OpenSolaris_b135/lib/libwanbootutil/common/key_util.c
/*
* CDDL HEADER START
*
* The contents of this file are subject to the terms of the
* Common Development and Distribution License, Version 1.0 only
* (the "License"). You may not use this file except in compliance
* with the License.
*
* You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
* or http://www.opensolaris.org/os/licensing.
* See the License for the specific language governing permissions
* and limitations under the License.
*
* When distributing Covered Code, include this CDDL HEADER in each
* file and include the License file at usr/src/OPENSOLARIS.LICENSE.
* If applicable, add the following below this CDDL HEADER, with the
* fields enclosed by brackets "[]" replaced with your own identifying
* information: Portions Copyright [yyyy] [name of copyright owner]
*
* CDDL HEADER END
*/
/*
* Copyright 2003 Sun Microsystems, Inc. All rights reserved.
* Use is subject to license terms.
*/
#pragma ident "%Z%%M% %I% %E% SMI"
#include <strings.h>
#include <stdarg.h>
#include <errno.h>
#include <libintl.h>
#include <sys/wanboot_impl.h>
#include "key_xdr.h"
#include "key_util.h"
/*
* Size of 'empty' pkcs12 key file (with no key in it) plus 1
* This is the minimum length for our RSA keys, because we
* only use RSA keys that are stored in PKCS12 format.
*/
#define PKCS12_MIN_LEN 76
/*
* Program name to be used by wbku_printerr()
*/
static const char *wbku_pname = NULL;
/*
* Note: must be kept in sync with codes in <key_util.h>
*/
static char *wbku_retmsgs[WBKU_NRET] = {
/* 0 WBKU_SUCCESS */ "Success",
/* 1 WBKU_INTERNAL_ERR */ "Internal error",
/* 2 WBKU_WRITE_ERR */ "Keystore write error",
/* 3 WBKU_NOKEY */ "Key does not exist in keystore",
/* 4 WBKU_BAD_KEYTYPE */ "Invalid keytype specified"
};
/*
* Initialize library for calls to wbku_printerr().
*/
void
wbku_errinit(const char *arg0)
{
wbku_pname = strrchr(arg0, '/');
if (wbku_pname == NULL)
wbku_pname = arg0;
else
wbku_pname++;
}
/*
* Print an error message to standard error and optionally
* append a system error.
*/
/*PRINTFLIKE1*/
void
wbku_printerr(const char *format, ...)
{
int err = errno;
va_list ap;
if (wbku_pname != NULL)
(void) fprintf(stderr, "%s: ", wbku_pname);
/*
* Note that gettext() is used in order to obtain the
* message from the consumer's domain.
*/
va_start(ap, format);
(void) vfprintf(stderr, gettext(format), ap);
va_end(ap);
if (strchr(format, '\n') == NULL)
(void) fprintf(stderr, ": %s\n", strerror(err));
}
/*
* Return the appropriate message for a given WBKU return code.
*/
const char *
wbku_retmsg(wbku_retcode_t retcode)
{
if ((retcode < WBKU_SUCCESS) || (retcode >= WBKU_NRET))
return (dgettext(TEXT_DOMAIN, "<unknown code>"));
return (dgettext(TEXT_DOMAIN, wbku_retmsgs[retcode]));
}
/*
* This routine is a simple helper routine that initializes a
* wbku_key_attr_t object.
*/
static void
wbku_keyattr_init(wbku_key_attr_t *attr, wbku_key_type_t type, uint_t atype,
uint_t len, uint_t minlen, uint_t maxlen,
char *str, char *oid, boolean_t (*keycheck)(const uint8_t *))
{
attr->ka_type = type;
attr->ka_atype = atype;
attr->ka_len = len;
attr->ka_minlen = minlen;
attr->ka_maxlen = maxlen;
attr->ka_str = str;
attr->ka_oid = oid;
attr->ka_keycheck = keycheck;
}
/*
* This routine is used to build a key attribute structure of the type
* defined by 'str' and 'flag'. This structure, 'attr', is the common
* structure used by the utilities that defines the attributes of a
* specific key type.
*
* Returns:
* WBKU_SUCCESS or WBKU_BAD_KEYTYPE.
*/
wbku_retcode_t
wbku_str_to_keyattr(const char *str, wbku_key_attr_t *attr, uint_t flag)
{
if (str == NULL)
return (WBKU_BAD_KEYTYPE);
if (flag & WBKU_ENCR_KEY) {
if (strcmp(str, WBKU_KW_3DES) == 0) {
wbku_keyattr_init(attr, WBKU_KEY_3DES,
WBKU_ENCR_KEY, DES3_KEY_SIZE, DES3_KEY_SIZE,
DES3_KEY_SIZE, "3DES", WBKU_DES3_OID,
des3_keycheck);
return (WBKU_SUCCESS);
}
if (strcmp(str, WBKU_KW_AES_128) == 0) {
wbku_keyattr_init(attr, WBKU_KEY_AES_128,
WBKU_ENCR_KEY, AES_128_KEY_SIZE, AES_128_KEY_SIZE,
AES_128_KEY_SIZE, "AES", WBKU_AES_128_OID, NULL);
return (WBKU_SUCCESS);
}
if (strcmp(str, WBKU_KW_RSA) == 0) {
wbku_keyattr_init(attr, WBKU_KEY_RSA,
WBKU_ENCR_KEY, 0, PKCS12_MIN_LEN,
WBKU_MAX_KEYLEN, "RSA", WBKU_RSA_OID, NULL);
return (WBKU_SUCCESS);
}
}
if (flag & WBKU_HASH_KEY) {
if (strcmp(str, WBKU_KW_HMAC_SHA1) == 0) {
wbku_keyattr_init(attr, WBKU_KEY_HMAC_SHA1,
WBKU_HASH_KEY, WANBOOT_HMAC_KEY_SIZE,
WANBOOT_HMAC_KEY_SIZE, WANBOOT_HMAC_KEY_SIZE,
"HMAC/SHA1", WBKU_HMAC_SHA1_OID, NULL);
return (WBKU_SUCCESS);
}
}
return (WBKU_BAD_KEYTYPE);
}
/*
* This routine is used to search a key file (whose handle, fp, has been
* initialized by the caller) for the key of type 'ka'. The search is further
* constrained by the 'master' argument which is used to signify that the
* key being searched for is the master key.
*
* This routine may be used for a number of purposes:
* - Check for the existence of key of type foo.
* - Get the value for the key of type foo.
* - Return the file position of the key of type foo.
*
* To faciliate the uses above, both 'ppos' and 'ekey' will only be
* returned if they are not NULL pointers.
*
* Returns:
* WBKU_SUCCESS, WBKU_INTERNAL_ERR or WBKU_NOKEY.
*/
wbku_retcode_t
wbku_find_key(FILE *fp, fpos_t *ppos, wbku_key_attr_t *ka, uint8_t *ekey,
boolean_t master)
{
fpos_t pos;
XDR xdrs;
wbku_key keyobj;
int keyno;
int ret;
/*
* Always, start at the beginning.
*/
rewind(fp);
/*
* Initialize the XDR stream.
*/
xdrs.x_ops = NULL;
xdrstdio_create(&xdrs, fp, XDR_DECODE);
if (xdrs.x_ops == NULL) {
return (WBKU_INTERNAL_ERR);
}
/*
* The XDR routines may examine the content of the keyobj
* structure to determine whether or not to provide memory
* resources. Since XDR does not provide an init routine
* for XDR generated objects, it seems that the safest thing
* to do is to bzero() the object as a means of initialization.
*/
bzero(&keyobj, sizeof (keyobj));
/*
* Read a key and check to see if matches the criteria.
*/
for (keyno = 0; !feof(fp); keyno++) {
/*
* Returning the file position is conditional.
*/
if (ppos != NULL) {
if (fgetpos(fp, &pos) != 0) {
ret = WBKU_INTERNAL_ERR;
break;
}
}
/*
* Read the key. Unfortuantely, XDR does not provide
* the ability to tell an EOF from some other IO error.
* Therefore, a faliure to read is assumed to be EOF.
*/
if (!xdr_wbku_key(&xdrs, &keyobj)) {
ret = WBKU_NOKEY;
break;
}
/*
* Check this key against the criteria.
*/
if ((strcmp(keyobj.wk_oid, ka->ka_oid) == 0) &&
(keyobj.wk_master == master)) {
ka->ka_len = keyobj.wk_key_len;
/*
* Conditionally return the key value and file
* position.
*/
if (ekey != NULL) {
(void) memcpy(ekey, keyobj.wk_key_val,
ka->ka_len);
}
if (ppos != NULL) {
*ppos = pos;
}
xdr_free(xdr_wbku_key, (char *)&keyobj);
ret = WBKU_SUCCESS;
break;
}
xdr_free(xdr_wbku_key, (char *)&keyobj);
}
xdr_destroy(&xdrs);
return (ret);
}
/*
* This routine writes a key object to the key file at the location
* specified by the caller.
*
* Returns:
* WBKU_SUCCESS, WBKU_INTERNAL_ERR or WBKU_WRITE_ERR.
*/
wbku_retcode_t
wbku_write_key(FILE *fp, const fpos_t *ppos, const wbku_key_attr_t *ka,
uint8_t *rand_key, boolean_t master)
{
XDR xdrs;
wbku_key keyobj;
/*
* Set the file position as specified by the caller.
*/
if (fsetpos(fp, ppos) != 0) {
return (WBKU_INTERNAL_ERR);
}
/*
* Initialize the XDR stream.
*/
xdrs.x_ops = NULL;
xdrstdio_create(&xdrs, fp, XDR_ENCODE);
if (xdrs.x_ops == NULL) {
return (WBKU_INTERNAL_ERR);
}
/*
* Build the key object.
*/
keyobj.wk_master = master;
keyobj.wk_oid = ka->ka_oid;
keyobj.wk_key_len = ka->ka_len;
keyobj.wk_key_val = (char *)rand_key;
/*
* Write it.
*/
if (!xdr_wbku_key(&xdrs, &keyobj)) {
xdr_free(xdr_wbku_key, (char *)&keyobj);
xdr_destroy(&xdrs);
return (WBKU_WRITE_ERR);
}
/*
* Free the stream and return success.
*/
xdr_destroy(&xdrs);
return (WBKU_SUCCESS);
}
/*
* This routine reads the contents of one keystore file and copies it to
* another, omitting the key of the type defined by 'ka'.
*
* Returns:
* WBKU_SUCCESS, WBKU_INTERNAL_ERR or WBKU_WRITE_ERR.
*/
wbku_retcode_t
wbku_delete_key(FILE *from_fp, FILE *to_fp, const wbku_key_attr_t *ka)
{
XDR from_xdrs;
XDR to_xdrs;
wbku_key keyobj;
int keyno;
int ret;
/*
* Always, start at the beginning.
*/
rewind(from_fp);
rewind(to_fp);
/*
* Initialize the XDR streams.
*/
from_xdrs.x_ops = NULL;
xdrstdio_create(&from_xdrs, from_fp, XDR_DECODE);
if (from_xdrs.x_ops == NULL) {
return (WBKU_INTERNAL_ERR);
}
to_xdrs.x_ops = NULL;
xdrstdio_create(&to_xdrs, to_fp, XDR_ENCODE);
if (to_xdrs.x_ops == NULL) {
xdr_destroy(&from_xdrs);
return (WBKU_INTERNAL_ERR);
}
/*
* The XDR routines may examine the content of the keyobj
* structure to determine whether or not to provide memory
* resources. Since XDR does not provide an init routine
* for XDR generated objects, it seems that the safest thing
* to do is to bzero() the object as a means of initialization.
*/
bzero(&keyobj, sizeof (keyobj));
/*
* Read a key and check to see if matches the criteria.
*/
ret = WBKU_SUCCESS;
for (keyno = 0; !feof(from_fp); keyno++) {
/*
* Read the key. Unfortuantely, XDR does not provide
* the ability to tell an EOF from some other IO error.
* Therefore, a faliure to read is assumed to be EOF.
*/
if (!xdr_wbku_key(&from_xdrs, &keyobj)) {
break;
}
/*
* If this isn't the key to skip, then write it.
*/
if (strcmp(keyobj.wk_oid, ka->ka_oid) != 0) {
/*
* Write this to the copy.
*/
if (!xdr_wbku_key(&to_xdrs, &keyobj)) {
xdr_free(xdr_wbku_key, (char *)&keyobj);
ret = WBKU_WRITE_ERR;
break;
}
}
xdr_free(xdr_wbku_key, (char *)&keyobj);
}
xdr_destroy(&from_xdrs);
xdr_destroy(&to_xdrs);
return (ret);
}