kssl/kssladm/kssladm_create.c

	kssladm_create.c revision 164c0dd6f561db19bdaf1d0b7f2a8dec44355b69
c28749e97052f09388969427adf7df641cdcdc22kais/*
c28749e97052f09388969427adf7df641cdcdc22kais * CDDL HEADER START
c28749e97052f09388969427adf7df641cdcdc22kais *
c28749e97052f09388969427adf7df641cdcdc22kais * The contents of this file are subject to the terms of the
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna * Common Development and Distribution License (the "License").
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna * You may not use this file except in compliance with the License.
c28749e97052f09388969427adf7df641cdcdc22kais *
c28749e97052f09388969427adf7df641cdcdc22kais * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
c28749e97052f09388969427adf7df641cdcdc22kais * or http://www.opensolaris.org/os/licensing.
c28749e97052f09388969427adf7df641cdcdc22kais * See the License for the specific language governing permissions
c28749e97052f09388969427adf7df641cdcdc22kais * and limitations under the License.
c28749e97052f09388969427adf7df641cdcdc22kais *
c28749e97052f09388969427adf7df641cdcdc22kais * When distributing Covered Code, include this CDDL HEADER in each
c28749e97052f09388969427adf7df641cdcdc22kais * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
c28749e97052f09388969427adf7df641cdcdc22kais * If applicable, add the following below this CDDL HEADER, with the
c28749e97052f09388969427adf7df641cdcdc22kais * fields enclosed by brackets "[]" replaced with your own identifying
c28749e97052f09388969427adf7df641cdcdc22kais * information: Portions Copyright [yyyy] [name of copyright owner]
c28749e97052f09388969427adf7df641cdcdc22kais *
c28749e97052f09388969427adf7df641cdcdc22kais * CDDL HEADER END
c28749e97052f09388969427adf7df641cdcdc22kais */
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna
c28749e97052f09388969427adf7df641cdcdc22kais/*
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna * Copyright 2006 Sun Microsystems, Inc.  All rights reserved.
c28749e97052f09388969427adf7df641cdcdc22kais * Use is subject to license terms.
c28749e97052f09388969427adf7df641cdcdc22kais */
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais#pragma ident   "%Z%%M% %I% %E% SMI"
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais#include <arpa/inet.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <errno.h>
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna#include <sys/sysmacros.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <netdb.h> /* hostent */
c28749e97052f09388969427adf7df641cdcdc22kais#include <netinet/in.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <openssl/rsa.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <security/cryptoki.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <security/pkcs11.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <cryptoutil.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <stdio.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <strings.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <sys/socket.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <libscf.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include <inet/kssl/kssl.h>
c28749e97052f09388969427adf7df641cdcdc22kais#include "kssladm.h"
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kaisvoid
c28749e97052f09388969427adf7df641cdcdc22kaisusage_create(boolean_t do_print)
c28749e97052f09388969427adf7df641cdcdc22kais{
c28749e97052f09388969427adf7df641cdcdc22kais    if (do_print)
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr, "Usage:\n");
c28749e97052f09388969427adf7df641cdcdc22kais    (void) fprintf(stderr, "kssladm create"
c28749e97052f09388969427adf7df641cdcdc22kais        " -f pkcs11 [-d softtoken_directory] -T <token_label>"
c28749e97052f09388969427adf7df641cdcdc22kais        " -C <certificate_label> -x <proxy_port>"
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        " [-h <ca_certchain_file>]"
c28749e97052f09388969427adf7df641cdcdc22kais        " [options] [<server_address>] [<server_port>]\n");
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    (void) fprintf(stderr, "kssladm create"
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        " -f pkcs12 -i <cert_and_key_pk12file> -x <proxy_port>"
c28749e97052f09388969427adf7df641cdcdc22kais        " [options] [<server_address>] [<server_port>]\n");
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    (void) fprintf(stderr, "kssladm create"
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        " -f pem -i <cert_and_key_pemfile> -x <proxy_port>"
c28749e97052f09388969427adf7df641cdcdc22kais        " [options] [<server_address>] [<server_port>]\n");
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    (void) fprintf(stderr, "options are:\n"
c28749e97052f09388969427adf7df641cdcdc22kais        "\t[-c <ciphersuites>]\n"
c28749e97052f09388969427adf7df641cdcdc22kais        "\t[-p <password_file>]\n"
c28749e97052f09388969427adf7df641cdcdc22kais        "\t[-t <ssl_session_cache_timeout>]\n"
c28749e97052f09388969427adf7df641cdcdc22kais        "\t[-z <ssl_session_cache_size>]\n"
c28749e97052f09388969427adf7df641cdcdc22kais        "\t[-v]\n");
c28749e97052f09388969427adf7df641cdcdc22kais}
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kaisstatic uchar_t *
c28749e97052f09388969427adf7df641cdcdc22kaisget_cert_val(CK_SESSION_HANDLE sess, CK_OBJECT_HANDLE cert_obj, int *len)
c28749e97052f09388969427adf7df641cdcdc22kais{
c28749e97052f09388969427adf7df641cdcdc22kais    CK_RV rv;
c28749e97052f09388969427adf7df641cdcdc22kais    uchar_t *buf;
c28749e97052f09388969427adf7df641cdcdc22kais    CK_ATTRIBUTE cert_attrs[] = {{CKA_VALUE, NULL, 0}};
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    /* the certs ... */
c28749e97052f09388969427adf7df641cdcdc22kais    rv = C_GetAttributeValue(sess, cert_obj, cert_attrs, 1);
c28749e97052f09388969427adf7df641cdcdc22kais    if (rv != CKR_OK) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr, "Cannot get cert size."
c28749e97052f09388969427adf7df641cdcdc22kais            " error = %s\n", pkcs11_strerror(rv));
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    buf = malloc(cert_attrs[0].ulValueLen);
c28749e97052f09388969427adf7df641cdcdc22kais    if (buf == NULL)
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    cert_attrs[0].pValue = buf;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    rv = C_GetAttributeValue(sess, cert_obj, cert_attrs, 1);
c28749e97052f09388969427adf7df641cdcdc22kais    if (rv != CKR_OK) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr, "Cannot get cert value."
c28749e97052f09388969427adf7df641cdcdc22kais            " error = %s\n", pkcs11_strerror(rv));
c28749e97052f09388969427adf7df641cdcdc22kais        free(buf);
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    *len = cert_attrs[0].ulValueLen;
c28749e97052f09388969427adf7df641cdcdc22kais    return (buf);
c28749e97052f09388969427adf7df641cdcdc22kais}
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais#define REQ_ATTR_CNT    2
c28749e97052f09388969427adf7df641cdcdc22kais#define OPT_ATTR_CNT    6
c28749e97052f09388969427adf7df641cdcdc22kais#define MAX_ATTR_CNT    (REQ_ATTR_CNT + OPT_ATTR_CNT)
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais/*
c28749e97052f09388969427adf7df641cdcdc22kais * Everything is allocated in one single contiguous buffer.
c28749e97052f09388969427adf7df641cdcdc22kais * The layout is the following:
c28749e97052f09388969427adf7df641cdcdc22kais * . the kssl_params_t structure
c28749e97052f09388969427adf7df641cdcdc22kais * . the array of key attribute structs, (value of ck_attrs)
c28749e97052f09388969427adf7df641cdcdc22kais * . the key attributes values (values of ck_attrs[i].ck_value);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna * . the array of sizes of the certificates, (referred to as sc_sizes[])
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna * . the certificates values (referred to as sc_certs[])
c28749e97052f09388969427adf7df641cdcdc22kais *
c28749e97052f09388969427adf7df641cdcdc22kais * The address of the certs and key attributes values are offsets
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna * from the beginning of the big buffer. sc_sizes_offset points
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna * to sc_sizes[0] and sc_certs_offset points to sc_certs[0].
c28749e97052f09388969427adf7df641cdcdc22kais */
c28749e97052f09388969427adf7df641cdcdc22kaisstatic kssl_params_t *
c28749e97052f09388969427adf7df641cdcdc22kaispkcs11_to_kssl(CK_SESSION_HANDLE sess, CK_OBJECT_HANDLE privkey_obj,
c28749e97052f09388969427adf7df641cdcdc22kais    CK_OBJECT_HANDLE cert_obj, int *paramsize)
c28749e97052f09388969427adf7df641cdcdc22kais{
c28749e97052f09388969427adf7df641cdcdc22kais    int i;
c28749e97052f09388969427adf7df641cdcdc22kais    CK_RV rv;
c28749e97052f09388969427adf7df641cdcdc22kais    CK_ATTRIBUTE privkey_attrs[MAX_ATTR_CNT] = {
c28749e97052f09388969427adf7df641cdcdc22kais        {CKA_MODULUS, NULL_PTR, 0},
c28749e97052f09388969427adf7df641cdcdc22kais        {CKA_PRIVATE_EXPONENT, NULL_PTR, 0}
c28749e97052f09388969427adf7df641cdcdc22kais    };
c28749e97052f09388969427adf7df641cdcdc22kais    CK_ATTRIBUTE privkey_opt_attrs[OPT_ATTR_CNT] = {
c28749e97052f09388969427adf7df641cdcdc22kais        {CKA_PUBLIC_EXPONENT, NULL_PTR, 0},
c28749e97052f09388969427adf7df641cdcdc22kais        {CKA_PRIME_1, NULL_PTR, 0},
c28749e97052f09388969427adf7df641cdcdc22kais        {CKA_PRIME_2, NULL_PTR, 0},
c28749e97052f09388969427adf7df641cdcdc22kais        {CKA_EXPONENT_1, NULL_PTR, 0},
c28749e97052f09388969427adf7df641cdcdc22kais        {CKA_EXPONENT_2, NULL_PTR, 0},
c28749e97052f09388969427adf7df641cdcdc22kais        {CKA_COEFFICIENT, NULL_PTR, 0}
c28749e97052f09388969427adf7df641cdcdc22kais    };
c28749e97052f09388969427adf7df641cdcdc22kais    CK_ATTRIBUTE cert_attrs[] = { {CKA_VALUE, NULL, 0} };
c28749e97052f09388969427adf7df641cdcdc22kais    kssl_object_attribute_t kssl_attrs[MAX_ATTR_CNT];
c28749e97052f09388969427adf7df641cdcdc22kais    kssl_params_t *kssl_params;
c28749e97052f09388969427adf7df641cdcdc22kais    kssl_key_t *key;
c28749e97052f09388969427adf7df641cdcdc22kais    char *buf;
c28749e97052f09388969427adf7df641cdcdc22kais    uint32_t cert_size, bufsize;
c28749e97052f09388969427adf7df641cdcdc22kais    int attr_cnt;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    /* the certs ... */
c28749e97052f09388969427adf7df641cdcdc22kais    rv = C_GetAttributeValue(sess, cert_obj, cert_attrs, 1);
c28749e97052f09388969427adf7df641cdcdc22kais    if (rv != CKR_OK) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr, "Cannot get cert size."
c28749e97052f09388969427adf7df641cdcdc22kais            " error = %s\n", pkcs11_strerror(rv));
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    /* Get the sizes */
c28749e97052f09388969427adf7df641cdcdc22kais    bufsize = sizeof (kssl_params_t);
c28749e97052f09388969427adf7df641cdcdc22kais    cert_size = (uint32_t)cert_attrs[0].ulValueLen;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    bufsize += cert_size + MAX_CHAIN_LENGTH * sizeof (uint32_t);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    /* and the required key attributes */
c28749e97052f09388969427adf7df641cdcdc22kais    rv = C_GetAttributeValue(sess, privkey_obj, privkey_attrs,
c28749e97052f09388969427adf7df641cdcdc22kais        REQ_ATTR_CNT);
c28749e97052f09388969427adf7df641cdcdc22kais    if (rv != CKR_OK) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr,
c28749e97052f09388969427adf7df641cdcdc22kais            "Cannot get private key object attributes. error = %s\n",
c28749e97052f09388969427adf7df641cdcdc22kais            pkcs11_strerror(rv));
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais    for (i = 0; i < REQ_ATTR_CNT; i++) {
c28749e97052f09388969427adf7df641cdcdc22kais        bufsize += sizeof (crypto_object_attribute_t) +
c28749e97052f09388969427adf7df641cdcdc22kais            privkey_attrs[i].ulValueLen;
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais    attr_cnt = REQ_ATTR_CNT;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    /*
c28749e97052f09388969427adf7df641cdcdc22kais     * Get the optional key attributes. The return values could be
c28749e97052f09388969427adf7df641cdcdc22kais     * CKR_ATTRIBUTE_TYPE_INVALID with ulValueLen set to -1 OR
c28749e97052f09388969427adf7df641cdcdc22kais     * CKR_OK with ulValueLen set to 0. The latter is done by
c28749e97052f09388969427adf7df641cdcdc22kais     * soft token and seems dubious.
c28749e97052f09388969427adf7df641cdcdc22kais     */
c28749e97052f09388969427adf7df641cdcdc22kais    rv = C_GetAttributeValue(sess, privkey_obj, privkey_opt_attrs,
c28749e97052f09388969427adf7df641cdcdc22kais        OPT_ATTR_CNT);
c28749e97052f09388969427adf7df641cdcdc22kais    if (rv != CKR_OK && rv != CKR_ATTRIBUTE_TYPE_INVALID) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr,
c28749e97052f09388969427adf7df641cdcdc22kais            "Cannot get private key object attributes. error = %s\n",
c28749e97052f09388969427adf7df641cdcdc22kais            pkcs11_strerror(rv));
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais    for (i = 0; i < OPT_ATTR_CNT; i++) {
c28749e97052f09388969427adf7df641cdcdc22kais        if (privkey_opt_attrs[i].ulValueLen == (CK_ULONG)-1 ||
c28749e97052f09388969427adf7df641cdcdc22kais            privkey_opt_attrs[i].ulValueLen == 0)
c28749e97052f09388969427adf7df641cdcdc22kais            continue;
c28749e97052f09388969427adf7df641cdcdc22kais        /* Structure copy */
c28749e97052f09388969427adf7df641cdcdc22kais        privkey_attrs[attr_cnt] = privkey_opt_attrs[i];
c28749e97052f09388969427adf7df641cdcdc22kais        bufsize += sizeof (crypto_object_attribute_t) +
c28749e97052f09388969427adf7df641cdcdc22kais            privkey_opt_attrs[i].ulValueLen;
c28749e97052f09388969427adf7df641cdcdc22kais        attr_cnt++;
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    /* Add 4-byte cushion as sc_sizes[0] needs 32-bit aligment */
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    bufsize += sizeof (uint32_t);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna
c28749e97052f09388969427adf7df641cdcdc22kais    /* Now the big memory allocation */
c28749e97052f09388969427adf7df641cdcdc22kais    if ((buf = calloc(bufsize, 1)) == NULL) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr,
c28749e97052f09388969427adf7df641cdcdc22kais            "Cannot allocate memory for the kssl_params "
c28749e97052f09388969427adf7df641cdcdc22kais            "and values\n");
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    /* LINTED */
c28749e97052f09388969427adf7df641cdcdc22kais    kssl_params = (kssl_params_t *)buf;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    buf = (char *)(kssl_params + 1);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    /* the keys attributes structs array */
c28749e97052f09388969427adf7df641cdcdc22kais    key = &kssl_params->kssl_privkey;
c28749e97052f09388969427adf7df641cdcdc22kais    key->ks_format = CRYPTO_KEY_ATTR_LIST;
c28749e97052f09388969427adf7df641cdcdc22kais    key->ks_count = attr_cnt;
c28749e97052f09388969427adf7df641cdcdc22kais    key->ks_attrs_offset = buf - (char *)kssl_params;
c28749e97052f09388969427adf7df641cdcdc22kais    buf += attr_cnt * sizeof (kssl_object_attribute_t);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    /* then the attributes values */
c28749e97052f09388969427adf7df641cdcdc22kais    for (i = 0; i < attr_cnt; i++) {
c28749e97052f09388969427adf7df641cdcdc22kais        privkey_attrs[i].pValue = buf;
c28749e97052f09388969427adf7df641cdcdc22kais        /*
c28749e97052f09388969427adf7df641cdcdc22kais         * We assume the attribute types in the kernel are
c28749e97052f09388969427adf7df641cdcdc22kais         * the same as the PKCS #11 values.
c28749e97052f09388969427adf7df641cdcdc22kais         */
c28749e97052f09388969427adf7df641cdcdc22kais        kssl_attrs[i].ka_type = privkey_attrs[i].type;
c28749e97052f09388969427adf7df641cdcdc22kais        kssl_attrs[i].ka_value_offset = buf - (char *)kssl_params;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais        kssl_attrs[i].ka_value_len = privkey_attrs[i].ulValueLen;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais        buf += privkey_attrs[i].ulValueLen;
c28749e97052f09388969427adf7df641cdcdc22kais    }
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna
c28749e97052f09388969427adf7df641cdcdc22kais    /* then the key attributes values */
c28749e97052f09388969427adf7df641cdcdc22kais    rv = C_GetAttributeValue(sess, privkey_obj, privkey_attrs, attr_cnt);
c28749e97052f09388969427adf7df641cdcdc22kais    if (rv != CKR_OK) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr,
c28749e97052f09388969427adf7df641cdcdc22kais            "Cannot get private key object attributes."
c28749e97052f09388969427adf7df641cdcdc22kais            " error = %s\n", pkcs11_strerror(rv));
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    bcopy(kssl_attrs, ((char *)kssl_params) + key->ks_attrs_offset,
c28749e97052f09388969427adf7df641cdcdc22kais        attr_cnt * sizeof (kssl_object_attribute_t));
c28749e97052f09388969427adf7df641cdcdc22kais
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    buf = (char *)P2ROUNDUP((uintptr_t)buf, sizeof (uint32_t));
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    kssl_params->kssl_certs.sc_count = 1;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    bcopy(&cert_size, buf, sizeof (uint32_t));
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    kssl_params->kssl_certs.sc_sizes_offset = buf - (char *)kssl_params;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    buf += MAX_CHAIN_LENGTH * sizeof (uint32_t);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    /* now the certs values */
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    cert_attrs[0].pValue = buf;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    kssl_params->kssl_certs.sc_certs_offset = buf - (char *)kssl_params;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    buf += cert_attrs[0].ulValueLen;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    rv = C_GetAttributeValue(sess, cert_obj, cert_attrs, 1);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    if (rv != CKR_OK) {
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        (void) fprintf(stderr, "Cannot get cert value."
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna            " error = %s\n", pkcs11_strerror(rv));
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        return (NULL);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    }
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna
c28749e97052f09388969427adf7df641cdcdc22kais    *paramsize = bufsize;
c28749e97052f09388969427adf7df641cdcdc22kais    return (kssl_params);
c28749e97052f09388969427adf7df641cdcdc22kais}
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais#define max_num_cert 32
c28749e97052f09388969427adf7df641cdcdc22kais
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishnastatic kssl_params_t *
c28749e97052f09388969427adf7df641cdcdc22kaisload_from_pkcs11(const char *token_label, const char *password_file,
c28749e97052f09388969427adf7df641cdcdc22kais    const char *certname, int *bufsize)
c28749e97052f09388969427adf7df641cdcdc22kais{
c28749e97052f09388969427adf7df641cdcdc22kais    static CK_BBOOL true = TRUE;
c28749e97052f09388969427adf7df641cdcdc22kais    static CK_BBOOL false = FALSE;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    CK_RV rv;
c28749e97052f09388969427adf7df641cdcdc22kais    CK_SLOT_ID slot;
c28749e97052f09388969427adf7df641cdcdc22kais    CK_SLOT_ID_PTR  pk11_slots;
c28749e97052f09388969427adf7df641cdcdc22kais    CK_ULONG slotcnt = 10;
c28749e97052f09388969427adf7df641cdcdc22kais    CK_TOKEN_INFO   token_info;
c28749e97052f09388969427adf7df641cdcdc22kais    CK_SESSION_HANDLE sess;
c28749e97052f09388969427adf7df641cdcdc22kais    static CK_OBJECT_CLASS cert_class = CKO_CERTIFICATE;
c28749e97052f09388969427adf7df641cdcdc22kais    static CK_CERTIFICATE_TYPE cert_type = CKC_X_509;
c28749e97052f09388969427adf7df641cdcdc22kais    CK_ATTRIBUTE cert_tmpl[4] = {
c28749e97052f09388969427adf7df641cdcdc22kais        {CKA_TOKEN, &true, sizeof (true)},
c28749e97052f09388969427adf7df641cdcdc22kais        {CKA_LABEL, NULL, 0},
c28749e97052f09388969427adf7df641cdcdc22kais        {CKA_CLASS, &cert_class, sizeof (cert_class)},
c28749e97052f09388969427adf7df641cdcdc22kais        {CKA_CERTIFICATE_TYPE, &cert_type, sizeof (cert_type)}
c28749e97052f09388969427adf7df641cdcdc22kais    };
c28749e97052f09388969427adf7df641cdcdc22kais    CK_ULONG cert_tmpl_count = 4, cert_obj_count = 1;
c28749e97052f09388969427adf7df641cdcdc22kais    CK_OBJECT_HANDLE cert_obj, privkey_obj;
c28749e97052f09388969427adf7df641cdcdc22kais    CK_OBJECT_HANDLE cert_objs[max_num_cert];
c28749e97052f09388969427adf7df641cdcdc22kais    static CK_OBJECT_CLASS privkey_class = CKO_PRIVATE_KEY;
c28749e97052f09388969427adf7df641cdcdc22kais    static CK_KEY_TYPE privkey_type = CKK_RSA;
c28749e97052f09388969427adf7df641cdcdc22kais    CK_ATTRIBUTE privkey_tmpl[] = {
c28749e97052f09388969427adf7df641cdcdc22kais        {CKA_MODULUS, NULL, 0},
c28749e97052f09388969427adf7df641cdcdc22kais        {CKA_TOKEN, &true, sizeof (true)},
c28749e97052f09388969427adf7df641cdcdc22kais        {CKA_CLASS, &privkey_class, sizeof (privkey_class)},
c28749e97052f09388969427adf7df641cdcdc22kais        {CKA_KEY_TYPE, &privkey_type, sizeof (privkey_type)}
c28749e97052f09388969427adf7df641cdcdc22kais    };
c28749e97052f09388969427adf7df641cdcdc22kais    CK_ULONG privkey_tmpl_count = 4, privkey_obj_count = 1;
c28749e97052f09388969427adf7df641cdcdc22kais    static CK_BYTE modulus[1024];
c28749e97052f09388969427adf7df641cdcdc22kais    CK_ATTRIBUTE privkey_attrs[1] = {
c28749e97052f09388969427adf7df641cdcdc22kais        {CKA_MODULUS, modulus, sizeof (modulus)},
c28749e97052f09388969427adf7df641cdcdc22kais    };
c28749e97052f09388969427adf7df641cdcdc22kais    boolean_t bingo = B_FALSE;
c28749e97052f09388969427adf7df641cdcdc22kais    int blen, mlen;
c28749e97052f09388969427adf7df641cdcdc22kais    uchar_t *mval, *ber_buf;
c28749e97052f09388969427adf7df641cdcdc22kais    char token_label_padded[sizeof (token_info.label) + 1];
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    (void) snprintf(token_label_padded, sizeof (token_label_padded),
c28749e97052f09388969427adf7df641cdcdc22kais        "%-32s", token_label);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    rv = C_Initialize(NULL_PTR);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    if ((rv != CKR_OK) && (rv != CKR_CRYPTOKI_ALREADY_INITIALIZED)) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr,
c28749e97052f09388969427adf7df641cdcdc22kais            "Cannot initialize PKCS#11. error = %s\n",
c28749e97052f09388969427adf7df641cdcdc22kais            pkcs11_strerror(rv));
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    /* Get slot count */
c28749e97052f09388969427adf7df641cdcdc22kais    rv = C_GetSlotList(1, NULL_PTR, &slotcnt);
c28749e97052f09388969427adf7df641cdcdc22kais    if (rv != CKR_OK || slotcnt == 0) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr,
c28749e97052f09388969427adf7df641cdcdc22kais            "Cannot get PKCS#11 slot list. error = %s\n",
c28749e97052f09388969427adf7df641cdcdc22kais            pkcs11_strerror(rv));
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    pk11_slots = calloc(slotcnt, sizeof (CK_SLOT_ID));
c28749e97052f09388969427adf7df641cdcdc22kais    if (pk11_slots == NULL) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr,
c28749e97052f09388969427adf7df641cdcdc22kais            "Cannot get memory for %ld slots\n", slotcnt);
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    rv = C_GetSlotList(1, pk11_slots, &slotcnt);
c28749e97052f09388969427adf7df641cdcdc22kais    if (rv != CKR_OK) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr,
c28749e97052f09388969427adf7df641cdcdc22kais            "Cannot get PKCS#11 slot list. error = %s\n",
c28749e97052f09388969427adf7df641cdcdc22kais            pkcs11_strerror(rv));
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    if (verbose)
c28749e97052f09388969427adf7df641cdcdc22kais        (void) printf("Found %ld slots\n", slotcnt);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    /* Search the token that matches the label */
c28749e97052f09388969427adf7df641cdcdc22kais    while (slotcnt > 0) {
c28749e97052f09388969427adf7df641cdcdc22kais        rv = C_GetTokenInfo(pk11_slots[--slotcnt], &token_info);
c28749e97052f09388969427adf7df641cdcdc22kais        if (rv != CKR_OK)
c28749e97052f09388969427adf7df641cdcdc22kais            continue;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais        if (verbose)
c28749e97052f09388969427adf7df641cdcdc22kais            (void) printf("slot [%ld] = %s\n",
c28749e97052f09388969427adf7df641cdcdc22kais                slotcnt, token_info.label);
c28749e97052f09388969427adf7df641cdcdc22kais        if (memcmp(token_label_padded, token_info.label,
c28749e97052f09388969427adf7df641cdcdc22kais            sizeof (token_info.label)) == 0) {
c28749e97052f09388969427adf7df641cdcdc22kais            bingo = B_TRUE;
c28749e97052f09388969427adf7df641cdcdc22kais            slot = pk11_slots[slotcnt];
c28749e97052f09388969427adf7df641cdcdc22kais            break;
c28749e97052f09388969427adf7df641cdcdc22kais        }
c28749e97052f09388969427adf7df641cdcdc22kais        if (verbose) {
c28749e97052f09388969427adf7df641cdcdc22kais            token_info.label[31] = '\0';
c28749e97052f09388969427adf7df641cdcdc22kais            (void) printf("found slot [%s]\n", token_info.label);
c28749e97052f09388969427adf7df641cdcdc22kais        }
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    if (!bingo) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr, "no matching PKCS#11 token found\n");
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    rv = C_OpenSession(slot, CKF_SERIAL_SESSION, NULL_PTR, NULL_PTR,
c28749e97052f09388969427adf7df641cdcdc22kais        &sess);
c28749e97052f09388969427adf7df641cdcdc22kais    if (rv != CKR_OK) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr, "Cannot open session. error = %s\n",
c28749e97052f09388969427adf7df641cdcdc22kais            pkcs11_strerror(rv));
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    cert_tmpl[1].pValue = (CK_VOID_PTR) certname;
c28749e97052f09388969427adf7df641cdcdc22kais    cert_tmpl[1].ulValueLen = strlen(certname);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    rv = C_FindObjectsInit(sess, cert_tmpl, cert_tmpl_count);
c28749e97052f09388969427adf7df641cdcdc22kais    if (rv != CKR_OK) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr,
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna            "Cannot initialize cert search."
c28749e97052f09388969427adf7df641cdcdc22kais            " error = %s\n", pkcs11_strerror(rv));
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    rv = C_FindObjects(sess, cert_objs,
c28749e97052f09388969427adf7df641cdcdc22kais        (certname == NULL ? 1 : max_num_cert), &cert_obj_count);
c28749e97052f09388969427adf7df641cdcdc22kais    if (rv != CKR_OK) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr,
c28749e97052f09388969427adf7df641cdcdc22kais            "Cannot retrieve cert object. error = %s\n",
c28749e97052f09388969427adf7df641cdcdc22kais            pkcs11_strerror(rv));
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    /* Who cares if this fails! */
c28749e97052f09388969427adf7df641cdcdc22kais    (void) C_FindObjectsFinal(sess);
c28749e97052f09388969427adf7df641cdcdc22kais    if (verbose)
c28749e97052f09388969427adf7df641cdcdc22kais        (void) printf("found %ld certificates\n", cert_obj_count);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    if (cert_obj_count == 0) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr, "\"%s\" not found.\n", certname);
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr, "no certs. bye.\n");
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    cert_obj = cert_objs[0];
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    /* Get the modulus value from the certificate */
c28749e97052f09388969427adf7df641cdcdc22kais    ber_buf = get_cert_val(sess, cert_obj, &blen);
c28749e97052f09388969427adf7df641cdcdc22kais    if (ber_buf == NULL) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr,
c28749e97052f09388969427adf7df641cdcdc22kais            "Cannot get certificate data for \"%s\".\n", certname);
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    mval = get_modulus(ber_buf, blen, &mlen);
c28749e97052f09388969427adf7df641cdcdc22kais    if (mval == NULL) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr,
c28749e97052f09388969427adf7df641cdcdc22kais            "Cannot get Modulus in certificate \"%s\".\n", certname);
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    /* Now get the private key */
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    /* Gotta authenticate first if login is required. */
c28749e97052f09388969427adf7df641cdcdc22kais    if (token_info.flags & CKF_LOGIN_REQUIRED) {
c28749e97052f09388969427adf7df641cdcdc22kais        char passphrase[1024];
c28749e97052f09388969427adf7df641cdcdc22kais        CK_ULONG ulPinLen;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais        ulPinLen = get_passphrase(
c28749e97052f09388969427adf7df641cdcdc22kais            password_file, passphrase, sizeof (passphrase));
c28749e97052f09388969427adf7df641cdcdc22kais        if (ulPinLen == 0) {
c28749e97052f09388969427adf7df641cdcdc22kais            (void) fprintf(stderr, "Unable to read passphrase");
c28749e97052f09388969427adf7df641cdcdc22kais            return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais        }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais        rv = C_Login(sess, CKU_USER, (CK_UTF8CHAR_PTR)passphrase,
c28749e97052f09388969427adf7df641cdcdc22kais            ulPinLen);
c28749e97052f09388969427adf7df641cdcdc22kais        if (rv != CKR_OK) {
c28749e97052f09388969427adf7df641cdcdc22kais            (void) fprintf(stderr, "Cannot login to the token."
c28749e97052f09388969427adf7df641cdcdc22kais                " error = %s\n", pkcs11_strerror(rv));
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais        }
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    privkey_tmpl[0].pValue = mval;
c28749e97052f09388969427adf7df641cdcdc22kais    privkey_tmpl[0].ulValueLen = mlen;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    rv = C_FindObjectsInit(sess, privkey_tmpl, privkey_tmpl_count);
c28749e97052f09388969427adf7df641cdcdc22kais    if (rv != CKR_OK) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr, "Cannot intialize private key search."
c28749e97052f09388969427adf7df641cdcdc22kais            " error = %s\n", pkcs11_strerror(rv));
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    rv = C_FindObjects(sess, &privkey_obj, 1,  &privkey_obj_count);
c28749e97052f09388969427adf7df641cdcdc22kais    if (rv != CKR_OK) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr, "Cannot retrieve private key object "
c28749e97052f09388969427adf7df641cdcdc22kais            " error = %s\n", pkcs11_strerror(rv));
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais    /* Who cares if this fails! */
c28749e97052f09388969427adf7df641cdcdc22kais    (void) C_FindObjectsFinal(sess);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    (void) printf("found %ld private keys\n", privkey_obj_count);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    if (privkey_obj_count == 0) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr, "no private keys. bye.\n");
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    rv = C_GetAttributeValue(sess, privkey_obj, privkey_attrs, 1);
c28749e97052f09388969427adf7df641cdcdc22kais    if (rv != CKR_OK) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr,
c28749e97052f09388969427adf7df641cdcdc22kais            "Cannot get private key object attributes."
c28749e97052f09388969427adf7df641cdcdc22kais            " error = %s\n", pkcs11_strerror(rv));
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    if (verbose) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) printf("private key attributes:    \n");
c28749e97052f09388969427adf7df641cdcdc22kais        (void) printf("\tmodulus: size %ld value:",
c28749e97052f09388969427adf7df641cdcdc22kais            privkey_attrs[0].ulValueLen);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    /* Now wrap the key, then unwrap it */
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    {
c28749e97052f09388969427adf7df641cdcdc22kais    CK_BYTE aes_key_val[16] = {
c28749e97052f09388969427adf7df641cdcdc22kais        1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16};
c28749e97052f09388969427adf7df641cdcdc22kais    static CK_BYTE aes_param[16] = {
c28749e97052f09388969427adf7df641cdcdc22kais        0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0};
c28749e97052f09388969427adf7df641cdcdc22kais    CK_MECHANISM aes_cbc_pad_mech = {CKM_AES_CBC_PAD, aes_param, 16};
c28749e97052f09388969427adf7df641cdcdc22kais    CK_OBJECT_HANDLE aes_key_obj, sess_privkey_obj;
c28749e97052f09388969427adf7df641cdcdc22kais    CK_BYTE *wrapped_privkey;
c28749e97052f09388969427adf7df641cdcdc22kais    CK_ULONG wrapped_privkey_len;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    CK_ATTRIBUTE unwrap_tmpl[] = {
c28749e97052f09388969427adf7df641cdcdc22kais        {CKA_TOKEN, &false, sizeof (false)},
c28749e97052f09388969427adf7df641cdcdc22kais        {CKA_CLASS, &privkey_class, sizeof (privkey_class)},
c28749e97052f09388969427adf7df641cdcdc22kais        {CKA_KEY_TYPE, &privkey_type, sizeof (privkey_type)},
c28749e97052f09388969427adf7df641cdcdc22kais        {CKA_SENSITIVE, &false, sizeof (false)},
c28749e97052f09388969427adf7df641cdcdc22kais        {CKA_PRIVATE, &false, sizeof (false)}
c28749e97052f09388969427adf7df641cdcdc22kais    };
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    rv = SUNW_C_KeyToObject(sess, CKM_AES_CBC_PAD, aes_key_val, 16,
c28749e97052f09388969427adf7df641cdcdc22kais        &aes_key_obj);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    if (rv != CKR_OK) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr,
c28749e97052f09388969427adf7df641cdcdc22kais            "Cannot create wrapping key. error = %s\n",
c28749e97052f09388969427adf7df641cdcdc22kais            pkcs11_strerror(rv));
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    /* get the size of the wrapped key */
c28749e97052f09388969427adf7df641cdcdc22kais    rv = C_WrapKey(sess, &aes_cbc_pad_mech, aes_key_obj, privkey_obj,
c28749e97052f09388969427adf7df641cdcdc22kais        NULL, &wrapped_privkey_len);
c28749e97052f09388969427adf7df641cdcdc22kais    if (rv != CKR_OK) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr, "Cannot get key size. error = %s\n",
c28749e97052f09388969427adf7df641cdcdc22kais            pkcs11_strerror(rv));
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    wrapped_privkey = malloc(wrapped_privkey_len * sizeof (CK_BYTE));
c28749e97052f09388969427adf7df641cdcdc22kais    if (wrapped_privkey == NULL) {
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    /* do the actual key wrapping */
c28749e97052f09388969427adf7df641cdcdc22kais    rv = C_WrapKey(sess, &aes_cbc_pad_mech, aes_key_obj, privkey_obj,
c28749e97052f09388969427adf7df641cdcdc22kais        wrapped_privkey, &wrapped_privkey_len);
c28749e97052f09388969427adf7df641cdcdc22kais    if (rv != CKR_OK) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr, "Cannot wrap private key. error = %s\n",
c28749e97052f09388969427adf7df641cdcdc22kais            pkcs11_strerror(rv));
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    (void) C_Logout(sess);
c28749e97052f09388969427adf7df641cdcdc22kais    (void) printf("private key successfully wrapped, "
c28749e97052f09388969427adf7df641cdcdc22kais        "wrapped blob length: %ld\n",
c28749e97052f09388969427adf7df641cdcdc22kais        wrapped_privkey_len);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    rv = C_UnwrapKey(sess, &aes_cbc_pad_mech, aes_key_obj,
c28749e97052f09388969427adf7df641cdcdc22kais        wrapped_privkey, wrapped_privkey_len,
c28749e97052f09388969427adf7df641cdcdc22kais        unwrap_tmpl, 5, &sess_privkey_obj);
c28749e97052f09388969427adf7df641cdcdc22kais    if (rv != CKR_OK) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr, "Cannot unwrap private key."
c28749e97052f09388969427adf7df641cdcdc22kais            " error = %s\n", pkcs11_strerror(rv));
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais    (void) printf("session private key successfully unwrapped\n");
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    return (pkcs11_to_kssl(sess, sess_privkey_obj, cert_obj, bufsize));
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais}
c28749e97052f09388969427adf7df641cdcdc22kais
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna/*
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna * See the comments for pkcs11_to_kssl() for the layout of the
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna * returned buffer.
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna */
c28749e97052f09388969427adf7df641cdcdc22kaisstatic kssl_params_t *
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishnaopenssl_to_kssl(RSA *rsa, int ncerts, uchar_t *cert_bufs[], int *cert_sizes,
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    int *paramsize)
c28749e97052f09388969427adf7df641cdcdc22kais{
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    int i, tcsize;
c28749e97052f09388969427adf7df641cdcdc22kais    kssl_params_t *kssl_params;
c28749e97052f09388969427adf7df641cdcdc22kais    kssl_key_t *key;
c28749e97052f09388969427adf7df641cdcdc22kais    char *buf;
c28749e97052f09388969427adf7df641cdcdc22kais    uint32_t bufsize;
c28749e97052f09388969427adf7df641cdcdc22kais    kssl_object_attribute_t kssl_attrs[MAX_ATTR_CNT];
c28749e97052f09388969427adf7df641cdcdc22kais    kssl_object_attribute_t kssl_tmpl_attrs[MAX_ATTR_CNT] = {
c28749e97052f09388969427adf7df641cdcdc22kais        {SUN_CKA_MODULUS, NULL, 0},
c28749e97052f09388969427adf7df641cdcdc22kais        {SUN_CKA_PUBLIC_EXPONENT, NULL, 0},
c28749e97052f09388969427adf7df641cdcdc22kais        {SUN_CKA_PRIVATE_EXPONENT, NULL, 0},
c28749e97052f09388969427adf7df641cdcdc22kais        {SUN_CKA_PRIME_1, NULL, 0},
c28749e97052f09388969427adf7df641cdcdc22kais        {SUN_CKA_PRIME_2, NULL, 0},
c28749e97052f09388969427adf7df641cdcdc22kais        {SUN_CKA_EXPONENT_1, NULL, 0},
c28749e97052f09388969427adf7df641cdcdc22kais        {SUN_CKA_EXPONENT_2, NULL, 0},
c28749e97052f09388969427adf7df641cdcdc22kais        {SUN_CKA_COEFFICIENT, NULL, 0}
c28749e97052f09388969427adf7df641cdcdc22kais    };
c28749e97052f09388969427adf7df641cdcdc22kais    BIGNUM *priv_key_bignums[MAX_ATTR_CNT];
c28749e97052f09388969427adf7df641cdcdc22kais    int attr_cnt;
c28749e97052f09388969427adf7df641cdcdc22kais
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    tcsize = 0;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    for (i = 0; i < ncerts; i++)
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        tcsize += cert_sizes[i];
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna
c28749e97052f09388969427adf7df641cdcdc22kais    bufsize = sizeof (kssl_params_t);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    bufsize += (tcsize + MAX_CHAIN_LENGTH * sizeof (uint32_t));
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    /* and the key attributes */
c28749e97052f09388969427adf7df641cdcdc22kais    priv_key_bignums[0] = rsa->n;       /* MODULUS */
c28749e97052f09388969427adf7df641cdcdc22kais    priv_key_bignums[1] = rsa->e;       /* PUBLIC_EXPONENT */
c28749e97052f09388969427adf7df641cdcdc22kais    priv_key_bignums[2] = rsa->d;       /* PRIVATE_EXPONENT */
c28749e97052f09388969427adf7df641cdcdc22kais    priv_key_bignums[3] = rsa->p;       /* PRIME_1 */
c28749e97052f09388969427adf7df641cdcdc22kais    priv_key_bignums[4] = rsa->q;       /* PRIME_2 */
c28749e97052f09388969427adf7df641cdcdc22kais    priv_key_bignums[5] = rsa->dmp1;    /* EXPONENT_1 */
c28749e97052f09388969427adf7df641cdcdc22kais    priv_key_bignums[6] = rsa->dmq1;    /* EXPONENT_2 */
c28749e97052f09388969427adf7df641cdcdc22kais    priv_key_bignums[7] = rsa->iqmp;    /* COEFFICIENT */
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    if (rsa->n == NULL || rsa->d == NULL) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr,
c28749e97052f09388969427adf7df641cdcdc22kais            "missing required attributes in private key.\n");
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    attr_cnt = 0;
c28749e97052f09388969427adf7df641cdcdc22kais    for (i = 0; i < MAX_ATTR_CNT; i++) {
c28749e97052f09388969427adf7df641cdcdc22kais        if (priv_key_bignums[i] == NULL)
c28749e97052f09388969427adf7df641cdcdc22kais            continue;
c28749e97052f09388969427adf7df641cdcdc22kais        kssl_attrs[attr_cnt].ka_type = kssl_tmpl_attrs[i].ka_type;
c28749e97052f09388969427adf7df641cdcdc22kais        kssl_attrs[attr_cnt].ka_value_len =
c28749e97052f09388969427adf7df641cdcdc22kais            BN_num_bytes(priv_key_bignums[i]);
c28749e97052f09388969427adf7df641cdcdc22kais        bufsize += sizeof (crypto_object_attribute_t) +
c28749e97052f09388969427adf7df641cdcdc22kais            kssl_attrs[attr_cnt].ka_value_len;
c28749e97052f09388969427adf7df641cdcdc22kais        attr_cnt++;
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    /* Add 4-byte cushion as sc_sizes[0] needs 32-bit aligment */
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    bufsize += sizeof (uint32_t);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna
c28749e97052f09388969427adf7df641cdcdc22kais    /* Now the big memory allocation */
c28749e97052f09388969427adf7df641cdcdc22kais    if ((buf = calloc(bufsize, 1)) == NULL) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr,
c28749e97052f09388969427adf7df641cdcdc22kais            "Cannot allocate memory for the kssl_params "
c28749e97052f09388969427adf7df641cdcdc22kais            "and values\n");
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    /* LINTED */
c28749e97052f09388969427adf7df641cdcdc22kais    kssl_params = (kssl_params_t *)buf;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    buf = (char *)(kssl_params + 1);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    /* the keys attributes structs array */
c28749e97052f09388969427adf7df641cdcdc22kais    key = &kssl_params->kssl_privkey;
c28749e97052f09388969427adf7df641cdcdc22kais    key->ks_format = CRYPTO_KEY_ATTR_LIST;
c28749e97052f09388969427adf7df641cdcdc22kais    key->ks_count = attr_cnt;
c28749e97052f09388969427adf7df641cdcdc22kais    key->ks_attrs_offset = buf - (char *)kssl_params;
c28749e97052f09388969427adf7df641cdcdc22kais    buf += attr_cnt * sizeof (kssl_object_attribute_t);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    attr_cnt = 0;
c28749e97052f09388969427adf7df641cdcdc22kais    /* then the key attributes values */
c28749e97052f09388969427adf7df641cdcdc22kais    for (i = 0; i < MAX_ATTR_CNT; i++) {
c28749e97052f09388969427adf7df641cdcdc22kais        if (priv_key_bignums[i] == NULL)
c28749e97052f09388969427adf7df641cdcdc22kais            continue;
c28749e97052f09388969427adf7df641cdcdc22kais        (void) BN_bn2bin(priv_key_bignums[i], (unsigned char *)buf);
c28749e97052f09388969427adf7df641cdcdc22kais        kssl_attrs[attr_cnt].ka_value_offset =
c28749e97052f09388969427adf7df641cdcdc22kais            buf - (char *)kssl_params;
c28749e97052f09388969427adf7df641cdcdc22kais        buf += kssl_attrs[attr_cnt].ka_value_len;
c28749e97052f09388969427adf7df641cdcdc22kais        attr_cnt++;
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    bcopy(kssl_attrs, ((char *)kssl_params) + key->ks_attrs_offset,
c28749e97052f09388969427adf7df641cdcdc22kais        attr_cnt * sizeof (kssl_object_attribute_t));
c28749e97052f09388969427adf7df641cdcdc22kais
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    buf = (char *)P2ROUNDUP((uintptr_t)buf, sizeof (uint32_t));
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    kssl_params->kssl_certs.sc_count = ncerts;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    bcopy(cert_sizes, buf, ncerts * sizeof (uint32_t));
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    kssl_params->kssl_certs.sc_sizes_offset = buf - (char *)kssl_params;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    buf += MAX_CHAIN_LENGTH * sizeof (uint32_t);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    kssl_params->kssl_certs.sc_certs_offset = buf - (char *)kssl_params;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    /* now the certs values */
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    for (i = 0; i < ncerts; i++) {
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        bcopy(cert_bufs[i], buf, cert_sizes[i]);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        buf += cert_sizes[i];
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    }
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna
c28749e97052f09388969427adf7df641cdcdc22kais    *paramsize = bufsize;
c28749e97052f09388969427adf7df641cdcdc22kais    return (kssl_params);
c28749e97052f09388969427adf7df641cdcdc22kais}
c28749e97052f09388969427adf7df641cdcdc22kais
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishnastatic kssl_params_t *
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishnaadd_cacerts(kssl_params_t *old_params, const char *cacert_chain_file,
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    const char *password_file)
c28749e97052f09388969427adf7df641cdcdc22kais{
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    int i, ncerts, newlen;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    int *cert_sizes;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    uint32_t certlen = 0;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    char *buf;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    uchar_t **cert_bufs;
c28749e97052f09388969427adf7df641cdcdc22kais    kssl_params_t *kssl_params;
c28749e97052f09388969427adf7df641cdcdc22kais
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    ncerts = 0;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    cert_bufs = PEM_get_rsa_key_certs(cacert_chain_file,
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        (char *)password_file, NULL, &cert_sizes, &ncerts);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    if (cert_bufs == NULL || ncerts == 0) {
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        free(old_params);
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    if (verbose) {
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        (void) printf("%d certificates read successfully\n", ncerts);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    }
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    newlen = old_params->kssl_params_size;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    for (i = 0; i < ncerts; i++)
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        newlen += cert_sizes[i];
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    /*
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna     * Get a bigger structure and update the
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna     * fields to account for the additional certs.
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna     */
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    kssl_params = realloc(old_params, newlen);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    kssl_params->kssl_params_size = newlen;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    kssl_params->kssl_certs.sc_count += ncerts;
c28749e97052f09388969427adf7df641cdcdc22kais
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    /* Put the cert_sizes starting from sc_sizes[1] */
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    buf = (char *)kssl_params;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    buf += kssl_params->kssl_certs.sc_sizes_offset;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    bcopy(buf, &certlen, sizeof (uint32_t));
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    buf += sizeof (uint32_t);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    bcopy(cert_sizes, buf, ncerts * sizeof (uint32_t));
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    /* Put the cert_bufs starting from sc_certs[1] */
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    buf = (char *)kssl_params;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    buf += kssl_params->kssl_certs.sc_certs_offset;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    buf += certlen;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    /* now the certs values */
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    for (i = 0; i < ncerts; i++) {
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        bcopy(cert_bufs[i], buf, cert_sizes[i]);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        buf += cert_sizes[i];
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    }
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    for (i = 0; i < ncerts; i++)
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        free(cert_bufs[i]);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    free(cert_bufs);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    free(cert_sizes);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    return (kssl_params);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna}
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishnastatic kssl_params_t *
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishnaload_from_pem(const char *filename, const char *password_file, int *paramsize)
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna{
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    uchar_t **cert_bufs;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    int *cert_sizes, ncerts, i;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    RSA *rsa;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    kssl_params_t *kssl_params;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    ncerts = 0;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    cert_bufs = PEM_get_rsa_key_certs(filename, (char *)password_file,
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        &rsa, &cert_sizes, &ncerts);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    if (rsa == NULL || cert_bufs == NULL || ncerts == 0) {
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    if (verbose)
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        (void) printf("%d certificates read successfully\n", ncerts);
c28749e97052f09388969427adf7df641cdcdc22kais
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    kssl_params = openssl_to_kssl(rsa, ncerts, cert_bufs,
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        cert_sizes, paramsize);
c28749e97052f09388969427adf7df641cdcdc22kais
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    for (i = 0; i < ncerts; i++)
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        free(cert_bufs[i]);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    free(cert_bufs);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    free(cert_sizes);
c28749e97052f09388969427adf7df641cdcdc22kais    RSA_free(rsa);
c28749e97052f09388969427adf7df641cdcdc22kais    return (kssl_params);
c28749e97052f09388969427adf7df641cdcdc22kais}
c28749e97052f09388969427adf7df641cdcdc22kais
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishnastatic kssl_params_t *
c28749e97052f09388969427adf7df641cdcdc22kaisload_from_pkcs12(const char *filename, const char *password_file,
c28749e97052f09388969427adf7df641cdcdc22kais    int *paramsize)
c28749e97052f09388969427adf7df641cdcdc22kais{
c28749e97052f09388969427adf7df641cdcdc22kais    RSA *rsa;
c28749e97052f09388969427adf7df641cdcdc22kais    kssl_params_t *kssl_params;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    uchar_t **cert_bufs;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    int *cert_sizes, ncerts, i;
c28749e97052f09388969427adf7df641cdcdc22kais
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    ncerts = 0;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    cert_bufs = PKCS12_get_rsa_key_certs(filename, password_file, &rsa,
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        &cert_sizes, &ncerts);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    if (cert_bufs == NULL || ncerts == 0) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr,
c28749e97052f09388969427adf7df641cdcdc22kais            "Unable to read cert and/or key from %s\n", filename);
c28749e97052f09388969427adf7df641cdcdc22kais        return (NULL);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    if (verbose)
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        (void) printf("%d certificates read successfully\n", ncerts);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    kssl_params = openssl_to_kssl(rsa, ncerts, cert_bufs,
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        cert_sizes, paramsize);
c28749e97052f09388969427adf7df641cdcdc22kais
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    for (i = 0; i < ncerts; i++)
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        free(cert_bufs[i]);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    free(cert_bufs);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    free(cert_sizes);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    RSA_free(rsa);
c28749e97052f09388969427adf7df641cdcdc22kais    return (kssl_params);
c28749e97052f09388969427adf7df641cdcdc22kais}
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kaisint
c28749e97052f09388969427adf7df641cdcdc22kaisparse_and_set_addr(char *server_address, char *server_port,
c28749e97052f09388969427adf7df641cdcdc22kais    struct sockaddr_in *addr)
c28749e97052f09388969427adf7df641cdcdc22kais{
c28749e97052f09388969427adf7df641cdcdc22kais    if (server_port == NULL) {
c28749e97052f09388969427adf7df641cdcdc22kais        return (-1);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    if (server_address == NULL) {
c28749e97052f09388969427adf7df641cdcdc22kais        addr->sin_addr.s_addr = INADDR_ANY;
c28749e97052f09388969427adf7df641cdcdc22kais    } else {
c28749e97052f09388969427adf7df641cdcdc22kais        addr->sin_addr.s_addr = inet_addr(server_address);
c28749e97052f09388969427adf7df641cdcdc22kais        if ((int)addr->sin_addr.s_addr == -1) {
c28749e97052f09388969427adf7df641cdcdc22kais            struct hostent *hp;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais            if ((hp = gethostbyname(server_address)) == NULL) {
c28749e97052f09388969427adf7df641cdcdc22kais                (void) fprintf(stderr,
c28749e97052f09388969427adf7df641cdcdc22kais                    "Error: Unknown host: %s\n",
c28749e97052f09388969427adf7df641cdcdc22kais                    server_address);
c28749e97052f09388969427adf7df641cdcdc22kais                return (-1);
c28749e97052f09388969427adf7df641cdcdc22kais            }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais            (void) memcpy(&addr->sin_addr.s_addr,
c28749e97052f09388969427adf7df641cdcdc22kais                hp->h_addr_list[0],
c28749e97052f09388969427adf7df641cdcdc22kais                sizeof (addr->sin_addr.s_addr));
c28749e97052f09388969427adf7df641cdcdc22kais        }
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    errno = 0;
c28749e97052f09388969427adf7df641cdcdc22kais    addr->sin_port = strtol(server_port, NULL, 10);
c28749e97052f09388969427adf7df641cdcdc22kais    if (addr->sin_port == 0 || errno != 0) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr, "Error: Invalid Port value: %s\n",
c28749e97052f09388969427adf7df641cdcdc22kais            server_port);
c28749e97052f09388969427adf7df641cdcdc22kais        return (-1);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    return (0);
c28749e97052f09388969427adf7df641cdcdc22kais}
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais/*
c28749e97052f09388969427adf7df641cdcdc22kais * The order of the ciphers is important. It is used as the
c28749e97052f09388969427adf7df641cdcdc22kais * default order (when -c is not specified).
c28749e97052f09388969427adf7df641cdcdc22kais */
c28749e97052f09388969427adf7df641cdcdc22kaisstruct csuite {
c28749e97052f09388969427adf7df641cdcdc22kais    const char *suite;
c28749e97052f09388969427adf7df641cdcdc22kais    uint16_t val;
c28749e97052f09388969427adf7df641cdcdc22kais    boolean_t seen;
c28749e97052f09388969427adf7df641cdcdc22kais} cipher_suites[CIPHER_SUITE_COUNT - 1] = {
c28749e97052f09388969427adf7df641cdcdc22kais    {"rsa_rc4_128_sha", SSL_RSA_WITH_RC4_128_SHA, B_FALSE},
c28749e97052f09388969427adf7df641cdcdc22kais    {"rsa_rc4_128_md5", SSL_RSA_WITH_RC4_128_MD5, B_FALSE},
c28749e97052f09388969427adf7df641cdcdc22kais    {"rsa_3des_ede_cbc_sha", SSL_RSA_WITH_3DES_EDE_CBC_SHA, B_FALSE},
c28749e97052f09388969427adf7df641cdcdc22kais    {"rsa_des_cbc_sha", SSL_RSA_WITH_DES_CBC_SHA, B_FALSE},
c28749e97052f09388969427adf7df641cdcdc22kais};
c28749e97052f09388969427adf7df641cdcdc22kais
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishnastatic int
c28749e97052f09388969427adf7df641cdcdc22kaischeck_suites(char *suites, uint16_t *sarray)
c28749e97052f09388969427adf7df641cdcdc22kais{
c28749e97052f09388969427adf7df641cdcdc22kais    int i;
c28749e97052f09388969427adf7df641cdcdc22kais    int err = 0;
c28749e97052f09388969427adf7df641cdcdc22kais    char *suite;
c28749e97052f09388969427adf7df641cdcdc22kais    int sindx = 0;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    if (suites != NULL) {
c28749e97052f09388969427adf7df641cdcdc22kais        for (i = 0; i < CIPHER_SUITE_COUNT - 1; i++)
c28749e97052f09388969427adf7df641cdcdc22kais            sarray[i] = CIPHER_NOTSET;
c28749e97052f09388969427adf7df641cdcdc22kais    } else {
c28749e97052f09388969427adf7df641cdcdc22kais        for (i = 0; i < CIPHER_SUITE_COUNT - 1; i++)
c28749e97052f09388969427adf7df641cdcdc22kais            sarray[i] = cipher_suites[i].val;
c28749e97052f09388969427adf7df641cdcdc22kais        return (err);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    suite = strtok(suites, ",");
c28749e97052f09388969427adf7df641cdcdc22kais    do {
c28749e97052f09388969427adf7df641cdcdc22kais        for (i = 0; i < CIPHER_SUITE_COUNT - 1; i++) {
c28749e97052f09388969427adf7df641cdcdc22kais            if (strcasecmp(suite, cipher_suites[i].suite) == 0) {
c28749e97052f09388969427adf7df641cdcdc22kais                if (!cipher_suites[i].seen) {
c28749e97052f09388969427adf7df641cdcdc22kais                    sarray[sindx++] = cipher_suites[i].val;
c28749e97052f09388969427adf7df641cdcdc22kais                    cipher_suites[i].seen = B_TRUE;
c28749e97052f09388969427adf7df641cdcdc22kais                }
c28749e97052f09388969427adf7df641cdcdc22kais                break;
c28749e97052f09388969427adf7df641cdcdc22kais            }
c28749e97052f09388969427adf7df641cdcdc22kais        }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais        if (i == (CIPHER_SUITE_COUNT - 1)) {
c28749e97052f09388969427adf7df641cdcdc22kais            (void) fprintf(stderr,
c28749e97052f09388969427adf7df641cdcdc22kais                "Unknown Cipher suite name: %s\n", suite);
c28749e97052f09388969427adf7df641cdcdc22kais            err++;
c28749e97052f09388969427adf7df641cdcdc22kais        }
c28749e97052f09388969427adf7df641cdcdc22kais    } while ((suite = strtok(NULL, ",")) != NULL);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    return (err);
c28749e97052f09388969427adf7df641cdcdc22kais}
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kaisint
c28749e97052f09388969427adf7df641cdcdc22kaisdo_create(int argc, char *argv[])
c28749e97052f09388969427adf7df641cdcdc22kais{
c28749e97052f09388969427adf7df641cdcdc22kais    const char *softtoken_dir = NULL;
c28749e97052f09388969427adf7df641cdcdc22kais    const char *token_label = NULL;
c28749e97052f09388969427adf7df641cdcdc22kais    const char *password_file = NULL;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    const char *cert_key_file = NULL;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    const char *cacert_chain_file = NULL;
c28749e97052f09388969427adf7df641cdcdc22kais    const char *certname = NULL;
c28749e97052f09388969427adf7df641cdcdc22kais    char *suites = NULL;
c28749e97052f09388969427adf7df641cdcdc22kais    uint32_t timeout = DEFAULT_SID_TIMEOUT;
c28749e97052f09388969427adf7df641cdcdc22kais    uint32_t scache_size = DEFAULT_SID_CACHE_NENTRIES;
c28749e97052f09388969427adf7df641cdcdc22kais    int proxy_port = -1;
c28749e97052f09388969427adf7df641cdcdc22kais    struct sockaddr_in server_addr;
c28749e97052f09388969427adf7df641cdcdc22kais    char *format = NULL;
c28749e97052f09388969427adf7df641cdcdc22kais    char *port, *addr;
c28749e97052f09388969427adf7df641cdcdc22kais    char c;
c28749e97052f09388969427adf7df641cdcdc22kais    int pcnt;
c28749e97052f09388969427adf7df641cdcdc22kais    kssl_params_t *kssl_params;
c28749e97052f09388969427adf7df641cdcdc22kais    int bufsize;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    argc -= 1;
c28749e97052f09388969427adf7df641cdcdc22kais    argv += 1;
c28749e97052f09388969427adf7df641cdcdc22kais
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    while ((c = getopt(argc, argv, "vT:d:f:h:i:p:c:C:t:x:z:")) != -1) {
c28749e97052f09388969427adf7df641cdcdc22kais        switch (c) {
c28749e97052f09388969427adf7df641cdcdc22kais        case 'd':
c28749e97052f09388969427adf7df641cdcdc22kais            softtoken_dir = optarg;
c28749e97052f09388969427adf7df641cdcdc22kais            break;
c28749e97052f09388969427adf7df641cdcdc22kais        case 'c':
c28749e97052f09388969427adf7df641cdcdc22kais            suites = optarg;
c28749e97052f09388969427adf7df641cdcdc22kais            break;
c28749e97052f09388969427adf7df641cdcdc22kais        case 'C':
c28749e97052f09388969427adf7df641cdcdc22kais            certname = optarg;
c28749e97052f09388969427adf7df641cdcdc22kais            break;
c28749e97052f09388969427adf7df641cdcdc22kais        case 'f':
c28749e97052f09388969427adf7df641cdcdc22kais            format = optarg;
c28749e97052f09388969427adf7df641cdcdc22kais            break;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        case 'h':
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna            cacert_chain_file = optarg;
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna            break;
c28749e97052f09388969427adf7df641cdcdc22kais        case 'i':
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna            cert_key_file = optarg;
c28749e97052f09388969427adf7df641cdcdc22kais            break;
c28749e97052f09388969427adf7df641cdcdc22kais        case 'T':
c28749e97052f09388969427adf7df641cdcdc22kais            token_label = optarg;
c28749e97052f09388969427adf7df641cdcdc22kais            break;
c28749e97052f09388969427adf7df641cdcdc22kais        case 'p':
c28749e97052f09388969427adf7df641cdcdc22kais            password_file = optarg;
c28749e97052f09388969427adf7df641cdcdc22kais            break;
c28749e97052f09388969427adf7df641cdcdc22kais        case 't':
c28749e97052f09388969427adf7df641cdcdc22kais            timeout = atoi(optarg);
c28749e97052f09388969427adf7df641cdcdc22kais            break;
c28749e97052f09388969427adf7df641cdcdc22kais        case 'x':
c28749e97052f09388969427adf7df641cdcdc22kais            proxy_port = atoi(optarg);
c28749e97052f09388969427adf7df641cdcdc22kais            break;
c28749e97052f09388969427adf7df641cdcdc22kais        case 'v':
c28749e97052f09388969427adf7df641cdcdc22kais            verbose = B_TRUE;
c28749e97052f09388969427adf7df641cdcdc22kais            break;
c28749e97052f09388969427adf7df641cdcdc22kais        case 'z':
c28749e97052f09388969427adf7df641cdcdc22kais            scache_size = atoi(optarg);
c28749e97052f09388969427adf7df641cdcdc22kais            break;
c28749e97052f09388969427adf7df641cdcdc22kais        default:
c28749e97052f09388969427adf7df641cdcdc22kais            goto err;
c28749e97052f09388969427adf7df641cdcdc22kais        }
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    pcnt = argc - optind;
c28749e97052f09388969427adf7df641cdcdc22kais    if (pcnt == 0) {
c28749e97052f09388969427adf7df641cdcdc22kais        port = "443";   /* default SSL port */
c28749e97052f09388969427adf7df641cdcdc22kais        addr = NULL;
c28749e97052f09388969427adf7df641cdcdc22kais    } else if (pcnt == 1) {
c28749e97052f09388969427adf7df641cdcdc22kais        port = argv[optind];
c28749e97052f09388969427adf7df641cdcdc22kais        addr = NULL;
c28749e97052f09388969427adf7df641cdcdc22kais    } else if (pcnt == 2) {
c28749e97052f09388969427adf7df641cdcdc22kais        addr = argv[optind];
c28749e97052f09388969427adf7df641cdcdc22kais        port = argv[optind + 1];
c28749e97052f09388969427adf7df641cdcdc22kais    } else {
c28749e97052f09388969427adf7df641cdcdc22kais        goto err;
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    if (parse_and_set_addr(addr, port, &server_addr) < 0) {
c28749e97052f09388969427adf7df641cdcdc22kais        goto err;
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    if (verbose) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) printf("addr=%s, port = %d\n",
c28749e97052f09388969427adf7df641cdcdc22kais            inet_ntoa(server_addr.sin_addr), server_addr.sin_port);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    if (format == NULL || proxy_port == -1) {
c28749e97052f09388969427adf7df641cdcdc22kais        goto err;
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    if (strcmp(format, "pkcs11") == 0) {
c28749e97052f09388969427adf7df641cdcdc22kais        if (token_label == NULL || certname == NULL) {
c28749e97052f09388969427adf7df641cdcdc22kais            goto err;
c28749e97052f09388969427adf7df641cdcdc22kais        }
c28749e97052f09388969427adf7df641cdcdc22kais        if (softtoken_dir != NULL) {
c28749e97052f09388969427adf7df641cdcdc22kais            (void) setenv("SOFTTOKEN_DIR", softtoken_dir, 1);
c28749e97052f09388969427adf7df641cdcdc22kais            if (verbose) {
c28749e97052f09388969427adf7df641cdcdc22kais                (void) printf(
c28749e97052f09388969427adf7df641cdcdc22kais                    "SOFTTOKEN_DIR=%s\n",
c28749e97052f09388969427adf7df641cdcdc22kais                    getenv("SOFTTOKEN_DIR"));
c28749e97052f09388969427adf7df641cdcdc22kais            }
c28749e97052f09388969427adf7df641cdcdc22kais        }
c28749e97052f09388969427adf7df641cdcdc22kais        kssl_params = load_from_pkcs11(
c28749e97052f09388969427adf7df641cdcdc22kais            token_label, password_file, certname, &bufsize);
c28749e97052f09388969427adf7df641cdcdc22kais    } else if (strcmp(format, "pkcs12") == 0) {
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        if (cert_key_file == NULL) {
c28749e97052f09388969427adf7df641cdcdc22kais            goto err;
c28749e97052f09388969427adf7df641cdcdc22kais        }
c28749e97052f09388969427adf7df641cdcdc22kais        kssl_params = load_from_pkcs12(
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna            cert_key_file, password_file, &bufsize);
c28749e97052f09388969427adf7df641cdcdc22kais    } else if (strcmp(format, "pem") == 0) {
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        if (cert_key_file == NULL) {
c28749e97052f09388969427adf7df641cdcdc22kais            goto err;
c28749e97052f09388969427adf7df641cdcdc22kais        }
c28749e97052f09388969427adf7df641cdcdc22kais        kssl_params = load_from_pem(
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna            cert_key_file, password_file, &bufsize);
c28749e97052f09388969427adf7df641cdcdc22kais    } else {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr, "Unsupported cert format: %s\n", format);
c28749e97052f09388969427adf7df641cdcdc22kais        goto err;
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    if (kssl_params == NULL) {
c28749e97052f09388969427adf7df641cdcdc22kais        return (FAILURE);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    if (check_suites(suites, kssl_params->kssl_suites) != 0)
c28749e97052f09388969427adf7df641cdcdc22kais        goto err;
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    kssl_params->kssl_params_size = bufsize;
c28749e97052f09388969427adf7df641cdcdc22kais    kssl_params->kssl_addr = server_addr;
c28749e97052f09388969427adf7df641cdcdc22kais    kssl_params->kssl_session_cache_timeout = timeout;
c28749e97052f09388969427adf7df641cdcdc22kais    kssl_params->kssl_proxy_port = proxy_port;
c28749e97052f09388969427adf7df641cdcdc22kais    kssl_params->kssl_session_cache_size = scache_size;
c28749e97052f09388969427adf7df641cdcdc22kais
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    if (cacert_chain_file != NULL) {
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        kssl_params = add_cacerts(kssl_params, cacert_chain_file,
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna            password_file);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        if (kssl_params == NULL) {
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna            return (FAILURE);
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna        }
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna    }
164c0dd6f561db19bdaf1d0b7f2a8dec44355b69krishna
c28749e97052f09388969427adf7df641cdcdc22kais    if (kssl_send_command((char *)kssl_params, KSSL_ADD_ENTRY) < 0) {
c28749e97052f09388969427adf7df641cdcdc22kais        (void) fprintf(stderr, "Error loading cert and key");
c28749e97052f09388969427adf7df641cdcdc22kais        return (FAILURE);
c28749e97052f09388969427adf7df641cdcdc22kais    }
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    if (verbose)
c28749e97052f09388969427adf7df641cdcdc22kais        (void) printf("Successfully loaded cert and key\n");
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kais    free(kssl_params);
c28749e97052f09388969427adf7df641cdcdc22kais    return (SUCCESS);
c28749e97052f09388969427adf7df641cdcdc22kais
c28749e97052f09388969427adf7df641cdcdc22kaiserr:
c28749e97052f09388969427adf7df641cdcdc22kais    usage_create(B_TRUE);
c28749e97052f09388969427adf7df641cdcdc22kais    return (SMF_EXIT_ERR_CONFIG);
c28749e97052f09388969427adf7df641cdcdc22kais}