10Sstevel@tonic-gate /* 20Sstevel@tonic-gate * CDDL HEADER START 30Sstevel@tonic-gate * 40Sstevel@tonic-gate * The contents of this file are subject to the terms of the 53812Shylee * Common Development and Distribution License (the "License"). 63812Shylee * You may not use this file except in compliance with the License. 70Sstevel@tonic-gate * 80Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 90Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 100Sstevel@tonic-gate * See the License for the specific language governing permissions 110Sstevel@tonic-gate * and limitations under the License. 120Sstevel@tonic-gate * 130Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 140Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 150Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 160Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 170Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 180Sstevel@tonic-gate * 190Sstevel@tonic-gate * CDDL HEADER END 200Sstevel@tonic-gate */ 210Sstevel@tonic-gate /* 22*6281Sda73024 * Copyright 2008 Sun Microsystems, Inc. All rights reserved. 230Sstevel@tonic-gate * Use is subject to license terms. 240Sstevel@tonic-gate */ 250Sstevel@tonic-gate 260Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 270Sstevel@tonic-gate 280Sstevel@tonic-gate /* 290Sstevel@tonic-gate * digest.c 300Sstevel@tonic-gate * 310Sstevel@tonic-gate * Implements digest(1) and mac(1) commands 320Sstevel@tonic-gate * If command name is mac, performs mac operation 330Sstevel@tonic-gate * else perform digest operation 340Sstevel@tonic-gate * 350Sstevel@tonic-gate * See the man pages for digest and mac for details on 360Sstevel@tonic-gate * how these commands work. 370Sstevel@tonic-gate */ 380Sstevel@tonic-gate 390Sstevel@tonic-gate #include <stdio.h> 400Sstevel@tonic-gate #include <stdlib.h> 410Sstevel@tonic-gate #include <unistd.h> 420Sstevel@tonic-gate #include <fcntl.h> 430Sstevel@tonic-gate #include <ctype.h> 440Sstevel@tonic-gate #include <strings.h> 450Sstevel@tonic-gate #include <libintl.h> 460Sstevel@tonic-gate #include <libgen.h> 470Sstevel@tonic-gate #include <locale.h> 480Sstevel@tonic-gate #include <errno.h> 490Sstevel@tonic-gate #include <sys/types.h> 500Sstevel@tonic-gate #include <sys/stat.h> 510Sstevel@tonic-gate #include <security/cryptoki.h> 520Sstevel@tonic-gate #include <limits.h> 530Sstevel@tonic-gate #include <cryptoutil.h> 543812Shylee #include <kmfapi.h> 550Sstevel@tonic-gate 560Sstevel@tonic-gate #define BUFFERSIZE (4096) /* Buffer size for reading file */ 570Sstevel@tonic-gate 580Sstevel@tonic-gate /* 590Sstevel@tonic-gate * RESULTLEN - large enough size in bytes to hold result for 600Sstevel@tonic-gate * digest and mac results for all mechanisms 610Sstevel@tonic-gate */ 620Sstevel@tonic-gate #define RESULTLEN (512) 630Sstevel@tonic-gate 640Sstevel@tonic-gate /* 650Sstevel@tonic-gate * Exit Status codes 660Sstevel@tonic-gate */ 670Sstevel@tonic-gate #ifndef EXIT_SUCCESS 680Sstevel@tonic-gate #define EXIT_SUCCESS 0 /* No errors */ 690Sstevel@tonic-gate #define EXIT_FAILURE 1 /* All errors except usage */ 700Sstevel@tonic-gate #endif /* EXIT_SUCCESS */ 710Sstevel@tonic-gate 720Sstevel@tonic-gate #define EXIT_USAGE 2 /* usage/syntax error */ 730Sstevel@tonic-gate 740Sstevel@tonic-gate #define MAC_NAME "mac" /* name of mac command */ 753812Shylee #define MAC_OPTIONS "lva:k:T:K:" /* for getopt */ 760Sstevel@tonic-gate #define DIGEST_NAME "digest" /* name of mac command */ 770Sstevel@tonic-gate #define DIGEST_OPTIONS "lva:" /* for getopt */ 780Sstevel@tonic-gate 790Sstevel@tonic-gate static boolean_t vflag = B_FALSE; /* -v (verbose) flag, optional */ 800Sstevel@tonic-gate static boolean_t aflag = B_FALSE; /* -a <algorithm> flag, required */ 810Sstevel@tonic-gate static boolean_t lflag = B_FALSE; /* -l flag, for mac and digest */ 823812Shylee static boolean_t kflag = B_FALSE; 833812Shylee static boolean_t Tflag = B_FALSE; 843812Shylee static boolean_t Kflag = B_FALSE; 850Sstevel@tonic-gate 860Sstevel@tonic-gate static char *keyfile = NULL; /* name of keyfile */ 873812Shylee static char *token_label = NULL; 883812Shylee static char *key_label = NULL; 893812Shylee 900Sstevel@tonic-gate static CK_BYTE buf[BUFFERSIZE]; 910Sstevel@tonic-gate 920Sstevel@tonic-gate struct mech_alias { 930Sstevel@tonic-gate CK_MECHANISM_TYPE type; 940Sstevel@tonic-gate char *alias; 950Sstevel@tonic-gate CK_ULONG keysize_min; 960Sstevel@tonic-gate CK_ULONG keysize_max; 970Sstevel@tonic-gate int keysize_unit; 980Sstevel@tonic-gate boolean_t available; 990Sstevel@tonic-gate }; 1000Sstevel@tonic-gate 101676Sizick #define MECH_ALIASES_COUNT 11 1020Sstevel@tonic-gate 1030Sstevel@tonic-gate static struct mech_alias mech_aliases[] = { 1040Sstevel@tonic-gate { CKM_SHA_1, "sha1", ULONG_MAX, 0L, 8, B_FALSE }, 1050Sstevel@tonic-gate { CKM_MD5, "md5", ULONG_MAX, 0L, 8, B_FALSE }, 1060Sstevel@tonic-gate { CKM_DES_MAC, "des_mac", ULONG_MAX, 0L, 8, B_FALSE }, 1070Sstevel@tonic-gate { CKM_SHA_1_HMAC, "sha1_hmac", ULONG_MAX, 0L, 8, B_FALSE }, 1080Sstevel@tonic-gate { CKM_MD5_HMAC, "md5_hmac", ULONG_MAX, 0L, 8, B_FALSE }, 109676Sizick { CKM_SHA256, "sha256", ULONG_MAX, 0L, 8, B_FALSE }, 110676Sizick { CKM_SHA384, "sha384", ULONG_MAX, 0L, 8, B_FALSE }, 111676Sizick { CKM_SHA512, "sha512", ULONG_MAX, 0L, 8, B_FALSE }, 112676Sizick { CKM_SHA256_HMAC, "sha256_hmac", ULONG_MAX, 0L, 8, B_FALSE }, 113676Sizick { CKM_SHA384_HMAC, "sha384_hmac", ULONG_MAX, 0L, 8, B_FALSE }, 114676Sizick { CKM_SHA512_HMAC, "sha512_hmac", ULONG_MAX, 0L, 8, B_FALSE } 1150Sstevel@tonic-gate }; 1160Sstevel@tonic-gate 1170Sstevel@tonic-gate static CK_BBOOL true = TRUE; 1180Sstevel@tonic-gate 1190Sstevel@tonic-gate static void usage(boolean_t mac_cmd); 1200Sstevel@tonic-gate static int execute_cmd(char *algo_str, int filecount, 1210Sstevel@tonic-gate char **filelist, boolean_t mac_cmd); 1220Sstevel@tonic-gate static CK_RV do_mac(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pmech, 1230Sstevel@tonic-gate int fd, CK_OBJECT_HANDLE key, CK_BYTE_PTR *psignature, 1240Sstevel@tonic-gate CK_ULONG_PTR psignaturelen); 1250Sstevel@tonic-gate static CK_RV do_digest(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pmech, 1260Sstevel@tonic-gate int fd, CK_BYTE_PTR *pdigest, CK_ULONG_PTR pdigestlen); 1270Sstevel@tonic-gate 1280Sstevel@tonic-gate int 1290Sstevel@tonic-gate main(int argc, char **argv) 1300Sstevel@tonic-gate { 1310Sstevel@tonic-gate 1320Sstevel@tonic-gate extern char *optarg; 1330Sstevel@tonic-gate extern int optind; 1340Sstevel@tonic-gate int errflag = 0; /* We had an optstr parse error */ 1350Sstevel@tonic-gate char c; /* current getopts flag */ 1360Sstevel@tonic-gate char *algo_str; /* mechanism/algorithm string */ 1370Sstevel@tonic-gate int filecount; 1380Sstevel@tonic-gate boolean_t mac_cmd; /* if TRUE, do mac, else do digest */ 1390Sstevel@tonic-gate char *optstr; 1400Sstevel@tonic-gate char **filelist; /* list of files */ 1410Sstevel@tonic-gate char *cmdname = NULL; /* name of command */ 1420Sstevel@tonic-gate 1430Sstevel@tonic-gate (void) setlocale(LC_ALL, ""); 1440Sstevel@tonic-gate #if !defined(TEXT_DOMAIN) /* Should be defiend by cc -D */ 1450Sstevel@tonic-gate #define TEXT_DOMAIN "SYS_TEST" /* Use this only if it weren't */ 1460Sstevel@tonic-gate #endif 1470Sstevel@tonic-gate (void) textdomain(TEXT_DOMAIN); 1480Sstevel@tonic-gate 1490Sstevel@tonic-gate /* 1500Sstevel@tonic-gate * Based on command name, determine 1510Sstevel@tonic-gate * type of command. mac is mac 1520Sstevel@tonic-gate * everything else is digest. 1530Sstevel@tonic-gate */ 1540Sstevel@tonic-gate cmdname = basename(argv[0]); 1550Sstevel@tonic-gate 1560Sstevel@tonic-gate cryptodebug_init(cmdname); 1570Sstevel@tonic-gate 1580Sstevel@tonic-gate if (strcmp(cmdname, MAC_NAME) == 0) 1590Sstevel@tonic-gate mac_cmd = B_TRUE; 1600Sstevel@tonic-gate else if (strcmp(cmdname, DIGEST_NAME) == 0) 1610Sstevel@tonic-gate mac_cmd = B_FALSE; 1620Sstevel@tonic-gate else { 1630Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 1645051Swyllys "command name must be either digest or mac\n")); 1650Sstevel@tonic-gate exit(EXIT_USAGE); 1660Sstevel@tonic-gate } 1670Sstevel@tonic-gate 1680Sstevel@tonic-gate if (mac_cmd) { 1690Sstevel@tonic-gate optstr = MAC_OPTIONS; 1700Sstevel@tonic-gate } else { 1710Sstevel@tonic-gate optstr = DIGEST_OPTIONS; 1720Sstevel@tonic-gate } 1730Sstevel@tonic-gate 1740Sstevel@tonic-gate /* Parse command line arguments */ 1750Sstevel@tonic-gate while (!errflag && (c = getopt(argc, argv, optstr)) != -1) { 1760Sstevel@tonic-gate 1770Sstevel@tonic-gate switch (c) { 1780Sstevel@tonic-gate case 'v': 1790Sstevel@tonic-gate vflag = B_TRUE; 1800Sstevel@tonic-gate break; 1810Sstevel@tonic-gate case 'a': 1820Sstevel@tonic-gate aflag = B_TRUE; 1830Sstevel@tonic-gate algo_str = optarg; 1840Sstevel@tonic-gate break; 1850Sstevel@tonic-gate case 'k': 1863812Shylee kflag = B_TRUE; 1870Sstevel@tonic-gate keyfile = optarg; 1880Sstevel@tonic-gate break; 1890Sstevel@tonic-gate case 'l': 1900Sstevel@tonic-gate lflag = B_TRUE; 1910Sstevel@tonic-gate break; 1923812Shylee case 'T': 1933812Shylee Tflag = B_TRUE; 1943812Shylee token_label = optarg; 1953812Shylee break; 1963812Shylee case 'K': 1973812Shylee Kflag = B_TRUE; 1983812Shylee key_label = optarg; 1993812Shylee break; 2000Sstevel@tonic-gate default: 2010Sstevel@tonic-gate errflag++; 2020Sstevel@tonic-gate } 2030Sstevel@tonic-gate } 2040Sstevel@tonic-gate 2050Sstevel@tonic-gate filecount = argc - optind; 2060Sstevel@tonic-gate if (errflag || (!aflag && !lflag) || (lflag && argc > 2) || 2073812Shylee (kflag && Kflag) || (Tflag && !Kflag) || filecount < 0) { 2080Sstevel@tonic-gate usage(mac_cmd); 2090Sstevel@tonic-gate exit(EXIT_USAGE); 2100Sstevel@tonic-gate } 2110Sstevel@tonic-gate 2120Sstevel@tonic-gate if (filecount == 0) { 2130Sstevel@tonic-gate filelist = NULL; 2140Sstevel@tonic-gate } else { 2150Sstevel@tonic-gate filelist = &argv[optind]; 2160Sstevel@tonic-gate } 2170Sstevel@tonic-gate 2180Sstevel@tonic-gate return (execute_cmd(algo_str, filecount, filelist, mac_cmd)); 2190Sstevel@tonic-gate } 2200Sstevel@tonic-gate 2210Sstevel@tonic-gate /* 2220Sstevel@tonic-gate * usage message for digest/mac 2230Sstevel@tonic-gate */ 2240Sstevel@tonic-gate static void 2250Sstevel@tonic-gate usage(boolean_t mac_cmd) 2260Sstevel@tonic-gate { 2273812Shylee (void) fprintf(stderr, gettext("Usage:\n")); 2280Sstevel@tonic-gate if (mac_cmd) { 2293812Shylee (void) fprintf(stderr, gettext(" mac -l\n")); 2303812Shylee (void) fprintf(stderr, gettext(" mac [-v] -a <algorithm> " 2313812Shylee "[-k <keyfile> | -K <keylabel> [-T <tokenspec>]] " 2323812Shylee "[file...]\n")); 2330Sstevel@tonic-gate } else { 2343812Shylee (void) fprintf(stderr, gettext(" digest -l | [-v] " 2353812Shylee "-a <algorithm> [file...]\n")); 2360Sstevel@tonic-gate } 2370Sstevel@tonic-gate } 2380Sstevel@tonic-gate 2390Sstevel@tonic-gate /* 2400Sstevel@tonic-gate * Print out list of available algorithms. 2410Sstevel@tonic-gate */ 2420Sstevel@tonic-gate static void 2430Sstevel@tonic-gate algorithm_list(boolean_t mac_cmd) 2440Sstevel@tonic-gate { 2450Sstevel@tonic-gate int mech; 2460Sstevel@tonic-gate 2470Sstevel@tonic-gate if (mac_cmd) 2480Sstevel@tonic-gate (void) printf(gettext("Algorithm Keysize: Min " 2495051Swyllys "Max (bits)\n" 2500Sstevel@tonic-gate "------------------------------------------\n")); 2510Sstevel@tonic-gate 2520Sstevel@tonic-gate for (mech = 0; mech < MECH_ALIASES_COUNT; mech++) { 2530Sstevel@tonic-gate 2540Sstevel@tonic-gate if (mech_aliases[mech].available == B_FALSE) 2550Sstevel@tonic-gate continue; 2560Sstevel@tonic-gate 2570Sstevel@tonic-gate if (mac_cmd) { 2580Sstevel@tonic-gate (void) printf("%-15s", mech_aliases[mech].alias); 2590Sstevel@tonic-gate 2600Sstevel@tonic-gate if (mech_aliases[mech].keysize_min != ULONG_MAX && 2610Sstevel@tonic-gate mech_aliases[mech].keysize_max != 0) 2620Sstevel@tonic-gate (void) printf(" %5lu %5lu\n", 2630Sstevel@tonic-gate (mech_aliases[mech].keysize_min * 2645051Swyllys mech_aliases[mech].keysize_unit), 2650Sstevel@tonic-gate (mech_aliases[mech].keysize_max * 2665051Swyllys mech_aliases[mech].keysize_unit)); 2670Sstevel@tonic-gate else 2680Sstevel@tonic-gate (void) printf("\n"); 2690Sstevel@tonic-gate 2700Sstevel@tonic-gate } else 2710Sstevel@tonic-gate (void) printf("%s\n", mech_aliases[mech].alias); 2720Sstevel@tonic-gate 2730Sstevel@tonic-gate } 2740Sstevel@tonic-gate } 2750Sstevel@tonic-gate 2763812Shylee static int 2773812Shylee get_token_key(CK_SESSION_HANDLE hSession, CK_KEY_TYPE keytype, 2783812Shylee char *keylabel, CK_BYTE *password, int password_len, 2793812Shylee CK_OBJECT_HANDLE *keyobj) 2803812Shylee { 2813812Shylee CK_RV rv; 2823812Shylee CK_ATTRIBUTE pTmpl[10]; 2833812Shylee CK_OBJECT_CLASS class = CKO_SECRET_KEY; 2843812Shylee CK_BBOOL true = 1; 2853812Shylee CK_BBOOL is_token = 1; 2863812Shylee CK_ULONG key_obj_count = 1; 2873812Shylee int i; 2883812Shylee CK_KEY_TYPE ckKeyType = keytype; 2893812Shylee 2903812Shylee 2913812Shylee rv = C_Login(hSession, CKU_USER, (CK_UTF8CHAR_PTR)password, 2923812Shylee password_len); 2933812Shylee if (rv != CKR_OK) { 2943812Shylee (void) fprintf(stderr, "Cannot login to the token." 2953812Shylee " error = %s\n", pkcs11_strerror(rv)); 2963812Shylee return (-1); 2973812Shylee } 2983812Shylee 2993812Shylee i = 0; 3003812Shylee pTmpl[i].type = CKA_TOKEN; 3013812Shylee pTmpl[i].pValue = &is_token; 3023812Shylee pTmpl[i].ulValueLen = sizeof (CK_BBOOL); 3033812Shylee i++; 3043812Shylee 3053812Shylee pTmpl[i].type = CKA_CLASS; 3063812Shylee pTmpl[i].pValue = &class; 3073812Shylee pTmpl[i].ulValueLen = sizeof (class); 3083812Shylee i++; 3093812Shylee 3103812Shylee pTmpl[i].type = CKA_LABEL; 3113812Shylee pTmpl[i].pValue = keylabel; 3123812Shylee pTmpl[i].ulValueLen = strlen(keylabel); 3133812Shylee i++; 3143812Shylee 3153812Shylee pTmpl[i].type = CKA_KEY_TYPE; 3163812Shylee pTmpl[i].pValue = &ckKeyType; 3173812Shylee pTmpl[i].ulValueLen = sizeof (ckKeyType); 3183812Shylee i++; 3193812Shylee 3203812Shylee pTmpl[i].type = CKA_PRIVATE; 3213812Shylee pTmpl[i].pValue = &true; 3223812Shylee pTmpl[i].ulValueLen = sizeof (true); 3233812Shylee i++; 3243812Shylee 3253812Shylee rv = C_FindObjectsInit(hSession, pTmpl, i); 3263812Shylee if (rv != CKR_OK) { 3273812Shylee goto out; 3283812Shylee } 3293812Shylee 3303812Shylee rv = C_FindObjects(hSession, keyobj, 1, &key_obj_count); 3313812Shylee (void) C_FindObjectsFinal(hSession); 3323812Shylee 3333812Shylee out: 3343812Shylee if (rv != CKR_OK) { 3353812Shylee (void) fprintf(stderr, 3363812Shylee "Cannot retrieve key object. error = %s\n", 3373812Shylee pkcs11_strerror(rv)); 3383812Shylee return (-1); 3393812Shylee } 3403812Shylee 3413812Shylee if (key_obj_count == 0) { 3423812Shylee (void) fprintf(stderr, "Cannot find the key object.\n"); 3433812Shylee return (-1); 3443812Shylee } 3453812Shylee 3463812Shylee return (0); 3473812Shylee } 3483812Shylee 3493812Shylee 3500Sstevel@tonic-gate /* 3510Sstevel@tonic-gate * Execute the command. 3520Sstevel@tonic-gate * algo_str - name of algorithm 3530Sstevel@tonic-gate * filecount - no. of files to process, if 0, use stdin 3540Sstevel@tonic-gate * filelist - list of files 3550Sstevel@tonic-gate * mac_cmd - if true do mac else do digest 3560Sstevel@tonic-gate */ 3570Sstevel@tonic-gate static int 3580Sstevel@tonic-gate execute_cmd(char *algo_str, int filecount, char **filelist, boolean_t mac_cmd) 3590Sstevel@tonic-gate { 3600Sstevel@tonic-gate int fd; 3610Sstevel@tonic-gate char *filename = NULL; 3620Sstevel@tonic-gate CK_RV rv; 3630Sstevel@tonic-gate CK_ULONG slotcount; 3640Sstevel@tonic-gate CK_SLOT_ID slotID; 3650Sstevel@tonic-gate CK_SLOT_ID_PTR pSlotList = NULL; 3660Sstevel@tonic-gate CK_MECHANISM_TYPE mech_type; 3670Sstevel@tonic-gate CK_MECHANISM_INFO info; 3680Sstevel@tonic-gate CK_MECHANISM mech; 3690Sstevel@tonic-gate CK_SESSION_HANDLE hSession = CK_INVALID_HANDLE; 3700Sstevel@tonic-gate CK_BYTE_PTR resultbuf = NULL; 3710Sstevel@tonic-gate CK_ULONG resultlen; 3720Sstevel@tonic-gate CK_BYTE_PTR pkeydata = NULL; 3730Sstevel@tonic-gate CK_OBJECT_HANDLE key = (CK_OBJECT_HANDLE) 0; 374*6281Sda73024 size_t keylen = 0; /* key length */ 3750Sstevel@tonic-gate char *resultstr = NULL; /* result in hex string */ 3760Sstevel@tonic-gate int resultstrlen; /* result string length */ 3770Sstevel@tonic-gate int i; 3780Sstevel@tonic-gate int exitcode = EXIT_SUCCESS; /* return code */ 3790Sstevel@tonic-gate int slot, mek; /* index variables */ 3800Sstevel@tonic-gate int mech_match = 0; 3815252Sdinak CK_BYTE salt[CK_PKCS5_PBKD2_SALT_SIZE]; 3820Sstevel@tonic-gate CK_ULONG keysize; 3835252Sdinak CK_ULONG iterations = CK_PKCS5_PBKD2_ITERATIONS; 3843812Shylee CK_KEY_TYPE keytype; 3853812Shylee KMF_RETURN kmfrv; 3863812Shylee CK_SLOT_ID token_slot_id; 3870Sstevel@tonic-gate 3880Sstevel@tonic-gate if (aflag) { 3890Sstevel@tonic-gate /* 3900Sstevel@tonic-gate * Determine if algorithm/mechanism is valid 3910Sstevel@tonic-gate */ 3920Sstevel@tonic-gate for (mech_match = 0; mech_match < MECH_ALIASES_COUNT; 3935051Swyllys mech_match++) { 3940Sstevel@tonic-gate if (strcmp(algo_str, 3950Sstevel@tonic-gate mech_aliases[mech_match].alias) == 0) { 3960Sstevel@tonic-gate mech_type = mech_aliases[mech_match].type; 3970Sstevel@tonic-gate break; 3980Sstevel@tonic-gate } 3990Sstevel@tonic-gate 4000Sstevel@tonic-gate } 4010Sstevel@tonic-gate 4020Sstevel@tonic-gate if (mech_match == MECH_ALIASES_COUNT) { 4030Sstevel@tonic-gate cryptoerror(LOG_STDERR, 4040Sstevel@tonic-gate gettext("unknown algorithm -- %s"), algo_str); 4050Sstevel@tonic-gate return (EXIT_FAILURE); 4060Sstevel@tonic-gate } 4070Sstevel@tonic-gate 4080Sstevel@tonic-gate /* Get key to do a MAC operation */ 4090Sstevel@tonic-gate if (mac_cmd) { 4105252Sdinak int status; 4115252Sdinak 4123812Shylee if (Kflag) { 4135252Sdinak /* get the pin of the token */ 4143812Shylee if (token_label == NULL || 4153812Shylee !strlen(token_label)) { 4165252Sdinak token_label = pkcs11_default_token(); 4173812Shylee } 4183812Shylee 4195252Sdinak status = pkcs11_get_pass(token_label, 420*6281Sda73024 (char **)&pkeydata, &keylen, 4215252Sdinak 0, B_FALSE); 4225252Sdinak } else if (keyfile != NULL) { 4235252Sdinak /* get the key file */ 4245252Sdinak status = pkcs11_read_data(keyfile, 425*6281Sda73024 (void **)&pkeydata, &keylen); 4265252Sdinak } else { 4275252Sdinak /* get the key from input */ 4285252Sdinak status = pkcs11_get_pass(NULL, 429*6281Sda73024 (char **)&pkeydata, &keylen, 4305252Sdinak 0, B_FALSE); 4315252Sdinak } 4323812Shylee 4335252Sdinak if (status == -1 || keylen == 0 || pkeydata == NULL) { 4345252Sdinak cryptoerror(LOG_STDERR, 4355252Sdinak Kflag ? gettext("invalid passphrase.") : 4365252Sdinak gettext("invalid key.")); 4375252Sdinak return (EXIT_FAILURE); 4380Sstevel@tonic-gate } 4390Sstevel@tonic-gate } 4400Sstevel@tonic-gate } 4410Sstevel@tonic-gate 4420Sstevel@tonic-gate /* Initialize, and get list of slots */ 4433812Shylee rv = C_Initialize(NULL); 4443812Shylee if (rv != CKR_OK && rv != CKR_CRYPTOKI_ALREADY_INITIALIZED) { 4450Sstevel@tonic-gate cryptoerror(LOG_STDERR, 4460Sstevel@tonic-gate gettext("failed to initialize PKCS #11 framework: %s"), 4470Sstevel@tonic-gate pkcs11_strerror(rv)); 4480Sstevel@tonic-gate return (EXIT_FAILURE); 4490Sstevel@tonic-gate } 4500Sstevel@tonic-gate 4510Sstevel@tonic-gate /* Get slot count */ 4520Sstevel@tonic-gate rv = C_GetSlotList(0, NULL_PTR, &slotcount); 4530Sstevel@tonic-gate if (rv != CKR_OK || slotcount == 0) { 4540Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 4550Sstevel@tonic-gate "failed to find any cryptographic provider," 4560Sstevel@tonic-gate "please check with your system administrator: %s"), 4570Sstevel@tonic-gate pkcs11_strerror(rv)); 4580Sstevel@tonic-gate exitcode = EXIT_FAILURE; 4590Sstevel@tonic-gate goto cleanup; 4600Sstevel@tonic-gate } 4610Sstevel@tonic-gate 4620Sstevel@tonic-gate /* Found at least one slot, allocate memory for slot list */ 4630Sstevel@tonic-gate pSlotList = malloc(slotcount * sizeof (CK_SLOT_ID)); 4640Sstevel@tonic-gate if (pSlotList == NULL_PTR) { 4650Sstevel@tonic-gate int err = errno; 4660Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("malloc: %s\n"), 4670Sstevel@tonic-gate strerror(err)); 4680Sstevel@tonic-gate exitcode = EXIT_FAILURE; 4690Sstevel@tonic-gate goto cleanup; 4700Sstevel@tonic-gate } 4710Sstevel@tonic-gate 4720Sstevel@tonic-gate /* Get the list of slots */ 4730Sstevel@tonic-gate if ((rv = C_GetSlotList(0, pSlotList, &slotcount)) != CKR_OK) { 4740Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 4750Sstevel@tonic-gate "failed to find any cryptographic provider," 4760Sstevel@tonic-gate "please check with your system administrator: %s"), 4770Sstevel@tonic-gate pkcs11_strerror(rv)); 4780Sstevel@tonic-gate exitcode = EXIT_FAILURE; 4790Sstevel@tonic-gate goto cleanup; 4800Sstevel@tonic-gate } 4810Sstevel@tonic-gate 4820Sstevel@tonic-gate /* 4830Sstevel@tonic-gate * Obtain list of algorithms if -l option was given 4840Sstevel@tonic-gate */ 4850Sstevel@tonic-gate if (lflag) { 4860Sstevel@tonic-gate 4870Sstevel@tonic-gate for (slot = 0; slot < slotcount; slot++) { 4880Sstevel@tonic-gate 4890Sstevel@tonic-gate /* Iterate through each mechanism */ 4900Sstevel@tonic-gate for (mek = 0; mek < MECH_ALIASES_COUNT; mek++) { 4910Sstevel@tonic-gate rv = C_GetMechanismInfo(pSlotList[slot], 4920Sstevel@tonic-gate mech_aliases[mek].type, &info); 4930Sstevel@tonic-gate 4940Sstevel@tonic-gate /* Only check algorithms that can be used */ 4950Sstevel@tonic-gate if ((rv != CKR_OK) || 4960Sstevel@tonic-gate (!mac_cmd && (info.flags & CKF_SIGN)) || 4970Sstevel@tonic-gate (mac_cmd && (info.flags & CKF_DIGEST))) 4980Sstevel@tonic-gate continue; 4990Sstevel@tonic-gate 5000Sstevel@tonic-gate /* 5010Sstevel@tonic-gate * Set to minimum/maximum key sizes assuming 5020Sstevel@tonic-gate * the values available are not 0. 5030Sstevel@tonic-gate */ 5040Sstevel@tonic-gate if (info.ulMinKeySize && (info.ulMinKeySize < 5050Sstevel@tonic-gate mech_aliases[mek].keysize_min)) 5060Sstevel@tonic-gate mech_aliases[mek].keysize_min = 5075051Swyllys info.ulMinKeySize; 5080Sstevel@tonic-gate 5090Sstevel@tonic-gate if (info.ulMaxKeySize && (info.ulMaxKeySize > 5100Sstevel@tonic-gate mech_aliases[mek].keysize_max)) 5110Sstevel@tonic-gate mech_aliases[mek].keysize_max = 5125051Swyllys info.ulMaxKeySize; 5130Sstevel@tonic-gate 5140Sstevel@tonic-gate mech_aliases[mek].available = B_TRUE; 5150Sstevel@tonic-gate } 5160Sstevel@tonic-gate 5170Sstevel@tonic-gate } 5180Sstevel@tonic-gate 5190Sstevel@tonic-gate algorithm_list(mac_cmd); 5200Sstevel@tonic-gate 5210Sstevel@tonic-gate goto cleanup; 5220Sstevel@tonic-gate } 5230Sstevel@tonic-gate 5243812Shylee /* 5253812Shylee * Find a slot with matching mechanism 5263812Shylee * 5273812Shylee * If -K is specified, we find the slot id for the token first, then 5283812Shylee * check if the slot supports the algorithm. 5293812Shylee */ 5303812Shylee i = 0; 5313812Shylee if (Kflag) { 5325051Swyllys kmfrv = kmf_pk11_token_lookup(NULL, token_label, 5335051Swyllys &token_slot_id); 5343812Shylee if (kmfrv != KMF_OK) { 5353812Shylee cryptoerror(LOG_STDERR, 5363812Shylee gettext("no matching PKCS#11 token")); 5373812Shylee exitcode = EXIT_FAILURE; 5383812Shylee goto cleanup; 5393812Shylee } 5403812Shylee rv = C_GetMechanismInfo(token_slot_id, mech_type, &info); 5413812Shylee if (rv == CKR_OK && (info.flags & CKF_SIGN)) 5423812Shylee slotID = token_slot_id; 5433812Shylee else 5443812Shylee i = slotcount; 5453812Shylee 5463812Shylee } else { 5473812Shylee for (i = 0; i < slotcount; i++) { 5483812Shylee slotID = pSlotList[i]; 5493812Shylee rv = C_GetMechanismInfo(slotID, mech_type, &info); 5503812Shylee if (rv != CKR_OK) { 5513812Shylee continue; /* to the next slot */ 5523812Shylee } else { 5533812Shylee if (mac_cmd) { 5543812Shylee /* 5553812Shylee * Make sure the slot supports 5563812Shylee * PKCS5 key generation if we 5573812Shylee * will be using it later. 5583812Shylee * We use it whenever the key 5593812Shylee * is entered at command line. 5603812Shylee */ 5613812Shylee if ((info.flags & CKF_SIGN) && 5623812Shylee (keyfile == NULL)) { 5633812Shylee CK_MECHANISM_INFO kg_info; 5643812Shylee rv = C_GetMechanismInfo(slotID, 5653812Shylee CKM_PKCS5_PBKD2, &kg_info); 5663812Shylee if (rv == CKR_OK) 5673812Shylee break; 5683812Shylee } else if (info.flags & CKF_SIGN) { 5693812Shylee break; 5703812Shylee } 5713812Shylee } else { 5723812Shylee if (info.flags & CKF_DIGEST) 5733812Shylee break; 5740Sstevel@tonic-gate } 5750Sstevel@tonic-gate } 5760Sstevel@tonic-gate } 5770Sstevel@tonic-gate } 5780Sstevel@tonic-gate 5790Sstevel@tonic-gate /* Show error if no matching mechanism found */ 5800Sstevel@tonic-gate if (i == slotcount) { 5810Sstevel@tonic-gate cryptoerror(LOG_STDERR, 5820Sstevel@tonic-gate gettext("no cryptographic provider was " 5830Sstevel@tonic-gate "found for this algorithm -- %s"), algo_str); 5840Sstevel@tonic-gate exitcode = EXIT_FAILURE; 5850Sstevel@tonic-gate goto cleanup; 5860Sstevel@tonic-gate } 5870Sstevel@tonic-gate 5880Sstevel@tonic-gate /* Mechanism is supported. Go ahead & open a session */ 5890Sstevel@tonic-gate rv = C_OpenSession(slotID, CKF_SERIAL_SESSION, 5905051Swyllys NULL_PTR, NULL, &hSession); 5910Sstevel@tonic-gate 5920Sstevel@tonic-gate if (rv != CKR_OK) { 5930Sstevel@tonic-gate cryptoerror(LOG_STDERR, 5940Sstevel@tonic-gate gettext("can not open PKCS#11 session: %s"), 5950Sstevel@tonic-gate pkcs11_strerror(rv)); 5960Sstevel@tonic-gate exitcode = EXIT_FAILURE; 5970Sstevel@tonic-gate goto cleanup; 5980Sstevel@tonic-gate } 5990Sstevel@tonic-gate 6000Sstevel@tonic-gate /* Create a key object for mac operation */ 6010Sstevel@tonic-gate if (mac_cmd) { 6020Sstevel@tonic-gate /* 6030Sstevel@tonic-gate * If we read keybytes from a file, 6040Sstevel@tonic-gate * do NOT process them with C_GenerateKey, 6050Sstevel@tonic-gate * treat them as raw keydata bytes and 6060Sstevel@tonic-gate * create a key object for them. 6070Sstevel@tonic-gate */ 6080Sstevel@tonic-gate if (keyfile) { 6095252Sdinak /* XXX : why wasn't SUNW_C_KeyToObject used here? */ 6100Sstevel@tonic-gate CK_OBJECT_CLASS class = CKO_SECRET_KEY; 6110Sstevel@tonic-gate CK_KEY_TYPE tmpl_keytype = CKK_GENERIC_SECRET; 6120Sstevel@tonic-gate CK_BBOOL false = FALSE; 6130Sstevel@tonic-gate int nattr = 0; 6140Sstevel@tonic-gate CK_ATTRIBUTE template[5]; 6150Sstevel@tonic-gate 6160Sstevel@tonic-gate if (mech_type == CKM_DES_MAC) { 6170Sstevel@tonic-gate tmpl_keytype = CKK_DES; 6180Sstevel@tonic-gate } 6190Sstevel@tonic-gate template[nattr].type = CKA_CLASS; 6200Sstevel@tonic-gate template[nattr].pValue = &class; 6210Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (class); 6220Sstevel@tonic-gate nattr++; 6230Sstevel@tonic-gate 6240Sstevel@tonic-gate template[nattr].type = CKA_KEY_TYPE; 6250Sstevel@tonic-gate template[nattr].pValue = &tmpl_keytype; 6260Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (tmpl_keytype); 6270Sstevel@tonic-gate nattr++; 6280Sstevel@tonic-gate 6290Sstevel@tonic-gate template[nattr].type = CKA_SIGN; 6300Sstevel@tonic-gate template[nattr].pValue = &true; 6310Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (true); 6320Sstevel@tonic-gate nattr++; 6330Sstevel@tonic-gate 6340Sstevel@tonic-gate template[nattr].type = CKA_TOKEN; 6350Sstevel@tonic-gate template[nattr].pValue = &false; 6360Sstevel@tonic-gate template[nattr].ulValueLen = sizeof (false); 6370Sstevel@tonic-gate nattr++; 6380Sstevel@tonic-gate 6390Sstevel@tonic-gate template[nattr].type = CKA_VALUE; 6400Sstevel@tonic-gate template[nattr].pValue = pkeydata; 6410Sstevel@tonic-gate template[nattr].ulValueLen = keylen; 6420Sstevel@tonic-gate nattr++; 6430Sstevel@tonic-gate 6445051Swyllys rv = C_CreateObject(hSession, template, nattr, &key); 6453812Shylee 6463812Shylee } else if (Kflag) { 6473812Shylee 6483812Shylee if (mech_type == CKM_DES_MAC) { 6493812Shylee keytype = CKK_DES; 6503812Shylee } else { 6513812Shylee keytype = CKK_GENERIC_SECRET; 6523812Shylee } 6533812Shylee 6543812Shylee rv = get_token_key(hSession, keytype, key_label, 6553812Shylee pkeydata, keylen, &key); 6563812Shylee if (rv != CKR_OK) { 6573812Shylee exitcode = EXIT_FAILURE; 6583812Shylee goto cleanup; 6593812Shylee } 6600Sstevel@tonic-gate } else { 6610Sstevel@tonic-gate CK_KEY_TYPE keytype; 6620Sstevel@tonic-gate if (mech_type == CKM_DES_MAC) { 6630Sstevel@tonic-gate keytype = CKK_DES; 6640Sstevel@tonic-gate keysize = 0; 6650Sstevel@tonic-gate } else { 6660Sstevel@tonic-gate keytype = CKK_GENERIC_SECRET; 6670Sstevel@tonic-gate keysize = 16; /* 128 bits */ 6680Sstevel@tonic-gate } 6690Sstevel@tonic-gate /* 6700Sstevel@tonic-gate * We use a fixed salt (0x0a, 0x0a, 0x0a ...) 6710Sstevel@tonic-gate * for creating the key so that the end user 6720Sstevel@tonic-gate * will be able to generate the same 'mac' 6730Sstevel@tonic-gate * using the same passphrase. 6740Sstevel@tonic-gate */ 6750Sstevel@tonic-gate (void) memset(salt, 0x0a, sizeof (salt)); 6765252Sdinak rv = pkcs11_PasswdToPBKD2Object(hSession, 6775252Sdinak (char *)pkeydata, (size_t)keylen, (void *)salt, 6785252Sdinak sizeof (salt), iterations, keytype, keysize, 6795252Sdinak CKF_SIGN, &key); 6800Sstevel@tonic-gate } 6810Sstevel@tonic-gate 6820Sstevel@tonic-gate if (rv != CKR_OK) { 6830Sstevel@tonic-gate cryptoerror(LOG_STDERR, 6840Sstevel@tonic-gate gettext("unable to create key for crypto " 6850Sstevel@tonic-gate "operation: %s"), pkcs11_strerror(rv)); 6860Sstevel@tonic-gate exitcode = EXIT_FAILURE; 6870Sstevel@tonic-gate goto cleanup; 6880Sstevel@tonic-gate } 6890Sstevel@tonic-gate } 6900Sstevel@tonic-gate 6910Sstevel@tonic-gate /* Allocate a buffer to store result. */ 6920Sstevel@tonic-gate resultlen = RESULTLEN; 6930Sstevel@tonic-gate if ((resultbuf = malloc(resultlen)) == NULL) { 6940Sstevel@tonic-gate int err = errno; 6950Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("malloc: %s\n"), 6960Sstevel@tonic-gate strerror(err)); 6970Sstevel@tonic-gate exitcode = EXIT_FAILURE; 6980Sstevel@tonic-gate goto cleanup; 6990Sstevel@tonic-gate } 7000Sstevel@tonic-gate 7010Sstevel@tonic-gate /* Allocate a buffer to store result string */ 7020Sstevel@tonic-gate resultstrlen = RESULTLEN; 7030Sstevel@tonic-gate if ((resultstr = malloc(resultstrlen)) == NULL) { 7040Sstevel@tonic-gate int err = errno; 7050Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("malloc: %s\n"), 7060Sstevel@tonic-gate strerror(err)); 7070Sstevel@tonic-gate exitcode = EXIT_FAILURE; 7080Sstevel@tonic-gate goto cleanup; 7090Sstevel@tonic-gate } 7100Sstevel@tonic-gate 7110Sstevel@tonic-gate mech.mechanism = mech_type; 7120Sstevel@tonic-gate mech.pParameter = NULL_PTR; 7130Sstevel@tonic-gate mech.ulParameterLen = 0; 7140Sstevel@tonic-gate exitcode = EXIT_SUCCESS; 7150Sstevel@tonic-gate i = 0; 7160Sstevel@tonic-gate 7170Sstevel@tonic-gate do { 7180Sstevel@tonic-gate if (filecount > 0 && filelist != NULL) { 7190Sstevel@tonic-gate filename = filelist[i]; 7205051Swyllys if ((fd = open(filename, O_RDONLY | O_NONBLOCK)) == 7215051Swyllys -1) { 7220Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 7230Sstevel@tonic-gate "can not open input file %s\n"), filename); 7240Sstevel@tonic-gate exitcode = EXIT_USAGE; 7250Sstevel@tonic-gate continue; 7260Sstevel@tonic-gate } 7270Sstevel@tonic-gate } else { 7280Sstevel@tonic-gate fd = 0; /* use stdin */ 7290Sstevel@tonic-gate } 7300Sstevel@tonic-gate 7310Sstevel@tonic-gate /* 7320Sstevel@tonic-gate * Perform the operation 7330Sstevel@tonic-gate */ 7340Sstevel@tonic-gate if (mac_cmd) { 7350Sstevel@tonic-gate rv = do_mac(hSession, &mech, fd, key, &resultbuf, 7365051Swyllys &resultlen); 7370Sstevel@tonic-gate } else { 7380Sstevel@tonic-gate rv = do_digest(hSession, &mech, fd, &resultbuf, 7395051Swyllys &resultlen); 7400Sstevel@tonic-gate } 7410Sstevel@tonic-gate 7420Sstevel@tonic-gate if (rv != CKR_OK) { 7430Sstevel@tonic-gate cryptoerror(LOG_STDERR, 7440Sstevel@tonic-gate gettext("crypto operation failed for " 7455051Swyllys "file %s: %s\n"), 7460Sstevel@tonic-gate filename ? filename : "STDIN", 7470Sstevel@tonic-gate pkcs11_strerror(rv)); 7480Sstevel@tonic-gate exitcode = EXIT_FAILURE; 7490Sstevel@tonic-gate continue; 7500Sstevel@tonic-gate } 7510Sstevel@tonic-gate 7520Sstevel@tonic-gate /* if result size has changed, allocate a bigger resulstr buf */ 7530Sstevel@tonic-gate if (resultlen != RESULTLEN) { 7540Sstevel@tonic-gate resultstrlen = 2 * resultlen + 1; 7550Sstevel@tonic-gate resultstr = realloc(resultstr, resultstrlen); 7560Sstevel@tonic-gate 7570Sstevel@tonic-gate if (resultstr == NULL) { 7580Sstevel@tonic-gate int err = errno; 7590Sstevel@tonic-gate cryptoerror(LOG_STDERR, 7600Sstevel@tonic-gate gettext("realloc: %s\n"), strerror(err)); 7610Sstevel@tonic-gate exitcode = EXIT_FAILURE; 7620Sstevel@tonic-gate goto cleanup; 7630Sstevel@tonic-gate } 7640Sstevel@tonic-gate } 7650Sstevel@tonic-gate 7660Sstevel@tonic-gate /* Output the result */ 7670Sstevel@tonic-gate tohexstr(resultbuf, resultlen, resultstr, resultstrlen); 7680Sstevel@tonic-gate 7690Sstevel@tonic-gate /* Include mechanism name for verbose */ 7700Sstevel@tonic-gate if (vflag) 7710Sstevel@tonic-gate (void) fprintf(stdout, "%s ", algo_str); 7720Sstevel@tonic-gate 7730Sstevel@tonic-gate /* Include file name for multiple files, or if verbose */ 7740Sstevel@tonic-gate if (filecount > 1 || (vflag && filecount > 0)) { 7750Sstevel@tonic-gate (void) fprintf(stdout, "(%s) = ", filename); 7760Sstevel@tonic-gate } 7770Sstevel@tonic-gate 7780Sstevel@tonic-gate (void) fprintf(stdout, "%s\n", resultstr); 7790Sstevel@tonic-gate (void) close(fd); 7800Sstevel@tonic-gate 7810Sstevel@tonic-gate 7820Sstevel@tonic-gate } while (++i < filecount); 7830Sstevel@tonic-gate 7840Sstevel@tonic-gate 7850Sstevel@tonic-gate /* clear and free the key */ 7860Sstevel@tonic-gate if (mac_cmd) { 7870Sstevel@tonic-gate (void) memset(pkeydata, 0, keylen); 7880Sstevel@tonic-gate free(pkeydata); 7890Sstevel@tonic-gate pkeydata = NULL; 7900Sstevel@tonic-gate } 7910Sstevel@tonic-gate 7920Sstevel@tonic-gate cleanup: 7930Sstevel@tonic-gate if (resultbuf != NULL) { 7940Sstevel@tonic-gate free(resultbuf); 7950Sstevel@tonic-gate } 7960Sstevel@tonic-gate 7970Sstevel@tonic-gate if (resultstr != NULL) { 7980Sstevel@tonic-gate free(resultstr); 7990Sstevel@tonic-gate } 8000Sstevel@tonic-gate 8010Sstevel@tonic-gate if (pSlotList != NULL) { 8020Sstevel@tonic-gate free(pSlotList); 8030Sstevel@tonic-gate } 8040Sstevel@tonic-gate 8053812Shylee if (!Kflag && key != (CK_OBJECT_HANDLE) 0) { 8060Sstevel@tonic-gate (void) C_DestroyObject(hSession, key); 8070Sstevel@tonic-gate } 8080Sstevel@tonic-gate 8090Sstevel@tonic-gate if (hSession != CK_INVALID_HANDLE) 8100Sstevel@tonic-gate (void) C_CloseSession(hSession); 8110Sstevel@tonic-gate 8120Sstevel@tonic-gate (void) C_Finalize(NULL_PTR); 8130Sstevel@tonic-gate 8140Sstevel@tonic-gate return (exitcode); 8150Sstevel@tonic-gate } 8160Sstevel@tonic-gate 8170Sstevel@tonic-gate /* 8180Sstevel@tonic-gate * do_digest - Compute digest of a file 8190Sstevel@tonic-gate * 8200Sstevel@tonic-gate * hSession - session 8210Sstevel@tonic-gate * pmech - ptr to mechanism to be used for digest 8220Sstevel@tonic-gate * fd - file descriptor 8230Sstevel@tonic-gate * pdigest - buffer where digest result is returned 8240Sstevel@tonic-gate * pdigestlen - length of digest buffer on input, 8250Sstevel@tonic-gate * length of result on output 8260Sstevel@tonic-gate */ 8270Sstevel@tonic-gate static CK_RV 8280Sstevel@tonic-gate do_digest(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pmech, 8290Sstevel@tonic-gate int fd, CK_BYTE_PTR *pdigest, CK_ULONG_PTR pdigestlen) 8300Sstevel@tonic-gate { 8310Sstevel@tonic-gate CK_RV rv; 8320Sstevel@tonic-gate ssize_t nread; 8330Sstevel@tonic-gate int saved_errno; 8340Sstevel@tonic-gate 8350Sstevel@tonic-gate if ((rv = C_DigestInit(hSession, pmech)) != CKR_OK) { 8360Sstevel@tonic-gate return (rv); 8370Sstevel@tonic-gate } 8380Sstevel@tonic-gate 8390Sstevel@tonic-gate while ((nread = read(fd, buf, sizeof (buf))) > 0) { 8400Sstevel@tonic-gate /* Get the digest */ 8410Sstevel@tonic-gate rv = C_DigestUpdate(hSession, buf, (CK_ULONG)nread); 8420Sstevel@tonic-gate if (rv != CKR_OK) 8430Sstevel@tonic-gate return (rv); 8440Sstevel@tonic-gate } 8450Sstevel@tonic-gate 8460Sstevel@tonic-gate saved_errno = errno; /* for later use */ 8470Sstevel@tonic-gate 8480Sstevel@tonic-gate /* 8490Sstevel@tonic-gate * Perform the C_DigestFinal, even if there is a read error. 8500Sstevel@tonic-gate * Otherwise C_DigestInit will return CKR_OPERATION_ACTIVE 8510Sstevel@tonic-gate * next time it is called (for another file) 8520Sstevel@tonic-gate */ 8530Sstevel@tonic-gate 8540Sstevel@tonic-gate rv = C_DigestFinal(hSession, *pdigest, pdigestlen); 8550Sstevel@tonic-gate 8560Sstevel@tonic-gate /* result too big to fit? Allocate a bigger buffer */ 8570Sstevel@tonic-gate if (rv == CKR_BUFFER_TOO_SMALL) { 8580Sstevel@tonic-gate *pdigest = realloc(*pdigest, *pdigestlen); 8590Sstevel@tonic-gate 8600Sstevel@tonic-gate if (*pdigest == NULL_PTR) { 8610Sstevel@tonic-gate int err = errno; 8620Sstevel@tonic-gate cryptoerror(LOG_STDERR, 8630Sstevel@tonic-gate gettext("realloc: %s\n"), strerror(err)); 8640Sstevel@tonic-gate return (CKR_HOST_MEMORY); 8650Sstevel@tonic-gate } 8660Sstevel@tonic-gate 8670Sstevel@tonic-gate rv = C_DigestFinal(hSession, *pdigest, pdigestlen); 8680Sstevel@tonic-gate } 8690Sstevel@tonic-gate 8700Sstevel@tonic-gate 8710Sstevel@tonic-gate /* There was a read error */ 8720Sstevel@tonic-gate if (nread == -1) { 8730Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext( 8745051Swyllys "error reading file: %s"), strerror(saved_errno)); 8750Sstevel@tonic-gate return (CKR_GENERAL_ERROR); 8760Sstevel@tonic-gate } else { 8770Sstevel@tonic-gate return (rv); 8780Sstevel@tonic-gate } 8790Sstevel@tonic-gate } 8800Sstevel@tonic-gate 8810Sstevel@tonic-gate /* 8820Sstevel@tonic-gate * do_mac - Compute mac of a file 8830Sstevel@tonic-gate * 8840Sstevel@tonic-gate * hSession - session 8850Sstevel@tonic-gate * pmech - ptr to mechanism to be used 8860Sstevel@tonic-gate * fd - file descriptor 8870Sstevel@tonic-gate * key - key to be used 8880Sstevel@tonic-gate * psignature - ptr buffer where mac result is returned 8890Sstevel@tonic-gate * returns new buf if current buf is small 8900Sstevel@tonic-gate * psignaturelen - length of mac buffer on input, 8910Sstevel@tonic-gate * length of result on output 8920Sstevel@tonic-gate */ 8930Sstevel@tonic-gate static CK_RV 8940Sstevel@tonic-gate do_mac(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pmech, 8950Sstevel@tonic-gate int fd, CK_OBJECT_HANDLE key, CK_BYTE_PTR *psignature, 8960Sstevel@tonic-gate CK_ULONG_PTR psignaturelen) 8970Sstevel@tonic-gate { 8980Sstevel@tonic-gate CK_RV rv; 8990Sstevel@tonic-gate ssize_t nread; 9000Sstevel@tonic-gate int saved_errno; 9010Sstevel@tonic-gate 9020Sstevel@tonic-gate if ((rv = C_SignInit(hSession, pmech, key)) != CKR_OK) { 9030Sstevel@tonic-gate return (rv); 9040Sstevel@tonic-gate } 9050Sstevel@tonic-gate 9060Sstevel@tonic-gate while ((nread = read(fd, buf, sizeof (buf))) > 0) { 9070Sstevel@tonic-gate /* Get the MAC */ 9080Sstevel@tonic-gate rv = C_SignUpdate(hSession, buf, (CK_ULONG)nread); 9090Sstevel@tonic-gate if (rv != CKR_OK) 9100Sstevel@tonic-gate return (rv); 9110Sstevel@tonic-gate } 9120Sstevel@tonic-gate 9130Sstevel@tonic-gate saved_errno = errno; /* for later use */ 9140Sstevel@tonic-gate 9150Sstevel@tonic-gate /* 9160Sstevel@tonic-gate * Perform the C_SignFinal, even if there is a read error. 9170Sstevel@tonic-gate * Otherwise C_SignInit will return CKR_OPERATION_ACTIVE 9180Sstevel@tonic-gate * next time it is called (for another file) 9190Sstevel@tonic-gate */ 9200Sstevel@tonic-gate 9210Sstevel@tonic-gate rv = C_SignFinal(hSession, *psignature, psignaturelen); 9220Sstevel@tonic-gate 9230Sstevel@tonic-gate /* result too big to fit? Allocate a bigger buffer */ 9240Sstevel@tonic-gate if (rv == CKR_BUFFER_TOO_SMALL) { 9250Sstevel@tonic-gate *psignature = realloc(*psignature, *psignaturelen); 9260Sstevel@tonic-gate 9270Sstevel@tonic-gate if (*psignature == NULL_PTR) { 9280Sstevel@tonic-gate int err = errno; 9290Sstevel@tonic-gate cryptoerror(LOG_STDERR, 9300Sstevel@tonic-gate gettext("realloc: %s\n"), strerror(err)); 9310Sstevel@tonic-gate return (CKR_HOST_MEMORY); 9320Sstevel@tonic-gate } 9330Sstevel@tonic-gate 9340Sstevel@tonic-gate rv = C_SignFinal(hSession, *psignature, psignaturelen); 9350Sstevel@tonic-gate } 9360Sstevel@tonic-gate 9370Sstevel@tonic-gate /* There was a read error */ 9380Sstevel@tonic-gate if (nread == -1) { 9390Sstevel@tonic-gate cryptoerror(LOG_STDERR, gettext("error reading file: %s"), 9405051Swyllys strerror(saved_errno)); 9410Sstevel@tonic-gate return (CKR_GENERAL_ERROR); 9420Sstevel@tonic-gate } else { 9430Sstevel@tonic-gate return (rv); 9440Sstevel@tonic-gate } 9450Sstevel@tonic-gate } 946