10Sstevel@tonic-gate /* 20Sstevel@tonic-gate * CDDL HEADER START 30Sstevel@tonic-gate * 40Sstevel@tonic-gate * The contents of this file are subject to the terms of the 51971Skrishna * Common Development and Distribution License (the "License"). 61971Skrishna * You may not use this file except in compliance with the License. 70Sstevel@tonic-gate * 80Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 90Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 100Sstevel@tonic-gate * See the License for the specific language governing permissions 110Sstevel@tonic-gate * and limitations under the License. 120Sstevel@tonic-gate * 130Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 140Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 150Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 160Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 170Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 180Sstevel@tonic-gate * 190Sstevel@tonic-gate * CDDL HEADER END 200Sstevel@tonic-gate */ 210Sstevel@tonic-gate /* 22*7968Sopensolaris@drydog.com * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 230Sstevel@tonic-gate * Use is subject to license terms. 240Sstevel@tonic-gate */ 250Sstevel@tonic-gate 260Sstevel@tonic-gate #ifndef _CRYPTOADM_H 270Sstevel@tonic-gate #define _CRYPTOADM_H 280Sstevel@tonic-gate 29*7968Sopensolaris@drydog.com #include <sys/types.h> 300Sstevel@tonic-gate #include <sys/crypto/ioctladmin.h> 310Sstevel@tonic-gate #include <cryptoutil.h> 320Sstevel@tonic-gate #include <security/cryptoki.h> 330Sstevel@tonic-gate 340Sstevel@tonic-gate #ifdef __cplusplus 350Sstevel@tonic-gate extern "C" { 360Sstevel@tonic-gate #endif 370Sstevel@tonic-gate 380Sstevel@tonic-gate #define _PATH_KCF_CONF "/etc/crypto/kcf.conf" 397291Ssuha #define _PATH_KCFD "/usr/lib/crypto/kcfd" 400Sstevel@tonic-gate #define TMPFILE_TEMPLATE "/etc/crypto/admXXXXXX" 410Sstevel@tonic-gate 420Sstevel@tonic-gate #define ERROR_USAGE 2 430Sstevel@tonic-gate 440Sstevel@tonic-gate /* 450Sstevel@tonic-gate * Common keywords and delimiters for pkcs11.conf and kcf.conf files are 460Sstevel@tonic-gate * defined in usr/lib/libcryptoutil/common/cryptoutil.h. The following is 470Sstevel@tonic-gate * the extra keywords and delimiters used in kcf.conf file. 480Sstevel@tonic-gate */ 490Sstevel@tonic-gate #define SEP_SLASH '/' 500Sstevel@tonic-gate #define EF_SUPPORTED "supportedlist=" 51*7968Sopensolaris@drydog.com #define EF_UNLOAD "unload" 520Sstevel@tonic-gate #define RANDOM "random" 530Sstevel@tonic-gate #define UEF_FRAME_LIB "/usr/lib/libpkcs11.so" 540Sstevel@tonic-gate 550Sstevel@tonic-gate #define ADD_MODE 1 560Sstevel@tonic-gate #define DELETE_MODE 2 570Sstevel@tonic-gate #define MODIFY_MODE 3 580Sstevel@tonic-gate 590Sstevel@tonic-gate typedef char prov_name_t[MAXNAMELEN]; 600Sstevel@tonic-gate typedef char mech_name_t[CRYPTO_MAX_MECH_NAME]; 610Sstevel@tonic-gate 620Sstevel@tonic-gate typedef struct mechlist { 630Sstevel@tonic-gate mech_name_t name; 640Sstevel@tonic-gate struct mechlist *next; 650Sstevel@tonic-gate } mechlist_t; 660Sstevel@tonic-gate 670Sstevel@tonic-gate 680Sstevel@tonic-gate typedef struct entry { 690Sstevel@tonic-gate prov_name_t name; 700Sstevel@tonic-gate mechlist_t *suplist; /* supported list */ 71*7968Sopensolaris@drydog.com uint_t sup_count; 720Sstevel@tonic-gate mechlist_t *dislist; /* disabled list */ 73*7968Sopensolaris@drydog.com uint_t dis_count; 74*7968Sopensolaris@drydog.com boolean_t load; /* B_FALSE after cryptoadm unload */ 750Sstevel@tonic-gate } entry_t; 760Sstevel@tonic-gate 770Sstevel@tonic-gate 780Sstevel@tonic-gate typedef struct entrylist { 790Sstevel@tonic-gate entry_t *pent; 800Sstevel@tonic-gate struct entrylist *next; 810Sstevel@tonic-gate } entrylist_t; 820Sstevel@tonic-gate 830Sstevel@tonic-gate typedef enum { 840Sstevel@tonic-gate NO_RNG, 850Sstevel@tonic-gate HAS_RNG 860Sstevel@tonic-gate } flag_val_t; 870Sstevel@tonic-gate 880Sstevel@tonic-gate extern int errno; 890Sstevel@tonic-gate 900Sstevel@tonic-gate /* adm_util */ 910Sstevel@tonic-gate extern boolean_t is_in_list(char *, mechlist_t *); 920Sstevel@tonic-gate extern mechlist_t *create_mech(char *); 930Sstevel@tonic-gate extern void free_mechlist(mechlist_t *); 940Sstevel@tonic-gate 950Sstevel@tonic-gate /* adm_kef_util */ 960Sstevel@tonic-gate extern boolean_t is_device(char *); 970Sstevel@tonic-gate extern char *ent2str(entry_t *); 98*7968Sopensolaris@drydog.com extern entry_t *getent_kef(char *provname, 99*7968Sopensolaris@drydog.com entrylist_t *pdevlist, entrylist_t *psoftlist); 100*7968Sopensolaris@drydog.com extern int check_kernel_for_soft(char *provname, 101*7968Sopensolaris@drydog.com crypto_get_soft_list_t *psoftlist, boolean_t *in_kernel); 102*7968Sopensolaris@drydog.com extern int check_kernel_for_hard(char *provname, 103*7968Sopensolaris@drydog.com crypto_get_dev_list_t *pdevlist, boolean_t *in_kernel); 1040Sstevel@tonic-gate extern int disable_mechs(entry_t **, mechlist_t *, boolean_t, mechlist_t *); 1050Sstevel@tonic-gate extern int enable_mechs(entry_t **, boolean_t, mechlist_t *); 1060Sstevel@tonic-gate extern int get_kcfconf_info(entrylist_t **, entrylist_t **); 1070Sstevel@tonic-gate extern int get_admindev_info(entrylist_t **, entrylist_t **); 1080Sstevel@tonic-gate extern int get_mech_count(mechlist_t *); 109*7968Sopensolaris@drydog.com extern entry_t *create_entry(char *provname); 1100Sstevel@tonic-gate extern int insert_kcfconf(entry_t *); 1110Sstevel@tonic-gate extern int split_hw_provname(char *, char *, int *); 1120Sstevel@tonic-gate extern int update_kcfconf(entry_t *, int); 1130Sstevel@tonic-gate extern void free_entry(entry_t *); 1140Sstevel@tonic-gate extern void free_entrylist(entrylist_t *); 1150Sstevel@tonic-gate extern void print_mechlist(char *, mechlist_t *); 116*7968Sopensolaris@drydog.com extern void print_kef_policy(char *provname, entry_t *pent, 117*7968Sopensolaris@drydog.com boolean_t has_random, boolean_t has_mechs); 1180Sstevel@tonic-gate extern boolean_t filter_mechlist(mechlist_t **, const char *); 1190Sstevel@tonic-gate extern uentry_t *getent_uef(char *); 1200Sstevel@tonic-gate 1210Sstevel@tonic-gate 1220Sstevel@tonic-gate /* adm_uef */ 1230Sstevel@tonic-gate extern int list_mechlist_for_lib(char *, mechlist_t *, flag_val_t *, 1240Sstevel@tonic-gate boolean_t, boolean_t, boolean_t); 1250Sstevel@tonic-gate extern int list_policy_for_lib(char *); 1260Sstevel@tonic-gate extern int disable_uef_lib(char *, boolean_t, boolean_t, mechlist_t *); 1270Sstevel@tonic-gate extern int enable_uef_lib(char *, boolean_t, boolean_t, mechlist_t *); 1280Sstevel@tonic-gate extern int install_uef_lib(char *); 1290Sstevel@tonic-gate extern int uninstall_uef_lib(char *); 1300Sstevel@tonic-gate extern int print_uef_policy(uentry_t *); 1310Sstevel@tonic-gate extern void display_token_flags(CK_FLAGS flags); 1320Sstevel@tonic-gate extern int convert_mechlist(CK_MECHANISM_TYPE **, CK_ULONG *, mechlist_t *); 1330Sstevel@tonic-gate extern void display_verbose_mech_header(); 1340Sstevel@tonic-gate extern void display_mech_info(CK_MECHANISM_INFO *); 1350Sstevel@tonic-gate extern int display_policy(uentry_t *); 1360Sstevel@tonic-gate extern int update_pkcs11conf(uentry_t *); 1370Sstevel@tonic-gate extern int update_policylist(uentry_t *, mechlist_t *, int); 1380Sstevel@tonic-gate 1390Sstevel@tonic-gate /* adm_kef */ 140*7968Sopensolaris@drydog.com extern int list_mechlist_for_soft(char *provname, 141*7968Sopensolaris@drydog.com entrylist_t *phardlist, entrylist_t *psoftlist); 1420Sstevel@tonic-gate extern int list_mechlist_for_hard(char *); 143*7968Sopensolaris@drydog.com extern int list_policy_for_soft(char *provname, 144*7968Sopensolaris@drydog.com entrylist_t *phardlist, entrylist_t *psoftlist); 145*7968Sopensolaris@drydog.com extern int list_policy_for_hard(char *provname, 146*7968Sopensolaris@drydog.com entrylist_t *phardlist, entrylist_t *psoftlist, 147*7968Sopensolaris@drydog.com crypto_get_dev_list_t *pdevlist); 1480Sstevel@tonic-gate extern int disable_kef_software(char *, boolean_t, boolean_t, mechlist_t *); 1490Sstevel@tonic-gate extern int disable_kef_hardware(char *, boolean_t, boolean_t, mechlist_t *); 1500Sstevel@tonic-gate extern int enable_kef(char *, boolean_t, boolean_t, mechlist_t *); 1510Sstevel@tonic-gate extern int install_kef(char *, mechlist_t *); 1520Sstevel@tonic-gate extern int uninstall_kef(char *); 153*7968Sopensolaris@drydog.com extern int unload_kef_soft(char *provname); 1540Sstevel@tonic-gate extern int refresh(void); 1550Sstevel@tonic-gate extern int start_daemon(void); 1560Sstevel@tonic-gate extern int stop_daemon(void); 1570Sstevel@tonic-gate 1580Sstevel@tonic-gate /* adm_ioctl */ 1590Sstevel@tonic-gate extern crypto_load_soft_config_t *setup_soft_conf(entry_t *); 1600Sstevel@tonic-gate extern crypto_load_soft_disabled_t *setup_soft_dis(entry_t *); 1610Sstevel@tonic-gate extern crypto_load_dev_disabled_t *setup_dev_dis(entry_t *); 1620Sstevel@tonic-gate extern crypto_unload_soft_module_t *setup_unload_soft(entry_t *); 1630Sstevel@tonic-gate extern int get_dev_info(char *, int, int, mechlist_t **); 1640Sstevel@tonic-gate extern int get_dev_list(crypto_get_dev_list_t **); 165*7968Sopensolaris@drydog.com extern int get_soft_info(char *provname, mechlist_t **ppmechlist, 166*7968Sopensolaris@drydog.com entrylist_t *phardlist, entrylist_t *psoftlist); 1670Sstevel@tonic-gate extern int get_soft_list(crypto_get_soft_list_t **); 1680Sstevel@tonic-gate 1690Sstevel@tonic-gate /* adm_metaslot */ 1700Sstevel@tonic-gate extern int list_metaslot_info(boolean_t, boolean_t, mechlist_t *); 1710Sstevel@tonic-gate extern int list_metaslot_policy(); 1720Sstevel@tonic-gate extern int disable_metaslot(mechlist_t *, boolean_t, boolean_t); 1730Sstevel@tonic-gate extern int enable_metaslot(char *, char *, boolean_t, mechlist_t *, boolean_t, 1740Sstevel@tonic-gate boolean_t); 1750Sstevel@tonic-gate 1760Sstevel@tonic-gate #ifdef __cplusplus 1770Sstevel@tonic-gate } 1780Sstevel@tonic-gate #endif 1790Sstevel@tonic-gate 1800Sstevel@tonic-gate #endif /* _CRYPTOADM_H */ 181