# # CDDL HEADER START # # The contents of this file are subject to the terms of the # Common Development and Distribution License (the "License"). # You may not use this file except in compliance with the License. # # You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE # or http://www.opensolaris.org/os/licensing. # See the License for the specific language governing permissions # and limitations under the License. # # When distributing Covered Code, include this CDDL HEADER in each # file and include the License file at usr/src/OPENSOLARIS.LICENSE. # If applicable, add the following below this CDDL HEADER, with the # fields enclosed by brackets "[]" replaced with your own identifying # information: Portions Copyright [yyyy] [name of copyright owner] # # CDDL HEADER END # # # Copyright 2009 Sun Microsystems, Inc. All rights reserved. # Use is subject to license terms. # # Makefile for policy testing code # PROG = kmfcfg OBJS = kmfcfg.o \ list.o \ delete.o \ util.o \ create.o \ modify.o \ export.o \ import.o \ install.o \ uninstall.o include ../../Makefile.cmd KMFDIR = $(SRC)/lib/libkmf SRCS = $(OBJS:%.o=%.c) POFILES = $(OBJS:%.o=%.po) POFILE = $(PROG)_msg.po MSGFILES = $(SRCS:%.c=%.i) CPPFLAGS += -I$(ROOT)/usr/include/libxml2 \ -I$(KMFDIR)/include -I. LDLIBS += -L$(ROOT)/usr/lib -lkmf -lcryptoutil XMLLIB = -lxml2 # Hammerhead: GNU Make fix - prevent .c: suffix rule from building # 'install' executable from install.c (clashes with install: target) .PHONY: install all clean clobber .KEEP_STATE: XMLDIR= $(ROOT)/etc/security DTDDIR= $(ROOT)/usr/share/lib/xml/dtd ROOTDTDS= $(DTDDIR)/kmfpolicy.dtd ROOTXML= $(XMLDIR)/kmfpolicy.xml $(ROOTDTDS) : FILEMODE = 444 $(ROOTXML) : FILEMODE = 644 all: $(PROG) $(ROOTDTDS) $(PROG): $(OBJS) $(LINK.c) -o $@ $(OBJS) $(LDLIBS) $(XMLLIB) $(POST_PROCESS) $(POFILE): $(POFILES) $(RM) $@; $(CAT) $(POFILES) > $@ install: all $(ROOTDTDS) $(ROOTXML) $(ROOTPROG) $(XMLDIR)/%: % $(INS.file) $(DTDDIR)/%: % $(INS.file) clean: $(RM) $(OBJS) include ../../Makefile.targ /* * CDDL HEADER START * * The contents of this file are subject to the terms of the * Common Development and Distribution License (the "License"). * You may not use this file except in compliance with the License. * * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE * or http://www.opensolaris.org/os/licensing. * See the License for the specific language governing permissions * and limitations under the License. * * When distributing Covered Code, include this CDDL HEADER in each * file and include the License file at usr/src/OPENSOLARIS.LICENSE. * If applicable, add the following below this CDDL HEADER, with the * fields enclosed by brackets "[]" replaced with your own identifying * information: Portions Copyright [yyyy] [name of copyright owner] * * CDDL HEADER END * * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved. */ #include #include #include #include #include #include #include #include #include "util.h" int kc_create(int argc, char *argv[]) { KMF_RETURN ret; int rv = KC_OK; int opt; extern int optind_av; extern char *optarg_av; char *filename = NULL; int ocsp_set_attr = 0; boolean_t crl_set_attr = 0; KMF_POLICY_RECORD plc; (void) memset(&plc, 0, sizeof (KMF_POLICY_RECORD)); while ((opt = getopt_av(argc, argv, "i:(dbfile)" "p:(policy)" "d:(ignore-date)" "e:(ignore-unknown-eku)" "a:(ignore-trust-anchor)" "v:(validity-adjusttime)" "t:(ta-name)" "s:(ta-serial)" "o:(ocsp-responder)" "P:(ocsp-proxy)" "r:(ocsp-use-cert-responder)" "T:(ocsp-response-lifetime)" "R:(ocsp-ignore-response-sign)" "n:(ocsp-responder-cert-name)" "A:(ocsp-responder-cert-serial)" "c:(crl-basefilename)" "I:(crl-directory)" "g:(crl-get-crl-uri)" "X:(crl-proxy)" "S:(crl-ignore-crl-sign)" "D:(crl-ignore-crl-date)" "m:(mapper-name)" "M:(mapper-directory)" "Q:(mapper-pathname)" "q:(mapper-options)" "u:(keyusage)" "E:(ekunames)" "O:(ekuoids)")) != EOF) { switch (opt) { case 'i': filename = get_string(optarg_av, &rv); if (filename == NULL) { (void) fprintf(stderr, gettext("Error dbfile input.\n")); } break; case 'p': plc.name = get_string(optarg_av, &rv); if (plc.name == NULL) { (void) fprintf(stderr, gettext("Error policy name.\n")); } break; case 'd': plc.ignore_date = get_boolean(optarg_av); if (plc.ignore_date == -1) { (void) fprintf(stderr, gettext("Error boolean input.\n")); rv = KC_ERR_USAGE; } break; case 'e': plc.ignore_unknown_ekus = get_boolean(optarg_av); if (plc.ignore_unknown_ekus == -1) { (void) fprintf(stderr, gettext("Error boolean input.\n")); rv = KC_ERR_USAGE; } break; case 'a': plc.ignore_trust_anchor = get_boolean(optarg_av); if (plc.ignore_trust_anchor == -1) { (void) fprintf(stderr, gettext("Error boolean input.\n")); rv = KC_ERR_USAGE; } break; case 'v': plc.validity_adjusttime = get_string(optarg_av, &rv); if (plc.validity_adjusttime == NULL) { (void) fprintf(stderr, gettext("Error time input.\n")); } else { uint32_t adj; /* for syntax checking */ if (str2lifetime( plc.validity_adjusttime, &adj) < 0) { (void) fprintf(stderr, gettext("Error time " "input.\n")); rv = KC_ERR_USAGE; } } break; case 't': plc.ta_name = get_string(optarg_av, &rv); if (plc.ta_name == NULL) { (void) fprintf(stderr, gettext("Error name input.\n")); } else if (strcasecmp(plc.ta_name, "search") != 0) { KMF_X509_NAME taDN; /* for syntax checking */ if (kmf_dn_parser(plc.ta_name, &taDN) != KMF_OK) { (void) fprintf(stderr, gettext("Error name " "input.\n")); rv = KC_ERR_USAGE; } else { kmf_free_dn(&taDN); } } break; case 's': plc.ta_serial = get_string(optarg_av, &rv); if (plc.ta_serial == NULL) { (void) fprintf(stderr, gettext("Error serial input.\n")); } else { uchar_t *bytes = NULL; size_t bytelen; ret = kmf_hexstr_to_bytes( (uchar_t *)plc.ta_serial, &bytes, &bytelen); if (ret != KMF_OK || bytes == NULL) { (void) fprintf(stderr, gettext("serial number " "must be specified as a " "hex number " "(ex: 0x0102030405" "ffeeddee)\n")); rv = KC_ERR_USAGE; } if (bytes != NULL) free(bytes); } break; case 'o': plc.VAL_OCSP_RESPONDER_URI = get_string(optarg_av, &rv); if (plc.VAL_OCSP_RESPONDER_URI == NULL) { (void) fprintf(stderr, gettext( "Error responder input.\n")); } else { ocsp_set_attr++; } break; case 'P': plc.VAL_OCSP_PROXY = get_string(optarg_av, &rv); if (plc.VAL_OCSP_PROXY == NULL) { (void) fprintf(stderr, gettext("Error proxy input.\n")); } else { ocsp_set_attr++; } break; case 'r': plc.VAL_OCSP_URI_FROM_CERT = get_boolean(optarg_av); if (plc.VAL_OCSP_URI_FROM_CERT == -1) { (void) fprintf(stderr, gettext("Error boolean input.\n")); rv = KC_ERR_USAGE; } else { ocsp_set_attr++; } break; case 'T': plc.VAL_OCSP_RESP_LIFETIME = get_string(optarg_av, &rv); if (plc.VAL_OCSP_RESP_LIFETIME == NULL) { (void) fprintf(stderr, gettext("Error time input.\n")); } else { uint32_t adj; /* for syntax checking */ if (str2lifetime( plc.VAL_OCSP_RESP_LIFETIME, &adj) < 0) { (void) fprintf(stderr, gettext("Error time " "input.\n")); rv = KC_ERR_USAGE; } else { ocsp_set_attr++; } } break; case 'R': plc.VAL_OCSP_IGNORE_RESP_SIGN = get_boolean(optarg_av); if (plc.VAL_OCSP_IGNORE_RESP_SIGN == -1) { (void) fprintf(stderr, gettext("Error boolean input.\n")); rv = KC_ERR_USAGE; } else { ocsp_set_attr++; } break; case 'n': plc.VAL_OCSP_RESP_CERT_NAME = get_string(optarg_av, &rv); if (plc.VAL_OCSP_RESP_CERT_NAME == NULL) { (void) fprintf(stderr, gettext("Error name input.\n")); } else { KMF_X509_NAME respDN; /* for syntax checking */ if (kmf_dn_parser( plc.VAL_OCSP_RESP_CERT_NAME, &respDN) != KMF_OK) { (void) fprintf(stderr, gettext("Error name " "input.\n")); rv = KC_ERR_USAGE; } else { kmf_free_dn(&respDN); ocsp_set_attr++; } } break; case 'A': plc.VAL_OCSP_RESP_CERT_SERIAL = get_string(optarg_av, &rv); if (plc.VAL_OCSP_RESP_CERT_SERIAL == NULL) { (void) fprintf(stderr, gettext("Error serial input.\n")); } else { uchar_t *bytes = NULL; size_t bytelen; ret = kmf_hexstr_to_bytes((uchar_t *) plc.VAL_OCSP_RESP_CERT_SERIAL, &bytes, &bytelen); if (ret != KMF_OK || bytes == NULL) { (void) fprintf(stderr, gettext("serial number " "must be specified as a " "hex number " "(ex: 0x0102030405" "ffeeddee)\n")); rv = KC_ERR_USAGE; break; } if (bytes != NULL) free(bytes); ocsp_set_attr++; } break; case 'c': plc.VAL_CRL_BASEFILENAME = get_string(optarg_av, &rv); if (plc.VAL_CRL_BASEFILENAME == NULL) { (void) fprintf(stderr, gettext("Error boolean input.\n")); } else { crl_set_attr++; } break; case 'I': plc.VAL_CRL_DIRECTORY = get_string(optarg_av, &rv); if (plc.VAL_CRL_DIRECTORY == NULL) { (void) fprintf(stderr, gettext("Error boolean input.\n")); } else { crl_set_attr++; } break; case 'g': plc.VAL_CRL_GET_URI = get_boolean(optarg_av); if (plc.VAL_CRL_GET_URI == -1) { (void) fprintf(stderr, gettext("Error boolean input.\n")); rv = KC_ERR_USAGE; } else { crl_set_attr++; } break; case 'X': plc.VAL_CRL_PROXY = get_string(optarg_av, &rv); if (plc.VAL_CRL_PROXY == NULL) { (void) fprintf(stderr, gettext("Error proxy input.\n")); } else { crl_set_attr++; } break; case 'S': plc.VAL_CRL_IGNORE_SIGN = get_boolean(optarg_av); if (plc.VAL_CRL_IGNORE_SIGN == -1) { (void) fprintf(stderr, gettext("Error boolean input.\n")); rv = KC_ERR_USAGE; } else { crl_set_attr++; } break; case 'D': plc.VAL_CRL_IGNORE_DATE = get_boolean(optarg_av); if (plc.VAL_CRL_IGNORE_DATE == -1) { (void) fprintf(stderr, gettext("Error boolean input.\n")); rv = KC_ERR_USAGE; } else { crl_set_attr++; } break; case 'u': plc.ku_bits = parseKUlist(optarg_av); if (plc.ku_bits == 0) { (void) fprintf(stderr, gettext( "Error keyusage input.\n")); rv = KC_ERR_USAGE; } break; case 'E': if (parseEKUNames(optarg_av, &plc) != 0) { (void) fprintf(stderr, gettext("Error EKU input.\n")); rv = KC_ERR_USAGE; } break; case 'O': if (parseEKUOIDs(optarg_av, &plc) != 0) { (void) fprintf(stderr, gettext("Error EKU OID input.\n")); rv = KC_ERR_USAGE; } break; case 'm': plc.mapper.mapname = get_string(optarg_av, &rv); if (plc.mapper.mapname == NULL) { (void) fprintf(stderr, gettext("Error mapper-name " "input.\n")); } break; case 'M': plc.mapper.dir = get_string(optarg_av, &rv); if (plc.mapper.dir == NULL) { (void) fprintf(stderr, gettext("Error mapper-dir " "input.\n")); } break; case 'Q': plc.mapper.pathname = get_string(optarg_av, &rv); if (plc.mapper.pathname == NULL) { (void) fprintf(stderr, gettext("Error mapper-pathname " "input.\n")); } break; case 'q': plc.mapper.options = get_string(optarg_av, &rv); if (plc.mapper.options == NULL) { (void) fprintf(stderr, gettext("Error mapper-options " "input.\n")); } break; default: (void) fprintf(stderr, gettext("Error input option.\n")); rv = KC_ERR_USAGE; break; } if (rv != KC_OK) goto out; } /* No additional args allowed. */ argc -= optind_av; if (argc) { (void) fprintf(stderr, gettext("Error input option\n")); rv = KC_ERR_USAGE; goto out; } if (filename == NULL) { filename = strdup(KMF_DEFAULT_POLICY_FILE); if (filename == NULL) { rv = KC_ERR_MEMORY; goto out; } } /* * Must have a policy name. The policy name can not be default * if using the default policy file. */ if (plc.name == NULL) { (void) fprintf(stderr, gettext("You must specify a policy name\n")); rv = KC_ERR_USAGE; goto out; } else if (strcmp(filename, KMF_DEFAULT_POLICY_FILE) == 0 && strcmp(plc.name, KMF_DEFAULT_POLICY_NAME) == 0) { (void) fprintf(stderr, gettext("Can not create a default policy in the default " "policy file\n")); rv = KC_ERR_USAGE; goto out; } /* * If the policy file exists and the policy is in the policy file * already, we will not create it again. */ if (access(filename, R_OK) == 0) { POLICY_LIST *plclist = NULL, *pnode; int found = 0; rv = load_policies(filename, &plclist); if (rv != KMF_OK) goto out; pnode = plclist; while (pnode != NULL && !found) { if (strcmp(plc.name, pnode->plc.name) == 0) found++; pnode = pnode->next; } free_policy_list(plclist); if (found) { (void) fprintf(stderr, gettext("Could not create policy \"%s\" - exists " "already\n"), plc.name); rv = KC_ERR_USAGE; goto out; } } /* * If any OCSP attribute is set, turn on the OCSP checking flag. * Also set "has_resp_cert" to be true, if the responder cert * is provided. */ if (ocsp_set_attr > 0) plc.revocation |= KMF_REVOCATION_METHOD_OCSP; if (plc.VAL_OCSP_RESP_CERT.name != NULL && plc.VAL_OCSP_RESP_CERT.serial != NULL) { plc.VAL_OCSP.has_resp_cert = B_TRUE; } /* * Setting mapper-name (with optional mapper-dir) and mapper-pathname is * mutually exclusive. Also, you cannot set options only, you need the * name or pathname, and you can set the directory only with the name, * not the pathname. */ if ((plc.mapper.mapname != NULL && plc.mapper.pathname != NULL) || (plc.mapper.dir != NULL && plc.mapper.pathname != NULL) || (plc.mapper.dir != NULL && plc.mapper.mapname == NULL) || (plc.mapper.options != NULL && plc.mapper.mapname == NULL && plc.mapper.pathname == NULL)) { (void) fprintf(stderr, gettext("Error in mapper input options\n")); rv = KC_ERR_USAGE; goto out; } /* * If any CRL attribute is set, turn on the CRL checking flag. */ if (crl_set_attr > 0) plc.revocation |= KMF_REVOCATION_METHOD_CRL; /* * Does a sanity check on the new policy. */ ret = kmf_verify_policy(&plc); if (ret != KMF_OK) { print_sanity_error(ret); rv = KC_ERR_ADD_POLICY; goto out; } /* * Add to the DB. */ ret = kmf_add_policy_to_db(&plc, filename, B_FALSE); if (ret != KMF_OK) { (void) fprintf(stderr, gettext("Error adding policy to database: 0x%04x\n"), ret); rv = KC_ERR_ADD_POLICY; } out: if (filename != NULL) free(filename); kmf_free_policy_record(&plc); return (rv); } /* * CDDL HEADER START * * The contents of this file are subject to the terms of the * Common Development and Distribution License (the "License"). * You may not use this file except in compliance with the License. * * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE * or http://www.opensolaris.org/os/licensing. * See the License for the specific language governing permissions * and limitations under the License. * * When distributing Covered Code, include this CDDL HEADER in each * file and include the License file at usr/src/OPENSOLARIS.LICENSE. * If applicable, add the following below this CDDL HEADER, with the * fields enclosed by brackets "[]" replaced with your own identifying * information: Portions Copyright [yyyy] [name of copyright owner] * * CDDL HEADER END * * Copyright 2007 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include #include #include #include #include #include #include #include "util.h" int kc_delete(int argc, char *argv[]) { int rv = KC_OK; KMF_RETURN kmfrv = KMF_OK; int opt; extern int optind_av; extern char *optarg_av; char *filename = NULL; char *policyname = NULL; while ((opt = getopt_av(argc, argv, "i:(dbfile)p:(policy)")) != EOF) { switch (opt) { case 'i': filename = get_string(optarg_av, &rv); if (filename == NULL) { (void) fprintf(stderr, gettext("Error dbfile input.\n")); } break; case 'p': policyname = get_string(optarg_av, &rv); if (policyname == NULL) { (void) fprintf(stderr, gettext("Error policy name.\n")); } break; default: (void) fprintf(stderr, gettext("Error input option.\n")); rv = KC_ERR_USAGE; break; } if (rv != KC_OK) goto out; } /* No additional args allowed. */ argc -= optind_av; if (argc) { (void) fprintf(stderr, gettext("Error input option\n")); rv = KC_ERR_USAGE; goto out; } if (filename == NULL) { filename = strdup(KMF_DEFAULT_POLICY_FILE); if (filename == NULL) { rv = KC_ERR_MEMORY; goto out; } } /* * Must have a policy name. The policy name can not be default * if using the default policy file. */ if (policyname == NULL) { (void) fprintf(stderr, gettext("You must specify a policy name\n")); rv = KC_ERR_USAGE; goto out; } else if (strcmp(filename, KMF_DEFAULT_POLICY_FILE) == 0 && strcmp(policyname, KMF_DEFAULT_POLICY_NAME) == 0) { (void) fprintf(stderr, gettext("Can not delete the default policy in the default " "policy file\n")); rv = KC_ERR_USAGE; goto out; } /* Check the access permission of the policy DB */ if (access(filename, W_OK) < 0) { int err = errno; (void) fprintf(stderr, gettext("Cannot access \"%s\" for delete - %s\n"), filename, strerror(err)); rv = KC_ERR_ACCESS; goto out; } kmfrv = kmf_delete_policy_from_db(policyname, filename); if (kmfrv != KMF_OK) rv = KC_ERR_DELETE_POLICY; out: if (filename != NULL) free(filename); if (policyname != NULL) free(policyname); return (rv); } /* * CDDL HEADER START * * The contents of this file are subject to the terms of the * Common Development and Distribution License (the "License"). * You may not use this file except in compliance with the License. * * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE * or http://www.opensolaris.org/os/licensing. * See the License for the specific language governing permissions * and limitations under the License. * * When distributing Covered Code, include this CDDL HEADER in each * file and include the License file at usr/src/OPENSOLARIS.LICENSE. * If applicable, add the following below this CDDL HEADER, with the * fields enclosed by brackets "[]" replaced with your own identifying * information: Portions Copyright [yyyy] [name of copyright owner] * * CDDL HEADER END * * * Copyright 2007 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include #include #include #include #include #include #include #include #include "util.h" int kc_export(int argc, char *argv[]) { int rv = KC_OK; char *filename = NULL; char *outfile = NULL; char *policyname = NULL; POLICY_LIST *plclist = NULL, *pnode; int opt, found = 0; extern int optind_av; extern char *optarg_av; while ((opt = getopt_av(argc, argv, "d:(dbfile)p:(policy)o:(outfile)")) != EOF) { switch (opt) { case 'd': filename = get_string(optarg_av, &rv); if (filename == NULL) { (void) fprintf(stderr, gettext("Error dbfile input.\n")); } break; case 'p': policyname = get_string(optarg_av, &rv); if (policyname == NULL) { (void) fprintf(stderr, gettext("Error policy name.\n")); } break; case 'o': outfile = get_string(optarg_av, &rv); if (outfile == NULL) { (void) fprintf(stderr, gettext("Error outfile input.\n")); } break; default: (void) fprintf(stderr, gettext("Error input option.\n")); rv = KC_ERR_USAGE; break; } if (rv != KC_OK) goto out; } /* No additional args allowed. */ argc -= optind_av; if (argc) { (void) fprintf(stderr, gettext("Error input option\n")); rv = KC_ERR_USAGE; goto out; } if (filename == NULL) { filename = strdup(KMF_DEFAULT_POLICY_FILE); if (filename == NULL) { rv = KC_ERR_MEMORY; goto out; } } if (policyname == NULL) { (void) fprintf(stderr, gettext("You must specify a policy name\n")); rv = KC_ERR_USAGE; goto out; } if (outfile == NULL) { (void) fprintf(stderr, gettext("You must specify a output DB file\n")); rv = KC_ERR_USAGE; goto out; } if (strcmp(outfile, KMF_DEFAULT_POLICY_FILE) == 0 && strcmp(policyname, KMF_DEFAULT_POLICY_NAME) == 0) { (void) fprintf(stderr, gettext("Can not export the default policy record to " "the system default policy database\n")); rv = KC_ERR_USAGE; goto out; } rv = load_policies(filename, &plclist); if (rv != KMF_OK) goto out; pnode = plclist; while (pnode != NULL && !found) { if (strcmp(policyname, pnode->plc.name) == 0) { KMF_RETURN ret; found++; ret = kmf_verify_policy(&pnode->plc); if (ret != KMF_OK) { print_sanity_error(ret); rv = KC_ERR_VERIFY_POLICY; break; } rv = kmf_add_policy_to_db(&pnode->plc, outfile, B_FALSE); } pnode = pnode->next; } if (!found) { (void) fprintf(stderr, gettext("Could not find policy \"%s\" in %s\n"), policyname, filename); rv = KC_ERR_FIND_POLICY; } out: if (filename != NULL) free(filename); if (policyname != NULL) free(policyname); if (outfile != NULL) free(outfile); free_policy_list(plclist); return (rv); } /* * CDDL HEADER START * * The contents of this file are subject to the terms of the * Common Development and Distribution License (the "License"). * You may not use this file except in compliance with the License. * * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE * or http://www.opensolaris.org/os/licensing. * See the License for the specific language governing permissions * and limitations under the License. * * When distributing Covered Code, include this CDDL HEADER in each * file and include the License file at usr/src/OPENSOLARIS.LICENSE. * If applicable, add the following below this CDDL HEADER, with the * fields enclosed by brackets "[]" replaced with your own identifying * information: Portions Copyright [yyyy] [name of copyright owner] * * CDDL HEADER END * * * Copyright 2007 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include #include #include #include #include #include #include #include #include "util.h" int kc_import(int argc, char *argv[]) { int rv = KC_OK; char *filename = NULL; char *infile = NULL; char *policyname = NULL; POLICY_LIST *plclist = NULL, *pnode; int opt, found = 0; extern int optind_av; extern char *optarg_av; while ((opt = getopt_av(argc, argv, "d:(dbfile)p:(policy)i:(infile)")) != EOF) { switch (opt) { case 'd': filename = get_string(optarg_av, &rv); if (filename == NULL) { (void) fprintf(stderr, gettext("Error dbfile input.\n")); } break; case 'p': policyname = get_string(optarg_av, &rv); if (policyname == NULL) { (void) fprintf(stderr, gettext("Error policy name.\n")); } break; case 'i': infile = get_string(optarg_av, &rv); if (infile == NULL) { (void) fprintf(stderr, gettext("Error infile input.\n")); } break; default: (void) fprintf(stderr, gettext("Error input option.\n")); rv = KC_ERR_USAGE; break; } if (rv != KC_OK) goto out; } /* No additional args allowed. */ argc -= optind_av; if (argc) { (void) fprintf(stderr, gettext("Error input option\n")); rv = KC_ERR_USAGE; goto out; } if (filename == NULL) { filename = strdup(KMF_DEFAULT_POLICY_FILE); if (filename == NULL) { rv = KC_ERR_MEMORY; goto out; } } if (policyname == NULL) { (void) fprintf(stderr, gettext("You must specify a policy name\n")); rv = KC_ERR_USAGE; goto out; } if (infile == NULL) { (void) fprintf(stderr, gettext("You must specify a input DB file\n")); rv = KC_ERR_USAGE; goto out; } if (strcmp(filename, KMF_DEFAULT_POLICY_FILE) == 0 && strcmp(policyname, KMF_DEFAULT_POLICY_NAME) == 0) { (void) fprintf(stderr, gettext("Can not import the default policy record to " "the system default policy database\n")); rv = KC_ERR_USAGE; goto out; } rv = load_policies(infile, &plclist); if (rv != KMF_OK) goto out; pnode = plclist; while (pnode != NULL && !found) { if (strcmp(policyname, pnode->plc.name) == 0) { KMF_RETURN ret; found++; ret = kmf_verify_policy(&pnode->plc); if (ret != KMF_OK) { print_sanity_error(ret); rv = KC_ERR_VERIFY_POLICY; break; } rv = kmf_add_policy_to_db(&pnode->plc, filename, B_FALSE); } pnode = pnode->next; } if (!found) { (void) fprintf(stderr, gettext("Could not find policy \"%s\" in %s\n"), policyname, infile); rv = KC_ERR_FIND_POLICY; } out: if (filename != NULL) free(filename); if (policyname != NULL) free(policyname); if (infile != NULL) free(infile); free_policy_list(plclist); return (rv); } /* * CDDL HEADER START * * The contents of this file are subject to the terms of the * Common Development and Distribution License (the "License"). * You may not use this file except in compliance with the License. * * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE * or http://www.opensolaris.org/os/licensing. * See the License for the specific language governing permissions * and limitations under the License. * * When distributing Covered Code, include this CDDL HEADER in each * file and include the License file at usr/src/OPENSOLARIS.LICENSE. * If applicable, add the following below this CDDL HEADER, with the * fields enclosed by brackets "[]" replaced with your own identifying * information: Portions Copyright [yyyy] [name of copyright owner] * * CDDL HEADER END * * Copyright 2007 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include #include #include #include #include #include #include #include #include #include #include "util.h" static int err; /* To store errno which may be overwritten by gettext() */ int kc_install(int argc, char *argv[]) { int rv = KC_OK; int opt; extern int optind_av; extern char *optarg_av; char *keystore_name = NULL; char *modulepath = NULL; char *option_str = NULL; conf_entry_t *entry = NULL; char realpath[MAXPATHLEN]; struct stat statbuf; FILE *pfile = NULL; FILE *pfile_tmp = NULL; char tmpfile_name[MAXPATHLEN]; int found_count = 0; char buffer[BUFSIZ]; char *ptr; boolean_t found; while ((opt = getopt_av(argc, argv, "k:(keystore)m:(modulepath)" "o:(option)")) != EOF) { switch (opt) { case 'k': if (keystore_name != NULL) rv = KC_ERR_USAGE; else { keystore_name = get_string(optarg_av, &rv); if (keystore_name == NULL) { (void) fprintf(stderr, gettext( "Error keystore input.\n")); } } break; case 'm': if (modulepath != NULL) rv = KC_ERR_USAGE; else { modulepath = get_string(optarg_av, &rv); if (modulepath == NULL) { (void) fprintf(stderr, gettext("Error modulepath.\n")); } } break; case 'o': if (option_str != NULL) { rv = KC_ERR_USAGE; } else { option_str = get_string(optarg_av, &rv); if (option_str == NULL) { (void) fprintf(stderr, gettext("Error option input.\n")); } } break; default: (void) fprintf(stderr, gettext("Error input option.\n")); rv = KC_ERR_USAGE; break; } if (rv != KC_OK) goto out; } /* No additional args allowed. */ argc -= optind_av; if (argc) { (void) fprintf(stderr, gettext("Error input option\n")); rv = KC_ERR_USAGE; goto out; } if (keystore_name == NULL || modulepath == NULL) { (void) fprintf(stderr, gettext("Error input option\n")); rv = KC_ERR_USAGE; goto out; } if (strcasecmp(keystore_name, "nss") == 0 || strcasecmp(keystore_name, "pkcs11") == 0 || strcasecmp(keystore_name, "file") == 0) { (void) fprintf(stderr, gettext("Can not use the built-in keystore name %s\n"), keystore_name); rv = KC_ERR_USAGE; goto out; } entry = get_keystore_entry(keystore_name); if (entry != NULL) { (void) fprintf(stderr, gettext("%s exists already.\n"), keystore_name); rv = KC_ERR_USAGE; goto out; } /* * Find the absolute path of the module and check if it exists in * the system. If $ISA is in the path, will check the 32bit version * only. */ if (strncmp(modulepath, "/", 1) != 0) { /* * Only contain the base name; prepand it with * KMF_PLUGIN_PATH */ (void) snprintf(realpath, MAXPATHLEN, "%s%s", KMF_PLUGIN_PATH, modulepath); } else { char *buf = modulepath; char *isa; if ((isa = strstr(buf, PKCS11_ISA)) != NULL) { (void) strncpy(realpath, buf, isa - buf); isa += strlen(PKCS11_ISA) - 1; (void) strlcat(realpath, isa, MAXPATHLEN); } else { (void) strlcpy(realpath, modulepath, MAXPATHLEN); } } if (stat(realpath, &statbuf) != 0) { (void) fprintf(stderr, gettext("%s not found.\n"), realpath); rv = KC_ERR_ACCESS; goto out; } if ((pfile = fopen(_PATH_KMF_CONF, "r+")) == NULL) { err = errno; (void) fprintf(stderr, gettext("failed to update the configuration - %s\n"), strerror(err)); rv = KC_ERR_ACCESS; goto out; } if (lockf(fileno(pfile), F_TLOCK, 0) == -1) { err = errno; (void) fprintf(stderr, gettext("failed to lock the configuration - %s\n"), strerror(err)); rv = KC_ERR_INSTALL; goto out; } /* * Create a temporary file in the /etc/crypto directory. */ (void) strlcpy(tmpfile_name, CONF_TEMPFILE, sizeof (tmpfile_name)); if (mkstemp(tmpfile_name) == -1) { err = errno; (void) fprintf(stderr, gettext("failed to create a temporary file - %s\n"), strerror(err)); rv = KC_ERR_INSTALL; goto out; } if ((pfile_tmp = fopen(tmpfile_name, "w")) == NULL) { err = errno; (void) fprintf(stderr, gettext("failed to open %s - %s\n"), tmpfile_name, strerror(err)); rv = KC_ERR_INSTALL; goto out; } /* * Loop thru the config file. If the file was reserved within a * package bracket, just uncomment it. Other wise, append it at * the end. The resulting file will be saved in the temp file first. */ while (fgets(buffer, BUFSIZ, pfile) != NULL) { found = B_FALSE; if (buffer[0] == '#') { ptr = buffer; ptr++; while (*ptr == '#' || *ptr == ' ') ptr++; if (strncmp(keystore_name, ptr, strlen(keystore_name)) == 0) { found = B_TRUE; found_count++; } } if (found == B_FALSE) { if (fputs(buffer, pfile_tmp) == EOF) { rv = KC_ERR_INSTALL; goto out; } } else { if (found_count == 1) { if (fputs(ptr, pfile_tmp) == EOF) { rv = KC_ERR_INSTALL; goto out; } } else { /* * Found a second entry with #keystore_name. * This should not happen. The kmf.conf file * is corrupted. Give a warning and skip * this entry. */ (void) fprintf(stderr, gettext( "(Warning) Found an additional reserved " "entry for %s.\n"), keystore_name); } } } if (found_count == 0) { char buf[MAXPATHLEN]; /* * This entry was not in package before, append it to the * end of the temp file. */ if (option_str == NULL) (void) snprintf(buf, MAXPATHLEN, "%s:%s%s\n", keystore_name, CONF_MODULEPATH, modulepath); else (void) snprintf(buf, MAXPATHLEN, "%s:%s%s;%s%s\n", keystore_name, CONF_MODULEPATH, modulepath, CONF_OPTION, option_str); if (fputs(buf, pfile_tmp) == EOF) { err = errno; (void) fprintf(stderr, gettext( "failed to write to %s: %s\n"), tmpfile_name, strerror(err)); rv = KC_ERR_INSTALL; goto out; } } out: if (pfile != NULL) (void) fclose(pfile); if (rv != KC_OK && pfile_tmp != NULL) (void) unlink(tmpfile_name); if (pfile_tmp != NULL) (void) fclose(pfile_tmp); if (rv == KC_OK) { if (rename(tmpfile_name, _PATH_KMF_CONF) == -1) { err = errno; (void) fprintf(stderr, gettext( "failed to update the configuration - %s"), strerror(err)); return (KC_ERR_INSTALL); } if (chmod(_PATH_KMF_CONF, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH) == -1) { err = errno; (void) fprintf(stderr, gettext( "failed to update the configuration - %s\n"), strerror(err)); return (KC_ERR_INSTALL); } } return (rv); } /* * CDDL HEADER START * * The contents of this file are subject to the terms of the * Common Development and Distribution License (the "License"). * You may not use this file except in compliance with the License. * * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE * or http://www.opensolaris.org/os/licensing. * See the License for the specific language governing permissions * and limitations under the License. * * When distributing Covered Code, include this CDDL HEADER in each * file and include the License file at usr/src/OPENSOLARIS.LICENSE. * If applicable, add the following below this CDDL HEADER, with the * fields enclosed by brackets "[]" replaced with your own identifying * information: Portions Copyright [yyyy] [name of copyright owner] * * CDDL HEADER END * * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved. */ /* * Copyright (c) 2018, Joyent, Inc. */ #include #include #include #include #include #include #include #include "util.h" /* * The verbcmd construct allows genericizing information about a verb so * that it is easier to manipulate. Makes parsing code easier to read, * fix, and extend with new verbs. */ typedef struct verbcmd_s { char *verb; int (*action)(int, char *[]); char *synopsis; } verbcmd; int kc_list(int argc, char *argv[]); int kc_delete(int argc, char *argv[]); int kc_create(int argc, char *argv[]); int kc_modify(int argc, char *argv[]); int kc_export(int argc, char *argv[]); int kc_import(int argc, char *argv[]); int kc_install(int argc, char *argv[]); int kc_uninstall(int argc, char *argv[]); static int kc_help(); static verbcmd cmds[] = { { "list", kc_list, "list [dbfile=dbfile] [policy=policyname]\n" "\tlist plugin" }, { "delete", kc_delete, "delete [dbfile=dbfile] " "policy=policyname" }, { "create", kc_create, "create [dbfile=dbfile] policy=policyname\n" "\t\t[ignore-date=true|false]\n" "\t\t[ignore-unknown-eku=true|false]\n" "\t\t[ignore-trust-anchor=true|false]\n" "\t\t[validity-adjusttime=adjusttime]\n" "\t\t[ta-name=trust anchor subject DN]\n" "\t\t[ta-serial=trust anchor serial number]\n" "\t\t[ocsp-responder=URL]\n" "\t\t[ocsp-proxy=URL]\n" "\t\t[ocsp-use-cert-responder=true|false]\n" "\t\t[ocsp-response-lifetime=timelimit]\n" "\t\t[ocsp-ignore-response-sign=true|false]\n" "\t\t[ocsp-responder-cert-name=Issuer DN]\n" "\t\t[ocsp-responder-cert-serial=serial number]\n" "\t\t[crl-basefilename=basefilename]\n" "\t\t[crl-directory=directory]\n" "\t\t[crl-get-crl-uri=true|false]\n" "\t\t[crl-proxy=URL]\n" "\t\t[crl-ignore-crl-sign=true|false]\n" "\t\t[crl-ignore-crl-date=true|false]\n" "\t\t[keyusage=digitalSignature|nonRepudiation\n\t" "\t\t|keyEncipherment | dataEncipherment |\n\t" "\t\tkeyAgreement |keyCertSign |\n\t" "\t\tcRLSign | encipherOnly | decipherOnly],[...]\n" "\t\t[ekunames=serverAuth | clientAuth |\n\t" "\t\tcodeSigning | emailProtection |\n\t" "\t\tipsecEndSystem | ipsecTunnel |\n\t" "\t\tipsecUser | timeStamping |\n\t" "\t\tOCSPSigning],[...]\n" "\t\t[ekuoids=OID,OID,OID...]\n" "\t\t[mapper-name=name of mapper library]\n" "\t\t[mapper-directory=dir where mapper library resides]\n" "\t\t[mapper-path=full pathname of mapper library]\n" "\t\t[mapper-options=mapper options]\n"}, { "modify", kc_modify, "modify [dbfile=dbfile] policy=policyname\n" "\t\t[ignore-date=true|false]\n" "\t\t[ignore-unknown-eku=true|false]\n" "\t\t[ignore-trust-anchor=true|false]\n" "\t\t[validity-adjusttime=adjusttime]\n" "\t\t[ta-name=trust anchor subject DN | search]\n" "\t\t[ta-serial=trust anchor serial number]\n" "\t\t[ocsp-responder=URL]\n" "\t\t[ocsp-proxy=URL]\n" "\t\t[ocsp-use-cert-responder=true|false]\n" "\t\t[ocsp-response-lifetime=timelimit]\n" "\t\t[ocsp-ignore-response-sign=true|false]\n" "\t\t[ocsp-responder-cert-name=Issuer DN]\n" "\t\t[ocsp-responder-cert-serial=serial number]\n" "\t\t[ocsp-none=true|false]\n" "\t\t[crl-basefilename=basefilename]\n" "\t\t[crl-directory=directory]\n" "\t\t[crl-get-crl-uri=true|false]\n" "\t\t[crl-proxy=URL]\n" "\t\t[crl-ignore-crl-sign=true|false]\n" "\t\t[crl-ignore-crl-date=true|false]\n" "\t\t[crl-none=true|false]\n" "\t\t[keyusage=digitalSignature|nonRepudiation\n\t" "\t\t|keyEncipherment | dataEncipherment |\n\t" "\t\tkeyAgreement |keyCertSign |\n\t" "\t\tcRLSign | encipherOnly | decipherOnly],[...]\n" "\t\t[keyusage-none=true|false]\n" "\t\t[ekunames=serverAuth | clientAuth |\n\t" "\t\tcodeSigning | emailProtection |\n\t" "\t\tipsecEndSystem | ipsecTunnel |\n\t" "\t\tipsecUser | timeStamping |\n\t" "\t\tOCSPSigning],[...]\n" "\t\t[ekuoids=OID,OID,OID...]\n" "\t\t[eku-none=true|false]\n\n" "\t\t[mapper-name=name of mapper library]\n" "\t\t[mapper-directory=dir where mapper library resides]\n" "\t\t[mapper-path=full pathname of mapper library]\n" "\t\t[mapper-options=mapper options]\n" "\tmodify plugin keystore=keystorename option=optionstring\n"}, { "import", kc_import, "import [dbfile=dbfile] policy=policyname " "infile=inputdbfile\n" }, { "export", kc_export, "export [dbfile=dbfile] policy=policyname " "outfile=newdbfile\n" }, { "install", kc_install, "install keystore=keystorename " "modulepath=path [option=optionstring]\n"}, { "uninstall", kc_uninstall, "uninstall keystore=keystorename\n"}, { "-?", kc_help, "help"}, { "help", kc_help, ""} }; static int num_cmds = sizeof (cmds) / sizeof (verbcmd); static char *prog; static void usage(void) { int i; /* Display this block only in command-line mode. */ (void) fprintf(stdout, gettext("Usage:\n")); (void) fprintf(stdout, gettext("\t%s -?\t(help and usage)\n"), prog); (void) fprintf(stdout, gettext("\t%s subcommand [options...]\n"), prog); (void) fprintf(stdout, gettext("where subcommands may be:\n")); /* Display only those verbs that match the current tool mode. */ for (i = 0; i < num_cmds; i++) { /* Do NOT i18n/l10n. */ (void) fprintf(stdout, "\t%s\n", cmds[i].synopsis); } } static int kc_help() { usage(); return (0); } int main(int argc, char *argv[]) { int ret; int found; int i; (void) setlocale(LC_ALL, ""); #if !defined(TEXT_DOMAIN) /* Should be defined by cc -D. */ #define TEXT_DOMAIN "SYS_TEST" /* Use this only if it isn't. */ #endif (void) textdomain(TEXT_DOMAIN); prog = basename(argv[0]); argv++; argc--; if (argc == 0) { usage(); exit(1); } if (argc == 1 && argv[0][0] == '-') { switch (argv[0][1]) { case '?': return (kc_help()); default: usage(); exit(1); } } found = -1; for (i = 0; i < num_cmds; i++) { if (strcmp(cmds[i].verb, argv[0]) == 0) { found = i; break; } } if (found < 0) { (void) fprintf(stderr, gettext("Invalid command: %s\n"), argv[0]); exit(1); } /* * Note the action functions can return values from * the key management framework, and those values can conflict * with the utility error codes. */ ret = (*cmds[found].action)(argc, argv); switch (ret) { case KC_OK: break; case KC_ERR_USAGE: break; case KC_ERR_LOADDB: (void) fprintf(stderr, gettext("Error loading database\n")); break; case KC_ERR_FIND_POLICY: break; case KC_ERR_DELETE_POLICY: (void) fprintf(stderr, gettext("Error deleting policy " "from database.\n")); break; case KC_ERR_ADD_POLICY: break; case KC_ERR_VERIFY_POLICY: break; case KC_ERR_INCOMPLETE_POLICY: break; case KC_ERR_MEMORY: (void) fprintf(stderr, gettext("Out of memory.\n")); break; case KC_ERR_ACCESS: break; case KC_ERR_INSTALL: break; case KC_ERR_UNINSTALL: break; default: (void) fprintf(stderr, gettext("%s operation failed. " "error 0x%02x\n"), cmds[found].verb, ret); break; } return (ret); } /* * CDDL HEADER START * * The contents of this file are subject to the terms of the * Common Development and Distribution License (the "License"). * You may not use this file except in compliance with the License. * * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE * or http://www.opensolaris.org/os/licensing. * See the License for the specific language governing permissions * and limitations under the License. * * When distributing Covered Code, include this CDDL HEADER in each * file and include the License file at usr/src/OPENSOLARIS.LICENSE. * If applicable, add the following below this CDDL HEADER, with the * fields enclosed by brackets "[]" replaced with your own identifying * information: Portions Copyright [yyyy] [name of copyright owner] * * CDDL HEADER END * * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved. */ #include #include #include #include #include #include #include #include #include "util.h" #define LIB_NSS_PATH "/usr/lib/mps/libnss3.so" #define LIB_NSPR_PATH "/usr/lib/mps/libnspr4.so" static void show_policy(KMF_POLICY_RECORD *plc) { int i; if (plc == NULL) return; (void) printf("Name: %s\n", plc->name); (void) printf(gettext("Ignore Date: %s\n"), plc->ignore_date ? gettext("true") : gettext("false")); (void) printf(gettext("Ignore Unknown EKUs: %s\n"), plc->ignore_unknown_ekus ? gettext("true") : gettext("false")); (void) printf(gettext("Ignore TA: %s\n"), plc->ignore_trust_anchor ? gettext("true") : gettext("false")); (void) printf(gettext("Validity Adjusted Time: %s\n"), plc->validity_adjusttime ? plc->validity_adjusttime : ""); if (plc->ta_name == NULL && plc->ta_serial == NULL) { (void) printf(gettext("Trust Anchor Certificate: \n")); } else if (strcasecmp(plc->ta_name, "search") == 0) { (void) printf(gettext("Trust Anchor Certificate: " "Search by Issuer\n")); } else { (void) printf(gettext("Trust Anchor Certificate:\n")); (void) printf(gettext("\tName: %s\n"), plc->ta_name ? plc->ta_name : ""); (void) printf(gettext("\tSerial Number: %s\n"), plc->ta_serial ? plc->ta_serial : ""); } if (plc->ku_bits != 0) { (void) printf(gettext("Key Usage Bits: ")); for (i = KULOWBIT; i <= KUHIGHBIT; i++) { char *s = kmf_ku_to_string( (plc->ku_bits & (1<eku_set.eku_count > 0) { (void) printf(gettext("Extended Key Usage Values:\n")); for (i = 0; i < plc->eku_set.eku_count; i++) { char *s = kmf_oid_to_ekuname( &plc->eku_set.ekulist[i]); (void) printf("\t%s\t(%s)\n", kmf_oid_to_string(&plc->eku_set.ekulist[i]), s ? s : "unknown"); } } else { (void) printf(gettext("Extended Key Usage Values: \n")); } (void) printf(gettext("Validation Policy Information:\n")); if (plc->revocation & KMF_REVOCATION_METHOD_OCSP) { (void) printf(gettext(" OCSP:\n")); (void) printf(gettext("\tResponder URI: %s\n"), plc->VAL_OCSP_BASIC.responderURI ? plc->VAL_OCSP_BASIC.responderURI : ""); (void) printf(gettext("\tProxy: %s\n"), plc->VAL_OCSP_BASIC.proxy ? plc->VAL_OCSP_BASIC.proxy : ""); (void) printf(gettext("\tUse ResponderURI from Certificate: " "%s\n"), plc->VAL_OCSP_BASIC.uri_from_cert ? gettext("true") : gettext("false")); (void) printf(gettext("\tResponse lifetime: %s\n"), plc->VAL_OCSP_BASIC.response_lifetime ? plc->VAL_OCSP_BASIC.response_lifetime : ""); (void) printf(gettext("\tIgnore Response signature: %s\n"), plc->VAL_OCSP_BASIC.ignore_response_sign ? gettext("true") : gettext("false")); if (!plc->VAL_OCSP.has_resp_cert) { (void) printf(gettext("\tResponder Certificate:" " \n")); } else { (void) printf(gettext("\tResponder Certificate:\n")); (void) printf(gettext("\t\tName: %s\n"), plc->VAL_OCSP_RESP_CERT.name ? plc->VAL_OCSP_RESP_CERT.name : ""); (void) printf(gettext("\t\tSerial: %s\n"), plc->VAL_OCSP_RESP_CERT.serial ? plc->VAL_OCSP_RESP_CERT.serial : ""); } } if (plc->revocation & KMF_REVOCATION_METHOD_CRL) { (void) printf(gettext(" CRL:\n")); (void) printf(gettext("\tBase filename: %s\n"), plc->validation_info.crl_info.basefilename ? plc->validation_info.crl_info.basefilename : ""); (void) printf(gettext("\tDirectory: %s\n"), plc->validation_info.crl_info.directory ? plc->validation_info.crl_info.directory : ""); (void) printf(gettext("\tDownload and cache CRL: %s\n"), plc->validation_info.crl_info.get_crl_uri ? gettext("true") : gettext("false")); (void) printf(gettext("\tProxy: %s\n"), plc->validation_info.crl_info.proxy ? plc->validation_info.crl_info.proxy : ""); (void) printf(gettext("\tIgnore CRL signature: %s\n"), plc->validation_info.crl_info.ignore_crl_sign ? gettext("true") : gettext("false")); (void) printf(gettext("\tIgnore CRL validity date: %s\n"), plc->validation_info.crl_info.ignore_crl_date ? gettext("true") : gettext("false")); } (void) printf(gettext("Mapper name: %s\n"), plc->mapper.mapname ? plc->mapper.mapname : ""); (void) printf(gettext("Mapper pathname: %s\n"), plc->mapper.pathname ? plc->mapper.pathname : ""); (void) printf(gettext("Mapper directory: %s\n"), plc->mapper.dir ? plc->mapper.dir : ""); (void) printf(gettext("Mapper options: %s\n"), plc->mapper.options ? plc->mapper.options : ""); (void) printf("\n"); } void show_plugin(void) { conf_entrylist_t *phead = NULL; struct stat statbuf; (void) printf(gettext("KMF plugin information:\n")); (void) printf(gettext("-----------------------\n")); /* List the built-in plugins */ (void) printf("pkcs11:kmf_pkcs11.so.1 (built-in)\n"); (void) printf("file:kmf_openssl.so.1 (built-in)\n"); /* * If the NSS libraries are not installed in the system, * then we will not show the nss plugin either. */ if (stat(LIB_NSS_PATH, &statbuf) == 0 && stat(LIB_NSPR_PATH, &statbuf) == 0) { (void) printf("nss:kmf_nss.so.1 (built-in)\n"); } /* List non-default plugins, if there is any. */ if (get_entrylist(&phead) == KMF_OK) { while (phead != NULL) { (void) printf("%s:%s", phead->entry->keystore, phead->entry->modulepath); if (phead->entry->option == NULL) (void) printf("\n"); else (void) printf(";option=%s\n", phead->entry->option); phead = phead->next; } free_entrylist(phead); } } int kc_list(int argc, char *argv[]) { int rv = KC_OK; int opt, found = 0; extern int optind_av; extern char *optarg_av; char *filename = NULL; char *policyname = NULL; POLICY_LIST *plclist = NULL, *pnode; int sanity_err = 0; boolean_t list_plugin = B_FALSE; while ((opt = getopt_av(argc, argv, "i:(dbfile)p:(policy)m(plugin)")) != EOF) { switch (opt) { case 'i': if (list_plugin) rv = KC_ERR_USAGE; else { filename = get_string(optarg_av, &rv); if (filename == NULL) { (void) fprintf(stderr, gettext("Error dbfile input.\n")); } } break; case 'p': if (list_plugin) rv = KC_ERR_USAGE; else { policyname = get_string(optarg_av, &rv); if (policyname == NULL) { (void) fprintf(stderr, gettext("Error policy name.\n")); } } break; case 'm': list_plugin = B_TRUE; break; default: (void) fprintf(stderr, gettext("Error input option.\n")); rv = KC_ERR_USAGE; break; } if (rv != KC_OK) goto out; } /* No additional args allowed. */ argc -= optind_av; if (argc) { (void) fprintf(stderr, gettext("Error input option\n")); rv = KC_ERR_USAGE; goto out; } if (list_plugin) { show_plugin(); goto out; } if (filename == NULL) { filename = strdup(KMF_DEFAULT_POLICY_FILE); if (filename == NULL) { rv = KC_ERR_MEMORY; goto out; } } /* Check the access permission of the policy DB */ if (access(filename, R_OK) < 0) { int err = errno; (void) fprintf(stderr, gettext("Cannot access \"%s\" for list - %s\n"), filename, strerror(err)); rv = KC_ERR_ACCESS; goto out; } rv = load_policies(filename, &plclist); if (rv != KMF_OK) { goto out; } pnode = plclist; while (pnode != NULL) { if (policyname == NULL || strcmp(policyname, pnode->plc.name) == 0) { KMF_POLICY_RECORD *plc = &pnode->plc; found++; rv = kmf_verify_policy(plc); if (rv != KMF_OK) { (void) fprintf(stderr, gettext( "Policy Name: '%s' is invalid\n"), plc->name); sanity_err++; } else { show_policy(&pnode->plc); } } pnode = pnode->next; } free_policy_list(plclist); if (!found) { if (policyname) (void) fprintf(stderr, gettext( "Cannot find policy '%s'\n"), policyname); else (void) fprintf(stderr, gettext("Cannot find " "any policies to display\n")); rv = KC_ERR_FIND_POLICY; } else if (sanity_err) { rv = KC_ERR_VERIFY_POLICY; } out: if (filename != NULL) free(filename); if (policyname != NULL) free(policyname); return (rv); } /* * CDDL HEADER START * * The contents of this file are subject to the terms of the * Common Development and Distribution License (the "License"). * You may not use this file except in compliance with the License. * * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE * or http://www.opensolaris.org/os/licensing. * See the License for the specific language governing permissions * and limitations under the License. * * When distributing Covered Code, include this CDDL HEADER in each * file and include the License file at usr/src/OPENSOLARIS.LICENSE. * If applicable, add the following below this CDDL HEADER, with the * fields enclosed by brackets "[]" replaced with your own identifying * information: Portions Copyright [yyyy] [name of copyright owner] * * CDDL HEADER END * * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved. */ #include #include #include #include #include #include #include #include #include #include #include "util.h" #define KC_IGNORE_DATE 0x0000001 #define KC_IGNORE_UNKNOWN_EKUS 0x0000002 #define KC_IGNORE_TRUST_ANCHOR 0x0000004 #define KC_VALIDITY_ADJUSTTIME 0x0000008 #define KC_TA_NAME 0x0000010 #define KC_TA_SERIAL 0x0000020 #define KC_OCSP_RESPONDER_URI 0x0000040 #define KC_OCSP_PROXY 0x0000080 #define KC_OCSP_URI_FROM_CERT 0x0000100 #define KC_OCSP_RESP_LIFETIME 0x0000200 #define KC_OCSP_IGNORE_RESP_SIGN 0x0000400 #define KC_OCSP_RESP_CERT_NAME 0x0000800 #define KC_OCSP_RESP_CERT_SERIAL 0x0001000 #define KC_OCSP_NONE 0x0002000 #define KC_CRL_BASEFILENAME 0x0004000 #define KC_CRL_DIRECTORY 0x0008000 #define KC_CRL_GET_URI 0x0010000 #define KC_CRL_PROXY 0x0020000 #define KC_CRL_IGNORE_SIGN 0x0040000 #define KC_CRL_IGNORE_DATE 0x0080000 #define KC_CRL_NONE 0x0100000 #define KC_KEYUSAGE 0x0200000 #define KC_KEYUSAGE_NONE 0x0400000 #define KC_EKUS 0x0800000 #define KC_EKUS_NONE 0x1000000 #define KC_MAPPER_OPTIONS 0x2000000 static int err; /* To store errno which may be overwritten by gettext() */ #define UPDATE_IF_DIFFERENT(old, new) \ if ((old != NULL && new != NULL && strcmp(old, new) != 0) || \ (old == NULL && new != NULL)) { \ if (old != NULL) \ free(old); \ old = new; \ } int kc_modify_policy(int argc, char *argv[]) { KMF_RETURN ret; int rv = KC_OK; int opt; extern int optind_av; extern char *optarg_av; char *filename = NULL; char *mapper_name = NULL; char *mapper_dir = NULL; char *mapper_pathname = NULL; uint32_t flags = 0; boolean_t ocsp_none_opt = B_FALSE; boolean_t crl_none_opt = B_FALSE; boolean_t ku_none_opt = B_FALSE; boolean_t eku_none_opt = B_FALSE; int ocsp_set_attr = 0; int crl_set_attr = 0; KMF_POLICY_RECORD oplc, plc; (void) memset(&plc, 0, sizeof (KMF_POLICY_RECORD)); (void) memset(&oplc, 0, sizeof (KMF_POLICY_RECORD)); while ((opt = getopt_av(argc, argv, "i:(dbfile)" "p:(policy)" "d:(ignore-date)" "e:(ignore-unknown-eku)" "a:(ignore-trust-anchor)" "v:(validity-adjusttime)" "t:(ta-name)" "s:(ta-serial)" "o:(ocsp-responder)" "P:(ocsp-proxy)" "r:(ocsp-use-cert-responder)" "T:(ocsp-response-lifetime)" "R:(ocsp-ignore-response-sign)" "n:(ocsp-responder-cert-name)" "A:(ocsp-responder-cert-serial)" "y:(ocsp-none)" "c:(crl-basefilename)" "I:(crl-directory)" "g:(crl-get-crl-uri)" "X:(crl-proxy)" "S:(crl-ignore-crl-sign)" "D:(crl-ignore-crl-date)" "z:(crl-none)" "u:(keyusage)" "Y:(keyusage-none)" "E:(ekunames)" "O:(ekuoids)" "m:(mapper-name)" "M:(mapper-directory)" "Q:(mapper-pathname)" "q:(mapper-options)" "Z:(eku-none)")) != EOF) { switch (opt) { case 'i': filename = get_string(optarg_av, &rv); if (filename == NULL) { (void) fprintf(stderr, gettext("Error dbfile input.\n")); } break; case 'p': plc.name = get_string(optarg_av, &rv); if (plc.name == NULL) { (void) fprintf(stderr, gettext("Error policy name.\n")); } break; case 'd': plc.ignore_date = get_boolean(optarg_av); if (plc.ignore_date == -1) { (void) fprintf(stderr, gettext("Error boolean input.\n")); rv = KC_ERR_USAGE; } else { flags |= KC_IGNORE_DATE; } break; case 'e': plc.ignore_unknown_ekus = get_boolean(optarg_av); if (plc.ignore_unknown_ekus == -1) { (void) fprintf(stderr, gettext("Error boolean input.\n")); rv = KC_ERR_USAGE; } else { flags |= KC_IGNORE_UNKNOWN_EKUS; } break; case 'a': plc.ignore_trust_anchor = get_boolean(optarg_av); if (plc.ignore_trust_anchor == -1) { (void) fprintf(stderr, gettext("Error boolean input.\n")); rv = KC_ERR_USAGE; } else { flags |= KC_IGNORE_TRUST_ANCHOR; } break; case 'v': plc.validity_adjusttime = get_string(optarg_av, &rv); if (plc.validity_adjusttime == NULL) { (void) fprintf(stderr, gettext("Error time input.\n")); } else { uint32_t adj; /* for syntax checking */ if (str2lifetime( plc.validity_adjusttime, &adj) < 0) { (void) fprintf(stderr, gettext("Error time " "input.\n")); rv = KC_ERR_USAGE; } else { flags |= KC_VALIDITY_ADJUSTTIME; } } break; case 't': plc.ta_name = get_string(optarg_av, &rv); if (plc.ta_name == NULL) { (void) fprintf(stderr, gettext("Error name input.\n")); } else if (strcasecmp(plc.ta_name, "search")) { KMF_X509_NAME taDN; /* for syntax checking */ if (kmf_dn_parser(plc.ta_name, &taDN) != KMF_OK) { (void) fprintf(stderr, gettext("Error name " "input.\n")); rv = KC_ERR_USAGE; } else { kmf_free_dn(&taDN); flags |= KC_TA_NAME; } } else { flags |= KC_TA_NAME; } break; case 's': plc.ta_serial = get_string(optarg_av, &rv); if (plc.ta_serial == NULL) { (void) fprintf(stderr, gettext("Error serial input.\n")); } else { uchar_t *bytes = NULL; size_t bytelen; ret = kmf_hexstr_to_bytes( (uchar_t *)plc.ta_serial, &bytes, &bytelen); if (ret != KMF_OK || bytes == NULL) { (void) fprintf(stderr, gettext("serial number " "must be specified as a " "hex number " "(ex: 0x0102030405" "ffeeddee)\n")); rv = KC_ERR_USAGE; break; } if (bytes != NULL) free(bytes); flags |= KC_TA_SERIAL; } break; case 'o': plc.VAL_OCSP_RESPONDER_URI = get_string(optarg_av, &rv); if (plc.VAL_OCSP_RESPONDER_URI == NULL) { (void) fprintf(stderr, gettext("Error responder " "input.\n")); } else { flags |= KC_OCSP_RESPONDER_URI; ocsp_set_attr++; } break; case 'P': plc.VAL_OCSP_PROXY = get_string(optarg_av, &rv); if (plc.VAL_OCSP_PROXY == NULL) { (void) fprintf(stderr, gettext("Error proxy input.\n")); } else { flags |= KC_OCSP_PROXY; ocsp_set_attr++; } break; case 'r': plc.VAL_OCSP_URI_FROM_CERT = get_boolean(optarg_av); if (plc.VAL_OCSP_URI_FROM_CERT == -1) { (void) fprintf(stderr, gettext("Error boolean input.\n")); rv = KC_ERR_USAGE; } else { flags |= KC_OCSP_URI_FROM_CERT; ocsp_set_attr++; } break; case 'T': plc.VAL_OCSP_RESP_LIFETIME = get_string(optarg_av, &rv); if (plc.VAL_OCSP_RESP_LIFETIME == NULL) { (void) fprintf(stderr, gettext("Error time input.\n")); } else { uint32_t adj; /* for syntax checking */ if (str2lifetime( plc.VAL_OCSP_RESP_LIFETIME, &adj) < 0) { (void) fprintf(stderr, gettext("Error time " "input.\n")); rv = KC_ERR_USAGE; } else { flags |= KC_OCSP_RESP_LIFETIME; ocsp_set_attr++; } } break; case 'R': plc.VAL_OCSP_IGNORE_RESP_SIGN = get_boolean(optarg_av); if (plc.VAL_OCSP_IGNORE_RESP_SIGN == -1) { (void) fprintf(stderr, gettext("Error boolean input.\n")); rv = KC_ERR_USAGE; } else { flags |= KC_OCSP_IGNORE_RESP_SIGN; ocsp_set_attr++; } break; case 'n': plc.VAL_OCSP_RESP_CERT_NAME = get_string(optarg_av, &rv); if (plc.VAL_OCSP_RESP_CERT_NAME == NULL) { (void) fprintf(stderr, gettext("Error name input.\n")); } else { KMF_X509_NAME respDN; /* for syntax checking */ if (kmf_dn_parser( plc.VAL_OCSP_RESP_CERT_NAME, &respDN) != KMF_OK) { (void) fprintf(stderr, gettext("Error name " "input.\n")); rv = KC_ERR_USAGE; } else { kmf_free_dn(&respDN); flags |= KC_OCSP_RESP_CERT_NAME; ocsp_set_attr++; } } break; case 'A': plc.VAL_OCSP_RESP_CERT_SERIAL = get_string(optarg_av, &rv); if (plc.VAL_OCSP_RESP_CERT_SERIAL == NULL) { (void) fprintf(stderr, gettext("Error serial input.\n")); } else { uchar_t *bytes = NULL; size_t bytelen; ret = kmf_hexstr_to_bytes((uchar_t *) plc.VAL_OCSP_RESP_CERT_SERIAL, &bytes, &bytelen); if (ret != KMF_OK || bytes == NULL) { (void) fprintf(stderr, gettext("serial number " "must be specified as a " "hex number " "(ex: 0x0102030405" "ffeeddee)\n")); rv = KC_ERR_USAGE; break; } if (bytes != NULL) free(bytes); flags |= KC_OCSP_RESP_CERT_SERIAL; ocsp_set_attr++; } break; case 'y': ocsp_none_opt = get_boolean(optarg_av); if (ocsp_none_opt == -1) { (void) fprintf(stderr, gettext("Error boolean input.\n")); rv = KC_ERR_USAGE; } else { flags |= KC_OCSP_NONE; } break; case 'c': plc.VAL_CRL_BASEFILENAME = get_string(optarg_av, &rv); if (plc.VAL_CRL_BASEFILENAME == NULL) { (void) fprintf(stderr, gettext( "Error basefilename input.\n")); } else { flags |= KC_CRL_BASEFILENAME; crl_set_attr++; } break; case 'I': plc.VAL_CRL_DIRECTORY = get_string(optarg_av, &rv); if (plc.VAL_CRL_DIRECTORY == NULL) { (void) fprintf(stderr, gettext("Error boolean input.\n")); } else { flags |= KC_CRL_DIRECTORY; crl_set_attr++; } break; case 'g': plc.VAL_CRL_GET_URI = get_boolean(optarg_av); if (plc.VAL_CRL_GET_URI == -1) { (void) fprintf(stderr, gettext("Error boolean input.\n")); rv = KC_ERR_USAGE; } else { flags |= KC_CRL_GET_URI; crl_set_attr++; } break; case 'X': plc.VAL_CRL_PROXY = get_string(optarg_av, &rv); if (plc.VAL_CRL_PROXY == NULL) { (void) fprintf(stderr, gettext("Error proxy input.\n")); } else { flags |= KC_CRL_PROXY; crl_set_attr++; } break; case 'S': plc.VAL_CRL_IGNORE_SIGN = get_boolean(optarg_av); if (plc.VAL_CRL_IGNORE_SIGN == -1) { (void) fprintf(stderr, gettext("Error boolean input.\n")); rv = KC_ERR_USAGE; } else { flags |= KC_CRL_IGNORE_SIGN; crl_set_attr++; } break; case 'D': plc.VAL_CRL_IGNORE_DATE = get_boolean(optarg_av); if (plc.VAL_CRL_IGNORE_DATE == -1) { (void) fprintf(stderr, gettext("Error boolean input.\n")); rv = KC_ERR_USAGE; } else { flags |= KC_CRL_IGNORE_DATE; crl_set_attr++; } break; case 'z': crl_none_opt = get_boolean(optarg_av); if (crl_none_opt == -1) { (void) fprintf(stderr, gettext("Error boolean input.\n")); rv = KC_ERR_USAGE; } else { flags |= KC_CRL_NONE; } break; case 'u': plc.ku_bits = parseKUlist(optarg_av); if (plc.ku_bits == 0) { (void) fprintf(stderr, gettext( "Error keyusage input.\n")); rv = KC_ERR_USAGE; } else { flags |= KC_KEYUSAGE; } break; case 'Y': ku_none_opt = get_boolean(optarg_av); if (ku_none_opt == -1) { (void) fprintf(stderr, gettext("Error boolean input.\n")); rv = KC_ERR_USAGE; } else { flags |= KC_KEYUSAGE_NONE; } break; case 'E': if (parseEKUNames(optarg_av, &plc) != 0) { (void) fprintf(stderr, gettext("Error EKU input.\n")); rv = KC_ERR_USAGE; } else { flags |= KC_EKUS; } break; case 'O': if (parseEKUOIDs(optarg_av, &plc) != 0) { (void) fprintf(stderr, gettext("Error EKU OID input.\n")); rv = KC_ERR_USAGE; } else { flags |= KC_EKUS; } break; case 'Z': eku_none_opt = get_boolean(optarg_av); if (eku_none_opt == -1) { (void) fprintf(stderr, gettext("Error boolean input.\n")); rv = KC_ERR_USAGE; } else { flags |= KC_EKUS_NONE; } break; case 'm': mapper_name = get_string(optarg_av, &rv); if (mapper_name == NULL) { (void) fprintf(stderr, gettext("Error mapper-name " "input.\n")); } break; case 'M': mapper_dir = get_string(optarg_av, &rv); if (mapper_dir == NULL) { (void) fprintf(stderr, gettext("Error mapper-directory " "input.\n")); } break; case 'Q': mapper_pathname = get_string(optarg_av, &rv); if (mapper_pathname == NULL) { (void) fprintf(stderr, gettext("Error mapper-pathname " "input.\n")); } break; case 'q': plc.mapper.options = get_string(optarg_av, &rv); rv = 0; /* its ok for this to be NULL */ flags |= KC_MAPPER_OPTIONS; break; default: (void) fprintf(stderr, gettext("Error input option.\n")); rv = KC_ERR_USAGE; break; } if (rv != KC_OK) goto out; } /* No additional args allowed. */ argc -= optind_av; if (argc) { (void) fprintf(stderr, gettext("Error input option\n")); rv = KC_ERR_USAGE; goto out; } if (filename == NULL) { filename = strdup(KMF_DEFAULT_POLICY_FILE); if (filename == NULL) { rv = KC_ERR_MEMORY; goto out; } } /* * Must have a policy name. The policy name can not be default * if using the default policy file. */ if (plc.name == NULL) { (void) fprintf(stderr, gettext("You must specify a policy name.\n")); rv = KC_ERR_USAGE; goto out; } else if (strcmp(filename, KMF_DEFAULT_POLICY_FILE) == 0 && strcmp(plc.name, KMF_DEFAULT_POLICY_NAME) == 0) { (void) fprintf(stderr, gettext("Can not modify the default policy in the default " "policy file.\n")); rv = KC_ERR_USAGE; goto out; } /* Check the access permission of the policy DB */ if (access(filename, W_OK) < 0) { int err = errno; (void) fprintf(stderr, gettext("Cannot access \"%s\" for modify - %s\n"), filename, strerror(err)); rv = KC_ERR_ACCESS; goto out; } /* Try to load the named policy from the DB */ ret = kmf_get_policy(filename, plc.name, &oplc); if (ret != KMF_OK) { (void) fprintf(stderr, gettext("Error loading policy \"%s\" from %s\n"), filename, plc.name); return (KC_ERR_FIND_POLICY); } /* Update the general policy attributes. */ if (flags & KC_IGNORE_DATE) oplc.ignore_date = plc.ignore_date; if (flags & KC_IGNORE_UNKNOWN_EKUS) oplc.ignore_unknown_ekus = plc.ignore_unknown_ekus; if (flags & KC_IGNORE_TRUST_ANCHOR) oplc.ignore_trust_anchor = plc.ignore_trust_anchor; if (flags & KC_VALIDITY_ADJUSTTIME) { if (oplc.validity_adjusttime) free(oplc.validity_adjusttime); oplc.validity_adjusttime = plc.validity_adjusttime; } if (flags & KC_TA_NAME) { if (oplc.ta_name) free(oplc.ta_name); oplc.ta_name = plc.ta_name; } if (flags & KC_TA_SERIAL) { if (oplc.ta_serial) free(oplc.ta_serial); oplc.ta_serial = plc.ta_serial; } /* * There are some combinations of attributes that are not valid. * * First, setting mapper-name (with optional mapper-directory) and * mapper-pathname is mutually exclusive. */ if ((mapper_name != NULL && mapper_pathname != NULL) || (mapper_name != NULL && oplc.mapper.pathname != NULL) || (mapper_pathname != NULL && oplc.mapper.mapname != NULL) || /* Mapper directory can be set only if mapper name is set. */ (mapper_dir != NULL && mapper_pathname != NULL) || (mapper_dir != NULL && mapper_name == NULL && oplc.mapper.mapname == NULL) || (mapper_dir != NULL && oplc.mapper.pathname != NULL) || /* Options can be set only if mapper name or pathname is set. */ ((plc.mapper.options != NULL || oplc.mapper.options != NULL) && (mapper_name == NULL && oplc.mapper.mapname == NULL && mapper_pathname == NULL && oplc.mapper.pathname == NULL))) { (void) fprintf(stderr, gettext("Error in mapper input options\n")); if (mapper_name != NULL) free(mapper_name); if (mapper_pathname != NULL) free(mapper_pathname); if (mapper_dir != NULL) free(mapper_dir); if (flags & KC_MAPPER_OPTIONS && plc.mapper.options != NULL) free(plc.mapper.options); rv = KC_ERR_USAGE; goto out; } else { if (mapper_name != NULL) plc.mapper.mapname = mapper_name; if (mapper_pathname != NULL) plc.mapper.pathname = mapper_pathname; if (mapper_dir != NULL) plc.mapper.dir = mapper_dir; } UPDATE_IF_DIFFERENT(oplc.mapper.mapname, plc.mapper.mapname); UPDATE_IF_DIFFERENT(oplc.mapper.pathname, plc.mapper.pathname); UPDATE_IF_DIFFERENT(oplc.mapper.dir, plc.mapper.dir); if (flags & KC_MAPPER_OPTIONS) { if (oplc.mapper.options != NULL) free(oplc.mapper.options); oplc.mapper.options = plc.mapper.options; } /* Update the OCSP policy */ if (ocsp_none_opt == B_TRUE) { if (ocsp_set_attr > 0) { (void) fprintf(stderr, gettext("Can not set ocsp-none=true and other " "OCSP attributes at the same time.\n")); rv = KC_ERR_USAGE; goto out; } /* * If the original policy does not have OCSP checking, * then we do not need to do anything. If the original * policy has the OCSP checking, then we need to release the * space of OCSP attributes and turn the OCSP checking off. */ if (oplc.revocation & KMF_REVOCATION_METHOD_OCSP) { if (oplc.VAL_OCSP_BASIC.responderURI) { free(oplc.VAL_OCSP_BASIC.responderURI); oplc.VAL_OCSP_BASIC.responderURI = NULL; } if (oplc.VAL_OCSP_BASIC.proxy) { free(oplc.VAL_OCSP_BASIC.proxy); oplc.VAL_OCSP_BASIC.proxy = NULL; } if (oplc.VAL_OCSP_BASIC.response_lifetime) { free(oplc.VAL_OCSP_BASIC.response_lifetime); oplc.VAL_OCSP_BASIC.response_lifetime = NULL; } if (flags & KC_OCSP_RESP_CERT_NAME) { free(oplc.VAL_OCSP_RESP_CERT.name); oplc.VAL_OCSP_RESP_CERT.name = NULL; } if (flags & KC_OCSP_RESP_CERT_SERIAL) { free(oplc.VAL_OCSP_RESP_CERT.serial); oplc.VAL_OCSP_RESP_CERT.serial = NULL; } /* Turn off the OCSP checking */ oplc.revocation &= ~KMF_REVOCATION_METHOD_OCSP; } } else { /* * If the "ocsp-none" option is not set or is set to false, * then we only need to do the modification if there is at * least one OCSP attribute is specified. */ if (ocsp_set_attr > 0) { if (flags & KC_OCSP_RESPONDER_URI) { if (oplc.VAL_OCSP_RESPONDER_URI) free(oplc.VAL_OCSP_RESPONDER_URI); oplc.VAL_OCSP_RESPONDER_URI = plc.VAL_OCSP_RESPONDER_URI; } if (flags & KC_OCSP_PROXY) { if (oplc.VAL_OCSP_PROXY) free(oplc.VAL_OCSP_PROXY); oplc.VAL_OCSP_PROXY = plc.VAL_OCSP_PROXY; } if (flags & KC_OCSP_URI_FROM_CERT) oplc.VAL_OCSP_URI_FROM_CERT = plc.VAL_OCSP_URI_FROM_CERT; if (flags & KC_OCSP_RESP_LIFETIME) { if (oplc.VAL_OCSP_RESP_LIFETIME) free(oplc.VAL_OCSP_RESP_LIFETIME); oplc.VAL_OCSP_RESP_LIFETIME = plc.VAL_OCSP_RESP_LIFETIME; } if (flags & KC_OCSP_IGNORE_RESP_SIGN) oplc.VAL_OCSP_IGNORE_RESP_SIGN = plc.VAL_OCSP_IGNORE_RESP_SIGN; if (flags & KC_OCSP_RESP_CERT_NAME) { if (oplc.VAL_OCSP_RESP_CERT_NAME) free(oplc.VAL_OCSP_RESP_CERT_NAME); oplc.VAL_OCSP_RESP_CERT_NAME = plc.VAL_OCSP_RESP_CERT_NAME; } if (flags & KC_OCSP_RESP_CERT_SERIAL) { if (oplc.VAL_OCSP_RESP_CERT_SERIAL) free(oplc.VAL_OCSP_RESP_CERT_SERIAL); oplc.VAL_OCSP_RESP_CERT_SERIAL = plc.VAL_OCSP_RESP_CERT_SERIAL; } if (oplc.VAL_OCSP_RESP_CERT_NAME != NULL && oplc.VAL_OCSP_RESP_CERT_SERIAL != NULL) oplc.VAL_OCSP.has_resp_cert = B_TRUE; else oplc.VAL_OCSP.has_resp_cert = B_FALSE; /* Turn on the OCSP checking */ oplc.revocation |= KMF_REVOCATION_METHOD_OCSP; } } /* Update the CRL policy */ if (crl_none_opt == B_TRUE) { if (crl_set_attr > 0) { (void) fprintf(stderr, gettext("Can not set crl-none=true and other CRL " "attributes at the same time.\n")); rv = KC_ERR_USAGE; goto out; } /* * If the original policy does not have CRL checking, * then we do not need to do anything. If the original * policy has the CRL checking, then we need to release the * space of CRL attributes and turn the CRL checking off. */ if (oplc.revocation & KMF_REVOCATION_METHOD_CRL) { if (oplc.VAL_CRL_BASEFILENAME) { free(oplc.VAL_CRL_BASEFILENAME); oplc.VAL_CRL_BASEFILENAME = NULL; } if (oplc.VAL_CRL_DIRECTORY) { free(oplc.VAL_CRL_DIRECTORY); oplc.VAL_CRL_DIRECTORY = NULL; } if (oplc.VAL_CRL_PROXY) { free(oplc.VAL_CRL_PROXY); oplc.VAL_CRL_PROXY = NULL; } /* Turn off the CRL checking */ oplc.revocation &= ~KMF_REVOCATION_METHOD_CRL; } } else { /* * If the "ocsp-none" option is not set or is set to false, * then we only need to do the modification if there is at * least one CRL attribute is specified. */ if (crl_set_attr > 0) { if (flags & KC_CRL_BASEFILENAME) { if (oplc.VAL_CRL_BASEFILENAME) free(oplc.VAL_CRL_BASEFILENAME); oplc.VAL_CRL_BASEFILENAME = plc.VAL_CRL_BASEFILENAME; } if (flags & KC_CRL_DIRECTORY) { if (oplc.VAL_CRL_DIRECTORY) free(oplc.VAL_CRL_DIRECTORY); oplc.VAL_CRL_DIRECTORY = plc.VAL_CRL_DIRECTORY; } if (flags & KC_CRL_GET_URI) { oplc.VAL_CRL_GET_URI = plc.VAL_CRL_GET_URI; } if (flags & KC_CRL_PROXY) { if (oplc.VAL_CRL_PROXY) free(oplc.VAL_CRL_PROXY); oplc.VAL_CRL_PROXY = plc.VAL_CRL_PROXY; } if (flags & KC_CRL_IGNORE_SIGN) { oplc.VAL_CRL_IGNORE_SIGN = plc.VAL_CRL_IGNORE_SIGN; } if (flags & KC_CRL_IGNORE_DATE) { oplc.VAL_CRL_IGNORE_DATE = plc.VAL_CRL_IGNORE_DATE; } /* Turn on the CRL checking */ oplc.revocation |= KMF_REVOCATION_METHOD_CRL; } } /* Update the Key Usage */ if (ku_none_opt == B_TRUE) { if (flags & KC_KEYUSAGE) { (void) fprintf(stderr, gettext("Can not set keyusage-none=true and " "modify the keyusage value at the same time.\n")); rv = KC_ERR_USAGE; goto out; } oplc.ku_bits = 0; } else { /* * If the "keyusage-none" option is not set or is set to * false, then we only need to do the modification if * the keyusage value is specified. */ if (flags & KC_KEYUSAGE) oplc.ku_bits = plc.ku_bits; } /* Update the Extended Key Usage */ if (eku_none_opt == B_TRUE) { if (flags & KC_EKUS) { (void) fprintf(stderr, gettext("Can not set eku-none=true and modify " "EKU values at the same time.\n")); rv = KC_ERR_USAGE; goto out; } /* Release current EKU list (if any) */ if (oplc.eku_set.eku_count > 0) { kmf_free_eku_policy(&oplc.eku_set); oplc.eku_set.eku_count = 0; oplc.eku_set.ekulist = NULL; } } else { /* * If the "eku-none" option is not set or is set to false, * then we only need to do the modification if either * "ekuname" or "ekuoids" is specified. */ if (flags & KC_EKUS) { /* Release current EKU list (if any) */ kmf_free_eku_policy(&oplc.eku_set); oplc.eku_set = plc.eku_set; } } /* Do a sanity check on the modified policy */ ret = kmf_verify_policy(&oplc); if (ret != KMF_OK) { print_sanity_error(ret); rv = KC_ERR_VERIFY_POLICY; goto out; } /* The modify operation is a delete followed by an add */ ret = kmf_delete_policy_from_db(oplc.name, filename); if (ret != KMF_OK) { rv = KC_ERR_DELETE_POLICY; goto out; } /* * Now add the modified policy back to the DB. */ ret = kmf_add_policy_to_db(&oplc, filename, B_FALSE); if (ret != KMF_OK) { (void) fprintf(stderr, gettext("Error adding policy to database: 0x%04x\n"), ret); rv = KC_ERR_ADD_POLICY; goto out; } out: if (filename != NULL) free(filename); kmf_free_policy_record(&oplc); return (rv); } static int kc_modify_plugin(int argc, char *argv[]) { int rv = KC_OK; int opt; extern int optind_av; extern char *optarg_av; char *keystore_name = NULL; char *option = NULL; boolean_t modify_plugin = B_FALSE; boolean_t has_option_arg = B_FALSE; conf_entry_t *entry = NULL; FILE *pfile = NULL; FILE *pfile_tmp = NULL; char tmpfile_name[MAXPATHLEN]; char buffer[MAXPATHLEN]; char buffer2[MAXPATHLEN]; while ((opt = getopt_av(argc, argv, "p(plugin)k:(keystore)o:(option)")) != EOF) { switch (opt) { case 'p': if (modify_plugin) { (void) fprintf(stderr, gettext("duplicate plugin input.\n")); rv = KC_ERR_USAGE; } else { modify_plugin = B_TRUE; } break; case 'k': if (keystore_name != NULL) rv = KC_ERR_USAGE; else { keystore_name = get_string(optarg_av, &rv); if (keystore_name == NULL) { (void) fprintf(stderr, gettext( "Error keystore input.\n")); rv = KC_ERR_USAGE; } } break; case 'o': if (has_option_arg) { (void) fprintf(stderr, gettext("duplicate option input.\n")); rv = KC_ERR_USAGE; } else { has_option_arg = B_TRUE; option = get_string(optarg_av, NULL); } break; default: (void) fprintf(stderr, gettext("Error input option.\n")); rv = KC_ERR_USAGE; break; } if (rv != KC_OK) goto out; } /* No additional args allowed. */ argc -= optind_av; if (argc) { (void) fprintf(stderr, gettext("Error input option\n")); rv = KC_ERR_USAGE; goto out; } if (keystore_name == NULL || has_option_arg == B_FALSE) { (void) fprintf(stderr, gettext("Error input option\n")); rv = KC_ERR_USAGE; goto out; } if (strcasecmp(keystore_name, "nss") == 0 || strcasecmp(keystore_name, "pkcs11") == 0 || strcasecmp(keystore_name, "file") == 0) { (void) fprintf(stderr, gettext("Can not modify the built-in keystore %s\n"), keystore_name); rv = KC_ERR_USAGE; goto out; } entry = get_keystore_entry(keystore_name); if (entry == NULL) { (void) fprintf(stderr, gettext("%s does not exist.\n"), keystore_name); rv = KC_ERR_USAGE; goto out; } if ((entry->option == NULL && option == NULL) || (entry->option != NULL && option != NULL && strcmp(entry->option, option) == 0)) { (void) fprintf(stderr, gettext("No change - " "the new option is same as the old option.\n")); rv = KC_OK; goto out; } if ((pfile = fopen(_PATH_KMF_CONF, "r+")) == NULL) { err = errno; (void) fprintf(stderr, gettext("failed to update the configuration - %s\n"), strerror(err)); rv = KC_ERR_ACCESS; goto out; } if (lockf(fileno(pfile), F_TLOCK, 0) == -1) { err = errno; (void) fprintf(stderr, gettext("failed to lock the configuration - %s\n"), strerror(err)); rv = KC_ERR_MODIFY_PLUGIN; goto out; } /* * Create a temporary file in the /etc/crypto directory. */ (void) strlcpy(tmpfile_name, CONF_TEMPFILE, sizeof (tmpfile_name)); if (mkstemp(tmpfile_name) == -1) { err = errno; (void) fprintf(stderr, gettext("failed to create a temporary file - %s\n"), strerror(err)); rv = KC_ERR_MODIFY_PLUGIN; goto out; } if ((pfile_tmp = fopen(tmpfile_name, "w")) == NULL) { err = errno; (void) fprintf(stderr, gettext("failed to open %s - %s\n"), tmpfile_name, strerror(err)); rv = KC_ERR_MODIFY_PLUGIN; goto out; } /* * Loop thru the config file and update the entry. */ while (fgets(buffer, MAXPATHLEN, pfile) != NULL) { char *name; int len; if (buffer[0] == '#') { if (fputs(buffer, pfile_tmp) == EOF) { rv = KC_ERR_MODIFY_PLUGIN; goto out; } else { continue; } } /* * make a copy of the original buffer to buffer2. Also get * rid of the trailing '\n' from buffer2. */ (void) strlcpy(buffer2, buffer, MAXPATHLEN); len = strlen(buffer2); if (buffer2[len-1] == '\n') { len--; } buffer2[len] = '\0'; if ((name = strtok(buffer2, SEP_COLON)) == NULL) { rv = KC_ERR_UNINSTALL; goto out; } if (strcmp(name, keystore_name) == 0) { /* found the entry */ if (option == NULL) (void) snprintf(buffer, MAXPATHLEN, "%s:%s%s\n", keystore_name, CONF_MODULEPATH, entry->modulepath); else (void) snprintf(buffer, MAXPATHLEN, "%s:%s%s;%s%s\n", keystore_name, CONF_MODULEPATH, entry->modulepath, CONF_OPTION, option); if (fputs(buffer, pfile_tmp) == EOF) { err = errno; (void) fprintf(stderr, gettext( "failed to write to %s: %s\n"), tmpfile_name, strerror(err)); rv = KC_ERR_MODIFY_PLUGIN; goto out; } } else { if (fputs(buffer, pfile_tmp) == EOF) { rv = KC_ERR_UNINSTALL; goto out; } } } if (rename(tmpfile_name, _PATH_KMF_CONF) == -1) { err = errno; (void) fprintf(stderr, gettext( "failed to update the configuration - %s"), strerror(err)); rv = KC_ERR_MODIFY_PLUGIN; goto out; } if (chmod(_PATH_KMF_CONF, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH) == -1) { err = errno; (void) fprintf(stderr, gettext( "failed to update the configuration - %s\n"), strerror(err)); rv = KC_ERR_MODIFY_PLUGIN; goto out; } out: if (entry != NULL) free_entry(entry); if (pfile != NULL) (void) fclose(pfile); if (rv != KC_OK && pfile_tmp != NULL) (void) unlink(tmpfile_name); if (pfile_tmp != NULL) (void) fclose(pfile_tmp); return (rv); } int kc_modify(int argc, char *argv[]) { if (argc > 2 && strcmp(argv[0], "modify") == 0 && strcmp(argv[1], "plugin") == 0) { return (kc_modify_plugin(argc, argv)); } else { return (kc_modify_policy(argc, argv)); } } /* * CDDL HEADER START * * The contents of this file are subject to the terms of the * Common Development and Distribution License (the "License"). * You may not use this file except in compliance with the License. * * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE * or http://www.opensolaris.org/os/licensing. * See the License for the specific language governing permissions * and limitations under the License. * * When distributing Covered Code, include this CDDL HEADER in each * file and include the License file at usr/src/OPENSOLARIS.LICENSE. * If applicable, add the following below this CDDL HEADER, with the * fields enclosed by brackets "[]" replaced with your own identifying * information: Portions Copyright [yyyy] [name of copyright owner] * * CDDL HEADER END * * Copyright 2007 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include #include #include #include #include #include #include #include #include #include #include "util.h" static int err; /* To store errno which may be overwritten by gettext() */ int kc_uninstall(int argc, char *argv[]) { int rv = KC_OK; int opt; extern int optind_av; extern char *optarg_av; char *keystore_name = NULL; conf_entry_t *entry = NULL; FILE *pfile = NULL; FILE *pfile_tmp = NULL; char tmpfile_name[MAXPATHLEN]; char buffer[MAXPATHLEN]; char buffer2[MAXPATHLEN]; boolean_t found; boolean_t in_package; while ((opt = getopt_av(argc, argv, "k:(keystore)")) != EOF) { switch (opt) { case 'k': if (keystore_name != NULL) rv = KC_ERR_USAGE; else { keystore_name = get_string(optarg_av, &rv); if (keystore_name == NULL) { (void) fprintf(stderr, gettext( "Error keystore input.\n")); } } break; default: (void) fprintf(stderr, gettext("Error input option.\n")); rv = KC_ERR_USAGE; break; } if (rv != KC_OK) goto out; } /* No additional args allowed. */ argc -= optind_av; if (argc) { (void) fprintf(stderr, gettext("Error input option\n")); rv = KC_ERR_USAGE; goto out; } if (keystore_name == NULL) { (void) fprintf(stderr, gettext("Error input option\n")); rv = KC_ERR_USAGE; goto out; } if (strcasecmp(keystore_name, "nss") == 0 || strcasecmp(keystore_name, "pkcs11") == 0 || strcasecmp(keystore_name, "file") == 0) { (void) fprintf(stderr, gettext("Can not uninstall the built-in keystore %s\n"), keystore_name); rv = KC_ERR_UNINSTALL; goto out; } entry = get_keystore_entry(keystore_name); if (entry == NULL) { (void) fprintf(stderr, gettext("%s does not exist.\n"), keystore_name); rv = KC_ERR_USAGE; goto out; } if ((pfile = fopen(_PATH_KMF_CONF, "r+")) == NULL) { err = errno; (void) fprintf(stderr, gettext("failed to update the configuration - %s\n"), strerror(err)); rv = KC_ERR_ACCESS; goto out; } if (lockf(fileno(pfile), F_TLOCK, 0) == -1) { err = errno; (void) fprintf(stderr, gettext("failed to lock the configuration - %s\n"), strerror(err)); rv = KC_ERR_UNINSTALL; goto out; } /* * Create a temporary file in the /etc/crypto directory. */ (void) strlcpy(tmpfile_name, CONF_TEMPFILE, sizeof (tmpfile_name)); if (mkstemp(tmpfile_name) == -1) { err = errno; (void) fprintf(stderr, gettext("failed to create a temporary file - %s\n"), strerror(err)); rv = KC_ERR_UNINSTALL; goto out; } if ((pfile_tmp = fopen(tmpfile_name, "w")) == NULL) { err = errno; (void) fprintf(stderr, gettext("failed to open a temporary file - %s\n"), strerror(err)); rv = KC_ERR_UNINSTALL; goto out; } /* * Loop thru the config file. If the plugin to be uninstalled is in * a package, then just comment it off. */ in_package = B_FALSE; while (fgets(buffer, MAXPATHLEN, pfile) != NULL) { found = B_FALSE; if (buffer[0] != ' ' && buffer[0] != '\n' && buffer[0] != '\t') { if (strstr(buffer, " Start ") != NULL) { in_package = B_TRUE; } else if (strstr(buffer, " End ") != NULL) { in_package = B_FALSE; } else if (buffer[0] != '#') { char *name; int len; /* * make a copy of the original buffer to * buffer2. Also get rid of the trailing * '\n' from buffer2. */ (void) strlcpy(buffer2, buffer, MAXPATHLEN); /* get rid of trailing '\n' */ len = strlen(buffer2); if (buffer2[len-1] == '\n') { len--; } buffer2[len] = '\0'; if ((name = strtok(buffer2, SEP_COLON)) == NULL) { rv = KC_ERR_UNINSTALL; goto out; } if (strcmp(keystore_name, name) == 0) found = B_TRUE; } } if (found) { /* * If found and not in_package, then don't write * this line to the result file. */ if (in_package) { (void) snprintf(buffer2, sizeof (buffer2), "%s%s", "#", buffer); if (fputs(buffer2, pfile_tmp) == EOF) { rv = KC_ERR_UNINSTALL; goto out; } } } else { if (fputs(buffer, pfile_tmp) == EOF) { rv = KC_ERR_UNINSTALL; goto out; } } } out: if (pfile != NULL) (void) fclose(pfile); if (rv != KC_OK && pfile_tmp != NULL) (void) unlink(tmpfile_name); if (pfile_tmp != NULL) (void) fclose(pfile_tmp); if (rv == KC_OK) { if (rename(tmpfile_name, _PATH_KMF_CONF) == -1) { err = errno; (void) fprintf(stderr, gettext( "failed to update the configuration - %s"), strerror(err)); return (KC_ERR_UNINSTALL); } if (chmod(_PATH_KMF_CONF, S_IRUSR | S_IWUSR | S_IRGRP | S_IROTH) == -1) { err = errno; (void) fprintf(stderr, gettext( "failed to update the configuration - %s\n"), strerror(err)); return (KC_ERR_UNINSTALL); } } return (rv); } /* * CDDL HEADER START * * The contents of this file are subject to the terms of the * Common Development and Distribution License (the "License"). * You may not use this file except in compliance with the License. * * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE * or http://www.opensolaris.org/os/licensing. * See the License for the specific language governing permissions * and limitations under the License. * * When distributing Covered Code, include this CDDL HEADER in each * file and include the License file at usr/src/OPENSOLARIS.LICENSE. * If applicable, add the following below this CDDL HEADER, with the * fields enclosed by brackets "[]" replaced with your own identifying * information: Portions Copyright [yyyy] [name of copyright owner] * * CDDL HEADER END * * Copyright 2007 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #include #include #include #include #include #include #include #include #include "util.h" /* Supporting structures and global variables for getopt_av(). */ typedef struct av_opts_s { int shortnm; /* short name character */ char *longnm; /* long name string, NOT terminated */ int longnm_len; /* length of long name string */ boolean_t has_arg; /* takes optional argument */ } av_opts; static av_opts *opts_av = NULL; static const char *_save_optstr = NULL; static int _save_numopts = 0; int optind_av = 1; char *optarg_av = NULL; void free_policy_list(POLICY_LIST *plist) { POLICY_LIST *n = plist, *old; if (plist == NULL) return; while (n != NULL) { old = n; kmf_free_policy_record(&n->plc); n = n->next; free(old); } plist = NULL; } int load_policies(char *file, POLICY_LIST **policy_list) { int rv = KC_OK; KMF_RETURN kmfrv = KMF_OK; POLICY_LIST *newitem, *plist = NULL; xmlParserCtxtPtr ctxt; xmlDocPtr doc = NULL; xmlNodePtr cur, node; /* Create a parser context */ ctxt = xmlNewParserCtxt(); if (ctxt == NULL) return (KMF_ERR_POLICY_DB_FORMAT); /* Read the policy DB and verify it against the schema. */ doc = xmlCtxtReadFile(ctxt, file, NULL, XML_PARSE_DTDVALID | XML_PARSE_NOERROR | XML_PARSE_NOWARNING); if (doc == NULL || ctxt->valid == 0) { kmfrv = KMF_ERR_POLICY_DB_FORMAT; goto end; } cur = xmlDocGetRootElement(doc); if (cur == NULL) { kmfrv = KMF_ERR_POLICY_DB_FORMAT; goto end; } node = cur->xmlChildrenNode; while (node != NULL) { char *c; /* * Search for the policy that matches the given name. */ if (!xmlStrcmp((const xmlChar *)node->name, (const xmlChar *)KMF_POLICY_ELEMENT)) { /* Check the name attribute */ c = (char *)xmlGetProp(node, (const xmlChar *)KMF_POLICY_NAME_ATTR); /* If a match, parse the rest of the data */ if (c != NULL) { xmlFree(c); newitem = malloc(sizeof (POLICY_LIST)); if (newitem != NULL) { (void) memset(newitem, 0, sizeof (POLICY_LIST)); kmfrv = parsePolicyElement(node, &newitem->plc); } else { kmfrv = KMF_ERR_MEMORY; goto end; } /* add to linked list */ if (plist == NULL) { plist = newitem; } else { POLICY_LIST *n = plist; while (n->next != NULL) n = n->next; n->next = newitem; newitem->next = NULL; } } } node = node->next; } end: if (ctxt != NULL) xmlFreeParserCtxt(ctxt); if (doc != NULL) xmlFreeDoc(doc); if (kmfrv != KMF_OK) { free_policy_list(plist); rv = KC_ERR_LOADDB; } else { *policy_list = plist; } return (rv); } /* * Return 0 if there is any error in the input string. */ uint16_t parseKUlist(char *kustring) { uint16_t cur_bit; uint16_t kubits = 0; char *p; p = strtok(kustring, ","); while (p != NULL) { cur_bit = kmf_string_to_ku(p); if (cur_bit == 0) { kubits = 0; break; } kubits |= cur_bit; p = strtok(NULL, ","); } return (kubits); } static void addToEKUList(KMF_EKU_POLICY *ekus, KMF_OID *newoid) { if (newoid != NULL && ekus != NULL) { ekus->eku_count++; ekus->ekulist = realloc( ekus->ekulist, ekus->eku_count * sizeof (KMF_OID)); if (ekus->ekulist != NULL) { ekus->ekulist[ekus->eku_count-1] = *newoid; } } } int parseEKUNames(char *ekulist, KMF_POLICY_RECORD *plc) { int rv = KC_OK; char *p; KMF_OID *newoid; KMF_EKU_POLICY *ekus = &plc->eku_set; if (ekulist == NULL || !strlen(ekulist)) return (0); /* * The list should be comma separated list of EKU Names. */ p = strtok(ekulist, ","); /* If no tokens found, then maybe its just a single EKU value */ if (p == NULL) { newoid = kmf_ekuname_to_oid(ekulist); if (newoid != NULL) { addToEKUList(ekus, newoid); free(newoid); } else { rv = KC_ERR_USAGE; } } while (p != NULL) { newoid = kmf_ekuname_to_oid(p); if (newoid != NULL) { addToEKUList(ekus, newoid); free(newoid); } else { rv = KC_ERR_USAGE; break; } p = strtok(NULL, ","); } if (rv != KC_OK) kmf_free_eku_policy(ekus); return (rv); } int parseEKUOIDs(char *ekulist, KMF_POLICY_RECORD *plc) { int rv = KC_OK; char *p; KMF_OID newoid = { 0, NULL }; KMF_EKU_POLICY *ekus = &plc->eku_set; if (ekulist == NULL || !strlen(ekulist)) return (0); /* * The list should be comma separated list of EKU Names. */ p = strtok(ekulist, ","); if (p == NULL) { if (kmf_string_to_oid(ekulist, &newoid) == KMF_OK) { addToEKUList(ekus, &newoid); } else { rv = KC_ERR_USAGE; } } while (p != NULL && rv == 0) { if (kmf_string_to_oid(p, &newoid) == KMF_OK) { addToEKUList(ekus, &newoid); } else { rv = KC_ERR_USAGE; break; } p = strtok(NULL, ","); } if (rv != KC_OK) kmf_free_eku_policy(ekus); return (rv); } int get_boolean(char *arg) { if (arg == NULL) return (-1); if (strcasecmp(arg, "true") == 0) return (1); if (strcasecmp(arg, "false") == 0) return (0); return (-1); } /* * This function processes the input string. It removes the beginning * and ending blank's first, makes a copy of the resulting string and * return it. * * This function returns NULL, if there is an error in the * input string or when the system is out of memory. The output * "err_flag" argument will record the error code, if it is not NULL. */ char * get_string(char *str, int *err_flag) { char *p; int len, i; char *retstr = NULL; if (str == NULL) { if (err_flag != NULL) *err_flag = KC_ERR_USAGE; return (NULL); } /* Remove beginning whitespace */ p = str; while (p != NULL && isspace(*p)) p++; if (p == NULL) { if (err_flag != NULL) *err_flag = KC_ERR_USAGE; return (NULL); } /* Remove the trailing blanks */ len = strlen(p); while (len > 0 && isspace(p[len-1])) len--; if (len == 0) { if (err_flag != NULL) *err_flag = KC_ERR_USAGE; return (NULL); } /* Check if there is any non-printable character */ i = 0; while (i < len) { if (isprint(p[i])) i++; else { if (err_flag != NULL) *err_flag = KC_ERR_USAGE; return (NULL); } } /* Make a copy of the string and return it */ retstr = malloc(len + 1); if (retstr == NULL) { if (err_flag != NULL) *err_flag = KC_ERR_MEMORY; return (NULL); } if (err_flag != NULL) *err_flag = KC_OK; (void) strncpy(retstr, p, len); retstr[len] = '\0'; return (retstr); } /* * Breaks out the getopt-style option string into a structure that can be * traversed later for calls to getopt_av(). Option string is NOT altered, * but the struct fields point to locations within option string. */ static int populate_opts(char *optstring) { int i; av_opts *temp; char *marker; if (optstring == NULL || *optstring == '\0') return (0); /* * This tries to imitate getopt(3c) Each option must conform to: * [ ':' ] [ '(' ')' ] * If long name is missing, the short name is used for long name. */ for (i = 0; *optstring != '\0'; i++) { if ((temp = (av_opts *)((i == 0) ? malloc(sizeof (av_opts)) : realloc(opts_av, (i+1) * sizeof (av_opts)))) == NULL) { free(opts_av); opts_av = NULL; return (0); } else opts_av = (av_opts *)temp; marker = optstring; /* may need optstring later */ opts_av[i].shortnm = *marker++; /* set short name */ if (*marker == ':') { /* check for opt arg */ marker++; opts_av[i].has_arg = B_TRUE; } if (*marker == '(') { /* check and set long name */ marker++; opts_av[i].longnm = marker; opts_av[i].longnm_len = strcspn(marker, ")"); optstring = marker + opts_av[i].longnm_len + 1; } else { /* use short name option character */ opts_av[i].longnm = optstring; opts_av[i].longnm_len = 1; optstring = marker; } } return (i); } /* * getopt_av() is very similar to getopt(3c) in that the takes an option * string, compares command line arguments for matches, and returns a single * letter option when a match is found. However, getopt_av() differs from * getopt(3c) by allowing both longname options and values be found * on the command line. */ int getopt_av(int argc, char * const *argv, const char *optstring) { int i; int len; if (optind_av >= argc) return (EOF); /* First time or when optstring changes from previous one */ if (_save_optstr != optstring) { if (opts_av != NULL) free(opts_av); opts_av = NULL; _save_optstr = optstring; _save_numopts = populate_opts((char *)optstring); } for (i = 0; i < _save_numopts; i++) { if (strcmp(argv[optind_av], "--") == 0) { optind_av++; break; } len = strcspn(argv[optind_av], "="); if (len == opts_av[i].longnm_len && strncmp(argv[optind_av], opts_av[i].longnm, opts_av[i].longnm_len) == 0) { /* matched */ if (!opts_av[i].has_arg) { optind_av++; return (opts_av[i].shortnm); } /* needs optarg */ if (argv[optind_av][len] == '=') { optarg_av = &(argv[optind_av][len+1]); optind_av++; return (opts_av[i].shortnm); } optarg_av = NULL; optind_av++; return ((int)'?'); } } return (EOF); } void print_sanity_error(KMF_RETURN ret) { switch (ret) { case KMF_ERR_POLICY_NAME: (void) fprintf(stderr, gettext("Error in the policy name\n")); break; case KMF_ERR_TA_POLICY: (void) fprintf(stderr, gettext("Error in trust anchor attributes\n")); break; case KMF_ERR_OCSP_POLICY: (void) fprintf(stderr, gettext("Error in OCSP policy attributes\n")); break; default: break; } } conf_entry_t * get_keystore_entry(char *kstore_name) { conf_entrylist_t *phead = NULL; conf_entrylist_t *ptr; conf_entry_t *rtn_entry = NULL; if (kstore_name == NULL) return (NULL); if (get_entrylist(&phead) != KMF_OK) return (NULL); ptr = phead; while (ptr != NULL) { if (strcmp(ptr->entry->keystore, kstore_name) == 0) break; ptr = ptr->next; } if (ptr != NULL) /* found the entry */ rtn_entry = dup_entry(ptr->entry); free_entrylist(phead); return (rtn_entry); } /* * CDDL HEADER START * * The contents of this file are subject to the terms of the * Common Development and Distribution License (the "License"). * You may not use this file except in compliance with the License. * * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE * or http://www.opensolaris.org/os/licensing. * See the License for the specific language governing permissions * and limitations under the License. * * When distributing Covered Code, include this CDDL HEADER in each * file and include the License file at usr/src/OPENSOLARIS.LICENSE. * If applicable, add the following below this CDDL HEADER, with the * fields enclosed by brackets "[]" replaced with your own identifying * information: Portions Copyright [yyyy] [name of copyright owner] * * CDDL HEADER END * * Copyright 2007 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ #ifndef _UTIL_H #define _UTIL_H #ifdef __cplusplus extern "C" { #endif #include typedef struct _policy_list { KMF_POLICY_RECORD plc; struct _policy_list *next; } POLICY_LIST; void free_policy_list(POLICY_LIST *); int getopt_av(int, char * const *, const char *); int load_policies(char *, POLICY_LIST **); int get_boolean(char *); char *get_string(char *, int *err_flag); int parseEKUOIDs(char *, KMF_POLICY_RECORD *); int parseEKUNames(char *, KMF_POLICY_RECORD *); uint16_t parseKUlist(char *); void print_sanity_error(KMF_RETURN); conf_entry_t *get_keystore_entry(char *); #define KC_OK 0 #define KC_ERR_USAGE 1 #define KC_ERR_LOADDB 2 #define KC_ERR_FIND_POLICY 3 #define KC_ERR_DELETE_POLICY 4 #define KC_ERR_ADD_POLICY 5 #define KC_ERR_VERIFY_POLICY 6 #define KC_ERR_INCOMPLETE_POLICY 7 #define KC_ERR_MEMORY 8 #define KC_ERR_ACCESS 9 #define KC_ERR_INSTALL 10 #define KC_ERR_UNINSTALL 11 #define KC_ERR_MODIFY_PLUGIN 12 #define CONF_TEMPFILE "/etc/crypto/kmfXXXXXX" #ifdef __cplusplus } #endif #endif /* _UTIL_H */