10Sstevel@tonic-gate /*
20Sstevel@tonic-gate  * CDDL HEADER START
30Sstevel@tonic-gate  *
40Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
57334SDaniel.Anderson@Sun.COM  * Common Development and Distribution License (the "License").
67334SDaniel.Anderson@Sun.COM  * You may not use this file except in compliance with the License.
70Sstevel@tonic-gate  *
80Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
90Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
100Sstevel@tonic-gate  * See the License for the specific language governing permissions
110Sstevel@tonic-gate  * and limitations under the License.
120Sstevel@tonic-gate  *
130Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
140Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
150Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
160Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
170Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
180Sstevel@tonic-gate  *
190Sstevel@tonic-gate  * CDDL HEADER END
200Sstevel@tonic-gate  */
210Sstevel@tonic-gate /*
22*11458Sopensolaris@drydog.com  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
230Sstevel@tonic-gate  * Use is subject to license terms.
240Sstevel@tonic-gate  */
250Sstevel@tonic-gate 
260Sstevel@tonic-gate #include <errno.h>
270Sstevel@tonic-gate #include <fcntl.h>
280Sstevel@tonic-gate #include <stdio.h>
290Sstevel@tonic-gate #include <stdlib.h>
300Sstevel@tonic-gate #include <strings.h>
310Sstevel@tonic-gate #include <time.h>
320Sstevel@tonic-gate #include <unistd.h>
330Sstevel@tonic-gate #include <locale.h>
340Sstevel@tonic-gate #include <sys/types.h>
357968Sopensolaris@drydog.com #include <zone.h>
360Sstevel@tonic-gate #include <sys/stat.h>
370Sstevel@tonic-gate #include "cryptoadm.h"
380Sstevel@tonic-gate 
390Sstevel@tonic-gate static int err; /* To store errno which may be overwritten by gettext() */
400Sstevel@tonic-gate static int build_entrylist(entry_t *, entrylist_t **);
410Sstevel@tonic-gate static entry_t *dup_entry(entry_t *);
420Sstevel@tonic-gate static mechlist_t *dup_mechlist(mechlist_t *);
430Sstevel@tonic-gate static entry_t *getent(char *, entrylist_t *);
440Sstevel@tonic-gate static int interpret(char *, entry_t **);
45*11458Sopensolaris@drydog.com static int parse_sup_dis_list(const char *buf, entry_t *pent);
460Sstevel@tonic-gate 
470Sstevel@tonic-gate 
480Sstevel@tonic-gate /*
490Sstevel@tonic-gate  * Duplicate the mechanism list.  A null pointer is returned if the storage
500Sstevel@tonic-gate  * space available is insufficient or the input argument is NULL.
510Sstevel@tonic-gate  */
520Sstevel@tonic-gate static mechlist_t *
530Sstevel@tonic-gate dup_mechlist(mechlist_t *plist)
540Sstevel@tonic-gate {
557968Sopensolaris@drydog.com 	mechlist_t	*pres = NULL;
567968Sopensolaris@drydog.com 	mechlist_t	*pcur;
577968Sopensolaris@drydog.com 	mechlist_t	*ptmp;
587968Sopensolaris@drydog.com 	int		rc = SUCCESS;
590Sstevel@tonic-gate 
600Sstevel@tonic-gate 	while (plist != NULL) {
610Sstevel@tonic-gate 		if (!(ptmp = create_mech(plist->name))) {
620Sstevel@tonic-gate 			rc = FAILURE;
630Sstevel@tonic-gate 			break;
640Sstevel@tonic-gate 		}
650Sstevel@tonic-gate 
660Sstevel@tonic-gate 		if (pres == NULL) {
670Sstevel@tonic-gate 			pres = pcur = ptmp;
680Sstevel@tonic-gate 		} else {
690Sstevel@tonic-gate 			pcur->next = ptmp;
700Sstevel@tonic-gate 			pcur = pcur->next;
710Sstevel@tonic-gate 		}
720Sstevel@tonic-gate 		plist = plist->next;
730Sstevel@tonic-gate 	}
740Sstevel@tonic-gate 
750Sstevel@tonic-gate 	if (rc != SUCCESS) {
760Sstevel@tonic-gate 		free_mechlist(pres);
770Sstevel@tonic-gate 		return (NULL);
780Sstevel@tonic-gate 	}
790Sstevel@tonic-gate 
800Sstevel@tonic-gate 	return (pres);
810Sstevel@tonic-gate }
820Sstevel@tonic-gate 
830Sstevel@tonic-gate 
840Sstevel@tonic-gate /*
850Sstevel@tonic-gate  * Get the number of mechanisms in the mechanism list.
860Sstevel@tonic-gate  */
870Sstevel@tonic-gate int
880Sstevel@tonic-gate get_mech_count(mechlist_t *plist)
890Sstevel@tonic-gate {
900Sstevel@tonic-gate 	int count = 0;
910Sstevel@tonic-gate 
920Sstevel@tonic-gate 	while (plist != NULL) {
930Sstevel@tonic-gate 		count++;
940Sstevel@tonic-gate 		plist = plist->next;
950Sstevel@tonic-gate 	}
960Sstevel@tonic-gate 	return (count);
970Sstevel@tonic-gate }
980Sstevel@tonic-gate 
997968Sopensolaris@drydog.com /*
1007968Sopensolaris@drydog.com  * Create one item of type entry_t with the provider name.
1017968Sopensolaris@drydog.com  * Return NULL if there's not enough memory or provname is NULL.
1027968Sopensolaris@drydog.com  */
1037968Sopensolaris@drydog.com entry_t *
1047968Sopensolaris@drydog.com create_entry(char *provname)
1057968Sopensolaris@drydog.com {
1067968Sopensolaris@drydog.com 	entry_t		*pent = NULL;
1077968Sopensolaris@drydog.com 
1087968Sopensolaris@drydog.com 	if (provname == NULL) {
1097968Sopensolaris@drydog.com 		return (NULL);
1107968Sopensolaris@drydog.com 	}
1117968Sopensolaris@drydog.com 
1127968Sopensolaris@drydog.com 	pent = calloc(1, sizeof (entry_t));
1137968Sopensolaris@drydog.com 	if (pent == NULL) {
1147968Sopensolaris@drydog.com 		cryptodebug("out of memory.");
1157968Sopensolaris@drydog.com 		return (NULL);
1167968Sopensolaris@drydog.com 	}
1177968Sopensolaris@drydog.com 
1187968Sopensolaris@drydog.com 	(void) strlcpy(pent->name, provname, MAXNAMELEN);
1197968Sopensolaris@drydog.com 	pent->suplist = NULL;
1207968Sopensolaris@drydog.com 	pent->sup_count = 0;
1217968Sopensolaris@drydog.com 	pent->dislist = NULL;
1227968Sopensolaris@drydog.com 	pent->dis_count = 0;
1237968Sopensolaris@drydog.com 	pent->load = B_TRUE;
1247968Sopensolaris@drydog.com 
1257968Sopensolaris@drydog.com 	return (pent);
1267968Sopensolaris@drydog.com }
1270Sstevel@tonic-gate 
1280Sstevel@tonic-gate /*
1297968Sopensolaris@drydog.com  * Duplicate an entry for a provider from kcf.conf.
1307968Sopensolaris@drydog.com  * Return NULL if memory is insufficient or the input argument is NULL.
1317968Sopensolaris@drydog.com  * Called by getent().
1320Sstevel@tonic-gate  */
1330Sstevel@tonic-gate static entry_t *
1340Sstevel@tonic-gate dup_entry(entry_t *pent1)
1350Sstevel@tonic-gate {
1360Sstevel@tonic-gate 	entry_t	*pent2 = NULL;
1370Sstevel@tonic-gate 
1380Sstevel@tonic-gate 	if (pent1 == NULL) {
1390Sstevel@tonic-gate 		return (NULL);
1400Sstevel@tonic-gate 	}
1410Sstevel@tonic-gate 
1427968Sopensolaris@drydog.com 	if ((pent2 = create_entry(pent1->name)) == NULL) {
1430Sstevel@tonic-gate 		cryptodebug("out of memory.");
1440Sstevel@tonic-gate 		return (NULL);
1450Sstevel@tonic-gate 	}
1460Sstevel@tonic-gate 
1470Sstevel@tonic-gate 	pent2->sup_count = pent1->sup_count;
1480Sstevel@tonic-gate 	pent2->dis_count = pent1->dis_count;
1497968Sopensolaris@drydog.com 	pent2->load = pent1->load;
1500Sstevel@tonic-gate 	if (pent1->suplist != NULL) {
1510Sstevel@tonic-gate 		pent2->suplist = dup_mechlist(pent1->suplist);
1520Sstevel@tonic-gate 		if (pent2->suplist == NULL) {
1530Sstevel@tonic-gate 			free_entry(pent2);
1540Sstevel@tonic-gate 			return (NULL);
1550Sstevel@tonic-gate 		}
1560Sstevel@tonic-gate 	}
1570Sstevel@tonic-gate 	if (pent1->dislist != NULL) {
1580Sstevel@tonic-gate 		pent2->dislist = dup_mechlist(pent1->dislist);
1590Sstevel@tonic-gate 		if (pent2->dislist == NULL) {
1600Sstevel@tonic-gate 			free_entry(pent2);
1610Sstevel@tonic-gate 			return (NULL);
1620Sstevel@tonic-gate 		}
1630Sstevel@tonic-gate 	}
1640Sstevel@tonic-gate 
1650Sstevel@tonic-gate 	return (pent2);
1660Sstevel@tonic-gate }
1670Sstevel@tonic-gate 
1680Sstevel@tonic-gate 
1690Sstevel@tonic-gate /*
1700Sstevel@tonic-gate  * This routine parses the disabledlist or the supportedlist of an entry
1710Sstevel@tonic-gate  * in the kcf.conf configuration file.
1720Sstevel@tonic-gate  *
1730Sstevel@tonic-gate  * Arguments:
1747968Sopensolaris@drydog.com  *	buf: an input argument which is a char string with the format of
1750Sstevel@tonic-gate  *	     "disabledlist=m1,m2,..." or "supportedlist=m1,m2,..."
1760Sstevel@tonic-gate  *	pent: the entry for the disabledlist.  This is an IN/OUT argument.
1770Sstevel@tonic-gate  *
1780Sstevel@tonic-gate  * Return value: SUCCESS or FAILURE.
1790Sstevel@tonic-gate  */
1800Sstevel@tonic-gate static int
181*11458Sopensolaris@drydog.com parse_sup_dis_list(const char *buf, entry_t *pent)
1820Sstevel@tonic-gate {
1837968Sopensolaris@drydog.com 	mechlist_t	*pmech = NULL;
1847968Sopensolaris@drydog.com 	mechlist_t	*phead = NULL;
1857968Sopensolaris@drydog.com 	char		*next_token;
1867968Sopensolaris@drydog.com 	char		*value;
1877968Sopensolaris@drydog.com 	int		count;
1887968Sopensolaris@drydog.com 	int		supflag = B_FALSE;
1897968Sopensolaris@drydog.com 	int		disflag = B_FALSE;
1907968Sopensolaris@drydog.com 	int		rc = SUCCESS;
1910Sstevel@tonic-gate 
1920Sstevel@tonic-gate 	if (strncmp(buf, EF_SUPPORTED, strlen(EF_SUPPORTED)) == 0) {
1930Sstevel@tonic-gate 		supflag = B_TRUE;
1940Sstevel@tonic-gate 	} else if (strncmp(buf, EF_DISABLED, strlen(EF_DISABLED)) == 0) {
1950Sstevel@tonic-gate 		disflag = B_TRUE;
1960Sstevel@tonic-gate 	} else {
1970Sstevel@tonic-gate 		/* should not come here */
1980Sstevel@tonic-gate 		return (FAILURE);
1990Sstevel@tonic-gate 	}
2000Sstevel@tonic-gate 
2010Sstevel@tonic-gate 	if (value = strpbrk(buf, SEP_EQUAL)) {
2020Sstevel@tonic-gate 		value++; /* get rid of = */
2030Sstevel@tonic-gate 	} else {
2040Sstevel@tonic-gate 		cryptodebug("failed to parse the kcf.conf file.");
2050Sstevel@tonic-gate 		return (FAILURE);
2060Sstevel@tonic-gate 	}
2070Sstevel@tonic-gate 
2080Sstevel@tonic-gate 	if ((next_token = strtok(value, SEP_COMMA)) == NULL) {
2090Sstevel@tonic-gate 		cryptodebug("failed to parse the kcf.conf file.");
2100Sstevel@tonic-gate 		return (FAILURE);
2110Sstevel@tonic-gate 	}
2120Sstevel@tonic-gate 
2130Sstevel@tonic-gate 	if ((pmech = create_mech(next_token)) == NULL) {
2140Sstevel@tonic-gate 		return (FAILURE);
2150Sstevel@tonic-gate 	}
2160Sstevel@tonic-gate 
2170Sstevel@tonic-gate 	if (supflag) {
218*11458Sopensolaris@drydog.com 			if (pent->suplist != NULL) {
219*11458Sopensolaris@drydog.com 				cryptodebug("multiple supportedlist entries "
220*11458Sopensolaris@drydog.com 				    "for a mechanism in file kcf.conf.");
221*11458Sopensolaris@drydog.com 				return (FAILURE);
222*11458Sopensolaris@drydog.com 			} else {
223*11458Sopensolaris@drydog.com 				pent->suplist = phead = pmech;
224*11458Sopensolaris@drydog.com 			}
2250Sstevel@tonic-gate 	} else if (disflag) {
226*11458Sopensolaris@drydog.com 			if (pent->dislist != NULL) {
227*11458Sopensolaris@drydog.com 				cryptodebug("multiple disabledlist entries "
228*11458Sopensolaris@drydog.com 				    "for a mechanism in file kcf.conf.");
229*11458Sopensolaris@drydog.com 				return (FAILURE);
230*11458Sopensolaris@drydog.com 			} else {
231*11458Sopensolaris@drydog.com 				pent->dislist = phead = pmech;
232*11458Sopensolaris@drydog.com 			}
2330Sstevel@tonic-gate 	}
2340Sstevel@tonic-gate 
2350Sstevel@tonic-gate 	count = 1;
2360Sstevel@tonic-gate 	while (next_token) {
2370Sstevel@tonic-gate 		if (next_token = strtok(NULL, SEP_COMMA)) {
2380Sstevel@tonic-gate 			if ((pmech = create_mech(next_token)) == NULL) {
2390Sstevel@tonic-gate 				rc = FAILURE;
2400Sstevel@tonic-gate 				break;
2410Sstevel@tonic-gate 			}
2420Sstevel@tonic-gate 			count++;
2430Sstevel@tonic-gate 			phead->next = pmech;
2440Sstevel@tonic-gate 			phead = phead->next;
2450Sstevel@tonic-gate 		}
2460Sstevel@tonic-gate 	}
2470Sstevel@tonic-gate 
2480Sstevel@tonic-gate 	if (rc == SUCCESS) {
2490Sstevel@tonic-gate 		if (supflag) {
2500Sstevel@tonic-gate 			pent->sup_count = count;
2510Sstevel@tonic-gate 		} else if (disflag) {
2520Sstevel@tonic-gate 			pent->dis_count = count;
2530Sstevel@tonic-gate 		}
2540Sstevel@tonic-gate 	} else {
2550Sstevel@tonic-gate 		free_mechlist(phead);
2560Sstevel@tonic-gate 	}
2570Sstevel@tonic-gate 
2580Sstevel@tonic-gate 	return (rc);
2590Sstevel@tonic-gate }
2600Sstevel@tonic-gate 
2610Sstevel@tonic-gate 
2620Sstevel@tonic-gate /*
2637968Sopensolaris@drydog.com  * Convert a char string containing a line about a provider
2647968Sopensolaris@drydog.com  * from kcf.conf into an entry_t structure.
2657968Sopensolaris@drydog.com  *
266*11458Sopensolaris@drydog.com  * Note: the input string, buf, may be modified by this function.
267*11458Sopensolaris@drydog.com  *
2687968Sopensolaris@drydog.com  * See ent2str(), the reverse of this function, for the format of
2697968Sopensolaris@drydog.com  * kcf.conf lines.
2700Sstevel@tonic-gate  */
2710Sstevel@tonic-gate static int
2720Sstevel@tonic-gate interpret(char *buf, entry_t **ppent)
2730Sstevel@tonic-gate {
2747968Sopensolaris@drydog.com 	entry_t	*pent = NULL;
2757968Sopensolaris@drydog.com 	char	*token1;
2767968Sopensolaris@drydog.com 	char	*token2;
2777968Sopensolaris@drydog.com 	char	*token3;
2787968Sopensolaris@drydog.com 	int	rc;
2790Sstevel@tonic-gate 
2807968Sopensolaris@drydog.com 	/* Get provider name */
2810Sstevel@tonic-gate 	if ((token1 = strtok(buf, SEP_COLON)) == NULL) { /* buf is NULL */
2820Sstevel@tonic-gate 		return (FAILURE);
2830Sstevel@tonic-gate 	};
2840Sstevel@tonic-gate 
2857968Sopensolaris@drydog.com 	pent = create_entry(token1);
2860Sstevel@tonic-gate 	if (pent == NULL) {
2870Sstevel@tonic-gate 		cryptodebug("out of memory.");
2880Sstevel@tonic-gate 		return (FAILURE);
2890Sstevel@tonic-gate 	}
2900Sstevel@tonic-gate 
2910Sstevel@tonic-gate 	if ((token2 = strtok(NULL, SEP_SEMICOLON)) == NULL) {
2920Sstevel@tonic-gate 		/* The entry contains a provider name only */
2930Sstevel@tonic-gate 		free_entry(pent);
2940Sstevel@tonic-gate 		return (FAILURE);
2950Sstevel@tonic-gate 	}
2960Sstevel@tonic-gate 
2977968Sopensolaris@drydog.com 	if (strncmp(token2, EF_UNLOAD, strlen(EF_UNLOAD)) == 0) {
2987968Sopensolaris@drydog.com 		pent->load = B_FALSE; /* cryptoadm unload */
299*11458Sopensolaris@drydog.com 		token2 = strtok(NULL, SEP_SEMICOLON);
300*11458Sopensolaris@drydog.com 		/*
301*11458Sopensolaris@drydog.com 		 * If token2 is NULL, the entry contains a
302*11458Sopensolaris@drydog.com 		 * provider name:unload only
303*11458Sopensolaris@drydog.com 		 */
3047968Sopensolaris@drydog.com 	}
3057968Sopensolaris@drydog.com 
306*11458Sopensolaris@drydog.com 	if (token2 != NULL) {
307*11458Sopensolaris@drydog.com 		/*
308*11458Sopensolaris@drydog.com 		 * Either supportedlist or disabledlist or both are present.
309*11458Sopensolaris@drydog.com 		 * Need to call strtok() to get token3 first, as function
310*11458Sopensolaris@drydog.com 		 * parse_sup_dis_list() makes strtok() calls on the
311*11458Sopensolaris@drydog.com 		 * token2 substring.
312*11458Sopensolaris@drydog.com 		 */
313*11458Sopensolaris@drydog.com 		token3 = strtok(NULL, SEP_SEMICOLON); /* optional */
3140Sstevel@tonic-gate 
315*11458Sopensolaris@drydog.com 		/* parse supportedlist (or disabledlist if no supportedlist) */
316*11458Sopensolaris@drydog.com 		if ((rc = parse_sup_dis_list(token2, pent)) != SUCCESS) {
317*11458Sopensolaris@drydog.com 			free_entry(pent);
318*11458Sopensolaris@drydog.com 			return (rc);
319*11458Sopensolaris@drydog.com 		}
3200Sstevel@tonic-gate 
321*11458Sopensolaris@drydog.com 		/* parse disabledlist (if there's a supportedlist) */
322*11458Sopensolaris@drydog.com 		if ((token3 != NULL) && ((rc = parse_sup_dis_list(token3,
323*11458Sopensolaris@drydog.com 		    pent)) != SUCCESS)) {
324*11458Sopensolaris@drydog.com 			free_entry(pent);
325*11458Sopensolaris@drydog.com 			return (rc);
326*11458Sopensolaris@drydog.com 		}
3270Sstevel@tonic-gate 	}
3280Sstevel@tonic-gate 
3290Sstevel@tonic-gate 	*ppent = pent;
3300Sstevel@tonic-gate 	return (SUCCESS);
3310Sstevel@tonic-gate }
3320Sstevel@tonic-gate 
3330Sstevel@tonic-gate 
3340Sstevel@tonic-gate /*
3357968Sopensolaris@drydog.com  * Add an entry about a provider from kcf.conf to the end of an entry list.
3367968Sopensolaris@drydog.com  * If the entry list pplist is NULL, create the linked list with pent as the
3377968Sopensolaris@drydog.com  * first element.
3380Sstevel@tonic-gate  */
3390Sstevel@tonic-gate static int
3400Sstevel@tonic-gate build_entrylist(entry_t *pent, entrylist_t **pplist)
3410Sstevel@tonic-gate {
3427968Sopensolaris@drydog.com 	entrylist_t	*pentlist;
3437968Sopensolaris@drydog.com 	entrylist_t	*pcur = NULL;
3440Sstevel@tonic-gate 
3450Sstevel@tonic-gate 	pentlist = malloc(sizeof (entrylist_t));
3460Sstevel@tonic-gate 	if (pentlist == NULL) {
3470Sstevel@tonic-gate 		cryptodebug("out of memory.");
3480Sstevel@tonic-gate 		return (FAILURE);
3490Sstevel@tonic-gate 	}
3500Sstevel@tonic-gate 	pentlist->pent = pent;
3510Sstevel@tonic-gate 	pentlist->next = NULL;
3520Sstevel@tonic-gate 
3530Sstevel@tonic-gate 	if (*pplist) {
3540Sstevel@tonic-gate 		pcur = *pplist;
3550Sstevel@tonic-gate 		while (pcur->next != NULL)
3560Sstevel@tonic-gate 			pcur = pcur->next;
3570Sstevel@tonic-gate 		pcur->next = pentlist;
3580Sstevel@tonic-gate 	} else { /* empty list */
3590Sstevel@tonic-gate 		*pplist = pentlist;
3600Sstevel@tonic-gate 	}
3610Sstevel@tonic-gate 
3620Sstevel@tonic-gate 	return (SUCCESS);
3630Sstevel@tonic-gate }
3640Sstevel@tonic-gate 
3650Sstevel@tonic-gate 
3660Sstevel@tonic-gate 
3670Sstevel@tonic-gate /*
3680Sstevel@tonic-gate  * Find the entry with the "provname" name from the entry list and duplicate
3697968Sopensolaris@drydog.com  * it.  Called by getent_kef().
3700Sstevel@tonic-gate  */
3710Sstevel@tonic-gate static entry_t *
3720Sstevel@tonic-gate getent(char *provname, entrylist_t *entrylist)
3730Sstevel@tonic-gate {
3740Sstevel@tonic-gate 	boolean_t	found = B_FALSE;
3750Sstevel@tonic-gate 	entry_t		*pent1 = NULL;
3760Sstevel@tonic-gate 
3770Sstevel@tonic-gate 	if ((provname == NULL) || (entrylist == NULL)) {
3780Sstevel@tonic-gate 		return (NULL);
3790Sstevel@tonic-gate 	}
3800Sstevel@tonic-gate 
3810Sstevel@tonic-gate 	while (!found && entrylist) {
3820Sstevel@tonic-gate 		if (strcmp(entrylist->pent->name, provname) == 0) {
3830Sstevel@tonic-gate 			found = B_TRUE;
3840Sstevel@tonic-gate 			pent1 = entrylist->pent;
3850Sstevel@tonic-gate 		} else {
3860Sstevel@tonic-gate 			entrylist = entrylist->next;
3870Sstevel@tonic-gate 		}
3880Sstevel@tonic-gate 	}
3890Sstevel@tonic-gate 
3900Sstevel@tonic-gate 	if (!found) {
3910Sstevel@tonic-gate 		return (NULL);
3920Sstevel@tonic-gate 	}
3930Sstevel@tonic-gate 
3940Sstevel@tonic-gate 	/* duplicate the entry to be returned */
3950Sstevel@tonic-gate 	return (dup_entry(pent1));
3960Sstevel@tonic-gate }
3970Sstevel@tonic-gate 
3980Sstevel@tonic-gate 
3997968Sopensolaris@drydog.com /*
4007968Sopensolaris@drydog.com  * Free memory in entry_t.
4017968Sopensolaris@drydog.com  * That is, the supported and disabled lists for a provider
4027968Sopensolaris@drydog.com  * from kcf.conf.
4037968Sopensolaris@drydog.com  */
4040Sstevel@tonic-gate void
4050Sstevel@tonic-gate free_entry(entry_t  *pent)
4060Sstevel@tonic-gate {
4070Sstevel@tonic-gate 	if (pent == NULL) {
4080Sstevel@tonic-gate 		return;
4090Sstevel@tonic-gate 	} else {
4100Sstevel@tonic-gate 		free_mechlist(pent->suplist);
4110Sstevel@tonic-gate 		free_mechlist(pent->dislist);
4120Sstevel@tonic-gate 		free(pent);
4130Sstevel@tonic-gate 	}
4140Sstevel@tonic-gate }
4150Sstevel@tonic-gate 
4160Sstevel@tonic-gate 
4177968Sopensolaris@drydog.com /*
4187968Sopensolaris@drydog.com  * Free elements in a entrylist_t linked list,
4197968Sopensolaris@drydog.com  * which lists providers in kcf.conf.
4207968Sopensolaris@drydog.com  */
4210Sstevel@tonic-gate void
4220Sstevel@tonic-gate free_entrylist(entrylist_t *entrylist)
4230Sstevel@tonic-gate {
4240Sstevel@tonic-gate 	entrylist_t *pnext;
4250Sstevel@tonic-gate 
4260Sstevel@tonic-gate 	while (entrylist != NULL) {
4270Sstevel@tonic-gate 		pnext = entrylist->next;
4280Sstevel@tonic-gate 		free_entry(entrylist->pent);
4290Sstevel@tonic-gate 		entrylist = pnext;
4300Sstevel@tonic-gate 	}
4310Sstevel@tonic-gate }
4320Sstevel@tonic-gate 
4330Sstevel@tonic-gate 
4340Sstevel@tonic-gate /*
4350Sstevel@tonic-gate  * Convert an entry to a string.  This routine builds a string for the entry
4367968Sopensolaris@drydog.com  * to be inserted in the kcf.conf file.  Based on the content of each entry,
437*11458Sopensolaris@drydog.com  * the result string can be one of these 7 forms:
4380Sstevel@tonic-gate  *  - name:supportedlist=m1,m2,...,mj
4390Sstevel@tonic-gate  *  - name:disabledlist=m1,m2,...,mj
4400Sstevel@tonic-gate  *  - name:supportedlist=m1,...,mj;disabledlist=m1,m2,...,mk
4410Sstevel@tonic-gate  *
442*11458Sopensolaris@drydog.com  *  - name:unload
4437968Sopensolaris@drydog.com  *  - name:unload;supportedlist=m1,m2,...,mj
4447968Sopensolaris@drydog.com  *  - name:unload;disabledlist=m1,m2,...,mj
4457968Sopensolaris@drydog.com  *  - name:unload;supportedlist=m1,...,mj;disabledlist=m1,m2,...,mk
4467968Sopensolaris@drydog.com  *
4477968Sopensolaris@drydog.com  * Note that the caller is responsible for freeing the returned string
4487968Sopensolaris@drydog.com  * (with free_entry()).
4497968Sopensolaris@drydog.com  * See interpret() for the reverse of this function: converting a string
4507968Sopensolaris@drydog.com  * to an entry_t.
4510Sstevel@tonic-gate  */
4520Sstevel@tonic-gate char *
4530Sstevel@tonic-gate ent2str(entry_t *pent)
4540Sstevel@tonic-gate {
4557968Sopensolaris@drydog.com 	char		*buf;
4567968Sopensolaris@drydog.com 	mechlist_t	*pcur = NULL;
4577968Sopensolaris@drydog.com 	boolean_t	semicolon_separator = B_FALSE;
4580Sstevel@tonic-gate 
4590Sstevel@tonic-gate 
4600Sstevel@tonic-gate 	if (pent == NULL) {
4610Sstevel@tonic-gate 		return (NULL);
4620Sstevel@tonic-gate 	}
4630Sstevel@tonic-gate 
4640Sstevel@tonic-gate 	if ((buf = malloc(BUFSIZ)) == NULL) {
4650Sstevel@tonic-gate 		return (NULL);
4660Sstevel@tonic-gate 	}
4670Sstevel@tonic-gate 
4680Sstevel@tonic-gate 	/* convert the provider name */
4690Sstevel@tonic-gate 	if (strlcpy(buf, pent->name, BUFSIZ) >= BUFSIZ) {
4700Sstevel@tonic-gate 		free(buf);
4710Sstevel@tonic-gate 		return (NULL);
4720Sstevel@tonic-gate 	}
4730Sstevel@tonic-gate 
4747968Sopensolaris@drydog.com 	if (!pent->load) { /* add "unload" keyword */
4757968Sopensolaris@drydog.com 		if (strlcat(buf, SEP_COLON, BUFSIZ) >= BUFSIZ) {
4767968Sopensolaris@drydog.com 			free(buf);
4777968Sopensolaris@drydog.com 			return (NULL);
4787968Sopensolaris@drydog.com 		}
4797968Sopensolaris@drydog.com 
4807968Sopensolaris@drydog.com 		if (strlcat(buf, EF_UNLOAD, BUFSIZ) >= BUFSIZ) {
4817968Sopensolaris@drydog.com 			free(buf);
4827968Sopensolaris@drydog.com 			return (NULL);
4837968Sopensolaris@drydog.com 		}
4847968Sopensolaris@drydog.com 
4857968Sopensolaris@drydog.com 		semicolon_separator = B_TRUE;
4867968Sopensolaris@drydog.com 	}
4877968Sopensolaris@drydog.com 
4880Sstevel@tonic-gate 	/* convert the supported list if any */
4897968Sopensolaris@drydog.com 	pcur = pent->suplist;
4907968Sopensolaris@drydog.com 	if (pcur != NULL) {
4917968Sopensolaris@drydog.com 		if (strlcat(buf,
4927968Sopensolaris@drydog.com 		    semicolon_separator ? SEP_SEMICOLON : SEP_COLON,
4937968Sopensolaris@drydog.com 		    BUFSIZ) >= BUFSIZ) {
4940Sstevel@tonic-gate 			free(buf);
4950Sstevel@tonic-gate 			return (NULL);
4960Sstevel@tonic-gate 		}
4970Sstevel@tonic-gate 
4980Sstevel@tonic-gate 		if (strlcat(buf, EF_SUPPORTED, BUFSIZ) >= BUFSIZ) {
4990Sstevel@tonic-gate 			free(buf);
5000Sstevel@tonic-gate 			return (NULL);
5010Sstevel@tonic-gate 		}
5020Sstevel@tonic-gate 
5037968Sopensolaris@drydog.com 		while (pcur != NULL) {
5047968Sopensolaris@drydog.com 			if (strlcat(buf, pcur->name, BUFSIZ) >= BUFSIZ) {
5050Sstevel@tonic-gate 				free(buf);
5060Sstevel@tonic-gate 				return (NULL);
5070Sstevel@tonic-gate 			}
5080Sstevel@tonic-gate 
5097968Sopensolaris@drydog.com 			pcur = pcur->next;
5107968Sopensolaris@drydog.com 			if (pcur != NULL) {
5110Sstevel@tonic-gate 				if (strlcat(buf, SEP_COMMA, BUFSIZ)
5120Sstevel@tonic-gate 				    >= BUFSIZ) {
5130Sstevel@tonic-gate 					free(buf);
5140Sstevel@tonic-gate 					return (NULL);
5150Sstevel@tonic-gate 				}
5160Sstevel@tonic-gate 			}
5170Sstevel@tonic-gate 		}
5187968Sopensolaris@drydog.com 		semicolon_separator = B_TRUE;
5190Sstevel@tonic-gate 	}
5200Sstevel@tonic-gate 
5210Sstevel@tonic-gate 	/* convert the disabled list if any */
5227968Sopensolaris@drydog.com 	pcur = pent->dislist;
5237968Sopensolaris@drydog.com 	if (pcur != NULL) {
5247968Sopensolaris@drydog.com 		if (strlcat(buf,
5257968Sopensolaris@drydog.com 		    semicolon_separator ? SEP_SEMICOLON : SEP_COLON,
5267968Sopensolaris@drydog.com 		    BUFSIZ) >= BUFSIZ) {
5277968Sopensolaris@drydog.com 			free(buf);
5287968Sopensolaris@drydog.com 			return (NULL);
5290Sstevel@tonic-gate 		}
5300Sstevel@tonic-gate 
5317968Sopensolaris@drydog.com 		if (strlcat(buf, EF_DISABLED, BUFSIZ) >= BUFSIZ) {
5327968Sopensolaris@drydog.com 			free(buf);
5337968Sopensolaris@drydog.com 			return (NULL);
5347968Sopensolaris@drydog.com 		}
5357968Sopensolaris@drydog.com 
5367968Sopensolaris@drydog.com 		while (pcur != NULL) {
5377968Sopensolaris@drydog.com 			if (strlcat(buf, pcur->name, BUFSIZ) >= BUFSIZ) {
5380Sstevel@tonic-gate 				free(buf);
5390Sstevel@tonic-gate 				return (NULL);
5400Sstevel@tonic-gate 			}
5410Sstevel@tonic-gate 
5427968Sopensolaris@drydog.com 			pcur = pcur->next;
5437968Sopensolaris@drydog.com 			if (pcur != NULL) {
5440Sstevel@tonic-gate 				if (strlcat(buf, SEP_COMMA, BUFSIZ)
5450Sstevel@tonic-gate 				    >= BUFSIZ) {
5460Sstevel@tonic-gate 					free(buf);
5470Sstevel@tonic-gate 					return (NULL);
5480Sstevel@tonic-gate 				}
5490Sstevel@tonic-gate 			}
5500Sstevel@tonic-gate 		}
5517968Sopensolaris@drydog.com 		semicolon_separator = B_TRUE;
5520Sstevel@tonic-gate 	}
5530Sstevel@tonic-gate 
5540Sstevel@tonic-gate 	if (strlcat(buf, "\n", BUFSIZ) >= BUFSIZ) {
5550Sstevel@tonic-gate 		free(buf);
5560Sstevel@tonic-gate 		return (NULL);
5570Sstevel@tonic-gate 	}
5580Sstevel@tonic-gate 
5590Sstevel@tonic-gate 	return (buf);
5600Sstevel@tonic-gate }
5610Sstevel@tonic-gate 
5620Sstevel@tonic-gate 
5630Sstevel@tonic-gate /*
5640Sstevel@tonic-gate  * Enable the mechanisms for the provider pointed by *ppent.  If allflag is
5650Sstevel@tonic-gate  * TRUE, enable all.  Otherwise, enable the mechanisms specified in the 3rd
5660Sstevel@tonic-gate  * argument "mlist".  The result will be stored in ppent also.
5670Sstevel@tonic-gate  */
5680Sstevel@tonic-gate int
5690Sstevel@tonic-gate enable_mechs(entry_t **ppent, boolean_t allflag, mechlist_t *mlist)
5700Sstevel@tonic-gate {
5717968Sopensolaris@drydog.com 	entry_t		*pent;
5727968Sopensolaris@drydog.com 	mechlist_t	*phead; /* the current and resulting disabled list */
5737968Sopensolaris@drydog.com 	mechlist_t	*ptr = NULL;
5747968Sopensolaris@drydog.com 	mechlist_t	*pcur = NULL;
5757968Sopensolaris@drydog.com 	boolean_t	found;
5760Sstevel@tonic-gate 
5770Sstevel@tonic-gate 	pent = *ppent;
5780Sstevel@tonic-gate 	if (pent == NULL) {
5790Sstevel@tonic-gate 		return (FAILURE);
5800Sstevel@tonic-gate 	}
5810Sstevel@tonic-gate 
5820Sstevel@tonic-gate 	if (allflag) {
5830Sstevel@tonic-gate 		free_mechlist(pent->dislist);
5840Sstevel@tonic-gate 		pent->dis_count = 0;
5850Sstevel@tonic-gate 		pent->dislist = NULL;
5860Sstevel@tonic-gate 		return (SUCCESS);
5870Sstevel@tonic-gate 	}
5880Sstevel@tonic-gate 
5890Sstevel@tonic-gate 	/*
5900Sstevel@tonic-gate 	 * for each mechanism in the to-be-enabled mechanism list,
5910Sstevel@tonic-gate 	 * -	check if it is in the current disabled list
5920Sstevel@tonic-gate 	 * -	if found, delete it from the disabled list
5937968Sopensolaris@drydog.com 	 *	otherwise, give a warning.
5940Sstevel@tonic-gate 	 */
5950Sstevel@tonic-gate 	ptr = mlist;
5960Sstevel@tonic-gate 	while (ptr != NULL) {
5970Sstevel@tonic-gate 		found = B_FALSE;
5980Sstevel@tonic-gate 		phead = pcur =  pent->dislist;
5990Sstevel@tonic-gate 		while (!found && pcur) {
6000Sstevel@tonic-gate 			if (strcmp(pcur->name, ptr->name) == 0) {
6010Sstevel@tonic-gate 				found = B_TRUE;
6020Sstevel@tonic-gate 			} else {
6030Sstevel@tonic-gate 				phead = pcur;
6040Sstevel@tonic-gate 				pcur = pcur->next;
6050Sstevel@tonic-gate 			}
6060Sstevel@tonic-gate 		}
6070Sstevel@tonic-gate 
6080Sstevel@tonic-gate 		if (found) {
6090Sstevel@tonic-gate 			if (phead == pcur) {
6100Sstevel@tonic-gate 				pent->dislist = pent->dislist->next;
6110Sstevel@tonic-gate 				free(pcur);
6120Sstevel@tonic-gate 			} else {
6130Sstevel@tonic-gate 				phead->next = pcur->next;
6140Sstevel@tonic-gate 				free(pcur);
6150Sstevel@tonic-gate 			}
6160Sstevel@tonic-gate 			pent->dis_count--;
6170Sstevel@tonic-gate 		} else {
6180Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext(
6190Sstevel@tonic-gate 			    "(Warning) %1$s is either enabled already or not "
6200Sstevel@tonic-gate 			    "a valid mechanism for %2$s"), ptr->name,
6210Sstevel@tonic-gate 			    pent->name);
6220Sstevel@tonic-gate 		}
6230Sstevel@tonic-gate 		ptr = ptr->next;
6240Sstevel@tonic-gate 	}
6250Sstevel@tonic-gate 
6260Sstevel@tonic-gate 	if (pent->dis_count == 0) {
6270Sstevel@tonic-gate 		pent->dislist = NULL;
6280Sstevel@tonic-gate 	}
6290Sstevel@tonic-gate 
6300Sstevel@tonic-gate 	return (SUCCESS);
6310Sstevel@tonic-gate 
6320Sstevel@tonic-gate }
6330Sstevel@tonic-gate 
6340Sstevel@tonic-gate 
6357968Sopensolaris@drydog.com /*
6367968Sopensolaris@drydog.com  * Determine if the kernel provider name, path, is a device
6377968Sopensolaris@drydog.com  * (that is, it contains a slash character (e.g., "mca/0").
6387968Sopensolaris@drydog.com  * If so, it is a hardware provider; otherwise it is a software provider.
6397968Sopensolaris@drydog.com  */
6400Sstevel@tonic-gate boolean_t
6410Sstevel@tonic-gate is_device(char *path)
6420Sstevel@tonic-gate {
6430Sstevel@tonic-gate 	if (strchr(path, SEP_SLASH) != NULL) {
6440Sstevel@tonic-gate 		return (B_TRUE);
6450Sstevel@tonic-gate 	} else {
6460Sstevel@tonic-gate 		return (B_FALSE);
6470Sstevel@tonic-gate 	}
6480Sstevel@tonic-gate }
6490Sstevel@tonic-gate 
6500Sstevel@tonic-gate /*
6510Sstevel@tonic-gate  * Split a hardware provider name with the "name/inst_num" format into
6527968Sopensolaris@drydog.com  * a name and a number (e.g., split "mca/0" into "mca" instance 0).
6530Sstevel@tonic-gate  */
6540Sstevel@tonic-gate int
6550Sstevel@tonic-gate split_hw_provname(char *provname, char *pname, int *inst_num)
6560Sstevel@tonic-gate {
6570Sstevel@tonic-gate 	char	name[MAXNAMELEN];
6580Sstevel@tonic-gate 	char	*inst_str;
6590Sstevel@tonic-gate 
6600Sstevel@tonic-gate 	if (provname == NULL) {
6610Sstevel@tonic-gate 		return (FAILURE);
6620Sstevel@tonic-gate 	}
6630Sstevel@tonic-gate 
6640Sstevel@tonic-gate 	(void) strlcpy(name, provname, MAXNAMELEN);
6650Sstevel@tonic-gate 	if (strtok(name, "/") == NULL) {
6660Sstevel@tonic-gate 		return (FAILURE);
6670Sstevel@tonic-gate 	}
6680Sstevel@tonic-gate 
6690Sstevel@tonic-gate 	if ((inst_str = strtok(NULL, "/")) == NULL) {
6700Sstevel@tonic-gate 		return (FAILURE);
6710Sstevel@tonic-gate 	}
6720Sstevel@tonic-gate 
6730Sstevel@tonic-gate 	(void) strlcpy(pname, name, MAXNAMELEN);
6740Sstevel@tonic-gate 	*inst_num = atoi(inst_str);
6750Sstevel@tonic-gate 
6760Sstevel@tonic-gate 	return (SUCCESS);
6770Sstevel@tonic-gate }
6780Sstevel@tonic-gate 
6790Sstevel@tonic-gate 
6800Sstevel@tonic-gate /*
6817968Sopensolaris@drydog.com  * Retrieve information from kcf.conf and build a hardware device entry list
6827968Sopensolaris@drydog.com  * and a software entry list of kernel crypto providers.
6837968Sopensolaris@drydog.com  *
6847968Sopensolaris@drydog.com  * This list is usually incomplete, as kernel crypto providers only have to
6857968Sopensolaris@drydog.com  * be listed in kcf.conf if a mechanism is disabled (by cryptoadm) or
6867968Sopensolaris@drydog.com  * if the kernel provider module is not one of the default kernel providers.
6877968Sopensolaris@drydog.com  *
6887968Sopensolaris@drydog.com  * The kcf.conf file is available only in the global zone.
6890Sstevel@tonic-gate  */
6900Sstevel@tonic-gate int
69110979SHai-May.Chao@Sun.COM get_kcfconf_info(entrylist_t **ppdevlist, entrylist_t **ppsoftlist)
6920Sstevel@tonic-gate {
6937968Sopensolaris@drydog.com 	FILE	*pfile = NULL;
6947968Sopensolaris@drydog.com 	char	buffer[BUFSIZ];
6957968Sopensolaris@drydog.com 	int	len;
6967968Sopensolaris@drydog.com 	entry_t	*pent = NULL;
6977968Sopensolaris@drydog.com 	int	rc = SUCCESS;
6980Sstevel@tonic-gate 
6990Sstevel@tonic-gate 	if ((pfile = fopen(_PATH_KCF_CONF, "r")) == NULL) {
7000Sstevel@tonic-gate 		cryptodebug("failed to open the kcf.conf file for read only");
7010Sstevel@tonic-gate 		return (FAILURE);
7020Sstevel@tonic-gate 	}
7030Sstevel@tonic-gate 
7040Sstevel@tonic-gate 	*ppdevlist = NULL;
7050Sstevel@tonic-gate 	*ppsoftlist = NULL;
7060Sstevel@tonic-gate 	while (fgets(buffer, BUFSIZ, pfile) != NULL) {
7070Sstevel@tonic-gate 		if (buffer[0] == '#' || buffer[0] == ' ' ||
7080Sstevel@tonic-gate 		    buffer[0] == '\n'|| buffer[0] == '\t') {
7090Sstevel@tonic-gate 			continue;   /* ignore comment lines */
7100Sstevel@tonic-gate 		}
7110Sstevel@tonic-gate 
7120Sstevel@tonic-gate 		len = strlen(buffer);
7137968Sopensolaris@drydog.com 		if (buffer[len - 1] == '\n') { /* get rid of trailing '\n' */
7140Sstevel@tonic-gate 			len--;
7150Sstevel@tonic-gate 		}
7160Sstevel@tonic-gate 		buffer[len] = '\0';
7170Sstevel@tonic-gate 
7180Sstevel@tonic-gate 		if ((rc = interpret(buffer,  &pent)) == SUCCESS) {
71910979SHai-May.Chao@Sun.COM 			if (is_device(pent->name)) {
7200Sstevel@tonic-gate 				rc = build_entrylist(pent, ppdevlist);
7210Sstevel@tonic-gate 			} else {
7220Sstevel@tonic-gate 				rc = build_entrylist(pent, ppsoftlist);
7230Sstevel@tonic-gate 			}
7240Sstevel@tonic-gate 		} else {
7250Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext(
7260Sstevel@tonic-gate 			    "failed to parse configuration."));
7270Sstevel@tonic-gate 		}
7280Sstevel@tonic-gate 
7290Sstevel@tonic-gate 		if (rc != SUCCESS) {
7300Sstevel@tonic-gate 			free_entrylist(*ppdevlist);
7310Sstevel@tonic-gate 			free_entrylist(*ppsoftlist);
7320Sstevel@tonic-gate 			free_entry(pent);
7330Sstevel@tonic-gate 			break;
7340Sstevel@tonic-gate 		}
7350Sstevel@tonic-gate 	}
7360Sstevel@tonic-gate 
7370Sstevel@tonic-gate 	(void) fclose(pfile);
7380Sstevel@tonic-gate 	return (rc);
7390Sstevel@tonic-gate }
7400Sstevel@tonic-gate 
7410Sstevel@tonic-gate /*
7420Sstevel@tonic-gate  * Retrieve information from admin device and build a device entry list and
7437968Sopensolaris@drydog.com  * a software entry list.  This is used where there is no kcf.conf, e.g., the
7440Sstevel@tonic-gate  * non-global zone.
7450Sstevel@tonic-gate  */
7460Sstevel@tonic-gate int
7470Sstevel@tonic-gate get_admindev_info(entrylist_t **ppdevlist, entrylist_t **ppsoftlist)
7480Sstevel@tonic-gate {
7497968Sopensolaris@drydog.com 	crypto_get_dev_list_t	*pdevlist_kernel = NULL;
7507968Sopensolaris@drydog.com 	crypto_get_soft_list_t	*psoftlist_kernel = NULL;
7517968Sopensolaris@drydog.com 	char			*devname;
7527968Sopensolaris@drydog.com 	int			inst_num;
7537968Sopensolaris@drydog.com 	int			mcount;
7547968Sopensolaris@drydog.com 	mechlist_t		*pmech = NULL;
7557968Sopensolaris@drydog.com 	entry_t			*pent_dev = NULL, *pent_soft = NULL;
7567968Sopensolaris@drydog.com 	int			i;
7577968Sopensolaris@drydog.com 	char			*psoftname;
7587968Sopensolaris@drydog.com 	entrylist_t		*tmp_pdev = NULL;
7597968Sopensolaris@drydog.com 	entrylist_t		*tmp_psoft = NULL;
7607968Sopensolaris@drydog.com 	entrylist_t		*phardlist = NULL, *psoftlist = NULL;
7610Sstevel@tonic-gate 
7627968Sopensolaris@drydog.com 	/*
7637968Sopensolaris@drydog.com 	 * Get hardware providers
7647968Sopensolaris@drydog.com 	 */
7650Sstevel@tonic-gate 	if (get_dev_list(&pdevlist_kernel) != SUCCESS) {
7660Sstevel@tonic-gate 		cryptodebug("failed to get hardware provider list from kernel");
7670Sstevel@tonic-gate 		return (FAILURE);
7680Sstevel@tonic-gate 	}
7690Sstevel@tonic-gate 
7700Sstevel@tonic-gate 	for (i = 0; i < pdevlist_kernel->dl_dev_count; i++) {
7710Sstevel@tonic-gate 		devname = pdevlist_kernel->dl_devs[i].le_dev_name;
7720Sstevel@tonic-gate 		inst_num = pdevlist_kernel->dl_devs[i].le_dev_instance;
7730Sstevel@tonic-gate 		mcount = pdevlist_kernel->dl_devs[i].le_mechanism_count;
7740Sstevel@tonic-gate 
7750Sstevel@tonic-gate 		pmech = NULL;
7760Sstevel@tonic-gate 		if (get_dev_info(devname, inst_num, mcount, &pmech) !=
7770Sstevel@tonic-gate 		    SUCCESS) {
7780Sstevel@tonic-gate 			cryptodebug(
7790Sstevel@tonic-gate 			    "failed to retrieve the mechanism list for %s/%d.",
7800Sstevel@tonic-gate 			    devname, inst_num);
7810Sstevel@tonic-gate 			goto fail_out;
7820Sstevel@tonic-gate 		}
7830Sstevel@tonic-gate 
7847968Sopensolaris@drydog.com 		if ((pent_dev = create_entry(devname)) == NULL) {
7850Sstevel@tonic-gate 			cryptodebug("out of memory.");
7860Sstevel@tonic-gate 			free_mechlist(pmech);
7870Sstevel@tonic-gate 			goto fail_out;
7880Sstevel@tonic-gate 		}
7897968Sopensolaris@drydog.com 		pent_dev->suplist = pmech;
7907968Sopensolaris@drydog.com 		pent_dev->sup_count = mcount;
7910Sstevel@tonic-gate 
7927968Sopensolaris@drydog.com 		if (build_entrylist(pent_dev, &tmp_pdev) != SUCCESS) {
7930Sstevel@tonic-gate 			goto fail_out;
7940Sstevel@tonic-gate 		}
7950Sstevel@tonic-gate 	}
7960Sstevel@tonic-gate 
7970Sstevel@tonic-gate 	free(pdevlist_kernel);
7980Sstevel@tonic-gate 	pdevlist_kernel = NULL;
7990Sstevel@tonic-gate 
8007968Sopensolaris@drydog.com 	/*
8017968Sopensolaris@drydog.com 	 * Get software providers
8027968Sopensolaris@drydog.com 	 */
8037968Sopensolaris@drydog.com 	if (getzoneid() == GLOBAL_ZONEID) {
80410979SHai-May.Chao@Sun.COM 		if (get_kcfconf_info(&phardlist, &psoftlist) != SUCCESS) {
8057968Sopensolaris@drydog.com 			goto fail_out;
8067968Sopensolaris@drydog.com 		}
8077968Sopensolaris@drydog.com 	}
8087968Sopensolaris@drydog.com 
8090Sstevel@tonic-gate 	if (get_soft_list(&psoftlist_kernel) != SUCCESS) {
8100Sstevel@tonic-gate 		cryptodebug("failed to get software provider list from kernel");
8110Sstevel@tonic-gate 		goto fail_out;
8120Sstevel@tonic-gate 	}
8130Sstevel@tonic-gate 
8140Sstevel@tonic-gate 	for (i = 0, psoftname = psoftlist_kernel->sl_soft_names;
8150Sstevel@tonic-gate 	    i < psoftlist_kernel->sl_soft_count;
8160Sstevel@tonic-gate 	    i++, psoftname = psoftname + strlen(psoftname) + 1) {
8170Sstevel@tonic-gate 		pmech = NULL;
81810979SHai-May.Chao@Sun.COM 		if (get_soft_info(psoftname, &pmech, phardlist, psoftlist) !=
81910979SHai-May.Chao@Sun.COM 		    SUCCESS) {
8200Sstevel@tonic-gate 			cryptodebug(
8210Sstevel@tonic-gate 			    "failed to retrieve the mechanism list for %s.",
8220Sstevel@tonic-gate 			    psoftname);
8230Sstevel@tonic-gate 			goto fail_out;
8240Sstevel@tonic-gate 		}
8250Sstevel@tonic-gate 
8267968Sopensolaris@drydog.com 		if ((pent_soft = create_entry(psoftname)) == NULL) {
8270Sstevel@tonic-gate 			cryptodebug("out of memory.");
8280Sstevel@tonic-gate 			free_mechlist(pmech);
8290Sstevel@tonic-gate 			goto fail_out;
8300Sstevel@tonic-gate 		}
8317968Sopensolaris@drydog.com 		pent_soft->suplist = pmech;
8327968Sopensolaris@drydog.com 		pent_soft->sup_count = get_mech_count(pmech);
8330Sstevel@tonic-gate 
8347968Sopensolaris@drydog.com 		if (build_entrylist(pent_soft, &tmp_psoft) != SUCCESS) {
8350Sstevel@tonic-gate 			goto fail_out;
8360Sstevel@tonic-gate 		}
8370Sstevel@tonic-gate 	}
8380Sstevel@tonic-gate 
8390Sstevel@tonic-gate 	free(psoftlist_kernel);
8400Sstevel@tonic-gate 	psoftlist_kernel = NULL;
8410Sstevel@tonic-gate 
8420Sstevel@tonic-gate 	*ppdevlist = tmp_pdev;
8430Sstevel@tonic-gate 	*ppsoftlist = tmp_psoft;
8440Sstevel@tonic-gate 
8450Sstevel@tonic-gate 	return (SUCCESS);
8460Sstevel@tonic-gate 
8470Sstevel@tonic-gate fail_out:
8487968Sopensolaris@drydog.com 	if (pent_dev != NULL)
8497968Sopensolaris@drydog.com 		free_entry(pent_dev);
8507968Sopensolaris@drydog.com 	if (pent_soft != NULL)
8517968Sopensolaris@drydog.com 		free_entry(pent_soft);
8520Sstevel@tonic-gate 
8530Sstevel@tonic-gate 	free_entrylist(tmp_pdev);
8540Sstevel@tonic-gate 	free_entrylist(tmp_psoft);
8550Sstevel@tonic-gate 
8560Sstevel@tonic-gate 	if (pdevlist_kernel != NULL)
8570Sstevel@tonic-gate 		free(pdevlist_kernel);
8580Sstevel@tonic-gate 	if (psoftlist_kernel != NULL)
8590Sstevel@tonic-gate 		free(psoftlist_kernel);
8600Sstevel@tonic-gate 
8610Sstevel@tonic-gate 	return (FAILURE);
8620Sstevel@tonic-gate }
8630Sstevel@tonic-gate 
8640Sstevel@tonic-gate /*
8657968Sopensolaris@drydog.com  * Return configuration information for a kernel provider from kcf.conf.
8667968Sopensolaris@drydog.com  * For kernel software providers return a enabled list and disabled list.
8677968Sopensolaris@drydog.com  * For kernel hardware providers return just a disabled list.
8687968Sopensolaris@drydog.com  *
8697968Sopensolaris@drydog.com  * Parameters phardlist and psoftlist are supplied by get_kcfconf_info().
8707968Sopensolaris@drydog.com  * If NULL, this function calls get_kcfconf_info() internally.
8710Sstevel@tonic-gate  */
8720Sstevel@tonic-gate entry_t *
87310979SHai-May.Chao@Sun.COM getent_kef(char *provname, entrylist_t *phardlist, entrylist_t *psoftlist)
8740Sstevel@tonic-gate {
8757968Sopensolaris@drydog.com 	entry_t		*pent = NULL;
8767968Sopensolaris@drydog.com 	boolean_t	memory_allocated = B_FALSE;
8770Sstevel@tonic-gate 
87810979SHai-May.Chao@Sun.COM 	if ((phardlist == NULL) || (psoftlist == NULL)) {
87910979SHai-May.Chao@Sun.COM 		if (get_kcfconf_info(&phardlist, &psoftlist) != SUCCESS) {
8807968Sopensolaris@drydog.com 			return (NULL);
8817968Sopensolaris@drydog.com 		}
8827968Sopensolaris@drydog.com 		memory_allocated = B_TRUE;
8830Sstevel@tonic-gate 	}
8840Sstevel@tonic-gate 
8850Sstevel@tonic-gate 	if (is_device(provname)) {
8867968Sopensolaris@drydog.com 		pent = getent(provname, phardlist);
8870Sstevel@tonic-gate 	} else {
8880Sstevel@tonic-gate 		pent = getent(provname, psoftlist);
8890Sstevel@tonic-gate 	}
8900Sstevel@tonic-gate 
8917968Sopensolaris@drydog.com 	if (memory_allocated) {
8927968Sopensolaris@drydog.com 		free_entrylist(phardlist);
8937968Sopensolaris@drydog.com 		free_entrylist(psoftlist);
8947968Sopensolaris@drydog.com 	}
8950Sstevel@tonic-gate 
8960Sstevel@tonic-gate 	return (pent);
8970Sstevel@tonic-gate }
8980Sstevel@tonic-gate 
8990Sstevel@tonic-gate /*
9000Sstevel@tonic-gate  * Print out the provider name and the mechanism list.
9010Sstevel@tonic-gate  */
9020Sstevel@tonic-gate void
9030Sstevel@tonic-gate print_mechlist(char *provname, mechlist_t *pmechlist)
9040Sstevel@tonic-gate {
9057968Sopensolaris@drydog.com 	mechlist_t *ptr = NULL;
9060Sstevel@tonic-gate 
9070Sstevel@tonic-gate 	if (provname == NULL) {
9080Sstevel@tonic-gate 		return;
9090Sstevel@tonic-gate 	}
9100Sstevel@tonic-gate 
9110Sstevel@tonic-gate 	(void) printf("%s: ", provname);
9120Sstevel@tonic-gate 	if (pmechlist == NULL) {
9130Sstevel@tonic-gate 		(void) printf(gettext("No mechanisms presented.\n"));
9140Sstevel@tonic-gate 		return;
9150Sstevel@tonic-gate 	}
9160Sstevel@tonic-gate 
9170Sstevel@tonic-gate 	ptr = pmechlist;
9180Sstevel@tonic-gate 	while (ptr != NULL) {
9190Sstevel@tonic-gate 		(void) printf("%s", ptr->name);
9200Sstevel@tonic-gate 		ptr = ptr->next;
9210Sstevel@tonic-gate 		if (ptr == NULL) {
9220Sstevel@tonic-gate 			(void) printf("\n");
9230Sstevel@tonic-gate 		} else {
9240Sstevel@tonic-gate 			(void) printf(",");
9250Sstevel@tonic-gate 		}
9260Sstevel@tonic-gate 	}
9270Sstevel@tonic-gate }
9280Sstevel@tonic-gate 
9290Sstevel@tonic-gate 
9300Sstevel@tonic-gate /*
9317968Sopensolaris@drydog.com  * Update the kcf.conf file based on the update mode:
9327968Sopensolaris@drydog.com  * - If update_mode is MODIFY_MODE, modify the entry with the same name.
9337968Sopensolaris@drydog.com  *   If not found, append a new entry to the kcf.conf file.
9347968Sopensolaris@drydog.com  * - If update_mode is DELETE_MODE, delete the entry with the same name.
9357968Sopensolaris@drydog.com  * - If update_mode is ADD_MODE, append a new entry to the kcf.conf file.
9360Sstevel@tonic-gate  */
9370Sstevel@tonic-gate int
9380Sstevel@tonic-gate update_kcfconf(entry_t *pent, int update_mode)
9390Sstevel@tonic-gate {
9400Sstevel@tonic-gate 	boolean_t	add_it = B_FALSE;
9410Sstevel@tonic-gate 	boolean_t	delete_it = B_FALSE;
9428273Sopensolaris@drydog.com 	boolean_t	this_entry_matches = B_FALSE;
9430Sstevel@tonic-gate 	boolean_t	found_entry = B_FALSE;
9447968Sopensolaris@drydog.com 	FILE		*pfile = NULL;
9457968Sopensolaris@drydog.com 	FILE		*pfile_tmp = NULL;
9467968Sopensolaris@drydog.com 	char		buffer[BUFSIZ];
9477968Sopensolaris@drydog.com 	char		buffer2[BUFSIZ];
9487968Sopensolaris@drydog.com 	char		tmpfile_name[MAXPATHLEN];
9497968Sopensolaris@drydog.com 	char		*name;
9507968Sopensolaris@drydog.com 	char		*new_str = NULL;
9517968Sopensolaris@drydog.com 	int		rc = SUCCESS;
9520Sstevel@tonic-gate 
9530Sstevel@tonic-gate 	if (pent == NULL) {
9540Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("internal error."));
9550Sstevel@tonic-gate 		return (FAILURE);
9560Sstevel@tonic-gate 	}
9570Sstevel@tonic-gate 
9580Sstevel@tonic-gate 	/* Check the update_mode */
9597968Sopensolaris@drydog.com 	switch (update_mode) {
9607968Sopensolaris@drydog.com 	case ADD_MODE:
9610Sstevel@tonic-gate 		add_it = B_TRUE;
9627968Sopensolaris@drydog.com 		/* FALLTHROUGH */
9637968Sopensolaris@drydog.com 	case MODIFY_MODE:
9647968Sopensolaris@drydog.com 		/* Convert the entry a string to add to kcf.conf  */
9650Sstevel@tonic-gate 		if ((new_str = ent2str(pent)) == NULL) {
9660Sstevel@tonic-gate 			return (FAILURE);
9670Sstevel@tonic-gate 		}
9687968Sopensolaris@drydog.com 		break;
9697968Sopensolaris@drydog.com 	case DELETE_MODE:
9700Sstevel@tonic-gate 		delete_it = B_TRUE;
9717968Sopensolaris@drydog.com 		break;
9727968Sopensolaris@drydog.com 	default:
9730Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("internal error."));
9740Sstevel@tonic-gate 		return (FAILURE);
9750Sstevel@tonic-gate 	}
9760Sstevel@tonic-gate 
9770Sstevel@tonic-gate 	/* Open the kcf.conf file */
9780Sstevel@tonic-gate 	if ((pfile = fopen(_PATH_KCF_CONF, "r+")) == NULL) {
9790Sstevel@tonic-gate 		err = errno;
9800Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
9810Sstevel@tonic-gate 		    gettext("failed to update the configuration - %s"),
9820Sstevel@tonic-gate 		    strerror(err));
9830Sstevel@tonic-gate 		cryptodebug("failed to open %s for write.", _PATH_KCF_CONF);
9840Sstevel@tonic-gate 		return (FAILURE);
9850Sstevel@tonic-gate 	}
9860Sstevel@tonic-gate 
9870Sstevel@tonic-gate 	/* Lock the kcf.conf file */
9880Sstevel@tonic-gate 	if (lockf(fileno(pfile), F_TLOCK, 0) == -1) {
9890Sstevel@tonic-gate 		err = errno;
9900Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
9910Sstevel@tonic-gate 		    gettext("failed to update the configuration - %s"),
9927968Sopensolaris@drydog.com 		    strerror(err));
9930Sstevel@tonic-gate 		(void) fclose(pfile);
9940Sstevel@tonic-gate 		return (FAILURE);
9950Sstevel@tonic-gate 	}
9960Sstevel@tonic-gate 
9970Sstevel@tonic-gate 	/*
9980Sstevel@tonic-gate 	 * Create a temporary file in the /etc/crypto directory to save
9990Sstevel@tonic-gate 	 * updated configuration file first.
10000Sstevel@tonic-gate 	 */
10010Sstevel@tonic-gate 	(void) strlcpy(tmpfile_name, TMPFILE_TEMPLATE, sizeof (tmpfile_name));
10020Sstevel@tonic-gate 	if (mkstemp(tmpfile_name) == -1) {
10030Sstevel@tonic-gate 		err = errno;
10040Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
10050Sstevel@tonic-gate 		    gettext("failed to create a temporary file - %s"),
10060Sstevel@tonic-gate 		    strerror(err));
10070Sstevel@tonic-gate 		(void) fclose(pfile);
10080Sstevel@tonic-gate 		return (FAILURE);
10090Sstevel@tonic-gate 	}
10100Sstevel@tonic-gate 
10110Sstevel@tonic-gate 	if ((pfile_tmp = fopen(tmpfile_name, "w")) == NULL) {
10120Sstevel@tonic-gate 		err = errno;
10130Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("failed to open %s - %s"),
10140Sstevel@tonic-gate 		    tmpfile_name, strerror(err));
10150Sstevel@tonic-gate 		(void) fclose(pfile);
10160Sstevel@tonic-gate 		return (FAILURE);
10170Sstevel@tonic-gate 	}
10180Sstevel@tonic-gate 
10190Sstevel@tonic-gate 	/*
10200Sstevel@tonic-gate 	 * Loop thru the entire kcf.conf file, insert, modify or delete
10210Sstevel@tonic-gate 	 * an entry.
10220Sstevel@tonic-gate 	 */
10230Sstevel@tonic-gate 	while (fgets(buffer, BUFSIZ, pfile) != NULL) {
10240Sstevel@tonic-gate 		if (add_it) {
10250Sstevel@tonic-gate 			if (fputs(buffer, pfile_tmp) == EOF) {
10260Sstevel@tonic-gate 				err = errno;
10270Sstevel@tonic-gate 				cryptoerror(LOG_STDERR, gettext(
10280Sstevel@tonic-gate 				    "failed to write to a temp file: %s."),
10290Sstevel@tonic-gate 				    strerror(err));
10300Sstevel@tonic-gate 				rc = FAILURE;
10310Sstevel@tonic-gate 				break;
10320Sstevel@tonic-gate 			}
10330Sstevel@tonic-gate 
10340Sstevel@tonic-gate 		} else { /* modify or delete */
10358273Sopensolaris@drydog.com 			this_entry_matches = B_FALSE;
10367968Sopensolaris@drydog.com 
10370Sstevel@tonic-gate 			if (!(buffer[0] == '#' || buffer[0] == ' ' ||
10380Sstevel@tonic-gate 			    buffer[0] == '\n'|| buffer[0] == '\t')) {
10390Sstevel@tonic-gate 				/*
10400Sstevel@tonic-gate 				 * Get the provider name from this line and
10410Sstevel@tonic-gate 				 * check if this is the entry to be updated
10420Sstevel@tonic-gate 				 * or deleted. Note: can not use "buffer"
10430Sstevel@tonic-gate 				 * directly because strtok will change its
10440Sstevel@tonic-gate 				 * value.
10450Sstevel@tonic-gate 				 */
10460Sstevel@tonic-gate 				(void) strlcpy(buffer2, buffer, BUFSIZ);
10470Sstevel@tonic-gate 				if ((name = strtok(buffer2, SEP_COLON)) ==
10480Sstevel@tonic-gate 				    NULL) {
10490Sstevel@tonic-gate 					rc = FAILURE;
10500Sstevel@tonic-gate 					break;
10510Sstevel@tonic-gate 				}
10520Sstevel@tonic-gate 
10530Sstevel@tonic-gate 				if (strcmp(pent->name, name) == 0) {
10548273Sopensolaris@drydog.com 					this_entry_matches = B_TRUE;
10550Sstevel@tonic-gate 					found_entry = B_TRUE;
10560Sstevel@tonic-gate 				}
10570Sstevel@tonic-gate 			}
10580Sstevel@tonic-gate 
10590Sstevel@tonic-gate 
10608273Sopensolaris@drydog.com 			if (!this_entry_matches || !delete_it) {
10618273Sopensolaris@drydog.com 				/* write this entry */
10628273Sopensolaris@drydog.com 				if (this_entry_matches) {
10638273Sopensolaris@drydog.com 					/*
10648273Sopensolaris@drydog.com 					 * Modify this entry: get the
10658273Sopensolaris@drydog.com 					 * updated string and place into buffer.
10668273Sopensolaris@drydog.com 					 */
10678273Sopensolaris@drydog.com 					(void) strlcpy(buffer, new_str, BUFSIZ);
10688273Sopensolaris@drydog.com 					free(new_str);
10698273Sopensolaris@drydog.com 				}
10708273Sopensolaris@drydog.com 				/* write the (unchanged or modified) entry */
10710Sstevel@tonic-gate 				if (fputs(buffer, pfile_tmp) == EOF) {
10720Sstevel@tonic-gate 					err = errno;
10730Sstevel@tonic-gate 					cryptoerror(LOG_STDERR, gettext(
10740Sstevel@tonic-gate 					    "failed to write to a temp file: "
10750Sstevel@tonic-gate 					    "%s."), strerror(err));
10760Sstevel@tonic-gate 					rc = FAILURE;
10770Sstevel@tonic-gate 					break;
10780Sstevel@tonic-gate 				}
10790Sstevel@tonic-gate 			}
10800Sstevel@tonic-gate 		}
10810Sstevel@tonic-gate 	}
10820Sstevel@tonic-gate 
10837968Sopensolaris@drydog.com 	if ((!delete_it) && (rc != FAILURE)) {
10847968Sopensolaris@drydog.com 		if (add_it || !found_entry) {
10857968Sopensolaris@drydog.com 			/* append new entry to end of file */
10867968Sopensolaris@drydog.com 			if (fputs(new_str, pfile_tmp) == EOF) {
10877968Sopensolaris@drydog.com 				err = errno;
10887968Sopensolaris@drydog.com 				cryptoerror(LOG_STDERR, gettext(
10897968Sopensolaris@drydog.com 				    "failed to write to a temp file: %s."),
10907968Sopensolaris@drydog.com 				    strerror(err));
10917968Sopensolaris@drydog.com 				rc = FAILURE;
10927968Sopensolaris@drydog.com 			}
10937968Sopensolaris@drydog.com 			free(new_str);
10940Sstevel@tonic-gate 		}
10950Sstevel@tonic-gate 	}
10960Sstevel@tonic-gate 
10970Sstevel@tonic-gate 	(void) fclose(pfile);
10980Sstevel@tonic-gate 	if (fclose(pfile_tmp) != 0) {
10990Sstevel@tonic-gate 		err = errno;
11000Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
11010Sstevel@tonic-gate 		    gettext("failed to close %s: %s"), tmpfile_name,
11020Sstevel@tonic-gate 		    strerror(err));
11030Sstevel@tonic-gate 		return (FAILURE);
11040Sstevel@tonic-gate 	}
11050Sstevel@tonic-gate 
11060Sstevel@tonic-gate 	/* Copy the temporary file to the kcf.conf file */
11070Sstevel@tonic-gate 	if (rename(tmpfile_name, _PATH_KCF_CONF) == -1) {
11080Sstevel@tonic-gate 		err = errno;
11090Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
11100Sstevel@tonic-gate 		    gettext("failed to update the configuration - %s"),
11110Sstevel@tonic-gate 		    strerror(err));
11120Sstevel@tonic-gate 		cryptodebug("failed to rename %s to %s: %s", tmpfile,
11130Sstevel@tonic-gate 		    _PATH_KCF_CONF, strerror(err));
11140Sstevel@tonic-gate 		rc = FAILURE;
11150Sstevel@tonic-gate 	} else if (chmod(_PATH_KCF_CONF,
11160Sstevel@tonic-gate 	    S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH) == -1) {
11170Sstevel@tonic-gate 		err = errno;
11180Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
11190Sstevel@tonic-gate 		    gettext("failed to update the configuration - %s"),
11200Sstevel@tonic-gate 		    strerror(err));
11210Sstevel@tonic-gate 		cryptodebug("failed to chmod to %s: %s", _PATH_KCF_CONF,
11220Sstevel@tonic-gate 		    strerror(err));
11230Sstevel@tonic-gate 		rc = FAILURE;
11240Sstevel@tonic-gate 	} else {
11250Sstevel@tonic-gate 		rc = SUCCESS;
11260Sstevel@tonic-gate 	}
11270Sstevel@tonic-gate 
11280Sstevel@tonic-gate 	if ((rc == FAILURE) && (unlink(tmpfile_name) != 0)) {
11290Sstevel@tonic-gate 		err = errno;
11300Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext(
11310Sstevel@tonic-gate 		    "(Warning) failed to remove %s: %s"),
11320Sstevel@tonic-gate 		    tmpfile_name, strerror(err));
11330Sstevel@tonic-gate 	}
11340Sstevel@tonic-gate 
11350Sstevel@tonic-gate 	return (rc);
11360Sstevel@tonic-gate }
11370Sstevel@tonic-gate 
11380Sstevel@tonic-gate 
11390Sstevel@tonic-gate /*
11400Sstevel@tonic-gate  * Disable the mechanisms for the provider pointed by *ppent.  If allflag is
11410Sstevel@tonic-gate  * TRUE, disable all.  Otherwise, disable the mechanisms specified in the
11420Sstevel@tonic-gate  * dislist argument.  The "infolist" argument contains the mechanism list
11430Sstevel@tonic-gate  * supported by this provider.
11440Sstevel@tonic-gate  */
11450Sstevel@tonic-gate int
11460Sstevel@tonic-gate disable_mechs(entry_t **ppent, mechlist_t *infolist, boolean_t allflag,
11470Sstevel@tonic-gate mechlist_t *dislist)
11480Sstevel@tonic-gate {
11497968Sopensolaris@drydog.com 	entry_t		*pent;
11507968Sopensolaris@drydog.com 	mechlist_t	*plist = NULL;
11517968Sopensolaris@drydog.com 	mechlist_t	*phead = NULL;
11527968Sopensolaris@drydog.com 	mechlist_t	*pmech = NULL;
11537968Sopensolaris@drydog.com 	int		rc = SUCCESS;
11540Sstevel@tonic-gate 
11550Sstevel@tonic-gate 	pent = *ppent;
11560Sstevel@tonic-gate 	if (pent == NULL) {
11570Sstevel@tonic-gate 		return (FAILURE);
11580Sstevel@tonic-gate 	}
11590Sstevel@tonic-gate 
11600Sstevel@tonic-gate 	if (allflag) {
11610Sstevel@tonic-gate 		free_mechlist(pent->dislist);
11620Sstevel@tonic-gate 		pent->dis_count = get_mech_count(infolist);
11630Sstevel@tonic-gate 		if (!(pent->dislist = dup_mechlist(infolist))) {
11640Sstevel@tonic-gate 			return (FAILURE);
11650Sstevel@tonic-gate 		} else {
11660Sstevel@tonic-gate 			return (SUCCESS);
11670Sstevel@tonic-gate 		}
11680Sstevel@tonic-gate 	}
11690Sstevel@tonic-gate 
11700Sstevel@tonic-gate 	/*
11710Sstevel@tonic-gate 	 * Not disable all. Now loop thru the mechanisms specified in the
11720Sstevel@tonic-gate 	 * dislist.  If the mechanism is not supported by the provider,
11730Sstevel@tonic-gate 	 * ignore it with a warning.  If the mechanism is disabled already,
11740Sstevel@tonic-gate 	 * do nothing. Otherwise, prepend it to the beginning of the disabled
11750Sstevel@tonic-gate 	 * list of the provider.
11760Sstevel@tonic-gate 	 */
11770Sstevel@tonic-gate 	plist = dislist;
11780Sstevel@tonic-gate 	while (plist != NULL) {
11790Sstevel@tonic-gate 		if (!is_in_list(plist->name, infolist)) {
11800Sstevel@tonic-gate 			cryptoerror(LOG_STDERR, gettext("(Warning) "
11810Sstevel@tonic-gate 			    "%1$s is not a valid mechanism for %2$s."),
11820Sstevel@tonic-gate 			    plist->name, pent->name);
11830Sstevel@tonic-gate 		} else if (!is_in_list(plist->name, pent->dislist)) {
11840Sstevel@tonic-gate 			/* Add this mechanism into the disabled list */
11850Sstevel@tonic-gate 			if ((pmech = create_mech(plist->name)) == NULL) {
11860Sstevel@tonic-gate 				rc = FAILURE;
11870Sstevel@tonic-gate 				break;
11880Sstevel@tonic-gate 			}
11890Sstevel@tonic-gate 
11900Sstevel@tonic-gate 			if (pent->dislist == NULL) {
11910Sstevel@tonic-gate 				pent->dislist = pmech;
11920Sstevel@tonic-gate 			} else {
11930Sstevel@tonic-gate 				phead = pent->dislist;
11940Sstevel@tonic-gate 				pent->dislist = pmech;
11950Sstevel@tonic-gate 				pmech->next = phead;
11960Sstevel@tonic-gate 			}
11970Sstevel@tonic-gate 			pent->dis_count++;
11980Sstevel@tonic-gate 		}
11990Sstevel@tonic-gate 		plist = plist->next;
12000Sstevel@tonic-gate 	}
12010Sstevel@tonic-gate 
12020Sstevel@tonic-gate 	return (rc);
12030Sstevel@tonic-gate }
12040Sstevel@tonic-gate 
12050Sstevel@tonic-gate /*
12060Sstevel@tonic-gate  * Remove the mechanism passed, specified by mech, from the list of
12070Sstevel@tonic-gate  * mechanisms, if present in the list. Else, do nothing.
12080Sstevel@tonic-gate  *
12090Sstevel@tonic-gate  * Returns B_TRUE if mechanism is present in the list.
12100Sstevel@tonic-gate  */
12110Sstevel@tonic-gate boolean_t
12120Sstevel@tonic-gate filter_mechlist(mechlist_t **pmechlist, const char *mech)
12130Sstevel@tonic-gate {
12147968Sopensolaris@drydog.com 	int		cnt = 0;
12157968Sopensolaris@drydog.com 	mechlist_t	*ptr, *pptr;
12167968Sopensolaris@drydog.com 	boolean_t	mech_present = B_FALSE;
12170Sstevel@tonic-gate 
12180Sstevel@tonic-gate 	ptr = pptr = *pmechlist;
12190Sstevel@tonic-gate 
12200Sstevel@tonic-gate 	while (ptr != NULL) {
12210Sstevel@tonic-gate 		if (strncmp(ptr->name, mech, sizeof (mech_name_t)) == 0) {
12220Sstevel@tonic-gate 			mech_present = B_TRUE;
12230Sstevel@tonic-gate 			if (ptr == *pmechlist) {
12240Sstevel@tonic-gate 				pptr = *pmechlist = ptr->next;
12250Sstevel@tonic-gate 				free(ptr);
12260Sstevel@tonic-gate 				ptr = pptr;
12270Sstevel@tonic-gate 			} else {
12280Sstevel@tonic-gate 				pptr->next = ptr->next;
12290Sstevel@tonic-gate 				free(ptr);
12300Sstevel@tonic-gate 				ptr = pptr->next;
12310Sstevel@tonic-gate 			}
12320Sstevel@tonic-gate 		} else {
12330Sstevel@tonic-gate 			pptr = ptr;
12340Sstevel@tonic-gate 			ptr = ptr->next;
12350Sstevel@tonic-gate 			cnt++;
12360Sstevel@tonic-gate 		}
12370Sstevel@tonic-gate 	}
12380Sstevel@tonic-gate 
12390Sstevel@tonic-gate 	/* Only one entry is present */
12400Sstevel@tonic-gate 	if (cnt == 0)
12410Sstevel@tonic-gate 		*pmechlist = NULL;
12420Sstevel@tonic-gate 
12430Sstevel@tonic-gate 	return (mech_present);
12440Sstevel@tonic-gate }
12450Sstevel@tonic-gate 
12460Sstevel@tonic-gate 
12470Sstevel@tonic-gate 
12480Sstevel@tonic-gate /*
12490Sstevel@tonic-gate  * Print out the mechanism policy for a kernel provider that has an entry
12500Sstevel@tonic-gate  * in the kcf.conf file.
12510Sstevel@tonic-gate  *
12520Sstevel@tonic-gate  * The flag has_random is set to B_TRUE if the provider does random
12530Sstevel@tonic-gate  * numbers. The flag has_mechs is set by the caller to B_TRUE if the provider
12540Sstevel@tonic-gate  * has some mechanisms.
12557968Sopensolaris@drydog.com  *
12567968Sopensolaris@drydog.com  * If pent is NULL, the provider doesn't have a kcf.conf entry.
12570Sstevel@tonic-gate  */
12580Sstevel@tonic-gate void
12597968Sopensolaris@drydog.com print_kef_policy(char *provname, entry_t *pent, boolean_t has_random,
12607968Sopensolaris@drydog.com     boolean_t has_mechs)
12610Sstevel@tonic-gate {
12627968Sopensolaris@drydog.com 	mechlist_t	*ptr = NULL;
12637968Sopensolaris@drydog.com 	boolean_t	rnd_disabled = B_FALSE;
12640Sstevel@tonic-gate 
12657968Sopensolaris@drydog.com 	if (pent != NULL) {
12667968Sopensolaris@drydog.com 		rnd_disabled = filter_mechlist(&pent->dislist, RANDOM);
12677968Sopensolaris@drydog.com 		ptr = pent->dislist;
12680Sstevel@tonic-gate 	}
12690Sstevel@tonic-gate 
12707968Sopensolaris@drydog.com 	(void) printf("%s:", provname);
12710Sstevel@tonic-gate 
12720Sstevel@tonic-gate 	if (has_mechs == B_TRUE) {
12730Sstevel@tonic-gate 		/*
12747334SDaniel.Anderson@Sun.COM 		 * TRANSLATION_NOTE
12750Sstevel@tonic-gate 		 * This code block may need to be modified a bit to avoid
12760Sstevel@tonic-gate 		 * constructing the text message on the fly.
12770Sstevel@tonic-gate 		 */
12780Sstevel@tonic-gate 		(void) printf(gettext(" all mechanisms are enabled"));
12790Sstevel@tonic-gate 		if (ptr != NULL)
12800Sstevel@tonic-gate 			(void) printf(gettext(", except "));
12810Sstevel@tonic-gate 		while (ptr != NULL) {
12820Sstevel@tonic-gate 			(void) printf("%s", ptr->name);
12830Sstevel@tonic-gate 			ptr = ptr->next;
12840Sstevel@tonic-gate 			if (ptr != NULL)
12850Sstevel@tonic-gate 				(void) printf(",");
12860Sstevel@tonic-gate 		}
12870Sstevel@tonic-gate 		if (ptr == NULL)
12880Sstevel@tonic-gate 			(void) printf(".");
12890Sstevel@tonic-gate 	}
12900Sstevel@tonic-gate 
12910Sstevel@tonic-gate 	/*
12927334SDaniel.Anderson@Sun.COM 	 * TRANSLATION_NOTE
12930Sstevel@tonic-gate 	 * "random" is a keyword and not to be translated.
12940Sstevel@tonic-gate 	 */
12950Sstevel@tonic-gate 	if (rnd_disabled)
12960Sstevel@tonic-gate 		(void) printf(gettext(" %s is disabled."), "random");
12970Sstevel@tonic-gate 	else if (has_random)
12980Sstevel@tonic-gate 		(void) printf(gettext(" %s is enabled."), "random");
12990Sstevel@tonic-gate 	(void) printf("\n");
13000Sstevel@tonic-gate }
13010Sstevel@tonic-gate 
13027968Sopensolaris@drydog.com 
13030Sstevel@tonic-gate /*
13040Sstevel@tonic-gate  * Check if a kernel software provider is in the kernel.
13057968Sopensolaris@drydog.com  *
13067968Sopensolaris@drydog.com  * Parameters:
13077968Sopensolaris@drydog.com  * provname		Provider name
13087968Sopensolaris@drydog.com  * psoftlist_kernel	Optional software provider list.  If NULL, it will be
13097968Sopensolaris@drydog.com  *			obtained from get_soft_list().
13107968Sopensolaris@drydog.com  * in_kernel		Set to B_TRUE if device is in the kernel, else B_FALSE
13110Sstevel@tonic-gate  */
13120Sstevel@tonic-gate int
13137968Sopensolaris@drydog.com check_kernel_for_soft(char *provname, crypto_get_soft_list_t *psoftlist_kernel,
13147968Sopensolaris@drydog.com     boolean_t *in_kernel)
13150Sstevel@tonic-gate {
13167968Sopensolaris@drydog.com 	char		*ptr;
13177968Sopensolaris@drydog.com 	int		i;
13187968Sopensolaris@drydog.com 	boolean_t	psoftlist_allocated = B_FALSE;
13190Sstevel@tonic-gate 
13200Sstevel@tonic-gate 	if (provname == NULL) {
13210Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("internal error."));
13220Sstevel@tonic-gate 		return (FAILURE);
13230Sstevel@tonic-gate 	}
13240Sstevel@tonic-gate 
13257968Sopensolaris@drydog.com 	if (psoftlist_kernel == NULL) {
13267968Sopensolaris@drydog.com 		if (get_soft_list(&psoftlist_kernel) == FAILURE) {
13277968Sopensolaris@drydog.com 			cryptodebug("failed to get the software provider list"
13287968Sopensolaris@drydog.com 			" from kernel.");
13297968Sopensolaris@drydog.com 			return (FAILURE);
13307968Sopensolaris@drydog.com 		}
13317968Sopensolaris@drydog.com 		psoftlist_allocated = B_TRUE;
13320Sstevel@tonic-gate 	}
13330Sstevel@tonic-gate 
13347968Sopensolaris@drydog.com 	*in_kernel = B_FALSE;
13350Sstevel@tonic-gate 	ptr = psoftlist_kernel->sl_soft_names;
13360Sstevel@tonic-gate 	for (i = 0; i < psoftlist_kernel->sl_soft_count; i++) {
13370Sstevel@tonic-gate 		if (strcmp(provname, ptr) == 0) {
13387968Sopensolaris@drydog.com 			*in_kernel = B_TRUE;
13390Sstevel@tonic-gate 			break;
13400Sstevel@tonic-gate 		}
13410Sstevel@tonic-gate 		ptr = ptr + strlen(ptr) + 1;
13420Sstevel@tonic-gate 	}
13437968Sopensolaris@drydog.com 
13447968Sopensolaris@drydog.com 	if (psoftlist_allocated)
13457968Sopensolaris@drydog.com 		free(psoftlist_kernel);
13460Sstevel@tonic-gate 
13470Sstevel@tonic-gate 	return (SUCCESS);
13480Sstevel@tonic-gate }
13490Sstevel@tonic-gate 
13500Sstevel@tonic-gate 
13510Sstevel@tonic-gate /*
13520Sstevel@tonic-gate  * Check if a kernel hardware provider is in the kernel.
13537968Sopensolaris@drydog.com  *
13547968Sopensolaris@drydog.com  * Parameters:
13557968Sopensolaris@drydog.com  * provname	Provider name
13567968Sopensolaris@drydog.com  * pdevlist	Optional Hardware Crypto Device List.  If NULL, it will be
13577968Sopensolaris@drydog.com  *		obtained from get_dev_list().
13587968Sopensolaris@drydog.com  * in_kernel	Set to B_TRUE if device is in the kernel, otherwise B_FALSE
13590Sstevel@tonic-gate  */
13600Sstevel@tonic-gate int
13617968Sopensolaris@drydog.com check_kernel_for_hard(char *provname,
13627968Sopensolaris@drydog.com     crypto_get_dev_list_t *pdevlist, boolean_t *in_kernel)
13630Sstevel@tonic-gate {
13647968Sopensolaris@drydog.com 	char		devname[MAXNAMELEN];
13657968Sopensolaris@drydog.com 	int		inst_num;
13667968Sopensolaris@drydog.com 	int		i;
13677968Sopensolaris@drydog.com 	boolean_t	dev_list_allocated = B_FALSE;
13680Sstevel@tonic-gate 
13690Sstevel@tonic-gate 	if (provname == NULL) {
13700Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("internal error."));
13710Sstevel@tonic-gate 		return (FAILURE);
13720Sstevel@tonic-gate 	}
13730Sstevel@tonic-gate 
13740Sstevel@tonic-gate 	if (split_hw_provname(provname, devname, &inst_num) == FAILURE) {
13750Sstevel@tonic-gate 		return (FAILURE);
13760Sstevel@tonic-gate 	}
13770Sstevel@tonic-gate 
13787968Sopensolaris@drydog.com 	if (pdevlist == NULL) {
13797968Sopensolaris@drydog.com 		if (get_dev_list(&pdevlist) == FAILURE) {
13807968Sopensolaris@drydog.com 			cryptoerror(LOG_STDERR, gettext("internal error."));
13817968Sopensolaris@drydog.com 			return (FAILURE);
13827968Sopensolaris@drydog.com 		}
13837968Sopensolaris@drydog.com 		dev_list_allocated = B_TRUE;
13840Sstevel@tonic-gate 	}
13850Sstevel@tonic-gate 
13867968Sopensolaris@drydog.com 	*in_kernel = B_FALSE;
13870Sstevel@tonic-gate 	for (i = 0; i < pdevlist->dl_dev_count; i++) {
13880Sstevel@tonic-gate 		if ((strcmp(pdevlist->dl_devs[i].le_dev_name, devname) == 0) &&
13890Sstevel@tonic-gate 		    (pdevlist->dl_devs[i].le_dev_instance == inst_num)) {
13907968Sopensolaris@drydog.com 			*in_kernel = B_TRUE;
13910Sstevel@tonic-gate 			break;
13920Sstevel@tonic-gate 		}
13930Sstevel@tonic-gate 	}
13947968Sopensolaris@drydog.com 
13957968Sopensolaris@drydog.com 	if (dev_list_allocated)
13967968Sopensolaris@drydog.com 		free(pdevlist);
13970Sstevel@tonic-gate 
13980Sstevel@tonic-gate 	return (SUCCESS);
13990Sstevel@tonic-gate }
1400