cmd-crypto/pktool/import.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */
/*
 * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 * Copyright 2012 Milan Jurik. All rights reserved.
 */

/*
 * This file implements the import operation for this tool.
 * The basic flow of the process is to decrypt the PKCS#12
 * input file if it has a password, parse the elements in
 * the file, find the soft token, log into it, import the
 * PKCS#11 objects into the soft token, and log out.
 */

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>
#include <errno.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/stat.h>
#include "common.h"

#include <kmfapi.h>

#define NEW_ATTRLIST(a, n) \
{ \
    a = (KMF_ATTRIBUTE *)malloc(n * sizeof (KMF_ATTRIBUTE)); \
    if (a == NULL) { \
        rv = KMF_ERR_MEMORY; \
        goto end; \
    } \
    (void) memset(a, 0, n * sizeof (KMF_ATTRIBUTE));  \
}

static KMF_RETURN
pk_import_pk12_files(KMF_HANDLE_T kmfhandle, KMF_CREDENTIAL *cred,
    char *outfile, char *certfile, char *keyfile,
    KMF_ENCODE_FORMAT outformat)
{
    KMF_RETURN rv = KMF_OK;
    KMF_X509_DER_CERT *certs = NULL;
    KMF_RAW_KEY_DATA *keys = NULL;
    int ncerts = 0;
    int nkeys = 0;
    int i;
    KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_OPENSSL;
    KMF_ATTRIBUTE *attrlist = NULL;
    int numattr = 0;

    rv = kmf_import_objects(kmfhandle, outfile, cred,
        &certs, &ncerts, &keys, &nkeys);

    if (rv == KMF_OK) {
        (void) printf(gettext("Found %d certificate(s) and %d "
            "key(s) in %s\n"), ncerts, nkeys, outfile);
    }

    if (rv == KMF_OK && ncerts > 0) {
        char newcertfile[MAXPATHLEN];

        NEW_ATTRLIST(attrlist,  (3 + (3 * ncerts)));

        kmf_set_attr_at_index(attrlist, numattr,
            KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
        numattr++;

        kmf_set_attr_at_index(attrlist, numattr,
            KMF_ENCODE_FORMAT_ATTR, &outformat, sizeof (outformat));
        numattr++;

        for (i = 0; rv == KMF_OK && i < ncerts; i++) {
            int num = numattr;

            /*
             * If storing more than 1 cert, gotta change
             * the name so we don't overwrite the previous one.
             * Just append a _# to the name.
             */
            if (i > 0) {
                (void) snprintf(newcertfile,
                    sizeof (newcertfile), "%s_%d", certfile, i);

                kmf_set_attr_at_index(attrlist, num,
                    KMF_CERT_FILENAME_ATTR, newcertfile,
                    strlen(newcertfile));
                num++;
            } else {
                kmf_set_attr_at_index(attrlist, num,
                    KMF_CERT_FILENAME_ATTR, certfile,
                    strlen(certfile));
                num++;
            }

            if (certs[i].kmf_private.label != NULL) {
                kmf_set_attr_at_index(attrlist, num,
                    KMF_CERT_LABEL_ATTR,
                    certs[i].kmf_private.label,
                    strlen(certs[i].kmf_private.label));
                num++;
            }
            kmf_set_attr_at_index(attrlist, num,
                KMF_CERT_DATA_ATTR, &certs[i].certificate,
                sizeof (KMF_DATA));
            num++;
            rv = kmf_store_cert(kmfhandle, num, attrlist);
        }
        free(attrlist);
    }
    if (rv == KMF_OK && nkeys > 0) {
        char newkeyfile[MAXPATHLEN];
        numattr = 0;
        NEW_ATTRLIST(attrlist, (4 + (4 * nkeys)));

        kmf_set_attr_at_index(attrlist, numattr,
            KMF_KEYSTORE_TYPE_ATTR, &kstype,
            sizeof (kstype));
        numattr++;

        kmf_set_attr_at_index(attrlist, numattr,
            KMF_ENCODE_FORMAT_ATTR, &outformat,
            sizeof (outformat));
        numattr++;

        if (cred != NULL && cred->credlen > 0) {
            kmf_set_attr_at_index(attrlist, numattr,
                KMF_CREDENTIAL_ATTR, cred,
                sizeof (KMF_CREDENTIAL));
            numattr++;
        }

        /* The order of certificates and keys should match */
        for (i = 0; rv == KMF_OK && i < nkeys; i++) {
            int num = numattr;

            if (i > 0) {
                (void) snprintf(newkeyfile,
                    sizeof (newkeyfile), "%s_%d", keyfile, i);

                kmf_set_attr_at_index(attrlist, num,
                    KMF_KEY_FILENAME_ATTR, newkeyfile,
                    strlen(newkeyfile));
                num++;
            } else {
                kmf_set_attr_at_index(attrlist, num,
                    KMF_KEY_FILENAME_ATTR, keyfile,
                    strlen(keyfile));
                num++;
            }

            if (i < ncerts) {
                kmf_set_attr_at_index(attrlist, num,
                    KMF_CERT_DATA_ATTR, &certs[i],
                    sizeof (KMF_CERT_DATA_ATTR));
                num++;
            }

            kmf_set_attr_at_index(attrlist, num,
                KMF_RAW_KEY_ATTR, &keys[i],
                sizeof (KMF_RAW_KEY_DATA));
            num++;

            rv = kmf_store_key(kmfhandle, num, attrlist);
        }
        free(attrlist);
    }
end:
    /*
     * Cleanup memory.
     */
    if (certs) {
        for (i = 0; i < ncerts; i++)
            kmf_free_kmf_cert(kmfhandle, &certs[i]);
        free(certs);
    }
    if (keys) {
        for (i = 0; i < nkeys; i++)
            kmf_free_raw_key(&keys[i]);
        free(keys);
    }


    return (rv);
}


static KMF_RETURN
pk_import_pk12_nss(
    KMF_HANDLE_T kmfhandle, KMF_CREDENTIAL *kmfcred,
    KMF_CREDENTIAL *tokencred,
    char *token_spec, char *dir, char *prefix,
    char *nickname, char *trustflags, char *filename)
{
    KMF_RETURN rv = KMF_OK;
    KMF_X509_DER_CERT *certs = NULL;
    KMF_RAW_KEY_DATA *keys = NULL;
    int ncerts = 0;
    int nkeys = 0;
    int i;
    KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_NSS;
    KMF_ATTRIBUTE *attrlist = NULL;
    int numattr = 0;

    rv = configure_nss(kmfhandle, dir, prefix);
    if (rv != KMF_OK)
        return (rv);

    rv = kmf_import_objects(kmfhandle, filename, kmfcred,
        &certs, &ncerts, &keys, &nkeys);

    if (rv == KMF_OK)
        (void) printf(gettext("Found %d certificate(s) and %d "
            "key(s) in %s\n"), ncerts, nkeys, filename);

    if (rv == KMF_OK) {
        numattr = 0;
        NEW_ATTRLIST(attrlist, (4 + (2 * nkeys)));

        kmf_set_attr_at_index(attrlist, numattr,
            KMF_KEYSTORE_TYPE_ATTR, &kstype,
            sizeof (kstype));
        numattr++;

        if (token_spec != NULL) {
            kmf_set_attr_at_index(attrlist, numattr,
                KMF_TOKEN_LABEL_ATTR, token_spec,
                strlen(token_spec));
            numattr++;
        }

        if (nickname != NULL) {
            kmf_set_attr_at_index(attrlist, numattr,
                KMF_KEYLABEL_ATTR, nickname,
                strlen(nickname));
            numattr++;
        }

        if (tokencred->credlen > 0) {
            kmf_set_attr_at_index(attrlist, numattr,
                KMF_CREDENTIAL_ATTR, tokencred,
                sizeof (KMF_CREDENTIAL));
            numattr++;
        }

        /* The order of certificates and keys should match */
        for (i = 0; i < nkeys; i++) {
            int num = numattr;

            if (i < ncerts) {
                kmf_set_attr_at_index(attrlist, num,
                    KMF_CERT_DATA_ATTR, &certs[i],
                    sizeof (KMF_DATA));
                num++;
            }

            kmf_set_attr_at_index(attrlist, num,
                KMF_RAW_KEY_ATTR, &keys[i],
                sizeof (KMF_RAW_KEY_DATA));
            num++;

            rv = kmf_store_key(kmfhandle, num, attrlist);
        }
        free(attrlist);
        attrlist = NULL;
    }

    if (rv == KMF_OK) {
        numattr = 0;
        NEW_ATTRLIST(attrlist, (3 + (2 * ncerts)));

        kmf_set_attr_at_index(attrlist, numattr,
            KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
        numattr++;

        if (token_spec != NULL) {
            kmf_set_attr_at_index(attrlist, numattr,
                KMF_TOKEN_LABEL_ATTR, token_spec,
                strlen(token_spec));
            numattr++;
        }

        if (trustflags != NULL) {
            kmf_set_attr_at_index(attrlist, numattr,
                KMF_TRUSTFLAG_ATTR, trustflags,
                strlen(trustflags));
            numattr++;
        }

        for (i = 0; rv == KMF_OK && i < ncerts; i++) {
            int num = numattr;

            if (certs[i].kmf_private.label != NULL) {
                kmf_set_attr_at_index(attrlist, num,
                    KMF_CERT_LABEL_ATTR,
                    certs[i].kmf_private.label,
                    strlen(certs[i].kmf_private.label));
                num++;
            } else if (i == 0 && nickname != NULL) {
                kmf_set_attr_at_index(attrlist, num,
                    KMF_CERT_LABEL_ATTR, nickname,
                    strlen(nickname));
                num++;
            }

            kmf_set_attr_at_index(attrlist, num,
                KMF_CERT_DATA_ATTR,
                &certs[i].certificate, sizeof (KMF_DATA));
            num++;
            rv = kmf_store_cert(kmfhandle, num, attrlist);
        }
        free(attrlist);
        attrlist = NULL;
        if (rv != KMF_OK) {
            display_error(kmfhandle, rv,
                gettext("Error storing certificate in NSS token"));
        }
    }

end:
    /*
     * Cleanup memory.
     */
    if (certs) {
        for (i = 0; i < ncerts; i++)
            kmf_free_kmf_cert(kmfhandle, &certs[i]);
        free(certs);
    }
    if (keys) {
        for (i = 0; i < nkeys; i++)
            kmf_free_raw_key(&keys[i]);
        free(keys);
    }

    return (rv);
}

static KMF_RETURN
pk_import_cert(
    KMF_HANDLE_T kmfhandle,
    KMF_KEYSTORE_TYPE kstype,
    char *label, char *token_spec, char *filename,
    char *dir, char *prefix, char *trustflags)
{
    KMF_RETURN rv = KMF_OK;
    KMF_ATTRIBUTE attrlist[32];
    KMF_CREDENTIAL tokencred;
    int i = 0;

    if (kstype == KMF_KEYSTORE_PK11TOKEN) {
        rv = select_token(kmfhandle, token_spec, FALSE);
    } else if (kstype == KMF_KEYSTORE_NSS) {
        rv = configure_nss(kmfhandle, dir, prefix);
    }
    if (rv != KMF_OK)
        return (rv);

    kmf_set_attr_at_index(attrlist, i,
        KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (KMF_KEYSTORE_TYPE));
    i++;

    kmf_set_attr_at_index(attrlist, i, KMF_CERT_FILENAME_ATTR,
        filename, strlen(filename));
    i++;

    if (label != NULL) {
        kmf_set_attr_at_index(attrlist, i, KMF_CERT_LABEL_ATTR,
            label, strlen(label));
        i++;
    }

    if (kstype == KMF_KEYSTORE_NSS) {
        if (trustflags != NULL) {
            kmf_set_attr_at_index(attrlist, i, KMF_TRUSTFLAG_ATTR,
                trustflags, strlen(trustflags));
            i++;
        }

        if (token_spec != NULL) {
            kmf_set_attr_at_index(attrlist, i,
                KMF_TOKEN_LABEL_ATTR,
                token_spec, strlen(token_spec));
            i++;
        }
    }

    rv = kmf_import_cert(kmfhandle, i, attrlist);
    if (rv == KMF_ERR_AUTH_FAILED) {
        /*
         * The token requires a credential, prompt and try again.
         */
        (void) get_token_password(kstype, token_spec, &tokencred);
        kmf_set_attr_at_index(attrlist, i, KMF_CREDENTIAL_ATTR,
            &tokencred, sizeof (KMF_CREDENTIAL));
        i++;

        rv = kmf_import_cert(kmfhandle, i, attrlist);

    }
    return (rv);
}

static KMF_RETURN
pk_import_file_crl(void *kmfhandle,
    char *infile,
    char *outfile,
    KMF_ENCODE_FORMAT outfmt)
{
    int numattr = 0;
    KMF_ATTRIBUTE attrlist[8];
    KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_OPENSSL;

    kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
        &kstype, sizeof (kstype));
    numattr++;
    if (infile) {
        kmf_set_attr_at_index(attrlist, numattr,
            KMF_CRL_FILENAME_ATTR, infile, strlen(infile));
        numattr++;
    }
    if (outfile) {
        kmf_set_attr_at_index(attrlist, numattr,
            KMF_CRL_OUTFILE_ATTR, outfile, strlen(outfile));
        numattr++;
    }
    kmf_set_attr_at_index(attrlist, numattr,
        KMF_ENCODE_FORMAT_ATTR, &outfmt, sizeof (outfmt));
    numattr++;

    return (kmf_import_crl(kmfhandle, numattr, attrlist));
}

static KMF_RETURN
pk_import_nss_crl(void *kmfhandle,
    boolean_t verify_crl_flag,
    char *infile,
    char *outdir,
    char *prefix)
{
    KMF_RETURN rv;
    int numattr = 0;
    KMF_ATTRIBUTE attrlist[4];
    KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_NSS;

    rv = configure_nss(kmfhandle, outdir, prefix);
    if (rv != KMF_OK)
        return (rv);

    kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
        &kstype, sizeof (kstype));
    numattr++;
    if (infile) {
        kmf_set_attr_at_index(attrlist, numattr, KMF_CRL_FILENAME_ATTR,
            infile, strlen(infile));
        numattr++;
    }
    kmf_set_attr_at_index(attrlist, numattr, KMF_CRL_CHECK_ATTR,
        &verify_crl_flag, sizeof (verify_crl_flag));
    numattr++;

    return (kmf_import_crl(kmfhandle, numattr, attrlist));

}

static KMF_RETURN
pk_import_pk12_pk11(
    KMF_HANDLE_T kmfhandle,
    KMF_CREDENTIAL *p12cred,
    KMF_CREDENTIAL *tokencred,
    char *label, char *token_spec,
    char *filename)
{
    KMF_RETURN rv = KMF_OK;
    KMF_X509_DER_CERT *certs = NULL;
    KMF_RAW_KEY_DATA *keys = NULL;
    int ncerts = 0;
    int nkeys = 0;
    int i;
    KMF_KEYSTORE_TYPE kstype = KMF_KEYSTORE_PK11TOKEN;
    KMF_ATTRIBUTE *attrlist = NULL;
    int numattr = 0;

    rv = select_token(kmfhandle, token_spec, FALSE);

    if (rv != KMF_OK) {
        return (rv);
    }

    rv = kmf_import_objects(kmfhandle, filename, p12cred,
        &certs, &ncerts, &keys, &nkeys);

    if (rv == KMF_OK) {
        NEW_ATTRLIST(attrlist, (3 + (2 * nkeys)));

        kmf_set_attr_at_index(attrlist, numattr,
            KMF_KEYSTORE_TYPE_ATTR, &kstype,
            sizeof (kstype));
        numattr++;

        if (label != NULL) {
            kmf_set_attr_at_index(attrlist, numattr,
                KMF_KEYLABEL_ATTR, label,
                strlen(label));
            numattr++;
        }

        if (tokencred != NULL && tokencred->credlen > 0) {
            kmf_set_attr_at_index(attrlist, numattr,
                KMF_CREDENTIAL_ATTR, tokencred,
                sizeof (KMF_CREDENTIAL));
            numattr++;
        }

        /* The order of certificates and keys should match */
        for (i = 0; i < nkeys; i++) {
            int num = numattr;

            if (i < ncerts) {
                kmf_set_attr_at_index(attrlist, num,
                    KMF_CERT_DATA_ATTR, &certs[i].certificate,
                    sizeof (KMF_DATA));
                num++;
            }

            kmf_set_attr_at_index(attrlist, num,
                KMF_RAW_KEY_ATTR, &keys[i],
                sizeof (KMF_RAW_KEY_DATA));
            num++;

            rv = kmf_store_key(kmfhandle, num, attrlist);

        }
        free(attrlist);
    }

    if (rv == KMF_OK) {
        numattr = 0;
        NEW_ATTRLIST(attrlist, (1 + (2 * ncerts)));

        (void) printf(gettext("Found %d certificate(s) and %d "
            "key(s) in %s\n"), ncerts, nkeys, filename);

        kmf_set_attr_at_index(attrlist, numattr,
            KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
        numattr++;

        for (i = 0; rv == KMF_OK && i < ncerts; i++) {
            int num = numattr;
            if (certs[i].kmf_private.label != NULL) {
                kmf_set_attr_at_index(attrlist, num,
                    KMF_CERT_LABEL_ATTR,
                    certs[i].kmf_private.label,
                    strlen(certs[i].kmf_private.label));
                num++;
            } else if (i == 0 && label != NULL) {
                kmf_set_attr_at_index(attrlist, num,
                    KMF_CERT_LABEL_ATTR, label, strlen(label));
                num++;
            }

            kmf_set_attr_at_index(attrlist, num,
                KMF_CERT_DATA_ATTR, &certs[i].certificate,
                sizeof (KMF_DATA));
            num++;

            rv = kmf_store_cert(kmfhandle, num, attrlist);
        }
        free(attrlist);
    }

end:
    /*
     * Cleanup memory.
     */
    if (certs) {
        for (i = 0; i < ncerts; i++)
            kmf_free_kmf_cert(kmfhandle, &certs[i]);
        free(certs);
    }
    if (keys) {
        for (i = 0; i < nkeys; i++)
            kmf_free_raw_key(&keys[i]);
        free(keys);
    }

    return (rv);
}

/*ARGSUSED*/
static KMF_RETURN
pk_import_keys(KMF_HANDLE_T kmfhandle,
    KMF_KEYSTORE_TYPE kstype, char *token_spec,
    KMF_CREDENTIAL *cred, char *filename,
    char *label, char *senstr, char *extstr)
{
    KMF_RETURN rv = KMF_OK;
    KMF_ATTRIBUTE attrlist[16];
    KMF_KEYSTORE_TYPE fileks = KMF_KEYSTORE_OPENSSL;
    int numattr = 0;
    KMF_KEY_HANDLE key;
    KMF_RAW_KEY_DATA rawkey;
    KMF_KEY_CLASS class = KMF_ASYM_PRI;
    int numkeys = 1;

    if (kstype == KMF_KEYSTORE_PK11TOKEN) {
        rv = select_token(kmfhandle, token_spec, FALSE);
    }
    if (rv != KMF_OK)
        return (rv);
    /*
     * First, set up to read the keyfile using the FILE plugin
     * mechanisms.
     */
    kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
        &fileks, sizeof (fileks));
    numattr++;

    kmf_set_attr_at_index(attrlist, numattr, KMF_COUNT_ATTR,
        &numkeys, sizeof (numkeys));
    numattr++;

    kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_HANDLE_ATTR,
        &key, sizeof (key));
    numattr++;

    kmf_set_attr_at_index(attrlist, numattr, KMF_RAW_KEY_ATTR,
        &rawkey, sizeof (rawkey));
    numattr++;

    kmf_set_attr_at_index(attrlist, numattr, KMF_KEYCLASS_ATTR,
        &class, sizeof (class));
    numattr++;

    kmf_set_attr_at_index(attrlist, numattr, KMF_KEY_FILENAME_ATTR,
        filename, strlen(filename));
    numattr++;

    rv = kmf_find_key(kmfhandle, numattr, attrlist);
    if (rv == KMF_OK) {
        numattr = 0;

        kmf_set_attr_at_index(attrlist, numattr, KMF_KEYSTORE_TYPE_ATTR,
            &kstype, sizeof (kstype));
        numattr++;

        if (cred != NULL && cred->credlen > 0) {
            kmf_set_attr_at_index(attrlist, numattr,
                KMF_CREDENTIAL_ATTR, cred, sizeof (KMF_CREDENTIAL));
            numattr++;
        }

        if (label != NULL) {
            kmf_set_attr_at_index(attrlist, numattr,
                KMF_KEYLABEL_ATTR, label, strlen(label));
            numattr++;
        }

        kmf_set_attr_at_index(attrlist, numattr,
            KMF_RAW_KEY_ATTR, &rawkey, sizeof (rawkey));
        numattr++;

        rv = kmf_store_key(kmfhandle, numattr, attrlist);
        if (rv == KMF_OK) {
            (void) printf(gettext("Importing %d keys\n"), numkeys);
        }

        kmf_free_kmf_key(kmfhandle, &key);
        kmf_free_raw_key(&rawkey);
    } else {
        cryptoerror(LOG_STDERR,
            gettext("Failed to load key from file (%s)\n"),
            filename);
    }
    return (rv);
}

static KMF_RETURN
pk_import_rawkey(KMF_HANDLE_T kmfhandle,
    KMF_KEYSTORE_TYPE kstype, char *token,
    KMF_CREDENTIAL *cred,
    char *filename, char *label, KMF_KEY_ALG keyAlg,
    char *senstr, char *extstr)
{
    KMF_RETURN rv = KMF_OK;
    KMF_ATTRIBUTE attrlist[16];
    int numattr = 0;
    uint32_t keylen;
    boolean_t sensitive = B_FALSE;
    boolean_t not_extractable = B_FALSE;
    KMF_DATA keydata = { 0, NULL };
    KMF_KEY_HANDLE rawkey;

    rv = kmf_read_input_file(kmfhandle, filename, &keydata);
    if (rv != KMF_OK)
        return (rv);

    rv = select_token(kmfhandle, token, FALSE);

    if (rv != KMF_OK) {
        return (rv);
    }
    if (senstr != NULL) {
        if (tolower(senstr[0]) == 'y')
            sensitive = B_TRUE;
        else if (tolower(senstr[0]) == 'n')
            sensitive = B_FALSE;
        else {
            cryptoerror(LOG_STDERR,
                gettext("Incorrect sensitive option value.\n"));
            return (KMF_ERR_BAD_PARAMETER);
        }
    }

    if (extstr != NULL) {
        if (tolower(extstr[0]) == 'y')
            not_extractable = B_FALSE;
        else if (tolower(extstr[0]) == 'n')
            not_extractable = B_TRUE;
        else {
            cryptoerror(LOG_STDERR,
                gettext("Incorrect extractable option value.\n"));
            return (KMF_ERR_BAD_PARAMETER);
        }
    }
    kmf_set_attr_at_index(attrlist, numattr,
        KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
    numattr++;

    kmf_set_attr_at_index(attrlist, numattr,
        KMF_KEY_HANDLE_ATTR, &rawkey, sizeof (rawkey));
    numattr++;

    kmf_set_attr_at_index(attrlist, numattr,
        KMF_KEYALG_ATTR, &keyAlg, sizeof (KMF_KEY_ALG));
    numattr++;

    kmf_set_attr_at_index(attrlist, numattr,
        KMF_KEY_DATA_ATTR, keydata.Data, keydata.Length);
    numattr++;

    /* Key length is given in bits not bytes */
    keylen = keydata.Length * 8;
    kmf_set_attr_at_index(attrlist, numattr,
        KMF_KEYLENGTH_ATTR, &keylen, sizeof (keydata.Length));
    numattr++;

    kmf_set_attr_at_index(attrlist, numattr,
        KMF_SENSITIVE_BOOL_ATTR, &sensitive, sizeof (sensitive));
    numattr++;

    kmf_set_attr_at_index(attrlist, numattr,
        KMF_NON_EXTRACTABLE_BOOL_ATTR, &not_extractable,
        sizeof (not_extractable));
    numattr++;

    if (label != NULL) {
        kmf_set_attr_at_index(attrlist, numattr,
            KMF_KEYLABEL_ATTR, label, strlen(label));
        numattr++;
    }
    if (cred != NULL && cred->credlen > 0) {
        kmf_set_attr_at_index(attrlist, numattr,
            KMF_CREDENTIAL_ATTR, cred, sizeof (KMF_CREDENTIAL));
        numattr++;
    }
    rv = kmf_create_sym_key(kmfhandle, numattr, attrlist);

    return (rv);
}

/*
 * Import objects from into KMF repositories.
 */
int
pk_import(int argc, char *argv[])
{
    int     opt;
    extern int  optind_av;
    extern char *optarg_av;
    char        *token_spec = NULL;
    char        *filename = NULL;
    char        *keyfile = NULL;
    char        *certfile = NULL;
    char        *crlfile = NULL;
    char        *label = NULL;
    char        *dir = NULL;
    char        *prefix = NULL;
    char        *trustflags = NULL;
    char        *verify_crl = NULL;
    char        *keytype = "generic";
    char        *senstr = NULL;
    char        *extstr = NULL;
    boolean_t   verify_crl_flag = B_FALSE;
    int     oclass = 0;
    KMF_KEYSTORE_TYPE   kstype = 0;
    KMF_ENCODE_FORMAT   kfmt = 0;
    KMF_ENCODE_FORMAT   okfmt = KMF_FORMAT_ASN1;
    KMF_RETURN      rv = KMF_OK;
    KMF_CREDENTIAL  pk12cred = { NULL, 0 };
    KMF_CREDENTIAL  tokencred = { NULL, 0 };
    KMF_HANDLE_T    kmfhandle = NULL;
    KMF_KEY_ALG keyAlg = KMF_GENERIC_SECRET;

    /* Parse command line options.  Do NOT i18n/l10n. */
    while ((opt = getopt_av(argc, argv,
        "T:(token)i:(infile)"
        "k:(keystore)y:(objtype)"
        "d:(dir)p:(prefix)"
        "n:(certlabel)N:(label)"
        "K:(outkey)c:(outcert)"
        "v:(verifycrl)l:(outcrl)"
        "E:(keytype)s:(sensitive)x:(extractable)"
        "t:(trust)F:(outformat)")) != EOF) {
        if (EMPTYSTRING(optarg_av))
            return (PK_ERR_USAGE);
        switch (opt) {
        case 'T':   /* token specifier */
            if (token_spec)
                return (PK_ERR_USAGE);
            token_spec = optarg_av;
            break;
        case 'c':   /* output cert file name */
            if (certfile)
                return (PK_ERR_USAGE);
            certfile = optarg_av;
            break;
        case 'l':   /* output CRL file name */
            if (crlfile)
                return (PK_ERR_USAGE);
            crlfile = optarg_av;
            break;
        case 'K':   /* output key file name */
            if (keyfile)
                return (PK_ERR_USAGE);
            keyfile = optarg_av;
            break;
        case 'i':   /* input file name */
            if (filename)
                return (PK_ERR_USAGE);
            filename = optarg_av;
            break;
        case 'k':
            kstype = KS2Int(optarg_av);
            if (kstype == 0)
                return (PK_ERR_USAGE);
            break;
        case 'y':
            oclass = OT2Int(optarg_av);
            if (oclass == -1)
                return (PK_ERR_USAGE);
            break;
        case 'd':
            dir = optarg_av;
            break;
        case 'p':
            if (prefix)
                return (PK_ERR_USAGE);
            prefix = optarg_av;
            break;
        case 'n':
        case 'N':
            if (label)
                return (PK_ERR_USAGE);
            label = optarg_av;
            break;
        case 'F':
            okfmt = Str2Format(optarg_av);
            if (okfmt == KMF_FORMAT_UNDEF)
                return (PK_ERR_USAGE);
            break;
        case 't':
            if (trustflags)
                return (PK_ERR_USAGE);
            trustflags = optarg_av;
            break;
        case 'v':
            verify_crl = optarg_av;
            if (tolower(verify_crl[0]) == 'y')
                verify_crl_flag = B_TRUE;
            else if (tolower(verify_crl[0]) == 'n')
                verify_crl_flag = B_FALSE;
            else
                return (PK_ERR_USAGE);
            break;
        case 'E':
            keytype = optarg_av;
            break;
        case 's':
            if (senstr)
                return (PK_ERR_USAGE);
            senstr = optarg_av;
            break;
        case 'x':
            if (extstr)
                return (PK_ERR_USAGE);
            extstr = optarg_av;
            break;
        default:
            return (PK_ERR_USAGE);
        }
    }

    /* Assume keystore = PKCS#11 if not specified */
    if (kstype == 0)
        kstype = KMF_KEYSTORE_PK11TOKEN;

    /* Filename arg is required. */
    if (EMPTYSTRING(filename)) {
        cryptoerror(LOG_STDERR, gettext("The 'infile' parameter"
            "is required for the import operation.\n"));
        return (PK_ERR_USAGE);
    }

    /* No additional args allowed. */
    argc -= optind_av;
    argv += optind_av;
    if (argc)
        return (PK_ERR_USAGE);

    DIR_OPTION_CHECK(kstype, dir);

    /* if PUBLIC or PRIVATE obj was given, the old syntax was used. */
    if ((oclass & (PK_PUBLIC_OBJ | PK_PRIVATE_OBJ)) &&
        kstype != KMF_KEYSTORE_PK11TOKEN) {

        (void) fprintf(stderr, gettext("The objtype parameter "
            "is only relevant if keystore=pkcs11\n"));
        return (PK_ERR_USAGE);
    }

    /*
     * You must specify a certlabel (cert label) when importing
     * into NSS or PKCS#11.
     */
    if (kstype == KMF_KEYSTORE_NSS &&
        (oclass != PK_CRL_OBJ) && EMPTYSTRING(label)) {
        cryptoerror(LOG_STDERR, gettext("The 'label' argument "
            "is required for this operation\n"));
        return (PK_ERR_USAGE);
    }

    if ((rv = kmf_get_file_format(filename, &kfmt)) != KMF_OK) {
        char *kmferrstr = NULL;
        KMF_RETURN rv2;
        /*
         * Allow for raw key data to be imported.
         */
        if (rv == KMF_ERR_ENCODING) {
            rv = KMF_OK;
            kfmt = KMF_FORMAT_RAWKEY;
            /*
             * Set the object class only if it was not
             * given on the command line or if it was
             * specified as a symmetric key object.
             */
            if (oclass == 0 || (oclass & PK_SYMKEY_OBJ)) {
                oclass = PK_SYMKEY_OBJ;
            } else {
                cryptoerror(LOG_STDERR, gettext(
                    "The input file does not contain the "
                    "object type indicated on command "
                    "line."));
                return (KMF_ERR_BAD_PARAMETER);
            }
        } else {
            if (rv == KMF_ERR_OPEN_FILE) {
                cryptoerror(LOG_STDERR,
                    gettext("Cannot open file (%s)\n."),
                    filename);
            } else {
                rv2 = kmf_get_kmf_error_str(rv, &kmferrstr);
                if (rv2 == KMF_OK && kmferrstr) {
                    cryptoerror(LOG_STDERR,
                        gettext("libkmf error: %s"),
                        kmferrstr);
                    kmf_free_str(kmferrstr);
                }
            }
            return (rv);
        }
    }

    /* Check parameters for raw key import operation */
    if (kfmt == KMF_FORMAT_RAWKEY) {
        if (keytype != NULL &&
            Str2SymKeyType(keytype, &keyAlg) != 0) {
            cryptoerror(LOG_STDERR,
                gettext("Unrecognized keytype(%s).\n"), keytype);
            return (PK_ERR_USAGE);
        }
        if (senstr != NULL && extstr != NULL &&
            kstype != KMF_KEYSTORE_PK11TOKEN) {
            cryptoerror(LOG_STDERR,
                gettext("The sensitive or extractable option "
                "applies only when importing a key from a file "
                "into a PKCS#11 keystore.\n"));
            return (PK_ERR_USAGE);
        }
    }

    /* If no objtype was given, treat it as a certificate */
    if (oclass == 0 && (kfmt == KMF_FORMAT_ASN1 ||
        kfmt == KMF_FORMAT_PEM))
        oclass = PK_CERT_OBJ;

    if (kstype == KMF_KEYSTORE_NSS) {
        if (oclass == PK_CRL_OBJ &&
            (kfmt != KMF_FORMAT_ASN1 && kfmt != KMF_FORMAT_PEM)) {
            cryptoerror(LOG_STDERR, gettext(
                "CRL data can only be imported as DER or "
                "PEM format"));
            return (PK_ERR_USAGE);
        }

        if (oclass == PK_CERT_OBJ &&
            (kfmt != KMF_FORMAT_ASN1 && kfmt != KMF_FORMAT_PEM)) {
            cryptoerror(LOG_STDERR, gettext(
                "Certificates can only be imported as DER or "
                "PEM format"));
            return (PK_ERR_USAGE);
        }

        /* we do not import private keys except in PKCS12 bundles */
        if (oclass & (PK_PRIVATE_OBJ | PK_PRIKEY_OBJ)) {
            cryptoerror(LOG_STDERR, gettext(
                "Private key data can only be imported as part "
                "of a PKCS12 file.\n"));
            return (PK_ERR_USAGE);
        }
    }

    if (kstype == KMF_KEYSTORE_OPENSSL && oclass != PK_CRL_OBJ) {
        if (EMPTYSTRING(keyfile) || EMPTYSTRING(certfile)) {
            cryptoerror(LOG_STDERR, gettext(
                "The 'outkey' and 'outcert' parameters "
                "are required for the import operation "
                "when the 'file' keystore is used.\n"));
            return (PK_ERR_USAGE);
        }
    }

    if (kstype == KMF_KEYSTORE_PK11TOKEN && EMPTYSTRING(token_spec))
        token_spec = PK_DEFAULT_PK11TOKEN;
    else if (kstype == KMF_KEYSTORE_NSS && EMPTYSTRING(token_spec))
        token_spec = DEFAULT_NSS_TOKEN;

    if (kfmt == KMF_FORMAT_PKCS12) {
        (void) get_pk12_password(&pk12cred);
    }

    if ((kfmt == KMF_FORMAT_PKCS12 || kfmt == KMF_FORMAT_RAWKEY ||
        (kfmt == KMF_FORMAT_PEM && (oclass & PK_KEY_OBJ))) &&
        (kstype == KMF_KEYSTORE_PK11TOKEN || kstype == KMF_KEYSTORE_NSS)) {
        (void) get_token_password(kstype, token_spec, &tokencred);
    }

    if ((rv = kmf_initialize(&kmfhandle, NULL, NULL)) != KMF_OK) {
        cryptoerror(LOG_STDERR, gettext("Error initializing "
            "KMF: 0x%02x\n"), rv);
        goto end;
    }

    switch (kstype) {
        case KMF_KEYSTORE_PK11TOKEN:
            if (kfmt == KMF_FORMAT_PKCS12)
                rv = pk_import_pk12_pk11(
                    kmfhandle, &pk12cred,
                    &tokencred, label,
                    token_spec, filename);
            else if (oclass == PK_CERT_OBJ)
                rv = pk_import_cert(
                    kmfhandle, kstype,
                    label, token_spec,
                    filename,
                    NULL, NULL, NULL);
            else if (oclass == PK_CRL_OBJ)
                rv = pk_import_file_crl(
                    kmfhandle, filename,
                    crlfile, okfmt);
            else if (kfmt == KMF_FORMAT_RAWKEY &&
                oclass == PK_SYMKEY_OBJ) {
                rv = pk_import_rawkey(kmfhandle,
                    kstype, token_spec, &tokencred,
                    filename, label,
                    keyAlg, senstr, extstr);
            } else if (kfmt == KMF_FORMAT_PEM ||
                kfmt == KMF_FORMAT_PEM_KEYPAIR) {
                rv = pk_import_keys(kmfhandle,
                    kstype, token_spec, &tokencred,
                    filename, label, senstr, extstr);
            } else {
                rv = PK_ERR_USAGE;
            }
            break;
        case KMF_KEYSTORE_NSS:
            if (dir == NULL)
                dir = PK_DEFAULT_DIRECTORY;
            if (kfmt == KMF_FORMAT_PKCS12)
                rv = pk_import_pk12_nss(
                    kmfhandle, &pk12cred,
                    &tokencred,
                    token_spec, dir, prefix,
                    label, trustflags, filename);
            else if (oclass == PK_CERT_OBJ) {
                rv = pk_import_cert(
                    kmfhandle, kstype,
                    label, token_spec,
                    filename, dir, prefix, trustflags);
            } else if (oclass == PK_CRL_OBJ) {
                rv = pk_import_nss_crl(
                    kmfhandle, verify_crl_flag,
                    filename, dir, prefix);
            }
            break;
        case KMF_KEYSTORE_OPENSSL:
            if (kfmt == KMF_FORMAT_PKCS12)
                rv = pk_import_pk12_files(
                    kmfhandle, &pk12cred,
                    filename, certfile, keyfile,
                    okfmt);
            else if (oclass == PK_CRL_OBJ) {
                rv = pk_import_file_crl(
                    kmfhandle, filename,
                    crlfile, okfmt);
            } else
                /*
                 * It doesn't make sense to import anything
                 * else for the files plugin.
                 */
                return (PK_ERR_USAGE);
            break;
        default:
            rv = PK_ERR_USAGE;
            break;
    }

end:
    if (rv != KMF_OK)
        display_error(kmfhandle, rv,
            gettext("Error importing objects"));

    if (tokencred.cred != NULL)
        free(tokencred.cred);

    if (pk12cred.cred != NULL)
        free(pk12cred.cred);

    (void) kmf_finalize(kmfhandle);

    if (rv != KMF_OK)
        return (PK_ERR_USAGE);

    return (0);
}