10Sstevel@tonic-gate /*
20Sstevel@tonic-gate  * CDDL HEADER START
30Sstevel@tonic-gate  *
40Sstevel@tonic-gate  * The contents of this file are subject to the terms of the
53812Shylee  * Common Development and Distribution License (the "License").
63812Shylee  * You may not use this file except in compliance with the License.
70Sstevel@tonic-gate  *
80Sstevel@tonic-gate  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
90Sstevel@tonic-gate  * or http://www.opensolaris.org/os/licensing.
100Sstevel@tonic-gate  * See the License for the specific language governing permissions
110Sstevel@tonic-gate  * and limitations under the License.
120Sstevel@tonic-gate  *
130Sstevel@tonic-gate  * When distributing Covered Code, include this CDDL HEADER in each
140Sstevel@tonic-gate  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
150Sstevel@tonic-gate  * If applicable, add the following below this CDDL HEADER, with the
160Sstevel@tonic-gate  * fields enclosed by brackets "[]" replaced with your own identifying
170Sstevel@tonic-gate  * information: Portions Copyright [yyyy] [name of copyright owner]
180Sstevel@tonic-gate  *
190Sstevel@tonic-gate  * CDDL HEADER END
200Sstevel@tonic-gate  */
210Sstevel@tonic-gate /*
22*6281Sda73024  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
230Sstevel@tonic-gate  * Use is subject to license terms.
240Sstevel@tonic-gate  */
250Sstevel@tonic-gate 
260Sstevel@tonic-gate #pragma ident	"%Z%%M%	%I%	%E% SMI"
270Sstevel@tonic-gate 
280Sstevel@tonic-gate /*
290Sstevel@tonic-gate  * digest.c
300Sstevel@tonic-gate  *
310Sstevel@tonic-gate  * Implements digest(1) and mac(1) commands
320Sstevel@tonic-gate  * If command name is mac, performs mac operation
330Sstevel@tonic-gate  * else perform digest operation
340Sstevel@tonic-gate  *
350Sstevel@tonic-gate  * See the man pages for digest and mac for details on
360Sstevel@tonic-gate  * how these commands work.
370Sstevel@tonic-gate  */
380Sstevel@tonic-gate 
390Sstevel@tonic-gate #include <stdio.h>
400Sstevel@tonic-gate #include <stdlib.h>
410Sstevel@tonic-gate #include <unistd.h>
420Sstevel@tonic-gate #include <fcntl.h>
430Sstevel@tonic-gate #include <ctype.h>
440Sstevel@tonic-gate #include <strings.h>
450Sstevel@tonic-gate #include <libintl.h>
460Sstevel@tonic-gate #include <libgen.h>
470Sstevel@tonic-gate #include <locale.h>
480Sstevel@tonic-gate #include <errno.h>
490Sstevel@tonic-gate #include <sys/types.h>
500Sstevel@tonic-gate #include <sys/stat.h>
510Sstevel@tonic-gate #include <security/cryptoki.h>
520Sstevel@tonic-gate #include <limits.h>
530Sstevel@tonic-gate #include <cryptoutil.h>
543812Shylee #include <kmfapi.h>
550Sstevel@tonic-gate 
560Sstevel@tonic-gate #define	BUFFERSIZE	(4096)		/* Buffer size for reading file */
570Sstevel@tonic-gate 
580Sstevel@tonic-gate /*
590Sstevel@tonic-gate  * RESULTLEN - large enough size in bytes to hold result for
600Sstevel@tonic-gate  * digest and mac results for all mechanisms
610Sstevel@tonic-gate  */
620Sstevel@tonic-gate #define	RESULTLEN	(512)
630Sstevel@tonic-gate 
640Sstevel@tonic-gate /*
650Sstevel@tonic-gate  * Exit Status codes
660Sstevel@tonic-gate  */
670Sstevel@tonic-gate #ifndef	EXIT_SUCCESS
680Sstevel@tonic-gate #define	EXIT_SUCCESS	0	/* No errors */
690Sstevel@tonic-gate #define	EXIT_FAILURE	1	/* All errors except usage */
700Sstevel@tonic-gate #endif /* EXIT_SUCCESS */
710Sstevel@tonic-gate 
720Sstevel@tonic-gate #define	EXIT_USAGE	2	/* usage/syntax error */
730Sstevel@tonic-gate 
740Sstevel@tonic-gate #define	MAC_NAME	"mac"		/* name of mac command */
753812Shylee #define	MAC_OPTIONS	"lva:k:T:K:"		/* for getopt */
760Sstevel@tonic-gate #define	DIGEST_NAME	"digest"	/* name of mac command */
770Sstevel@tonic-gate #define	DIGEST_OPTIONS	"lva:"		/* for getopt */
780Sstevel@tonic-gate 
790Sstevel@tonic-gate static boolean_t vflag = B_FALSE;	/* -v (verbose) flag, optional */
800Sstevel@tonic-gate static boolean_t aflag = B_FALSE;	/* -a <algorithm> flag, required */
810Sstevel@tonic-gate static boolean_t lflag = B_FALSE;	/* -l flag, for mac and digest */
823812Shylee static boolean_t kflag = B_FALSE;
833812Shylee static boolean_t Tflag = B_FALSE;
843812Shylee static boolean_t Kflag = B_FALSE;
850Sstevel@tonic-gate 
860Sstevel@tonic-gate static char *keyfile = NULL;	/* name of keyfile */
873812Shylee static char *token_label = NULL;
883812Shylee static char *key_label = NULL;
893812Shylee 
900Sstevel@tonic-gate static CK_BYTE buf[BUFFERSIZE];
910Sstevel@tonic-gate 
920Sstevel@tonic-gate struct mech_alias {
930Sstevel@tonic-gate 	CK_MECHANISM_TYPE type;
940Sstevel@tonic-gate 	char *alias;
950Sstevel@tonic-gate 	CK_ULONG keysize_min;
960Sstevel@tonic-gate 	CK_ULONG keysize_max;
970Sstevel@tonic-gate 	int keysize_unit;
980Sstevel@tonic-gate 	boolean_t available;
990Sstevel@tonic-gate };
1000Sstevel@tonic-gate 
101676Sizick #define	MECH_ALIASES_COUNT 11
1020Sstevel@tonic-gate 
1030Sstevel@tonic-gate static struct mech_alias mech_aliases[] = {
1040Sstevel@tonic-gate 	{ CKM_SHA_1, "sha1", ULONG_MAX, 0L, 8, B_FALSE },
1050Sstevel@tonic-gate 	{ CKM_MD5, "md5", ULONG_MAX, 0L, 8, B_FALSE },
1060Sstevel@tonic-gate 	{ CKM_DES_MAC, "des_mac", ULONG_MAX, 0L, 8, B_FALSE },
1070Sstevel@tonic-gate 	{ CKM_SHA_1_HMAC, "sha1_hmac", ULONG_MAX, 0L, 8, B_FALSE },
1080Sstevel@tonic-gate 	{ CKM_MD5_HMAC, "md5_hmac", ULONG_MAX, 0L, 8, B_FALSE },
109676Sizick 	{ CKM_SHA256, "sha256", ULONG_MAX, 0L, 8, B_FALSE },
110676Sizick 	{ CKM_SHA384, "sha384", ULONG_MAX, 0L, 8, B_FALSE },
111676Sizick 	{ CKM_SHA512, "sha512", ULONG_MAX, 0L, 8, B_FALSE },
112676Sizick 	{ CKM_SHA256_HMAC, "sha256_hmac", ULONG_MAX, 0L, 8, B_FALSE },
113676Sizick 	{ CKM_SHA384_HMAC, "sha384_hmac", ULONG_MAX, 0L, 8, B_FALSE },
114676Sizick 	{ CKM_SHA512_HMAC, "sha512_hmac", ULONG_MAX, 0L, 8, B_FALSE }
1150Sstevel@tonic-gate };
1160Sstevel@tonic-gate 
1170Sstevel@tonic-gate static CK_BBOOL true = TRUE;
1180Sstevel@tonic-gate 
1190Sstevel@tonic-gate static void usage(boolean_t mac_cmd);
1200Sstevel@tonic-gate static int execute_cmd(char *algo_str, int filecount,
1210Sstevel@tonic-gate 	char **filelist, boolean_t mac_cmd);
1220Sstevel@tonic-gate static CK_RV do_mac(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pmech,
1230Sstevel@tonic-gate 	int fd, CK_OBJECT_HANDLE key, CK_BYTE_PTR *psignature,
1240Sstevel@tonic-gate 	CK_ULONG_PTR psignaturelen);
1250Sstevel@tonic-gate static CK_RV do_digest(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pmech,
1260Sstevel@tonic-gate 	int fd, CK_BYTE_PTR *pdigest, CK_ULONG_PTR pdigestlen);
1270Sstevel@tonic-gate 
1280Sstevel@tonic-gate int
1290Sstevel@tonic-gate main(int argc, char **argv)
1300Sstevel@tonic-gate {
1310Sstevel@tonic-gate 
1320Sstevel@tonic-gate 	extern char *optarg;
1330Sstevel@tonic-gate 	extern int optind;
1340Sstevel@tonic-gate 	int errflag = 0;	/* We had an optstr parse error */
1350Sstevel@tonic-gate 	char c;			/* current getopts flag */
1360Sstevel@tonic-gate 	char *algo_str;		/* mechanism/algorithm string */
1370Sstevel@tonic-gate 	int filecount;
1380Sstevel@tonic-gate 	boolean_t mac_cmd;	/* if TRUE, do mac, else do digest */
1390Sstevel@tonic-gate 	char *optstr;
1400Sstevel@tonic-gate 	char **filelist;	/* list of files */
1410Sstevel@tonic-gate 	char *cmdname = NULL;	/* name of command */
1420Sstevel@tonic-gate 
1430Sstevel@tonic-gate 	(void) setlocale(LC_ALL, "");
1440Sstevel@tonic-gate #if !defined(TEXT_DOMAIN)	/* Should be defiend by cc -D */
1450Sstevel@tonic-gate #define	TEXT_DOMAIN "SYS_TEST"	/* Use this only if it weren't */
1460Sstevel@tonic-gate #endif
1470Sstevel@tonic-gate 	(void) textdomain(TEXT_DOMAIN);
1480Sstevel@tonic-gate 
1490Sstevel@tonic-gate 	/*
1500Sstevel@tonic-gate 	 * Based on command name, determine
1510Sstevel@tonic-gate 	 * type of command. mac is mac
1520Sstevel@tonic-gate 	 * everything else is digest.
1530Sstevel@tonic-gate 	 */
1540Sstevel@tonic-gate 	cmdname = basename(argv[0]);
1550Sstevel@tonic-gate 
1560Sstevel@tonic-gate 	cryptodebug_init(cmdname);
1570Sstevel@tonic-gate 
1580Sstevel@tonic-gate 	if (strcmp(cmdname, MAC_NAME) == 0)
1590Sstevel@tonic-gate 		mac_cmd = B_TRUE;
1600Sstevel@tonic-gate 	else if (strcmp(cmdname, DIGEST_NAME) == 0)
1610Sstevel@tonic-gate 		mac_cmd = B_FALSE;
1620Sstevel@tonic-gate 	else {
1630Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext(
1645051Swyllys 		    "command name must be either digest or mac\n"));
1650Sstevel@tonic-gate 		exit(EXIT_USAGE);
1660Sstevel@tonic-gate 	}
1670Sstevel@tonic-gate 
1680Sstevel@tonic-gate 	if (mac_cmd) {
1690Sstevel@tonic-gate 		optstr = MAC_OPTIONS;
1700Sstevel@tonic-gate 	} else {
1710Sstevel@tonic-gate 		optstr = DIGEST_OPTIONS;
1720Sstevel@tonic-gate 	}
1730Sstevel@tonic-gate 
1740Sstevel@tonic-gate 	/* Parse command line arguments */
1750Sstevel@tonic-gate 	while (!errflag && (c = getopt(argc, argv, optstr)) != -1) {
1760Sstevel@tonic-gate 
1770Sstevel@tonic-gate 		switch (c) {
1780Sstevel@tonic-gate 		case 'v':
1790Sstevel@tonic-gate 			vflag = B_TRUE;
1800Sstevel@tonic-gate 			break;
1810Sstevel@tonic-gate 		case 'a':
1820Sstevel@tonic-gate 			aflag = B_TRUE;
1830Sstevel@tonic-gate 			algo_str = optarg;
1840Sstevel@tonic-gate 			break;
1850Sstevel@tonic-gate 		case 'k':
1863812Shylee 			kflag = B_TRUE;
1870Sstevel@tonic-gate 			keyfile = optarg;
1880Sstevel@tonic-gate 			break;
1890Sstevel@tonic-gate 		case 'l':
1900Sstevel@tonic-gate 			lflag = B_TRUE;
1910Sstevel@tonic-gate 			break;
1923812Shylee 		case 'T':
1933812Shylee 			Tflag = B_TRUE;
1943812Shylee 			token_label = optarg;
1953812Shylee 			break;
1963812Shylee 		case 'K':
1973812Shylee 			Kflag = B_TRUE;
1983812Shylee 			key_label = optarg;
1993812Shylee 			break;
2000Sstevel@tonic-gate 		default:
2010Sstevel@tonic-gate 			errflag++;
2020Sstevel@tonic-gate 		}
2030Sstevel@tonic-gate 	}
2040Sstevel@tonic-gate 
2050Sstevel@tonic-gate 	filecount = argc - optind;
2060Sstevel@tonic-gate 	if (errflag || (!aflag && !lflag) || (lflag && argc > 2) ||
2073812Shylee 	    (kflag && Kflag) || (Tflag && !Kflag) || filecount < 0) {
2080Sstevel@tonic-gate 		usage(mac_cmd);
2090Sstevel@tonic-gate 		exit(EXIT_USAGE);
2100Sstevel@tonic-gate 	}
2110Sstevel@tonic-gate 
2120Sstevel@tonic-gate 	if (filecount == 0) {
2130Sstevel@tonic-gate 		filelist = NULL;
2140Sstevel@tonic-gate 	} else {
2150Sstevel@tonic-gate 		filelist = &argv[optind];
2160Sstevel@tonic-gate 	}
2170Sstevel@tonic-gate 
2180Sstevel@tonic-gate 	return (execute_cmd(algo_str, filecount, filelist, mac_cmd));
2190Sstevel@tonic-gate }
2200Sstevel@tonic-gate 
2210Sstevel@tonic-gate /*
2220Sstevel@tonic-gate  * usage message for digest/mac
2230Sstevel@tonic-gate  */
2240Sstevel@tonic-gate static void
2250Sstevel@tonic-gate usage(boolean_t mac_cmd)
2260Sstevel@tonic-gate {
2273812Shylee 	(void) fprintf(stderr, gettext("Usage:\n"));
2280Sstevel@tonic-gate 	if (mac_cmd) {
2293812Shylee 		(void) fprintf(stderr, gettext("  mac -l\n"));
2303812Shylee 		(void) fprintf(stderr, gettext("  mac [-v] -a <algorithm> "
2313812Shylee 		    "[-k <keyfile> | -K <keylabel> [-T <tokenspec>]] "
2323812Shylee 		    "[file...]\n"));
2330Sstevel@tonic-gate 	} else {
2343812Shylee 		(void) fprintf(stderr, gettext("  digest -l | [-v] "
2353812Shylee 		    "-a <algorithm> [file...]\n"));
2360Sstevel@tonic-gate 	}
2370Sstevel@tonic-gate }
2380Sstevel@tonic-gate 
2390Sstevel@tonic-gate /*
2400Sstevel@tonic-gate  * Print out list of available algorithms.
2410Sstevel@tonic-gate  */
2420Sstevel@tonic-gate static void
2430Sstevel@tonic-gate algorithm_list(boolean_t mac_cmd)
2440Sstevel@tonic-gate {
2450Sstevel@tonic-gate 	int mech;
2460Sstevel@tonic-gate 
2470Sstevel@tonic-gate 	if (mac_cmd)
2480Sstevel@tonic-gate 		(void) printf(gettext("Algorithm       Keysize:  Min   "
2495051Swyllys 		    "Max (bits)\n"
2500Sstevel@tonic-gate 		    "------------------------------------------\n"));
2510Sstevel@tonic-gate 
2520Sstevel@tonic-gate 	for (mech = 0; mech < MECH_ALIASES_COUNT; mech++) {
2530Sstevel@tonic-gate 
2540Sstevel@tonic-gate 		if (mech_aliases[mech].available == B_FALSE)
2550Sstevel@tonic-gate 			continue;
2560Sstevel@tonic-gate 
2570Sstevel@tonic-gate 		if (mac_cmd) {
2580Sstevel@tonic-gate 			(void) printf("%-15s", mech_aliases[mech].alias);
2590Sstevel@tonic-gate 
2600Sstevel@tonic-gate 			if (mech_aliases[mech].keysize_min != ULONG_MAX &&
2610Sstevel@tonic-gate 			    mech_aliases[mech].keysize_max != 0)
2620Sstevel@tonic-gate 				(void) printf("         %5lu %5lu\n",
2630Sstevel@tonic-gate 				    (mech_aliases[mech].keysize_min *
2645051Swyllys 				    mech_aliases[mech].keysize_unit),
2650Sstevel@tonic-gate 				    (mech_aliases[mech].keysize_max *
2665051Swyllys 				    mech_aliases[mech].keysize_unit));
2670Sstevel@tonic-gate 			else
2680Sstevel@tonic-gate 				(void) printf("\n");
2690Sstevel@tonic-gate 
2700Sstevel@tonic-gate 		} else
2710Sstevel@tonic-gate 			(void) printf("%s\n", mech_aliases[mech].alias);
2720Sstevel@tonic-gate 
2730Sstevel@tonic-gate 	}
2740Sstevel@tonic-gate }
2750Sstevel@tonic-gate 
2763812Shylee static int
2773812Shylee get_token_key(CK_SESSION_HANDLE hSession, CK_KEY_TYPE keytype,
2783812Shylee     char *keylabel, CK_BYTE *password, int password_len,
2793812Shylee     CK_OBJECT_HANDLE *keyobj)
2803812Shylee {
2813812Shylee 	CK_RV rv;
2823812Shylee 	CK_ATTRIBUTE pTmpl[10];
2833812Shylee 	CK_OBJECT_CLASS class = CKO_SECRET_KEY;
2843812Shylee 	CK_BBOOL true = 1;
2853812Shylee 	CK_BBOOL is_token = 1;
2863812Shylee 	CK_ULONG key_obj_count = 1;
2873812Shylee 	int i;
2883812Shylee 	CK_KEY_TYPE ckKeyType = keytype;
2893812Shylee 
2903812Shylee 
2913812Shylee 	rv = C_Login(hSession, CKU_USER, (CK_UTF8CHAR_PTR)password,
2923812Shylee 	    password_len);
2933812Shylee 	if (rv != CKR_OK) {
2943812Shylee 		(void) fprintf(stderr, "Cannot login to the token."
2953812Shylee 		    " error = %s\n", pkcs11_strerror(rv));
2963812Shylee 		return (-1);
2973812Shylee 	}
2983812Shylee 
2993812Shylee 	i = 0;
3003812Shylee 	pTmpl[i].type = CKA_TOKEN;
3013812Shylee 	pTmpl[i].pValue = &is_token;
3023812Shylee 	pTmpl[i].ulValueLen = sizeof (CK_BBOOL);
3033812Shylee 	i++;
3043812Shylee 
3053812Shylee 	pTmpl[i].type = CKA_CLASS;
3063812Shylee 	pTmpl[i].pValue = &class;
3073812Shylee 	pTmpl[i].ulValueLen = sizeof (class);
3083812Shylee 	i++;
3093812Shylee 
3103812Shylee 	pTmpl[i].type = CKA_LABEL;
3113812Shylee 	pTmpl[i].pValue = keylabel;
3123812Shylee 	pTmpl[i].ulValueLen = strlen(keylabel);
3133812Shylee 	i++;
3143812Shylee 
3153812Shylee 	pTmpl[i].type = CKA_KEY_TYPE;
3163812Shylee 	pTmpl[i].pValue = &ckKeyType;
3173812Shylee 	pTmpl[i].ulValueLen = sizeof (ckKeyType);
3183812Shylee 	i++;
3193812Shylee 
3203812Shylee 	pTmpl[i].type = CKA_PRIVATE;
3213812Shylee 	pTmpl[i].pValue = &true;
3223812Shylee 	pTmpl[i].ulValueLen = sizeof (true);
3233812Shylee 	i++;
3243812Shylee 
3253812Shylee 	rv = C_FindObjectsInit(hSession, pTmpl, i);
3263812Shylee 	if (rv != CKR_OK) {
3273812Shylee 		goto out;
3283812Shylee 	}
3293812Shylee 
3303812Shylee 	rv = C_FindObjects(hSession, keyobj, 1, &key_obj_count);
3313812Shylee 	(void) C_FindObjectsFinal(hSession);
3323812Shylee 
3333812Shylee out:
3343812Shylee 	if (rv != CKR_OK) {
3353812Shylee 		(void) fprintf(stderr,
3363812Shylee 		    "Cannot retrieve key object. error = %s\n",
3373812Shylee 		    pkcs11_strerror(rv));
3383812Shylee 		return (-1);
3393812Shylee 	}
3403812Shylee 
3413812Shylee 	if (key_obj_count == 0) {
3423812Shylee 		(void) fprintf(stderr, "Cannot find the key object.\n");
3433812Shylee 		return (-1);
3443812Shylee 	}
3453812Shylee 
3463812Shylee 	return (0);
3473812Shylee }
3483812Shylee 
3493812Shylee 
3500Sstevel@tonic-gate /*
3510Sstevel@tonic-gate  * Execute the command.
3520Sstevel@tonic-gate  *   algo_str - name of algorithm
3530Sstevel@tonic-gate  *   filecount - no. of files to process, if 0, use stdin
3540Sstevel@tonic-gate  *   filelist - list of files
3550Sstevel@tonic-gate  *   mac_cmd - if true do mac else do digest
3560Sstevel@tonic-gate  */
3570Sstevel@tonic-gate static int
3580Sstevel@tonic-gate execute_cmd(char *algo_str, int filecount, char **filelist, boolean_t mac_cmd)
3590Sstevel@tonic-gate {
3600Sstevel@tonic-gate 	int fd;
3610Sstevel@tonic-gate 	char *filename = NULL;
3620Sstevel@tonic-gate 	CK_RV rv;
3630Sstevel@tonic-gate 	CK_ULONG slotcount;
3640Sstevel@tonic-gate 	CK_SLOT_ID slotID;
3650Sstevel@tonic-gate 	CK_SLOT_ID_PTR pSlotList = NULL;
3660Sstevel@tonic-gate 	CK_MECHANISM_TYPE mech_type;
3670Sstevel@tonic-gate 	CK_MECHANISM_INFO info;
3680Sstevel@tonic-gate 	CK_MECHANISM mech;
3690Sstevel@tonic-gate 	CK_SESSION_HANDLE hSession = CK_INVALID_HANDLE;
3700Sstevel@tonic-gate 	CK_BYTE_PTR resultbuf = NULL;
3710Sstevel@tonic-gate 	CK_ULONG resultlen;
3720Sstevel@tonic-gate 	CK_BYTE_PTR	pkeydata = NULL;
3730Sstevel@tonic-gate 	CK_OBJECT_HANDLE key = (CK_OBJECT_HANDLE) 0;
374*6281Sda73024 	size_t keylen = 0;		/* key length */
3750Sstevel@tonic-gate 	char *resultstr = NULL;	/* result in hex string */
3760Sstevel@tonic-gate 	int resultstrlen;	/* result string length */
3770Sstevel@tonic-gate 	int i;
3780Sstevel@tonic-gate 	int exitcode = EXIT_SUCCESS;		/* return code */
3790Sstevel@tonic-gate 	int slot, mek;			/* index variables */
3800Sstevel@tonic-gate 	int mech_match = 0;
3815252Sdinak 	CK_BYTE		salt[CK_PKCS5_PBKD2_SALT_SIZE];
3820Sstevel@tonic-gate 	CK_ULONG	keysize;
3835252Sdinak 	CK_ULONG	iterations = CK_PKCS5_PBKD2_ITERATIONS;
3843812Shylee 	CK_KEY_TYPE keytype;
3853812Shylee 	KMF_RETURN kmfrv;
3863812Shylee 	CK_SLOT_ID token_slot_id;
3870Sstevel@tonic-gate 
3880Sstevel@tonic-gate 	if (aflag) {
3890Sstevel@tonic-gate 		/*
3900Sstevel@tonic-gate 		 * Determine if algorithm/mechanism is valid
3910Sstevel@tonic-gate 		 */
3920Sstevel@tonic-gate 		for (mech_match = 0; mech_match < MECH_ALIASES_COUNT;
3935051Swyllys 		    mech_match++) {
3940Sstevel@tonic-gate 			if (strcmp(algo_str,
3950Sstevel@tonic-gate 			    mech_aliases[mech_match].alias) == 0) {
3960Sstevel@tonic-gate 				mech_type = mech_aliases[mech_match].type;
3970Sstevel@tonic-gate 				break;
3980Sstevel@tonic-gate 			}
3990Sstevel@tonic-gate 
4000Sstevel@tonic-gate 		}
4010Sstevel@tonic-gate 
4020Sstevel@tonic-gate 		if (mech_match == MECH_ALIASES_COUNT) {
4030Sstevel@tonic-gate 			cryptoerror(LOG_STDERR,
4040Sstevel@tonic-gate 			    gettext("unknown algorithm -- %s"), algo_str);
4050Sstevel@tonic-gate 			return (EXIT_FAILURE);
4060Sstevel@tonic-gate 		}
4070Sstevel@tonic-gate 
4080Sstevel@tonic-gate 		/* Get key to do a MAC operation */
4090Sstevel@tonic-gate 		if (mac_cmd) {
4105252Sdinak 			int status;
4115252Sdinak 
4123812Shylee 			if (Kflag) {
4135252Sdinak 				/* get the pin of the token */
4143812Shylee 				if (token_label == NULL ||
4153812Shylee 				    !strlen(token_label)) {
4165252Sdinak 					token_label = pkcs11_default_token();
4173812Shylee 				}
4183812Shylee 
4195252Sdinak 				status = pkcs11_get_pass(token_label,
420*6281Sda73024 				    (char **)&pkeydata, &keylen,
4215252Sdinak 				    0, B_FALSE);
4225252Sdinak 			} else if (keyfile != NULL) {
4235252Sdinak 				/* get the key file */
4245252Sdinak 				status = pkcs11_read_data(keyfile,
425*6281Sda73024 				    (void **)&pkeydata, &keylen);
4265252Sdinak 			} else {
4275252Sdinak 				/* get the key from input */
4285252Sdinak 				status = pkcs11_get_pass(NULL,
429*6281Sda73024 				    (char **)&pkeydata, &keylen,
4305252Sdinak 				    0, B_FALSE);
4315252Sdinak 			}
4323812Shylee 
4335252Sdinak 			if (status == -1 || keylen == 0 || pkeydata == NULL) {
4345252Sdinak 				cryptoerror(LOG_STDERR,
4355252Sdinak 				    Kflag ? gettext("invalid passphrase.") :
4365252Sdinak 				    gettext("invalid key."));
4375252Sdinak 				return (EXIT_FAILURE);
4380Sstevel@tonic-gate 			}
4390Sstevel@tonic-gate 		}
4400Sstevel@tonic-gate 	}
4410Sstevel@tonic-gate 
4420Sstevel@tonic-gate 	/* Initialize, and get list of slots */
4433812Shylee 	rv = C_Initialize(NULL);
4443812Shylee 	if (rv != CKR_OK && rv != CKR_CRYPTOKI_ALREADY_INITIALIZED) {
4450Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
4460Sstevel@tonic-gate 		    gettext("failed to initialize PKCS #11 framework: %s"),
4470Sstevel@tonic-gate 		    pkcs11_strerror(rv));
4480Sstevel@tonic-gate 		return (EXIT_FAILURE);
4490Sstevel@tonic-gate 	}
4500Sstevel@tonic-gate 
4510Sstevel@tonic-gate 	/* Get slot count */
4520Sstevel@tonic-gate 	rv = C_GetSlotList(0, NULL_PTR, &slotcount);
4530Sstevel@tonic-gate 	if (rv != CKR_OK || slotcount == 0) {
4540Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext(
4550Sstevel@tonic-gate 		    "failed to find any cryptographic provider,"
4560Sstevel@tonic-gate 		    "please check with your system administrator: %s"),
4570Sstevel@tonic-gate 		    pkcs11_strerror(rv));
4580Sstevel@tonic-gate 		exitcode = EXIT_FAILURE;
4590Sstevel@tonic-gate 		goto cleanup;
4600Sstevel@tonic-gate 	}
4610Sstevel@tonic-gate 
4620Sstevel@tonic-gate 	/* Found at least one slot, allocate memory for slot list */
4630Sstevel@tonic-gate 	pSlotList = malloc(slotcount * sizeof (CK_SLOT_ID));
4640Sstevel@tonic-gate 	if (pSlotList == NULL_PTR) {
4650Sstevel@tonic-gate 		int err = errno;
4660Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("malloc: %s\n"),
4670Sstevel@tonic-gate 		    strerror(err));
4680Sstevel@tonic-gate 		exitcode = EXIT_FAILURE;
4690Sstevel@tonic-gate 		goto cleanup;
4700Sstevel@tonic-gate 	}
4710Sstevel@tonic-gate 
4720Sstevel@tonic-gate 	/* Get the list of slots */
4730Sstevel@tonic-gate 	if ((rv = C_GetSlotList(0, pSlotList, &slotcount)) != CKR_OK) {
4740Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext(
4750Sstevel@tonic-gate 		    "failed to find any cryptographic provider,"
4760Sstevel@tonic-gate 		    "please check with your system administrator: %s"),
4770Sstevel@tonic-gate 		    pkcs11_strerror(rv));
4780Sstevel@tonic-gate 		exitcode = EXIT_FAILURE;
4790Sstevel@tonic-gate 		goto cleanup;
4800Sstevel@tonic-gate 	}
4810Sstevel@tonic-gate 
4820Sstevel@tonic-gate 	/*
4830Sstevel@tonic-gate 	 * Obtain list of algorithms if -l option was given
4840Sstevel@tonic-gate 	 */
4850Sstevel@tonic-gate 	if (lflag) {
4860Sstevel@tonic-gate 
4870Sstevel@tonic-gate 		for (slot = 0; slot < slotcount; slot++) {
4880Sstevel@tonic-gate 
4890Sstevel@tonic-gate 			/* Iterate through each mechanism */
4900Sstevel@tonic-gate 			for (mek = 0; mek < MECH_ALIASES_COUNT; mek++) {
4910Sstevel@tonic-gate 				rv = C_GetMechanismInfo(pSlotList[slot],
4920Sstevel@tonic-gate 				    mech_aliases[mek].type, &info);
4930Sstevel@tonic-gate 
4940Sstevel@tonic-gate 				/* Only check algorithms that can be used */
4950Sstevel@tonic-gate 				if ((rv != CKR_OK) ||
4960Sstevel@tonic-gate 				    (!mac_cmd && (info.flags & CKF_SIGN)) ||
4970Sstevel@tonic-gate 				    (mac_cmd && (info.flags & CKF_DIGEST)))
4980Sstevel@tonic-gate 					continue;
4990Sstevel@tonic-gate 
5000Sstevel@tonic-gate 				/*
5010Sstevel@tonic-gate 				 * Set to minimum/maximum key sizes assuming
5020Sstevel@tonic-gate 				 * the values available are not 0.
5030Sstevel@tonic-gate 				 */
5040Sstevel@tonic-gate 				if (info.ulMinKeySize && (info.ulMinKeySize <
5050Sstevel@tonic-gate 				    mech_aliases[mek].keysize_min))
5060Sstevel@tonic-gate 					mech_aliases[mek].keysize_min =
5075051Swyllys 					    info.ulMinKeySize;
5080Sstevel@tonic-gate 
5090Sstevel@tonic-gate 				if (info.ulMaxKeySize && (info.ulMaxKeySize >
5100Sstevel@tonic-gate 				    mech_aliases[mek].keysize_max))
5110Sstevel@tonic-gate 					mech_aliases[mek].keysize_max =
5125051Swyllys 					    info.ulMaxKeySize;
5130Sstevel@tonic-gate 
5140Sstevel@tonic-gate 				mech_aliases[mek].available = B_TRUE;
5150Sstevel@tonic-gate 			}
5160Sstevel@tonic-gate 
5170Sstevel@tonic-gate 		}
5180Sstevel@tonic-gate 
5190Sstevel@tonic-gate 		algorithm_list(mac_cmd);
5200Sstevel@tonic-gate 
5210Sstevel@tonic-gate 		goto cleanup;
5220Sstevel@tonic-gate 	}
5230Sstevel@tonic-gate 
5243812Shylee 	/*
5253812Shylee 	 * Find a slot with matching mechanism
5263812Shylee 	 *
5273812Shylee 	 * If -K is specified, we find the slot id for the token first, then
5283812Shylee 	 * check if the slot supports the algorithm.
5293812Shylee 	 */
5303812Shylee 	i = 0;
5313812Shylee 	if (Kflag) {
5325051Swyllys 		kmfrv = kmf_pk11_token_lookup(NULL, token_label,
5335051Swyllys 		    &token_slot_id);
5343812Shylee 		if (kmfrv != KMF_OK) {
5353812Shylee 			cryptoerror(LOG_STDERR,
5363812Shylee 			    gettext("no matching PKCS#11 token"));
5373812Shylee 			exitcode = EXIT_FAILURE;
5383812Shylee 			goto cleanup;
5393812Shylee 		}
5403812Shylee 		rv = C_GetMechanismInfo(token_slot_id, mech_type, &info);
5413812Shylee 		if (rv == CKR_OK && (info.flags & CKF_SIGN))
5423812Shylee 			slotID = token_slot_id;
5433812Shylee 		else
5443812Shylee 			i = slotcount;
5453812Shylee 
5463812Shylee 	} else {
5473812Shylee 		for (i = 0; i < slotcount; i++) {
5483812Shylee 			slotID = pSlotList[i];
5493812Shylee 			rv = C_GetMechanismInfo(slotID, mech_type, &info);
5503812Shylee 			if (rv != CKR_OK) {
5513812Shylee 				continue; /* to the next slot */
5523812Shylee 			} else {
5533812Shylee 				if (mac_cmd) {
5543812Shylee 					/*
5553812Shylee 					 * Make sure the slot supports
5563812Shylee 					 * PKCS5 key generation if we
5573812Shylee 					 * will be using it later.
5583812Shylee 					 * We use it whenever the key
5593812Shylee 					 * is entered at command line.
5603812Shylee 					 */
5613812Shylee 					if ((info.flags & CKF_SIGN) &&
5623812Shylee 					    (keyfile == NULL)) {
5633812Shylee 						CK_MECHANISM_INFO kg_info;
5643812Shylee 						rv = C_GetMechanismInfo(slotID,
5653812Shylee 						    CKM_PKCS5_PBKD2, &kg_info);
5663812Shylee 						if (rv == CKR_OK)
5673812Shylee 							break;
5683812Shylee 					} else if (info.flags & CKF_SIGN) {
5693812Shylee 						break;
5703812Shylee 					}
5713812Shylee 				} else {
5723812Shylee 					if (info.flags & CKF_DIGEST)
5733812Shylee 						break;
5740Sstevel@tonic-gate 				}
5750Sstevel@tonic-gate 			}
5760Sstevel@tonic-gate 		}
5770Sstevel@tonic-gate 	}
5780Sstevel@tonic-gate 
5790Sstevel@tonic-gate 	/* Show error if no matching mechanism found */
5800Sstevel@tonic-gate 	if (i == slotcount) {
5810Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
5820Sstevel@tonic-gate 		    gettext("no cryptographic provider was "
5830Sstevel@tonic-gate 		    "found for this algorithm -- %s"), algo_str);
5840Sstevel@tonic-gate 		exitcode = EXIT_FAILURE;
5850Sstevel@tonic-gate 		goto cleanup;
5860Sstevel@tonic-gate 	}
5870Sstevel@tonic-gate 
5880Sstevel@tonic-gate 	/* Mechanism is supported. Go ahead & open a session */
5890Sstevel@tonic-gate 	rv = C_OpenSession(slotID, CKF_SERIAL_SESSION,
5905051Swyllys 	    NULL_PTR, NULL, &hSession);
5910Sstevel@tonic-gate 
5920Sstevel@tonic-gate 	if (rv != CKR_OK) {
5930Sstevel@tonic-gate 		cryptoerror(LOG_STDERR,
5940Sstevel@tonic-gate 		    gettext("can not open PKCS#11 session: %s"),
5950Sstevel@tonic-gate 		    pkcs11_strerror(rv));
5960Sstevel@tonic-gate 		exitcode = EXIT_FAILURE;
5970Sstevel@tonic-gate 		goto cleanup;
5980Sstevel@tonic-gate 	}
5990Sstevel@tonic-gate 
6000Sstevel@tonic-gate 	/* Create a key object for mac operation */
6010Sstevel@tonic-gate 	if (mac_cmd) {
6020Sstevel@tonic-gate 		/*
6030Sstevel@tonic-gate 		 * If we read keybytes from a file,
6040Sstevel@tonic-gate 		 * do NOT process them with C_GenerateKey,
6050Sstevel@tonic-gate 		 * treat them as raw keydata bytes and
6060Sstevel@tonic-gate 		 * create a key object for them.
6070Sstevel@tonic-gate 		 */
6080Sstevel@tonic-gate 		if (keyfile) {
6095252Sdinak 			/* XXX : why wasn't SUNW_C_KeyToObject used here? */
6100Sstevel@tonic-gate 			CK_OBJECT_CLASS class = CKO_SECRET_KEY;
6110Sstevel@tonic-gate 			CK_KEY_TYPE tmpl_keytype = CKK_GENERIC_SECRET;
6120Sstevel@tonic-gate 			CK_BBOOL false = FALSE;
6130Sstevel@tonic-gate 			int nattr = 0;
6140Sstevel@tonic-gate 			CK_ATTRIBUTE template[5];
6150Sstevel@tonic-gate 
6160Sstevel@tonic-gate 			if (mech_type == CKM_DES_MAC) {
6170Sstevel@tonic-gate 				tmpl_keytype = CKK_DES;
6180Sstevel@tonic-gate 			}
6190Sstevel@tonic-gate 			template[nattr].type = CKA_CLASS;
6200Sstevel@tonic-gate 			template[nattr].pValue = &class;
6210Sstevel@tonic-gate 			template[nattr].ulValueLen = sizeof (class);
6220Sstevel@tonic-gate 			nattr++;
6230Sstevel@tonic-gate 
6240Sstevel@tonic-gate 			template[nattr].type = CKA_KEY_TYPE;
6250Sstevel@tonic-gate 			template[nattr].pValue = &tmpl_keytype;
6260Sstevel@tonic-gate 			template[nattr].ulValueLen = sizeof (tmpl_keytype);
6270Sstevel@tonic-gate 			nattr++;
6280Sstevel@tonic-gate 
6290Sstevel@tonic-gate 			template[nattr].type = CKA_SIGN;
6300Sstevel@tonic-gate 			template[nattr].pValue = &true;
6310Sstevel@tonic-gate 			template[nattr].ulValueLen = sizeof (true);
6320Sstevel@tonic-gate 			nattr++;
6330Sstevel@tonic-gate 
6340Sstevel@tonic-gate 			template[nattr].type = CKA_TOKEN;
6350Sstevel@tonic-gate 			template[nattr].pValue = &false;
6360Sstevel@tonic-gate 			template[nattr].ulValueLen = sizeof (false);
6370Sstevel@tonic-gate 			nattr++;
6380Sstevel@tonic-gate 
6390Sstevel@tonic-gate 			template[nattr].type = CKA_VALUE;
6400Sstevel@tonic-gate 			template[nattr].pValue = pkeydata;
6410Sstevel@tonic-gate 			template[nattr].ulValueLen = keylen;
6420Sstevel@tonic-gate 			nattr++;
6430Sstevel@tonic-gate 
6445051Swyllys 			rv = C_CreateObject(hSession, template, nattr, &key);
6453812Shylee 
6463812Shylee 		} else if (Kflag) {
6473812Shylee 
6483812Shylee 			if (mech_type == CKM_DES_MAC) {
6493812Shylee 				keytype = CKK_DES;
6503812Shylee 			} else {
6513812Shylee 				keytype = CKK_GENERIC_SECRET;
6523812Shylee 			}
6533812Shylee 
6543812Shylee 			rv = get_token_key(hSession, keytype, key_label,
6553812Shylee 			    pkeydata, keylen, &key);
6563812Shylee 			if (rv != CKR_OK) {
6573812Shylee 				exitcode = EXIT_FAILURE;
6583812Shylee 				goto cleanup;
6593812Shylee 			}
6600Sstevel@tonic-gate 		} else {
6610Sstevel@tonic-gate 			CK_KEY_TYPE keytype;
6620Sstevel@tonic-gate 			if (mech_type == CKM_DES_MAC) {
6630Sstevel@tonic-gate 				keytype = CKK_DES;
6640Sstevel@tonic-gate 				keysize = 0;
6650Sstevel@tonic-gate 			} else {
6660Sstevel@tonic-gate 				keytype = CKK_GENERIC_SECRET;
6670Sstevel@tonic-gate 				keysize = 16; /* 128 bits */
6680Sstevel@tonic-gate 			}
6690Sstevel@tonic-gate 			/*
6700Sstevel@tonic-gate 			 * We use a fixed salt (0x0a, 0x0a, 0x0a ...)
6710Sstevel@tonic-gate 			 * for creating the key so that the end user
6720Sstevel@tonic-gate 			 * will be able to generate the same 'mac'
6730Sstevel@tonic-gate 			 * using the same passphrase.
6740Sstevel@tonic-gate 			 */
6750Sstevel@tonic-gate 			(void) memset(salt, 0x0a, sizeof (salt));
6765252Sdinak 			rv = pkcs11_PasswdToPBKD2Object(hSession,
6775252Sdinak 			    (char *)pkeydata, (size_t)keylen, (void *)salt,
6785252Sdinak 			    sizeof (salt), iterations, keytype, keysize,
6795252Sdinak 			    CKF_SIGN, &key);
6800Sstevel@tonic-gate 		}
6810Sstevel@tonic-gate 
6820Sstevel@tonic-gate 		if (rv != CKR_OK) {
6830Sstevel@tonic-gate 			cryptoerror(LOG_STDERR,
6840Sstevel@tonic-gate 			    gettext("unable to create key for crypto "
6850Sstevel@tonic-gate 			    "operation: %s"), pkcs11_strerror(rv));
6860Sstevel@tonic-gate 			exitcode = EXIT_FAILURE;
6870Sstevel@tonic-gate 			goto cleanup;
6880Sstevel@tonic-gate 		}
6890Sstevel@tonic-gate 	}
6900Sstevel@tonic-gate 
6910Sstevel@tonic-gate 	/* Allocate a buffer to store result. */
6920Sstevel@tonic-gate 	resultlen = RESULTLEN;
6930Sstevel@tonic-gate 	if ((resultbuf = malloc(resultlen)) == NULL) {
6940Sstevel@tonic-gate 		int err = errno;
6950Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("malloc: %s\n"),
6960Sstevel@tonic-gate 		    strerror(err));
6970Sstevel@tonic-gate 		exitcode = EXIT_FAILURE;
6980Sstevel@tonic-gate 		goto cleanup;
6990Sstevel@tonic-gate 	}
7000Sstevel@tonic-gate 
7010Sstevel@tonic-gate 	/* Allocate a buffer to store result string */
7020Sstevel@tonic-gate 	resultstrlen = RESULTLEN;
7030Sstevel@tonic-gate 	if ((resultstr = malloc(resultstrlen)) == NULL) {
7040Sstevel@tonic-gate 		int err = errno;
7050Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("malloc: %s\n"),
7060Sstevel@tonic-gate 		    strerror(err));
7070Sstevel@tonic-gate 		exitcode = EXIT_FAILURE;
7080Sstevel@tonic-gate 		goto cleanup;
7090Sstevel@tonic-gate 	}
7100Sstevel@tonic-gate 
7110Sstevel@tonic-gate 	mech.mechanism = mech_type;
7120Sstevel@tonic-gate 	mech.pParameter = NULL_PTR;
7130Sstevel@tonic-gate 	mech.ulParameterLen = 0;
7140Sstevel@tonic-gate 	exitcode = EXIT_SUCCESS;
7150Sstevel@tonic-gate 	i = 0;
7160Sstevel@tonic-gate 
7170Sstevel@tonic-gate 	do {
7180Sstevel@tonic-gate 		if (filecount > 0 && filelist != NULL) {
7190Sstevel@tonic-gate 			filename = filelist[i];
7205051Swyllys 			if ((fd = open(filename, O_RDONLY | O_NONBLOCK)) ==
7215051Swyllys 			    -1) {
7220Sstevel@tonic-gate 				cryptoerror(LOG_STDERR, gettext(
7230Sstevel@tonic-gate 				    "can not open input file %s\n"), filename);
7240Sstevel@tonic-gate 				exitcode = EXIT_USAGE;
7250Sstevel@tonic-gate 				continue;
7260Sstevel@tonic-gate 			}
7270Sstevel@tonic-gate 		} else {
7280Sstevel@tonic-gate 			fd = 0; /* use stdin */
7290Sstevel@tonic-gate 		}
7300Sstevel@tonic-gate 
7310Sstevel@tonic-gate 		/*
7320Sstevel@tonic-gate 		 * Perform the operation
7330Sstevel@tonic-gate 		 */
7340Sstevel@tonic-gate 		if (mac_cmd) {
7350Sstevel@tonic-gate 			rv = do_mac(hSession, &mech, fd, key, &resultbuf,
7365051Swyllys 			    &resultlen);
7370Sstevel@tonic-gate 		} else {
7380Sstevel@tonic-gate 			rv = do_digest(hSession, &mech, fd, &resultbuf,
7395051Swyllys 			    &resultlen);
7400Sstevel@tonic-gate 		}
7410Sstevel@tonic-gate 
7420Sstevel@tonic-gate 		if (rv != CKR_OK) {
7430Sstevel@tonic-gate 			cryptoerror(LOG_STDERR,
7440Sstevel@tonic-gate 			    gettext("crypto operation failed for "
7455051Swyllys 			    "file %s: %s\n"),
7460Sstevel@tonic-gate 			    filename ? filename : "STDIN",
7470Sstevel@tonic-gate 			    pkcs11_strerror(rv));
7480Sstevel@tonic-gate 			exitcode = EXIT_FAILURE;
7490Sstevel@tonic-gate 			continue;
7500Sstevel@tonic-gate 		}
7510Sstevel@tonic-gate 
7520Sstevel@tonic-gate 		/* if result size has changed, allocate a bigger resulstr buf */
7530Sstevel@tonic-gate 		if (resultlen != RESULTLEN) {
7540Sstevel@tonic-gate 			resultstrlen = 2 * resultlen + 1;
7550Sstevel@tonic-gate 			resultstr = realloc(resultstr, resultstrlen);
7560Sstevel@tonic-gate 
7570Sstevel@tonic-gate 			if (resultstr == NULL) {
7580Sstevel@tonic-gate 				int err = errno;
7590Sstevel@tonic-gate 				cryptoerror(LOG_STDERR,
7600Sstevel@tonic-gate 				    gettext("realloc: %s\n"), strerror(err));
7610Sstevel@tonic-gate 				exitcode =  EXIT_FAILURE;
7620Sstevel@tonic-gate 				goto cleanup;
7630Sstevel@tonic-gate 			}
7640Sstevel@tonic-gate 		}
7650Sstevel@tonic-gate 
7660Sstevel@tonic-gate 		/* Output the result */
7670Sstevel@tonic-gate 		tohexstr(resultbuf, resultlen, resultstr, resultstrlen);
7680Sstevel@tonic-gate 
7690Sstevel@tonic-gate 		/* Include mechanism name for verbose */
7700Sstevel@tonic-gate 		if (vflag)
7710Sstevel@tonic-gate 			(void) fprintf(stdout, "%s ", algo_str);
7720Sstevel@tonic-gate 
7730Sstevel@tonic-gate 		/* Include file name for multiple files, or if verbose */
7740Sstevel@tonic-gate 		if (filecount > 1 || (vflag && filecount > 0)) {
7750Sstevel@tonic-gate 			(void) fprintf(stdout, "(%s) = ", filename);
7760Sstevel@tonic-gate 		}
7770Sstevel@tonic-gate 
7780Sstevel@tonic-gate 		(void) fprintf(stdout, "%s\n", resultstr);
7790Sstevel@tonic-gate 		(void) close(fd);
7800Sstevel@tonic-gate 
7810Sstevel@tonic-gate 
7820Sstevel@tonic-gate 	} while (++i < filecount);
7830Sstevel@tonic-gate 
7840Sstevel@tonic-gate 
7850Sstevel@tonic-gate 	/* clear and free the key */
7860Sstevel@tonic-gate 	if (mac_cmd) {
7870Sstevel@tonic-gate 		(void) memset(pkeydata, 0, keylen);
7880Sstevel@tonic-gate 		free(pkeydata);
7890Sstevel@tonic-gate 		pkeydata = NULL;
7900Sstevel@tonic-gate 	}
7910Sstevel@tonic-gate 
7920Sstevel@tonic-gate cleanup:
7930Sstevel@tonic-gate 	if (resultbuf != NULL) {
7940Sstevel@tonic-gate 		free(resultbuf);
7950Sstevel@tonic-gate 	}
7960Sstevel@tonic-gate 
7970Sstevel@tonic-gate 	if (resultstr != NULL) {
7980Sstevel@tonic-gate 		free(resultstr);
7990Sstevel@tonic-gate 	}
8000Sstevel@tonic-gate 
8010Sstevel@tonic-gate 	if (pSlotList != NULL) {
8020Sstevel@tonic-gate 		free(pSlotList);
8030Sstevel@tonic-gate 	}
8040Sstevel@tonic-gate 
8053812Shylee 	if (!Kflag && key != (CK_OBJECT_HANDLE) 0) {
8060Sstevel@tonic-gate 		(void) C_DestroyObject(hSession, key);
8070Sstevel@tonic-gate 	}
8080Sstevel@tonic-gate 
8090Sstevel@tonic-gate 	if (hSession != CK_INVALID_HANDLE)
8100Sstevel@tonic-gate 		(void) C_CloseSession(hSession);
8110Sstevel@tonic-gate 
8120Sstevel@tonic-gate 	(void) C_Finalize(NULL_PTR);
8130Sstevel@tonic-gate 
8140Sstevel@tonic-gate 	return (exitcode);
8150Sstevel@tonic-gate }
8160Sstevel@tonic-gate 
8170Sstevel@tonic-gate /*
8180Sstevel@tonic-gate  * do_digest - Compute digest of a file
8190Sstevel@tonic-gate  *
8200Sstevel@tonic-gate  *  hSession - session
8210Sstevel@tonic-gate  *  pmech - ptr to mechanism to be used for digest
8220Sstevel@tonic-gate  *  fd  - file descriptor
8230Sstevel@tonic-gate  *  pdigest - buffer  where digest result is returned
8240Sstevel@tonic-gate  *  pdigestlen - length of digest buffer on input,
8250Sstevel@tonic-gate  *               length of result on output
8260Sstevel@tonic-gate  */
8270Sstevel@tonic-gate static CK_RV
8280Sstevel@tonic-gate do_digest(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pmech,
8290Sstevel@tonic-gate 	int fd, CK_BYTE_PTR *pdigest, CK_ULONG_PTR pdigestlen)
8300Sstevel@tonic-gate {
8310Sstevel@tonic-gate 	CK_RV rv;
8320Sstevel@tonic-gate 	ssize_t nread;
8330Sstevel@tonic-gate 	int saved_errno;
8340Sstevel@tonic-gate 
8350Sstevel@tonic-gate 	if ((rv = C_DigestInit(hSession, pmech)) != CKR_OK) {
8360Sstevel@tonic-gate 		return (rv);
8370Sstevel@tonic-gate 	}
8380Sstevel@tonic-gate 
8390Sstevel@tonic-gate 	while ((nread = read(fd, buf, sizeof (buf))) > 0) {
8400Sstevel@tonic-gate 		/* Get the digest */
8410Sstevel@tonic-gate 		rv = C_DigestUpdate(hSession, buf, (CK_ULONG)nread);
8420Sstevel@tonic-gate 		if (rv != CKR_OK)
8430Sstevel@tonic-gate 			return (rv);
8440Sstevel@tonic-gate 	}
8450Sstevel@tonic-gate 
8460Sstevel@tonic-gate 	saved_errno = errno; /* for later use */
8470Sstevel@tonic-gate 
8480Sstevel@tonic-gate 	/*
8490Sstevel@tonic-gate 	 * Perform the C_DigestFinal, even if there is a read error.
8500Sstevel@tonic-gate 	 * Otherwise C_DigestInit will return CKR_OPERATION_ACTIVE
8510Sstevel@tonic-gate 	 * next time it is called (for another file)
8520Sstevel@tonic-gate 	 */
8530Sstevel@tonic-gate 
8540Sstevel@tonic-gate 	rv = C_DigestFinal(hSession, *pdigest, pdigestlen);
8550Sstevel@tonic-gate 
8560Sstevel@tonic-gate 	/* result too big to fit? Allocate a bigger buffer */
8570Sstevel@tonic-gate 	if (rv == CKR_BUFFER_TOO_SMALL) {
8580Sstevel@tonic-gate 		*pdigest = realloc(*pdigest, *pdigestlen);
8590Sstevel@tonic-gate 
8600Sstevel@tonic-gate 		if (*pdigest == NULL_PTR) {
8610Sstevel@tonic-gate 			int err = errno;
8620Sstevel@tonic-gate 			cryptoerror(LOG_STDERR,
8630Sstevel@tonic-gate 			    gettext("realloc: %s\n"), strerror(err));
8640Sstevel@tonic-gate 			return (CKR_HOST_MEMORY);
8650Sstevel@tonic-gate 		}
8660Sstevel@tonic-gate 
8670Sstevel@tonic-gate 		rv = C_DigestFinal(hSession, *pdigest, pdigestlen);
8680Sstevel@tonic-gate 	}
8690Sstevel@tonic-gate 
8700Sstevel@tonic-gate 
8710Sstevel@tonic-gate 	/* There was a read error */
8720Sstevel@tonic-gate 	if (nread == -1) {
8730Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext(
8745051Swyllys 		    "error reading file: %s"), strerror(saved_errno));
8750Sstevel@tonic-gate 		return (CKR_GENERAL_ERROR);
8760Sstevel@tonic-gate 	} else {
8770Sstevel@tonic-gate 		return (rv);
8780Sstevel@tonic-gate 	}
8790Sstevel@tonic-gate }
8800Sstevel@tonic-gate 
8810Sstevel@tonic-gate /*
8820Sstevel@tonic-gate  * do_mac - Compute mac of a file
8830Sstevel@tonic-gate  *
8840Sstevel@tonic-gate  *  hSession - session
8850Sstevel@tonic-gate  *  pmech - ptr to mechanism to be used
8860Sstevel@tonic-gate  *  fd  - file descriptor
8870Sstevel@tonic-gate  *  key - key to be used
8880Sstevel@tonic-gate  *  psignature - ptr buffer  where mac result is returned
8890Sstevel@tonic-gate  *		returns new buf if current buf is small
8900Sstevel@tonic-gate  *  psignaturelen - length of mac buffer on input,
8910Sstevel@tonic-gate  *               length of result on output
8920Sstevel@tonic-gate  */
8930Sstevel@tonic-gate static CK_RV
8940Sstevel@tonic-gate do_mac(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pmech,
8950Sstevel@tonic-gate 	int fd, CK_OBJECT_HANDLE key, CK_BYTE_PTR *psignature,
8960Sstevel@tonic-gate 	CK_ULONG_PTR psignaturelen)
8970Sstevel@tonic-gate {
8980Sstevel@tonic-gate 	CK_RV rv;
8990Sstevel@tonic-gate 	ssize_t nread;
9000Sstevel@tonic-gate 	int saved_errno;
9010Sstevel@tonic-gate 
9020Sstevel@tonic-gate 	if ((rv = C_SignInit(hSession, pmech, key)) != CKR_OK) {
9030Sstevel@tonic-gate 		return (rv);
9040Sstevel@tonic-gate 	}
9050Sstevel@tonic-gate 
9060Sstevel@tonic-gate 	while ((nread = read(fd, buf, sizeof (buf))) > 0) {
9070Sstevel@tonic-gate 		/* Get the MAC */
9080Sstevel@tonic-gate 		rv = C_SignUpdate(hSession, buf, (CK_ULONG)nread);
9090Sstevel@tonic-gate 		if (rv != CKR_OK)
9100Sstevel@tonic-gate 			return (rv);
9110Sstevel@tonic-gate 	}
9120Sstevel@tonic-gate 
9130Sstevel@tonic-gate 	saved_errno = errno; /* for later use */
9140Sstevel@tonic-gate 
9150Sstevel@tonic-gate 	/*
9160Sstevel@tonic-gate 	 * Perform the C_SignFinal, even if there is a read error.
9170Sstevel@tonic-gate 	 * Otherwise C_SignInit will return CKR_OPERATION_ACTIVE
9180Sstevel@tonic-gate 	 * next time it is called (for another file)
9190Sstevel@tonic-gate 	 */
9200Sstevel@tonic-gate 
9210Sstevel@tonic-gate 	rv = C_SignFinal(hSession, *psignature, psignaturelen);
9220Sstevel@tonic-gate 
9230Sstevel@tonic-gate 	/* result too big to fit? Allocate a bigger buffer */
9240Sstevel@tonic-gate 	if (rv == CKR_BUFFER_TOO_SMALL) {
9250Sstevel@tonic-gate 		*psignature = realloc(*psignature, *psignaturelen);
9260Sstevel@tonic-gate 
9270Sstevel@tonic-gate 		if (*psignature == NULL_PTR) {
9280Sstevel@tonic-gate 			int err = errno;
9290Sstevel@tonic-gate 			cryptoerror(LOG_STDERR,
9300Sstevel@tonic-gate 			    gettext("realloc: %s\n"), strerror(err));
9310Sstevel@tonic-gate 			return (CKR_HOST_MEMORY);
9320Sstevel@tonic-gate 		}
9330Sstevel@tonic-gate 
9340Sstevel@tonic-gate 		rv = C_SignFinal(hSession, *psignature, psignaturelen);
9350Sstevel@tonic-gate 	}
9360Sstevel@tonic-gate 
9370Sstevel@tonic-gate 	/* There was a read error */
9380Sstevel@tonic-gate 	if (nread == -1) {
9390Sstevel@tonic-gate 		cryptoerror(LOG_STDERR, gettext("error reading file: %s"),
9405051Swyllys 		    strerror(saved_errno));
9410Sstevel@tonic-gate 		return (CKR_GENERAL_ERROR);
9420Sstevel@tonic-gate 	} else {
9430Sstevel@tonic-gate 		return (rv);
9440Sstevel@tonic-gate 	}
9450Sstevel@tonic-gate }
946