10Sstevel@tonic-gate /*
20Sstevel@tonic-gate  * CDDL HEADER START
30Sstevel@tonic-gate  *
40Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
51971Skrishna  * Common Development and Distribution License (the "License").
61971Skrishna  * You may not use this file except in compliance with the License.
70Sstevel@tonic-gate  *
80Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
90Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
100Sstevel@tonic-gate  * See the License for the specific language governing permissions
110Sstevel@tonic-gate  * and limitations under the License.
120Sstevel@tonic-gate  *
130Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
140Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
150Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
160Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
170Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
180Sstevel@tonic-gate  *
190Sstevel@tonic-gate  * CDDL HEADER END
200Sstevel@tonic-gate  */
210Sstevel@tonic-gate /*
22*7968Sopensolaris@drydog.com  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
230Sstevel@tonic-gate  * Use is subject to license terms.
240Sstevel@tonic-gate  */
250Sstevel@tonic-gate 
260Sstevel@tonic-gate #ifndef	_CRYPTOADM_H
270Sstevel@tonic-gate #define	_CRYPTOADM_H
280Sstevel@tonic-gate 
29*7968Sopensolaris@drydog.com #include <sys/types.h>
300Sstevel@tonic-gate #include <sys/crypto/ioctladmin.h>
310Sstevel@tonic-gate #include <cryptoutil.h>
320Sstevel@tonic-gate #include <security/cryptoki.h>
330Sstevel@tonic-gate 
340Sstevel@tonic-gate #ifdef __cplusplus
350Sstevel@tonic-gate extern "C" {
360Sstevel@tonic-gate #endif
370Sstevel@tonic-gate 
380Sstevel@tonic-gate #define	_PATH_KCF_CONF		"/etc/crypto/kcf.conf"
397291Ssuha #define	_PATH_KCFD		"/usr/lib/crypto/kcfd"
400Sstevel@tonic-gate #define	TMPFILE_TEMPLATE	"/etc/crypto/admXXXXXX"
410Sstevel@tonic-gate 
420Sstevel@tonic-gate #define	ERROR_USAGE	2
430Sstevel@tonic-gate 
440Sstevel@tonic-gate /*
450Sstevel@tonic-gate  * Common keywords and delimiters for pkcs11.conf and kcf.conf files are
460Sstevel@tonic-gate  * defined in usr/lib/libcryptoutil/common/cryptoutil.h.  The following is
470Sstevel@tonic-gate  * the extra keywords and delimiters used in kcf.conf file.
480Sstevel@tonic-gate  */
490Sstevel@tonic-gate #define	SEP_SLASH		'/'
500Sstevel@tonic-gate #define	EF_SUPPORTED		"supportedlist="
51*7968Sopensolaris@drydog.com #define	EF_UNLOAD		"unload"
520Sstevel@tonic-gate #define	RANDOM			"random"
530Sstevel@tonic-gate #define	UEF_FRAME_LIB		"/usr/lib/libpkcs11.so"
540Sstevel@tonic-gate 
550Sstevel@tonic-gate #define	ADD_MODE	1
560Sstevel@tonic-gate #define	DELETE_MODE	2
570Sstevel@tonic-gate #define	MODIFY_MODE	3
580Sstevel@tonic-gate 
590Sstevel@tonic-gate typedef char prov_name_t[MAXNAMELEN];
600Sstevel@tonic-gate typedef char mech_name_t[CRYPTO_MAX_MECH_NAME];
610Sstevel@tonic-gate 
620Sstevel@tonic-gate typedef struct mechlist {
630Sstevel@tonic-gate 	mech_name_t	name;
640Sstevel@tonic-gate 	struct mechlist	*next;
650Sstevel@tonic-gate } mechlist_t;
660Sstevel@tonic-gate 
670Sstevel@tonic-gate 
680Sstevel@tonic-gate typedef struct entry {
690Sstevel@tonic-gate 	prov_name_t	name;
700Sstevel@tonic-gate 	mechlist_t	*suplist; /* supported list */
71*7968Sopensolaris@drydog.com 	uint_t		sup_count;
720Sstevel@tonic-gate 	mechlist_t	*dislist; /* disabled list */
73*7968Sopensolaris@drydog.com 	uint_t		dis_count;
74*7968Sopensolaris@drydog.com 	boolean_t	load; /* B_FALSE after cryptoadm unload */
750Sstevel@tonic-gate } entry_t;
760Sstevel@tonic-gate 
770Sstevel@tonic-gate 
780Sstevel@tonic-gate typedef struct entrylist {
790Sstevel@tonic-gate 	entry_t	*pent;
800Sstevel@tonic-gate 	struct entrylist *next;
810Sstevel@tonic-gate } entrylist_t;
820Sstevel@tonic-gate 
830Sstevel@tonic-gate typedef enum {
840Sstevel@tonic-gate 	NO_RNG,
850Sstevel@tonic-gate 	HAS_RNG
860Sstevel@tonic-gate } flag_val_t;
870Sstevel@tonic-gate 
880Sstevel@tonic-gate extern int errno;
890Sstevel@tonic-gate 
900Sstevel@tonic-gate /* adm_util */
910Sstevel@tonic-gate extern boolean_t is_in_list(char *, mechlist_t *);
920Sstevel@tonic-gate extern mechlist_t *create_mech(char *);
930Sstevel@tonic-gate extern void free_mechlist(mechlist_t *);
940Sstevel@tonic-gate 
950Sstevel@tonic-gate /* adm_kef_util */
960Sstevel@tonic-gate extern boolean_t is_device(char *);
970Sstevel@tonic-gate extern char *ent2str(entry_t *);
98*7968Sopensolaris@drydog.com extern entry_t *getent_kef(char *provname,
99*7968Sopensolaris@drydog.com 		entrylist_t *pdevlist, entrylist_t *psoftlist);
100*7968Sopensolaris@drydog.com extern int check_kernel_for_soft(char *provname,
101*7968Sopensolaris@drydog.com 		crypto_get_soft_list_t *psoftlist, boolean_t *in_kernel);
102*7968Sopensolaris@drydog.com extern int check_kernel_for_hard(char *provname,
103*7968Sopensolaris@drydog.com 		crypto_get_dev_list_t *pdevlist, boolean_t *in_kernel);
1040Sstevel@tonic-gate extern int disable_mechs(entry_t **, mechlist_t *, boolean_t, mechlist_t *);
1050Sstevel@tonic-gate extern int enable_mechs(entry_t **, boolean_t, mechlist_t *);
1060Sstevel@tonic-gate extern int get_kcfconf_info(entrylist_t **, entrylist_t **);
1070Sstevel@tonic-gate extern int get_admindev_info(entrylist_t **, entrylist_t **);
1080Sstevel@tonic-gate extern int get_mech_count(mechlist_t *);
109*7968Sopensolaris@drydog.com extern entry_t *create_entry(char *provname);
1100Sstevel@tonic-gate extern int insert_kcfconf(entry_t *);
1110Sstevel@tonic-gate extern int split_hw_provname(char *, char *, int *);
1120Sstevel@tonic-gate extern int update_kcfconf(entry_t *, int);
1130Sstevel@tonic-gate extern void free_entry(entry_t *);
1140Sstevel@tonic-gate extern void free_entrylist(entrylist_t *);
1150Sstevel@tonic-gate extern void print_mechlist(char *, mechlist_t *);
116*7968Sopensolaris@drydog.com extern void print_kef_policy(char *provname, entry_t *pent,
117*7968Sopensolaris@drydog.com 		boolean_t has_random, boolean_t has_mechs);
1180Sstevel@tonic-gate extern boolean_t filter_mechlist(mechlist_t **, const char *);
1190Sstevel@tonic-gate extern uentry_t *getent_uef(char *);
1200Sstevel@tonic-gate 
1210Sstevel@tonic-gate 
1220Sstevel@tonic-gate /* adm_uef */
1230Sstevel@tonic-gate extern int list_mechlist_for_lib(char *, mechlist_t *, flag_val_t *,
1240Sstevel@tonic-gate 		boolean_t, boolean_t, boolean_t);
1250Sstevel@tonic-gate extern int list_policy_for_lib(char *);
1260Sstevel@tonic-gate extern int disable_uef_lib(char *, boolean_t, boolean_t, mechlist_t *);
1270Sstevel@tonic-gate extern int enable_uef_lib(char *, boolean_t, boolean_t, mechlist_t *);
1280Sstevel@tonic-gate extern int install_uef_lib(char *);
1290Sstevel@tonic-gate extern int uninstall_uef_lib(char *);
1300Sstevel@tonic-gate extern int print_uef_policy(uentry_t *);
1310Sstevel@tonic-gate extern void display_token_flags(CK_FLAGS flags);
1320Sstevel@tonic-gate extern int convert_mechlist(CK_MECHANISM_TYPE **, CK_ULONG *, mechlist_t *);
1330Sstevel@tonic-gate extern void display_verbose_mech_header();
1340Sstevel@tonic-gate extern void display_mech_info(CK_MECHANISM_INFO *);
1350Sstevel@tonic-gate extern int display_policy(uentry_t *);
1360Sstevel@tonic-gate extern int update_pkcs11conf(uentry_t *);
1370Sstevel@tonic-gate extern int update_policylist(uentry_t *, mechlist_t *, int);
1380Sstevel@tonic-gate 
1390Sstevel@tonic-gate /* adm_kef */
140*7968Sopensolaris@drydog.com extern int list_mechlist_for_soft(char *provname,
141*7968Sopensolaris@drydog.com 		entrylist_t *phardlist, entrylist_t *psoftlist);
1420Sstevel@tonic-gate extern int list_mechlist_for_hard(char *);
143*7968Sopensolaris@drydog.com extern int list_policy_for_soft(char *provname,
144*7968Sopensolaris@drydog.com 		entrylist_t *phardlist, entrylist_t *psoftlist);
145*7968Sopensolaris@drydog.com extern int list_policy_for_hard(char *provname,
146*7968Sopensolaris@drydog.com 		entrylist_t *phardlist, entrylist_t *psoftlist,
147*7968Sopensolaris@drydog.com 		crypto_get_dev_list_t *pdevlist);
1480Sstevel@tonic-gate extern int disable_kef_software(char *, boolean_t, boolean_t, mechlist_t *);
1490Sstevel@tonic-gate extern int disable_kef_hardware(char *, boolean_t, boolean_t, mechlist_t *);
1500Sstevel@tonic-gate extern int enable_kef(char *, boolean_t, boolean_t, mechlist_t *);
1510Sstevel@tonic-gate extern int install_kef(char *, mechlist_t *);
1520Sstevel@tonic-gate extern int uninstall_kef(char *);
153*7968Sopensolaris@drydog.com extern int unload_kef_soft(char *provname);
1540Sstevel@tonic-gate extern int refresh(void);
1550Sstevel@tonic-gate extern int start_daemon(void);
1560Sstevel@tonic-gate extern int stop_daemon(void);
1570Sstevel@tonic-gate 
1580Sstevel@tonic-gate /* adm_ioctl */
1590Sstevel@tonic-gate extern crypto_load_soft_config_t *setup_soft_conf(entry_t *);
1600Sstevel@tonic-gate extern crypto_load_soft_disabled_t *setup_soft_dis(entry_t *);
1610Sstevel@tonic-gate extern crypto_load_dev_disabled_t *setup_dev_dis(entry_t *);
1620Sstevel@tonic-gate extern crypto_unload_soft_module_t *setup_unload_soft(entry_t *);
1630Sstevel@tonic-gate extern int get_dev_info(char *, int, int, mechlist_t **);
1640Sstevel@tonic-gate extern int get_dev_list(crypto_get_dev_list_t **);
165*7968Sopensolaris@drydog.com extern int get_soft_info(char *provname, mechlist_t **ppmechlist,
166*7968Sopensolaris@drydog.com 		entrylist_t *phardlist, entrylist_t *psoftlist);
1670Sstevel@tonic-gate extern int get_soft_list(crypto_get_soft_list_t **);
1680Sstevel@tonic-gate 
1690Sstevel@tonic-gate /* adm_metaslot */
1700Sstevel@tonic-gate extern int list_metaslot_info(boolean_t, boolean_t, mechlist_t *);
1710Sstevel@tonic-gate extern int list_metaslot_policy();
1720Sstevel@tonic-gate extern int disable_metaslot(mechlist_t *, boolean_t, boolean_t);
1730Sstevel@tonic-gate extern int enable_metaslot(char *, char *, boolean_t, mechlist_t *, boolean_t,
1740Sstevel@tonic-gate     boolean_t);
1750Sstevel@tonic-gate 
1760Sstevel@tonic-gate #ifdef __cplusplus
1770Sstevel@tonic-gate }
1780Sstevel@tonic-gate #endif
1790Sstevel@tonic-gate 
1800Sstevel@tonic-gate #endif /* _CRYPTOADM_H */
181