/*

 * CDDL HEADER START

 *

 * The contents of this file are subject to the terms of the

 * Common Development and Distribution License (the "License").

 * You may not use this file except in compliance with the License.

 *

 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 * or http://www.opensolaris.org/os/licensing.

 * See the License for the specific language governing permissions

 * and limitations under the License.

 *

 * When distributing Covered Code, include this CDDL HEADER in each

 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 * If applicable, add the following below this CDDL HEADER, with the

 * fields enclosed by brackets "[]" replaced with your own identifying

 * information: Portions Copyright [yyyy] [name of copyright owner]

 *

 * CDDL HEADER END

 */

/*

 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.

 * Use is subject to license terms.

 *

 */

#include <stdio.h>

#include <dlfcn.h>

#include <link.h>

#include <fcntl.h>

#include <ctype.h>

#include <sys/param.h>

#include <sys/types.h>

#include <sys/stat.h>

#include <errno.h>

#include <sys/socket.h>

#include <netinet/in.h>

#include <arpa/inet.h>

#include <thread.h>

#include <ber_der.h>

#include <kmfapiP.h>

#include <pem_encode.h>

#include <rdn_parser.h>

#include <libxml2/libxml/uri.h>

#include <libgen.h>

#include <cryptoutil.h>

static uchar_t pkcs11_initialized = 0;

mutex_t init_lock = DEFAULTMUTEX;

extern int errno;

typedef struct {

	KMF_RETURN code;

	char	*message;

} kmf_error_map;

static kmf_error_map kmf_errcodes[] = {

	{KMF_OK,	"KMF_OK"},

	{KMF_ERR_BAD_PARAMETER,	"KMF_ERR_BAD_PARAMETER"},

	{KMF_ERR_BAD_KEY_FORMAT,	"KMF_ERR_BAD_KEY_FORMAT"},

	{KMF_ERR_BAD_ALGORITHM,	"KMF_ERR_BAD_ALGORITHM"},

	{KMF_ERR_MEMORY,	"KMF_ERR_MEMORY"},

	{KMF_ERR_ENCODING,	"KMF_ERR_ENCODING"},

	{KMF_ERR_PLUGIN_INIT,	"KMF_ERR_PLUGIN_INIT"},

	{KMF_ERR_PLUGIN_NOTFOUND,	"KMF_ERR_PLUGIN_NOTFOUND"},

	{KMF_ERR_INTERNAL,	"KMF_ERR_INTERNAL"},

	{KMF_ERR_BAD_CERT_FORMAT,	"KMF_ERR_BAD_CERT_FORMAT"},

	{KMF_ERR_KEYGEN_FAILED,	"KMF_ERR_KEYGEN_FAILED"},

	{KMF_ERR_UNINITIALIZED,	"KMF_ERR_UNINITIALIZED"},

	{KMF_ERR_ISSUER,	"KMF_ERR_ISSUER"},

	{KMF_ERR_NOT_REVOKED,	"KMF_ERR_NOT_REVOKED"},

	{KMF_ERR_CERT_NOT_FOUND,	"KMF_ERR_CERT_NOT_FOUND"},

	{KMF_ERR_CRL_NOT_FOUND,	"KMF_ERR_CRL_NOT_FOUND"},

	{KMF_ERR_RDN_PARSER,	"KMF_ERR_RDN_PARSER"},

	{KMF_ERR_RDN_ATTR,	"KMF_ERR_RDN_ATTR"},

	{KMF_ERR_SLOTNAME,	"KMF_ERR_SLOTNAME"},

	{KMF_ERR_EMPTY_CRL,	"KMF_ERR_EMPTY_CRL"},

	{KMF_ERR_BUFFER_SIZE,	"KMF_ERR_BUFFER_SIZE"},

	{KMF_ERR_AUTH_FAILED,	"KMF_ERR_AUTH_FAILED"},

	{KMF_ERR_TOKEN_SELECTED,	"KMF_ERR_TOKEN_SELECTED"},

	{KMF_ERR_NO_TOKEN_SELECTED,	"KMF_ERR_NO_TOKEN_SELECTED"},

	{KMF_ERR_TOKEN_NOT_PRESENT,	"KMF_ERR_TOKEN_NOT_PRESENT"},

	{KMF_ERR_EXTENSION_NOT_FOUND,	"KMF_ERR_EXTENSION_NOT_FOUND"},

	{KMF_ERR_POLICY_ENGINE,	"KMF_ERR_POLICY_ENGINE"},

	{KMF_ERR_POLICY_DB_FORMAT,	"KMF_ERR_POLICY_DB_FORMAT"},

	{KMF_ERR_POLICY_NOT_FOUND,	"KMF_ERR_POLICY_NOT_FOUND"},

	{KMF_ERR_POLICY_DB_FILE,	"KMF_ERR_POLICY_DB_FILE"},

	{KMF_ERR_POLICY_NAME,	"KMF_ERR_POLICY_NAME"},

	{KMF_ERR_OCSP_POLICY,	"KMF_ERR_OCSP_POLICY"},

	{KMF_ERR_TA_POLICY,	"KMF_ERR_TA_POLICY"},

	{KMF_ERR_KEY_NOT_FOUND,	"KMF_ERR_KEY_NOT_FOUND"},

	{KMF_ERR_OPEN_FILE,	"KMF_ERR_OPEN_FILE"},

	{KMF_ERR_OCSP_BAD_ISSUER,	"KMF_ERR_OCSP_BAD_ISSUER"},

	{KMF_ERR_OCSP_BAD_CERT,	"KMF_ERR_OCSP_BAD_CERT"},

	{KMF_ERR_OCSP_CREATE_REQUEST,	"KMF_ERR_OCSP_CREATE_REQUEST"},

	{KMF_ERR_CONNECT_SERVER,	"KMF_ERR_CONNECT_SERVER"},

	{KMF_ERR_SEND_REQUEST,	"KMF_ERR_SEND_REQUEST"},

	{KMF_ERR_OCSP_CERTID,	"KMF_ERR_OCSP_CERTID"},

	{KMF_ERR_OCSP_MALFORMED_RESPONSE, "KMF_ERR_OCSP_MALFORMED_RESPONSE"},

	{KMF_ERR_OCSP_RESPONSE_STATUS,	"KMF_ERR_OCSP_RESPONSE_STATUS"},

	{KMF_ERR_OCSP_NO_BASIC_RESPONSE, "KMF_ERR_OCSP_NO_BASIC_RESPONSE"},

	{KMF_ERR_OCSP_BAD_SIGNER,	"KMF_ERR_OCSP_BAD_SIGNER"},

	{KMF_ERR_OCSP_RESPONSE_SIGNATURE, "KMF_ERR_OCSP_RESPONSE_SIGNATURE"},

	{KMF_ERR_OCSP_UNKNOWN_CERT,	"KMF_ERR_OCSP_UNKNOWN_CERT"},

	{KMF_ERR_OCSP_STATUS_TIME_INVALID, "KMF_ERR_OCSP_STATUS_TIME_INVALID"},

	{KMF_ERR_BAD_HTTP_RESPONSE,	"KMF_ERR_BAD_HTTP_RESPONSE"},

	{KMF_ERR_RECV_RESPONSE,	"KMF_ERR_RECV_RESPONSE"},

	{KMF_ERR_RECV_TIMEOUT,	"KMF_ERR_RECV_TIMEOUT"},

	{KMF_ERR_DUPLICATE_KEYFILE,	"KMF_ERR_DUPLICATE_KEYFILE"},

	{KMF_ERR_AMBIGUOUS_PATHNAME,	"KMF_ERR_AMBIGUOUS_PATHNAME"},

	{KMF_ERR_FUNCTION_NOT_FOUND,	"KMF_ERR_FUNCTION_NOT_FOUND"},

	{KMF_ERR_PKCS12_FORMAT,	"KMF_ERR_PKCS12_FORMAT"},

	{KMF_ERR_BAD_KEY_TYPE,	"KMF_ERR_BAD_KEY_TYPE"},

	{KMF_ERR_BAD_KEY_CLASS,	"KMF_ERR_BAD_KEY_CLASS"},

	{KMF_ERR_BAD_KEY_SIZE,	"KMF_ERR_BAD_KEY_SIZE"},

	{KMF_ERR_BAD_HEX_STRING,	"KMF_ERR_BAD_HEX_STRING"},

	{KMF_ERR_KEYUSAGE,	"KMF_ERR_KEYUSAGE"},

	{KMF_ERR_VALIDITY_PERIOD,	"KMF_ERR_VALIDITY_PERIOD"},

	{KMF_ERR_OCSP_REVOKED,	"KMF_ERR_OCSP_REVOKED"},

	{KMF_ERR_CERT_MULTIPLE_FOUND,	"KMF_ERR_CERT_MULTIPLE_FOUND"},

	{KMF_ERR_WRITE_FILE,	"KMF_ERR_WRITE_FILE"},

	{KMF_ERR_BAD_URI,	"KMF_ERR_BAD_URI"},

	{KMF_ERR_BAD_CRLFILE,	"KMF_ERR_BAD_CRLFILE"},

	{KMF_ERR_BAD_CERTFILE,	"KMF_ERR_BAD_CERTFILE"},

	{KMF_ERR_GETKEYVALUE_FAILED,	"KMF_ERR_GETKEYVALUE_FAILED"},

	{KMF_ERR_BAD_KEYHANDLE,	"KMF_ERR_BAD_KEYHANDLE"},

	{KMF_ERR_BAD_OBJECT_TYPE,	"KMF_ERR_BAD_OBJECT_TYPE"},

	{KMF_ERR_OCSP_RESPONSE_LIFETIME, "KMF_ERR_OCSP_RESPONSE_LIFETIME"},

	{KMF_ERR_UNKNOWN_CSR_ATTRIBUTE,	"KMF_ERR_UNKNOWN_CSR_ATTRIBUTE"},

	{KMF_ERR_UNINITIALIZED_TOKEN,	"KMF_ERR_UNINITIALIZED_TOKEN"},

	{KMF_ERR_INCOMPLETE_TBS_CERT,	"KMF_ERR_INCOMPLETE_TBS_CERT"},

	{KMF_ERR_MISSING_ERRCODE,	"KMF_ERR_MISSING_ERRCODE"},

	{KMF_KEYSTORE_ALREADY_INITIALIZED, "KMF_KEYSTORE_ALREADY_INITIALIZED"},

	{KMF_ERR_SENSITIVE_KEY,		"KMF_ERR_SENSITIVE_KEY"},

	{KMF_ERR_UNEXTRACTABLE_KEY,	"KMF_ERR_UNEXTRACTABLE_KEY"},

	{KMF_ERR_KEY_MISMATCH,		"KMF_ERR_KEY_MISMATCH"},

	{KMF_ERR_ATTR_NOT_FOUND,	"KMF_ERR_ATTR_NOT_FOUND"},

	{KMF_ERR_KMF_CONF,		"KMF_ERR_KMF_CONF"}

};

typedef struct {

	KMF_KEYSTORE_TYPE	kstype;

	char			*path;

	boolean_t		critical;

} KMF_PLUGIN_ITEM;

KMF_PLUGIN_ITEM plugin_list[] = {

	{KMF_KEYSTORE_OPENSSL,	KMF_PLUGIN_PATH "kmf_openssl.so.1",  TRUE},

	{KMF_KEYSTORE_PK11TOKEN, KMF_PLUGIN_PATH "kmf_pkcs11.so.1",  TRUE},

	{KMF_KEYSTORE_NSS,	KMF_PLUGIN_PATH "kmf_nss.so.1",  FALSE}

};

static KMF_RETURN InitializePlugin(KMF_KEYSTORE_TYPE, char *, KMF_PLUGIN **);

static KMF_RETURN AddPlugin(KMF_HANDLE_T, KMF_PLUGIN *);

static void free_extensions(KMF_X509_EXTENSIONS *extns);

static void DestroyPlugin(KMF_PLUGIN *);

#if defined(__sparcv9)

#define	ISA_PATH	"/sparcv9"

#elif defined(__sparc)

#define	ISA_PATH	"/"

#elif defined(__i386)

#define	ISA_PATH	"/"

#elif defined(__amd64)

#define	ISA_PATH	"/amd64"

#endif

#define	DEFAULT_KEYSTORE_NUM	3

static int kstore_num = DEFAULT_KEYSTORE_NUM;

conf_entrylist_t *extra_plugin_list = NULL;

static boolean_t check_extra_plugin = B_FALSE;

mutex_t extra_plugin_lock = DEFAULTMUTEX;

KMF_RETURN

init_pk11()

{

	(void) mutex_lock(&init_lock);

	if (!pkcs11_initialized) {

		CK_RV rv = C_Initialize(NULL);

		if ((rv != CKR_OK) &&

		    (rv != CKR_CRYPTOKI_ALREADY_INITIALIZED)) {

			(void) mutex_unlock(&init_lock);

			return (KMF_ERR_UNINITIALIZED);

		} else {

			pkcs11_initialized = 1;

		}

	}

	(void) mutex_unlock(&init_lock);

	return (KMF_OK);

}

/*

 * Private method for searching the plugin list for the correct

 * Plugin to use.

 */

KMF_PLUGIN *

FindPlugin(KMF_HANDLE_T handle, KMF_KEYSTORE_TYPE kstype)

{

	KMF_PLUGIN_LIST *node;

	KMF_RETURN ret = KMF_OK;

	KMF_PLUGIN *pluginrec = NULL;

	if (handle == NULL)

		return (NULL);

	node = handle->plugins;

	/* See if the desired plugin was already initialized. */

	while (node != NULL && node->plugin->type != kstype)

		node = node->next;

	if (node != NULL)

		return (node->plugin);

	/* The plugin was not found, try to initialize it here. */

	if (VALID_DEFAULT_KEYSTORE_TYPE(kstype)) {

		int i;

		int numitems = sizeof (plugin_list)/sizeof (KMF_PLUGIN_ITEM);

		for (i = 0; i < numitems; i++) {

			if (plugin_list[i].kstype == kstype) {

				ret = InitializePlugin(plugin_list[i].kstype,

				    plugin_list[i].path, &pluginrec);

				break;

			}

		}

		goto out;

	} else {

		/*

		 * Not a built-in plugin. Check if it is in the

		 * extra_plugin_list.  If it is, try to initialize it here.

		 */

		conf_entrylist_t *phead = extra_plugin_list;

		char realpath[MAXPATHLEN];

		while (phead != NULL) {

			if (phead->entry->kstype == kstype)

				break;

			else

				phead = phead->next;

		}

		if (phead == NULL)

			return (NULL);

		/*

		 * Get the absolute path of the module.

		 * - If modulepath is not a full path, then prepend it

		 *   with KMF_PLUGIN_PATH.

		 * - If modulepath is a full path and contain $ISA, then

		 *   subsitute the architecture dependent path.

		 */

		(void) memset(realpath, 0, sizeof (realpath));

		if (strncmp(phead->entry->modulepath, "/", 1) != 0) {

			(void) snprintf(realpath, MAXPATHLEN, "%s%s",

			    KMF_PLUGIN_PATH, phead->entry->modulepath);

		} else {

			char *buf = phead->entry->modulepath;

			char *isa;

			if ((isa = strstr(buf, PKCS11_ISA)) != NULL) {

				char *isa_str;

				(void) strncpy(realpath, buf, isa - buf);

				isa_str = strdup(ISA_PATH);

				if (isa_str == NULL) /* not enough memory */

					return (NULL);

				(void) strncat(realpath, isa_str,

				    strlen(isa_str));

				free(isa_str);

				isa += strlen(PKCS11_ISA);

				(void) strlcat(realpath, isa, MAXPATHLEN);

			} else {

				(void) snprintf(realpath, MAXPATHLEN, "%s",

				    phead->entry->modulepath);

			}

		}

		ret = InitializePlugin(phead->entry->kstype, realpath,

		    &pluginrec);

		goto out;

	}

out:

	if (ret != KMF_OK || pluginrec == NULL)

		/* No matching plugins found in the built-in list */

		return (NULL);

	ret = AddPlugin(handle, pluginrec);

	if (ret != KMF_OK) {

		DestroyPlugin(pluginrec);

		pluginrec = NULL;

	}

	return (pluginrec);

}

static KMF_RETURN

InitializePlugin(KMF_KEYSTORE_TYPE kstype, char *path, KMF_PLUGIN **plugin)

{

	KMF_PLUGIN *p = NULL;

	KMF_PLUGIN_FUNCLIST *(*sym)();

	if (path == NULL || plugin == NULL)

		return (KMF_ERR_BAD_PARAMETER);

	*plugin = NULL;

	p = (KMF_PLUGIN *)malloc(sizeof (KMF_PLUGIN));

	if (p == NULL)

		return (KMF_ERR_MEMORY);

	p->type = kstype;

	p->path = strdup(path);

	if (p->path == NULL) {

		free(p);

		return (KMF_ERR_MEMORY);

	}

	/*

	 * Do not use RTLD_GROUP here, or this will cause a circular

	 * dependency when kmf_pkcs11.so.1 gets its PKCS#11 functions

	 * from libpkcs11.so.1 when kmf is used via libelfsign.so.1

	 * called from kcfd.

	 */

	p->dldesc = dlopen(path, RTLD_LAZY | RTLD_PARENT);

	if (p->dldesc == NULL) {

		free(p->path);

		free(p);

		return (KMF_ERR_PLUGIN_INIT);

	}

	sym = (KMF_PLUGIN_FUNCLIST *(*)())dlsym(p->dldesc,

	    KMF_PLUGIN_INIT_SYMBOL);

	if (sym == NULL) {

		(void) dlclose(p->dldesc);

		free(p->path);

		free(p);

		return (KMF_ERR_PLUGIN_INIT);

	}

	/* Get the function list */

	if ((p->funclist = (*sym)()) == NULL) {

		(void) dlclose(p->dldesc);

		free(p->path);

		free(p);

		return (KMF_ERR_PLUGIN_INIT);

	}

	*plugin = p;

	return (KMF_OK);

}

static KMF_RETURN

AddPlugin(KMF_HANDLE_T handle, KMF_PLUGIN *plugin)

{

	KMF_PLUGIN_LIST *n;

	if (handle == NULL || plugin == NULL)

		return (KMF_ERR_BAD_PARAMETER);

	/* If the head is NULL, create it */

	if (handle->plugins == NULL) {

		handle->plugins = (KMF_PLUGIN_LIST *)malloc(

		    sizeof (KMF_PLUGIN_LIST));

		if (handle->plugins == NULL)

			return (KMF_ERR_MEMORY);

		handle->plugins->plugin = plugin;

		handle->plugins->next = NULL;

	} else {

		/* walk the list to find the tail */

		n = handle->plugins;

		while (n->next != NULL)

			n = n->next;

		n->next = (KMF_PLUGIN_LIST *)malloc(sizeof (KMF_PLUGIN_LIST));

		if (n->next == NULL)

			return (KMF_ERR_MEMORY);

		n->next->plugin = plugin;

		n->next->next = NULL;

	}

	return (0);

}

static void

DestroyPlugin(KMF_PLUGIN *plugin)

{

	if (plugin) {

		if (plugin->path)

			free(plugin->path);

		free(plugin);

	}

}

static void

Cleanup_KMF_Handle(KMF_HANDLE_T handle)

{

	if (handle != NULL) {

		while (handle->plugins != NULL) {

			KMF_PLUGIN_LIST *next = handle->plugins->next;

			DestroyPlugin(handle->plugins->plugin);

			free(handle->plugins);

			handle->plugins = next;

		}

		kmf_free_policy_record(handle->policy);

		free(handle->policy);

	}

	free(handle);

}

void

Cleanup_PK11_Session(KMF_HANDLE_T handle)

{

	if (handle != NULL) {

		/* Close active session on a pkcs11 token */

		if (handle->pk11handle != NULL) {

			(void) C_CloseSession(handle->pk11handle);

			handle->pk11handle = NULL;

		}

	}

}

KMF_RETURN

kmf_initialize(KMF_HANDLE_T *outhandle, char *policyfile, char *policyname)

{

	KMF_RETURN ret = KMF_OK;

	KMF_HANDLE *handle = NULL;

	if (outhandle == NULL)

		return (KMF_ERR_BAD_PARAMETER);

	*outhandle = NULL;

	handle = (KMF_HANDLE *)malloc(sizeof (KMF_HANDLE));

	if (handle == NULL)

		return (KMF_ERR_MEMORY);

	(void) memset(handle, 0, sizeof (KMF_HANDLE));

	handle->plugins = NULL;

	/*

	 * When this function is called the first time, get the additional

	 * plugins from the config file.

	 */

	(void) mutex_lock(&extra_plugin_lock);

	if (!check_extra_plugin) {

		ret = get_entrylist(&extra_plugin_list);

		check_extra_plugin = B_TRUE;

		/*

		 * Assign the kstype number to the additional plugins here.

		 * The global kstore_num will be protected by the mutex lock.

		 */

		if (ret == KMF_OK) {

			conf_entrylist_t *phead = extra_plugin_list;

			while (phead != NULL) {

				phead->entry->kstype = ++kstore_num;

				phead = phead->next;

			}

		}

		/*

		 * If the KMF configuration file does not exist or cannot be

		 * parsed correctly, we will give a warning in syslog and

		 * continue on as there is no extra plugins in the system.

		 */

		if (ret == KMF_ERR_KMF_CONF) {

			cryptoerror(LOG_WARNING, "KMF was unable to parse "

			    "the private KMF config file.\n");

			ret = KMF_OK;

		}

		if (ret != KMF_OK) {

			(void) mutex_unlock(&extra_plugin_lock);

			goto errout;

		}

	}

	(void) mutex_unlock(&extra_plugin_lock);

	/* Initialize the handle with the policy */

	ret = kmf_set_policy((void *)handle,

	    policyfile == NULL ? KMF_DEFAULT_POLICY_FILE : policyfile,

	    policyname == NULL ? KMF_DEFAULT_POLICY_NAME : policyname);

	if (ret != KMF_OK)

		goto errout;

	CLEAR_ERROR(handle, ret);

errout:

	if (ret != KMF_OK) {

		Cleanup_KMF_Handle(handle);

		handle = NULL;

	}

	*outhandle = (KMF_HANDLE_T)handle;

	return (ret);

}

KMF_RETURN

kmf_configure_keystore(KMF_HANDLE_T handle,

	int	num_args,

	KMF_ATTRIBUTE	*attrlist)

{

	KMF_RETURN ret = KMF_OK;

	KMF_PLUGIN *plugin;