1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * CDDL HEADER START 3*0Sstevel@tonic-gate * 4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only 6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance 7*0Sstevel@tonic-gate * with the License. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 11*0Sstevel@tonic-gate * See the License for the specific language governing permissions 12*0Sstevel@tonic-gate * and limitations under the License. 13*0Sstevel@tonic-gate * 14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 19*0Sstevel@tonic-gate * 20*0Sstevel@tonic-gate * CDDL HEADER END 21*0Sstevel@tonic-gate */ 22*0Sstevel@tonic-gate /* 23*0Sstevel@tonic-gate * Copyright 2005 Sun Microsystems, Inc. All rights reserved. 24*0Sstevel@tonic-gate * Use is subject to license terms. 25*0Sstevel@tonic-gate */ 26*0Sstevel@tonic-gate 27*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 28*0Sstevel@tonic-gate 29*0Sstevel@tonic-gate #include <fcntl.h> 30*0Sstevel@tonic-gate #include <stdio.h> 31*0Sstevel@tonic-gate #include <stdlib.h> 32*0Sstevel@tonic-gate #include <strings.h> 33*0Sstevel@tonic-gate #include <unistd.h> 34*0Sstevel@tonic-gate #include <locale.h> 35*0Sstevel@tonic-gate #include <libgen.h> 36*0Sstevel@tonic-gate #include <sys/types.h> 37*0Sstevel@tonic-gate #include <zone.h> 38*0Sstevel@tonic-gate #include <sys/crypto/ioctladmin.h> 39*0Sstevel@tonic-gate #include <cryptoutil.h> 40*0Sstevel@tonic-gate #include "cryptoadm.h" 41*0Sstevel@tonic-gate 42*0Sstevel@tonic-gate #define REQ_ARG_CNT 2 43*0Sstevel@tonic-gate 44*0Sstevel@tonic-gate /* subcommand index */ 45*0Sstevel@tonic-gate enum subcommand_index { 46*0Sstevel@tonic-gate CRYPTO_LIST, 47*0Sstevel@tonic-gate CRYPTO_DISABLE, 48*0Sstevel@tonic-gate CRYPTO_ENABLE, 49*0Sstevel@tonic-gate CRYPTO_INSTALL, 50*0Sstevel@tonic-gate CRYPTO_UNINSTALL, 51*0Sstevel@tonic-gate CRYPTO_UNLOAD, 52*0Sstevel@tonic-gate CRYPTO_REFRESH, 53*0Sstevel@tonic-gate CRYPTO_START, 54*0Sstevel@tonic-gate CRYPTO_STOP, 55*0Sstevel@tonic-gate CRYPTO_HELP }; 56*0Sstevel@tonic-gate 57*0Sstevel@tonic-gate /* 58*0Sstevel@tonic-gate * TRANSLATION_NOTE: 59*0Sstevel@tonic-gate * Command keywords are not to be translated. 60*0Sstevel@tonic-gate */ 61*0Sstevel@tonic-gate static char *cmd_table[] = { 62*0Sstevel@tonic-gate "list", 63*0Sstevel@tonic-gate "disable", 64*0Sstevel@tonic-gate "enable", 65*0Sstevel@tonic-gate "install", 66*0Sstevel@tonic-gate "uninstall", 67*0Sstevel@tonic-gate "unload", 68*0Sstevel@tonic-gate "refresh", 69*0Sstevel@tonic-gate "start", 70*0Sstevel@tonic-gate "stop", 71*0Sstevel@tonic-gate "--help" }; 72*0Sstevel@tonic-gate 73*0Sstevel@tonic-gate /* provider type */ 74*0Sstevel@tonic-gate enum provider_type_index { 75*0Sstevel@tonic-gate PROV_UEF_LIB, 76*0Sstevel@tonic-gate PROV_KEF_SOFT, 77*0Sstevel@tonic-gate PROV_KEF_HARD, 78*0Sstevel@tonic-gate METASLOT, 79*0Sstevel@tonic-gate PROV_BADNAME }; 80*0Sstevel@tonic-gate 81*0Sstevel@tonic-gate typedef struct { 82*0Sstevel@tonic-gate char cp_name[MAXPATHLEN]; 83*0Sstevel@tonic-gate enum provider_type_index cp_type; 84*0Sstevel@tonic-gate } cryptoadm_provider_t; 85*0Sstevel@tonic-gate 86*0Sstevel@tonic-gate /* 87*0Sstevel@tonic-gate * TRANSLATION_NOTE: 88*0Sstevel@tonic-gate * Operand keywords are not to be translated. 89*0Sstevel@tonic-gate */ 90*0Sstevel@tonic-gate static const char *KN_PROVIDER = "provider="; 91*0Sstevel@tonic-gate static const char *KN_MECH = "mechanism="; 92*0Sstevel@tonic-gate static const char *KN_ALL = "all"; 93*0Sstevel@tonic-gate static const char *KN_TOKEN = "token="; 94*0Sstevel@tonic-gate static const char *KN_SLOT = "slot="; 95*0Sstevel@tonic-gate static const char *KN_DEFAULT_KS = "default-keystore"; 96*0Sstevel@tonic-gate static const char *KN_AUTO_KEY_MIGRATE = "auto-key-migrate"; 97*0Sstevel@tonic-gate 98*0Sstevel@tonic-gate /* static variables */ 99*0Sstevel@tonic-gate static boolean_t allflag = B_FALSE; 100*0Sstevel@tonic-gate static boolean_t rndflag = B_FALSE; 101*0Sstevel@tonic-gate static mechlist_t *mecharglist = NULL; 102*0Sstevel@tonic-gate 103*0Sstevel@tonic-gate /* static functions */ 104*0Sstevel@tonic-gate static void usage(void); 105*0Sstevel@tonic-gate static int get_provider_type(char *); 106*0Sstevel@tonic-gate static int process_mech_operands(int, char **, boolean_t); 107*0Sstevel@tonic-gate static int do_list(int, char **); 108*0Sstevel@tonic-gate static int do_disable(int, char **); 109*0Sstevel@tonic-gate static int do_enable(int, char **); 110*0Sstevel@tonic-gate static int do_install(int, char **); 111*0Sstevel@tonic-gate static int do_uninstall(int, char **); 112*0Sstevel@tonic-gate static int do_unload(int, char **); 113*0Sstevel@tonic-gate static int do_refresh(int); 114*0Sstevel@tonic-gate static int do_start(int); 115*0Sstevel@tonic-gate static int do_stop(int); 116*0Sstevel@tonic-gate static int list_simple_for_all(boolean_t); 117*0Sstevel@tonic-gate static int list_mechlist_for_all(boolean_t); 118*0Sstevel@tonic-gate static int list_policy_for_all(void); 119*0Sstevel@tonic-gate 120*0Sstevel@tonic-gate int 121*0Sstevel@tonic-gate main(int argc, char *argv[]) 122*0Sstevel@tonic-gate { 123*0Sstevel@tonic-gate char *subcmd; 124*0Sstevel@tonic-gate int cmdnum; 125*0Sstevel@tonic-gate int cmd_index = 0; 126*0Sstevel@tonic-gate int rc = SUCCESS; 127*0Sstevel@tonic-gate 128*0Sstevel@tonic-gate (void) setlocale(LC_ALL, ""); 129*0Sstevel@tonic-gate 130*0Sstevel@tonic-gate #if !defined(TEXT_DOMAIN) /* Should be defined by cc -D */ 131*0Sstevel@tonic-gate #define TEXT_DOMAIN "SYS_TEST" /* Use this only if it weren't */ 132*0Sstevel@tonic-gate #endif 133*0Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 134*0Sstevel@tonic-gate 135*0Sstevel@tonic-gate cryptodebug_init(basename(argv[0])); 136*0Sstevel@tonic-gate 137*0Sstevel@tonic-gate if (argc < REQ_ARG_CNT) { 138*0Sstevel@tonic-gate usage(); 139*0Sstevel@tonic-gate return (ERROR_USAGE); 140*0Sstevel@tonic-gate } 141*0Sstevel@tonic-gate 142*0Sstevel@tonic-gate /* get the subcommand index */ 143*0Sstevel@tonic-gate cmd_index = 0; 144*0Sstevel@tonic-gate subcmd = argv[1]; 145*0Sstevel@tonic-gate cmdnum = sizeof (cmd_table)/sizeof (cmd_table[0]); 146*0Sstevel@tonic-gate 147*0Sstevel@tonic-gate while ((cmd_index < cmdnum) && 148*0Sstevel@tonic-gate (strcmp(subcmd, cmd_table[cmd_index]) != 0)) { 149*0Sstevel@tonic-gate cmd_index++; 150*0Sstevel@tonic-gate } 151*0Sstevel@tonic-gate if (cmd_index >= cmdnum) { 152*0Sstevel@tonic-gate usage(); 153*0Sstevel@tonic-gate return (ERROR_USAGE); 154*0Sstevel@tonic-gate } 155*0Sstevel@tonic-gate 156*0Sstevel@tonic-gate /* do the subcommand */ 157*0Sstevel@tonic-gate switch (cmd_index) { 158*0Sstevel@tonic-gate case CRYPTO_LIST: 159*0Sstevel@tonic-gate rc = do_list(argc, argv); 160*0Sstevel@tonic-gate break; 161*0Sstevel@tonic-gate case CRYPTO_DISABLE: 162*0Sstevel@tonic-gate rc = do_disable(argc, argv); 163*0Sstevel@tonic-gate break; 164*0Sstevel@tonic-gate case CRYPTO_ENABLE: 165*0Sstevel@tonic-gate rc = do_enable(argc, argv); 166*0Sstevel@tonic-gate break; 167*0Sstevel@tonic-gate case CRYPTO_INSTALL: 168*0Sstevel@tonic-gate rc = do_install(argc, argv); 169*0Sstevel@tonic-gate break; 170*0Sstevel@tonic-gate case CRYPTO_UNINSTALL: 171*0Sstevel@tonic-gate rc = do_uninstall(argc, argv); 172*0Sstevel@tonic-gate break; 173*0Sstevel@tonic-gate case CRYPTO_UNLOAD: 174*0Sstevel@tonic-gate rc = do_unload(argc, argv); 175*0Sstevel@tonic-gate break; 176*0Sstevel@tonic-gate case CRYPTO_REFRESH: 177*0Sstevel@tonic-gate rc = do_refresh(argc); 178*0Sstevel@tonic-gate break; 179*0Sstevel@tonic-gate case CRYPTO_START: 180*0Sstevel@tonic-gate rc = do_start(argc); 181*0Sstevel@tonic-gate break; 182*0Sstevel@tonic-gate case CRYPTO_STOP: 183*0Sstevel@tonic-gate rc = do_stop(argc); 184*0Sstevel@tonic-gate break; 185*0Sstevel@tonic-gate case CRYPTO_HELP: 186*0Sstevel@tonic-gate usage(); 187*0Sstevel@tonic-gate rc = SUCCESS; 188*0Sstevel@tonic-gate break; 189*0Sstevel@tonic-gate default: /* should not come here */ 190*0Sstevel@tonic-gate usage(); 191*0Sstevel@tonic-gate rc = ERROR_USAGE; 192*0Sstevel@tonic-gate break; 193*0Sstevel@tonic-gate } 194*0Sstevel@tonic-gate return (rc); 195*0Sstevel@tonic-gate } 196*0Sstevel@tonic-gate 197*0Sstevel@tonic-gate 198*0Sstevel@tonic-gate static void 199*0Sstevel@tonic-gate usage(void) 200*0Sstevel@tonic-gate { 201*0Sstevel@tonic-gate /* 202*0Sstevel@tonic-gate * TRANSLATION_NOTE: 203*0Sstevel@tonic-gate * Command usage is not to be translated. Only the word "Usage:" 204*0Sstevel@tonic-gate * along with localized expressions indicating what kind of value 205*0Sstevel@tonic-gate * is expected for arguments. 206*0Sstevel@tonic-gate */ 207*0Sstevel@tonic-gate (void) fprintf(stderr, gettext("Usage:\n")); 208*0Sstevel@tonic-gate (void) fprintf(stderr, 209*0Sstevel@tonic-gate " cryptoadm list [-mpv] [provider=<%s> | metaslot]" 210*0Sstevel@tonic-gate " [mechanism=<%s>]\n", 211*0Sstevel@tonic-gate gettext("provider-name"), gettext("mechanism-list")); 212*0Sstevel@tonic-gate (void) fprintf(stderr, 213*0Sstevel@tonic-gate " cryptoadm disable provider=<%s>" 214*0Sstevel@tonic-gate " mechanism=<%s> | random | all\n", 215*0Sstevel@tonic-gate gettext("provider-name"), gettext("mechanism-list")); 216*0Sstevel@tonic-gate (void) fprintf(stderr, 217*0Sstevel@tonic-gate " cryptoadm disable metaslot" 218*0Sstevel@tonic-gate " [auto-key-migrate] [mechanism=<%s>]\n", 219*0Sstevel@tonic-gate gettext("mechanism-list")); 220*0Sstevel@tonic-gate (void) fprintf(stderr, 221*0Sstevel@tonic-gate " cryptoadm enable provider=<%s>" 222*0Sstevel@tonic-gate " mechanism=<%s> | random | all\n", 223*0Sstevel@tonic-gate gettext("provider-name"), gettext("mechanism-list")); 224*0Sstevel@tonic-gate (void) fprintf(stderr, 225*0Sstevel@tonic-gate " cryptoadm enable metaslot [mechanism=<%s>]" 226*0Sstevel@tonic-gate " [[token=<%s>] [slot=<%s>]" 227*0Sstevel@tonic-gate " | [default-keystore]] | [auto-key-migrate]\n", 228*0Sstevel@tonic-gate gettext("mechanism-list"), gettext("token-label"), 229*0Sstevel@tonic-gate gettext("slot-description")); 230*0Sstevel@tonic-gate (void) fprintf(stderr, 231*0Sstevel@tonic-gate " cryptoadm install provider=<%s>\n", 232*0Sstevel@tonic-gate gettext("provider-name")); 233*0Sstevel@tonic-gate (void) fprintf(stderr, 234*0Sstevel@tonic-gate " cryptoadm install provider=<%s> [mechanism=<%s>]\n", 235*0Sstevel@tonic-gate gettext("provider-name"), gettext("mechanism-list")); 236*0Sstevel@tonic-gate (void) fprintf(stderr, 237*0Sstevel@tonic-gate " cryptoadm uninstall provider=<%s>\n", 238*0Sstevel@tonic-gate gettext("provider-name")); 239*0Sstevel@tonic-gate (void) fprintf(stderr, 240*0Sstevel@tonic-gate " cryptoadm unload provider=<%s>\n", 241*0Sstevel@tonic-gate gettext("provider-name")); 242*0Sstevel@tonic-gate (void) fprintf(stderr, 243*0Sstevel@tonic-gate " cryptoadm refresh\n" 244*0Sstevel@tonic-gate " cryptoadm start\n" 245*0Sstevel@tonic-gate " cryptoadm stop\n" 246*0Sstevel@tonic-gate " cryptoadm --help\n"); 247*0Sstevel@tonic-gate } 248*0Sstevel@tonic-gate 249*0Sstevel@tonic-gate 250*0Sstevel@tonic-gate /* 251*0Sstevel@tonic-gate * Get the provider type. This function returns 252*0Sstevel@tonic-gate * - PROV_UEF_LIB if provname contains an absolute path name 253*0Sstevel@tonic-gate * - PROV_KEF_SOFT if provname is a base name only 254*0Sstevel@tonic-gate * - PROV_KEF_HARD if provname contains one slash only and the slash is not 255*0Sstevel@tonic-gate * the 1st character. 256*0Sstevel@tonic-gate * - PROV_BADNAME othewise. 257*0Sstevel@tonic-gate */ 258*0Sstevel@tonic-gate static int 259*0Sstevel@tonic-gate get_provider_type(char *provname) 260*0Sstevel@tonic-gate { 261*0Sstevel@tonic-gate char *pslash1; 262*0Sstevel@tonic-gate char *pslash2; 263*0Sstevel@tonic-gate 264*0Sstevel@tonic-gate if (provname == NULL) { 265*0Sstevel@tonic-gate return (FAILURE); 266*0Sstevel@tonic-gate } 267*0Sstevel@tonic-gate 268*0Sstevel@tonic-gate if (provname[0] == '/') { 269*0Sstevel@tonic-gate return (PROV_UEF_LIB); 270*0Sstevel@tonic-gate } else if ((pslash1 = strchr(provname, SEP_SLASH)) == NULL) { 271*0Sstevel@tonic-gate /* no slash */ 272*0Sstevel@tonic-gate return (PROV_KEF_SOFT); 273*0Sstevel@tonic-gate } else { 274*0Sstevel@tonic-gate pslash2 = strrchr(provname, SEP_SLASH); 275*0Sstevel@tonic-gate if (pslash1 == pslash2) { 276*0Sstevel@tonic-gate return (PROV_KEF_HARD); 277*0Sstevel@tonic-gate } else { 278*0Sstevel@tonic-gate return (PROV_BADNAME); 279*0Sstevel@tonic-gate } 280*0Sstevel@tonic-gate } 281*0Sstevel@tonic-gate } 282*0Sstevel@tonic-gate 283*0Sstevel@tonic-gate /* 284*0Sstevel@tonic-gate * Get the provider structure. This function returns NULL if no valid 285*0Sstevel@tonic-gate * provider= is found in argv[], otherwise a cryptoadm_provider_t is returned. 286*0Sstevel@tonic-gate * If provider= is found but has no argument, then a cryptoadm_provider_t 287*0Sstevel@tonic-gate * with cp_type = PROV_BADNAME is returned. 288*0Sstevel@tonic-gate */ 289*0Sstevel@tonic-gate static cryptoadm_provider_t * 290*0Sstevel@tonic-gate get_provider(int argc, char **argv) 291*0Sstevel@tonic-gate { 292*0Sstevel@tonic-gate int c = 0; 293*0Sstevel@tonic-gate boolean_t found = B_FALSE; 294*0Sstevel@tonic-gate cryptoadm_provider_t *provider = NULL; 295*0Sstevel@tonic-gate char *provstr = NULL, *savstr; 296*0Sstevel@tonic-gate boolean_t is_metaslot = B_FALSE; 297*0Sstevel@tonic-gate 298*0Sstevel@tonic-gate while (!found && ++c < argc) { 299*0Sstevel@tonic-gate if (strncmp(argv[c], METASLOT_KEYWORD, 300*0Sstevel@tonic-gate strlen(METASLOT_KEYWORD)) == 0) { 301*0Sstevel@tonic-gate is_metaslot = B_TRUE; 302*0Sstevel@tonic-gate found = B_TRUE; 303*0Sstevel@tonic-gate } else if (strncmp(argv[c], KN_PROVIDER, 304*0Sstevel@tonic-gate strlen(KN_PROVIDER)) == 0 && 305*0Sstevel@tonic-gate strlen(argv[c]) > strlen(KN_PROVIDER)) { 306*0Sstevel@tonic-gate if ((provstr = strdup(argv[c])) == NULL) { 307*0Sstevel@tonic-gate int err = errno; 308*0Sstevel@tonic-gate /* 309*0Sstevel@tonic-gate * TRANSLATION_NOTE: 310*0Sstevel@tonic-gate * "get_provider" is a function name and should 311*0Sstevel@tonic-gate * not be translated. 312*0Sstevel@tonic-gate */ 313*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, "get_provider: %s.", 314*0Sstevel@tonic-gate strerror(err)); 315*0Sstevel@tonic-gate return (NULL); 316*0Sstevel@tonic-gate } 317*0Sstevel@tonic-gate found = B_TRUE; 318*0Sstevel@tonic-gate } 319*0Sstevel@tonic-gate } 320*0Sstevel@tonic-gate if (!found) 321*0Sstevel@tonic-gate return (NULL); 322*0Sstevel@tonic-gate 323*0Sstevel@tonic-gate provider = malloc(sizeof (cryptoadm_provider_t)); 324*0Sstevel@tonic-gate if (provider == NULL) { 325*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("out of memory.")); 326*0Sstevel@tonic-gate if (provstr) { 327*0Sstevel@tonic-gate free(provstr); 328*0Sstevel@tonic-gate } 329*0Sstevel@tonic-gate return (NULL); 330*0Sstevel@tonic-gate } 331*0Sstevel@tonic-gate 332*0Sstevel@tonic-gate if (is_metaslot) { 333*0Sstevel@tonic-gate (void) strlcpy(provider->cp_name, METASLOT_KEYWORD, 334*0Sstevel@tonic-gate strlen(METASLOT_KEYWORD)); 335*0Sstevel@tonic-gate provider->cp_type = METASLOT; 336*0Sstevel@tonic-gate } else { 337*0Sstevel@tonic-gate 338*0Sstevel@tonic-gate savstr = provstr; 339*0Sstevel@tonic-gate (void) strtok(provstr, "="); 340*0Sstevel@tonic-gate provstr = strtok(NULL, "="); 341*0Sstevel@tonic-gate if (provstr == NULL) { 342*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("bad provider name.")); 343*0Sstevel@tonic-gate provider->cp_type = PROV_BADNAME; 344*0Sstevel@tonic-gate free(savstr); 345*0Sstevel@tonic-gate return (provider); 346*0Sstevel@tonic-gate } 347*0Sstevel@tonic-gate 348*0Sstevel@tonic-gate (void) strlcpy(provider->cp_name, provstr, 349*0Sstevel@tonic-gate sizeof (provider->cp_name)); 350*0Sstevel@tonic-gate provider->cp_type = get_provider_type(provider->cp_name); 351*0Sstevel@tonic-gate 352*0Sstevel@tonic-gate free(savstr); 353*0Sstevel@tonic-gate } 354*0Sstevel@tonic-gate return (provider); 355*0Sstevel@tonic-gate } 356*0Sstevel@tonic-gate 357*0Sstevel@tonic-gate /* 358*0Sstevel@tonic-gate * Process the "feature" operands. 359*0Sstevel@tonic-gate * 360*0Sstevel@tonic-gate * "argc" and "argv" contain values specified on the command line. 361*0Sstevel@tonic-gate * All other arguments are used for returning parsing results. 362*0Sstevel@tonic-gate * If any of these arguments are NULL, that keyword is not expected, 363*0Sstevel@tonic-gate * and FAILURE will be returned. 364*0Sstevel@tonic-gate */ 365*0Sstevel@tonic-gate static int 366*0Sstevel@tonic-gate process_metaslot_operands(int argc, char **argv, char **meta_ks_token, 367*0Sstevel@tonic-gate char **meta_ks_slot, boolean_t *use_default, 368*0Sstevel@tonic-gate boolean_t *auto_key_migrate_flag) 369*0Sstevel@tonic-gate { 370*0Sstevel@tonic-gate int c = 2; 371*0Sstevel@tonic-gate int rc = SUCCESS; 372*0Sstevel@tonic-gate 373*0Sstevel@tonic-gate while (++c < argc) { 374*0Sstevel@tonic-gate if ((strncmp(argv[c], KN_MECH, strlen(KN_MECH)) == 0) && 375*0Sstevel@tonic-gate strlen(argv[c]) > strlen(KN_MECH)) { 376*0Sstevel@tonic-gate 377*0Sstevel@tonic-gate /* process mechanism operands */ 378*0Sstevel@tonic-gate if ((rc = process_mech_operands(argc, argv, B_TRUE)) 379*0Sstevel@tonic-gate != SUCCESS) { 380*0Sstevel@tonic-gate goto finish; 381*0Sstevel@tonic-gate } 382*0Sstevel@tonic-gate 383*0Sstevel@tonic-gate } else if ((strncmp(argv[c], KN_TOKEN, 384*0Sstevel@tonic-gate strlen(KN_TOKEN)) == 0) && 385*0Sstevel@tonic-gate strlen(argv[c]) > strlen(KN_TOKEN)) { 386*0Sstevel@tonic-gate if ((meta_ks_token) && (strtok(argv[c], "=") != NULL)) { 387*0Sstevel@tonic-gate char *tmp; 388*0Sstevel@tonic-gate if ((tmp = strtok(NULL, "=")) != NULL) { 389*0Sstevel@tonic-gate *meta_ks_token = strdup(tmp); 390*0Sstevel@tonic-gate } else { 391*0Sstevel@tonic-gate return (FAILURE); 392*0Sstevel@tonic-gate } 393*0Sstevel@tonic-gate } else { 394*0Sstevel@tonic-gate return (FAILURE); 395*0Sstevel@tonic-gate } 396*0Sstevel@tonic-gate 397*0Sstevel@tonic-gate } else if ((strncmp(argv[c], KN_SLOT, 398*0Sstevel@tonic-gate strlen(KN_SLOT)) == 0) && 399*0Sstevel@tonic-gate strlen(argv[c]) > strlen(KN_SLOT)) { 400*0Sstevel@tonic-gate 401*0Sstevel@tonic-gate if ((meta_ks_slot) && (strtok(argv[c], "=") != NULL)) { 402*0Sstevel@tonic-gate char *tmp; 403*0Sstevel@tonic-gate if ((tmp = strtok(NULL, "=")) != NULL) { 404*0Sstevel@tonic-gate *meta_ks_slot = strdup(tmp); 405*0Sstevel@tonic-gate } else { 406*0Sstevel@tonic-gate return (FAILURE); 407*0Sstevel@tonic-gate } 408*0Sstevel@tonic-gate } else { 409*0Sstevel@tonic-gate return (FAILURE); 410*0Sstevel@tonic-gate } 411*0Sstevel@tonic-gate 412*0Sstevel@tonic-gate } else if (strncmp(argv[c], KN_DEFAULT_KS, 413*0Sstevel@tonic-gate strlen(KN_DEFAULT_KS)) == 0) { 414*0Sstevel@tonic-gate 415*0Sstevel@tonic-gate if (use_default) { 416*0Sstevel@tonic-gate *use_default = B_TRUE; 417*0Sstevel@tonic-gate } else { 418*0Sstevel@tonic-gate return (FAILURE); 419*0Sstevel@tonic-gate } 420*0Sstevel@tonic-gate } else if (strncmp(argv[c], KN_AUTO_KEY_MIGRATE, 421*0Sstevel@tonic-gate strlen(KN_AUTO_KEY_MIGRATE)) == 0) { 422*0Sstevel@tonic-gate 423*0Sstevel@tonic-gate if (auto_key_migrate_flag) { 424*0Sstevel@tonic-gate *auto_key_migrate_flag = B_TRUE; 425*0Sstevel@tonic-gate } else { 426*0Sstevel@tonic-gate return (FAILURE); 427*0Sstevel@tonic-gate } 428*0Sstevel@tonic-gate } else { 429*0Sstevel@tonic-gate return (FAILURE); 430*0Sstevel@tonic-gate } 431*0Sstevel@tonic-gate } 432*0Sstevel@tonic-gate finish: 433*0Sstevel@tonic-gate return (rc); 434*0Sstevel@tonic-gate } 435*0Sstevel@tonic-gate 436*0Sstevel@tonic-gate /* 437*0Sstevel@tonic-gate * Process the "feature" operands. 438*0Sstevel@tonic-gate */ 439*0Sstevel@tonic-gate static int 440*0Sstevel@tonic-gate process_feature_operands(int argc, char **argv) 441*0Sstevel@tonic-gate { 442*0Sstevel@tonic-gate int c = 2; 443*0Sstevel@tonic-gate 444*0Sstevel@tonic-gate while (++c < argc) { 445*0Sstevel@tonic-gate if (strcmp(argv[c], KN_ALL) == 0) { 446*0Sstevel@tonic-gate allflag = B_TRUE; 447*0Sstevel@tonic-gate rndflag = B_TRUE; /* all includes random also. */ 448*0Sstevel@tonic-gate } else if (strcmp(argv[c], RANDOM) == 0) { 449*0Sstevel@tonic-gate rndflag = B_TRUE; 450*0Sstevel@tonic-gate } 451*0Sstevel@tonic-gate } 452*0Sstevel@tonic-gate return (SUCCESS); 453*0Sstevel@tonic-gate } 454*0Sstevel@tonic-gate 455*0Sstevel@tonic-gate /* 456*0Sstevel@tonic-gate * Process the mechanism operands for the disable, enable and install 457*0Sstevel@tonic-gate * subcommands. This function sets the static variable allflag to be B_TRUE 458*0Sstevel@tonic-gate * if the keyword "all" is specified, otherwise builds a link list of the 459*0Sstevel@tonic-gate * mechanism operands and save it in the static variable mecharglist. 460*0Sstevel@tonic-gate * 461*0Sstevel@tonic-gate * This function returns 462*0Sstevel@tonic-gate * ERROR_USAGE: mechanism operand is missing. 463*0Sstevel@tonic-gate * FAILURE: out of memory. 464*0Sstevel@tonic-gate * SUCCESS: otherwise. 465*0Sstevel@tonic-gate */ 466*0Sstevel@tonic-gate static int 467*0Sstevel@tonic-gate process_mech_operands(int argc, char **argv, boolean_t quiet) 468*0Sstevel@tonic-gate { 469*0Sstevel@tonic-gate mechlist_t *pmech; 470*0Sstevel@tonic-gate mechlist_t *pcur = NULL; 471*0Sstevel@tonic-gate mechlist_t *phead = NULL; 472*0Sstevel@tonic-gate boolean_t found = B_FALSE; 473*0Sstevel@tonic-gate char *mechliststr = NULL; 474*0Sstevel@tonic-gate char *curmech = NULL; 475*0Sstevel@tonic-gate int c = -1; 476*0Sstevel@tonic-gate int rc = SUCCESS; 477*0Sstevel@tonic-gate 478*0Sstevel@tonic-gate while (!found && ++c < argc) { 479*0Sstevel@tonic-gate if ((strncmp(argv[c], KN_MECH, strlen(KN_MECH)) == 0) && 480*0Sstevel@tonic-gate strlen(argv[c]) > strlen(KN_MECH)) { 481*0Sstevel@tonic-gate found = B_TRUE; 482*0Sstevel@tonic-gate } 483*0Sstevel@tonic-gate } 484*0Sstevel@tonic-gate if (!found) { 485*0Sstevel@tonic-gate if (!quiet) 486*0Sstevel@tonic-gate /* 487*0Sstevel@tonic-gate * TRANSLATION_NOTE: 488*0Sstevel@tonic-gate * "mechanism" could be either a literal keyword 489*0Sstevel@tonic-gate * and hence not to be translated, or a descriptive 490*0Sstevel@tonic-gate * word and translatable. A choice was made to 491*0Sstevel@tonic-gate * view it as a literal keyword. 492*0Sstevel@tonic-gate */ 493*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, 494*0Sstevel@tonic-gate gettext("the %s operand is missing.\n"), 495*0Sstevel@tonic-gate "mechanism"); 496*0Sstevel@tonic-gate return (ERROR_USAGE); 497*0Sstevel@tonic-gate } 498*0Sstevel@tonic-gate (void) strtok(argv[c], "="); 499*0Sstevel@tonic-gate mechliststr = strtok(NULL, "="); 500*0Sstevel@tonic-gate 501*0Sstevel@tonic-gate if (strcmp(mechliststr, "all") == 0) { 502*0Sstevel@tonic-gate allflag = B_TRUE; 503*0Sstevel@tonic-gate mecharglist = NULL; 504*0Sstevel@tonic-gate return (SUCCESS); 505*0Sstevel@tonic-gate } 506*0Sstevel@tonic-gate 507*0Sstevel@tonic-gate curmech = strtok(mechliststr, ","); 508*0Sstevel@tonic-gate do { 509*0Sstevel@tonic-gate if ((pmech = create_mech(curmech)) == NULL) { 510*0Sstevel@tonic-gate rc = FAILURE; 511*0Sstevel@tonic-gate break; 512*0Sstevel@tonic-gate } else { 513*0Sstevel@tonic-gate if (phead == NULL) { 514*0Sstevel@tonic-gate phead = pcur = pmech; 515*0Sstevel@tonic-gate } else { 516*0Sstevel@tonic-gate pcur->next = pmech; 517*0Sstevel@tonic-gate pcur = pmech; 518*0Sstevel@tonic-gate } 519*0Sstevel@tonic-gate } 520*0Sstevel@tonic-gate } while ((curmech = strtok(NULL, ",")) != NULL); 521*0Sstevel@tonic-gate 522*0Sstevel@tonic-gate if (rc == FAILURE) { 523*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("out of memory.")); 524*0Sstevel@tonic-gate free_mechlist(phead); 525*0Sstevel@tonic-gate } else { 526*0Sstevel@tonic-gate mecharglist = phead; 527*0Sstevel@tonic-gate rc = SUCCESS; 528*0Sstevel@tonic-gate } 529*0Sstevel@tonic-gate return (rc); 530*0Sstevel@tonic-gate } 531*0Sstevel@tonic-gate 532*0Sstevel@tonic-gate 533*0Sstevel@tonic-gate 534*0Sstevel@tonic-gate /* 535*0Sstevel@tonic-gate * The top level function for the list subcommand and options. 536*0Sstevel@tonic-gate */ 537*0Sstevel@tonic-gate static int 538*0Sstevel@tonic-gate do_list(int argc, char **argv) 539*0Sstevel@tonic-gate { 540*0Sstevel@tonic-gate boolean_t mflag = B_FALSE; 541*0Sstevel@tonic-gate boolean_t pflag = B_FALSE; 542*0Sstevel@tonic-gate boolean_t vflag = B_FALSE; 543*0Sstevel@tonic-gate char ch; 544*0Sstevel@tonic-gate cryptoadm_provider_t *prov = NULL; 545*0Sstevel@tonic-gate int rc = SUCCESS; 546*0Sstevel@tonic-gate 547*0Sstevel@tonic-gate argc -= 1; 548*0Sstevel@tonic-gate argv += 1; 549*0Sstevel@tonic-gate 550*0Sstevel@tonic-gate if (argc == 1) { 551*0Sstevel@tonic-gate rc = list_simple_for_all(B_FALSE); 552*0Sstevel@tonic-gate goto out; 553*0Sstevel@tonic-gate } 554*0Sstevel@tonic-gate 555*0Sstevel@tonic-gate /* 556*0Sstevel@tonic-gate * [-v] [-m] [-p] [provider=<>] [mechanism=<>] 557*0Sstevel@tonic-gate */ 558*0Sstevel@tonic-gate if (argc > 5) { 559*0Sstevel@tonic-gate usage(); 560*0Sstevel@tonic-gate return (rc); 561*0Sstevel@tonic-gate } 562*0Sstevel@tonic-gate 563*0Sstevel@tonic-gate while ((ch = getopt(argc, argv, "mpv")) != EOF) { 564*0Sstevel@tonic-gate switch (ch) { 565*0Sstevel@tonic-gate case 'm': 566*0Sstevel@tonic-gate mflag = B_TRUE; 567*0Sstevel@tonic-gate if (pflag) { 568*0Sstevel@tonic-gate rc = ERROR_USAGE; 569*0Sstevel@tonic-gate } 570*0Sstevel@tonic-gate break; 571*0Sstevel@tonic-gate case 'p': 572*0Sstevel@tonic-gate pflag = B_TRUE; 573*0Sstevel@tonic-gate if (mflag || vflag) { 574*0Sstevel@tonic-gate rc = ERROR_USAGE; 575*0Sstevel@tonic-gate } 576*0Sstevel@tonic-gate break; 577*0Sstevel@tonic-gate case 'v': 578*0Sstevel@tonic-gate vflag = B_TRUE; 579*0Sstevel@tonic-gate if (pflag) 580*0Sstevel@tonic-gate rc = ERROR_USAGE; 581*0Sstevel@tonic-gate break; 582*0Sstevel@tonic-gate default: 583*0Sstevel@tonic-gate rc = ERROR_USAGE; 584*0Sstevel@tonic-gate break; 585*0Sstevel@tonic-gate } 586*0Sstevel@tonic-gate } 587*0Sstevel@tonic-gate 588*0Sstevel@tonic-gate if (rc == ERROR_USAGE) { 589*0Sstevel@tonic-gate usage(); 590*0Sstevel@tonic-gate return (rc); 591*0Sstevel@tonic-gate } 592*0Sstevel@tonic-gate 593*0Sstevel@tonic-gate if ((rc = process_feature_operands(argc, argv)) != SUCCESS) { 594*0Sstevel@tonic-gate goto out; 595*0Sstevel@tonic-gate } 596*0Sstevel@tonic-gate 597*0Sstevel@tonic-gate prov = get_provider(argc, argv); 598*0Sstevel@tonic-gate 599*0Sstevel@tonic-gate if (mflag || vflag) { 600*0Sstevel@tonic-gate if (argc > 0) { 601*0Sstevel@tonic-gate rc = process_mech_operands(argc, argv, B_TRUE); 602*0Sstevel@tonic-gate if (rc == FAILURE) 603*0Sstevel@tonic-gate goto out; 604*0Sstevel@tonic-gate /* "-m" is implied when a mechanism list is given */ 605*0Sstevel@tonic-gate if (mecharglist != NULL || allflag) 606*0Sstevel@tonic-gate mflag = B_TRUE; 607*0Sstevel@tonic-gate } 608*0Sstevel@tonic-gate } 609*0Sstevel@tonic-gate 610*0Sstevel@tonic-gate if (prov == NULL) { 611*0Sstevel@tonic-gate if (mflag) { 612*0Sstevel@tonic-gate rc = list_mechlist_for_all(vflag); 613*0Sstevel@tonic-gate } else if (pflag) { 614*0Sstevel@tonic-gate rc = list_policy_for_all(); 615*0Sstevel@tonic-gate } else if (vflag) { 616*0Sstevel@tonic-gate rc = list_simple_for_all(vflag); 617*0Sstevel@tonic-gate } 618*0Sstevel@tonic-gate } else if (prov->cp_type == METASLOT) { 619*0Sstevel@tonic-gate if ((!mflag) && (!vflag) && (!pflag)) { 620*0Sstevel@tonic-gate /* no flag is specified, just list metaslot status */ 621*0Sstevel@tonic-gate rc = list_metaslot_info(mflag, vflag, mecharglist); 622*0Sstevel@tonic-gate } else if (mflag || vflag) { 623*0Sstevel@tonic-gate rc = list_metaslot_info(mflag, vflag, mecharglist); 624*0Sstevel@tonic-gate } else if (pflag) { 625*0Sstevel@tonic-gate rc = list_metaslot_policy(); 626*0Sstevel@tonic-gate } else { 627*0Sstevel@tonic-gate /* error message */ 628*0Sstevel@tonic-gate usage(); 629*0Sstevel@tonic-gate rc = ERROR_USAGE; 630*0Sstevel@tonic-gate } 631*0Sstevel@tonic-gate } else if (prov->cp_type == PROV_BADNAME) { 632*0Sstevel@tonic-gate usage(); 633*0Sstevel@tonic-gate rc = ERROR_USAGE; 634*0Sstevel@tonic-gate goto out; 635*0Sstevel@tonic-gate } else { /* do the listing for a provider only */ 636*0Sstevel@tonic-gate if (mflag || vflag) { 637*0Sstevel@tonic-gate if (vflag) 638*0Sstevel@tonic-gate (void) printf(gettext("Provider: %s\n"), 639*0Sstevel@tonic-gate prov->cp_name); 640*0Sstevel@tonic-gate switch (prov->cp_type) { 641*0Sstevel@tonic-gate case PROV_UEF_LIB: 642*0Sstevel@tonic-gate rc = list_mechlist_for_lib(prov->cp_name, 643*0Sstevel@tonic-gate mecharglist, NULL, B_FALSE, 644*0Sstevel@tonic-gate vflag, mflag); 645*0Sstevel@tonic-gate break; 646*0Sstevel@tonic-gate case PROV_KEF_SOFT: 647*0Sstevel@tonic-gate rc = list_mechlist_for_soft(prov->cp_name); 648*0Sstevel@tonic-gate break; 649*0Sstevel@tonic-gate case PROV_KEF_HARD: 650*0Sstevel@tonic-gate rc = list_mechlist_for_hard(prov->cp_name); 651*0Sstevel@tonic-gate break; 652*0Sstevel@tonic-gate default: /* should not come here */ 653*0Sstevel@tonic-gate rc = FAILURE; 654*0Sstevel@tonic-gate break; 655*0Sstevel@tonic-gate } 656*0Sstevel@tonic-gate } else if (pflag) { 657*0Sstevel@tonic-gate switch (prov->cp_type) { 658*0Sstevel@tonic-gate case PROV_UEF_LIB: 659*0Sstevel@tonic-gate rc = list_policy_for_lib(prov->cp_name); 660*0Sstevel@tonic-gate break; 661*0Sstevel@tonic-gate case PROV_KEF_SOFT: 662*0Sstevel@tonic-gate if (getzoneid() == GLOBAL_ZONEID) { 663*0Sstevel@tonic-gate rc = list_policy_for_soft( 664*0Sstevel@tonic-gate prov->cp_name); 665*0Sstevel@tonic-gate } else { 666*0Sstevel@tonic-gate /* 667*0Sstevel@tonic-gate * TRANSLATION_NOTE: 668*0Sstevel@tonic-gate * "global" is keyword and not to 669*0Sstevel@tonic-gate * be translated. 670*0Sstevel@tonic-gate */ 671*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 672*0Sstevel@tonic-gate "policy information for kernel " 673*0Sstevel@tonic-gate "providers is available " 674*0Sstevel@tonic-gate "in the %s zone only"), "global"); 675*0Sstevel@tonic-gate rc = FAILURE; 676*0Sstevel@tonic-gate } 677*0Sstevel@tonic-gate break; 678*0Sstevel@tonic-gate case PROV_KEF_HARD: 679*0Sstevel@tonic-gate if (getzoneid() == GLOBAL_ZONEID) { 680*0Sstevel@tonic-gate rc = list_policy_for_hard( 681*0Sstevel@tonic-gate prov->cp_name); 682*0Sstevel@tonic-gate } else { 683*0Sstevel@tonic-gate /* 684*0Sstevel@tonic-gate * TRANSLATION_NOTE: 685*0Sstevel@tonic-gate * "global" is keyword and not to 686*0Sstevel@tonic-gate * be translated. 687*0Sstevel@tonic-gate */ 688*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 689*0Sstevel@tonic-gate "policy information for kernel " 690*0Sstevel@tonic-gate "providers is available " 691*0Sstevel@tonic-gate "in the %s zone only"), "global"); 692*0Sstevel@tonic-gate rc = FAILURE; 693*0Sstevel@tonic-gate } 694*0Sstevel@tonic-gate 695*0Sstevel@tonic-gate break; 696*0Sstevel@tonic-gate default: /* should not come here */ 697*0Sstevel@tonic-gate rc = FAILURE; 698*0Sstevel@tonic-gate break; 699*0Sstevel@tonic-gate } 700*0Sstevel@tonic-gate } else { 701*0Sstevel@tonic-gate /* error message */ 702*0Sstevel@tonic-gate usage(); 703*0Sstevel@tonic-gate rc = ERROR_USAGE; 704*0Sstevel@tonic-gate } 705*0Sstevel@tonic-gate } 706*0Sstevel@tonic-gate 707*0Sstevel@tonic-gate out: 708*0Sstevel@tonic-gate if (prov != NULL) 709*0Sstevel@tonic-gate free(prov); 710*0Sstevel@tonic-gate 711*0Sstevel@tonic-gate if (mecharglist != NULL) 712*0Sstevel@tonic-gate free_mechlist(mecharglist); 713*0Sstevel@tonic-gate return (rc); 714*0Sstevel@tonic-gate } 715*0Sstevel@tonic-gate 716*0Sstevel@tonic-gate 717*0Sstevel@tonic-gate /* 718*0Sstevel@tonic-gate * The top level function for the disable subcommand. 719*0Sstevel@tonic-gate */ 720*0Sstevel@tonic-gate static int 721*0Sstevel@tonic-gate do_disable(int argc, char **argv) 722*0Sstevel@tonic-gate { 723*0Sstevel@tonic-gate cryptoadm_provider_t *prov = NULL; 724*0Sstevel@tonic-gate int rc = SUCCESS; 725*0Sstevel@tonic-gate boolean_t auto_key_migrate_flag = B_FALSE; 726*0Sstevel@tonic-gate 727*0Sstevel@tonic-gate if ((argc < 3) || (argc > 5)) { 728*0Sstevel@tonic-gate usage(); 729*0Sstevel@tonic-gate return (ERROR_USAGE); 730*0Sstevel@tonic-gate } 731*0Sstevel@tonic-gate 732*0Sstevel@tonic-gate prov = get_provider(argc, argv); 733*0Sstevel@tonic-gate if (prov == NULL) { 734*0Sstevel@tonic-gate usage(); 735*0Sstevel@tonic-gate return (ERROR_USAGE); 736*0Sstevel@tonic-gate } 737*0Sstevel@tonic-gate if (prov->cp_type == PROV_BADNAME) { 738*0Sstevel@tonic-gate return (FAILURE); 739*0Sstevel@tonic-gate } 740*0Sstevel@tonic-gate 741*0Sstevel@tonic-gate if ((rc = process_feature_operands(argc, argv)) != SUCCESS) { 742*0Sstevel@tonic-gate goto out; 743*0Sstevel@tonic-gate } 744*0Sstevel@tonic-gate 745*0Sstevel@tonic-gate /* 746*0Sstevel@tonic-gate * If allflag or rndflag has already been set there is no reason to 747*0Sstevel@tonic-gate * process mech= 748*0Sstevel@tonic-gate */ 749*0Sstevel@tonic-gate if (prov->cp_type == METASLOT) { 750*0Sstevel@tonic-gate if ((argc > 3) && 751*0Sstevel@tonic-gate (rc = process_metaslot_operands(argc, argv, 752*0Sstevel@tonic-gate NULL, NULL, NULL, &auto_key_migrate_flag)) != SUCCESS) { 753*0Sstevel@tonic-gate usage(); 754*0Sstevel@tonic-gate return (rc); 755*0Sstevel@tonic-gate } 756*0Sstevel@tonic-gate } else if (!allflag && !rndflag && 757*0Sstevel@tonic-gate (rc = process_mech_operands(argc, argv, B_FALSE)) != SUCCESS) { 758*0Sstevel@tonic-gate return (rc); 759*0Sstevel@tonic-gate } 760*0Sstevel@tonic-gate 761*0Sstevel@tonic-gate switch (prov->cp_type) { 762*0Sstevel@tonic-gate case METASLOT: 763*0Sstevel@tonic-gate rc = disable_metaslot(mecharglist, allflag, 764*0Sstevel@tonic-gate auto_key_migrate_flag); 765*0Sstevel@tonic-gate break; 766*0Sstevel@tonic-gate case PROV_UEF_LIB: 767*0Sstevel@tonic-gate rc = disable_uef_lib(prov->cp_name, rndflag, allflag, 768*0Sstevel@tonic-gate mecharglist); 769*0Sstevel@tonic-gate break; 770*0Sstevel@tonic-gate case PROV_KEF_SOFT: 771*0Sstevel@tonic-gate if (rndflag && !allflag) { 772*0Sstevel@tonic-gate if ((mecharglist = create_mech(RANDOM)) == NULL) { 773*0Sstevel@tonic-gate rc = FAILURE; 774*0Sstevel@tonic-gate break; 775*0Sstevel@tonic-gate } 776*0Sstevel@tonic-gate } 777*0Sstevel@tonic-gate if (getzoneid() == GLOBAL_ZONEID) { 778*0Sstevel@tonic-gate rc = disable_kef_software(prov->cp_name, rndflag, 779*0Sstevel@tonic-gate allflag, mecharglist); 780*0Sstevel@tonic-gate } else { 781*0Sstevel@tonic-gate /* 782*0Sstevel@tonic-gate * TRANSLATION_NOTE: 783*0Sstevel@tonic-gate * "disable" could be either a literal keyword 784*0Sstevel@tonic-gate * and hence not to be translated, or a verb and 785*0Sstevel@tonic-gate * translatable. A choice was made to view it as 786*0Sstevel@tonic-gate * a literal keyword. "global" is keyword and not 787*0Sstevel@tonic-gate * to be translated. 788*0Sstevel@tonic-gate */ 789*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("%1$s for kernel " 790*0Sstevel@tonic-gate "providers is supported in the %2$s zone only"), 791*0Sstevel@tonic-gate "disable", "global"); 792*0Sstevel@tonic-gate rc = FAILURE; 793*0Sstevel@tonic-gate } 794*0Sstevel@tonic-gate break; 795*0Sstevel@tonic-gate case PROV_KEF_HARD: 796*0Sstevel@tonic-gate if (rndflag && !allflag) { 797*0Sstevel@tonic-gate if ((mecharglist = create_mech(RANDOM)) == NULL) { 798*0Sstevel@tonic-gate rc = FAILURE; 799*0Sstevel@tonic-gate break; 800*0Sstevel@tonic-gate } 801*0Sstevel@tonic-gate } 802*0Sstevel@tonic-gate if (getzoneid() == GLOBAL_ZONEID) { 803*0Sstevel@tonic-gate rc = disable_kef_hardware(prov->cp_name, rndflag, 804*0Sstevel@tonic-gate allflag, mecharglist); 805*0Sstevel@tonic-gate } else { 806*0Sstevel@tonic-gate /* 807*0Sstevel@tonic-gate * TRANSLATION_NOTE: 808*0Sstevel@tonic-gate * "disable" could be either a literal keyword 809*0Sstevel@tonic-gate * and hence not to be translated, or a verb and 810*0Sstevel@tonic-gate * translatable. A choice was made to view it as 811*0Sstevel@tonic-gate * a literal keyword. "global" is keyword and not 812*0Sstevel@tonic-gate * to be translated. 813*0Sstevel@tonic-gate */ 814*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("%1$s for kernel " 815*0Sstevel@tonic-gate "providers is supported in the %2$s zone only"), 816*0Sstevel@tonic-gate "disable", "global"); 817*0Sstevel@tonic-gate rc = FAILURE; 818*0Sstevel@tonic-gate } 819*0Sstevel@tonic-gate break; 820*0Sstevel@tonic-gate default: /* should not come here */ 821*0Sstevel@tonic-gate rc = FAILURE; 822*0Sstevel@tonic-gate break; 823*0Sstevel@tonic-gate } 824*0Sstevel@tonic-gate 825*0Sstevel@tonic-gate out: 826*0Sstevel@tonic-gate free(prov); 827*0Sstevel@tonic-gate if (mecharglist != NULL) { 828*0Sstevel@tonic-gate free_mechlist(mecharglist); 829*0Sstevel@tonic-gate } 830*0Sstevel@tonic-gate return (rc); 831*0Sstevel@tonic-gate } 832*0Sstevel@tonic-gate 833*0Sstevel@tonic-gate 834*0Sstevel@tonic-gate /* 835*0Sstevel@tonic-gate * The top level function fo the enable subcommand. 836*0Sstevel@tonic-gate */ 837*0Sstevel@tonic-gate static int 838*0Sstevel@tonic-gate do_enable(int argc, char **argv) 839*0Sstevel@tonic-gate { 840*0Sstevel@tonic-gate cryptoadm_provider_t *prov = NULL; 841*0Sstevel@tonic-gate int rc = SUCCESS; 842*0Sstevel@tonic-gate char *alt_token = NULL, *alt_slot = NULL; 843*0Sstevel@tonic-gate boolean_t use_default = B_FALSE, auto_key_migrate_flag = B_FALSE; 844*0Sstevel@tonic-gate 845*0Sstevel@tonic-gate if ((argc < 3) || (argc > 6)) { 846*0Sstevel@tonic-gate usage(); 847*0Sstevel@tonic-gate return (ERROR_USAGE); 848*0Sstevel@tonic-gate } 849*0Sstevel@tonic-gate 850*0Sstevel@tonic-gate prov = get_provider(argc, argv); 851*0Sstevel@tonic-gate if (prov == NULL) { 852*0Sstevel@tonic-gate usage(); 853*0Sstevel@tonic-gate return (ERROR_USAGE); 854*0Sstevel@tonic-gate } 855*0Sstevel@tonic-gate if ((prov->cp_type != METASLOT) && (argc != 4)) { 856*0Sstevel@tonic-gate usage(); 857*0Sstevel@tonic-gate return (ERROR_USAGE); 858*0Sstevel@tonic-gate } 859*0Sstevel@tonic-gate if (prov->cp_type == PROV_BADNAME) { 860*0Sstevel@tonic-gate rc = FAILURE; 861*0Sstevel@tonic-gate goto out; 862*0Sstevel@tonic-gate } 863*0Sstevel@tonic-gate 864*0Sstevel@tonic-gate 865*0Sstevel@tonic-gate if (prov->cp_type == METASLOT) { 866*0Sstevel@tonic-gate if ((rc = process_metaslot_operands(argc, argv, &alt_token, 867*0Sstevel@tonic-gate &alt_slot, &use_default, &auto_key_migrate_flag)) 868*0Sstevel@tonic-gate != SUCCESS) { 869*0Sstevel@tonic-gate usage(); 870*0Sstevel@tonic-gate goto out; 871*0Sstevel@tonic-gate } 872*0Sstevel@tonic-gate if ((alt_slot || alt_token) && use_default) { 873*0Sstevel@tonic-gate usage(); 874*0Sstevel@tonic-gate rc = FAILURE; 875*0Sstevel@tonic-gate goto out; 876*0Sstevel@tonic-gate } 877*0Sstevel@tonic-gate } else { 878*0Sstevel@tonic-gate if ((rc = process_feature_operands(argc, argv)) != SUCCESS) { 879*0Sstevel@tonic-gate goto out; 880*0Sstevel@tonic-gate } 881*0Sstevel@tonic-gate 882*0Sstevel@tonic-gate /* 883*0Sstevel@tonic-gate * If allflag or rndflag has already been set there is 884*0Sstevel@tonic-gate * no reason to process mech= 885*0Sstevel@tonic-gate */ 886*0Sstevel@tonic-gate if (!allflag && !rndflag && 887*0Sstevel@tonic-gate (rc = process_mech_operands(argc, argv, B_FALSE)) 888*0Sstevel@tonic-gate != SUCCESS) { 889*0Sstevel@tonic-gate goto out; 890*0Sstevel@tonic-gate } 891*0Sstevel@tonic-gate } 892*0Sstevel@tonic-gate 893*0Sstevel@tonic-gate switch (prov->cp_type) { 894*0Sstevel@tonic-gate case METASLOT: 895*0Sstevel@tonic-gate rc = enable_metaslot(alt_token, alt_slot, use_default, 896*0Sstevel@tonic-gate mecharglist, allflag, auto_key_migrate_flag); 897*0Sstevel@tonic-gate break; 898*0Sstevel@tonic-gate case PROV_UEF_LIB: 899*0Sstevel@tonic-gate rc = enable_uef_lib(prov->cp_name, rndflag, allflag, 900*0Sstevel@tonic-gate mecharglist); 901*0Sstevel@tonic-gate break; 902*0Sstevel@tonic-gate case PROV_KEF_SOFT: 903*0Sstevel@tonic-gate case PROV_KEF_HARD: 904*0Sstevel@tonic-gate if (rndflag && !allflag) { 905*0Sstevel@tonic-gate if ((mecharglist = create_mech(RANDOM)) == NULL) { 906*0Sstevel@tonic-gate rc = FAILURE; 907*0Sstevel@tonic-gate break; 908*0Sstevel@tonic-gate } 909*0Sstevel@tonic-gate } 910*0Sstevel@tonic-gate if (getzoneid() == GLOBAL_ZONEID) { 911*0Sstevel@tonic-gate rc = enable_kef(prov->cp_name, rndflag, allflag, 912*0Sstevel@tonic-gate mecharglist); 913*0Sstevel@tonic-gate } else { 914*0Sstevel@tonic-gate /* 915*0Sstevel@tonic-gate * TRANSLATION_NOTE: 916*0Sstevel@tonic-gate * "enable" could be either a literal keyword 917*0Sstevel@tonic-gate * and hence not to be translated, or a verb and 918*0Sstevel@tonic-gate * translatable. A choice was made to view it as 919*0Sstevel@tonic-gate * a literal keyword. "global" is keyword and not 920*0Sstevel@tonic-gate * to be translated. 921*0Sstevel@tonic-gate */ 922*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("%1$s for kernel " 923*0Sstevel@tonic-gate "providers is supported in the %2$s zone only"), 924*0Sstevel@tonic-gate "enable", "global"); 925*0Sstevel@tonic-gate rc = FAILURE; 926*0Sstevel@tonic-gate } 927*0Sstevel@tonic-gate break; 928*0Sstevel@tonic-gate default: /* should not come here */ 929*0Sstevel@tonic-gate rc = FAILURE; 930*0Sstevel@tonic-gate break; 931*0Sstevel@tonic-gate } 932*0Sstevel@tonic-gate out: 933*0Sstevel@tonic-gate free(prov); 934*0Sstevel@tonic-gate if (mecharglist != NULL) { 935*0Sstevel@tonic-gate free_mechlist(mecharglist); 936*0Sstevel@tonic-gate } 937*0Sstevel@tonic-gate if (alt_token != NULL) { 938*0Sstevel@tonic-gate free(alt_token); 939*0Sstevel@tonic-gate } 940*0Sstevel@tonic-gate if (alt_slot != NULL) { 941*0Sstevel@tonic-gate free(alt_slot); 942*0Sstevel@tonic-gate } 943*0Sstevel@tonic-gate return (rc); 944*0Sstevel@tonic-gate } 945*0Sstevel@tonic-gate 946*0Sstevel@tonic-gate 947*0Sstevel@tonic-gate 948*0Sstevel@tonic-gate /* 949*0Sstevel@tonic-gate * The top level function fo the install subcommand. 950*0Sstevel@tonic-gate */ 951*0Sstevel@tonic-gate static int 952*0Sstevel@tonic-gate do_install(int argc, char **argv) 953*0Sstevel@tonic-gate { 954*0Sstevel@tonic-gate cryptoadm_provider_t *prov = NULL; 955*0Sstevel@tonic-gate int rc; 956*0Sstevel@tonic-gate 957*0Sstevel@tonic-gate if (argc < 3) { 958*0Sstevel@tonic-gate usage(); 959*0Sstevel@tonic-gate return (ERROR_USAGE); 960*0Sstevel@tonic-gate } 961*0Sstevel@tonic-gate 962*0Sstevel@tonic-gate prov = get_provider(argc, argv); 963*0Sstevel@tonic-gate if (prov == NULL || 964*0Sstevel@tonic-gate prov->cp_type == PROV_BADNAME || prov->cp_type == PROV_KEF_HARD) { 965*0Sstevel@tonic-gate /* 966*0Sstevel@tonic-gate * TRANSLATION_NOTE: 967*0Sstevel@tonic-gate * "install" could be either a literal keyword and hence 968*0Sstevel@tonic-gate * not to be translated, or a verb and translatable. A 969*0Sstevel@tonic-gate * choice was made to view it as a literal keyword. 970*0Sstevel@tonic-gate */ 971*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, 972*0Sstevel@tonic-gate gettext("bad provider name for %s."), "install"); 973*0Sstevel@tonic-gate rc = FAILURE; 974*0Sstevel@tonic-gate goto out; 975*0Sstevel@tonic-gate } 976*0Sstevel@tonic-gate 977*0Sstevel@tonic-gate if (prov->cp_type == PROV_UEF_LIB) { 978*0Sstevel@tonic-gate rc = install_uef_lib(prov->cp_name); 979*0Sstevel@tonic-gate goto out; 980*0Sstevel@tonic-gate } 981*0Sstevel@tonic-gate 982*0Sstevel@tonic-gate /* It is the PROV_KEF_SOFT type now */ 983*0Sstevel@tonic-gate 984*0Sstevel@tonic-gate /* check if there are mechanism operands */ 985*0Sstevel@tonic-gate if (argc < 4) { 986*0Sstevel@tonic-gate /* 987*0Sstevel@tonic-gate * TRANSLATION_NOTE: 988*0Sstevel@tonic-gate * "mechanism" could be either a literal keyword and hence 989*0Sstevel@tonic-gate * not to be translated, or a descriptive word and 990*0Sstevel@tonic-gate * translatable. A choice was made to view it as a literal 991*0Sstevel@tonic-gate * keyword. 992*0Sstevel@tonic-gate */ 993*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, 994*0Sstevel@tonic-gate gettext("need %s operands for installing a" 995*0Sstevel@tonic-gate " kernel software provider."), "mechanism"); 996*0Sstevel@tonic-gate rc = ERROR_USAGE; 997*0Sstevel@tonic-gate goto out; 998*0Sstevel@tonic-gate } 999*0Sstevel@tonic-gate 1000*0Sstevel@tonic-gate if ((rc = process_mech_operands(argc, argv, B_FALSE)) != SUCCESS) { 1001*0Sstevel@tonic-gate goto out; 1002*0Sstevel@tonic-gate } 1003*0Sstevel@tonic-gate 1004*0Sstevel@tonic-gate if (allflag == B_TRUE) { 1005*0Sstevel@tonic-gate /* 1006*0Sstevel@tonic-gate * TRANSLATION_NOTE: 1007*0Sstevel@tonic-gate * "all", "mechanism", and "install" are all keywords and 1008*0Sstevel@tonic-gate * not to be translated. 1009*0Sstevel@tonic-gate */ 1010*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, 1011*0Sstevel@tonic-gate gettext("can not use the %1$s keyword for %2$s " 1012*0Sstevel@tonic-gate "in the %3$s subcommand."), "all", "mechanism", "install"); 1013*0Sstevel@tonic-gate rc = ERROR_USAGE; 1014*0Sstevel@tonic-gate goto out; 1015*0Sstevel@tonic-gate } 1016*0Sstevel@tonic-gate 1017*0Sstevel@tonic-gate if (getzoneid() == GLOBAL_ZONEID) { 1018*0Sstevel@tonic-gate rc = install_kef(prov->cp_name, mecharglist); 1019*0Sstevel@tonic-gate } else { 1020*0Sstevel@tonic-gate /* 1021*0Sstevel@tonic-gate * TRANSLATION_NOTE: 1022*0Sstevel@tonic-gate * "install" could be either a literal keyword and hence 1023*0Sstevel@tonic-gate * not to be translated, or a verb and translatable. A 1024*0Sstevel@tonic-gate * choice was made to view it as a literal keyword. 1025*0Sstevel@tonic-gate * "global" is keyword and not to be translated. 1026*0Sstevel@tonic-gate */ 1027*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("%1$s for kernel providers " 1028*0Sstevel@tonic-gate "is supported in the %2$s zone only"), "install", "global"); 1029*0Sstevel@tonic-gate rc = FAILURE; 1030*0Sstevel@tonic-gate } 1031*0Sstevel@tonic-gate out: 1032*0Sstevel@tonic-gate free(prov); 1033*0Sstevel@tonic-gate return (rc); 1034*0Sstevel@tonic-gate } 1035*0Sstevel@tonic-gate 1036*0Sstevel@tonic-gate 1037*0Sstevel@tonic-gate 1038*0Sstevel@tonic-gate /* 1039*0Sstevel@tonic-gate * The top level function for the uninstall subcommand. 1040*0Sstevel@tonic-gate */ 1041*0Sstevel@tonic-gate static int 1042*0Sstevel@tonic-gate do_uninstall(int argc, char **argv) 1043*0Sstevel@tonic-gate { 1044*0Sstevel@tonic-gate cryptoadm_provider_t *prov = NULL; 1045*0Sstevel@tonic-gate int rc = SUCCESS; 1046*0Sstevel@tonic-gate 1047*0Sstevel@tonic-gate if (argc != 3) { 1048*0Sstevel@tonic-gate usage(); 1049*0Sstevel@tonic-gate return (ERROR_USAGE); 1050*0Sstevel@tonic-gate } 1051*0Sstevel@tonic-gate 1052*0Sstevel@tonic-gate prov = get_provider(argc, argv); 1053*0Sstevel@tonic-gate if (prov == NULL || 1054*0Sstevel@tonic-gate prov->cp_type == PROV_BADNAME || prov->cp_type == PROV_KEF_HARD) { 1055*0Sstevel@tonic-gate /* 1056*0Sstevel@tonic-gate * TRANSLATION_NOTE: 1057*0Sstevel@tonic-gate * "uninstall" could be either a literal keyword and hence 1058*0Sstevel@tonic-gate * not to be translated, or a verb and translatable. A 1059*0Sstevel@tonic-gate * choice was made to view it as a literal keyword. 1060*0Sstevel@tonic-gate */ 1061*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, 1062*0Sstevel@tonic-gate gettext("bad provider name for %s."), "uninstall"); 1063*0Sstevel@tonic-gate free(prov); 1064*0Sstevel@tonic-gate return (FAILURE); 1065*0Sstevel@tonic-gate } 1066*0Sstevel@tonic-gate 1067*0Sstevel@tonic-gate if (prov->cp_type == PROV_UEF_LIB) { 1068*0Sstevel@tonic-gate rc = uninstall_uef_lib(prov->cp_name); 1069*0Sstevel@tonic-gate } else if (prov->cp_type == PROV_KEF_SOFT) { 1070*0Sstevel@tonic-gate if (getzoneid() == GLOBAL_ZONEID) { 1071*0Sstevel@tonic-gate rc = uninstall_kef(prov->cp_name); 1072*0Sstevel@tonic-gate } else { 1073*0Sstevel@tonic-gate /* 1074*0Sstevel@tonic-gate * TRANSLATION_NOTE: 1075*0Sstevel@tonic-gate * "uninstall" could be either a literal keyword and 1076*0Sstevel@tonic-gate * hence not to be translated, or a verb and 1077*0Sstevel@tonic-gate * translatable. A choice was made to view it as a 1078*0Sstevel@tonic-gate * literal keyword. "global" is keyword and not to 1079*0Sstevel@tonic-gate * be translated. 1080*0Sstevel@tonic-gate */ 1081*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("%1$s for kernel " 1082*0Sstevel@tonic-gate "providers is supported in the %2$s zone only"), 1083*0Sstevel@tonic-gate "uninstall", "global"); 1084*0Sstevel@tonic-gate rc = FAILURE; 1085*0Sstevel@tonic-gate } 1086*0Sstevel@tonic-gate } 1087*0Sstevel@tonic-gate 1088*0Sstevel@tonic-gate free(prov); 1089*0Sstevel@tonic-gate return (rc); 1090*0Sstevel@tonic-gate } 1091*0Sstevel@tonic-gate 1092*0Sstevel@tonic-gate 1093*0Sstevel@tonic-gate /* 1094*0Sstevel@tonic-gate * The top level function for the unload subcommand. 1095*0Sstevel@tonic-gate */ 1096*0Sstevel@tonic-gate static int 1097*0Sstevel@tonic-gate do_unload(int argc, char **argv) 1098*0Sstevel@tonic-gate { 1099*0Sstevel@tonic-gate cryptoadm_provider_t *prov = NULL; 1100*0Sstevel@tonic-gate entry_t *pent; 1101*0Sstevel@tonic-gate boolean_t is_active; 1102*0Sstevel@tonic-gate int rc = SUCCESS; 1103*0Sstevel@tonic-gate 1104*0Sstevel@tonic-gate if (argc != 3) { 1105*0Sstevel@tonic-gate usage(); 1106*0Sstevel@tonic-gate return (ERROR_USAGE); 1107*0Sstevel@tonic-gate } 1108*0Sstevel@tonic-gate 1109*0Sstevel@tonic-gate /* check if it is a kernel software provider */ 1110*0Sstevel@tonic-gate prov = get_provider(argc, argv); 1111*0Sstevel@tonic-gate if (prov == NULL) { 1112*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, 1113*0Sstevel@tonic-gate gettext("unable to determine provider name.")); 1114*0Sstevel@tonic-gate goto out; 1115*0Sstevel@tonic-gate } 1116*0Sstevel@tonic-gate if (prov->cp_type != PROV_KEF_SOFT) { 1117*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, 1118*0Sstevel@tonic-gate gettext("%s is not a valid kernel software provider."), 1119*0Sstevel@tonic-gate prov->cp_name); 1120*0Sstevel@tonic-gate rc = FAILURE; 1121*0Sstevel@tonic-gate goto out; 1122*0Sstevel@tonic-gate } 1123*0Sstevel@tonic-gate 1124*0Sstevel@tonic-gate if (getzoneid() != GLOBAL_ZONEID) { 1125*0Sstevel@tonic-gate /* 1126*0Sstevel@tonic-gate * TRANSLATION_NOTE: 1127*0Sstevel@tonic-gate * "unload" could be either a literal keyword and hence 1128*0Sstevel@tonic-gate * not to be translated, or a verb and translatable. 1129*0Sstevel@tonic-gate * A choice was made to view it as a literal keyword. 1130*0Sstevel@tonic-gate * "global" is keyword and not to be translated. 1131*0Sstevel@tonic-gate */ 1132*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("%1$s for kernel providers " 1133*0Sstevel@tonic-gate "is supported in the %2$s zone only"), "unload", "global"); 1134*0Sstevel@tonic-gate rc = FAILURE; 1135*0Sstevel@tonic-gate goto out; 1136*0Sstevel@tonic-gate } 1137*0Sstevel@tonic-gate 1138*0Sstevel@tonic-gate /* Check if it is in the kcf.conf file first */ 1139*0Sstevel@tonic-gate if ((pent = getent_kef(prov->cp_name)) == NULL) { 1140*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, 1141*0Sstevel@tonic-gate gettext("provider %s does not exist."), prov->cp_name); 1142*0Sstevel@tonic-gate rc = FAILURE; 1143*0Sstevel@tonic-gate goto out; 1144*0Sstevel@tonic-gate } 1145*0Sstevel@tonic-gate free_entry(pent); 1146*0Sstevel@tonic-gate 1147*0Sstevel@tonic-gate /* If it is unloaded already, return */ 1148*0Sstevel@tonic-gate if (check_active_for_soft(prov->cp_name, &is_active) == FAILURE) { 1149*0Sstevel@tonic-gate cryptodebug("internal error"); 1150*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, 1151*0Sstevel@tonic-gate gettext("failed to unload %s."), prov->cp_name); 1152*0Sstevel@tonic-gate rc = FAILURE; 1153*0Sstevel@tonic-gate goto out; 1154*0Sstevel@tonic-gate } 1155*0Sstevel@tonic-gate 1156*0Sstevel@tonic-gate if (is_active == B_FALSE) { /* unloaded already */ 1157*0Sstevel@tonic-gate rc = SUCCESS; 1158*0Sstevel@tonic-gate goto out; 1159*0Sstevel@tonic-gate } else if (unload_kef_soft(prov->cp_name) == FAILURE) { 1160*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, 1161*0Sstevel@tonic-gate gettext("failed to unload %s."), prov->cp_name); 1162*0Sstevel@tonic-gate rc = FAILURE; 1163*0Sstevel@tonic-gate } else { 1164*0Sstevel@tonic-gate rc = SUCCESS; 1165*0Sstevel@tonic-gate } 1166*0Sstevel@tonic-gate out: 1167*0Sstevel@tonic-gate free(prov); 1168*0Sstevel@tonic-gate return (rc); 1169*0Sstevel@tonic-gate } 1170*0Sstevel@tonic-gate 1171*0Sstevel@tonic-gate 1172*0Sstevel@tonic-gate 1173*0Sstevel@tonic-gate /* 1174*0Sstevel@tonic-gate * The top level function for the refresh subcommand. 1175*0Sstevel@tonic-gate */ 1176*0Sstevel@tonic-gate static int 1177*0Sstevel@tonic-gate do_refresh(int argc) 1178*0Sstevel@tonic-gate { 1179*0Sstevel@tonic-gate if (argc != 2) { 1180*0Sstevel@tonic-gate usage(); 1181*0Sstevel@tonic-gate return (ERROR_USAGE); 1182*0Sstevel@tonic-gate } 1183*0Sstevel@tonic-gate 1184*0Sstevel@tonic-gate /* 1185*0Sstevel@tonic-gate * Note: in non-global zone, this must silently return SUCCESS 1186*0Sstevel@tonic-gate * due to integration with SMF, for "svcadm refresh cryptosvc" 1187*0Sstevel@tonic-gate */ 1188*0Sstevel@tonic-gate if (getzoneid() != GLOBAL_ZONEID) 1189*0Sstevel@tonic-gate return (SUCCESS); 1190*0Sstevel@tonic-gate 1191*0Sstevel@tonic-gate return (refresh()); 1192*0Sstevel@tonic-gate } 1193*0Sstevel@tonic-gate 1194*0Sstevel@tonic-gate 1195*0Sstevel@tonic-gate /* 1196*0Sstevel@tonic-gate * The top level function for the start subcommand. 1197*0Sstevel@tonic-gate */ 1198*0Sstevel@tonic-gate static int 1199*0Sstevel@tonic-gate do_start(int argc) 1200*0Sstevel@tonic-gate { 1201*0Sstevel@tonic-gate int ret; 1202*0Sstevel@tonic-gate 1203*0Sstevel@tonic-gate if (argc != 2) { 1204*0Sstevel@tonic-gate usage(); 1205*0Sstevel@tonic-gate return (ERROR_USAGE); 1206*0Sstevel@tonic-gate } 1207*0Sstevel@tonic-gate 1208*0Sstevel@tonic-gate ret = do_refresh(argc); 1209*0Sstevel@tonic-gate if (ret != SUCCESS) 1210*0Sstevel@tonic-gate return (ret); 1211*0Sstevel@tonic-gate 1212*0Sstevel@tonic-gate return (start_daemon()); 1213*0Sstevel@tonic-gate } 1214*0Sstevel@tonic-gate 1215*0Sstevel@tonic-gate /* 1216*0Sstevel@tonic-gate * The top level function for the stop subcommand. 1217*0Sstevel@tonic-gate */ 1218*0Sstevel@tonic-gate static int 1219*0Sstevel@tonic-gate do_stop(int argc) 1220*0Sstevel@tonic-gate { 1221*0Sstevel@tonic-gate if (argc != 2) { 1222*0Sstevel@tonic-gate usage(); 1223*0Sstevel@tonic-gate return (ERROR_USAGE); 1224*0Sstevel@tonic-gate } 1225*0Sstevel@tonic-gate 1226*0Sstevel@tonic-gate return (stop_daemon()); 1227*0Sstevel@tonic-gate } 1228*0Sstevel@tonic-gate 1229*0Sstevel@tonic-gate 1230*0Sstevel@tonic-gate 1231*0Sstevel@tonic-gate /* 1232*0Sstevel@tonic-gate * List all the providers. 1233*0Sstevel@tonic-gate */ 1234*0Sstevel@tonic-gate static int 1235*0Sstevel@tonic-gate list_simple_for_all(boolean_t verbose) 1236*0Sstevel@tonic-gate { 1237*0Sstevel@tonic-gate uentrylist_t *pliblist; 1238*0Sstevel@tonic-gate uentrylist_t *plibptr; 1239*0Sstevel@tonic-gate entrylist_t *pdevlist_conf; 1240*0Sstevel@tonic-gate entrylist_t *psoftlist_conf; 1241*0Sstevel@tonic-gate entrylist_t *pdevlist_zone; 1242*0Sstevel@tonic-gate entrylist_t *psoftlist_zone; 1243*0Sstevel@tonic-gate entrylist_t *ptr; 1244*0Sstevel@tonic-gate crypto_get_dev_list_t *pdevlist_kernel = NULL; 1245*0Sstevel@tonic-gate boolean_t is_active; 1246*0Sstevel@tonic-gate int ru = SUCCESS; 1247*0Sstevel@tonic-gate int rs = SUCCESS; 1248*0Sstevel@tonic-gate int rd = SUCCESS; 1249*0Sstevel@tonic-gate int i; 1250*0Sstevel@tonic-gate 1251*0Sstevel@tonic-gate /* get user-level providers */ 1252*0Sstevel@tonic-gate (void) printf(gettext("\nUser-level providers:\n")); 1253*0Sstevel@tonic-gate if (get_pkcs11conf_info(&pliblist) != SUCCESS) { 1254*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 1255*0Sstevel@tonic-gate "failed to retrieve the list of user-level providers.")); 1256*0Sstevel@tonic-gate ru = FAILURE; 1257*0Sstevel@tonic-gate } 1258*0Sstevel@tonic-gate plibptr = pliblist; 1259*0Sstevel@tonic-gate while (plibptr != NULL) { 1260*0Sstevel@tonic-gate if (strcmp(plibptr->puent->name, METASLOT_KEYWORD) != 0) { 1261*0Sstevel@tonic-gate (void) printf(gettext("Provider: %s\n"), 1262*0Sstevel@tonic-gate plibptr->puent->name); 1263*0Sstevel@tonic-gate if (verbose) { 1264*0Sstevel@tonic-gate (void) list_mechlist_for_lib( 1265*0Sstevel@tonic-gate plibptr->puent->name, mecharglist, NULL, 1266*0Sstevel@tonic-gate B_FALSE, verbose, B_FALSE); 1267*0Sstevel@tonic-gate (void) printf("\n"); 1268*0Sstevel@tonic-gate } 1269*0Sstevel@tonic-gate } 1270*0Sstevel@tonic-gate plibptr = plibptr->next; 1271*0Sstevel@tonic-gate } 1272*0Sstevel@tonic-gate free_uentrylist(pliblist); 1273*0Sstevel@tonic-gate 1274*0Sstevel@tonic-gate /* get kernel software providers */ 1275*0Sstevel@tonic-gate (void) printf(gettext("\nKernel software providers:\n")); 1276*0Sstevel@tonic-gate 1277*0Sstevel@tonic-gate if (getzoneid() == GLOBAL_ZONEID) { 1278*0Sstevel@tonic-gate /* use kcf.conf for kernel software providers in global zone */ 1279*0Sstevel@tonic-gate pdevlist_conf = NULL; 1280*0Sstevel@tonic-gate psoftlist_conf = NULL; 1281*0Sstevel@tonic-gate 1282*0Sstevel@tonic-gate if (get_kcfconf_info(&pdevlist_conf, &psoftlist_conf) != 1283*0Sstevel@tonic-gate SUCCESS) { 1284*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, 1285*0Sstevel@tonic-gate gettext("failed to retrieve the " 1286*0Sstevel@tonic-gate "list of kernel software providers.\n")); 1287*0Sstevel@tonic-gate rs = FAILURE; 1288*0Sstevel@tonic-gate } 1289*0Sstevel@tonic-gate 1290*0Sstevel@tonic-gate ptr = psoftlist_conf; 1291*0Sstevel@tonic-gate while (ptr != NULL) { 1292*0Sstevel@tonic-gate if (check_active_for_soft(ptr->pent->name, &is_active) 1293*0Sstevel@tonic-gate == FAILURE) { 1294*0Sstevel@tonic-gate rs = FAILURE; 1295*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("failed to " 1296*0Sstevel@tonic-gate "get the state of a kernel software " 1297*0Sstevel@tonic-gate "providers.\n")); 1298*0Sstevel@tonic-gate break; 1299*0Sstevel@tonic-gate } 1300*0Sstevel@tonic-gate 1301*0Sstevel@tonic-gate (void) printf("\t%s", ptr->pent->name); 1302*0Sstevel@tonic-gate if (is_active == B_FALSE) { 1303*0Sstevel@tonic-gate (void) printf(gettext(" (inactive)\n")); 1304*0Sstevel@tonic-gate } else { 1305*0Sstevel@tonic-gate (void) printf("\n"); 1306*0Sstevel@tonic-gate } 1307*0Sstevel@tonic-gate ptr = ptr->next; 1308*0Sstevel@tonic-gate } 1309*0Sstevel@tonic-gate 1310*0Sstevel@tonic-gate free_entrylist(pdevlist_conf); 1311*0Sstevel@tonic-gate free_entrylist(psoftlist_conf); 1312*0Sstevel@tonic-gate } else { 1313*0Sstevel@tonic-gate /* kcf.conf not there in non-global zone, use /dev/cryptoadm */ 1314*0Sstevel@tonic-gate pdevlist_zone = NULL; 1315*0Sstevel@tonic-gate psoftlist_zone = NULL; 1316*0Sstevel@tonic-gate 1317*0Sstevel@tonic-gate if (get_admindev_info(&pdevlist_zone, &psoftlist_zone) != 1318*0Sstevel@tonic-gate SUCCESS) { 1319*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, 1320*0Sstevel@tonic-gate gettext("failed to retrieve the " 1321*0Sstevel@tonic-gate "list of kernel software providers.\n")); 1322*0Sstevel@tonic-gate rs = FAILURE; 1323*0Sstevel@tonic-gate } 1324*0Sstevel@tonic-gate 1325*0Sstevel@tonic-gate ptr = psoftlist_zone; 1326*0Sstevel@tonic-gate while (ptr != NULL) { 1327*0Sstevel@tonic-gate (void) printf("\t%s\n", ptr->pent->name); 1328*0Sstevel@tonic-gate ptr = ptr->next; 1329*0Sstevel@tonic-gate } 1330*0Sstevel@tonic-gate 1331*0Sstevel@tonic-gate free_entrylist(pdevlist_zone); 1332*0Sstevel@tonic-gate free_entrylist(psoftlist_zone); 1333*0Sstevel@tonic-gate } 1334*0Sstevel@tonic-gate 1335*0Sstevel@tonic-gate /* get kernel hardware providers */ 1336*0Sstevel@tonic-gate (void) printf(gettext("\nKernel hardware providers:\n")); 1337*0Sstevel@tonic-gate if (get_dev_list(&pdevlist_kernel) == FAILURE) { 1338*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("failed to retrieve " 1339*0Sstevel@tonic-gate "the list of kernel hardware providers.\n")); 1340*0Sstevel@tonic-gate rd = FAILURE; 1341*0Sstevel@tonic-gate } else { 1342*0Sstevel@tonic-gate for (i = 0; i < pdevlist_kernel->dl_dev_count; i++) { 1343*0Sstevel@tonic-gate (void) printf("\t%s/%d\n", 1344*0Sstevel@tonic-gate pdevlist_kernel->dl_devs[i].le_dev_name, 1345*0Sstevel@tonic-gate pdevlist_kernel->dl_devs[i].le_dev_instance); 1346*0Sstevel@tonic-gate } 1347*0Sstevel@tonic-gate } 1348*0Sstevel@tonic-gate free(pdevlist_kernel); 1349*0Sstevel@tonic-gate 1350*0Sstevel@tonic-gate if (ru == FAILURE || rs == FAILURE || rd == FAILURE) { 1351*0Sstevel@tonic-gate return (FAILURE); 1352*0Sstevel@tonic-gate } else { 1353*0Sstevel@tonic-gate return (SUCCESS); 1354*0Sstevel@tonic-gate } 1355*0Sstevel@tonic-gate } 1356*0Sstevel@tonic-gate 1357*0Sstevel@tonic-gate 1358*0Sstevel@tonic-gate 1359*0Sstevel@tonic-gate /* 1360*0Sstevel@tonic-gate * List all the providers. And for each provider, list the mechanism list. 1361*0Sstevel@tonic-gate */ 1362*0Sstevel@tonic-gate static int 1363*0Sstevel@tonic-gate list_mechlist_for_all(boolean_t verbose) 1364*0Sstevel@tonic-gate { 1365*0Sstevel@tonic-gate crypto_get_dev_list_t *pdevlist_kernel; 1366*0Sstevel@tonic-gate uentrylist_t *pliblist; 1367*0Sstevel@tonic-gate uentrylist_t *plibptr; 1368*0Sstevel@tonic-gate entrylist_t *pdevlist_conf; 1369*0Sstevel@tonic-gate entrylist_t *psoftlist_conf; 1370*0Sstevel@tonic-gate entrylist_t *pdevlist_zone; 1371*0Sstevel@tonic-gate entrylist_t *psoftlist_zone; 1372*0Sstevel@tonic-gate entrylist_t *ptr; 1373*0Sstevel@tonic-gate mechlist_t *pmechlist; 1374*0Sstevel@tonic-gate boolean_t is_active; 1375*0Sstevel@tonic-gate char provname[MAXNAMELEN]; 1376*0Sstevel@tonic-gate char devname[MAXNAMELEN]; 1377*0Sstevel@tonic-gate int inst_num; 1378*0Sstevel@tonic-gate int count; 1379*0Sstevel@tonic-gate int i; 1380*0Sstevel@tonic-gate int rv; 1381*0Sstevel@tonic-gate int rc = SUCCESS; 1382*0Sstevel@tonic-gate 1383*0Sstevel@tonic-gate /* get user-level providers */ 1384*0Sstevel@tonic-gate (void) printf(gettext("\nUser-level providers:\n")); 1385*0Sstevel@tonic-gate /* 1386*0Sstevel@tonic-gate * TRANSLATION_NOTE: 1387*0Sstevel@tonic-gate * Strictly for appearance's sake, this line should be as long as 1388*0Sstevel@tonic-gate * the length of the translated text above. 1389*0Sstevel@tonic-gate */ 1390*0Sstevel@tonic-gate (void) printf(gettext("=====================\n")); 1391*0Sstevel@tonic-gate if (get_pkcs11conf_info(&pliblist) != SUCCESS) { 1392*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("failed to retrieve " 1393*0Sstevel@tonic-gate "the list of user-level providers.\n")); 1394*0Sstevel@tonic-gate rc = FAILURE; 1395*0Sstevel@tonic-gate } 1396*0Sstevel@tonic-gate 1397*0Sstevel@tonic-gate plibptr = pliblist; 1398*0Sstevel@tonic-gate while (plibptr != NULL) { 1399*0Sstevel@tonic-gate /* skip metaslot entry */ 1400*0Sstevel@tonic-gate if (strcmp(plibptr->puent->name, METASLOT_KEYWORD) != 0) { 1401*0Sstevel@tonic-gate (void) printf(gettext("\nProvider: %s\n"), 1402*0Sstevel@tonic-gate plibptr->puent->name); 1403*0Sstevel@tonic-gate rv = list_mechlist_for_lib(plibptr->puent->name, 1404*0Sstevel@tonic-gate mecharglist, NULL, B_FALSE, verbose, B_TRUE); 1405*0Sstevel@tonic-gate if (rv == FAILURE) { 1406*0Sstevel@tonic-gate rc = FAILURE; 1407*0Sstevel@tonic-gate } 1408*0Sstevel@tonic-gate } 1409*0Sstevel@tonic-gate plibptr = plibptr->next; 1410*0Sstevel@tonic-gate } 1411*0Sstevel@tonic-gate free_uentrylist(pliblist); 1412*0Sstevel@tonic-gate 1413*0Sstevel@tonic-gate /* get kernel software providers */ 1414*0Sstevel@tonic-gate (void) printf(gettext("\nKernel software providers:\n")); 1415*0Sstevel@tonic-gate /* 1416*0Sstevel@tonic-gate * TRANSLATION_NOTE: 1417*0Sstevel@tonic-gate * Strictly for appearance's sake, this line should be as long as 1418*0Sstevel@tonic-gate * the length of the translated text above. 1419*0Sstevel@tonic-gate */ 1420*0Sstevel@tonic-gate (void) printf(gettext("==========================\n")); 1421*0Sstevel@tonic-gate if (getzoneid() == GLOBAL_ZONEID) { 1422*0Sstevel@tonic-gate /* use kcf.conf for kernel software providers in global zone */ 1423*0Sstevel@tonic-gate pdevlist_conf = NULL; 1424*0Sstevel@tonic-gate psoftlist_conf = NULL; 1425*0Sstevel@tonic-gate 1426*0Sstevel@tonic-gate if (get_kcfconf_info(&pdevlist_conf, &psoftlist_conf) != 1427*0Sstevel@tonic-gate SUCCESS) { 1428*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("failed to retrieve " 1429*0Sstevel@tonic-gate "the list of kernel software providers.\n")); 1430*0Sstevel@tonic-gate rc = FAILURE; 1431*0Sstevel@tonic-gate } 1432*0Sstevel@tonic-gate 1433*0Sstevel@tonic-gate ptr = psoftlist_conf; 1434*0Sstevel@tonic-gate while (ptr != NULL) { 1435*0Sstevel@tonic-gate if (check_active_for_soft(ptr->pent->name, &is_active) 1436*0Sstevel@tonic-gate == SUCCESS) { 1437*0Sstevel@tonic-gate if (is_active) { 1438*0Sstevel@tonic-gate rv = list_mechlist_for_soft( 1439*0Sstevel@tonic-gate ptr->pent->name); 1440*0Sstevel@tonic-gate if (rv == FAILURE) { 1441*0Sstevel@tonic-gate rc = FAILURE; 1442*0Sstevel@tonic-gate } 1443*0Sstevel@tonic-gate } else { 1444*0Sstevel@tonic-gate (void) printf(gettext( 1445*0Sstevel@tonic-gate "%s: (inactive)\n"), 1446*0Sstevel@tonic-gate ptr->pent->name); 1447*0Sstevel@tonic-gate } 1448*0Sstevel@tonic-gate } else { 1449*0Sstevel@tonic-gate /* should not happen */ 1450*0Sstevel@tonic-gate (void) printf(gettext( 1451*0Sstevel@tonic-gate "%s: failed to get the mechanism list.\n"), 1452*0Sstevel@tonic-gate ptr->pent->name); 1453*0Sstevel@tonic-gate rc = FAILURE; 1454*0Sstevel@tonic-gate } 1455*0Sstevel@tonic-gate ptr = ptr->next; 1456*0Sstevel@tonic-gate } 1457*0Sstevel@tonic-gate 1458*0Sstevel@tonic-gate free_entrylist(pdevlist_conf); 1459*0Sstevel@tonic-gate free_entrylist(psoftlist_conf); 1460*0Sstevel@tonic-gate } else { 1461*0Sstevel@tonic-gate /* kcf.conf not there in non-global zone, use /dev/cryptoadm */ 1462*0Sstevel@tonic-gate pdevlist_zone = NULL; 1463*0Sstevel@tonic-gate psoftlist_zone = NULL; 1464*0Sstevel@tonic-gate 1465*0Sstevel@tonic-gate if (get_admindev_info(&pdevlist_zone, &psoftlist_zone) != 1466*0Sstevel@tonic-gate SUCCESS) { 1467*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("failed to retrieve " 1468*0Sstevel@tonic-gate "the list of kernel software providers.\n")); 1469*0Sstevel@tonic-gate rc = FAILURE; 1470*0Sstevel@tonic-gate } 1471*0Sstevel@tonic-gate 1472*0Sstevel@tonic-gate ptr = psoftlist_zone; 1473*0Sstevel@tonic-gate while (ptr != NULL) { 1474*0Sstevel@tonic-gate rv = list_mechlist_for_soft(ptr->pent->name); 1475*0Sstevel@tonic-gate if (rv == FAILURE) { 1476*0Sstevel@tonic-gate (void) printf(gettext( 1477*0Sstevel@tonic-gate "%s: failed to get the mechanism list.\n"), 1478*0Sstevel@tonic-gate ptr->pent->name); 1479*0Sstevel@tonic-gate rc = FAILURE; 1480*0Sstevel@tonic-gate } 1481*0Sstevel@tonic-gate ptr = ptr->next; 1482*0Sstevel@tonic-gate } 1483*0Sstevel@tonic-gate 1484*0Sstevel@tonic-gate free_entrylist(pdevlist_zone); 1485*0Sstevel@tonic-gate free_entrylist(psoftlist_zone); 1486*0Sstevel@tonic-gate } 1487*0Sstevel@tonic-gate 1488*0Sstevel@tonic-gate /* Get kernel hardware providers and their mechanism lists */ 1489*0Sstevel@tonic-gate (void) printf(gettext("\nKernel hardware providers:\n")); 1490*0Sstevel@tonic-gate /* 1491*0Sstevel@tonic-gate * TRANSLATION_NOTE: 1492*0Sstevel@tonic-gate * Strictly for appearance's sake, this line should be as long as 1493*0Sstevel@tonic-gate * the length of the translated text above. 1494*0Sstevel@tonic-gate */ 1495*0Sstevel@tonic-gate (void) printf(gettext("==========================\n")); 1496*0Sstevel@tonic-gate if (get_dev_list(&pdevlist_kernel) != SUCCESS) { 1497*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("failed to retrieve " 1498*0Sstevel@tonic-gate "the list of hardware providers.\n")); 1499*0Sstevel@tonic-gate return (FAILURE); 1500*0Sstevel@tonic-gate } 1501*0Sstevel@tonic-gate 1502*0Sstevel@tonic-gate for (i = 0; i < pdevlist_kernel->dl_dev_count; i++) { 1503*0Sstevel@tonic-gate (void) strlcpy(devname, 1504*0Sstevel@tonic-gate pdevlist_kernel->dl_devs[i].le_dev_name, MAXNAMELEN); 1505*0Sstevel@tonic-gate inst_num = pdevlist_kernel->dl_devs[i].le_dev_instance; 1506*0Sstevel@tonic-gate count = pdevlist_kernel->dl_devs[i].le_mechanism_count; 1507*0Sstevel@tonic-gate (void) snprintf(provname, sizeof (provname), "%s/%d", devname, 1508*0Sstevel@tonic-gate inst_num); 1509*0Sstevel@tonic-gate if (get_dev_info(devname, inst_num, count, &pmechlist) == 1510*0Sstevel@tonic-gate SUCCESS) { 1511*0Sstevel@tonic-gate (void) filter_mechlist(&pmechlist, RANDOM); 1512*0Sstevel@tonic-gate print_mechlist(provname, pmechlist); 1513*0Sstevel@tonic-gate free_mechlist(pmechlist); 1514*0Sstevel@tonic-gate } else { 1515*0Sstevel@tonic-gate (void) printf(gettext("%s: failed to get the mechanism" 1516*0Sstevel@tonic-gate " list.\n"), provname); 1517*0Sstevel@tonic-gate rc = FAILURE; 1518*0Sstevel@tonic-gate } 1519*0Sstevel@tonic-gate } 1520*0Sstevel@tonic-gate free(pdevlist_kernel); 1521*0Sstevel@tonic-gate return (rc); 1522*0Sstevel@tonic-gate } 1523*0Sstevel@tonic-gate 1524*0Sstevel@tonic-gate 1525*0Sstevel@tonic-gate /* 1526*0Sstevel@tonic-gate * List all the providers. And for each provider, list the policy information. 1527*0Sstevel@tonic-gate */ 1528*0Sstevel@tonic-gate static int 1529*0Sstevel@tonic-gate list_policy_for_all(void) 1530*0Sstevel@tonic-gate { 1531*0Sstevel@tonic-gate crypto_get_dev_list_t *pdevlist_kernel; 1532*0Sstevel@tonic-gate uentrylist_t *pliblist; 1533*0Sstevel@tonic-gate uentrylist_t *plibptr; 1534*0Sstevel@tonic-gate entrylist_t *pdevlist_conf; 1535*0Sstevel@tonic-gate entrylist_t *psoftlist_conf; 1536*0Sstevel@tonic-gate entrylist_t *ptr; 1537*0Sstevel@tonic-gate entrylist_t *phead; 1538*0Sstevel@tonic-gate boolean_t found; 1539*0Sstevel@tonic-gate char provname[MAXNAMELEN]; 1540*0Sstevel@tonic-gate int i; 1541*0Sstevel@tonic-gate int rc = SUCCESS; 1542*0Sstevel@tonic-gate 1543*0Sstevel@tonic-gate /* Get user-level providers */ 1544*0Sstevel@tonic-gate (void) printf(gettext("\nUser-level providers:\n")); 1545*0Sstevel@tonic-gate /* 1546*0Sstevel@tonic-gate * TRANSLATION_NOTE: 1547*0Sstevel@tonic-gate * Strictly for appearance's sake, this line should be as long as 1548*0Sstevel@tonic-gate * the length of the translated text above. 1549*0Sstevel@tonic-gate */ 1550*0Sstevel@tonic-gate (void) printf(gettext("=====================\n")); 1551*0Sstevel@tonic-gate if (get_pkcs11conf_info(&pliblist) == FAILURE) { 1552*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("failed to retrieve " 1553*0Sstevel@tonic-gate "the list of user-level providers.\n")); 1554*0Sstevel@tonic-gate } else { 1555*0Sstevel@tonic-gate plibptr = pliblist; 1556*0Sstevel@tonic-gate while (plibptr != NULL) { 1557*0Sstevel@tonic-gate /* skip metaslot entry */ 1558*0Sstevel@tonic-gate if (strcmp(plibptr->puent->name, 1559*0Sstevel@tonic-gate METASLOT_KEYWORD) != 0) { 1560*0Sstevel@tonic-gate if (print_uef_policy(plibptr->puent) 1561*0Sstevel@tonic-gate == FAILURE) { 1562*0Sstevel@tonic-gate rc = FAILURE; 1563*0Sstevel@tonic-gate } 1564*0Sstevel@tonic-gate } 1565*0Sstevel@tonic-gate plibptr = plibptr->next; 1566*0Sstevel@tonic-gate } 1567*0Sstevel@tonic-gate free_uentrylist(pliblist); 1568*0Sstevel@tonic-gate } 1569*0Sstevel@tonic-gate 1570*0Sstevel@tonic-gate /* kernel software providers */ 1571*0Sstevel@tonic-gate (void) printf(gettext("\nKernel software providers:\n")); 1572*0Sstevel@tonic-gate /* 1573*0Sstevel@tonic-gate * TRANSLATION_NOTE: 1574*0Sstevel@tonic-gate * Strictly for appearance's sake, this line should be as long as 1575*0Sstevel@tonic-gate * the length of the translated text above. 1576*0Sstevel@tonic-gate */ 1577*0Sstevel@tonic-gate (void) printf(gettext("==========================\n")); 1578*0Sstevel@tonic-gate 1579*0Sstevel@tonic-gate /* Get all entries from the kcf.conf file */ 1580*0Sstevel@tonic-gate pdevlist_conf = NULL; 1581*0Sstevel@tonic-gate if (getzoneid() == GLOBAL_ZONEID) { 1582*0Sstevel@tonic-gate /* use kcf.conf for kernel software providers in global zone */ 1583*0Sstevel@tonic-gate psoftlist_conf = NULL; 1584*0Sstevel@tonic-gate 1585*0Sstevel@tonic-gate if (get_kcfconf_info(&pdevlist_conf, &psoftlist_conf) == 1586*0Sstevel@tonic-gate FAILURE) { 1587*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 1588*0Sstevel@tonic-gate "failed to retrieve the list of kernel " 1589*0Sstevel@tonic-gate "providers.\n")); 1590*0Sstevel@tonic-gate return (FAILURE); 1591*0Sstevel@tonic-gate } 1592*0Sstevel@tonic-gate 1593*0Sstevel@tonic-gate ptr = psoftlist_conf; 1594*0Sstevel@tonic-gate while (ptr != NULL) { 1595*0Sstevel@tonic-gate (void) list_policy_for_soft(ptr->pent->name); 1596*0Sstevel@tonic-gate ptr = ptr->next; 1597*0Sstevel@tonic-gate } 1598*0Sstevel@tonic-gate 1599*0Sstevel@tonic-gate free_entrylist(psoftlist_conf); 1600*0Sstevel@tonic-gate } else { 1601*0Sstevel@tonic-gate /* kcf.conf not there in non-global zone, no policy info */ 1602*0Sstevel@tonic-gate 1603*0Sstevel@tonic-gate /* 1604*0Sstevel@tonic-gate * TRANSLATION_NOTE: 1605*0Sstevel@tonic-gate * "global" is keyword and not to be translated. 1606*0Sstevel@tonic-gate */ 1607*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 1608*0Sstevel@tonic-gate "policy information for kernel software providers is " 1609*0Sstevel@tonic-gate "available in the %s zone only"), "global"); 1610*0Sstevel@tonic-gate } 1611*0Sstevel@tonic-gate 1612*0Sstevel@tonic-gate /* Kernel hardware providers */ 1613*0Sstevel@tonic-gate (void) printf(gettext("\nKernel hardware providers:\n")); 1614*0Sstevel@tonic-gate /* 1615*0Sstevel@tonic-gate * TRANSLATION_NOTE: 1616*0Sstevel@tonic-gate * Strictly for appearance's sake, this line should be as long as 1617*0Sstevel@tonic-gate * the length of the translated text above. 1618*0Sstevel@tonic-gate */ 1619*0Sstevel@tonic-gate (void) printf(gettext("==========================\n")); 1620*0Sstevel@tonic-gate 1621*0Sstevel@tonic-gate if (getzoneid() != GLOBAL_ZONEID) { 1622*0Sstevel@tonic-gate /* 1623*0Sstevel@tonic-gate * TRANSLATION_NOTE: 1624*0Sstevel@tonic-gate * "global" is keyword and not to be translated. 1625*0Sstevel@tonic-gate */ 1626*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 1627*0Sstevel@tonic-gate "policy information for kernel hardware providers is " 1628*0Sstevel@tonic-gate "available in the %s zone only"), "global"); 1629*0Sstevel@tonic-gate return (FAILURE); 1630*0Sstevel@tonic-gate } 1631*0Sstevel@tonic-gate 1632*0Sstevel@tonic-gate /* Get the hardware provider list from kernel */ 1633*0Sstevel@tonic-gate if (get_dev_list(&pdevlist_kernel) != SUCCESS) { 1634*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 1635*0Sstevel@tonic-gate "failed to retrieve the list of hardware providers.\n")); 1636*0Sstevel@tonic-gate free_entrylist(pdevlist_conf); 1637*0Sstevel@tonic-gate return (FAILURE); 1638*0Sstevel@tonic-gate } 1639*0Sstevel@tonic-gate 1640*0Sstevel@tonic-gate /* 1641*0Sstevel@tonic-gate * For each hardware provider from kernel, check if it has an entry 1642*0Sstevel@tonic-gate * in the config file. If it has an entry, print out the policy from 1643*0Sstevel@tonic-gate * config file and remove the entry from the hardware provider list 1644*0Sstevel@tonic-gate * of the config file. If it does not have an entry in the config 1645*0Sstevel@tonic-gate * file, no mechanisms of it have been disabled. But, we still call 1646*0Sstevel@tonic-gate * list_policy_for_hard() to account for the "random" feature. 1647*0Sstevel@tonic-gate */ 1648*0Sstevel@tonic-gate for (i = 0; i < pdevlist_kernel->dl_dev_count; i++) { 1649*0Sstevel@tonic-gate (void) snprintf(provname, sizeof (provname), "%s/%d", 1650*0Sstevel@tonic-gate pdevlist_kernel->dl_devs[i].le_dev_name, 1651*0Sstevel@tonic-gate pdevlist_kernel->dl_devs[i].le_dev_instance); 1652*0Sstevel@tonic-gate found = B_FALSE; 1653*0Sstevel@tonic-gate phead = ptr = pdevlist_conf; 1654*0Sstevel@tonic-gate while (!found && ptr) { 1655*0Sstevel@tonic-gate if (strcmp(ptr->pent->name, provname) == 0) { 1656*0Sstevel@tonic-gate found = B_TRUE; 1657*0Sstevel@tonic-gate } else { 1658*0Sstevel@tonic-gate phead = ptr; 1659*0Sstevel@tonic-gate ptr = ptr->next; 1660*0Sstevel@tonic-gate } 1661*0Sstevel@tonic-gate } 1662*0Sstevel@tonic-gate 1663*0Sstevel@tonic-gate if (found) { 1664*0Sstevel@tonic-gate (void) list_policy_for_hard(ptr->pent->name); 1665*0Sstevel@tonic-gate if (phead == ptr) { 1666*0Sstevel@tonic-gate pdevlist_conf = pdevlist_conf->next; 1667*0Sstevel@tonic-gate } else { 1668*0Sstevel@tonic-gate phead->next = ptr->next; 1669*0Sstevel@tonic-gate } 1670*0Sstevel@tonic-gate free_entry(ptr->pent); 1671*0Sstevel@tonic-gate free(ptr); 1672*0Sstevel@tonic-gate } else { 1673*0Sstevel@tonic-gate (void) list_policy_for_hard(provname); 1674*0Sstevel@tonic-gate } 1675*0Sstevel@tonic-gate } 1676*0Sstevel@tonic-gate 1677*0Sstevel@tonic-gate /* 1678*0Sstevel@tonic-gate * If there are still entries left in the pdevlist_conf list from 1679*0Sstevel@tonic-gate * the config file, these providers must have been detached. 1680*0Sstevel@tonic-gate * Should print out their policy information also. 1681*0Sstevel@tonic-gate */ 1682*0Sstevel@tonic-gate ptr = pdevlist_conf; 1683*0Sstevel@tonic-gate while (ptr != NULL) { 1684*0Sstevel@tonic-gate print_kef_policy(ptr->pent, B_FALSE, B_TRUE); 1685*0Sstevel@tonic-gate ptr = ptr->next; 1686*0Sstevel@tonic-gate } 1687*0Sstevel@tonic-gate 1688*0Sstevel@tonic-gate free_entrylist(pdevlist_conf); 1689*0Sstevel@tonic-gate free(pdevlist_kernel); 1690*0Sstevel@tonic-gate 1691*0Sstevel@tonic-gate return (rc); 1692*0Sstevel@tonic-gate } 1693