef(psoftname, pdevlist_conf,
155510979SHai-May.Chao@Sun.COM 			    psoftlist_conf);
15567968Sopensolaris@drydog.com 			if ((pent == NULL) || (pent->load)) {
15577968Sopensolaris@drydog.com 				rv = list_mechlist_for_soft(psoftname,
155810979SHai-May.Chao@Sun.COM 				    NULL, NULL);
15597968Sopensolaris@drydog.com 				if (rv == FAILURE) {
15607968Sopensolaris@drydog.com 					rc = FAILURE;
15610Sstevel@tonic-gate 				}
15620Sstevel@tonic-gate 			} else {
15637968Sopensolaris@drydog.com 				(void) printf(gettext("%s: (inactive)\n"),
15647968Sopensolaris@drydog.com 				    psoftname);
15650Sstevel@tonic-gate 			}
15660Sstevel@tonic-gate 		}
15670Sstevel@tonic-gate 
15687968Sopensolaris@drydog.com 		free(psoftlist_kernel);
15690Sstevel@tonic-gate 		free_entrylist(pdevlist_conf);
15700Sstevel@tonic-gate 		free_entrylist(psoftlist_conf);
15717968Sopensolaris@drydog.com 
15720Sstevel@tonic-gate 	} else {
15730Sstevel@tonic-gate 		/* kcf.conf not there in non-global zone, use /dev/cryptoadm */
15747968Sopensolaris@drydog.com 		entrylist_t	*pdevlist_zone = NULL;
15757968Sopensolaris@drydog.com 		entrylist_t	*psoftlist_zone = NULL;
15767968Sopensolaris@drydog.com 		entrylist_t	*ptr;
15770Sstevel@tonic-gate 
15780Sstevel@tonic-gate 		if (get_admindev_info(&pdevlist_zone, &psoftlist_zone) !=
15790Sstevel@tonic-gate 		    SUCCESS) {
15800Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext("failed to retrieve "
15810Sstevel@tonic-gate 			    "the list of kernel software providers.\n"));
15820Sstevel@tonic-gate 			rc = FAILURE;
15830Sstevel@tonic-gate 		}
15840Sstevel@tonic-gate 
15857968Sopensolaris@drydog.com 		for (ptr = psoftlist_zone; ptr != NULL; ptr = ptr->next) {
15867968Sopensolaris@drydog.com 			rv = list_mechlist_for_soft(ptr->pent->name,
158710979SHai-May.Chao@Sun.COM 			    pdevlist_zone, psoftlist_zone);
15880Sstevel@tonic-gate 			if (rv == FAILURE) {
15890Sstevel@tonic-gate 				(void) printf(gettext(
15900Sstevel@tonic-gate 				    "%s: failed to get the mechanism list.\n"),
15910Sstevel@tonic-gate 				    ptr->pent->name);
15920Sstevel@tonic-gate 				rc = FAILURE;
15930Sstevel@tonic-gate 			}
15940Sstevel@tonic-gate 		}
15950Sstevel@tonic-gate 
15960Sstevel@tonic-gate 		free_entrylist(pdevlist_zone);
15970Sstevel@tonic-gate 		free_entrylist(psoftlist_zone);
15980Sstevel@tonic-gate 	}
15990Sstevel@tonic-gate 
16000Sstevel@tonic-gate 	/* Get kernel hardware providers and their mechanism lists */
16010Sstevel@tonic-gate 	(void) printf(gettext("\nKernel hardware providers:\n"));
16020Sstevel@tonic-gate 	/*
16037334SDaniel.Anderson@Sun.COM 	 * TRANSLATION_NOTE
16040Sstevel@tonic-gate 	 * Strictly for appearance's sake, this line should be as long as
16050Sstevel@tonic-gate 	 * the length of the translated text above.
16060Sstevel@tonic-gate 	 */
16070Sstevel@tonic-gate 	(void) printf(gettext("==========================\n"));
16080Sstevel@tonic-gate 	if (get_dev_list(&pdevlist_kernel) != SUCCESS) {
16090Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("failed to retrieve "
16100Sstevel@tonic-gate 		    "the list of hardware providers.\n"));
16110Sstevel@tonic-gate 		return (FAILURE);
16120Sstevel@tonic-gate 	}
16130Sstevel@tonic-gate 
16140Sstevel@tonic-gate 	for (i = 0; i < pdevlist_kernel->dl_dev_count; i++) {
16150Sstevel@tonic-gate 		(void) strlcpy(devname,
16160Sstevel@tonic-gate 		    pdevlist_kernel->dl_devs[i].le_dev_name, MAXNAMELEN);
16170Sstevel@tonic-gate 		inst_num = pdevlist_kernel->dl_devs[i].le_dev_instance;
16180Sstevel@tonic-gate 		count = pdevlist_kernel->dl_devs[i].le_mechanism_count;
16190Sstevel@tonic-gate 		(void) snprintf(provname, sizeof (provname), "%s/%d", devname,
16200Sstevel@tonic-gate 		    inst_num);
16210Sstevel@tonic-gate 		if (get_dev_info(devname, inst_num, count, &pmechlist) ==
16220Sstevel@tonic-gate 		    SUCCESS) {
16230Sstevel@tonic-gate 			(void) filter_mechlist(&pmechlist, RANDOM);
16240Sstevel@tonic-gate 			print_mechlist(provname, pmechlist);
16250Sstevel@tonic-gate 			free_mechlist(pmechlist);
16260Sstevel@tonic-gate 		} else {
16270Sstevel@tonic-gate 			(void) printf(gettext("%s: failed to get the mechanism"
16280Sstevel@tonic-gate 			    " list.\n"), provname);
16290Sstevel@tonic-gate 			rc = FAILURE;
16300Sstevel@tonic-gate 		}
16310Sstevel@tonic-gate 	}
16320Sstevel@tonic-gate 	free(pdevlist_kernel);
16330Sstevel@tonic-gate 	return (rc);
16340Sstevel@tonic-gate }
16350Sstevel@tonic-gate 
16360Sstevel@tonic-gate 
16370Sstevel@tonic-gate /*
16380Sstevel@tonic-gate  * List all the providers. And for each provider, list the policy information.
16397968Sopensolaris@drydog.com  * Called for "cryptoadm list -p".
16400Sstevel@tonic-gate  */
16410Sstevel@tonic-gate static int
list_policy_for_all(void)16420Sstevel@tonic-gate list_policy_for_all(void)
16430Sstevel@tonic-gate {
16447968Sopensolaris@drydog.com 	crypto_get_dev_list_t	*pdevlist_kernel = NULL;
16457968Sopensolaris@drydog.com 	uentrylist_t		*pliblist = NULL;
16467968Sopensolaris@drydog.com 	entrylist_t		*pdevlist_conf = NULL;
16477968Sopensolaris@drydog.com 	entrylist_t		*psoftlist_conf = NULL;
16487968Sopensolaris@drydog.com 	entrylist_t		*ptr = NULL;
16497968Sopensolaris@drydog.com 	entrylist_t		*phead = NULL;
16507968Sopensolaris@drydog.com 	boolean_t		found = B_FALSE;
16517968Sopensolaris@drydog.com 	char			provname[MAXNAMELEN];
16527968Sopensolaris@drydog.com 	int			i;
16537968Sopensolaris@drydog.com 	int			rc = SUCCESS;
16540Sstevel@tonic-gate 
16550Sstevel@tonic-gate 	/* Get user-level providers */
16560Sstevel@tonic-gate 	(void) printf(gettext("\nUser-level providers:\n"));
16570Sstevel@tonic-gate 	/*
16587334SDaniel.Anderson@Sun.COM 	 * TRANSLATION_NOTE
16590Sstevel@tonic-gate 	 * Strictly for appearance's sake, this line should be as long as
16600Sstevel@tonic-gate 	 * the length of the translated text above.
16610Sstevel@tonic-gate 	 */
16620Sstevel@tonic-gate 	(void) printf(gettext("=====================\n"));
16630Sstevel@tonic-gate 	if (get_pkcs11conf_info(&pliblist) == FAILURE) {
16640Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("failed to retrieve "
16650Sstevel@tonic-gate 		    "the list of user-level providers.\n"));
16667968Sopensolaris@drydog.com 		rc = FAILURE;
16670Sstevel@tonic-gate 	} else {
16687968Sopensolaris@drydog.com 		uentrylist_t	*plibptr = pliblist;
16697968Sopensolaris@drydog.com 
16700Sstevel@tonic-gate 		while (plibptr != NULL) {
167110979SHai-May.Chao@Sun.COM 			/* skip metaslot and fips-140 entry */
167210979SHai-May.Chao@Sun.COM 			if ((strcmp(plibptr->puent->name,
167310979SHai-May.Chao@Sun.COM 			    METASLOT_KEYWORD) != 0) &&
167410979SHai-May.Chao@Sun.COM 			    (strcmp(plibptr->puent->name,
167510979SHai-May.Chao@Sun.COM 			    FIPS_KEYWORD) != 0)) {
16760Sstevel@tonic-gate 				if (print_uef_policy(plibptr->puent)
16770Sstevel@tonic-gate 				    == FAILURE) {
16780Sstevel@tonic-gate 					rc = FAILURE;
16790Sstevel@tonic-gate 				}
16800Sstevel@tonic-gate 			}
16810Sstevel@tonic-gate 			plibptr = plibptr->next;
16820Sstevel@tonic-gate 		}
16830Sstevel@tonic-gate 		free_uentrylist(pliblist);
16840Sstevel@tonic-gate 	}
16850Sstevel@tonic-gate 
16860Sstevel@tonic-gate 	/* kernel software providers */
16870Sstevel@tonic-gate 	(void) printf(gettext("\nKernel software providers:\n"));
16880Sstevel@tonic-gate 	/*
16897334SDaniel.Anderson@Sun.COM 	 * TRANSLATION_NOTE
16900Sstevel@tonic-gate 	 * Strictly for appearance's sake, this line should be as long as
16910Sstevel@tonic-gate 	 * the length of the translated text above.
16920Sstevel@tonic-gate 	 */
16930Sstevel@tonic-gate 	(void) printf(gettext("==========================\n"));
16940Sstevel@tonic-gate 
16957968Sopensolaris@drydog.com 	/* Get all entries from the kernel */
16960Sstevel@tonic-gate 	if (getzoneid() == GLOBAL_ZONEID) {
16977968Sopensolaris@drydog.com 		/* get kernel software providers from kernel ioctl */
16987968Sopensolaris@drydog.com 		crypto_get_soft_list_t		*psoftlist_kernel = NULL;
16997968Sopensolaris@drydog.com 		uint_t				sl_soft_count;
17007968Sopensolaris@drydog.com 		char				*psoftname;
17017968Sopensolaris@drydog.com 		int				i;
17020Sstevel@tonic-gate 
17037968Sopensolaris@drydog.com 		if (get_soft_list(&psoftlist_kernel) == FAILURE) {
17047968Sopensolaris@drydog.com 			cryptoerror(LOG_ERR, gettext("Failed to retrieve the "
17057968Sopensolaris@drydog.com 			    "software provider list from kernel."));
17067968Sopensolaris@drydog.com 			rc = FAILURE;
17077968Sopensolaris@drydog.com 		} else {
17087968Sopensolaris@drydog.com 			sl_soft_count = psoftlist_kernel->sl_soft_count;
17097968Sopensolaris@drydog.com 
17107968Sopensolaris@drydog.com 			for (i = 0, psoftname = psoftlist_kernel->sl_soft_names;
17117968Sopensolaris@drydog.com 			    i < sl_soft_count;
17127968Sopensolaris@drydog.com 			    ++i, psoftname += strlen(psoftname) + 1) {
17137968Sopensolaris@drydog.com 				(void) list_policy_for_soft(psoftname,
171410979SHai-May.Chao@Sun.COM 				    pdevlist_conf, psoftlist_conf);
17157968Sopensolaris@drydog.com 			}
17167968Sopensolaris@drydog.com 			free(psoftlist_kernel);
17170Sstevel@tonic-gate 		}
17180Sstevel@tonic-gate 
17190Sstevel@tonic-gate 	} else {
17200Sstevel@tonic-gate 		/* kcf.conf not there in non-global zone, no policy info */
17210Sstevel@tonic-gate 
17220Sstevel@tonic-gate 		/*
17237334SDaniel.Anderson@Sun.COM 		 * TRANSLATION_NOTE
17240Sstevel@tonic-gate 		 * "global" is keyword and not to be translated.
17250Sstevel@tonic-gate 		 */
17260Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext(
17270Sstevel@tonic-gate 		    "policy information for kernel software providers is "
17280Sstevel@tonic-gate 		    "available in the %s zone only"), "global");
17290Sstevel@tonic-gate 	}
17300Sstevel@tonic-gate 
17310Sstevel@tonic-gate 	/* Kernel hardware providers */
17320Sstevel@tonic-gate 	(void) printf(gettext("\nKernel hardware providers:\n"));
17330Sstevel@tonic-gate 	/*
17347334SDaniel.Anderson@Sun.COM 	 * TRANSLATION_NOTE
17350Sstevel@tonic-gate 	 * Strictly for appearance's sake, this line should be as long as
17360Sstevel@tonic-gate 	 * the length of the translated text above.
17370Sstevel@tonic-gate 	 */
17380Sstevel@tonic-gate 	(void) printf(gettext("==========================\n"));
17390Sstevel@tonic-gate 
17400Sstevel@tonic-gate 	if (getzoneid() != GLOBAL_ZONEID) {
17410Sstevel@tonic-gate 		/*
17427334SDaniel.Anderson@Sun.COM 		 * TRANSLATION_NOTE
17430Sstevel@tonic-gate 		 * "global" is keyword and not to be translated.
17440Sstevel@tonic-gate 		 */
17450Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext(
17460Sstevel@tonic-gate 		    "policy information for kernel hardware providers is "
17470Sstevel@tonic-gate 		    "available in the %s zone only"), "global");
17480Sstevel@tonic-gate 		return (FAILURE);
17490Sstevel@tonic-gate 	}
17500Sstevel@tonic-gate 
17510Sstevel@tonic-gate 	/* Get the hardware provider list from kernel */
17520Sstevel@tonic-gate 	if (get_dev_list(&pdevlist_kernel) != SUCCESS) {
17530Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext(
17540Sstevel@tonic-gate 		    "failed to retrieve the list of hardware providers.\n"));
17550Sstevel@tonic-gate 		return (FAILURE);
17560Sstevel@tonic-gate 	}
17570Sstevel@tonic-gate 
175810979SHai-May.Chao@Sun.COM 	if (get_kcfconf_info(&pdevlist_conf, &psoftlist_conf) == FAILURE) {
17597968Sopensolaris@drydog.com 		cryptoerror(LOG_ERR, "failed to retrieve the providers' "
17607968Sopensolaris@drydog.com 		    "information from file kcf.conf - %s.",
17617968Sopensolaris@drydog.com 		    _PATH_KCF_CONF);
17627968Sopensolaris@drydog.com 		return (FAILURE);
17637968Sopensolaris@drydog.com 	}
17647968Sopensolaris@drydog.com 
17657968Sopensolaris@drydog.com 
17660Sstevel@tonic-gate 	/*
17670Sstevel@tonic-gate 	 * For each hardware provider from kernel, check if it has an entry
17680Sstevel@tonic-gate 	 * in the config file.  If it has an entry, print out the policy from
17690Sstevel@tonic-gate 	 * config file and remove the entry from the hardware provider list
17700Sstevel@tonic-gate 	 * of the config file.  If it does not have an entry in the config
17710Sstevel@tonic-gate 	 * file, no mechanisms of it have been disabled. But, we still call
17720Sstevel@tonic-gate 	 * list_policy_for_hard() to account for the "random" feature.
17730Sstevel@tonic-gate 	 */
17740Sstevel@tonic-gate 	for (i = 0; i < pdevlist_kernel->dl_dev_count; i++) {
17750Sstevel@tonic-gate 		(void) snprintf(provname, sizeof (provname), "%s/%d",
17760Sstevel@tonic-gate 		    pdevlist_kernel->dl_devs[i].le_dev_name,
17770Sstevel@tonic-gate 		    pdevlist_kernel->dl_devs[i].le_dev_instance);
17787968Sopensolaris@drydog.com 
17790Sstevel@tonic-gate 		found = B_FALSE;
17800Sstevel@tonic-gate 		phead = ptr = pdevlist_conf;
17810Sstevel@tonic-gate 		while (!found && ptr) {
17820Sstevel@tonic-gate 			if (strcmp(ptr->pent->name, provname) == 0) {
17830Sstevel@tonic-gate 				found = B_TRUE;
17840Sstevel@tonic-gate 			} else {
17850Sstevel@tonic-gate 				phead = ptr;
17860Sstevel@tonic-gate 				ptr = ptr->next;
17870Sstevel@tonic-gate 			}
17880Sstevel@tonic-gate 		}
17890Sstevel@tonic-gate 
17900Sstevel@tonic-gate 		if (found) {
17917968Sopensolaris@drydog.com 			(void) list_policy_for_hard(ptr->pent->name,
179210979SHai-May.Chao@Sun.COM 			    pdevlist_conf, psoftlist_conf, pdevlist_kernel);
17930Sstevel@tonic-gate 			if (phead == ptr) {
17940Sstevel@tonic-gate 				pdevlist_conf = pdevlist_conf->next;
17950Sstevel@tonic-gate 			} else {
17960Sstevel@tonic-gate 				phead->next = ptr->next;
17970Sstevel@tonic-gate 			}
17980Sstevel@tonic-gate 			free_entry(ptr->pent);
17990Sstevel@tonic-gate 			free(ptr);
18000Sstevel@tonic-gate 		} else {
18017968Sopensolaris@drydog.com 			(void) list_policy_for_hard(provname, pdevlist_conf,
180210979SHai-May.Chao@Sun.COM 			    psoftlist_conf, pdevlist_kernel);
18030Sstevel@tonic-gate 		}
18040Sstevel@tonic-gate 	}
18050Sstevel@tonic-gate 
18060Sstevel@tonic-gate 	/*
18070Sstevel@tonic-gate 	 * If there are still entries left in the pdevlist_conf list from
18080Sstevel@tonic-gate 	 * the config file, these providers must have been detached.
18090Sstevel@tonic-gate 	 * Should print out their policy information also.
18100Sstevel@tonic-gate 	 */
18117968Sopensolaris@drydog.com 	for (ptr = pdevlist_conf; ptr != NULL; ptr = ptr->next) {
18127968Sopensolaris@drydog.com 		print_kef_policy(ptr->pent->name, ptr->pent, B_FALSE, B_TRUE);
18130Sstevel@tonic-gate 	}
18140Sstevel@tonic-gate 
18150Sstevel@tonic-gate 	free_entrylist(pdevlist_conf);
18167968Sopensolaris@drydog.com 	free_entrylist(psoftlist_conf);
18170Sstevel@tonic-gate 	free(pdevlist_kernel);
18180Sstevel@tonic-gate 
18190Sstevel@tonic-gate 	return (rc);
18200Sstevel@tonic-gate }
1821