/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
 * Use is subject to license terms.
 */

#include <limits.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
#include <dirent.h>
#include <strings.h>
#include <stdio.h>
#include <stdlib.h>
#include <errno.h>
#include <sys/mman.h>
#include <md5.h>
#include <pthread.h>

#include <cryptoutil.h>

#include <kmfapi.h>
#include <sys/crypto/elfsign.h>
#include <libelfsign.h>

#include <synch.h>

const char _PATH_ELFSIGN_CRYPTO_CERTS[] = CRYPTO_CERTS_DIR;
const char _PATH_ELFSIGN_ETC_CERTS[] = ETC_CERTS_DIR;

/*
 * The CACERT and OBJCACERT are the Cryptographic Trust Anchors
 * for the Solaris Cryptographic Framework.
 *
 * The SECACERT is the Signed Execution Trust Anchor that the
 * Cryptographic Framework uses for FIPS-140 validation of non-crypto
 * binaries
 */
static const char _PATH_CRYPTO_CACERT[] = CRYPTO_CERTS_DIR "/CA";
static const char _PATH_CRYPTO_OBJCACERT[] = CRYPTO_CERTS_DIR "/SUNWObjectCA";
static const char _PATH_CRYPTO_SECACERT[] = ETC_CERTS_DIR "/SUNWSolarisCA";
static ELFCert_t CACERT = NULL;
static ELFCert_t OBJCACERT = NULL;
static ELFCert_t SECACERT = NULL;
static pthread_mutex_t ca_mutex = PTHREAD_MUTEX_INITIALIZER;

static void elfcertlib_freecert(ELFsign_t, ELFCert_t);
static ELFCert_t elfcertlib_allocatecert(void);

/*
 * elfcertlib_verifycert - Verify the Cert with a Trust Anchor
 *
 * IN   ess             - elfsign context structure
 *      cert
 * OUT  NONE
 * RETURN       TRUE/FALSE
 *
 * We first setup the Trust Anchor (CA and SUNWObjectCA) certs
 * if it hasn't been done already.  We verify that the files on disk
 * are those we expected.
 *
 * We then verify the given cert using the publickey of a TA.
 * If the passed in cert is a TA or it has been verified already we
 * short cut and return TRUE without futher validation.
 */
/*ARGSUSED*/
boolean_t
elfcertlib_verifycert(ELFsign_t ess, ELFCert_t cert)
{
        KMF_ATTRIBUTE   attrlist[8];
        int             numattr;

        KMF_RETURN rv;
        if ((cert->c_verified == E_OK) || (cert->c_verified == E_IS_TA)) {
                return (B_TRUE);
        }

        (void) pthread_mutex_lock(&ca_mutex);
        if (CACERT == NULL) {
                (void) elfcertlib_getcert(ess, (char *)_PATH_CRYPTO_CACERT,
                    NULL, &CACERT, ES_GET);
        }

        if (OBJCACERT == NULL) {
                (void) elfcertlib_getcert(ess, (char *)_PATH_CRYPTO_OBJCACERT,
                    NULL, &OBJCACERT, ES_GET);
        }

        if (SECACERT == NULL) {
                (void) elfcertlib_getcert(ess,
                    (char *)_PATH_CRYPTO_SECACERT, NULL, &SECACERT,
                    ES_GET_FIPS140);
        }

        (void) pthread_mutex_unlock(&ca_mutex);

        if (CACERT != NULL) {
                numattr = 0;
                kmf_set_attr_at_index(attrlist, numattr++,
                    KMF_CERT_DATA_ATTR, &cert->c_cert.certificate,
                    sizeof (KMF_DATA));
                kmf_set_attr_at_index(attrlist, numattr++,
                    KMF_SIGNER_CERT_DATA_ATTR, &CACERT->c_cert.certificate,
                    sizeof (KMF_DATA));

                rv = kmf_verify_cert(ess->es_kmfhandle, numattr, attrlist);
                if (rv == KMF_OK) {
                        if (ess->es_certCAcallback != NULL)
                                (ess->es_certvercallback)(ess->es_callbackctx,
                                    cert, CACERT);
                        cert->c_verified = E_OK;
                        return (B_TRUE);
                }
        }

        if (OBJCACERT != NULL) {
                numattr = 0;
                kmf_set_attr_at_index(attrlist, numattr++,
                    KMF_CERT_DATA_ATTR, &cert->c_cert.certificate,
                    sizeof (KMF_DATA));
                kmf_set_attr_at_index(attrlist, numattr++,
                    KMF_SIGNER_CERT_DATA_ATTR, &OBJCACERT->c_cert.certificate,
                    sizeof (KMF_DATA));

                rv = kmf_verify_cert(ess->es_kmfhandle, numattr, attrlist);
                if (rv == KMF_OK) {
                        if (ess->es_certCAcallback != NULL)
                                (ess->es_certvercallback)(ess->es_callbackctx,
                                    cert, OBJCACERT);
                        cert->c_verified = E_OK;
                        return (B_TRUE);
                }
        }

        if (SECACERT != NULL) {
                numattr = 0;
                kmf_set_attr_at_index(attrlist, numattr++,
                    KMF_CERT_DATA_ATTR, &cert->c_cert.certificate,
                    sizeof (KMF_DATA));
                kmf_set_attr_at_index(attrlist, numattr++,
                    KMF_SIGNER_CERT_DATA_ATTR, &SECACERT->c_cert.certificate,
                    sizeof (KMF_DATA));

                rv = kmf_verify_cert(ess->es_kmfhandle, numattr, attrlist);
                if (rv == KMF_OK) {
                        if (ess->es_certCAcallback != NULL)
                                (ess->es_certvercallback)(ess->es_callbackctx,
                                    cert, SECACERT);
                        cert->c_verified = E_OK;
                        return (B_TRUE);
                }
        }

        return (B_FALSE);
}

/*
 * elfcertlib_getcert - Get the certificate for signer_DN
 *
 * IN   ess             - elfsign context structure
 *      cert_pathname   - path to cert (May be NULL)
 *      signer_DN       - The DN we are looking for (May be NULL)
 *      action          - indicates crypto verification call
 * OUT  certp           - allocated/loaded ELFCert_t
 *
 * If the cert_pathname is passed use it and don't search.
 * Otherwise, go looking in certificate directories
 */
boolean_t
elfcertlib_getcert(ELFsign_t ess, char *cert_pathname,
    char *signer_DN, ELFCert_t *certp, enum ES_ACTION action)
{
        KMF_RETURN rv;
        ELFCert_t       cert = NULL;
        KMF_X509_DER_CERT certbuf[2];
        uint32_t ncerts;
        boolean_t ret = B_FALSE;
        char    *pathlist[3], **plp;

        cryptodebug("elfcertlib_getcert: path=%s, DN=%s",
            cert_pathname ? cert_pathname : "-none-",
            signer_DN ? signer_DN : "-none-");
        *certp = NULL;
        if (cert_pathname == NULL && signer_DN == NULL) {
                cryptodebug("elfcertlib_getcert: lack of specificity");
                return (ret);
        }

        plp = pathlist;
        if (cert_pathname != NULL) {
                /* look in the specified object */
                *plp++ = cert_pathname;
        } else {
                /* look in the certificate directories */
                *plp++ = (char *)_PATH_ELFSIGN_CRYPTO_CERTS;
                /*
                 * crypto verifications don't search beyond
                 * _PATH_ELFSIGN_CRYPTO_CERTS
                 */
                if (action != ES_GET_CRYPTO)
                        *plp++ = (char *)_PATH_ELFSIGN_ETC_CERTS;
        }
        *plp = NULL;

        if ((cert = elfcertlib_allocatecert()) == NULL) {
                return (ret);
        }

        for (plp = pathlist; *plp; plp++) {
                KMF_ATTRIBUTE   attrlist[8];
                KMF_KEYSTORE_TYPE       kstype;
                KMF_CERT_VALIDITY       certvalidity;
                int             numattr;

                kstype = KMF_KEYSTORE_OPENSSL;
                certvalidity = KMF_ALL_CERTS;
                ncerts = 2;

                numattr = 0;
                kmf_set_attr_at_index(attrlist, numattr++,
                    KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
                kmf_set_attr_at_index(attrlist, numattr++,
                    KMF_X509_DER_CERT_ATTR, certbuf,
                    sizeof (KMF_X509_DER_CERT));
                kmf_set_attr_at_index(attrlist, numattr++,
                    KMF_COUNT_ATTR, &ncerts, sizeof (uint32_t));
                if (signer_DN != NULL) {
                        kmf_set_attr_at_index(attrlist, numattr++,
                            KMF_SUBJECT_NAME_ATTR, signer_DN,
                            strlen(signer_DN));
                }
                kmf_set_attr_at_index(attrlist, numattr++,
                    KMF_CERT_VALIDITY_ATTR, &certvalidity,
                    sizeof (KMF_CERT_VALIDITY));
                kmf_set_attr_at_index(attrlist, numattr++,
                    KMF_CERT_FILENAME_ATTR, *plp, strlen (*plp));

                rv = kmf_find_cert(ess->es_kmfhandle, numattr, attrlist);

                if (rv != KMF_OK)
                        continue;
                /* found one */
                cert->c_cert = certbuf[0];
                if (ncerts > 1) {
                        /* release any extras */
                        kmf_free_kmf_cert(ess->es_kmfhandle, &certbuf[1]);
                        if (signer_DN == NULL) {
                                /* There can be only one */
                                cryptodebug("elfcertlib_getcert: "
                                    "too many certificates found in %s",
                                    cert_pathname);
                                goto cleanup;
                        }
                }
                /* cache subject and issuer */
                rv = kmf_get_cert_subject_str(ess->es_kmfhandle,
                    &cert->c_cert.certificate, &cert->c_subject);
                if (rv != KMF_OK)
                        goto cleanup;

                rv = kmf_get_cert_issuer_str(ess->es_kmfhandle,
                    &cert->c_cert.certificate, &cert->c_issuer);
                if (rv != KMF_OK)
                        goto cleanup;
                break;
        }
        if (*plp == NULL) {
                cryptodebug("elfcertlib_getcert: no certificate found");
                goto cleanup;
        }

        cert->c_verified = E_UNCHECKED;

        /*
         * If the cert we are loading is the trust anchor (ie the CA) then
         * we mark it as such in cert.  This is so that we don't attempt
         * to verify it later.  The CA is always implicitly verified.
         */
        if (cert_pathname != NULL && (
            strcmp(cert_pathname, _PATH_CRYPTO_CACERT) == 0 ||
            strcmp(cert_pathname, _PATH_CRYPTO_OBJCACERT) == 0 ||
            strcmp(cert_pathname, _PATH_CRYPTO_SECACERT) == 0)) {
                if (ess->es_certCAcallback != NULL)
                        (ess->es_certCAcallback)(ess->es_callbackctx, cert,
                            cert_pathname);
                cert->c_verified = E_IS_TA;
        }

        ret = B_TRUE;

cleanup:
        if (ret) {
                *certp = cert;
        } else {
                if (cert != NULL)
                        elfcertlib_freecert(ess, cert);
                if (signer_DN != NULL)
                        cryptoerror(LOG_ERR, "unable to find a certificate "
                            "for DN: %s", signer_DN);
                else
                        cryptoerror(LOG_ERR, "unable to load certificate "
                            "from %s", cert_pathname);
        }
        return (ret);
}

/*
 * elfcertlib_loadprivatekey - Load the private key from path
 *
 * IN   ess             - elfsign context structure
 *      cert
 *      pathname
 * OUT  cert
 * RETURNS      TRUE/FALSE
 */
boolean_t
elfcertlib_loadprivatekey(ELFsign_t ess, ELFCert_t cert, const char *pathname)
{
        KMF_RETURN      rv = KMF_OK;
        KMF_KEY_HANDLE  keybuf[2];
        KMF_ATTRIBUTE   attrlist[16];
        uint32_t        nkeys;
        KMF_KEYSTORE_TYPE       kstype;
        KMF_KEY_ALG     keytype;
        KMF_KEY_CLASS   keyclass;
        KMF_ENCODE_FORMAT       format;
        int             numattr;

        kstype = KMF_KEYSTORE_OPENSSL;
        nkeys = 2;
        keytype = KMF_KEYALG_NONE;
        keyclass = KMF_ASYM_PRI;
        format = KMF_FORMAT_UNDEF;

        numattr = 0;
        kmf_set_attr_at_index(attrlist, numattr++, KMF_KEYSTORE_TYPE_ATTR,
            &kstype, sizeof (kstype));
        kmf_set_attr_at_index(attrlist, numattr++, KMF_KEY_HANDLE_ATTR,
            keybuf, sizeof (KMF_KEY_HANDLE));
        kmf_set_attr_at_index(attrlist, numattr++, KMF_COUNT_ATTR,
            &nkeys, sizeof (uint32_t));
        kmf_set_attr_at_index(attrlist, numattr++, KMF_KEYALG_ATTR,
            &keytype, sizeof (keytype));
        kmf_set_attr_at_index(attrlist, numattr++, KMF_KEYCLASS_ATTR,
            &keyclass, sizeof (keyclass));
        kmf_set_attr_at_index(attrlist, numattr++, KMF_ENCODE_FORMAT_ATTR,
            &format, sizeof (format));
        kmf_set_attr_at_index(attrlist, numattr++, KMF_KEY_FILENAME_ATTR,
            (char *)pathname, strlen(pathname));

        rv = kmf_find_key(ess->es_kmfhandle, numattr, attrlist);
        if (rv != KMF_OK)
                return (B_FALSE);
        if (nkeys != 1) {
                /* lack of specificity */
                cryptodebug("found %d keys at %s", nkeys, pathname);
                return (B_FALSE);
        }
        cert->c_privatekey = keybuf[0];
        cryptodebug("key %s loaded", pathname);
        return (B_TRUE);
}

/*
 * elfcertlib_loadtokenkey - Load the private key from token
 *
 * IN   ess             - elfsign context structure
 *      cert
 *      token_label
 *      pin
 * OUT  cert
 * RETURNS      TRUE/FALSE
 */
boolean_t
elfcertlib_loadtokenkey(ELFsign_t ess, ELFCert_t cert,
    const char *token_label, const char *pin)
{
        KMF_RETURN      rv;
        char            *idstr = NULL;
        char            *kmferr;
        KMF_ATTRIBUTE   attrlist[16];
        uint32_t        nkeys;
        KMF_KEYSTORE_TYPE       kstype;
        KMF_KEY_ALG     keytype;
        KMF_KEY_CLASS   keyclass;
        KMF_ENCODE_FORMAT       format;
        KMF_CREDENTIAL  pincred;
        boolean_t       tokenbool, privatebool;
        int             numattr;

        /*
         * We will search for the key based on the ID attribute
         * which was added when the key was created.  ID is
         * a SHA-1 hash of the public modulus shared by the
         * key and the certificate.
         */
        rv = kmf_get_cert_id_str(&cert->c_cert.certificate, &idstr);
        if (rv != KMF_OK) {
                (void) kmf_get_kmf_error_str(rv, &kmferr);
                cryptodebug("Error getting ID from cert: %s\n",
                    (kmferr ? kmferr : "Unrecognized KMF error"));
                free(kmferr);
                return (B_FALSE);
        }

        kstype = KMF_KEYSTORE_PK11TOKEN;
        nkeys = 1;
        keytype = KMF_KEYALG_NONE;
        keyclass = KMF_ASYM_PRI;
        format = KMF_FORMAT_UNDEF;
        pincred.cred = (char *)pin;
        pincred.credlen = strlen(pin);
        tokenbool = B_FALSE;
        privatebool = B_TRUE;

        numattr = 0;
        kmf_set_attr_at_index(attrlist, numattr++, KMF_KEYSTORE_TYPE_ATTR,
            &kstype, sizeof (kstype));
        kmf_set_attr_at_index(attrlist, numattr++, KMF_KEY_HANDLE_ATTR,
            &cert->c_privatekey, sizeof (KMF_KEY_HANDLE));
        kmf_set_attr_at_index(attrlist, numattr++, KMF_COUNT_ATTR,
            &nkeys, sizeof (uint32_t));
        kmf_set_attr_at_index(attrlist, numattr++, KMF_KEYALG_ATTR,
            &keytype, sizeof (keytype));
        kmf_set_attr_at_index(attrlist, numattr++, KMF_KEYCLASS_ATTR,
            &keyclass, sizeof (keyclass));
        kmf_set_attr_at_index(attrlist, numattr++, KMF_ENCODE_FORMAT_ATTR,
            &format, sizeof (format));
        kmf_set_attr_at_index(attrlist, numattr++, KMF_IDSTR_ATTR,
            idstr, strlen(idstr));
        kmf_set_attr_at_index(attrlist, numattr++, KMF_CREDENTIAL_ATTR,
            &pincred, sizeof (KMF_CREDENTIAL));
        kmf_set_attr_at_index(attrlist, numattr++, KMF_TOKEN_BOOL_ATTR,
            &tokenbool, sizeof (tokenbool));
        kmf_set_attr_at_index(attrlist, numattr++, KMF_PRIVATE_BOOL_ATTR,
            &privatebool, sizeof (privatebool));

        rv = kmf_find_key(ess->es_kmfhandle, numattr, attrlist);
        free(idstr);
        if (rv != KMF_OK) {
                (void) kmf_get_kmf_error_str(rv, &kmferr);
                cryptodebug("Error finding private key: %s\n",
                    (kmferr ? kmferr : "Unrecognized KMF error"));
                free(kmferr);
                return (B_FALSE);
        }
        if (nkeys != 1) {
                cryptodebug("Error finding private key: No key found\n");
                return (B_FALSE);
        }
        cryptodebug("key found in %s", token_label);
        cryptodebug("elfcertlib_loadprivatekey = 0x%.8X",
            &cert->c_privatekey);

        return (B_TRUE);
}

static const CK_BYTE MD5_DER_PREFIX[] = {0x30, 0x20, 0x30, 0x0c, 0x06, 0x08,
        0x2a, 0x86, 0x48, 0x86, 0xf7, 0x0d, 0x02, 0x05, 0x05, 0x00, 0x04, 0x10};

/*
 * elfcertlib_sign - sign the given DATA using the privatekey in cert
 *
 * IN   ess             - elfsign context structure
 *      cert
 *      data
 *      data_len
 * OUT  sig     - must be big enough to hold the signature of data
 *                Caller must allocate
 *      sig_len - actual length used; 0 on failure.
 * RETURNS      TRUE/FALSE
 */
/*ARGSUSED*/
boolean_t
elfcertlib_sign(ELFsign_t ess, ELFCert_t cert,
        const uchar_t *data, size_t data_len,
        uchar_t *sig, size_t *sig_len)
{
        KMF_RETURN      ret;
        KMF_DATA        tobesigned;
        KMF_DATA        signature;
        uchar_t         der_data[sizeof (MD5_DER_PREFIX) + MD5_DIGEST_LENGTH];
        KMF_ATTRIBUTE   attrlist[8];
        int             numattr;

        if (ess->es_version <= FILESIG_VERSION2) {
                /* compatibility: take MD5 hash of SHA1 hash */
                size_t  derlen = MD5_DIGEST_LENGTH;
                MD5_CTX ctx;

                /*
                 * first: digest using software-based methods, don't
                 * rely on the token for hashing.
                 */
                MD5Init(&ctx);
                MD5Update(&ctx, data, data_len);
                MD5Final(&der_data[sizeof (MD5_DER_PREFIX)], &ctx);

                /*
                 * second: insert prefix
                 */
                (void) memcpy(der_data, MD5_DER_PREFIX,
                    sizeof (MD5_DER_PREFIX));
                /*
                 * prepare to sign the local buffer
                 */
                tobesigned.Data = (uchar_t *)der_data;
                tobesigned.Length = sizeof (MD5_DER_PREFIX) + derlen;
        } else {
                tobesigned.Data = (uchar_t *)data;
                tobesigned.Length = data_len;
        }

        signature.Data = (uchar_t *)sig;
        signature.Length = *sig_len;

        numattr = 0;
        kmf_set_attr_at_index(attrlist, numattr++,
            KMF_KEYSTORE_TYPE_ATTR, &(cert->c_privatekey.kstype),
            sizeof (KMF_KEYSTORE_TYPE));
        kmf_set_attr_at_index(attrlist, numattr++,
            KMF_KEY_HANDLE_ATTR, &cert->c_privatekey, sizeof (KMF_KEY_HANDLE));
        kmf_set_attr_at_index(attrlist, numattr++,
            KMF_OID_ATTR, (KMF_OID *)&KMFOID_RSA, sizeof (KMF_OID));
        kmf_set_attr_at_index(attrlist, numattr++,
            KMF_DATA_ATTR, &tobesigned, sizeof (KMF_DATA));
        kmf_set_attr_at_index(attrlist, numattr++,
            KMF_OUT_DATA_ATTR, &signature, sizeof (KMF_DATA));

        ret = kmf_sign_data(ess->es_kmfhandle, numattr, attrlist);

        if (ret != KMF_OK) {
                char    *kmferr;

                (void) kmf_get_kmf_error_str(ret, &kmferr);
                cryptodebug("Error signing data: %s\n",
                    (kmferr ? kmferr : "Unrecognized KMF error"));
                free(kmferr);
                *sig_len = 0;
                return (B_FALSE);
        }
        *sig_len = signature.Length;
        return (B_TRUE);
}

/*
 * elfcertlib_verifysig - verify the given DATA using the public key in cert
 *
 * IN   ess             - elfsign context structure
 *      cert
 *      signature
 *      sig_len
 *      data
 *      data_len
 * OUT  N/A
 * RETURNS      TRUE/FALSE
 */
boolean_t
elfcertlib_verifysig(ELFsign_t ess, ELFCert_t cert,
        const uchar_t *signature, size_t sig_len,
        const uchar_t *data, size_t data_len)
{
        KMF_RETURN      rv;
        KMF_DATA        indata;
        KMF_DATA        insig;
        KMF_ALGORITHM_INDEX algid;
        KMF_ATTRIBUTE   attrlist[8];
        KMF_KEYSTORE_TYPE       kstype;
        int             numattr;

        indata.Data = (uchar_t *)data;
        indata.Length = data_len;
        insig.Data = (uchar_t *)signature;
        insig.Length = sig_len;

        if (ess->es_version <= FILESIG_VERSION2)
                algid = KMF_ALGID_MD5WithRSA;
        else
                algid = KMF_ALGID_RSA;

        /*
         * We tell KMF to use the PKCS11 verification APIs
         * here to prevent the use of OpenSSL and to keep
         * all validation within the FIPS-140 boundary for
         * the Cryptographic Framework.
         */
        kstype = KMF_KEYSTORE_PK11TOKEN;

        numattr = 0;
        kmf_set_attr_at_index(attrlist, numattr++, KMF_KEYSTORE_TYPE_ATTR,
            &kstype,  sizeof (kstype));
        kmf_set_attr_at_index(attrlist, numattr++, KMF_DATA_ATTR,
            &indata, sizeof (KMF_DATA));
        kmf_set_attr_at_index(attrlist, numattr++, KMF_IN_SIGN_ATTR,
            &insig, sizeof (KMF_DATA));
        kmf_set_attr_at_index(attrlist, numattr++, KMF_SIGNER_CERT_DATA_ATTR,
            (KMF_DATA *)(&cert->c_cert.certificate), sizeof (KMF_DATA));
        kmf_set_attr_at_index(attrlist, numattr++, KMF_ALGORITHM_INDEX_ATTR,
            &algid, sizeof (algid));

        rv = kmf_verify_data(ess->es_kmfhandle, numattr, attrlist);

        return ((rv == KMF_OK));
}

/*
 * elfcertlib_getdn
 *
 * IN   cert
 * OUT  NONE
 * RETURN       dn or NULL
 */
char *
elfcertlib_getdn(ELFCert_t cert)
{
        cryptodebug("elfcertlib_getdn");

        return (cert->c_subject);
}

/*
 * elfcertlib_getissuer
 *
 * IN   cert
 * OUT  NONE
 * RETURN       dn or NULL
 */
char *
elfcertlib_getissuer(ELFCert_t cert)
{
        cryptodebug("elfcertlib_issuer");

        return (cert->c_issuer);
}

boolean_t
elfcertlib_init(ELFsign_t ess)
{
        boolean_t rc = B_TRUE;
        KMF_RETURN rv;
        if (ess->es_kmfhandle == NULL) {
                rv = kmf_initialize(&ess->es_kmfhandle, NULL, NULL);
                if (rv != KMF_OK) {
                        cryptoerror(LOG_ERR,
                            "unable to initialize KMF library");
                        rc = B_FALSE;
                }
        }
        return (rc);
}

void
elfcertlib_fini(ELFsign_t ess)
{
        (void) kmf_finalize(ess->es_kmfhandle);
}

/*
 * set the token device
 */
boolean_t
elfcertlib_settoken(ELFsign_t ess, char *token)
{
        boolean_t       rc = B_TRUE;
        KMF_RETURN      rv;
        KMF_ATTRIBUTE   attrlist[8];
        KMF_KEYSTORE_TYPE       kstype;
        boolean_t       readonly;
        int     numattr;

        kstype = KMF_KEYSTORE_PK11TOKEN;
        readonly = B_TRUE;

        numattr = 0;
        kmf_set_attr_at_index(attrlist, numattr++,
            KMF_KEYSTORE_TYPE_ATTR, &kstype, sizeof (kstype));
        kmf_set_attr_at_index(attrlist, numattr++,
            KMF_TOKEN_LABEL_ATTR, token, strlen(token));
        kmf_set_attr_at_index(attrlist, numattr++,
            KMF_READONLY_ATTR, &readonly, sizeof (readonly));

        rv = kmf_configure_keystore(ess->es_kmfhandle, numattr, attrlist);
        if (rv != KMF_OK) {
                cryptoerror(LOG_ERR, "unable to select token\n");
                rc = B_FALSE;
        }

        return (rc);
}

/*
 * set the certificate CA identification callback
 */
void
elfcertlib_setcertCAcallback(ELFsign_t ess,
    void (*cb)(void *, ELFCert_t, char *))
{
        ess->es_certCAcallback = cb;
}

/*
 * set the certificate verification callback
 */
void
elfcertlib_setcertvercallback(ELFsign_t ess,
    void (*cb)(void *, ELFCert_t, ELFCert_t))
{
        ess->es_certvercallback = cb;
}


/*
 * elfcertlib_releasecert - release a cert
 *
 * IN cert
 * OUT cert
 * RETURN       N/A
 *
 */
void
elfcertlib_releasecert(ELFsign_t ess, ELFCert_t cert)
{
        elfcertlib_freecert(ess, cert);
}

/*
 * elfcertlib_allocatecert - create a new ELFCert_t
 *
 * IN N/A
 * OUT  N/A
 * RETURN       ELFCert_t, NULL on failure.
 */
static ELFCert_t
elfcertlib_allocatecert(void)
{
        ELFCert_t cert = NULL;

        cert = malloc(sizeof (struct ELFCert_s));
        if (cert == NULL) {
                cryptoerror(LOG_ERR,
                    "elfcertlib_allocatecert: malloc failed %s",
                    strerror(errno));
                return (NULL);
        }
        (void) memset(cert, 0, sizeof (struct ELFCert_s));
        cert->c_verified = E_UNCHECKED;
        cert->c_subject = NULL;
        cert->c_issuer = NULL;
        return (cert);
}

/*
 * elfcertlib_freecert - freeup the memory of a cert
 *
 * IN cert
 * OUT cert
 * RETURN       N/A
 *
 */
static void
elfcertlib_freecert(ELFsign_t ess, ELFCert_t cert)
{
        if (cert == NULL)
                return;

        free(cert->c_subject);
        free(cert->c_issuer);

        kmf_free_kmf_cert(ess->es_kmfhandle, &cert->c_cert);
        kmf_free_kmf_key(ess->es_kmfhandle, &cert->c_privatekey);

        free(cert);
}