1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * CDDL HEADER START 3*0Sstevel@tonic-gate * 4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only 6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance 7*0Sstevel@tonic-gate * with the License. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 11*0Sstevel@tonic-gate * See the License for the specific language governing permissions 12*0Sstevel@tonic-gate * and limitations under the License. 13*0Sstevel@tonic-gate * 14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 19*0Sstevel@tonic-gate * 20*0Sstevel@tonic-gate * CDDL HEADER END 21*0Sstevel@tonic-gate */ 22*0Sstevel@tonic-gate /* 23*0Sstevel@tonic-gate * Copyright 2004 Sun Microsystems, Inc. All rights reserved. 24*0Sstevel@tonic-gate * Use is subject to license terms. 25*0Sstevel@tonic-gate */ 26*0Sstevel@tonic-gate 27*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 28*0Sstevel@tonic-gate 29*0Sstevel@tonic-gate /* 30*0Sstevel@tonic-gate * digest.c 31*0Sstevel@tonic-gate * 32*0Sstevel@tonic-gate * Implements digest(1) and mac(1) commands 33*0Sstevel@tonic-gate * If command name is mac, performs mac operation 34*0Sstevel@tonic-gate * else perform digest operation 35*0Sstevel@tonic-gate * 36*0Sstevel@tonic-gate * See the man pages for digest and mac for details on 37*0Sstevel@tonic-gate * how these commands work. 38*0Sstevel@tonic-gate */ 39*0Sstevel@tonic-gate 40*0Sstevel@tonic-gate #include <stdio.h> 41*0Sstevel@tonic-gate #include <stdlib.h> 42*0Sstevel@tonic-gate #include <unistd.h> 43*0Sstevel@tonic-gate #include <fcntl.h> 44*0Sstevel@tonic-gate #include <ctype.h> 45*0Sstevel@tonic-gate #include <strings.h> 46*0Sstevel@tonic-gate #include <libintl.h> 47*0Sstevel@tonic-gate #include <libgen.h> 48*0Sstevel@tonic-gate #include <locale.h> 49*0Sstevel@tonic-gate #include <errno.h> 50*0Sstevel@tonic-gate #include <sys/types.h> 51*0Sstevel@tonic-gate #include <sys/stat.h> 52*0Sstevel@tonic-gate #include <security/cryptoki.h> 53*0Sstevel@tonic-gate #include <limits.h> 54*0Sstevel@tonic-gate #include <cryptoutil.h> 55*0Sstevel@tonic-gate 56*0Sstevel@tonic-gate #define BUFFERSIZE (4096) /* Buffer size for reading file */ 57*0Sstevel@tonic-gate 58*0Sstevel@tonic-gate /* 59*0Sstevel@tonic-gate * RESULTLEN - large enough size in bytes to hold result for 60*0Sstevel@tonic-gate * digest and mac results for all mechanisms 61*0Sstevel@tonic-gate */ 62*0Sstevel@tonic-gate #define RESULTLEN (512) 63*0Sstevel@tonic-gate 64*0Sstevel@tonic-gate /* 65*0Sstevel@tonic-gate * Default parameters for PBKDF2 algorithm 66*0Sstevel@tonic-gate */ 67*0Sstevel@tonic-gate #define PBKD2_ITERATIONS (1000) 68*0Sstevel@tonic-gate #define PBKD2_SALT_SIZE 16 69*0Sstevel@tonic-gate 70*0Sstevel@tonic-gate /* 71*0Sstevel@tonic-gate * Exit Status codes 72*0Sstevel@tonic-gate */ 73*0Sstevel@tonic-gate #ifndef EXIT_SUCCESS 74*0Sstevel@tonic-gate #define EXIT_SUCCESS 0 /* No errors */ 75*0Sstevel@tonic-gate #define EXIT_FAILURE 1 /* All errors except usage */ 76*0Sstevel@tonic-gate #endif /* EXIT_SUCCESS */ 77*0Sstevel@tonic-gate 78*0Sstevel@tonic-gate #define EXIT_USAGE 2 /* usage/syntax error */ 79*0Sstevel@tonic-gate 80*0Sstevel@tonic-gate #define MAC_NAME "mac" /* name of mac command */ 81*0Sstevel@tonic-gate #define MAC_OPTIONS "lva:k:" /* for getopt */ 82*0Sstevel@tonic-gate #define DIGEST_NAME "digest" /* name of mac command */ 83*0Sstevel@tonic-gate #define DIGEST_OPTIONS "lva:" /* for getopt */ 84*0Sstevel@tonic-gate 85*0Sstevel@tonic-gate static boolean_t vflag = B_FALSE; /* -v (verbose) flag, optional */ 86*0Sstevel@tonic-gate static boolean_t aflag = B_FALSE; /* -a <algorithm> flag, required */ 87*0Sstevel@tonic-gate static boolean_t lflag = B_FALSE; /* -l flag, for mac and digest */ 88*0Sstevel@tonic-gate 89*0Sstevel@tonic-gate static char *keyfile = NULL; /* name of keyfile */ 90*0Sstevel@tonic-gate static CK_BYTE buf[BUFFERSIZE]; 91*0Sstevel@tonic-gate 92*0Sstevel@tonic-gate struct mech_alias { 93*0Sstevel@tonic-gate CK_MECHANISM_TYPE type; 94*0Sstevel@tonic-gate char *alias; 95*0Sstevel@tonic-gate CK_ULONG keysize_min; 96*0Sstevel@tonic-gate CK_ULONG keysize_max; 97*0Sstevel@tonic-gate int keysize_unit; 98*0Sstevel@tonic-gate boolean_t available; 99*0Sstevel@tonic-gate }; 100*0Sstevel@tonic-gate 101*0Sstevel@tonic-gate #define MECH_ALIASES_COUNT 5 102*0Sstevel@tonic-gate 103*0Sstevel@tonic-gate static struct mech_alias mech_aliases[] = { 104*0Sstevel@tonic-gate { CKM_SHA_1, "sha1", ULONG_MAX, 0L, 8, B_FALSE }, 105*0Sstevel@tonic-gate { CKM_MD5, "md5", ULONG_MAX, 0L, 8, B_FALSE }, 106*0Sstevel@tonic-gate { CKM_DES_MAC, "des_mac", ULONG_MAX, 0L, 8, B_FALSE }, 107*0Sstevel@tonic-gate { CKM_SHA_1_HMAC, "sha1_hmac", ULONG_MAX, 0L, 8, B_FALSE }, 108*0Sstevel@tonic-gate { CKM_MD5_HMAC, "md5_hmac", ULONG_MAX, 0L, 8, B_FALSE }, 109*0Sstevel@tonic-gate }; 110*0Sstevel@tonic-gate 111*0Sstevel@tonic-gate static CK_BBOOL true = TRUE; 112*0Sstevel@tonic-gate 113*0Sstevel@tonic-gate static void usage(boolean_t mac_cmd); 114*0Sstevel@tonic-gate static int execute_cmd(char *algo_str, int filecount, 115*0Sstevel@tonic-gate char **filelist, boolean_t mac_cmd); 116*0Sstevel@tonic-gate static CK_RV do_mac(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pmech, 117*0Sstevel@tonic-gate int fd, CK_OBJECT_HANDLE key, CK_BYTE_PTR *psignature, 118*0Sstevel@tonic-gate CK_ULONG_PTR psignaturelen); 119*0Sstevel@tonic-gate static CK_RV do_digest(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pmech, 120*0Sstevel@tonic-gate int fd, CK_BYTE_PTR *pdigest, CK_ULONG_PTR pdigestlen); 121*0Sstevel@tonic-gate static int getkey(char *filename, CK_BYTE_PTR *pkeydata); 122*0Sstevel@tonic-gate 123*0Sstevel@tonic-gate int 124*0Sstevel@tonic-gate main(int argc, char **argv) 125*0Sstevel@tonic-gate { 126*0Sstevel@tonic-gate 127*0Sstevel@tonic-gate extern char *optarg; 128*0Sstevel@tonic-gate extern int optind; 129*0Sstevel@tonic-gate int errflag = 0; /* We had an optstr parse error */ 130*0Sstevel@tonic-gate char c; /* current getopts flag */ 131*0Sstevel@tonic-gate char *algo_str; /* mechanism/algorithm string */ 132*0Sstevel@tonic-gate int filecount; 133*0Sstevel@tonic-gate boolean_t mac_cmd; /* if TRUE, do mac, else do digest */ 134*0Sstevel@tonic-gate char *optstr; 135*0Sstevel@tonic-gate char **filelist; /* list of files */ 136*0Sstevel@tonic-gate char *cmdname = NULL; /* name of command */ 137*0Sstevel@tonic-gate 138*0Sstevel@tonic-gate (void) setlocale(LC_ALL, ""); 139*0Sstevel@tonic-gate #if !defined(TEXT_DOMAIN) /* Should be defiend by cc -D */ 140*0Sstevel@tonic-gate #define TEXT_DOMAIN "SYS_TEST" /* Use this only if it weren't */ 141*0Sstevel@tonic-gate #endif 142*0Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 143*0Sstevel@tonic-gate 144*0Sstevel@tonic-gate /* 145*0Sstevel@tonic-gate * Based on command name, determine 146*0Sstevel@tonic-gate * type of command. mac is mac 147*0Sstevel@tonic-gate * everything else is digest. 148*0Sstevel@tonic-gate */ 149*0Sstevel@tonic-gate cmdname = basename(argv[0]); 150*0Sstevel@tonic-gate 151*0Sstevel@tonic-gate cryptodebug_init(cmdname); 152*0Sstevel@tonic-gate 153*0Sstevel@tonic-gate if (strcmp(cmdname, MAC_NAME) == 0) 154*0Sstevel@tonic-gate mac_cmd = B_TRUE; 155*0Sstevel@tonic-gate else if (strcmp(cmdname, DIGEST_NAME) == 0) 156*0Sstevel@tonic-gate mac_cmd = B_FALSE; 157*0Sstevel@tonic-gate else { 158*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 159*0Sstevel@tonic-gate "command name must be either digest or mac\n")); 160*0Sstevel@tonic-gate exit(EXIT_USAGE); 161*0Sstevel@tonic-gate } 162*0Sstevel@tonic-gate 163*0Sstevel@tonic-gate if (mac_cmd) { 164*0Sstevel@tonic-gate optstr = MAC_OPTIONS; 165*0Sstevel@tonic-gate } else { 166*0Sstevel@tonic-gate optstr = DIGEST_OPTIONS; 167*0Sstevel@tonic-gate } 168*0Sstevel@tonic-gate 169*0Sstevel@tonic-gate /* Parse command line arguments */ 170*0Sstevel@tonic-gate while (!errflag && (c = getopt(argc, argv, optstr)) != -1) { 171*0Sstevel@tonic-gate 172*0Sstevel@tonic-gate switch (c) { 173*0Sstevel@tonic-gate case 'v': 174*0Sstevel@tonic-gate vflag = B_TRUE; 175*0Sstevel@tonic-gate break; 176*0Sstevel@tonic-gate case 'a': 177*0Sstevel@tonic-gate aflag = B_TRUE; 178*0Sstevel@tonic-gate algo_str = optarg; 179*0Sstevel@tonic-gate break; 180*0Sstevel@tonic-gate case 'k': 181*0Sstevel@tonic-gate keyfile = optarg; 182*0Sstevel@tonic-gate break; 183*0Sstevel@tonic-gate case 'l': 184*0Sstevel@tonic-gate lflag = B_TRUE; 185*0Sstevel@tonic-gate break; 186*0Sstevel@tonic-gate default: 187*0Sstevel@tonic-gate errflag++; 188*0Sstevel@tonic-gate } 189*0Sstevel@tonic-gate } 190*0Sstevel@tonic-gate 191*0Sstevel@tonic-gate filecount = argc - optind; 192*0Sstevel@tonic-gate if (errflag || (!aflag && !lflag) || (lflag && argc > 2) || 193*0Sstevel@tonic-gate filecount < 0) { 194*0Sstevel@tonic-gate usage(mac_cmd); 195*0Sstevel@tonic-gate exit(EXIT_USAGE); 196*0Sstevel@tonic-gate } 197*0Sstevel@tonic-gate 198*0Sstevel@tonic-gate if (filecount == 0) { 199*0Sstevel@tonic-gate filelist = NULL; 200*0Sstevel@tonic-gate } else { 201*0Sstevel@tonic-gate filelist = &argv[optind]; 202*0Sstevel@tonic-gate } 203*0Sstevel@tonic-gate 204*0Sstevel@tonic-gate return (execute_cmd(algo_str, filecount, filelist, mac_cmd)); 205*0Sstevel@tonic-gate } 206*0Sstevel@tonic-gate 207*0Sstevel@tonic-gate /* 208*0Sstevel@tonic-gate * usage message for digest/mac 209*0Sstevel@tonic-gate */ 210*0Sstevel@tonic-gate static void 211*0Sstevel@tonic-gate usage(boolean_t mac_cmd) 212*0Sstevel@tonic-gate { 213*0Sstevel@tonic-gate if (mac_cmd) { 214*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 215*0Sstevel@tonic-gate "usage: mac -l | [-v] -a <algorithm> [-k <keyfile>] " 216*0Sstevel@tonic-gate "[file...]")); 217*0Sstevel@tonic-gate } else { 218*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, 219*0Sstevel@tonic-gate gettext("usage: digest -l | [-v] -a <algorithm> " 220*0Sstevel@tonic-gate "[file...]")); 221*0Sstevel@tonic-gate } 222*0Sstevel@tonic-gate } 223*0Sstevel@tonic-gate 224*0Sstevel@tonic-gate /* 225*0Sstevel@tonic-gate * Print out list of available algorithms. 226*0Sstevel@tonic-gate */ 227*0Sstevel@tonic-gate static void 228*0Sstevel@tonic-gate algorithm_list(boolean_t mac_cmd) 229*0Sstevel@tonic-gate { 230*0Sstevel@tonic-gate int mech; 231*0Sstevel@tonic-gate 232*0Sstevel@tonic-gate if (mac_cmd) 233*0Sstevel@tonic-gate (void) printf(gettext("Algorithm Keysize: Min " 234*0Sstevel@tonic-gate "Max (bits)\n" 235*0Sstevel@tonic-gate "------------------------------------------\n")); 236*0Sstevel@tonic-gate 237*0Sstevel@tonic-gate for (mech = 0; mech < MECH_ALIASES_COUNT; mech++) { 238*0Sstevel@tonic-gate 239*0Sstevel@tonic-gate if (mech_aliases[mech].available == B_FALSE) 240*0Sstevel@tonic-gate continue; 241*0Sstevel@tonic-gate 242*0Sstevel@tonic-gate if (mac_cmd) { 243*0Sstevel@tonic-gate (void) printf("%-15s", mech_aliases[mech].alias); 244*0Sstevel@tonic-gate 245*0Sstevel@tonic-gate if (mech_aliases[mech].keysize_min != ULONG_MAX && 246*0Sstevel@tonic-gate mech_aliases[mech].keysize_max != 0) 247*0Sstevel@tonic-gate (void) printf(" %5lu %5lu\n", 248*0Sstevel@tonic-gate (mech_aliases[mech].keysize_min * 249*0Sstevel@tonic-gate mech_aliases[mech].keysize_unit), 250*0Sstevel@tonic-gate (mech_aliases[mech].keysize_max * 251*0Sstevel@tonic-gate mech_aliases[mech].keysize_unit)); 252*0Sstevel@tonic-gate else 253*0Sstevel@tonic-gate (void) printf("\n"); 254*0Sstevel@tonic-gate 255*0Sstevel@tonic-gate } else 256*0Sstevel@tonic-gate (void) printf("%s\n", mech_aliases[mech].alias); 257*0Sstevel@tonic-gate 258*0Sstevel@tonic-gate } 259*0Sstevel@tonic-gate } 260*0Sstevel@tonic-gate 261*0Sstevel@tonic-gate static CK_RV 262*0Sstevel@tonic-gate generate_pkcs5_key(CK_SESSION_HANDLE hSession, 263*0Sstevel@tonic-gate CK_BYTE_PTR pSaltData, 264*0Sstevel@tonic-gate CK_ULONG saltLen, 265*0Sstevel@tonic-gate CK_ULONG iterations, 266*0Sstevel@tonic-gate CK_BYTE_PTR pkeydata, /* user entered passphrase */ 267*0Sstevel@tonic-gate CK_KEY_TYPE keytype, 268*0Sstevel@tonic-gate CK_ULONG passwd_size, 269*0Sstevel@tonic-gate CK_ULONG keylen, /* desired length of generated key */ 270*0Sstevel@tonic-gate CK_OBJECT_HANDLE *hKey) 271*0Sstevel@tonic-gate { 272*0Sstevel@tonic-gate CK_RV rv; 273*0Sstevel@tonic-gate CK_PKCS5_PBKD2_PARAMS params; 274*0Sstevel@tonic-gate CK_MECHANISM mechanism; 275*0Sstevel@tonic-gate CK_OBJECT_CLASS class = CKO_SECRET_KEY; 276*0Sstevel@tonic-gate CK_ATTRIBUTE tmpl[4]; 277*0Sstevel@tonic-gate int attrs = 0; 278*0Sstevel@tonic-gate 279*0Sstevel@tonic-gate tmpl[attrs].type = CKA_CLASS; 280*0Sstevel@tonic-gate tmpl[attrs].pValue = &class; 281*0Sstevel@tonic-gate tmpl[attrs].ulValueLen = sizeof (class); 282*0Sstevel@tonic-gate attrs++; 283*0Sstevel@tonic-gate 284*0Sstevel@tonic-gate tmpl[attrs].type = CKA_KEY_TYPE; 285*0Sstevel@tonic-gate tmpl[attrs].pValue = &keytype; 286*0Sstevel@tonic-gate tmpl[attrs].ulValueLen = sizeof (keytype); 287*0Sstevel@tonic-gate attrs++; 288*0Sstevel@tonic-gate 289*0Sstevel@tonic-gate tmpl[attrs].type = CKA_SIGN; 290*0Sstevel@tonic-gate tmpl[attrs].pValue = &true; 291*0Sstevel@tonic-gate tmpl[attrs].ulValueLen = sizeof (CK_BBOOL); 292*0Sstevel@tonic-gate attrs++; 293*0Sstevel@tonic-gate 294*0Sstevel@tonic-gate if (keylen > 0) { 295*0Sstevel@tonic-gate tmpl[attrs].type = CKA_VALUE_LEN; 296*0Sstevel@tonic-gate tmpl[attrs].pValue = &keylen; 297*0Sstevel@tonic-gate tmpl[attrs].ulValueLen = sizeof (keylen); 298*0Sstevel@tonic-gate attrs++; 299*0Sstevel@tonic-gate } 300*0Sstevel@tonic-gate 301*0Sstevel@tonic-gate params.saltSource = CKZ_SALT_SPECIFIED; 302*0Sstevel@tonic-gate params.pSaltSourceData = (void *)pSaltData; 303*0Sstevel@tonic-gate params.ulSaltSourceDataLen = saltLen; 304*0Sstevel@tonic-gate params.iterations = iterations; 305*0Sstevel@tonic-gate params.prf = CKP_PKCS5_PBKD2_HMAC_SHA1; 306*0Sstevel@tonic-gate params.pPrfData = NULL; 307*0Sstevel@tonic-gate params.ulPrfDataLen = 0; 308*0Sstevel@tonic-gate params.pPassword = (CK_UTF8CHAR_PTR)pkeydata; 309*0Sstevel@tonic-gate params.ulPasswordLen = &passwd_size; 310*0Sstevel@tonic-gate 311*0Sstevel@tonic-gate mechanism.mechanism = CKM_PKCS5_PBKD2; 312*0Sstevel@tonic-gate mechanism.pParameter = ¶ms; 313*0Sstevel@tonic-gate mechanism.ulParameterLen = sizeof (params); 314*0Sstevel@tonic-gate 315*0Sstevel@tonic-gate rv = C_GenerateKey(hSession, &mechanism, tmpl, 316*0Sstevel@tonic-gate attrs, hKey); 317*0Sstevel@tonic-gate 318*0Sstevel@tonic-gate return (rv); 319*0Sstevel@tonic-gate } 320*0Sstevel@tonic-gate 321*0Sstevel@tonic-gate 322*0Sstevel@tonic-gate /* 323*0Sstevel@tonic-gate * Execute the command. 324*0Sstevel@tonic-gate * algo_str - name of algorithm 325*0Sstevel@tonic-gate * filecount - no. of files to process, if 0, use stdin 326*0Sstevel@tonic-gate * filelist - list of files 327*0Sstevel@tonic-gate * mac_cmd - if true do mac else do digest 328*0Sstevel@tonic-gate */ 329*0Sstevel@tonic-gate static int 330*0Sstevel@tonic-gate execute_cmd(char *algo_str, int filecount, char **filelist, boolean_t mac_cmd) 331*0Sstevel@tonic-gate { 332*0Sstevel@tonic-gate int fd; 333*0Sstevel@tonic-gate char *filename = NULL; 334*0Sstevel@tonic-gate CK_RV rv; 335*0Sstevel@tonic-gate CK_ULONG slotcount; 336*0Sstevel@tonic-gate CK_SLOT_ID slotID; 337*0Sstevel@tonic-gate CK_SLOT_ID_PTR pSlotList = NULL; 338*0Sstevel@tonic-gate CK_MECHANISM_TYPE mech_type; 339*0Sstevel@tonic-gate CK_MECHANISM_INFO info; 340*0Sstevel@tonic-gate CK_MECHANISM mech; 341*0Sstevel@tonic-gate CK_SESSION_HANDLE hSession = CK_INVALID_HANDLE; 342*0Sstevel@tonic-gate CK_BYTE_PTR resultbuf = NULL; 343*0Sstevel@tonic-gate CK_ULONG resultlen; 344*0Sstevel@tonic-gate CK_BYTE_PTR pkeydata = NULL; 345*0Sstevel@tonic-gate CK_OBJECT_HANDLE key = (CK_OBJECT_HANDLE) 0; 346*0Sstevel@tonic-gate int keylen = 0; /* key length */ 347*0Sstevel@tonic-gate char *resultstr = NULL; /* result in hex string */ 348*0Sstevel@tonic-gate int resultstrlen; /* result string length */ 349*0Sstevel@tonic-gate int i; 350*0Sstevel@tonic-gate int exitcode = EXIT_SUCCESS; /* return code */ 351*0Sstevel@tonic-gate int slot, mek; /* index variables */ 352*0Sstevel@tonic-gate int mech_match = 0; 353*0Sstevel@tonic-gate CK_BYTE salt[PBKD2_SALT_SIZE]; 354*0Sstevel@tonic-gate CK_ULONG keysize; 355*0Sstevel@tonic-gate CK_ULONG iterations = PBKD2_ITERATIONS; 356*0Sstevel@tonic-gate 357*0Sstevel@tonic-gate if (aflag) { 358*0Sstevel@tonic-gate /* 359*0Sstevel@tonic-gate * Determine if algorithm/mechanism is valid 360*0Sstevel@tonic-gate */ 361*0Sstevel@tonic-gate for (mech_match = 0; mech_match < MECH_ALIASES_COUNT; 362*0Sstevel@tonic-gate mech_match++) { 363*0Sstevel@tonic-gate if (strcmp(algo_str, 364*0Sstevel@tonic-gate mech_aliases[mech_match].alias) == 0) { 365*0Sstevel@tonic-gate mech_type = mech_aliases[mech_match].type; 366*0Sstevel@tonic-gate break; 367*0Sstevel@tonic-gate } 368*0Sstevel@tonic-gate 369*0Sstevel@tonic-gate } 370*0Sstevel@tonic-gate 371*0Sstevel@tonic-gate if (mech_match == MECH_ALIASES_COUNT) { 372*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, 373*0Sstevel@tonic-gate gettext("unknown algorithm -- %s"), algo_str); 374*0Sstevel@tonic-gate return (EXIT_FAILURE); 375*0Sstevel@tonic-gate } 376*0Sstevel@tonic-gate 377*0Sstevel@tonic-gate /* Get key to do a MAC operation */ 378*0Sstevel@tonic-gate if (mac_cmd) { 379*0Sstevel@tonic-gate keylen = getkey(keyfile, &pkeydata); 380*0Sstevel@tonic-gate if (keylen <= 0 || pkeydata == NULL) { 381*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, 382*0Sstevel@tonic-gate gettext("invalid key.")); 383*0Sstevel@tonic-gate return (EXIT_FAILURE); 384*0Sstevel@tonic-gate } 385*0Sstevel@tonic-gate } 386*0Sstevel@tonic-gate } 387*0Sstevel@tonic-gate 388*0Sstevel@tonic-gate /* Initialize, and get list of slots */ 389*0Sstevel@tonic-gate if ((rv = C_Initialize(NULL)) != CKR_OK) { 390*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, 391*0Sstevel@tonic-gate gettext("failed to initialize PKCS #11 framework: %s"), 392*0Sstevel@tonic-gate pkcs11_strerror(rv)); 393*0Sstevel@tonic-gate return (EXIT_FAILURE); 394*0Sstevel@tonic-gate } 395*0Sstevel@tonic-gate 396*0Sstevel@tonic-gate /* Get slot count */ 397*0Sstevel@tonic-gate rv = C_GetSlotList(0, NULL_PTR, &slotcount); 398*0Sstevel@tonic-gate if (rv != CKR_OK || slotcount == 0) { 399*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 400*0Sstevel@tonic-gate "failed to find any cryptographic provider," 401*0Sstevel@tonic-gate "please check with your system administrator: %s"), 402*0Sstevel@tonic-gate pkcs11_strerror(rv)); 403*0Sstevel@tonic-gate exitcode = EXIT_FAILURE; 404*0Sstevel@tonic-gate goto cleanup; 405*0Sstevel@tonic-gate } 406*0Sstevel@tonic-gate 407*0Sstevel@tonic-gate /* Found at least one slot, allocate memory for slot list */ 408*0Sstevel@tonic-gate pSlotList = malloc(slotcount * sizeof (CK_SLOT_ID)); 409*0Sstevel@tonic-gate if (pSlotList == NULL_PTR) { 410*0Sstevel@tonic-gate int err = errno; 411*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("malloc: %s\n"), 412*0Sstevel@tonic-gate strerror(err)); 413*0Sstevel@tonic-gate exitcode = EXIT_FAILURE; 414*0Sstevel@tonic-gate goto cleanup; 415*0Sstevel@tonic-gate } 416*0Sstevel@tonic-gate 417*0Sstevel@tonic-gate /* Get the list of slots */ 418*0Sstevel@tonic-gate if ((rv = C_GetSlotList(0, pSlotList, &slotcount)) != CKR_OK) { 419*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 420*0Sstevel@tonic-gate "failed to find any cryptographic provider," 421*0Sstevel@tonic-gate "please check with your system administrator: %s"), 422*0Sstevel@tonic-gate pkcs11_strerror(rv)); 423*0Sstevel@tonic-gate exitcode = EXIT_FAILURE; 424*0Sstevel@tonic-gate goto cleanup; 425*0Sstevel@tonic-gate } 426*0Sstevel@tonic-gate 427*0Sstevel@tonic-gate /* 428*0Sstevel@tonic-gate * Obtain list of algorithms if -l option was given 429*0Sstevel@tonic-gate */ 430*0Sstevel@tonic-gate if (lflag) { 431*0Sstevel@tonic-gate 432*0Sstevel@tonic-gate for (slot = 0; slot < slotcount; slot++) { 433*0Sstevel@tonic-gate 434*0Sstevel@tonic-gate /* Iterate through each mechanism */ 435*0Sstevel@tonic-gate for (mek = 0; mek < MECH_ALIASES_COUNT; mek++) { 436*0Sstevel@tonic-gate rv = C_GetMechanismInfo(pSlotList[slot], 437*0Sstevel@tonic-gate mech_aliases[mek].type, &info); 438*0Sstevel@tonic-gate 439*0Sstevel@tonic-gate /* Only check algorithms that can be used */ 440*0Sstevel@tonic-gate if ((rv != CKR_OK) || 441*0Sstevel@tonic-gate (!mac_cmd && (info.flags & CKF_SIGN)) || 442*0Sstevel@tonic-gate (mac_cmd && (info.flags & CKF_DIGEST))) 443*0Sstevel@tonic-gate continue; 444*0Sstevel@tonic-gate 445*0Sstevel@tonic-gate /* 446*0Sstevel@tonic-gate * Set to minimum/maximum key sizes assuming 447*0Sstevel@tonic-gate * the values available are not 0. 448*0Sstevel@tonic-gate */ 449*0Sstevel@tonic-gate if (info.ulMinKeySize && (info.ulMinKeySize < 450*0Sstevel@tonic-gate mech_aliases[mek].keysize_min)) 451*0Sstevel@tonic-gate mech_aliases[mek].keysize_min = 452*0Sstevel@tonic-gate info.ulMinKeySize; 453*0Sstevel@tonic-gate 454*0Sstevel@tonic-gate if (info.ulMaxKeySize && (info.ulMaxKeySize > 455*0Sstevel@tonic-gate mech_aliases[mek].keysize_max)) 456*0Sstevel@tonic-gate mech_aliases[mek].keysize_max = 457*0Sstevel@tonic-gate info.ulMaxKeySize; 458*0Sstevel@tonic-gate 459*0Sstevel@tonic-gate mech_aliases[mek].available = B_TRUE; 460*0Sstevel@tonic-gate } 461*0Sstevel@tonic-gate 462*0Sstevel@tonic-gate } 463*0Sstevel@tonic-gate 464*0Sstevel@tonic-gate algorithm_list(mac_cmd); 465*0Sstevel@tonic-gate 466*0Sstevel@tonic-gate goto cleanup; 467*0Sstevel@tonic-gate } 468*0Sstevel@tonic-gate 469*0Sstevel@tonic-gate /* Find a slot with matching mechanism */ 470*0Sstevel@tonic-gate for (i = 0; i < slotcount; i++) { 471*0Sstevel@tonic-gate slotID = pSlotList[i]; 472*0Sstevel@tonic-gate rv = C_GetMechanismInfo(slotID, mech_type, &info); 473*0Sstevel@tonic-gate if (rv != CKR_OK) { 474*0Sstevel@tonic-gate continue; /* to the next slot */ 475*0Sstevel@tonic-gate } else { 476*0Sstevel@tonic-gate if (mac_cmd) { 477*0Sstevel@tonic-gate /* 478*0Sstevel@tonic-gate * Make sure the slot supports 479*0Sstevel@tonic-gate * PKCS5 key generation if we 480*0Sstevel@tonic-gate * will be using it later. 481*0Sstevel@tonic-gate * We use it whenever the key 482*0Sstevel@tonic-gate * is entered at command line. 483*0Sstevel@tonic-gate */ 484*0Sstevel@tonic-gate if ((info.flags & CKF_SIGN) && 485*0Sstevel@tonic-gate (keyfile == NULL)) { 486*0Sstevel@tonic-gate CK_MECHANISM_INFO kg_info; 487*0Sstevel@tonic-gate rv = C_GetMechanismInfo(slotID, 488*0Sstevel@tonic-gate CKM_PKCS5_PBKD2, &kg_info); 489*0Sstevel@tonic-gate if (rv == CKR_OK) 490*0Sstevel@tonic-gate break; 491*0Sstevel@tonic-gate } else if (info.flags & CKF_SIGN) { 492*0Sstevel@tonic-gate break; 493*0Sstevel@tonic-gate } 494*0Sstevel@tonic-gate } else { 495*0Sstevel@tonic-gate if (info.flags & CKF_DIGEST) 496*0Sstevel@tonic-gate break; 497*0Sstevel@tonic-gate } 498*0Sstevel@tonic-gate } 499*0Sstevel@tonic-gate } 500*0Sstevel@tonic-gate 501*0Sstevel@tonic-gate /* Show error if no matching mechanism found */ 502*0Sstevel@tonic-gate if (i == slotcount) { 503*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, 504*0Sstevel@tonic-gate gettext("no cryptographic provider was " 505*0Sstevel@tonic-gate "found for this algorithm -- %s"), algo_str); 506*0Sstevel@tonic-gate exitcode = EXIT_FAILURE; 507*0Sstevel@tonic-gate goto cleanup; 508*0Sstevel@tonic-gate } 509*0Sstevel@tonic-gate 510*0Sstevel@tonic-gate /* Mechanism is supported. Go ahead & open a session */ 511*0Sstevel@tonic-gate rv = C_OpenSession(slotID, CKF_SERIAL_SESSION, 512*0Sstevel@tonic-gate NULL_PTR, NULL, &hSession); 513*0Sstevel@tonic-gate 514*0Sstevel@tonic-gate if (rv != CKR_OK) { 515*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, 516*0Sstevel@tonic-gate gettext("can not open PKCS#11 session: %s"), 517*0Sstevel@tonic-gate pkcs11_strerror(rv)); 518*0Sstevel@tonic-gate exitcode = EXIT_FAILURE; 519*0Sstevel@tonic-gate goto cleanup; 520*0Sstevel@tonic-gate } 521*0Sstevel@tonic-gate 522*0Sstevel@tonic-gate /* Create a key object for mac operation */ 523*0Sstevel@tonic-gate if (mac_cmd) { 524*0Sstevel@tonic-gate /* 525*0Sstevel@tonic-gate * If we read keybytes from a file, 526*0Sstevel@tonic-gate * do NOT process them with C_GenerateKey, 527*0Sstevel@tonic-gate * treat them as raw keydata bytes and 528*0Sstevel@tonic-gate * create a key object for them. 529*0Sstevel@tonic-gate */ 530*0Sstevel@tonic-gate if (keyfile) { 531*0Sstevel@tonic-gate CK_OBJECT_CLASS class = CKO_SECRET_KEY; 532*0Sstevel@tonic-gate CK_KEY_TYPE tmpl_keytype = CKK_GENERIC_SECRET; 533*0Sstevel@tonic-gate CK_BBOOL false = FALSE; 534*0Sstevel@tonic-gate int nattr = 0; 535*0Sstevel@tonic-gate CK_ATTRIBUTE template[5]; 536*0Sstevel@tonic-gate 537*0Sstevel@tonic-gate if (mech_type == CKM_DES_MAC) { 538*0Sstevel@tonic-gate tmpl_keytype = CKK_DES; 539*0Sstevel@tonic-gate } 540*0Sstevel@tonic-gate template[nattr].type = CKA_CLASS; 541*0Sstevel@tonic-gate template[nattr].pValue = &class; 542*0Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (class); 543*0Sstevel@tonic-gate nattr++; 544*0Sstevel@tonic-gate 545*0Sstevel@tonic-gate template[nattr].type = CKA_KEY_TYPE; 546*0Sstevel@tonic-gate template[nattr].pValue = &tmpl_keytype; 547*0Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (tmpl_keytype); 548*0Sstevel@tonic-gate nattr++; 549*0Sstevel@tonic-gate 550*0Sstevel@tonic-gate template[nattr].type = CKA_SIGN; 551*0Sstevel@tonic-gate template[nattr].pValue = &true; 552*0Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (true); 553*0Sstevel@tonic-gate nattr++; 554*0Sstevel@tonic-gate 555*0Sstevel@tonic-gate template[nattr].type = CKA_TOKEN; 556*0Sstevel@tonic-gate template[nattr].pValue = &false; 557*0Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (false); 558*0Sstevel@tonic-gate nattr++; 559*0Sstevel@tonic-gate 560*0Sstevel@tonic-gate template[nattr].type = CKA_VALUE; 561*0Sstevel@tonic-gate template[nattr].pValue = pkeydata; 562*0Sstevel@tonic-gate template[nattr].ulValueLen = keylen; 563*0Sstevel@tonic-gate nattr++; 564*0Sstevel@tonic-gate 565*0Sstevel@tonic-gate rv = C_CreateObject(hSession, template, 566*0Sstevel@tonic-gate nattr, &key); 567*0Sstevel@tonic-gate } else { 568*0Sstevel@tonic-gate CK_KEY_TYPE keytype; 569*0Sstevel@tonic-gate if (mech_type == CKM_DES_MAC) { 570*0Sstevel@tonic-gate keytype = CKK_DES; 571*0Sstevel@tonic-gate keysize = 0; 572*0Sstevel@tonic-gate } else { 573*0Sstevel@tonic-gate keytype = CKK_GENERIC_SECRET; 574*0Sstevel@tonic-gate keysize = 16; /* 128 bits */ 575*0Sstevel@tonic-gate } 576*0Sstevel@tonic-gate /* 577*0Sstevel@tonic-gate * We use a fixed salt (0x0a, 0x0a, 0x0a ...) 578*0Sstevel@tonic-gate * for creating the key so that the end user 579*0Sstevel@tonic-gate * will be able to generate the same 'mac' 580*0Sstevel@tonic-gate * using the same passphrase. 581*0Sstevel@tonic-gate */ 582*0Sstevel@tonic-gate (void) memset(salt, 0x0a, sizeof (salt)); 583*0Sstevel@tonic-gate rv = generate_pkcs5_key(hSession, 584*0Sstevel@tonic-gate salt, sizeof (salt), 585*0Sstevel@tonic-gate iterations, pkeydata, 586*0Sstevel@tonic-gate keytype, keylen, keysize, 587*0Sstevel@tonic-gate &key); 588*0Sstevel@tonic-gate } 589*0Sstevel@tonic-gate 590*0Sstevel@tonic-gate if (rv != CKR_OK) { 591*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, 592*0Sstevel@tonic-gate gettext("unable to create key for crypto " 593*0Sstevel@tonic-gate "operation: %s"), pkcs11_strerror(rv)); 594*0Sstevel@tonic-gate exitcode = EXIT_FAILURE; 595*0Sstevel@tonic-gate goto cleanup; 596*0Sstevel@tonic-gate } 597*0Sstevel@tonic-gate } 598*0Sstevel@tonic-gate 599*0Sstevel@tonic-gate /* Allocate a buffer to store result. */ 600*0Sstevel@tonic-gate resultlen = RESULTLEN; 601*0Sstevel@tonic-gate if ((resultbuf = malloc(resultlen)) == NULL) { 602*0Sstevel@tonic-gate int err = errno; 603*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("malloc: %s\n"), 604*0Sstevel@tonic-gate strerror(err)); 605*0Sstevel@tonic-gate exitcode = EXIT_FAILURE; 606*0Sstevel@tonic-gate goto cleanup; 607*0Sstevel@tonic-gate } 608*0Sstevel@tonic-gate 609*0Sstevel@tonic-gate /* Allocate a buffer to store result string */ 610*0Sstevel@tonic-gate resultstrlen = RESULTLEN; 611*0Sstevel@tonic-gate if ((resultstr = malloc(resultstrlen)) == NULL) { 612*0Sstevel@tonic-gate int err = errno; 613*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("malloc: %s\n"), 614*0Sstevel@tonic-gate strerror(err)); 615*0Sstevel@tonic-gate exitcode = EXIT_FAILURE; 616*0Sstevel@tonic-gate goto cleanup; 617*0Sstevel@tonic-gate } 618*0Sstevel@tonic-gate 619*0Sstevel@tonic-gate mech.mechanism = mech_type; 620*0Sstevel@tonic-gate mech.pParameter = NULL_PTR; 621*0Sstevel@tonic-gate mech.ulParameterLen = 0; 622*0Sstevel@tonic-gate exitcode = EXIT_SUCCESS; 623*0Sstevel@tonic-gate i = 0; 624*0Sstevel@tonic-gate 625*0Sstevel@tonic-gate do { 626*0Sstevel@tonic-gate if (filecount > 0 && filelist != NULL) { 627*0Sstevel@tonic-gate filename = filelist[i]; 628*0Sstevel@tonic-gate if ((fd = open(filename, O_RDONLY 629*0Sstevel@tonic-gate | O_NONBLOCK)) == -1) { 630*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 631*0Sstevel@tonic-gate "can not open input file %s\n"), filename); 632*0Sstevel@tonic-gate exitcode = EXIT_USAGE; 633*0Sstevel@tonic-gate continue; 634*0Sstevel@tonic-gate } 635*0Sstevel@tonic-gate } else { 636*0Sstevel@tonic-gate fd = 0; /* use stdin */ 637*0Sstevel@tonic-gate } 638*0Sstevel@tonic-gate 639*0Sstevel@tonic-gate /* 640*0Sstevel@tonic-gate * Perform the operation 641*0Sstevel@tonic-gate */ 642*0Sstevel@tonic-gate if (mac_cmd) { 643*0Sstevel@tonic-gate rv = do_mac(hSession, &mech, fd, key, &resultbuf, 644*0Sstevel@tonic-gate &resultlen); 645*0Sstevel@tonic-gate } else { 646*0Sstevel@tonic-gate rv = do_digest(hSession, &mech, fd, &resultbuf, 647*0Sstevel@tonic-gate &resultlen); 648*0Sstevel@tonic-gate } 649*0Sstevel@tonic-gate 650*0Sstevel@tonic-gate if (rv != CKR_OK) { 651*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, 652*0Sstevel@tonic-gate gettext("crypto operation failed for " 653*0Sstevel@tonic-gate "file %s: %s\n"), 654*0Sstevel@tonic-gate filename ? filename : "STDIN", 655*0Sstevel@tonic-gate pkcs11_strerror(rv)); 656*0Sstevel@tonic-gate exitcode = EXIT_FAILURE; 657*0Sstevel@tonic-gate continue; 658*0Sstevel@tonic-gate } 659*0Sstevel@tonic-gate 660*0Sstevel@tonic-gate /* if result size has changed, allocate a bigger resulstr buf */ 661*0Sstevel@tonic-gate if (resultlen != RESULTLEN) { 662*0Sstevel@tonic-gate resultstrlen = 2 * resultlen + 1; 663*0Sstevel@tonic-gate resultstr = realloc(resultstr, resultstrlen); 664*0Sstevel@tonic-gate 665*0Sstevel@tonic-gate if (resultstr == NULL) { 666*0Sstevel@tonic-gate int err = errno; 667*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, 668*0Sstevel@tonic-gate gettext("realloc: %s\n"), strerror(err)); 669*0Sstevel@tonic-gate exitcode = EXIT_FAILURE; 670*0Sstevel@tonic-gate goto cleanup; 671*0Sstevel@tonic-gate } 672*0Sstevel@tonic-gate } 673*0Sstevel@tonic-gate 674*0Sstevel@tonic-gate /* Output the result */ 675*0Sstevel@tonic-gate tohexstr(resultbuf, resultlen, resultstr, resultstrlen); 676*0Sstevel@tonic-gate 677*0Sstevel@tonic-gate /* Include mechanism name for verbose */ 678*0Sstevel@tonic-gate if (vflag) 679*0Sstevel@tonic-gate (void) fprintf(stdout, "%s ", algo_str); 680*0Sstevel@tonic-gate 681*0Sstevel@tonic-gate /* Include file name for multiple files, or if verbose */ 682*0Sstevel@tonic-gate if (filecount > 1 || (vflag && filecount > 0)) { 683*0Sstevel@tonic-gate (void) fprintf(stdout, "(%s) = ", filename); 684*0Sstevel@tonic-gate } 685*0Sstevel@tonic-gate 686*0Sstevel@tonic-gate (void) fprintf(stdout, "%s\n", resultstr); 687*0Sstevel@tonic-gate (void) close(fd); 688*0Sstevel@tonic-gate 689*0Sstevel@tonic-gate 690*0Sstevel@tonic-gate } while (++i < filecount); 691*0Sstevel@tonic-gate 692*0Sstevel@tonic-gate 693*0Sstevel@tonic-gate /* clear and free the key */ 694*0Sstevel@tonic-gate if (mac_cmd) { 695*0Sstevel@tonic-gate (void) memset(pkeydata, 0, keylen); 696*0Sstevel@tonic-gate free(pkeydata); 697*0Sstevel@tonic-gate pkeydata = NULL; 698*0Sstevel@tonic-gate } 699*0Sstevel@tonic-gate 700*0Sstevel@tonic-gate cleanup: 701*0Sstevel@tonic-gate if (resultbuf != NULL) { 702*0Sstevel@tonic-gate free(resultbuf); 703*0Sstevel@tonic-gate } 704*0Sstevel@tonic-gate 705*0Sstevel@tonic-gate if (resultstr != NULL) { 706*0Sstevel@tonic-gate free(resultstr); 707*0Sstevel@tonic-gate } 708*0Sstevel@tonic-gate 709*0Sstevel@tonic-gate if (pSlotList != NULL) { 710*0Sstevel@tonic-gate free(pSlotList); 711*0Sstevel@tonic-gate } 712*0Sstevel@tonic-gate 713*0Sstevel@tonic-gate if (key != (CK_OBJECT_HANDLE) 0) { 714*0Sstevel@tonic-gate (void) C_DestroyObject(hSession, key); 715*0Sstevel@tonic-gate } 716*0Sstevel@tonic-gate 717*0Sstevel@tonic-gate if (hSession != CK_INVALID_HANDLE) 718*0Sstevel@tonic-gate (void) C_CloseSession(hSession); 719*0Sstevel@tonic-gate 720*0Sstevel@tonic-gate (void) C_Finalize(NULL_PTR); 721*0Sstevel@tonic-gate 722*0Sstevel@tonic-gate return (exitcode); 723*0Sstevel@tonic-gate } 724*0Sstevel@tonic-gate 725*0Sstevel@tonic-gate /* 726*0Sstevel@tonic-gate * do_digest - Compute digest of a file 727*0Sstevel@tonic-gate * 728*0Sstevel@tonic-gate * hSession - session 729*0Sstevel@tonic-gate * pmech - ptr to mechanism to be used for digest 730*0Sstevel@tonic-gate * fd - file descriptor 731*0Sstevel@tonic-gate * pdigest - buffer where digest result is returned 732*0Sstevel@tonic-gate * pdigestlen - length of digest buffer on input, 733*0Sstevel@tonic-gate * length of result on output 734*0Sstevel@tonic-gate */ 735*0Sstevel@tonic-gate static CK_RV 736*0Sstevel@tonic-gate do_digest(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pmech, 737*0Sstevel@tonic-gate int fd, CK_BYTE_PTR *pdigest, CK_ULONG_PTR pdigestlen) 738*0Sstevel@tonic-gate { 739*0Sstevel@tonic-gate CK_RV rv; 740*0Sstevel@tonic-gate ssize_t nread; 741*0Sstevel@tonic-gate int saved_errno; 742*0Sstevel@tonic-gate 743*0Sstevel@tonic-gate if ((rv = C_DigestInit(hSession, pmech)) != CKR_OK) { 744*0Sstevel@tonic-gate return (rv); 745*0Sstevel@tonic-gate } 746*0Sstevel@tonic-gate 747*0Sstevel@tonic-gate while ((nread = read(fd, buf, sizeof (buf))) > 0) { 748*0Sstevel@tonic-gate /* Get the digest */ 749*0Sstevel@tonic-gate rv = C_DigestUpdate(hSession, buf, (CK_ULONG)nread); 750*0Sstevel@tonic-gate if (rv != CKR_OK) 751*0Sstevel@tonic-gate return (rv); 752*0Sstevel@tonic-gate } 753*0Sstevel@tonic-gate 754*0Sstevel@tonic-gate saved_errno = errno; /* for later use */ 755*0Sstevel@tonic-gate 756*0Sstevel@tonic-gate /* 757*0Sstevel@tonic-gate * Perform the C_DigestFinal, even if there is a read error. 758*0Sstevel@tonic-gate * Otherwise C_DigestInit will return CKR_OPERATION_ACTIVE 759*0Sstevel@tonic-gate * next time it is called (for another file) 760*0Sstevel@tonic-gate */ 761*0Sstevel@tonic-gate 762*0Sstevel@tonic-gate rv = C_DigestFinal(hSession, *pdigest, pdigestlen); 763*0Sstevel@tonic-gate 764*0Sstevel@tonic-gate /* result too big to fit? Allocate a bigger buffer */ 765*0Sstevel@tonic-gate if (rv == CKR_BUFFER_TOO_SMALL) { 766*0Sstevel@tonic-gate *pdigest = realloc(*pdigest, *pdigestlen); 767*0Sstevel@tonic-gate 768*0Sstevel@tonic-gate if (*pdigest == NULL_PTR) { 769*0Sstevel@tonic-gate int err = errno; 770*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, 771*0Sstevel@tonic-gate gettext("realloc: %s\n"), strerror(err)); 772*0Sstevel@tonic-gate return (CKR_HOST_MEMORY); 773*0Sstevel@tonic-gate } 774*0Sstevel@tonic-gate 775*0Sstevel@tonic-gate rv = C_DigestFinal(hSession, *pdigest, pdigestlen); 776*0Sstevel@tonic-gate } 777*0Sstevel@tonic-gate 778*0Sstevel@tonic-gate 779*0Sstevel@tonic-gate /* There was a read error */ 780*0Sstevel@tonic-gate if (nread == -1) { 781*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 782*0Sstevel@tonic-gate "error reading file: %s"), strerror(saved_errno)); 783*0Sstevel@tonic-gate return (CKR_GENERAL_ERROR); 784*0Sstevel@tonic-gate } else { 785*0Sstevel@tonic-gate return (rv); 786*0Sstevel@tonic-gate } 787*0Sstevel@tonic-gate } 788*0Sstevel@tonic-gate 789*0Sstevel@tonic-gate /* 790*0Sstevel@tonic-gate * do_mac - Compute mac of a file 791*0Sstevel@tonic-gate * 792*0Sstevel@tonic-gate * hSession - session 793*0Sstevel@tonic-gate * pmech - ptr to mechanism to be used 794*0Sstevel@tonic-gate * fd - file descriptor 795*0Sstevel@tonic-gate * key - key to be used 796*0Sstevel@tonic-gate * psignature - ptr buffer where mac result is returned 797*0Sstevel@tonic-gate * returns new buf if current buf is small 798*0Sstevel@tonic-gate * psignaturelen - length of mac buffer on input, 799*0Sstevel@tonic-gate * length of result on output 800*0Sstevel@tonic-gate */ 801*0Sstevel@tonic-gate static CK_RV 802*0Sstevel@tonic-gate do_mac(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pmech, 803*0Sstevel@tonic-gate int fd, CK_OBJECT_HANDLE key, CK_BYTE_PTR *psignature, 804*0Sstevel@tonic-gate CK_ULONG_PTR psignaturelen) 805*0Sstevel@tonic-gate { 806*0Sstevel@tonic-gate CK_RV rv; 807*0Sstevel@tonic-gate ssize_t nread; 808*0Sstevel@tonic-gate int saved_errno; 809*0Sstevel@tonic-gate 810*0Sstevel@tonic-gate if ((rv = C_SignInit(hSession, pmech, key)) != CKR_OK) { 811*0Sstevel@tonic-gate return (rv); 812*0Sstevel@tonic-gate } 813*0Sstevel@tonic-gate 814*0Sstevel@tonic-gate while ((nread = read(fd, buf, sizeof (buf))) > 0) { 815*0Sstevel@tonic-gate /* Get the MAC */ 816*0Sstevel@tonic-gate rv = C_SignUpdate(hSession, buf, (CK_ULONG)nread); 817*0Sstevel@tonic-gate if (rv != CKR_OK) 818*0Sstevel@tonic-gate return (rv); 819*0Sstevel@tonic-gate } 820*0Sstevel@tonic-gate 821*0Sstevel@tonic-gate saved_errno = errno; /* for later use */ 822*0Sstevel@tonic-gate 823*0Sstevel@tonic-gate /* 824*0Sstevel@tonic-gate * Perform the C_SignFinal, even if there is a read error. 825*0Sstevel@tonic-gate * Otherwise C_SignInit will return CKR_OPERATION_ACTIVE 826*0Sstevel@tonic-gate * next time it is called (for another file) 827*0Sstevel@tonic-gate */ 828*0Sstevel@tonic-gate 829*0Sstevel@tonic-gate rv = C_SignFinal(hSession, *psignature, psignaturelen); 830*0Sstevel@tonic-gate 831*0Sstevel@tonic-gate /* result too big to fit? Allocate a bigger buffer */ 832*0Sstevel@tonic-gate if (rv == CKR_BUFFER_TOO_SMALL) { 833*0Sstevel@tonic-gate *psignature = realloc(*psignature, *psignaturelen); 834*0Sstevel@tonic-gate 835*0Sstevel@tonic-gate if (*psignature == NULL_PTR) { 836*0Sstevel@tonic-gate int err = errno; 837*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, 838*0Sstevel@tonic-gate gettext("realloc: %s\n"), strerror(err)); 839*0Sstevel@tonic-gate return (CKR_HOST_MEMORY); 840*0Sstevel@tonic-gate } 841*0Sstevel@tonic-gate 842*0Sstevel@tonic-gate rv = C_SignFinal(hSession, *psignature, psignaturelen); 843*0Sstevel@tonic-gate } 844*0Sstevel@tonic-gate 845*0Sstevel@tonic-gate /* There was a read error */ 846*0Sstevel@tonic-gate if (nread == -1) { 847*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("error reading file: %s"), 848*0Sstevel@tonic-gate strerror(saved_errno)); 849*0Sstevel@tonic-gate return (CKR_GENERAL_ERROR); 850*0Sstevel@tonic-gate } else { 851*0Sstevel@tonic-gate return (rv); 852*0Sstevel@tonic-gate } 853*0Sstevel@tonic-gate } 854*0Sstevel@tonic-gate 855*0Sstevel@tonic-gate 856*0Sstevel@tonic-gate /* 857*0Sstevel@tonic-gate * getkey - gets keydata from file specified 858*0Sstevel@tonic-gate * 859*0Sstevel@tonic-gate * filename - name of file, if null, prompt for pass phrase 860*0Sstevel@tonic-gate * pkeydata - binary key data is returned in this buf 861*0Sstevel@tonic-gate * 862*0Sstevel@tonic-gate * returns length of key, or -1 if error 863*0Sstevel@tonic-gate */ 864*0Sstevel@tonic-gate static int 865*0Sstevel@tonic-gate getkey(char *filename, CK_BYTE_PTR *pkeydata) 866*0Sstevel@tonic-gate { 867*0Sstevel@tonic-gate struct stat statbuf; 868*0Sstevel@tonic-gate char *keybuf = NULL; 869*0Sstevel@tonic-gate char *tmpbuf; 870*0Sstevel@tonic-gate int keylen; 871*0Sstevel@tonic-gate int fd; 872*0Sstevel@tonic-gate 873*0Sstevel@tonic-gate if (filename != NULL) { 874*0Sstevel@tonic-gate 875*0Sstevel@tonic-gate /* read the key file into a buffer */ 876*0Sstevel@tonic-gate if ((fd = open(filename, O_RDONLY | O_NONBLOCK)) == -1) { 877*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 878*0Sstevel@tonic-gate "can't open %s\n"), filename); 879*0Sstevel@tonic-gate return (-1); 880*0Sstevel@tonic-gate 881*0Sstevel@tonic-gate } 882*0Sstevel@tonic-gate 883*0Sstevel@tonic-gate if (fstat(fd, &statbuf) == -1) { 884*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 885*0Sstevel@tonic-gate "can't stat %s\n"), filename); 886*0Sstevel@tonic-gate (void) close(fd); 887*0Sstevel@tonic-gate return (-1); 888*0Sstevel@tonic-gate } 889*0Sstevel@tonic-gate 890*0Sstevel@tonic-gate if (!(statbuf.st_mode & S_IFREG)) { 891*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 892*0Sstevel@tonic-gate "%s not a regular file\n"), filename); 893*0Sstevel@tonic-gate (void) close(fd); 894*0Sstevel@tonic-gate return (-1); 895*0Sstevel@tonic-gate } 896*0Sstevel@tonic-gate 897*0Sstevel@tonic-gate keylen = (size_t)statbuf.st_size; 898*0Sstevel@tonic-gate 899*0Sstevel@tonic-gate if (keylen > 0) { 900*0Sstevel@tonic-gate /* allocate a buffer to hold the entire key */ 901*0Sstevel@tonic-gate if ((keybuf = malloc(keylen)) == NULL) { 902*0Sstevel@tonic-gate int err = errno; 903*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("malloc: %s\n"), 904*0Sstevel@tonic-gate strerror(err)); 905*0Sstevel@tonic-gate (void) close(fd); 906*0Sstevel@tonic-gate return (-1); 907*0Sstevel@tonic-gate } 908*0Sstevel@tonic-gate 909*0Sstevel@tonic-gate if (read(fd, keybuf, keylen) != keylen) { 910*0Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 911*0Sstevel@tonic-gate "can't read %s\n"), filename); 912*0Sstevel@tonic-gate (void) close(fd); 913*0Sstevel@tonic-gate return (-1); 914*0Sstevel@tonic-gate } 915*0Sstevel@tonic-gate } 916*0Sstevel@tonic-gate (void) close(fd); 917*0Sstevel@tonic-gate 918*0Sstevel@tonic-gate } else { 919*0Sstevel@tonic-gate 920*0Sstevel@tonic-gate /* No file, prompt for a pass phrase */ 921*0Sstevel@tonic-gate tmpbuf = getpassphrase(gettext("Enter key:")); 922*0Sstevel@tonic-gate 923*0Sstevel@tonic-gate if (tmpbuf == NULL) { 924*0Sstevel@tonic-gate return (-1); /* error */ 925*0Sstevel@tonic-gate } else { 926*0Sstevel@tonic-gate keybuf = strdup(tmpbuf); 927*0Sstevel@tonic-gate (void) memset(tmpbuf, 0, strlen(tmpbuf)); 928*0Sstevel@tonic-gate } 929*0Sstevel@tonic-gate keylen = strlen(keybuf); 930*0Sstevel@tonic-gate } 931*0Sstevel@tonic-gate 932*0Sstevel@tonic-gate *pkeydata = (CK_BYTE_PTR)keybuf; 933*0Sstevel@tonic-gate 934*0Sstevel@tonic-gate return (keylen); 935*0Sstevel@tonic-gate } 936