10Sstevel@tonic-gate /* 20Sstevel@tonic-gate * CDDL HEADER START 30Sstevel@tonic-gate * 40Sstevel@tonic-gate * The contents of this file are subject to the terms of the 57334SDaniel.Anderson@Sun.COM * Common Development and Distribution License (the "License"). 67334SDaniel.Anderson@Sun.COM * You may not use this file except in compliance with the License. 70Sstevel@tonic-gate * 80Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 90Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 100Sstevel@tonic-gate * See the License for the specific language governing permissions 110Sstevel@tonic-gate * and limitations under the License. 120Sstevel@tonic-gate * 130Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 140Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 150Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 160Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 170Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 180Sstevel@tonic-gate * 190Sstevel@tonic-gate * CDDL HEADER END 200Sstevel@tonic-gate */ 210Sstevel@tonic-gate /* 22*11458Sopensolaris@drydog.com * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 230Sstevel@tonic-gate * Use is subject to license terms. 240Sstevel@tonic-gate */ 250Sstevel@tonic-gate 260Sstevel@tonic-gate #include <errno.h> 270Sstevel@tonic-gate #include <fcntl.h> 280Sstevel@tonic-gate #include <stdio.h> 290Sstevel@tonic-gate #include <stdlib.h> 300Sstevel@tonic-gate #include <strings.h> 310Sstevel@tonic-gate #include <time.h> 320Sstevel@tonic-gate #include <unistd.h> 330Sstevel@tonic-gate #include <locale.h> 340Sstevel@tonic-gate #include <sys/types.h> 357968Sopensolaris@drydog.com #include <zone.h> 360Sstevel@tonic-gate #include <sys/stat.h> 370Sstevel@tonic-gate #include "cryptoadm.h" 380Sstevel@tonic-gate 390Sstevel@tonic-gate static int err; /* To store errno which may be overwritten by gettext() */ 400Sstevel@tonic-gate static int build_entrylist(entry_t *, entrylist_t **); 410Sstevel@tonic-gate static entry_t *dup_entry(entry_t *); 420Sstevel@tonic-gate static mechlist_t *dup_mechlist(mechlist_t *); 430Sstevel@tonic-gate static entry_t *getent(char *, entrylist_t *); 440Sstevel@tonic-gate static int interpret(char *, entry_t **); 45*11458Sopensolaris@drydog.com static int parse_sup_dis_list(const char *buf, entry_t *pent); 460Sstevel@tonic-gate 470Sstevel@tonic-gate 480Sstevel@tonic-gate /* 490Sstevel@tonic-gate * Duplicate the mechanism list. A null pointer is returned if the storage 500Sstevel@tonic-gate * space available is insufficient or the input argument is NULL. 510Sstevel@tonic-gate */ 520Sstevel@tonic-gate static mechlist_t * 530Sstevel@tonic-gate dup_mechlist(mechlist_t *plist) 540Sstevel@tonic-gate { 557968Sopensolaris@drydog.com mechlist_t *pres = NULL; 567968Sopensolaris@drydog.com mechlist_t *pcur; 577968Sopensolaris@drydog.com mechlist_t *ptmp; 587968Sopensolaris@drydog.com int rc = SUCCESS; 590Sstevel@tonic-gate 600Sstevel@tonic-gate while (plist != NULL) { 610Sstevel@tonic-gate if (!(ptmp = create_mech(plist->name))) { 620Sstevel@tonic-gate rc = FAILURE; 630Sstevel@tonic-gate break; 640Sstevel@tonic-gate } 650Sstevel@tonic-gate 660Sstevel@tonic-gate if (pres == NULL) { 670Sstevel@tonic-gate pres = pcur = ptmp; 680Sstevel@tonic-gate } else { 690Sstevel@tonic-gate pcur->next = ptmp; 700Sstevel@tonic-gate pcur = pcur->next; 710Sstevel@tonic-gate } 720Sstevel@tonic-gate plist = plist->next; 730Sstevel@tonic-gate } 740Sstevel@tonic-gate 750Sstevel@tonic-gate if (rc != SUCCESS) { 760Sstevel@tonic-gate free_mechlist(pres); 770Sstevel@tonic-gate return (NULL); 780Sstevel@tonic-gate } 790Sstevel@tonic-gate 800Sstevel@tonic-gate return (pres); 810Sstevel@tonic-gate } 820Sstevel@tonic-gate 830Sstevel@tonic-gate 840Sstevel@tonic-gate /* 850Sstevel@tonic-gate * Get the number of mechanisms in the mechanism list. 860Sstevel@tonic-gate */ 870Sstevel@tonic-gate int 880Sstevel@tonic-gate get_mech_count(mechlist_t *plist) 890Sstevel@tonic-gate { 900Sstevel@tonic-gate int count = 0; 910Sstevel@tonic-gate 920Sstevel@tonic-gate while (plist != NULL) { 930Sstevel@tonic-gate count++; 940Sstevel@tonic-gate plist = plist->next; 950Sstevel@tonic-gate } 960Sstevel@tonic-gate return (count); 970Sstevel@tonic-gate } 980Sstevel@tonic-gate 997968Sopensolaris@drydog.com /* 1007968Sopensolaris@drydog.com * Create one item of type entry_t with the provider name. 1017968Sopensolaris@drydog.com * Return NULL if there's not enough memory or provname is NULL. 1027968Sopensolaris@drydog.com */ 1037968Sopensolaris@drydog.com entry_t * 1047968Sopensolaris@drydog.com create_entry(char *provname) 1057968Sopensolaris@drydog.com { 1067968Sopensolaris@drydog.com entry_t *pent = NULL; 1077968Sopensolaris@drydog.com 1087968Sopensolaris@drydog.com if (provname == NULL) { 1097968Sopensolaris@drydog.com return (NULL); 1107968Sopensolaris@drydog.com } 1117968Sopensolaris@drydog.com 1127968Sopensolaris@drydog.com pent = calloc(1, sizeof (entry_t)); 1137968Sopensolaris@drydog.com if (pent == NULL) { 1147968Sopensolaris@drydog.com cryptodebug("out of memory."); 1157968Sopensolaris@drydog.com return (NULL); 1167968Sopensolaris@drydog.com } 1177968Sopensolaris@drydog.com 1187968Sopensolaris@drydog.com (void) strlcpy(pent->name, provname, MAXNAMELEN); 1197968Sopensolaris@drydog.com pent->suplist = NULL; 1207968Sopensolaris@drydog.com pent->sup_count = 0; 1217968Sopensolaris@drydog.com pent->dislist = NULL; 1227968Sopensolaris@drydog.com pent->dis_count = 0; 1237968Sopensolaris@drydog.com pent->load = B_TRUE; 1247968Sopensolaris@drydog.com 1257968Sopensolaris@drydog.com return (pent); 1267968Sopensolaris@drydog.com } 1270Sstevel@tonic-gate 1280Sstevel@tonic-gate /* 1297968Sopensolaris@drydog.com * Duplicate an entry for a provider from kcf.conf. 1307968Sopensolaris@drydog.com * Return NULL if memory is insufficient or the input argument is NULL. 1317968Sopensolaris@drydog.com * Called by getent(). 1320Sstevel@tonic-gate */ 1330Sstevel@tonic-gate static entry_t * 1340Sstevel@tonic-gate dup_entry(entry_t *pent1) 1350Sstevel@tonic-gate { 1360Sstevel@tonic-gate entry_t *pent2 = NULL; 1370Sstevel@tonic-gate 1380Sstevel@tonic-gate if (pent1 == NULL) { 1390Sstevel@tonic-gate return (NULL); 1400Sstevel@tonic-gate } 1410Sstevel@tonic-gate 1427968Sopensolaris@drydog.com if ((pent2 = create_entry(pent1->name)) == NULL) { 1430Sstevel@tonic-gate cryptodebug("out of memory."); 1440Sstevel@tonic-gate return (NULL); 1450Sstevel@tonic-gate } 1460Sstevel@tonic-gate 1470Sstevel@tonic-gate pent2->sup_count = pent1->sup_count; 1480Sstevel@tonic-gate pent2->dis_count = pent1->dis_count; 1497968Sopensolaris@drydog.com pent2->load = pent1->load; 1500Sstevel@tonic-gate if (pent1->suplist != NULL) { 1510Sstevel@tonic-gate pent2->suplist = dup_mechlist(pent1->suplist); 1520Sstevel@tonic-gate if (pent2->suplist == NULL) { 1530Sstevel@tonic-gate free_entry(pent2); 1540Sstevel@tonic-gate return (NULL); 1550Sstevel@tonic-gate } 1560Sstevel@tonic-gate } 1570Sstevel@tonic-gate if (pent1->dislist != NULL) { 1580Sstevel@tonic-gate pent2->dislist = dup_mechlist(pent1->dislist); 1590Sstevel@tonic-gate if (pent2->dislist == NULL) { 1600Sstevel@tonic-gate free_entry(pent2); 1610Sstevel@tonic-gate return (NULL); 1620Sstevel@tonic-gate } 1630Sstevel@tonic-gate } 1640Sstevel@tonic-gate 1650Sstevel@tonic-gate return (pent2); 1660Sstevel@tonic-gate } 1670Sstevel@tonic-gate 1680Sstevel@tonic-gate 1690Sstevel@tonic-gate /* 1700Sstevel@tonic-gate * This routine parses the disabledlist or the supportedlist of an entry 1710Sstevel@tonic-gate * in the kcf.conf configuration file. 1720Sstevel@tonic-gate * 1730Sstevel@tonic-gate * Arguments: 1747968Sopensolaris@drydog.com * buf: an input argument which is a char string with the format of 1750Sstevel@tonic-gate * "disabledlist=m1,m2,..." or "supportedlist=m1,m2,..." 1760Sstevel@tonic-gate * pent: the entry for the disabledlist. This is an IN/OUT argument. 1770Sstevel@tonic-gate * 1780Sstevel@tonic-gate * Return value: SUCCESS or FAILURE. 1790Sstevel@tonic-gate */ 1800Sstevel@tonic-gate static int 181*11458Sopensolaris@drydog.com parse_sup_dis_list(const char *buf, entry_t *pent) 1820Sstevel@tonic-gate { 1837968Sopensolaris@drydog.com mechlist_t *pmech = NULL; 1847968Sopensolaris@drydog.com mechlist_t *phead = NULL; 1857968Sopensolaris@drydog.com char *next_token; 1867968Sopensolaris@drydog.com char *value; 1877968Sopensolaris@drydog.com int count; 1887968Sopensolaris@drydog.com int supflag = B_FALSE; 1897968Sopensolaris@drydog.com int disflag = B_FALSE; 1907968Sopensolaris@drydog.com int rc = SUCCESS; 1910Sstevel@tonic-gate 1920Sstevel@tonic-gate if (strncmp(buf, EF_SUPPORTED, strlen(EF_SUPPORTED)) == 0) { 1930Sstevel@tonic-gate supflag = B_TRUE; 1940Sstevel@tonic-gate } else if (strncmp(buf, EF_DISABLED, strlen(EF_DISABLED)) == 0) { 1950Sstevel@tonic-gate disflag = B_TRUE; 1960Sstevel@tonic-gate } else { 1970Sstevel@tonic-gate /* should not come here */ 1980Sstevel@tonic-gate return (FAILURE); 1990Sstevel@tonic-gate } 2000Sstevel@tonic-gate 2010Sstevel@tonic-gate if (value = strpbrk(buf, SEP_EQUAL)) { 2020Sstevel@tonic-gate value++; /* get rid of = */ 2030Sstevel@tonic-gate } else { 2040Sstevel@tonic-gate cryptodebug("failed to parse the kcf.conf file."); 2050Sstevel@tonic-gate return (FAILURE); 2060Sstevel@tonic-gate } 2070Sstevel@tonic-gate 2080Sstevel@tonic-gate if ((next_token = strtok(value, SEP_COMMA)) == NULL) { 2090Sstevel@tonic-gate cryptodebug("failed to parse the kcf.conf file."); 2100Sstevel@tonic-gate return (FAILURE); 2110Sstevel@tonic-gate } 2120Sstevel@tonic-gate 2130Sstevel@tonic-gate if ((pmech = create_mech(next_token)) == NULL) { 2140Sstevel@tonic-gate return (FAILURE); 2150Sstevel@tonic-gate } 2160Sstevel@tonic-gate 2170Sstevel@tonic-gate if (supflag) { 218*11458Sopensolaris@drydog.com if (pent->suplist != NULL) { 219*11458Sopensolaris@drydog.com cryptodebug("multiple supportedlist entries " 220*11458Sopensolaris@drydog.com "for a mechanism in file kcf.conf."); 221*11458Sopensolaris@drydog.com return (FAILURE); 222*11458Sopensolaris@drydog.com } else { 223*11458Sopensolaris@drydog.com pent->suplist = phead = pmech; 224*11458Sopensolaris@drydog.com } 2250Sstevel@tonic-gate } else if (disflag) { 226*11458Sopensolaris@drydog.com if (pent->dislist != NULL) { 227*11458Sopensolaris@drydog.com cryptodebug("multiple disabledlist entries " 228*11458Sopensolaris@drydog.com "for a mechanism in file kcf.conf."); 229*11458Sopensolaris@drydog.com return (FAILURE); 230*11458Sopensolaris@drydog.com } else { 231*11458Sopensolaris@drydog.com pent->dislist = phead = pmech; 232*11458Sopensolaris@drydog.com } 2330Sstevel@tonic-gate } 2340Sstevel@tonic-gate 2350Sstevel@tonic-gate count = 1; 2360Sstevel@tonic-gate while (next_token) { 2370Sstevel@tonic-gate if (next_token = strtok(NULL, SEP_COMMA)) { 2380Sstevel@tonic-gate if ((pmech = create_mech(next_token)) == NULL) { 2390Sstevel@tonic-gate rc = FAILURE; 2400Sstevel@tonic-gate break; 2410Sstevel@tonic-gate } 2420Sstevel@tonic-gate count++; 2430Sstevel@tonic-gate phead->next = pmech; 2440Sstevel@tonic-gate phead = phead->next; 2450Sstevel@tonic-gate } 2460Sstevel@tonic-gate } 2470Sstevel@tonic-gate 2480Sstevel@tonic-gate if (rc == SUCCESS) { 2490Sstevel@tonic-gate if (supflag) { 2500Sstevel@tonic-gate pent->sup_count = count; 2510Sstevel@tonic-gate } else if (disflag) { 2520Sstevel@tonic-gate pent->dis_count = count; 2530Sstevel@tonic-gate } 2540Sstevel@tonic-gate } else { 2550Sstevel@tonic-gate free_mechlist(phead); 2560Sstevel@tonic-gate } 2570Sstevel@tonic-gate 2580Sstevel@tonic-gate return (rc); 2590Sstevel@tonic-gate } 2600Sstevel@tonic-gate 2610Sstevel@tonic-gate 2620Sstevel@tonic-gate /* 2637968Sopensolaris@drydog.com * Convert a char string containing a line about a provider 2647968Sopensolaris@drydog.com * from kcf.conf into an entry_t structure. 2657968Sopensolaris@drydog.com * 266*11458Sopensolaris@drydog.com * Note: the input string, buf, may be modified by this function. 267*11458Sopensolaris@drydog.com * 2687968Sopensolaris@drydog.com * See ent2str(), the reverse of this function, for the format of 2697968Sopensolaris@drydog.com * kcf.conf lines. 2700Sstevel@tonic-gate */ 2710Sstevel@tonic-gate static int 2720Sstevel@tonic-gate interpret(char *buf, entry_t **ppent) 2730Sstevel@tonic-gate { 2747968Sopensolaris@drydog.com entry_t *pent = NULL; 2757968Sopensolaris@drydog.com char *token1; 2767968Sopensolaris@drydog.com char *token2; 2777968Sopensolaris@drydog.com char *token3; 2787968Sopensolaris@drydog.com int rc; 2790Sstevel@tonic-gate 2807968Sopensolaris@drydog.com /* Get provider name */ 2810Sstevel@tonic-gate if ((token1 = strtok(buf, SEP_COLON)) == NULL) { /* buf is NULL */ 2820Sstevel@tonic-gate return (FAILURE); 2830Sstevel@tonic-gate }; 2840Sstevel@tonic-gate 2857968Sopensolaris@drydog.com pent = create_entry(token1); 2860Sstevel@tonic-gate if (pent == NULL) { 2870Sstevel@tonic-gate cryptodebug("out of memory."); 2880Sstevel@tonic-gate return (FAILURE); 2890Sstevel@tonic-gate } 2900Sstevel@tonic-gate 2910Sstevel@tonic-gate if ((token2 = strtok(NULL, SEP_SEMICOLON)) == NULL) { 2920Sstevel@tonic-gate /* The entry contains a provider name only */ 2930Sstevel@tonic-gate free_entry(pent); 2940Sstevel@tonic-gate return (FAILURE); 2950Sstevel@tonic-gate } 2960Sstevel@tonic-gate 2977968Sopensolaris@drydog.com if (strncmp(token2, EF_UNLOAD, strlen(EF_UNLOAD)) == 0) { 2987968Sopensolaris@drydog.com pent->load = B_FALSE; /* cryptoadm unload */ 299*11458Sopensolaris@drydog.com token2 = strtok(NULL, SEP_SEMICOLON); 300*11458Sopensolaris@drydog.com /* 301*11458Sopensolaris@drydog.com * If token2 is NULL, the entry contains a 302*11458Sopensolaris@drydog.com * provider name:unload only 303*11458Sopensolaris@drydog.com */ 3047968Sopensolaris@drydog.com } 3057968Sopensolaris@drydog.com 306*11458Sopensolaris@drydog.com if (token2 != NULL) { 307*11458Sopensolaris@drydog.com /* 308*11458Sopensolaris@drydog.com * Either supportedlist or disabledlist or both are present. 309*11458Sopensolaris@drydog.com * Need to call strtok() to get token3 first, as function 310*11458Sopensolaris@drydog.com * parse_sup_dis_list() makes strtok() calls on the 311*11458Sopensolaris@drydog.com * token2 substring. 312*11458Sopensolaris@drydog.com */ 313*11458Sopensolaris@drydog.com token3 = strtok(NULL, SEP_SEMICOLON); /* optional */ 3140Sstevel@tonic-gate 315*11458Sopensolaris@drydog.com /* parse supportedlist (or disabledlist if no supportedlist) */ 316*11458Sopensolaris@drydog.com if ((rc = parse_sup_dis_list(token2, pent)) != SUCCESS) { 317*11458Sopensolaris@drydog.com free_entry(pent); 318*11458Sopensolaris@drydog.com return (rc); 319*11458Sopensolaris@drydog.com } 3200Sstevel@tonic-gate 321*11458Sopensolaris@drydog.com /* parse disabledlist (if there's a supportedlist) */ 322*11458Sopensolaris@drydog.com if ((token3 != NULL) && ((rc = parse_sup_dis_list(token3, 323*11458Sopensolaris@drydog.com pent)) != SUCCESS)) { 324*11458Sopensolaris@drydog.com free_entry(pent); 325*11458Sopensolaris@drydog.com return (rc); 326*11458Sopensolaris@drydog.com } 3270Sstevel@tonic-gate } 3280Sstevel@tonic-gate 3290Sstevel@tonic-gate *ppent = pent; 3300Sstevel@tonic-gate return (SUCCESS); 3310Sstevel@tonic-gate } 3320Sstevel@tonic-gate 3330Sstevel@tonic-gate 3340Sstevel@tonic-gate /* 3357968Sopensolaris@drydog.com * Add an entry about a provider from kcf.conf to the end of an entry list. 3367968Sopensolaris@drydog.com * If the entry list pplist is NULL, create the linked list with pent as the 3377968Sopensolaris@drydog.com * first element. 3380Sstevel@tonic-gate */ 3390Sstevel@tonic-gate static int 3400Sstevel@tonic-gate build_entrylist(entry_t *pent, entrylist_t **pplist) 3410Sstevel@tonic-gate { 3427968Sopensolaris@drydog.com entrylist_t *pentlist; 3437968Sopensolaris@drydog.com entrylist_t *pcur = NULL; 3440Sstevel@tonic-gate 3450Sstevel@tonic-gate pentlist = malloc(sizeof (entrylist_t)); 3460Sstevel@tonic-gate if (pentlist == NULL) { 3470Sstevel@tonic-gate cryptodebug("out of memory."); 3480Sstevel@tonic-gate return (FAILURE); 3490Sstevel@tonic-gate } 3500Sstevel@tonic-gate pentlist->pent = pent; 3510Sstevel@tonic-gate pentlist->next = NULL; 3520Sstevel@tonic-gate 3530Sstevel@tonic-gate if (*pplist) { 3540Sstevel@tonic-gate pcur = *pplist; 3550Sstevel@tonic-gate while (pcur->next != NULL) 3560Sstevel@tonic-gate pcur = pcur->next; 3570Sstevel@tonic-gate pcur->next = pentlist; 3580Sstevel@tonic-gate } else { /* empty list */ 3590Sstevel@tonic-gate *pplist = pentlist; 3600Sstevel@tonic-gate } 3610Sstevel@tonic-gate 3620Sstevel@tonic-gate return (SUCCESS); 3630Sstevel@tonic-gate } 3640Sstevel@tonic-gate 3650Sstevel@tonic-gate 3660Sstevel@tonic-gate 3670Sstevel@tonic-gate /* 3680Sstevel@tonic-gate * Find the entry with the "provname" name from the entry list and duplicate 3697968Sopensolaris@drydog.com * it. Called by getent_kef(). 3700Sstevel@tonic-gate */ 3710Sstevel@tonic-gate static entry_t * 3720Sstevel@tonic-gate getent(char *provname, entrylist_t *entrylist) 3730Sstevel@tonic-gate { 3740Sstevel@tonic-gate boolean_t found = B_FALSE; 3750Sstevel@tonic-gate entry_t *pent1 = NULL; 3760Sstevel@tonic-gate 3770Sstevel@tonic-gate if ((provname == NULL) || (entrylist == NULL)) { 3780Sstevel@tonic-gate return (NULL); 3790Sstevel@tonic-gate } 3800Sstevel@tonic-gate 3810Sstevel@tonic-gate while (!found && entrylist) { 3820Sstevel@tonic-gate if (strcmp(entrylist->pent->name, provname) == 0) { 3830Sstevel@tonic-gate found = B_TRUE; 3840Sstevel@tonic-gate pent1 = entrylist->pent; 3850Sstevel@tonic-gate } else { 3860Sstevel@tonic-gate entrylist = entrylist->next; 3870Sstevel@tonic-gate } 3880Sstevel@tonic-gate } 3890Sstevel@tonic-gate 3900Sstevel@tonic-gate if (!found) { 3910Sstevel@tonic-gate return (NULL); 3920Sstevel@tonic-gate } 3930Sstevel@tonic-gate 3940Sstevel@tonic-gate /* duplicate the entry to be returned */ 3950Sstevel@tonic-gate return (dup_entry(pent1)); 3960Sstevel@tonic-gate } 3970Sstevel@tonic-gate 3980Sstevel@tonic-gate 3997968Sopensolaris@drydog.com /* 4007968Sopensolaris@drydog.com * Free memory in entry_t. 4017968Sopensolaris@drydog.com * That is, the supported and disabled lists for a provider 4027968Sopensolaris@drydog.com * from kcf.conf. 4037968Sopensolaris@drydog.com */ 4040Sstevel@tonic-gate void 4050Sstevel@tonic-gate free_entry(entry_t *pent) 4060Sstevel@tonic-gate { 4070Sstevel@tonic-gate if (pent == NULL) { 4080Sstevel@tonic-gate return; 4090Sstevel@tonic-gate } else { 4100Sstevel@tonic-gate free_mechlist(pent->suplist); 4110Sstevel@tonic-gate free_mechlist(pent->dislist); 4120Sstevel@tonic-gate free(pent); 4130Sstevel@tonic-gate } 4140Sstevel@tonic-gate } 4150Sstevel@tonic-gate 4160Sstevel@tonic-gate 4177968Sopensolaris@drydog.com /* 4187968Sopensolaris@drydog.com * Free elements in a entrylist_t linked list, 4197968Sopensolaris@drydog.com * which lists providers in kcf.conf. 4207968Sopensolaris@drydog.com */ 4210Sstevel@tonic-gate void 4220Sstevel@tonic-gate free_entrylist(entrylist_t *entrylist) 4230Sstevel@tonic-gate { 4240Sstevel@tonic-gate entrylist_t *pnext; 4250Sstevel@tonic-gate 4260Sstevel@tonic-gate while (entrylist != NULL) { 4270Sstevel@tonic-gate pnext = entrylist->next; 4280Sstevel@tonic-gate free_entry(entrylist->pent); 4290Sstevel@tonic-gate entrylist = pnext; 4300Sstevel@tonic-gate } 4310Sstevel@tonic-gate } 4320Sstevel@tonic-gate 4330Sstevel@tonic-gate 4340Sstevel@tonic-gate /* 4350Sstevel@tonic-gate * Convert an entry to a string. This routine builds a string for the entry 4367968Sopensolaris@drydog.com * to be inserted in the kcf.conf file. Based on the content of each entry, 437*11458Sopensolaris@drydog.com * the result string can be one of these 7 forms: 4380Sstevel@tonic-gate * - name:supportedlist=m1,m2,...,mj 4390Sstevel@tonic-gate * - name:disabledlist=m1,m2,...,mj 4400Sstevel@tonic-gate * - name:supportedlist=m1,...,mj;disabledlist=m1,m2,...,mk 4410Sstevel@tonic-gate * 442*11458Sopensolaris@drydog.com * - name:unload 4437968Sopensolaris@drydog.com * - name:unload;supportedlist=m1,m2,...,mj 4447968Sopensolaris@drydog.com * - name:unload;disabledlist=m1,m2,...,mj 4457968Sopensolaris@drydog.com * - name:unload;supportedlist=m1,...,mj;disabledlist=m1,m2,...,mk 4467968Sopensolaris@drydog.com * 4477968Sopensolaris@drydog.com * Note that the caller is responsible for freeing the returned string 4487968Sopensolaris@drydog.com * (with free_entry()). 4497968Sopensolaris@drydog.com * See interpret() for the reverse of this function: converting a string 4507968Sopensolaris@drydog.com * to an entry_t. 4510Sstevel@tonic-gate */ 4520Sstevel@tonic-gate char * 4530Sstevel@tonic-gate ent2str(entry_t *pent) 4540Sstevel@tonic-gate { 4557968Sopensolaris@drydog.com char *buf; 4567968Sopensolaris@drydog.com mechlist_t *pcur = NULL; 4577968Sopensolaris@drydog.com boolean_t semicolon_separator = B_FALSE; 4580Sstevel@tonic-gate 4590Sstevel@tonic-gate 4600Sstevel@tonic-gate if (pent == NULL) { 4610Sstevel@tonic-gate return (NULL); 4620Sstevel@tonic-gate } 4630Sstevel@tonic-gate 4640Sstevel@tonic-gate if ((buf = malloc(BUFSIZ)) == NULL) { 4650Sstevel@tonic-gate return (NULL); 4660Sstevel@tonic-gate } 4670Sstevel@tonic-gate 4680Sstevel@tonic-gate /* convert the provider name */ 4690Sstevel@tonic-gate if (strlcpy(buf, pent->name, BUFSIZ) >= BUFSIZ) { 4700Sstevel@tonic-gate free(buf); 4710Sstevel@tonic-gate return (NULL); 4720Sstevel@tonic-gate } 4730Sstevel@tonic-gate 4747968Sopensolaris@drydog.com if (!pent->load) { /* add "unload" keyword */ 4757968Sopensolaris@drydog.com if (strlcat(buf, SEP_COLON, BUFSIZ) >= BUFSIZ) { 4767968Sopensolaris@drydog.com free(buf); 4777968Sopensolaris@drydog.com return (NULL); 4787968Sopensolaris@drydog.com } 4797968Sopensolaris@drydog.com 4807968Sopensolaris@drydog.com if (strlcat(buf, EF_UNLOAD, BUFSIZ) >= BUFSIZ) { 4817968Sopensolaris@drydog.com free(buf); 4827968Sopensolaris@drydog.com return (NULL); 4837968Sopensolaris@drydog.com } 4847968Sopensolaris@drydog.com 4857968Sopensolaris@drydog.com semicolon_separator = B_TRUE; 4867968Sopensolaris@drydog.com } 4877968Sopensolaris@drydog.com 4880Sstevel@tonic-gate /* convert the supported list if any */ 4897968Sopensolaris@drydog.com pcur = pent->suplist; 4907968Sopensolaris@drydog.com if (pcur != NULL) { 4917968Sopensolaris@drydog.com if (strlcat(buf, 4927968Sopensolaris@drydog.com semicolon_separator ? SEP_SEMICOLON : SEP_COLON, 4937968Sopensolaris@drydog.com BUFSIZ) >= BUFSIZ) { 4940Sstevel@tonic-gate free(buf); 4950Sstevel@tonic-gate return (NULL); 4960Sstevel@tonic-gate } 4970Sstevel@tonic-gate 4980Sstevel@tonic-gate if (strlcat(buf, EF_SUPPORTED, BUFSIZ) >= BUFSIZ) { 4990Sstevel@tonic-gate free(buf); 5000Sstevel@tonic-gate return (NULL); 5010Sstevel@tonic-gate } 5020Sstevel@tonic-gate 5037968Sopensolaris@drydog.com while (pcur != NULL) { 5047968Sopensolaris@drydog.com if (strlcat(buf, pcur->name, BUFSIZ) >= BUFSIZ) { 5050Sstevel@tonic-gate free(buf); 5060Sstevel@tonic-gate return (NULL); 5070Sstevel@tonic-gate } 5080Sstevel@tonic-gate 5097968Sopensolaris@drydog.com pcur = pcur->next; 5107968Sopensolaris@drydog.com if (pcur != NULL) { 5110Sstevel@tonic-gate if (strlcat(buf, SEP_COMMA, BUFSIZ) 5120Sstevel@tonic-gate >= BUFSIZ) { 5130Sstevel@tonic-gate free(buf); 5140Sstevel@tonic-gate return (NULL); 5150Sstevel@tonic-gate } 5160Sstevel@tonic-gate } 5170Sstevel@tonic-gate } 5187968Sopensolaris@drydog.com semicolon_separator = B_TRUE; 5190Sstevel@tonic-gate } 5200Sstevel@tonic-gate 5210Sstevel@tonic-gate /* convert the disabled list if any */ 5227968Sopensolaris@drydog.com pcur = pent->dislist; 5237968Sopensolaris@drydog.com if (pcur != NULL) { 5247968Sopensolaris@drydog.com if (strlcat(buf, 5257968Sopensolaris@drydog.com semicolon_separator ? SEP_SEMICOLON : SEP_COLON, 5267968Sopensolaris@drydog.com BUFSIZ) >= BUFSIZ) { 5277968Sopensolaris@drydog.com free(buf); 5287968Sopensolaris@drydog.com return (NULL); 5290Sstevel@tonic-gate } 5300Sstevel@tonic-gate 5317968Sopensolaris@drydog.com if (strlcat(buf, EF_DISABLED, BUFSIZ) >= BUFSIZ) { 5327968Sopensolaris@drydog.com free(buf); 5337968Sopensolaris@drydog.com return (NULL); 5347968Sopensolaris@drydog.com } 5357968Sopensolaris@drydog.com 5367968Sopensolaris@drydog.com while (pcur != NULL) { 5377968Sopensolaris@drydog.com if (strlcat(buf, pcur->name, BUFSIZ) >= BUFSIZ) { 5380Sstevel@tonic-gate free(buf); 5390Sstevel@tonic-gate return (NULL); 5400Sstevel@tonic-gate } 5410Sstevel@tonic-gate 5427968Sopensolaris@drydog.com pcur = pcur->next; 5437968Sopensolaris@drydog.com if (pcur != NULL) { 5440Sstevel@tonic-gate if (strlcat(buf, SEP_COMMA, BUFSIZ) 5450Sstevel@tonic-gate >= BUFSIZ) { 5460Sstevel@tonic-gate free(buf); 5470Sstevel@tonic-gate return (NULL); 5480Sstevel@tonic-gate } 5490Sstevel@tonic-gate } 5500Sstevel@tonic-gate } 5517968Sopensolaris@drydog.com semicolon_separator = B_TRUE; 5520Sstevel@tonic-gate } 5530Sstevel@tonic-gate 5540Sstevel@tonic-gate if (strlcat(buf, "\n", BUFSIZ) >= BUFSIZ) { 5550Sstevel@tonic-gate free(buf); 5560Sstevel@tonic-gate return (NULL); 5570Sstevel@tonic-gate } 5580Sstevel@tonic-gate 5590Sstevel@tonic-gate return (buf); 5600Sstevel@tonic-gate } 5610Sstevel@tonic-gate 5620Sstevel@tonic-gate 5630Sstevel@tonic-gate /* 5640Sstevel@tonic-gate * Enable the mechanisms for the provider pointed by *ppent. If allflag is 5650Sstevel@tonic-gate * TRUE, enable all. Otherwise, enable the mechanisms specified in the 3rd 5660Sstevel@tonic-gate * argument "mlist". The result will be stored in ppent also. 5670Sstevel@tonic-gate */ 5680Sstevel@tonic-gate int 5690Sstevel@tonic-gate enable_mechs(entry_t **ppent, boolean_t allflag, mechlist_t *mlist) 5700Sstevel@tonic-gate { 5717968Sopensolaris@drydog.com entry_t *pent; 5727968Sopensolaris@drydog.com mechlist_t *phead; /* the current and resulting disabled list */ 5737968Sopensolaris@drydog.com mechlist_t *ptr = NULL; 5747968Sopensolaris@drydog.com mechlist_t *pcur = NULL; 5757968Sopensolaris@drydog.com boolean_t found; 5760Sstevel@tonic-gate 5770Sstevel@tonic-gate pent = *ppent; 5780Sstevel@tonic-gate if (pent == NULL) { 5790Sstevel@tonic-gate return (FAILURE); 5800Sstevel@tonic-gate } 5810Sstevel@tonic-gate 5820Sstevel@tonic-gate if (allflag) { 5830Sstevel@tonic-gate free_mechlist(pent->dislist); 5840Sstevel@tonic-gate pent->dis_count = 0; 5850Sstevel@tonic-gate pent->dislist = NULL; 5860Sstevel@tonic-gate return (SUCCESS); 5870Sstevel@tonic-gate } 5880Sstevel@tonic-gate 5890Sstevel@tonic-gate /* 5900Sstevel@tonic-gate * for each mechanism in the to-be-enabled mechanism list, 5910Sstevel@tonic-gate * - check if it is in the current disabled list 5920Sstevel@tonic-gate * - if found, delete it from the disabled list 5937968Sopensolaris@drydog.com * otherwise, give a warning. 5940Sstevel@tonic-gate */ 5950Sstevel@tonic-gate ptr = mlist; 5960Sstevel@tonic-gate while (ptr != NULL) { 5970Sstevel@tonic-gate found = B_FALSE; 5980Sstevel@tonic-gate phead = pcur = pent->dislist; 5990Sstevel@tonic-gate while (!found && pcur) { 6000Sstevel@tonic-gate if (strcmp(pcur->name, ptr->name) == 0) { 6010Sstevel@tonic-gate found = B_TRUE; 6020Sstevel@tonic-gate } else { 6030Sstevel@tonic-gate phead = pcur; 6040Sstevel@tonic-gate pcur = pcur->next; 6050Sstevel@tonic-gate } 6060Sstevel@tonic-gate } 6070Sstevel@tonic-gate 6080Sstevel@tonic-gate if (found) { 6090Sstevel@tonic-gate if (phead == pcur) { 6100Sstevel@tonic-gate pent->dislist = pent->dislist->next; 6110Sstevel@tonic-gate free(pcur); 6120Sstevel@tonic-gate } else { 6130Sstevel@tonic-gate phead->next = pcur->next; 6140Sstevel@tonic-gate free(pcur); 6150Sstevel@tonic-gate } 6160Sstevel@tonic-gate pent->dis_count--; 6170Sstevel@tonic-gate } else { 6180Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 6190Sstevel@tonic-gate "(Warning) %1$s is either enabled already or not " 6200Sstevel@tonic-gate "a valid mechanism for %2$s"), ptr->name, 6210Sstevel@tonic-gate pent->name); 6220Sstevel@tonic-gate } 6230Sstevel@tonic-gate ptr = ptr->next; 6240Sstevel@tonic-gate } 6250Sstevel@tonic-gate 6260Sstevel@tonic-gate if (pent->dis_count == 0) { 6270Sstevel@tonic-gate pent->dislist = NULL; 6280Sstevel@tonic-gate } 6290Sstevel@tonic-gate 6300Sstevel@tonic-gate return (SUCCESS); 6310Sstevel@tonic-gate 6320Sstevel@tonic-gate } 6330Sstevel@tonic-gate 6340Sstevel@tonic-gate 6357968Sopensolaris@drydog.com /* 6367968Sopensolaris@drydog.com * Determine if the kernel provider name, path, is a device 6377968Sopensolaris@drydog.com * (that is, it contains a slash character (e.g., "mca/0"). 6387968Sopensolaris@drydog.com * If so, it is a hardware provider; otherwise it is a software provider. 6397968Sopensolaris@drydog.com */ 6400Sstevel@tonic-gate boolean_t 6410Sstevel@tonic-gate is_device(char *path) 6420Sstevel@tonic-gate { 6430Sstevel@tonic-gate if (strchr(path, SEP_SLASH) != NULL) { 6440Sstevel@tonic-gate return (B_TRUE); 6450Sstevel@tonic-gate } else { 6460Sstevel@tonic-gate return (B_FALSE); 6470Sstevel@tonic-gate } 6480Sstevel@tonic-gate } 6490Sstevel@tonic-gate 6500Sstevel@tonic-gate /* 6510Sstevel@tonic-gate * Split a hardware provider name with the "name/inst_num" format into 6527968Sopensolaris@drydog.com * a name and a number (e.g., split "mca/0" into "mca" instance 0). 6530Sstevel@tonic-gate */ 6540Sstevel@tonic-gate int 6550Sstevel@tonic-gate split_hw_provname(char *provname, char *pname, int *inst_num) 6560Sstevel@tonic-gate { 6570Sstevel@tonic-gate char name[MAXNAMELEN]; 6580Sstevel@tonic-gate char *inst_str; 6590Sstevel@tonic-gate 6600Sstevel@tonic-gate if (provname == NULL) { 6610Sstevel@tonic-gate return (FAILURE); 6620Sstevel@tonic-gate } 6630Sstevel@tonic-gate 6640Sstevel@tonic-gate (void) strlcpy(name, provname, MAXNAMELEN); 6650Sstevel@tonic-gate if (strtok(name, "/") == NULL) { 6660Sstevel@tonic-gate return (FAILURE); 6670Sstevel@tonic-gate } 6680Sstevel@tonic-gate 6690Sstevel@tonic-gate if ((inst_str = strtok(NULL, "/")) == NULL) { 6700Sstevel@tonic-gate return (FAILURE); 6710Sstevel@tonic-gate } 6720Sstevel@tonic-gate 6730Sstevel@tonic-gate (void) strlcpy(pname, name, MAXNAMELEN); 6740Sstevel@tonic-gate *inst_num = atoi(inst_str); 6750Sstevel@tonic-gate 6760Sstevel@tonic-gate return (SUCCESS); 6770Sstevel@tonic-gate } 6780Sstevel@tonic-gate 6790Sstevel@tonic-gate 6800Sstevel@tonic-gate /* 6817968Sopensolaris@drydog.com * Retrieve information from kcf.conf and build a hardware device entry list 6827968Sopensolaris@drydog.com * and a software entry list of kernel crypto providers. 6837968Sopensolaris@drydog.com * 6847968Sopensolaris@drydog.com * This list is usually incomplete, as kernel crypto providers only have to 6857968Sopensolaris@drydog.com * be listed in kcf.conf if a mechanism is disabled (by cryptoadm) or 6867968Sopensolaris@drydog.com * if the kernel provider module is not one of the default kernel providers. 6877968Sopensolaris@drydog.com * 6887968Sopensolaris@drydog.com * The kcf.conf file is available only in the global zone. 6890Sstevel@tonic-gate */ 6900Sstevel@tonic-gate int 69110979SHai-May.Chao@Sun.COM get_kcfconf_info(entrylist_t **ppdevlist, entrylist_t **ppsoftlist) 6920Sstevel@tonic-gate { 6937968Sopensolaris@drydog.com FILE *pfile = NULL; 6947968Sopensolaris@drydog.com char buffer[BUFSIZ]; 6957968Sopensolaris@drydog.com int len; 6967968Sopensolaris@drydog.com entry_t *pent = NULL; 6977968Sopensolaris@drydog.com int rc = SUCCESS; 6980Sstevel@tonic-gate 6990Sstevel@tonic-gate if ((pfile = fopen(_PATH_KCF_CONF, "r")) == NULL) { 7000Sstevel@tonic-gate cryptodebug("failed to open the kcf.conf file for read only"); 7010Sstevel@tonic-gate return (FAILURE); 7020Sstevel@tonic-gate } 7030Sstevel@tonic-gate 7040Sstevel@tonic-gate *ppdevlist = NULL; 7050Sstevel@tonic-gate *ppsoftlist = NULL; 7060Sstevel@tonic-gate while (fgets(buffer, BUFSIZ, pfile) != NULL) { 7070Sstevel@tonic-gate if (buffer[0] == '#' || buffer[0] == ' ' || 7080Sstevel@tonic-gate buffer[0] == '\n'|| buffer[0] == '\t') { 7090Sstevel@tonic-gate continue; /* ignore comment lines */ 7100Sstevel@tonic-gate } 7110Sstevel@tonic-gate 7120Sstevel@tonic-gate len = strlen(buffer); 7137968Sopensolaris@drydog.com if (buffer[len - 1] == '\n') { /* get rid of trailing '\n' */ 7140Sstevel@tonic-gate len--; 7150Sstevel@tonic-gate } 7160Sstevel@tonic-gate buffer[len] = '\0'; 7170Sstevel@tonic-gate 7180Sstevel@tonic-gate if ((rc = interpret(buffer, &pent)) == SUCCESS) { 71910979SHai-May.Chao@Sun.COM if (is_device(pent->name)) { 7200Sstevel@tonic-gate rc = build_entrylist(pent, ppdevlist); 7210Sstevel@tonic-gate } else { 7220Sstevel@tonic-gate rc = build_entrylist(pent, ppsoftlist); 7230Sstevel@tonic-gate } 7240Sstevel@tonic-gate } else { 7250Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 7260Sstevel@tonic-gate "failed to parse configuration.")); 7270Sstevel@tonic-gate } 7280Sstevel@tonic-gate 7290Sstevel@tonic-gate if (rc != SUCCESS) { 7300Sstevel@tonic-gate free_entrylist(*ppdevlist); 7310Sstevel@tonic-gate free_entrylist(*ppsoftlist); 7320Sstevel@tonic-gate free_entry(pent); 7330Sstevel@tonic-gate break; 7340Sstevel@tonic-gate } 7350Sstevel@tonic-gate } 7360Sstevel@tonic-gate 7370Sstevel@tonic-gate (void) fclose(pfile); 7380Sstevel@tonic-gate return (rc); 7390Sstevel@tonic-gate } 7400Sstevel@tonic-gate 7410Sstevel@tonic-gate /* 7420Sstevel@tonic-gate * Retrieve information from admin device and build a device entry list and 7437968Sopensolaris@drydog.com * a software entry list. This is used where there is no kcf.conf, e.g., the 7440Sstevel@tonic-gate * non-global zone. 7450Sstevel@tonic-gate */ 7460Sstevel@tonic-gate int 7470Sstevel@tonic-gate get_admindev_info(entrylist_t **ppdevlist, entrylist_t **ppsoftlist) 7480Sstevel@tonic-gate { 7497968Sopensolaris@drydog.com crypto_get_dev_list_t *pdevlist_kernel = NULL; 7507968Sopensolaris@drydog.com crypto_get_soft_list_t *psoftlist_kernel = NULL; 7517968Sopensolaris@drydog.com char *devname; 7527968Sopensolaris@drydog.com int inst_num; 7537968Sopensolaris@drydog.com int mcount; 7547968Sopensolaris@drydog.com mechlist_t *pmech = NULL; 7557968Sopensolaris@drydog.com entry_t *pent_dev = NULL, *pent_soft = NULL; 7567968Sopensolaris@drydog.com int i; 7577968Sopensolaris@drydog.com char *psoftname; 7587968Sopensolaris@drydog.com entrylist_t *tmp_pdev = NULL; 7597968Sopensolaris@drydog.com entrylist_t *tmp_psoft = NULL; 7607968Sopensolaris@drydog.com entrylist_t *phardlist = NULL, *psoftlist = NULL; 7610Sstevel@tonic-gate 7627968Sopensolaris@drydog.com /* 7637968Sopensolaris@drydog.com * Get hardware providers 7647968Sopensolaris@drydog.com */ 7650Sstevel@tonic-gate if (get_dev_list(&pdevlist_kernel) != SUCCESS) { 7660Sstevel@tonic-gate cryptodebug("failed to get hardware provider list from kernel"); 7670Sstevel@tonic-gate return (FAILURE); 7680Sstevel@tonic-gate } 7690Sstevel@tonic-gate 7700Sstevel@tonic-gate for (i = 0; i < pdevlist_kernel->dl_dev_count; i++) { 7710Sstevel@tonic-gate devname = pdevlist_kernel->dl_devs[i].le_dev_name; 7720Sstevel@tonic-gate inst_num = pdevlist_kernel->dl_devs[i].le_dev_instance; 7730Sstevel@tonic-gate mcount = pdevlist_kernel->dl_devs[i].le_mechanism_count; 7740Sstevel@tonic-gate 7750Sstevel@tonic-gate pmech = NULL; 7760Sstevel@tonic-gate if (get_dev_info(devname, inst_num, mcount, &pmech) != 7770Sstevel@tonic-gate SUCCESS) { 7780Sstevel@tonic-gate cryptodebug( 7790Sstevel@tonic-gate "failed to retrieve the mechanism list for %s/%d.", 7800Sstevel@tonic-gate devname, inst_num); 7810Sstevel@tonic-gate goto fail_out; 7820Sstevel@tonic-gate } 7830Sstevel@tonic-gate 7847968Sopensolaris@drydog.com if ((pent_dev = create_entry(devname)) == NULL) { 7850Sstevel@tonic-gate cryptodebug("out of memory."); 7860Sstevel@tonic-gate free_mechlist(pmech); 7870Sstevel@tonic-gate goto fail_out; 7880Sstevel@tonic-gate } 7897968Sopensolaris@drydog.com pent_dev->suplist = pmech; 7907968Sopensolaris@drydog.com pent_dev->sup_count = mcount; 7910Sstevel@tonic-gate 7927968Sopensolaris@drydog.com if (build_entrylist(pent_dev, &tmp_pdev) != SUCCESS) { 7930Sstevel@tonic-gate goto fail_out; 7940Sstevel@tonic-gate } 7950Sstevel@tonic-gate } 7960Sstevel@tonic-gate 7970Sstevel@tonic-gate free(pdevlist_kernel); 7980Sstevel@tonic-gate pdevlist_kernel = NULL; 7990Sstevel@tonic-gate 8007968Sopensolaris@drydog.com /* 8017968Sopensolaris@drydog.com * Get software providers 8027968Sopensolaris@drydog.com */ 8037968Sopensolaris@drydog.com if (getzoneid() == GLOBAL_ZONEID) { 80410979SHai-May.Chao@Sun.COM if (get_kcfconf_info(&phardlist, &psoftlist) != SUCCESS) { 8057968Sopensolaris@drydog.com goto fail_out; 8067968Sopensolaris@drydog.com } 8077968Sopensolaris@drydog.com } 8087968Sopensolaris@drydog.com 8090Sstevel@tonic-gate if (get_soft_list(&psoftlist_kernel) != SUCCESS) { 8100Sstevel@tonic-gate cryptodebug("failed to get software provider list from kernel"); 8110Sstevel@tonic-gate goto fail_out; 8120Sstevel@tonic-gate } 8130Sstevel@tonic-gate 8140Sstevel@tonic-gate for (i = 0, psoftname = psoftlist_kernel->sl_soft_names; 8150Sstevel@tonic-gate i < psoftlist_kernel->sl_soft_count; 8160Sstevel@tonic-gate i++, psoftname = psoftname + strlen(psoftname) + 1) { 8170Sstevel@tonic-gate pmech = NULL; 81810979SHai-May.Chao@Sun.COM if (get_soft_info(psoftname, &pmech, phardlist, psoftlist) != 81910979SHai-May.Chao@Sun.COM SUCCESS) { 8200Sstevel@tonic-gate cryptodebug( 8210Sstevel@tonic-gate "failed to retrieve the mechanism list for %s.", 8220Sstevel@tonic-gate psoftname); 8230Sstevel@tonic-gate goto fail_out; 8240Sstevel@tonic-gate } 8250Sstevel@tonic-gate 8267968Sopensolaris@drydog.com if ((pent_soft = create_entry(psoftname)) == NULL) { 8270Sstevel@tonic-gate cryptodebug("out of memory."); 8280Sstevel@tonic-gate free_mechlist(pmech); 8290Sstevel@tonic-gate goto fail_out; 8300Sstevel@tonic-gate } 8317968Sopensolaris@drydog.com pent_soft->suplist = pmech; 8327968Sopensolaris@drydog.com pent_soft->sup_count = get_mech_count(pmech); 8330Sstevel@tonic-gate 8347968Sopensolaris@drydog.com if (build_entrylist(pent_soft, &tmp_psoft) != SUCCESS) { 8350Sstevel@tonic-gate goto fail_out; 8360Sstevel@tonic-gate } 8370Sstevel@tonic-gate } 8380Sstevel@tonic-gate 8390Sstevel@tonic-gate free(psoftlist_kernel); 8400Sstevel@tonic-gate psoftlist_kernel = NULL; 8410Sstevel@tonic-gate 8420Sstevel@tonic-gate *ppdevlist = tmp_pdev; 8430Sstevel@tonic-gate *ppsoftlist = tmp_psoft; 8440Sstevel@tonic-gate 8450Sstevel@tonic-gate return (SUCCESS); 8460Sstevel@tonic-gate 8470Sstevel@tonic-gate fail_out: 8487968Sopensolaris@drydog.com if (pent_dev != NULL) 8497968Sopensolaris@drydog.com free_entry(pent_dev); 8507968Sopensolaris@drydog.com if (pent_soft != NULL) 8517968Sopensolaris@drydog.com free_entry(pent_soft); 8520Sstevel@tonic-gate 8530Sstevel@tonic-gate free_entrylist(tmp_pdev); 8540Sstevel@tonic-gate free_entrylist(tmp_psoft); 8550Sstevel@tonic-gate 8560Sstevel@tonic-gate if (pdevlist_kernel != NULL) 8570Sstevel@tonic-gate free(pdevlist_kernel); 8580Sstevel@tonic-gate if (psoftlist_kernel != NULL) 8590Sstevel@tonic-gate free(psoftlist_kernel); 8600Sstevel@tonic-gate 8610Sstevel@tonic-gate return (FAILURE); 8620Sstevel@tonic-gate } 8630Sstevel@tonic-gate 8640Sstevel@tonic-gate /* 8657968Sopensolaris@drydog.com * Return configuration information for a kernel provider from kcf.conf. 8667968Sopensolaris@drydog.com * For kernel software providers return a enabled list and disabled list. 8677968Sopensolaris@drydog.com * For kernel hardware providers return just a disabled list. 8687968Sopensolaris@drydog.com * 8697968Sopensolaris@drydog.com * Parameters phardlist and psoftlist are supplied by get_kcfconf_info(). 8707968Sopensolaris@drydog.com * If NULL, this function calls get_kcfconf_info() internally. 8710Sstevel@tonic-gate */ 8720Sstevel@tonic-gate entry_t * 87310979SHai-May.Chao@Sun.COM getent_kef(char *provname, entrylist_t *phardlist, entrylist_t *psoftlist) 8740Sstevel@tonic-gate { 8757968Sopensolaris@drydog.com entry_t *pent = NULL; 8767968Sopensolaris@drydog.com boolean_t memory_allocated = B_FALSE; 8770Sstevel@tonic-gate 87810979SHai-May.Chao@Sun.COM if ((phardlist == NULL) || (psoftlist == NULL)) { 87910979SHai-May.Chao@Sun.COM if (get_kcfconf_info(&phardlist, &psoftlist) != SUCCESS) { 8807968Sopensolaris@drydog.com return (NULL); 8817968Sopensolaris@drydog.com } 8827968Sopensolaris@drydog.com memory_allocated = B_TRUE; 8830Sstevel@tonic-gate } 8840Sstevel@tonic-gate 8850Sstevel@tonic-gate if (is_device(provname)) { 8867968Sopensolaris@drydog.com pent = getent(provname, phardlist); 8870Sstevel@tonic-gate } else { 8880Sstevel@tonic-gate pent = getent(provname, psoftlist); 8890Sstevel@tonic-gate } 8900Sstevel@tonic-gate 8917968Sopensolaris@drydog.com if (memory_allocated) { 8927968Sopensolaris@drydog.com free_entrylist(phardlist); 8937968Sopensolaris@drydog.com free_entrylist(psoftlist); 8947968Sopensolaris@drydog.com } 8950Sstevel@tonic-gate 8960Sstevel@tonic-gate return (pent); 8970Sstevel@tonic-gate } 8980Sstevel@tonic-gate 8990Sstevel@tonic-gate /* 9000Sstevel@tonic-gate * Print out the provider name and the mechanism list. 9010Sstevel@tonic-gate */ 9020Sstevel@tonic-gate void 9030Sstevel@tonic-gate print_mechlist(char *provname, mechlist_t *pmechlist) 9040Sstevel@tonic-gate { 9057968Sopensolaris@drydog.com mechlist_t *ptr = NULL; 9060Sstevel@tonic-gate 9070Sstevel@tonic-gate if (provname == NULL) { 9080Sstevel@tonic-gate return; 9090Sstevel@tonic-gate } 9100Sstevel@tonic-gate 9110Sstevel@tonic-gate (void) printf("%s: ", provname); 9120Sstevel@tonic-gate if (pmechlist == NULL) { 9130Sstevel@tonic-gate (void) printf(gettext("No mechanisms presented.\n")); 9140Sstevel@tonic-gate return; 9150Sstevel@tonic-gate } 9160Sstevel@tonic-gate 9170Sstevel@tonic-gate ptr = pmechlist; 9180Sstevel@tonic-gate while (ptr != NULL) { 9190Sstevel@tonic-gate (void) printf("%s", ptr->name); 9200Sstevel@tonic-gate ptr = ptr->next; 9210Sstevel@tonic-gate if (ptr == NULL) { 9220Sstevel@tonic-gate (void) printf("\n"); 9230Sstevel@tonic-gate } else { 9240Sstevel@tonic-gate (void) printf(","); 9250Sstevel@tonic-gate } 9260Sstevel@tonic-gate } 9270Sstevel@tonic-gate } 9280Sstevel@tonic-gate 9290Sstevel@tonic-gate 9300Sstevel@tonic-gate /* 9317968Sopensolaris@drydog.com * Update the kcf.conf file based on the update mode: 9327968Sopensolaris@drydog.com * - If update_mode is MODIFY_MODE, modify the entry with the same name. 9337968Sopensolaris@drydog.com * If not found, append a new entry to the kcf.conf file. 9347968Sopensolaris@drydog.com * - If update_mode is DELETE_MODE, delete the entry with the same name. 9357968Sopensolaris@drydog.com * - If update_mode is ADD_MODE, append a new entry to the kcf.conf file. 9360Sstevel@tonic-gate */ 9370Sstevel@tonic-gate int 9380Sstevel@tonic-gate update_kcfconf(entry_t *pent, int update_mode) 9390Sstevel@tonic-gate { 9400Sstevel@tonic-gate boolean_t add_it = B_FALSE; 9410Sstevel@tonic-gate boolean_t delete_it = B_FALSE; 9428273Sopensolaris@drydog.com boolean_t this_entry_matches = B_FALSE; 9430Sstevel@tonic-gate boolean_t found_entry = B_FALSE; 9447968Sopensolaris@drydog.com FILE *pfile = NULL; 9457968Sopensolaris@drydog.com FILE *pfile_tmp = NULL; 9467968Sopensolaris@drydog.com char buffer[BUFSIZ]; 9477968Sopensolaris@drydog.com char buffer2[BUFSIZ]; 9487968Sopensolaris@drydog.com char tmpfile_name[MAXPATHLEN]; 9497968Sopensolaris@drydog.com char *name; 9507968Sopensolaris@drydog.com char *new_str = NULL; 9517968Sopensolaris@drydog.com int rc = SUCCESS; 9520Sstevel@tonic-gate 9530Sstevel@tonic-gate if (pent == NULL) { 9540Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("internal error.")); 9550Sstevel@tonic-gate return (FAILURE); 9560Sstevel@tonic-gate } 9570Sstevel@tonic-gate 9580Sstevel@tonic-gate /* Check the update_mode */ 9597968Sopensolaris@drydog.com switch (update_mode) { 9607968Sopensolaris@drydog.com case ADD_MODE: 9610Sstevel@tonic-gate add_it = B_TRUE; 9627968Sopensolaris@drydog.com /* FALLTHROUGH */ 9637968Sopensolaris@drydog.com case MODIFY_MODE: 9647968Sopensolaris@drydog.com /* Convert the entry a string to add to kcf.conf */ 9650Sstevel@tonic-gate if ((new_str = ent2str(pent)) == NULL) { 9660Sstevel@tonic-gate return (FAILURE); 9670Sstevel@tonic-gate } 9687968Sopensolaris@drydog.com break; 9697968Sopensolaris@drydog.com case DELETE_MODE: 9700Sstevel@tonic-gate delete_it = B_TRUE; 9717968Sopensolaris@drydog.com break; 9727968Sopensolaris@drydog.com default: 9730Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("internal error.")); 9740Sstevel@tonic-gate return (FAILURE); 9750Sstevel@tonic-gate } 9760Sstevel@tonic-gate 9770Sstevel@tonic-gate /* Open the kcf.conf file */ 9780Sstevel@tonic-gate if ((pfile = fopen(_PATH_KCF_CONF, "r+")) == NULL) { 9790Sstevel@tonic-gate err = errno; 9800Sstevel@tonic-gate cryptoerror(LOG_STDERR, 9810Sstevel@tonic-gate gettext("failed to update the configuration - %s"), 9820Sstevel@tonic-gate strerror(err)); 9830Sstevel@tonic-gate cryptodebug("failed to open %s for write.", _PATH_KCF_CONF); 9840Sstevel@tonic-gate return (FAILURE); 9850Sstevel@tonic-gate } 9860Sstevel@tonic-gate 9870Sstevel@tonic-gate /* Lock the kcf.conf file */ 9880Sstevel@tonic-gate if (lockf(fileno(pfile), F_TLOCK, 0) == -1) { 9890Sstevel@tonic-gate err = errno; 9900Sstevel@tonic-gate cryptoerror(LOG_STDERR, 9910Sstevel@tonic-gate gettext("failed to update the configuration - %s"), 9927968Sopensolaris@drydog.com strerror(err)); 9930Sstevel@tonic-gate (void) fclose(pfile); 9940Sstevel@tonic-gate return (FAILURE); 9950Sstevel@tonic-gate } 9960Sstevel@tonic-gate 9970Sstevel@tonic-gate /* 9980Sstevel@tonic-gate * Create a temporary file in the /etc/crypto directory to save 9990Sstevel@tonic-gate * updated configuration file first. 10000Sstevel@tonic-gate */ 10010Sstevel@tonic-gate (void) strlcpy(tmpfile_name, TMPFILE_TEMPLATE, sizeof (tmpfile_name)); 10020Sstevel@tonic-gate if (mkstemp(tmpfile_name) == -1) { 10030Sstevel@tonic-gate err = errno; 10040Sstevel@tonic-gate cryptoerror(LOG_STDERR, 10050Sstevel@tonic-gate gettext("failed to create a temporary file - %s"), 10060Sstevel@tonic-gate strerror(err)); 10070Sstevel@tonic-gate (void) fclose(pfile); 10080Sstevel@tonic-gate return (FAILURE); 10090Sstevel@tonic-gate } 10100Sstevel@tonic-gate 10110Sstevel@tonic-gate if ((pfile_tmp = fopen(tmpfile_name, "w")) == NULL) { 10120Sstevel@tonic-gate err = errno; 10130Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("failed to open %s - %s"), 10140Sstevel@tonic-gate tmpfile_name, strerror(err)); 10150Sstevel@tonic-gate (void) fclose(pfile); 10160Sstevel@tonic-gate return (FAILURE); 10170Sstevel@tonic-gate } 10180Sstevel@tonic-gate 10190Sstevel@tonic-gate /* 10200Sstevel@tonic-gate * Loop thru the entire kcf.conf file, insert, modify or delete 10210Sstevel@tonic-gate * an entry. 10220Sstevel@tonic-gate */ 10230Sstevel@tonic-gate while (fgets(buffer, BUFSIZ, pfile) != NULL) { 10240Sstevel@tonic-gate if (add_it) { 10250Sstevel@tonic-gate if (fputs(buffer, pfile_tmp) == EOF) { 10260Sstevel@tonic-gate err = errno; 10270Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 10280Sstevel@tonic-gate "failed to write to a temp file: %s."), 10290Sstevel@tonic-gate strerror(err)); 10300Sstevel@tonic-gate rc = FAILURE; 10310Sstevel@tonic-gate break; 10320Sstevel@tonic-gate } 10330Sstevel@tonic-gate 10340Sstevel@tonic-gate } else { /* modify or delete */ 10358273Sopensolaris@drydog.com this_entry_matches = B_FALSE; 10367968Sopensolaris@drydog.com 10370Sstevel@tonic-gate if (!(buffer[0] == '#' || buffer[0] == ' ' || 10380Sstevel@tonic-gate buffer[0] == '\n'|| buffer[0] == '\t')) { 10390Sstevel@tonic-gate /* 10400Sstevel@tonic-gate * Get the provider name from this line and 10410Sstevel@tonic-gate * check if this is the entry to be updated 10420Sstevel@tonic-gate * or deleted. Note: can not use "buffer" 10430Sstevel@tonic-gate * directly because strtok will change its 10440Sstevel@tonic-gate * value. 10450Sstevel@tonic-gate */ 10460Sstevel@tonic-gate (void) strlcpy(buffer2, buffer, BUFSIZ); 10470Sstevel@tonic-gate if ((name = strtok(buffer2, SEP_COLON)) == 10480Sstevel@tonic-gate NULL) { 10490Sstevel@tonic-gate rc = FAILURE; 10500Sstevel@tonic-gate break; 10510Sstevel@tonic-gate } 10520Sstevel@tonic-gate 10530Sstevel@tonic-gate if (strcmp(pent->name, name) == 0) { 10548273Sopensolaris@drydog.com this_entry_matches = B_TRUE; 10550Sstevel@tonic-gate found_entry = B_TRUE; 10560Sstevel@tonic-gate } 10570Sstevel@tonic-gate } 10580Sstevel@tonic-gate 10590Sstevel@tonic-gate 10608273Sopensolaris@drydog.com if (!this_entry_matches || !delete_it) { 10618273Sopensolaris@drydog.com /* write this entry */ 10628273Sopensolaris@drydog.com if (this_entry_matches) { 10638273Sopensolaris@drydog.com /* 10648273Sopensolaris@drydog.com * Modify this entry: get the 10658273Sopensolaris@drydog.com * updated string and place into buffer. 10668273Sopensolaris@drydog.com */ 10678273Sopensolaris@drydog.com (void) strlcpy(buffer, new_str, BUFSIZ); 10688273Sopensolaris@drydog.com free(new_str); 10698273Sopensolaris@drydog.com } 10708273Sopensolaris@drydog.com /* write the (unchanged or modified) entry */ 10710Sstevel@tonic-gate if (fputs(buffer, pfile_tmp) == EOF) { 10720Sstevel@tonic-gate err = errno; 10730Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 10740Sstevel@tonic-gate "failed to write to a temp file: " 10750Sstevel@tonic-gate "%s."), strerror(err)); 10760Sstevel@tonic-gate rc = FAILURE; 10770Sstevel@tonic-gate break; 10780Sstevel@tonic-gate } 10790Sstevel@tonic-gate } 10800Sstevel@tonic-gate } 10810Sstevel@tonic-gate } 10820Sstevel@tonic-gate 10837968Sopensolaris@drydog.com if ((!delete_it) && (rc != FAILURE)) { 10847968Sopensolaris@drydog.com if (add_it || !found_entry) { 10857968Sopensolaris@drydog.com /* append new entry to end of file */ 10867968Sopensolaris@drydog.com if (fputs(new_str, pfile_tmp) == EOF) { 10877968Sopensolaris@drydog.com err = errno; 10887968Sopensolaris@drydog.com cryptoerror(LOG_STDERR, gettext( 10897968Sopensolaris@drydog.com "failed to write to a temp file: %s."), 10907968Sopensolaris@drydog.com strerror(err)); 10917968Sopensolaris@drydog.com rc = FAILURE; 10927968Sopensolaris@drydog.com } 10937968Sopensolaris@drydog.com free(new_str); 10940Sstevel@tonic-gate } 10950Sstevel@tonic-gate } 10960Sstevel@tonic-gate 10970Sstevel@tonic-gate (void) fclose(pfile); 10980Sstevel@tonic-gate if (fclose(pfile_tmp) != 0) { 10990Sstevel@tonic-gate err = errno; 11000Sstevel@tonic-gate cryptoerror(LOG_STDERR, 11010Sstevel@tonic-gate gettext("failed to close %s: %s"), tmpfile_name, 11020Sstevel@tonic-gate strerror(err)); 11030Sstevel@tonic-gate return (FAILURE); 11040Sstevel@tonic-gate } 11050Sstevel@tonic-gate 11060Sstevel@tonic-gate /* Copy the temporary file to the kcf.conf file */ 11070Sstevel@tonic-gate if (rename(tmpfile_name, _PATH_KCF_CONF) == -1) { 11080Sstevel@tonic-gate err = errno; 11090Sstevel@tonic-gate cryptoerror(LOG_STDERR, 11100Sstevel@tonic-gate gettext("failed to update the configuration - %s"), 11110Sstevel@tonic-gate strerror(err)); 11120Sstevel@tonic-gate cryptodebug("failed to rename %s to %s: %s", tmpfile, 11130Sstevel@tonic-gate _PATH_KCF_CONF, strerror(err)); 11140Sstevel@tonic-gate rc = FAILURE; 11150Sstevel@tonic-gate } else if (chmod(_PATH_KCF_CONF, 11160Sstevel@tonic-gate S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH) == -1) { 11170Sstevel@tonic-gate err = errno; 11180Sstevel@tonic-gate cryptoerror(LOG_STDERR, 11190Sstevel@tonic-gate gettext("failed to update the configuration - %s"), 11200Sstevel@tonic-gate strerror(err)); 11210Sstevel@tonic-gate cryptodebug("failed to chmod to %s: %s", _PATH_KCF_CONF, 11220Sstevel@tonic-gate strerror(err)); 11230Sstevel@tonic-gate rc = FAILURE; 11240Sstevel@tonic-gate } else { 11250Sstevel@tonic-gate rc = SUCCESS; 11260Sstevel@tonic-gate } 11270Sstevel@tonic-gate 11280Sstevel@tonic-gate if ((rc == FAILURE) && (unlink(tmpfile_name) != 0)) { 11290Sstevel@tonic-gate err = errno; 11300Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 11310Sstevel@tonic-gate "(Warning) failed to remove %s: %s"), 11320Sstevel@tonic-gate tmpfile_name, strerror(err)); 11330Sstevel@tonic-gate } 11340Sstevel@tonic-gate 11350Sstevel@tonic-gate return (rc); 11360Sstevel@tonic-gate } 11370Sstevel@tonic-gate 11380Sstevel@tonic-gate 11390Sstevel@tonic-gate /* 11400Sstevel@tonic-gate * Disable the mechanisms for the provider pointed by *ppent. If allflag is 11410Sstevel@tonic-gate * TRUE, disable all. Otherwise, disable the mechanisms specified in the 11420Sstevel@tonic-gate * dislist argument. The "infolist" argument contains the mechanism list 11430Sstevel@tonic-gate * supported by this provider. 11440Sstevel@tonic-gate */ 11450Sstevel@tonic-gate int 11460Sstevel@tonic-gate disable_mechs(entry_t **ppent, mechlist_t *infolist, boolean_t allflag, 11470Sstevel@tonic-gate mechlist_t *dislist) 11480Sstevel@tonic-gate { 11497968Sopensolaris@drydog.com entry_t *pent; 11507968Sopensolaris@drydog.com mechlist_t *plist = NULL; 11517968Sopensolaris@drydog.com mechlist_t *phead = NULL; 11527968Sopensolaris@drydog.com mechlist_t *pmech = NULL; 11537968Sopensolaris@drydog.com int rc = SUCCESS; 11540Sstevel@tonic-gate 11550Sstevel@tonic-gate pent = *ppent; 11560Sstevel@tonic-gate if (pent == NULL) { 11570Sstevel@tonic-gate return (FAILURE); 11580Sstevel@tonic-gate } 11590Sstevel@tonic-gate 11600Sstevel@tonic-gate if (allflag) { 11610Sstevel@tonic-gate free_mechlist(pent->dislist); 11620Sstevel@tonic-gate pent->dis_count = get_mech_count(infolist); 11630Sstevel@tonic-gate if (!(pent->dislist = dup_mechlist(infolist))) { 11640Sstevel@tonic-gate return (FAILURE); 11650Sstevel@tonic-gate } else { 11660Sstevel@tonic-gate return (SUCCESS); 11670Sstevel@tonic-gate } 11680Sstevel@tonic-gate } 11690Sstevel@tonic-gate 11700Sstevel@tonic-gate /* 11710Sstevel@tonic-gate * Not disable all. Now loop thru the mechanisms specified in the 11720Sstevel@tonic-gate * dislist. If the mechanism is not supported by the provider, 11730Sstevel@tonic-gate * ignore it with a warning. If the mechanism is disabled already, 11740Sstevel@tonic-gate * do nothing. Otherwise, prepend it to the beginning of the disabled 11750Sstevel@tonic-gate * list of the provider. 11760Sstevel@tonic-gate */ 11770Sstevel@tonic-gate plist = dislist; 11780Sstevel@tonic-gate while (plist != NULL) { 11790Sstevel@tonic-gate if (!is_in_list(plist->name, infolist)) { 11800Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("(Warning) " 11810Sstevel@tonic-gate "%1$s is not a valid mechanism for %2$s."), 11820Sstevel@tonic-gate plist->name, pent->name); 11830Sstevel@tonic-gate } else if (!is_in_list(plist->name, pent->dislist)) { 11840Sstevel@tonic-gate /* Add this mechanism into the disabled list */ 11850Sstevel@tonic-gate if ((pmech = create_mech(plist->name)) == NULL) { 11860Sstevel@tonic-gate rc = FAILURE; 11870Sstevel@tonic-gate break; 11880Sstevel@tonic-gate } 11890Sstevel@tonic-gate 11900Sstevel@tonic-gate if (pent->dislist == NULL) { 11910Sstevel@tonic-gate pent->dislist = pmech; 11920Sstevel@tonic-gate } else { 11930Sstevel@tonic-gate phead = pent->dislist; 11940Sstevel@tonic-gate pent->dislist = pmech; 11950Sstevel@tonic-gate pmech->next = phead; 11960Sstevel@tonic-gate } 11970Sstevel@tonic-gate pent->dis_count++; 11980Sstevel@tonic-gate } 11990Sstevel@tonic-gate plist = plist->next; 12000Sstevel@tonic-gate } 12010Sstevel@tonic-gate 12020Sstevel@tonic-gate return (rc); 12030Sstevel@tonic-gate } 12040Sstevel@tonic-gate 12050Sstevel@tonic-gate /* 12060Sstevel@tonic-gate * Remove the mechanism passed, specified by mech, from the list of 12070Sstevel@tonic-gate * mechanisms, if present in the list. Else, do nothing. 12080Sstevel@tonic-gate * 12090Sstevel@tonic-gate * Returns B_TRUE if mechanism is present in the list. 12100Sstevel@tonic-gate */ 12110Sstevel@tonic-gate boolean_t 12120Sstevel@tonic-gate filter_mechlist(mechlist_t **pmechlist, const char *mech) 12130Sstevel@tonic-gate { 12147968Sopensolaris@drydog.com int cnt = 0; 12157968Sopensolaris@drydog.com mechlist_t *ptr, *pptr; 12167968Sopensolaris@drydog.com boolean_t mech_present = B_FALSE; 12170Sstevel@tonic-gate 12180Sstevel@tonic-gate ptr = pptr = *pmechlist; 12190Sstevel@tonic-gate 12200Sstevel@tonic-gate while (ptr != NULL) { 12210Sstevel@tonic-gate if (strncmp(ptr->name, mech, sizeof (mech_name_t)) == 0) { 12220Sstevel@tonic-gate mech_present = B_TRUE; 12230Sstevel@tonic-gate if (ptr == *pmechlist) { 12240Sstevel@tonic-gate pptr = *pmechlist = ptr->next; 12250Sstevel@tonic-gate free(ptr); 12260Sstevel@tonic-gate ptr = pptr; 12270Sstevel@tonic-gate } else { 12280Sstevel@tonic-gate pptr->next = ptr->next; 12290Sstevel@tonic-gate free(ptr); 12300Sstevel@tonic-gate ptr = pptr->next; 12310Sstevel@tonic-gate } 12320Sstevel@tonic-gate } else { 12330Sstevel@tonic-gate pptr = ptr; 12340Sstevel@tonic-gate ptr = ptr->next; 12350Sstevel@tonic-gate cnt++; 12360Sstevel@tonic-gate } 12370Sstevel@tonic-gate } 12380Sstevel@tonic-gate 12390Sstevel@tonic-gate /* Only one entry is present */ 12400Sstevel@tonic-gate if (cnt == 0) 12410Sstevel@tonic-gate *pmechlist = NULL; 12420Sstevel@tonic-gate 12430Sstevel@tonic-gate return (mech_present); 12440Sstevel@tonic-gate } 12450Sstevel@tonic-gate 12460Sstevel@tonic-gate 12470Sstevel@tonic-gate 12480Sstevel@tonic-gate /* 12490Sstevel@tonic-gate * Print out the mechanism policy for a kernel provider that has an entry 12500Sstevel@tonic-gate * in the kcf.conf file. 12510Sstevel@tonic-gate * 12520Sstevel@tonic-gate * The flag has_random is set to B_TRUE if the provider does random 12530Sstevel@tonic-gate * numbers. The flag has_mechs is set by the caller to B_TRUE if the provider 12540Sstevel@tonic-gate * has some mechanisms. 12557968Sopensolaris@drydog.com * 12567968Sopensolaris@drydog.com * If pent is NULL, the provider doesn't have a kcf.conf entry. 12570Sstevel@tonic-gate */ 12580Sstevel@tonic-gate void 12597968Sopensolaris@drydog.com print_kef_policy(char *provname, entry_t *pent, boolean_t has_random, 12607968Sopensolaris@drydog.com boolean_t has_mechs) 12610Sstevel@tonic-gate { 12627968Sopensolaris@drydog.com mechlist_t *ptr = NULL; 12637968Sopensolaris@drydog.com boolean_t rnd_disabled = B_FALSE; 12640Sstevel@tonic-gate 12657968Sopensolaris@drydog.com if (pent != NULL) { 12667968Sopensolaris@drydog.com rnd_disabled = filter_mechlist(&pent->dislist, RANDOM); 12677968Sopensolaris@drydog.com ptr = pent->dislist; 12680Sstevel@tonic-gate } 12690Sstevel@tonic-gate 12707968Sopensolaris@drydog.com (void) printf("%s:", provname); 12710Sstevel@tonic-gate 12720Sstevel@tonic-gate if (has_mechs == B_TRUE) { 12730Sstevel@tonic-gate /* 12747334SDaniel.Anderson@Sun.COM * TRANSLATION_NOTE 12750Sstevel@tonic-gate * This code block may need to be modified a bit to avoid 12760Sstevel@tonic-gate * constructing the text message on the fly. 12770Sstevel@tonic-gate */ 12780Sstevel@tonic-gate (void) printf(gettext(" all mechanisms are enabled")); 12790Sstevel@tonic-gate if (ptr != NULL) 12800Sstevel@tonic-gate (void) printf(gettext(", except ")); 12810Sstevel@tonic-gate while (ptr != NULL) { 12820Sstevel@tonic-gate (void) printf("%s", ptr->name); 12830Sstevel@tonic-gate ptr = ptr->next; 12840Sstevel@tonic-gate if (ptr != NULL) 12850Sstevel@tonic-gate (void) printf(","); 12860Sstevel@tonic-gate } 12870Sstevel@tonic-gate if (ptr == NULL) 12880Sstevel@tonic-gate (void) printf("."); 12890Sstevel@tonic-gate } 12900Sstevel@tonic-gate 12910Sstevel@tonic-gate /* 12927334SDaniel.Anderson@Sun.COM * TRANSLATION_NOTE 12930Sstevel@tonic-gate * "random" is a keyword and not to be translated. 12940Sstevel@tonic-gate */ 12950Sstevel@tonic-gate if (rnd_disabled) 12960Sstevel@tonic-gate (void) printf(gettext(" %s is disabled."), "random"); 12970Sstevel@tonic-gate else if (has_random) 12980Sstevel@tonic-gate (void) printf(gettext(" %s is enabled."), "random"); 12990Sstevel@tonic-gate (void) printf("\n"); 13000Sstevel@tonic-gate } 13010Sstevel@tonic-gate 13027968Sopensolaris@drydog.com 13030Sstevel@tonic-gate /* 13040Sstevel@tonic-gate * Check if a kernel software provider is in the kernel. 13057968Sopensolaris@drydog.com * 13067968Sopensolaris@drydog.com * Parameters: 13077968Sopensolaris@drydog.com * provname Provider name 13087968Sopensolaris@drydog.com * psoftlist_kernel Optional software provider list. If NULL, it will be 13097968Sopensolaris@drydog.com * obtained from get_soft_list(). 13107968Sopensolaris@drydog.com * in_kernel Set to B_TRUE if device is in the kernel, else B_FALSE 13110Sstevel@tonic-gate */ 13120Sstevel@tonic-gate int 13137968Sopensolaris@drydog.com check_kernel_for_soft(char *provname, crypto_get_soft_list_t *psoftlist_kernel, 13147968Sopensolaris@drydog.com boolean_t *in_kernel) 13150Sstevel@tonic-gate { 13167968Sopensolaris@drydog.com char *ptr; 13177968Sopensolaris@drydog.com int i; 13187968Sopensolaris@drydog.com boolean_t psoftlist_allocated = B_FALSE; 13190Sstevel@tonic-gate 13200Sstevel@tonic-gate if (provname == NULL) { 13210Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("internal error.")); 13220Sstevel@tonic-gate return (FAILURE); 13230Sstevel@tonic-gate } 13240Sstevel@tonic-gate 13257968Sopensolaris@drydog.com if (psoftlist_kernel == NULL) { 13267968Sopensolaris@drydog.com if (get_soft_list(&psoftlist_kernel) == FAILURE) { 13277968Sopensolaris@drydog.com cryptodebug("failed to get the software provider list" 13287968Sopensolaris@drydog.com " from kernel."); 13297968Sopensolaris@drydog.com return (FAILURE); 13307968Sopensolaris@drydog.com } 13317968Sopensolaris@drydog.com psoftlist_allocated = B_TRUE; 13320Sstevel@tonic-gate } 13330Sstevel@tonic-gate 13347968Sopensolaris@drydog.com *in_kernel = B_FALSE; 13350Sstevel@tonic-gate ptr = psoftlist_kernel->sl_soft_names; 13360Sstevel@tonic-gate for (i = 0; i < psoftlist_kernel->sl_soft_count; i++) { 13370Sstevel@tonic-gate if (strcmp(provname, ptr) == 0) { 13387968Sopensolaris@drydog.com *in_kernel = B_TRUE; 13390Sstevel@tonic-gate break; 13400Sstevel@tonic-gate } 13410Sstevel@tonic-gate ptr = ptr + strlen(ptr) + 1; 13420Sstevel@tonic-gate } 13437968Sopensolaris@drydog.com 13447968Sopensolaris@drydog.com if (psoftlist_allocated) 13457968Sopensolaris@drydog.com free(psoftlist_kernel); 13460Sstevel@tonic-gate 13470Sstevel@tonic-gate return (SUCCESS); 13480Sstevel@tonic-gate } 13490Sstevel@tonic-gate 13500Sstevel@tonic-gate 13510Sstevel@tonic-gate /* 13520Sstevel@tonic-gate * Check if a kernel hardware provider is in the kernel. 13537968Sopensolaris@drydog.com * 13547968Sopensolaris@drydog.com * Parameters: 13557968Sopensolaris@drydog.com * provname Provider name 13567968Sopensolaris@drydog.com * pdevlist Optional Hardware Crypto Device List. If NULL, it will be 13577968Sopensolaris@drydog.com * obtained from get_dev_list(). 13587968Sopensolaris@drydog.com * in_kernel Set to B_TRUE if device is in the kernel, otherwise B_FALSE 13590Sstevel@tonic-gate */ 13600Sstevel@tonic-gate int 13617968Sopensolaris@drydog.com check_kernel_for_hard(char *provname, 13627968Sopensolaris@drydog.com crypto_get_dev_list_t *pdevlist, boolean_t *in_kernel) 13630Sstevel@tonic-gate { 13647968Sopensolaris@drydog.com char devname[MAXNAMELEN]; 13657968Sopensolaris@drydog.com int inst_num; 13667968Sopensolaris@drydog.com int i; 13677968Sopensolaris@drydog.com boolean_t dev_list_allocated = B_FALSE; 13680Sstevel@tonic-gate 13690Sstevel@tonic-gate if (provname == NULL) { 13700Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("internal error.")); 13710Sstevel@tonic-gate return (FAILURE); 13720Sstevel@tonic-gate } 13730Sstevel@tonic-gate 13740Sstevel@tonic-gate if (split_hw_provname(provname, devname, &inst_num) == FAILURE) { 13750Sstevel@tonic-gate return (FAILURE); 13760Sstevel@tonic-gate } 13770Sstevel@tonic-gate 13787968Sopensolaris@drydog.com if (pdevlist == NULL) { 13797968Sopensolaris@drydog.com if (get_dev_list(&pdevlist) == FAILURE) { 13807968Sopensolaris@drydog.com cryptoerror(LOG_STDERR, gettext("internal error.")); 13817968Sopensolaris@drydog.com return (FAILURE); 13827968Sopensolaris@drydog.com } 13837968Sopensolaris@drydog.com dev_list_allocated = B_TRUE; 13840Sstevel@tonic-gate } 13850Sstevel@tonic-gate 13867968Sopensolaris@drydog.com *in_kernel = B_FALSE; 13870Sstevel@tonic-gate for (i = 0; i < pdevlist->dl_dev_count; i++) { 13880Sstevel@tonic-gate if ((strcmp(pdevlist->dl_devs[i].le_dev_name, devname) == 0) && 13890Sstevel@tonic-gate (pdevlist->dl_devs[i].le_dev_instance == inst_num)) { 13907968Sopensolaris@drydog.com *in_kernel = B_TRUE; 13910Sstevel@tonic-gate break; 13920Sstevel@tonic-gate } 13930Sstevel@tonic-gate } 13947968Sopensolaris@drydog.com 13957968Sopensolaris@drydog.com if (dev_list_allocated) 13967968Sopensolaris@drydog.com free(pdevlist); 13970Sstevel@tonic-gate 13980Sstevel@tonic-gate return (SUCCESS); 13990Sstevel@tonic-gate } 1400