269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * CDDL HEADER START
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * The contents of this file are subject to the terms of the
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * Common Development and Distribution License (the "License").
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * You may not use this file except in compliance with the License.
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * See the License for the specific language governing permissions
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * and limitations under the License.
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * When distributing Covered Code, include this CDDL HEADER in each
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * If applicable, add the following below this CDDL HEADER, with the
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * fields enclosed by brackets "[]" replaced with your own identifying
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * information: Portions Copyright [yyyy] [name of copyright owner]
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * CDDL HEADER END
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * Copyright (c) 2006, 2010, Oracle and/or its affiliates. All rights reserved.
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * This file implements the KMF certificate to name mapping framework.
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec/* Mappers go in the same dir as plugins. */
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec KMF_MAPPER_RECORD *mapper = &handle->policy->mapper;
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec /* Optional, not an error if it does not exist. */
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec/* The caller is expected to free the returned string. */
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * MAPPER_NAME_TEMPLATE has 2 extra characters (%s) which make up for
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * the "/" and the terminating NULL when computing the total length.
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec len = strlen(name) + strlen(MAPPER_NAME_TEMPLATE) + strlen(dir);
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec /* Avoid double forward slash if the dir's last character is "/". */
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec (void) snprintf(pathname, len, "%s%s" MAPPER_NAME_TEMPLATE,
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec dir, dir[strlen(dir) - 1] == '/' ? "" : "/", name);
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec map->dldesc = dlopen(map->curpathname, RTLD_LAZY | RTLD_PARENT);
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * The mapping framework uses either attributes or the policy file. Those two
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * sources are never mixed. We always need a mapper name or a mapper pathname
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * but these two are mutually exclusive. Directory can be set only if name is
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechaneckmf_cert_to_name_mapping_initialize(KMF_HANDLE_T handle, int numattr,
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec KMF_RETURN (*initialize)(KMF_HANDLE_T, char *);
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec name = kmf_get_attr_ptr(KMF_MAPPER_NAME_ATTR, attrlist, numattr);
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec dir = kmf_get_attr_ptr(KMF_DIRPATH_ATTR, attrlist, numattr);
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec path = kmf_get_attr_ptr(KMF_MAPPER_PATH_ATTR, attrlist, numattr);
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec opts = kmf_get_attr_ptr(KMF_MAPPER_OPTIONS_ATTR, attrlist, numattr);
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec /* Mutually exclusive. */
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec /* If we only have a name and possibly a dir, we can find the path. */
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * If we were given name but the returned path is still NULL,
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * return an error.
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec /* Can not exist standalone. */
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec /* No attributes define the mapper so let's use the policy database. */
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec tmppath = get_mapper_pathname(map->mapname, map->dir);
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * If we were given name but the returned path is still NULL,
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * return an error.
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * Either a name or a full pathname must be provided whether
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * from attributes or the policy database.
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * Dlopen the mapper specified by the policy. If anything goes wrong
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * just return an error. We do not have to worry about resetting
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * curpathname and curoptions to the previous values since there was no
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * mapper initialized beforehand.
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * No mapper was open so stored curoptions and curpathname are
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * already NULL and need not to be freed.
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec if ((ret = open_mapper_library(map)) != KMF_OK) {
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * We already have an open mapper, let's see if this is a new mapper
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec /* No change in mapper pathname. */
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec /* New options are empty while we had some before. */
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec /* We have some options now while we had none before. */
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec } else if (map->curoptions == NULL && opts != NULL) {
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec /* We got different options. */
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec } else if (strcmp(map->curoptions, opts) != 0) {
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * Same options, no free() of current options is
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec /* Free old options if applicable. */
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * This is a new mapper path, clean up the old data and open the
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * new mapper.
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec /* These two are no longer valid. */
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec if ((ret = open_mapper_library(map)) != KMF_OK) {
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * This will cleanup curoptions and curpathname, and
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * ignores the dldesc since it is NULL. Do not free
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * tmppath, it will be freed through map->curpathname.
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec initialize = (KMF_RETURN(*)())dlsym(map->dldesc,
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec /* Optional, not an error if it does not exist. */
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * Try to put the old curpathname and curoptions back there. In theory,
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * the application might be able to continue to use the old mapping
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * unless we already called cleanup_mapper(). However, it's neither
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * recommended nor officially supported. The app should initialize the
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * old mapping again.
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechaneckmf_cert_to_name_mapping_finalize(KMF_HANDLE_T handle)
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechaneckmf_map_cert_to_name(KMF_HANDLE_T handle, KMF_DATA *cert, KMF_DATA *name)
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec KMF_RETURN (*cert2name)(KMF_HANDLE *, KMF_DATA *, KMF_DATA *);
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec cert2name = (KMF_RETURN(*)())dlsym(map->dldesc,
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * If mapped_name is non-NULL the caller is later expected to free its Data
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * after use.
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechaneckmf_match_cert_to_name(KMF_HANDLE_T handle, KMF_DATA *cert,
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec KMF_DATA *name_to_match, KMF_DATA *mapped_name)
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec KMF_RETURN (*cert2name)(KMF_HANDLE *, KMF_DATA *, KMF_DATA *,
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec if (map->curpathname == NULL || map->dldesc == NULL)
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec cert2name = (KMF_RETURN(*)())dlsym(map->dldesc,
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec return (cert2name(handle, cert, name_to_match, mapped_name));
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * The caller is responsible for freeing the error string (ie., *errstr) when
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec * done with it.
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechaneckmf_get_mapper_error_str(KMF_HANDLE_T handle, char **errstr)
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec KMF_RETURN (*err2string)(KMF_HANDLE *, char **);
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec if (map->curpathname == NULL || map->dldesc == NULL)
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechanec err2string = (KMF_RETURN(*)())dlsym(map->dldesc,
269e59f9a28bf47e0f463e64fc5af4a408b73b21Jan Pechaneckmf_set_mapper_lasterror(KMF_HANDLE_T handle, uint32_t err)