Bommels05/Mozilla
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Bug 217538 Add shared database to nss.

Browse Source 
core Checking.


git-svn-id: svn://10.0.0.236/trunk@227936 18797224-902f-48f8-a5cc-f745e15eee43
This commit is contained in:
rrelyea%redhat.com
2007-06-13 00:24:57 +00:00
parent ec6e49bcb5
commit 13fa0b6c19
46 changed files with 12721 additions and 5088 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
mozilla/security/nss/lib/softoken/config.mk
View File

@@ -46,7 +46,7 @@ endif
EXTRA_LIBS += \
$(CRYPTOLIB) \
$(DIST)/lib/$(LIB_PREFIX)secutil.$(LIB_SUFFIX) \
$(DIST)/lib/$(LIB_PREFIX)dbm.$(LIB_SUFFIX) \
-lsqlite3 \
$(NULL)
# can't do this in manifest.mn because OS_TARGET isn't defined there.

7
mozilla/security/nss/lib/softoken/fipstest.c
View File

@@ -36,7 +36,7 @@
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/* $Id: fipstest.c,v 1.21 2006-09-22 18:33:25 wtchang%redhat.com Exp $ */
/* $Id: fipstest.c,v 1.22 2007-06-13 00:24:56 rrelyea%redhat.com Exp $ */
#include "softoken.h" /* Required for RC2-ECB, RC2-CBC, RC4, DES-ECB, */
/* DES-CBC, DES3-ECB, DES3-CBC, RSA */
@@ -49,11 +49,6 @@
#ifdef NSS_ENABLE_ECC
#include "secdert.h" /* Required for ECDSA */
#include "ec.h" /* Required for ECDSA */
extern SECStatus
EC_DecodeParams(const SECItem *encodedParams, ECParams **ecparams);
extern SECStatus
EC_CopyParams(PRArenaPool *arena, ECParams *dstParams,
const ECParams *srcParams);
#endif

1
mozilla/security/nss/lib/softoken/fipstokn.c
View File

@@ -52,7 +52,6 @@
#include "seccomon.h"
#include "softoken.h"
#include "lowkeyi.h"
#include "pcert.h"
#include "pkcs11.h"
#include "pkcs11i.h"
#include "prenv.h"

80
mozilla/security/nss/lib/softoken/legacydb/Makefile Normal file
View File

@@ -0,0 +1,80 @@
#! gmake
#
# ***** BEGIN LICENSE BLOCK *****
# Version: MPL 1.1/GPL 2.0/LGPL 2.1
#
# The contents of this file are subject to the Mozilla Public License Version
# 1.1 (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at
# http://www.mozilla.org/MPL/
#
# Software distributed under the License is distributed on an "AS IS" basis,
# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
# for the specific language governing rights and limitations under the
# License.
#
# The Original Code is the Netscape security libraries.
#
# The Initial Developer of the Original Code is
# Netscape Communications Corporation.
# Portions created by the Initial Developer are Copyright (C) 1994-2000
# the Initial Developer. All Rights Reserved.
#
# Contributor(s):
#
# Alternatively, the contents of this file may be used under the terms of
# either the GNU General Public License Version 2 or later (the "GPL"), or
# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
# in which case the provisions of the GPL or the LGPL are applicable instead
# of those above. If you wish to allow use of your version of this file only
# under the terms of either the GPL or the LGPL, and not to allow others to
# use your version of this file under the terms of the MPL, indicate your
# decision by deleting the provisions above and replace them with the notice
# and other provisions required by the GPL or the LGPL. If you do not delete
# the provisions above, a recipient may use your version of this file under
# the terms of any one of the MPL, the GPL or the LGPL.
#
# ***** END LICENSE BLOCK *****
#######################################################################
# (1) Include initial platform-independent assignments (MANDATORY). #
#######################################################################
include manifest.mn
#######################################################################
# (2) Include "global" configuration information. (OPTIONAL) #
#######################################################################
include $(CORE_DEPTH)/coreconf/config.mk
#######################################################################
# (3) Include "component" configuration information. (OPTIONAL) #
#######################################################################
#######################################################################
# (4) Include "local" platform-dependent assignments (OPTIONAL). #
#######################################################################
include config.mk
#######################################################################
# (5) Execute "global" rules. (OPTIONAL) #
#######################################################################
include $(CORE_DEPTH)/coreconf/rules.mk
#######################################################################
# (6) Execute "component" rules. (OPTIONAL) #
#######################################################################
#######################################################################
# (7) Execute "local" rules. (OPTIONAL). #
#######################################################################
export:: private_export

6
mozilla/security/nss/lib/softoken/cdbhdl.h → mozilla/security/nss/lib/softoken/legacydb/cdbhdl.h
View File

@@ -37,7 +37,7 @@
* cdbhdl.h - certificate database handle
* private to the certdb module
*
* $Id: cdbhdl.h,v 1.10 2005-09-28 17:12:17 relyea%netscape.com Exp $
* $Id: cdbhdl.h,v 1.2 2007-06-13 00:24:57 rrelyea%redhat.com Exp $
*/
#ifndef _CDBHDL_H_
#define _CDBHDL_H_
@@ -57,8 +57,6 @@ struct NSSLOWCERTCertDBHandleStr {
PRInt32 ref; /* reference count */
};
#define nsslowcert_reference(x) (PR_AtomicIncrement(&(x)->ref) , (x))
#ifdef DBM_USING_NSPR
#define NO_RDONLY PR_RDONLY
#define NO_RDWR PR_RDWR
@@ -82,8 +80,6 @@ DB * rdbopen(const char *appName, const char *prefix,
DB *dbsopen (const char *dbname , int flags, int mode, DBTYPE type,
const void * appData);
SECStatus db_Copy(DB *dest,DB *src);
int db_BeginTransaction(DB *db);
int db_FinishTransaction(DB *db, PRBool abort);
int db_InitComplete(DB *db);
#endif

102
mozilla/security/nss/lib/softoken/legacydb/config.mk Normal file
View File

@@ -0,0 +1,102 @@
#
# ***** BEGIN LICENSE BLOCK *****
# Version: MPL 1.1/GPL 2.0/LGPL 2.1
#
# The contents of this file are subject to the Mozilla Public License Version
# 1.1 (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at
# http://www.mozilla.org/MPL/
#
# Software distributed under the License is distributed on an "AS IS" basis,
# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
# for the specific language governing rights and limitations under the
# License.
#
# The Original Code is the Netscape security libraries.
#
# The Initial Developer of the Original Code is
# Netscape Communications Corporation.
# Portions created by the Initial Developer are Copyright (C) 1994-2000
# the Initial Developer. All Rights Reserved.
#
# Contributor(s):
#
# Alternatively, the contents of this file may be used under the terms of
# either the GNU General Public License Version 2 or later (the "GPL"), or
# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
# in which case the provisions of the GPL or the LGPL are applicable instead
# of those above. If you wish to allow use of your version of this file only
# under the terms of either the GPL or the LGPL, and not to allow others to
# use your version of this file under the terms of the MPL, indicate your
# decision by deleting the provisions above and replace them with the notice
# and other provisions required by the GPL or the LGPL. If you do not delete
# the provisions above, a recipient may use your version of this file under
# the terms of any one of the MPL, the GPL or the LGPL.
#
# ***** END LICENSE BLOCK *****
# $(PROGRAM) has explicit dependencies on $(EXTRA_LIBS)
CRYPTOLIB=$(DIST)/lib/$(LIB_PREFIX)freebl.$(LIB_SUFFIX)
CRYPTODIR=../freebl
ifdef MOZILLA_SECURITY_BUILD
CRYPTOLIB=$(DIST)/lib/$(LIB_PREFIX)crypto.$(LIB_SUFFIX)
CRYPTODIR=../crypto
endif
EXTRA_LIBS += \
$(CRYPTOLIB) \
$(DIST)/lib/$(LIB_PREFIX)secutil.$(LIB_SUFFIX)
$(DIST)/lib/$(LIB_PREFIX)dbm.$(LIB_SUFFIX) \
$(NULL)
# can't do this in manifest.mn because OS_TARGET isn't defined there.
ifeq (,$(filter-out WIN%,$(OS_TARGET)))
# don't want the 32 in the shared library name
SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION)$(IMPORT_LIB_SUFFIX)
RES = $(OBJDIR)/$(LIBRARY_NAME).res
RESNAME = $(LIBRARY_NAME).rc
ifdef NS_USE_GCC
EXTRA_SHARED_LIBS += \
-L$(NSPR_LIB_DIR) \
-lplc4 \
-lplds4 \
-lnspr4 \
$(NULL)
else # ! NS_USE_GCC
EXTRA_SHARED_LIBS += \
$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plc4.lib \
$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plds4.lib \
$(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)nspr4.lib \
$(NULL)
endif # NS_USE_GCC
else
# $(PROGRAM) has NO explicit dependencies on $(EXTRA_SHARED_LIBS)
# $(EXTRA_SHARED_LIBS) come before $(OS_LIBS), except on AIX.
EXTRA_SHARED_LIBS += \
-L$(NSPR_LIB_DIR) \
-lplc4 \
-lplds4 \
-lnspr4 \
$(NULL)
endif
ifeq ($(OS_TARGET),SunOS)
# The -R '$ORIGIN' linker option instructs this library to search for its
# dependencies in the same directory where it resides.
MKSHLIB += -R '$$ORIGIN'
OS_LIBS += -lbsm
endif
ifeq ($(OS_TARGET),WINCE)
DEFINES += -DDBM_USING_NSPR
endif
# indicates dependency on freebl static lib
$(SHARED_LIBRARY): $(CRYPTOLIB)

15
mozilla/security/nss/lib/softoken/dbmshim.c → mozilla/security/nss/lib/softoken/legacydb/dbmshim.c
View File

@@ -37,24 +37,15 @@
/*
* Berkeley DB 1.85 Shim code to handle blobs.
*
* $Id: dbmshim.c,v 1.13 2006-06-17 00:09:59 wtchang%redhat.com Exp $
* $Id: dbmshim.c,v 1.2 2007-06-13 00:24:57 rrelyea%redhat.com Exp $
*/
#include "mcom_db.h"
#include "secitem.h"
#include "secder.h"
#include "prprf.h"
#include "cdbhdl.h"
/* Call to SFTK_FreeSlot below */
#include "pcertt.h"
#include "secasn1.h"
#include "secerr.h"
#include "nssb64.h"
#include "blapi.h"
#include "sechash.h"
#include "secerr.h"
#include "pkcs11i.h"
#include "lgdb.h"
/*
* Blob block:

1307
mozilla/security/nss/lib/softoken/keydb.c → mozilla/security/nss/lib/softoken/legacydb/keydb.c
View File

File diff suppressed because it is too large Load Diff

2
mozilla/security/nss/lib/softoken/keydbi.h → mozilla/security/nss/lib/softoken/legacydb/keydbi.h
View File

@@ -36,7 +36,7 @@
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/* $Id: keydbi.h,v 1.7 2005-09-28 17:12:17 relyea%netscape.com Exp $ */
/* $Id: keydbi.h,v 1.2 2007-06-13 00:24:57 rrelyea%redhat.com Exp $ */
#ifndef _KEYDBI_H_
#define _KEYDBI_H_

64
mozilla/security/nss/lib/softoken/legacydb/legacydb.def Normal file
View File

@@ -0,0 +1,64 @@
;+#
;+# ***** BEGIN LICENSE BLOCK *****
;+# Version: MPL 1.1/GPL 2.0/LGPL 2.1
;+#
;+# The contents of this file are subject to the Mozilla Public License Version
;+# 1.1 (the "License"); you may not use this file except in compliance with
;+# the License. You may obtain a copy of the License at
;+# http://www.mozilla.org/MPL/
;+#
;+# Software distributed under the License is distributed on an "AS IS" basis,
;+# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
;+# for the specific language governing rights and limitations under the
;+# License.
;+#
;+# The Original Code is the Netscape security libraries.
;+#
;+# The Initial Developer of the Original Code is
;+# Netscape Communications Corporation.
;+# Portions created by the Initial Developer are Copyright (C) 2000
;+# the Initial Developer. All Rights Reserved.
;+#
;+# Contributor(s):
;+# Dr Stephen Henson <stephen.henson@gemplus.com>
;+#
;+# Alternatively, the contents of this file may be used under the terms of
;+# either the GNU General Public License Version 2 or later (the "GPL"), or
;+# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
;+# in which case the provisions of the GPL or the LGPL are applicable instead
;+# of those above. If you wish to allow use of your version of this file only
;+# under the terms of either the GPL or the LGPL, and not to allow others to
;+# use your version of this file under the terms of the MPL, indicate your
;+# decision by deleting the provisions above and replace them with the notice
;+# and other provisions required by the GPL or the LGPL. If you do not delete
;+# the provisions above, a recipient may use your version of this file under
;+# the terms of any one of the MPL, the GPL or the LGPL.
;+#
;+# ***** END LICENSE BLOCK *****
;+#
;+# OK, this file is meant to support SUN, LINUX, AIX and WINDOWS
;+# 1. For all unix platforms, the string ";-" means "remove this line"
;+# 2. For all unix platforms, the string " DATA " will be removed from any
;+# line on which it occurs.
;+# 3. Lines containing ";+" will have ";+" removed on SUN and LINUX.
;+# On AIX, lines containing ";+" will be removed.
;+# 4. For all unix platforms, the string ";;" will thave the ";;" removed.
;+# 5. For all unix platforms, after the above processing has taken place,
;+# all characters after the first ";" on the line will be removed.
;+# And for AIX, the first ";" will also be removed.
;+# This file is passed directly to windows. Since ';' is a comment, all UNIX
;+# directives are hidden behind ";", ";+", and ";-"
;+LGDBM_3.12 { # NSS 3.12 release
;+ global:
LIBRARY lgdbm3 ;-
EXPORTS ;-
legacy_Open;
legacy_Shutdown;
legacy_ReadSecmodDB;
legacy_ReleaseSecmodDBData;
legacy_AddSecmodDB;
legacy_DeleteSecmodDB;
legacy_SetCryptFunctions;
;+ local:
;+ *;
;+};

1748
mozilla/security/nss/lib/softoken/legacydb/lgattr.c Normal file
View File

File diff suppressed because it is too large Load Diff

955
mozilla/security/nss/lib/softoken/legacydb/lgcreate.c Normal file
View File

@@ -0,0 +1,955 @@
/* ***** BEGIN LICENSE BLOCK *****
* Version: MPL 1.1/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Mozilla Public License Version
* 1.1 (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
* http://www.mozilla.org/MPL/
*
* Software distributed under the License is distributed on an "AS IS" basis,
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
* for the specific language governing rights and limitations under the
* License.
*
* The Original Code is the Netscape security libraries.
*
* The Initial Developer of the Original Code is
* Netscape Communications Corporation.
* Portions created by the Initial Developer are Copyright (C) 1994-2000
* the Initial Developer. All Rights Reserved.
*
* Contributor(s):
* Dr Vipul Gupta <vipul.gupta@sun.com>, Sun Microsystems Laboratories
*
* Alternatively, the contents of this file may be used under the terms of
* either the GNU General Public License Version 2 or later (the "GPL"), or
* the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the MPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
#include "secitem.h"
#include "pkcs11.h"
#include "lgdb.h"
#include "pcert.h"
#include "lowkeyi.h"
#include "blapi.h"
#include "secder.h"
#include "keydbi.h"
/*
* ******************** Object Creation Utilities ***************************
*/
/*
* check the consistancy and initialize a Certificate Object
*/
static CK_RV
lg_createCertObject(SDB *sdb, CK_OBJECT_HANDLE *handle,
const CK_ATTRIBUTE *templ, CK_ULONG count)
{
SECItem derCert;
NSSLOWCERTCertificate *cert;
NSSLOWCERTCertTrust *trust = NULL;
NSSLOWCERTCertTrust userTrust =
{ CERTDB_USER, CERTDB_USER, CERTDB_USER };
NSSLOWCERTCertTrust defTrust =
{ CERTDB_TRUSTED_UNKNOWN,
CERTDB_TRUSTED_UNKNOWN, CERTDB_TRUSTED_UNKNOWN };
char *label = NULL;
char *email = NULL;
SECStatus rv;
PRBool inDB = PR_TRUE;
NSSLOWCERTCertDBHandle *certHandle = lg_getCertDB(sdb);
NSSLOWKEYDBHandle *keyHandle = NULL;
CK_CERTIFICATE_TYPE type;
const CK_ATTRIBUTE *attribute;
/* we can't store any certs private */
if (lg_isTrue(CKA_PRIVATE, templ, count)) {
return CKR_ATTRIBUTE_VALUE_INVALID;
}
/* We only support X.509 Certs for now */
attribute = lg_FindAttribute(CKA_CERTIFICATE_TYPE, templ, count);
if (attribute == NULL) return CKR_TEMPLATE_INCOMPLETE;
type = *(CK_CERTIFICATE_TYPE *)attribute->pValue;
if (type != CKC_X_509) {
return CKR_ATTRIBUTE_VALUE_INVALID;
}
/* X.509 Certificate */
if (certHandle == NULL) {
return CKR_TOKEN_WRITE_PROTECTED;
}
/* get the der cert */
attribute = lg_FindAttribute(CKA_VALUE, templ, count);
if (!attribute) {
return CKR_ATTRIBUTE_VALUE_INVALID;
}
derCert.type = 0;
derCert.data = (unsigned char *)attribute->pValue;
derCert.len = attribute->ulValueLen ;
label = lg_getString(CKA_LABEL, templ, count);
cert = nsslowcert_FindCertByDERCert(certHandle, &derCert);
if (cert == NULL) {
cert = nsslowcert_DecodeDERCertificate(&derCert, label);
inDB = PR_FALSE;
}
if (cert == NULL) {
if (label) PORT_Free(label);
return CKR_ATTRIBUTE_VALUE_INVALID;
}
keyHandle = lg_getKeyDB(sdb);
if (keyHandle) {
if (nsslowkey_KeyForCertExists(keyHandle,cert)) {
trust = &userTrust;
}
}
if (!inDB) {
if (!trust) trust = &defTrust;
rv = nsslowcert_AddPermCert(certHandle, cert, label, trust);
} else {
rv = trust ? nsslowcert_ChangeCertTrust(certHandle,cert,trust) :
SECSuccess;
}
if (label) PORT_Free(label);
if (rv != SECSuccess) {
nsslowcert_DestroyCertificate(cert);
return CKR_DEVICE_ERROR;
}
/*
* Add a NULL S/MIME profile if necessary.
*/
email = lg_getString(CKA_NETSCAPE_EMAIL, templ, count);
if (email) {
certDBEntrySMime *entry;
entry = nsslowcert_ReadDBSMimeEntry(certHandle,email);
if (!entry) {
nsslowcert_SaveSMimeProfile(certHandle, email,
&cert->derSubject, NULL, NULL);
} else {
nsslowcert_DestroyDBEntry((certDBEntry *)entry);
}
PORT_Free(email);
}
*handle=lg_mkHandle(sdb,&cert->certKey,LG_TOKEN_TYPE_CERT);
nsslowcert_DestroyCertificate(cert);
return CKR_OK;
}
unsigned int
lg_MapTrust(CK_TRUST trust, PRBool clientAuth)
{
unsigned int trustCA = clientAuth ? CERTDB_TRUSTED_CLIENT_CA :
CERTDB_TRUSTED_CA;
switch (trust) {
case CKT_NETSCAPE_TRUSTED:
return CERTDB_VALID_PEER|CERTDB_TRUSTED;
case CKT_NETSCAPE_TRUSTED_DELEGATOR:
return CERTDB_VALID_CA|trustCA;
case CKT_NETSCAPE_UNTRUSTED:
return CERTDB_NOT_TRUSTED;
case CKT_NETSCAPE_MUST_VERIFY:
return 0;
case CKT_NETSCAPE_VALID: /* implies must verify */
return CERTDB_VALID_PEER;
case CKT_NETSCAPE_VALID_DELEGATOR: /* implies must verify */
return CERTDB_VALID_CA;
default:
break;
}
return CERTDB_TRUSTED_UNKNOWN;
}
/*
* check the consistancy and initialize a Trust Object
*/
static CK_RV
lg_createTrustObject(SDB *sdb, CK_OBJECT_HANDLE *handle,
const CK_ATTRIBUTE *templ, CK_ULONG count)
{
const CK_ATTRIBUTE *issuer = NULL;
const CK_ATTRIBUTE *serial = NULL;
NSSLOWCERTCertificate *cert = NULL;
const CK_ATTRIBUTE *trust;
CK_TRUST sslTrust = CKT_NETSCAPE_TRUST_UNKNOWN;
CK_TRUST clientTrust = CKT_NETSCAPE_TRUST_UNKNOWN;
CK_TRUST emailTrust = CKT_NETSCAPE_TRUST_UNKNOWN;
CK_TRUST signTrust = CKT_NETSCAPE_TRUST_UNKNOWN;
CK_BBOOL stepUp;
NSSLOWCERTCertTrust dbTrust = { 0 };
SECStatus rv;
NSSLOWCERTCertDBHandle *certHandle = lg_getCertDB(sdb);
NSSLOWCERTIssuerAndSN issuerSN;
/* we can't store any certs private */
if (lg_isTrue(CKA_PRIVATE, templ, count)) {
return CKR_ATTRIBUTE_VALUE_INVALID;
}
if (certHandle == NULL) {
return CKR_TOKEN_WRITE_PROTECTED;
}
issuer = lg_FindAttribute(CKA_ISSUER, templ, count);
serial = lg_FindAttribute(CKA_SERIAL_NUMBER, templ, count);
if (issuer && serial) {
issuerSN.derIssuer.data = (unsigned char *)issuer->pValue;
issuerSN.derIssuer.len = issuer->ulValueLen ;
issuerSN.serialNumber.data = (unsigned char *)serial->pValue;
issuerSN.serialNumber.len = serial->ulValueLen ;
cert = nsslowcert_FindCertByIssuerAndSN(certHandle,&issuerSN);
}
if (cert == NULL) {
return CKR_ATTRIBUTE_VALUE_INVALID;
}
lg_GetULongAttribute(CKA_TRUST_SERVER_AUTH, templ, count, &sslTrust);
lg_GetULongAttribute(CKA_TRUST_CLIENT_AUTH, templ, count, &clientTrust);
lg_GetULongAttribute(CKA_TRUST_EMAIL_PROTECTION, templ, count, &emailTrust);
lg_GetULongAttribute(CKA_TRUST_CODE_SIGNING, templ, count, &signTrust);
stepUp = CK_FALSE;
trust = lg_FindAttribute(CKA_TRUST_STEP_UP_APPROVED, templ, count);
if (trust) {
if (trust->ulValueLen == sizeof(CK_BBOOL)) {
stepUp = *(CK_BBOOL*)trust->pValue;
}
}
/* preserve certain old fields */
if (cert->trust) {
dbTrust.sslFlags = cert->trust->sslFlags & CERTDB_PRESERVE_TRUST_BITS;
dbTrust.emailFlags=
cert->trust->emailFlags & CERTDB_PRESERVE_TRUST_BITS;
dbTrust.objectSigningFlags =
cert->trust->objectSigningFlags & CERTDB_PRESERVE_TRUST_BITS;
}
dbTrust.sslFlags |= lg_MapTrust(sslTrust,PR_FALSE);
dbTrust.sslFlags |= lg_MapTrust(clientTrust,PR_TRUE);
dbTrust.emailFlags |= lg_MapTrust(emailTrust,PR_FALSE);
dbTrust.objectSigningFlags |= lg_MapTrust(signTrust,PR_FALSE);
if (stepUp) {
dbTrust.sslFlags |= CERTDB_GOVT_APPROVED_CA;
}
rv = nsslowcert_ChangeCertTrust(certHandle,cert,&dbTrust);
*handle=lg_mkHandle(sdb,&cert->certKey,LG_TOKEN_TYPE_TRUST);
nsslowcert_DestroyCertificate(cert);
if (rv != SECSuccess) {
return CKR_DEVICE_ERROR;
}
return CKR_OK;
}
/*
* check the consistancy and initialize a Trust Object
*/
static CK_RV
lg_createSMimeObject(SDB *sdb, CK_OBJECT_HANDLE *handle,
const CK_ATTRIBUTE *templ, CK_ULONG count)
{
SECItem derSubj,rawProfile,rawTime,emailKey;
SECItem *pRawProfile = NULL;
SECItem *pRawTime = NULL;
char *email = NULL;
const CK_ATTRIBUTE *subject = NULL,
*profile = NULL,
*time = NULL;
SECStatus rv;
NSSLOWCERTCertDBHandle *certHandle;
CK_RV ck_rv = CKR_OK;
/* we can't store any certs private */
if (lg_isTrue(CKA_PRIVATE,templ,count)) {
return CKR_ATTRIBUTE_VALUE_INVALID;
}
certHandle = lg_getCertDB(sdb);
if (certHandle == NULL) {
return CKR_TOKEN_WRITE_PROTECTED;
}
/* lookup SUBJECT */
subject = lg_FindAttribute(CKA_SUBJECT,templ,count);
PORT_Assert(subject);
if (!subject) {
ck_rv = CKR_ATTRIBUTE_VALUE_INVALID;
goto loser;
}
derSubj.data = (unsigned char *)subject->pValue;
derSubj.len = subject->ulValueLen ;
derSubj.type = 0;
/* lookup VALUE */
profile = lg_FindAttribute(CKA_VALUE,templ,count);
if (profile) {
rawProfile.data = (unsigned char *)profile->pValue;
rawProfile.len = profile->ulValueLen ;
rawProfile.type = siBuffer;
pRawProfile = &rawProfile;
}
/* lookup Time */
time = lg_FindAttribute(CKA_NETSCAPE_SMIME_TIMESTAMP,templ,count);
if (time) {
rawTime.data = (unsigned char *)time->pValue;
rawTime.len = time->ulValueLen ;
rawTime.type = siBuffer;
pRawTime = &rawTime;
}
email = lg_getString(CKA_NETSCAPE_EMAIL,templ,count);
if (!email) {
ck_rv = CKR_ATTRIBUTE_VALUE_INVALID;
goto loser;
}
/* Store S/MIME Profile by SUBJECT */
rv = nsslowcert_SaveSMimeProfile(certHandle, email, &derSubj,
pRawProfile,pRawTime);
if (rv != SECSuccess) {
ck_rv = CKR_DEVICE_ERROR;
goto loser;
}
emailKey.data = (unsigned char *)email;
emailKey.len = PORT_Strlen(email)+1;
*handle = lg_mkHandle(sdb, &emailKey, LG_TOKEN_TYPE_SMIME);
loser:
if (email) PORT_Free(email);
return ck_rv;
}
/*
* check the consistancy and initialize a Trust Object
*/
static CK_RV
lg_createCrlObject(SDB *sdb, CK_OBJECT_HANDLE *handle,
const CK_ATTRIBUTE *templ, CK_ULONG count)
{
PRBool isKRL = PR_FALSE;
SECItem derSubj,derCrl;
char *url = NULL;
const CK_ATTRIBUTE *subject,*crl;
SECStatus rv;
NSSLOWCERTCertDBHandle *certHandle;
certHandle = lg_getCertDB(sdb);
/* we can't store any private crls */
if (lg_isTrue(CKA_PRIVATE,templ,count)) {
return CKR_ATTRIBUTE_VALUE_INVALID;
}
if (certHandle == NULL) {
return CKR_TOKEN_WRITE_PROTECTED;
}
/* lookup SUBJECT */
subject = lg_FindAttribute(CKA_SUBJECT,templ,count);
if (!subject) {
return CKR_ATTRIBUTE_VALUE_INVALID;
}
derSubj.data = (unsigned char *)subject->pValue;
derSubj.len = subject->ulValueLen ;
/* lookup VALUE */
crl = lg_FindAttribute(CKA_VALUE,templ,count);
PORT_Assert(crl);
if (!crl) {
return CKR_ATTRIBUTE_VALUE_INVALID;
}
derCrl.data = (unsigned char *)crl->pValue;
derCrl.len = crl->ulValueLen ;
url = lg_getString(CKA_NETSCAPE_URL,templ,count);
isKRL = lg_isTrue(CKA_NETSCAPE_KRL,templ,count);
/* Store CRL by SUBJECT */
rv = nsslowcert_AddCrl(certHandle, &derCrl, &derSubj, url, isKRL);
if (url) {
PORT_Free(url);
}
if (rv != SECSuccess) {
return CKR_DEVICE_ERROR;
}
/* if we overwrote the existing CRL, poison the handle entry so we get
* a new object handle */
(void) lg_poisonHandle(sdb, &derSubj,
isKRL ? LG_TOKEN_KRL_HANDLE : LG_TOKEN_TYPE_CRL);
*handle = lg_mkHandle(sdb, &derSubj,
isKRL ? LG_TOKEN_KRL_HANDLE : LG_TOKEN_TYPE_CRL);
return CKR_OK;
}
/*
* check the consistancy and initialize a Public Key Object
*/
static CK_RV
lg_createPublicKeyObject(SDB *sdb, CK_KEY_TYPE key_type,
CK_OBJECT_HANDLE *handle, const CK_ATTRIBUTE *templ, CK_ULONG count)
{
CK_ATTRIBUTE_TYPE pubKeyAttr = CKA_VALUE;
CK_RV crv;
NSSLOWKEYPrivateKey *priv;
SECItem pubKey;
NSSLOWKEYDBHandle *keyHandle = NULL;
switch (key_type) {
case CKK_RSA:
pubKeyAttr = CKA_MODULUS;
break;
#ifdef NSS_ENABLE_ECC
case CKK_EC:
pubKeyAttr = CKA_EC_POINT;
break;
#endif /* NSS_ENABLE_ECC */
case CKK_DSA:
case CKK_DH:
break;
default:
return CKR_ATTRIBUTE_VALUE_INVALID;
}
crv = lg_Attribute2SSecItem(NULL,pubKeyAttr,templ,count,&pubKey);
if (crv != CKR_OK) return crv;
PORT_Assert(pubKey.data);
keyHandle = lg_getKeyDB(sdb);
if (keyHandle == NULL) {
PORT_Free(pubKey.data);
return CKR_TOKEN_WRITE_PROTECTED;
}
if (keyHandle->version != 3) {
unsigned char buf[SHA1_LENGTH];
SHA1_HashBuf(buf,pubKey.data,pubKey.len);
PORT_Memcpy(pubKey.data,buf,sizeof(buf));
pubKey.len = sizeof(buf);
}
/* make sure the associated private key already exists */
/* only works if we are logged in */
priv = nsslowkey_FindKeyByPublicKey(keyHandle, &pubKey, sdb /*password*/);
if (priv == NULL) {
PORT_Free(pubKey.data);
return crv;
}
nsslowkey_DestroyPrivateKey(priv);
*handle = lg_mkHandle(sdb, &pubKey, LG_TOKEN_TYPE_PUB);
PORT_Free(pubKey.data);
return CKR_OK;
}
/* make a private key from a verified object */
static NSSLOWKEYPrivateKey *
lg_mkPrivKey(SDB *sdb, const CK_ATTRIBUTE *templ, CK_ULONG count,
CK_KEY_TYPE key_type, CK_RV *crvp)
{
NSSLOWKEYPrivateKey *privKey;
PLArenaPool *arena;
CK_RV crv = CKR_OK;
SECStatus rv;
arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
if (arena == NULL) {
*crvp = CKR_HOST_MEMORY;
return NULL;
}
privKey = (NSSLOWKEYPrivateKey *)
PORT_ArenaZAlloc(arena,sizeof(NSSLOWKEYPrivateKey));
if (privKey == NULL) {
PORT_FreeArena(arena,PR_FALSE);
*crvp = CKR_HOST_MEMORY;
return NULL;
}
/* in future this would be a switch on key_type */
privKey->arena = arena;
switch (key_type) {
case CKK_RSA:
privKey->keyType = NSSLOWKEYRSAKey;
crv=lg_Attribute2SSecItem(arena,CKA_MODULUS,templ,count,
&privKey->u.rsa.modulus);
if (crv != CKR_OK) break;
crv=lg_Attribute2SSecItem(arena,CKA_PUBLIC_EXPONENT,templ,count,
&privKey->u.rsa.publicExponent);
if (crv != CKR_OK) break;
crv=lg_PrivAttr2SSecItem(arena,CKA_PRIVATE_EXPONENT,templ,count,
&privKey->u.rsa.privateExponent, sdb);
if (crv != CKR_OK) break;
crv=lg_PrivAttr2SSecItem(arena,CKA_PRIME_1,templ,count,
&privKey->u.rsa.prime1, sdb);
if (crv != CKR_OK) break;
crv=lg_PrivAttr2SSecItem(arena,CKA_PRIME_2,templ,count,
&privKey->u.rsa.prime2, sdb);
if (crv != CKR_OK) break;
crv=lg_PrivAttr2SSecItem(arena,CKA_EXPONENT_1,templ,count,
&privKey->u.rsa.exponent1, sdb);
if (crv != CKR_OK) break;
crv=lg_PrivAttr2SSecItem(arena,CKA_EXPONENT_2,templ,count,
&privKey->u.rsa.exponent2, sdb);
if (crv != CKR_OK) break;
crv=lg_PrivAttr2SSecItem(arena,CKA_COEFFICIENT,templ,count,
&privKey->u.rsa.coefficient, sdb);
if (crv != CKR_OK) break;
rv = DER_SetUInteger(privKey->arena, &privKey->u.rsa.version,
NSSLOWKEY_VERSION);
if (rv != SECSuccess) crv = CKR_HOST_MEMORY;
break;
case CKK_DSA:
privKey->keyType = NSSLOWKEYDSAKey;
crv = lg_Attribute2SSecItem(arena,CKA_PRIME,templ,count,
&privKey->u.dsa.params.prime);
if (crv != CKR_OK) break;
crv = lg_Attribute2SSecItem(arena,CKA_SUBPRIME,templ,count,
&privKey->u.dsa.params.subPrime);
if (crv != CKR_OK) break;
crv = lg_Attribute2SSecItem(arena,CKA_BASE,templ,count,
&privKey->u.dsa.params.base);
if (crv != CKR_OK) break;
crv = lg_PrivAttr2SSecItem(arena,CKA_VALUE,templ,count,
&privKey->u.dsa.privateValue, sdb);
if (crv != CKR_OK) break;
if (lg_hasAttribute(CKA_NETSCAPE_DB, templ,count)) {
crv = lg_Attribute2SSecItem(arena, CKA_NETSCAPE_DB,templ,count,
&privKey->u.dsa.publicValue);
/* privKey was zero'd so public value is already set to NULL, 0
* if we don't set it explicitly */
}
break;
case CKK_DH:
privKey->keyType = NSSLOWKEYDHKey;
crv = lg_Attribute2SSecItem(arena,CKA_PRIME,templ,count,
&privKey->u.dh.prime);
if (crv != CKR_OK) break;
crv = lg_Attribute2SSecItem(arena,CKA_BASE,templ,count,
&privKey->u.dh.base);
if (crv != CKR_OK) break;
crv = lg_PrivAttr2SSecItem(arena,CKA_VALUE,templ,count,
&privKey->u.dh.privateValue, sdb);
if (crv != CKR_OK) break;
if (lg_hasAttribute(CKA_NETSCAPE_DB, templ, count)) {
crv = lg_Attribute2SSecItem(arena, CKA_NETSCAPE_DB,templ,count,
&privKey->u.dh.publicValue);
/* privKey was zero'd so public value is already set to NULL, 0
* if we don't set it explicitly */
}
break;
#ifdef NSS_ENABLE_ECC
case CKK_EC:
privKey->keyType = NSSLOWKEYECKey;
crv = lg_Attribute2SSecItem(arena, CKA_EC_PARAMS,templ,count,
&privKey->u.ec.ecParams.DEREncoding);
if (crv != CKR_OK) break;
/* Fill out the rest of the ecParams structure
* based on the encoded params
*/
if (LGEC_FillParams(arena, &privKey->u.ec.ecParams.DEREncoding,
&privKey->u.ec.ecParams) != SECSuccess) {
crv = CKR_DOMAIN_PARAMS_INVALID;
break;
}
crv = lg_PrivAttr2SSecItem(arena,CKA_VALUE,templ,count,
&privKey->u.ec.privateValue, sdb);
if (crv != CKR_OK) break;
if (lg_hasAttribute(CKA_NETSCAPE_DB,templ,count)) {
crv = lg_Attribute2SSecItem(arena, CKA_NETSCAPE_DB,templ,count,
&privKey->u.ec.publicValue);
if (crv != CKR_OK) break;
/* privKey was zero'd so public value is already set to NULL, 0
* if we don't set it explicitly */
}
rv = DER_SetUInteger(privKey->arena, &privKey->u.ec.version,
NSSLOWKEY_EC_PRIVATE_KEY_VERSION);
if (rv != SECSuccess) crv = CKR_HOST_MEMORY;
break;
#endif /* NSS_ENABLE_ECC */
default:
crv = CKR_KEY_TYPE_INCONSISTENT;
break;
}
*crvp = crv;
if (crv != CKR_OK) {
PORT_FreeArena(arena,PR_FALSE);
return NULL;
}
return privKey;
}
/*
* check the consistancy and initialize a Private Key Object
*/
static CK_RV
lg_createPrivateKeyObject(SDB *sdb, CK_KEY_TYPE key_type,
CK_OBJECT_HANDLE *handle, const CK_ATTRIBUTE *templ, CK_ULONG count)
{
NSSLOWKEYPrivateKey *privKey;
char *label;
SECStatus rv = SECSuccess;
CK_RV crv = CKR_DEVICE_ERROR;
SECItem pubKey;
NSSLOWKEYDBHandle *keyHandle = lg_getKeyDB(sdb);
if (keyHandle == NULL) {
return CKR_TOKEN_WRITE_PROTECTED;
}
privKey=lg_mkPrivKey(sdb, templ,count,key_type,&crv);
if (privKey == NULL) return crv;
label = lg_getString(CKA_LABEL,templ,count);
crv = lg_Attribute2SSecItem(NULL,CKA_NETSCAPE_DB,templ,count,&pubKey);
if (crv != CKR_OK) {
crv = CKR_TEMPLATE_INCOMPLETE;
rv = SECFailure;
goto fail;
}
#ifdef notdef
if (keyHandle->version != 3) {
unsigned char buf[SHA1_LENGTH];
SHA1_HashBuf(buf,pubKey.data,pubKey.len);
PORT_Memcpy(pubKey.data,buf,sizeof(buf));
pubKey.len = sizeof(buf);
}
#endif
/* get the key type */
if (key_type == CKK_RSA) {
rv = RSA_PrivateKeyCheck(&privKey->u.rsa);
if (rv == SECFailure) {
goto fail;
}
}
rv = nsslowkey_StoreKeyByPublicKey(keyHandle, privKey, &pubKey,
label, sdb /*->password*/);
fail:
if (label) PORT_Free(label);
*handle = lg_mkHandle(sdb,&pubKey,LG_TOKEN_TYPE_PRIV);
if (pubKey.data) PORT_Free(pubKey.data);
nsslowkey_DestroyPrivateKey(privKey);
if (rv != SECSuccess) return crv;
return CKR_OK;
}
#define LG_KEY_MAX_RETRIES 10 /* don't hang if we are having problems with the rng */
#define LG_KEY_ID_SIZE 18 /* don't use either SHA1 or MD5 sizes */
/*
* Secret keys must have a CKA_ID value to be stored in the database. This code
* will generate one if there wasn't one already.
*/
static CK_RV
lg_GenerateSecretCKA_ID(NSSLOWKEYDBHandle *handle, SECItem *id, char *label)
{
unsigned int retries;
SECStatus rv = SECSuccess;
CK_RV crv = CKR_OK;
id->data = NULL;
if (label) {
id->data = (unsigned char *)PORT_Strdup(label);
if (id->data == NULL) {
return CKR_HOST_MEMORY;
}
id->len = PORT_Strlen(label)+1;
if (!nsslowkey_KeyForIDExists(handle,id)) {
return CKR_OK;
}
PORT_Free(id->data);
id->data = NULL;
id->len = 0;
}
id->data = (unsigned char *)PORT_Alloc(LG_KEY_ID_SIZE);
if (id->data == NULL) {
return CKR_HOST_MEMORY;
}
id->len = LG_KEY_ID_SIZE;
retries = 0;
do {
rv = RNG_GenerateGlobalRandomBytes(id->data,id->len);
} while (rv == SECSuccess && nsslowkey_KeyForIDExists(handle,id) &&
(++retries <= LG_KEY_MAX_RETRIES));
if ((rv != SECSuccess) || (retries > LG_KEY_MAX_RETRIES)) {
crv = CKR_DEVICE_ERROR; /* random number generator is bad */
PORT_Free(id->data);
id->data = NULL;
id->len = 0;
}
return crv;
}
static NSSLOWKEYPrivateKey *lg_mkSecretKeyRep(const CK_ATTRIBUTE *templ,
CK_ULONG count, CK_KEY_TYPE key_type,
SECItem *pubkey, SDB *sdbpw)
{
NSSLOWKEYPrivateKey *privKey = 0;
PLArenaPool *arena = 0;
CK_KEY_TYPE keyType;
PRUint32 keyTypeStorage;
SECItem keyTypeItem;
CK_RV crv;
SECStatus rv;
static unsigned char derZero[1] = { 0 };
arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
if (arena == NULL) { crv = CKR_HOST_MEMORY; goto loser; }
privKey = (NSSLOWKEYPrivateKey *)
PORT_ArenaZAlloc(arena,sizeof(NSSLOWKEYPrivateKey));
if (privKey == NULL) { crv = CKR_HOST_MEMORY; goto loser; }
privKey->arena = arena;
/* Secret keys are represented in the database as "fake" RSA keys.
* The RSA key is marked as a secret key representation by setting the
* public exponent field to 0, which is an invalid RSA exponent.
* The other fields are set as follows:
* modulus - CKA_ID value for the secret key
* private exponent - CKA_VALUE (the key itself)
* coefficient - CKA_KEY_TYPE, which indicates what encryption algorithm
* is used for the key.
* all others - set to integer 0
*/
privKey->keyType = NSSLOWKEYRSAKey;
/* The modulus is set to the key id of the symmetric key */
crv = lg_Attribute2SecItem(arena, CKA_ID, templ, count,
&privKey->u.rsa.modulus);
if (crv != CKR_OK) goto loser;
/* The public exponent is set to 0 length to indicate a special key */
privKey->u.rsa.publicExponent.len = sizeof derZero;
privKey->u.rsa.publicExponent.data = derZero;
/* The private exponent is the actual key value */
crv = lg_PrivAttr2SecItem(arena, CKA_VALUE, templ, count,
&privKey->u.rsa.privateExponent, sdbpw);
if (crv != CKR_OK) goto loser;
/* All other fields empty - needs testing */
privKey->u.rsa.prime1.len = sizeof derZero;
privKey->u.rsa.prime1.data = derZero;
privKey->u.rsa.prime2.len = sizeof derZero;
privKey->u.rsa.prime2.data = derZero;
privKey->u.rsa.exponent1.len = sizeof derZero;
privKey->u.rsa.exponent1.data = derZero;
privKey->u.rsa.exponent2.len = sizeof derZero;
privKey->u.rsa.exponent2.data = derZero;
/* Coeficient set to KEY_TYPE */
crv = lg_GetULongAttribute(CKA_KEY_TYPE, templ, count, &keyType);
if (crv != CKR_OK) goto loser;
/* on 64 bit platforms, we still want to store 32 bits of keyType (This is
* safe since the PKCS #11 defines for all types are 32 bits or less). */
keyTypeStorage = (PRUint32) keyType;
keyTypeStorage = PR_htonl(keyTypeStorage);
keyTypeItem.data = (unsigned char *)&keyTypeStorage;
keyTypeItem.len = sizeof (keyTypeStorage);
rv = SECITEM_CopyItem(arena, &privKey->u.rsa.coefficient, &keyTypeItem);
if (rv != SECSuccess) {
crv = CKR_HOST_MEMORY;
goto loser;
}
/* Private key version field set normally for compatibility */
rv = DER_SetUInteger(privKey->arena,
&privKey->u.rsa.version, NSSLOWKEY_VERSION);
if (rv != SECSuccess) { crv = CKR_HOST_MEMORY; goto loser; }
loser:
if (crv != CKR_OK) {
PORT_FreeArena(arena,PR_FALSE);
privKey = 0;
}
return privKey;
}
/*
* check the consistancy and initialize a Secret Key Object
*/
static CK_RV
lg_createSecretKeyObject(SDB *sdb, CK_KEY_TYPE key_type,
CK_OBJECT_HANDLE *handle, const CK_ATTRIBUTE *templ, CK_ULONG count)
{
CK_RV crv;
NSSLOWKEYPrivateKey *privKey = NULL;
NSSLOWKEYDBHandle *keyHandle = NULL;
SECItem pubKey;
char *label = NULL;
SECStatus rv = SECSuccess;
pubKey.data = 0;
/* If the object is a TOKEN object, store in the database */
keyHandle = lg_getKeyDB(sdb);
if (keyHandle == NULL) {
return CKR_TOKEN_WRITE_PROTECTED;
}
label = lg_getString(CKA_LABEL,templ,count);
crv = lg_Attribute2SecItem(NULL,CKA_ID,templ,count,&pubKey);
/* Should this be ID? */
if (crv != CKR_OK) goto loser;
/* if we don't have an ID, generate one */
if (pubKey.len == 0) {
if (pubKey.data) {
PORT_Free(pubKey.data);
pubKey.data = NULL;
}
crv = lg_GenerateSecretCKA_ID(keyHandle, &pubKey, label);
if (crv != CKR_OK) goto loser;
}
privKey = lg_mkSecretKeyRep(templ, count, key_type, &pubKey, sdb);
if (privKey == NULL) {
crv = CKR_HOST_MEMORY;
goto loser;
}
rv = nsslowkey_StoreKeyByPublicKey(keyHandle,
privKey, &pubKey, label, sdb /*->password*/);
if (rv != SECSuccess) {
crv = CKR_DEVICE_ERROR;
goto loser;
}
*handle = lg_mkHandle(sdb, &pubKey, LG_TOKEN_TYPE_KEY);
loser:
if (label) PORT_Free(label);
if (privKey) nsslowkey_DestroyPrivateKey(privKey);
if (pubKey.data) PORT_Free(pubKey.data);
return crv;
}
/*
* check the consistancy and initialize a Key Object
*/
static CK_RV
lg_createKeyObject(SDB *sdb, CK_OBJECT_CLASS objclass,
CK_OBJECT_HANDLE *handle, const CK_ATTRIBUTE *templ, CK_ULONG count)
{
CK_RV crv;
CK_KEY_TYPE key_type;
/* get the key type */
crv = lg_GetULongAttribute(CKA_KEY_TYPE, templ, count, &key_type);
if (crv != CKR_OK) {
return crv;
}
switch (objclass) {
case CKO_PUBLIC_KEY:
return lg_createPublicKeyObject(sdb,key_type,handle,templ,count);
case CKO_PRIVATE_KEY:
return lg_createPrivateKeyObject(sdb,key_type,handle,templ,count);
case CKO_SECRET_KEY:
return lg_createSecretKeyObject(sdb,key_type,handle,templ,count);
default:
break;
}
return CKR_ATTRIBUTE_VALUE_INVALID;
}
/*
* Parse the template and create an object stored in the DB that reflects.
* the object specified in the database.
*/
CK_RV
lg_CreateObject(SDB *sdb, CK_OBJECT_HANDLE *handle,
const CK_ATTRIBUTE *templ, CK_ULONG count)
{
CK_RV crv;
CK_OBJECT_CLASS objclass;
/* get the object class */
crv = lg_GetULongAttribute(CKA_CLASS, templ, count, &objclass);
if (crv != CKR_OK) {
return crv;
}
/* Now handle the specific object class.
*/
switch (objclass) {
case CKO_CERTIFICATE:
crv = lg_createCertObject(sdb,handle,templ,count);
break;
case CKO_NETSCAPE_TRUST:
crv = lg_createTrustObject(sdb,handle,templ,count);
break;
case CKO_NETSCAPE_CRL:
crv = lg_createCrlObject(sdb,handle,templ,count);
break;
case CKO_NETSCAPE_SMIME:
crv = lg_createSMimeObject(sdb,handle,templ,count);
break;
case CKO_PRIVATE_KEY:
case CKO_PUBLIC_KEY:
case CKO_SECRET_KEY:
crv = lg_createKeyObject(sdb,objclass,handle,templ,count);
break;
default:
crv = CKR_ATTRIBUTE_VALUE_INVALID;
break;
}
return crv;
}

197
mozilla/security/nss/lib/softoken/legacydb/lgdb.h Normal file
View File

@@ -0,0 +1,197 @@
/* ***** BEGIN LICENSE BLOCK *****
* Version: MPL 1.1/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Mozilla Public License Version
* 1.1 (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
* http://www.mozilla.org/MPL/
*
* Software distributed under the License is distributed on an "AS IS" basis,
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
* for the specific language governing rights and limitations under the
* License.
*
* The Original Code is the Netscape security libraries.
*
* The Initial Developer of the Original Code is
* Netscape Communications Corporation.
* Portions created by the Initial Developer are Copyright (C) 1994-2000
* the Initial Developer. All Rights Reserved.
*
* Contributor(s):
*
* Alternatively, the contents of this file may be used under the terms of
* either the GNU General Public License Version 2 or later (the "GPL"), or
* the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the MPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/*
* Internal data structures and functions used by pkcs11.c
*/
#ifndef _LGDB_H_
#define _LGDB_H_ 1
#include "nssilock.h"
#include "seccomon.h"
#include "secoidt.h"
#include "lowkeyti.h"
#include "pkcs11t.h"
#include "sdb.h"
#include "cdbhdl.h"
#define MULTIACCESS "multiaccess:"
/* machine dependent path stuff used by dbinit.c and pk11db.c */
#ifdef macintosh
#define PATH_SEPARATOR ":"
#define SECMOD_DB "Security Modules"
#define CERT_DB_FMT "%sCertificates%s"
#define KEY_DB_FMT "%sKey Database%s"
#else
#define PATH_SEPARATOR "/"
#define SECMOD_DB "secmod.db"
#define CERT_DB_FMT "%scert%s.db"
#define KEY_DB_FMT "%skey%s.db"
#endif
SEC_BEGIN_PROTOS
/* internal utility functions used by pkcs11.c */
extern const CK_ATTRIBUTE *lg_FindAttribute(CK_ATTRIBUTE_TYPE type,
const CK_ATTRIBUTE *templ, CK_ULONG count);
extern CK_RV lg_Attribute2SecItem(PLArenaPool *,CK_ATTRIBUTE_TYPE type,
const CK_ATTRIBUTE *templ, CK_ULONG count,
SECItem *item);
extern CK_RV lg_Attribute2SSecItem(PLArenaPool *,CK_ATTRIBUTE_TYPE type,
const CK_ATTRIBUTE *templ, CK_ULONG count,
SECItem *item);
extern CK_RV lg_PrivAttr2SecItem(PLArenaPool *,CK_ATTRIBUTE_TYPE type,
const CK_ATTRIBUTE *templ, CK_ULONG count,
SECItem *item, SDB *sdbpw);
extern CK_RV lg_PrivAttr2SSecItem(PLArenaPool *,CK_ATTRIBUTE_TYPE type,
const CK_ATTRIBUTE *templ, CK_ULONG count,
SECItem *item, SDB *sdbpw);
extern CK_RV lg_GetULongAttribute(CK_ATTRIBUTE_TYPE type,
const CK_ATTRIBUTE *templ, CK_ULONG count,
CK_ULONG *out);
extern PRBool lg_hasAttribute(CK_ATTRIBUTE_TYPE type,
const CK_ATTRIBUTE *templ, CK_ULONG count);
extern PRBool lg_isTrue(CK_ATTRIBUTE_TYPE type,
const CK_ATTRIBUTE *templ, CK_ULONG count);
extern PRBool lg_isSensitive(CK_ATTRIBUTE_TYPE type, CK_OBJECT_CLASS inClass);
extern char *lg_getString(CK_ATTRIBUTE_TYPE type,
const CK_ATTRIBUTE *templ, CK_ULONG count);
extern unsigned int lg_MapTrust(CK_TRUST trust, PRBool clientAuth);
/* clear out all the existing object ID to database key mappings.
* used to reinit a token */
extern CK_RV SFTK_ClearTokenKeyHashTable(SDB *sdb);
extern void lg_FreeSearch(SDBFind *search);
NSSLOWCERTCertDBHandle *lg_getCertDB(SDB *sdb);
NSSLOWKEYDBHandle *lg_getKeyDB(SDB *sdb);
const char *lg_EvaluateConfigDir(const char *configdir, char **domain);
/*
* object handle modifiers
*/
#define LG_TOKEN_MASK 0xc0000000L
#define LG_TOKEN_TYPE_MASK 0x38000000L
#define LG_TOKEN_TYPE_SHIFT 27
/* keydb (high bit == 0) */
#define LG_TOKEN_TYPE_PRIV 0x08000000L
#define LG_TOKEN_TYPE_PUB 0x10000000L
#define LG_TOKEN_TYPE_KEY 0x18000000L
/* certdb (high bit == 1) */
#define LG_TOKEN_TYPE_TRUST 0x20000000L
#define LG_TOKEN_TYPE_CRL 0x28000000L
#define LG_TOKEN_TYPE_SMIME 0x30000000L
#define LG_TOKEN_TYPE_CERT 0x38000000L
#define LG_TOKEN_KRL_HANDLE (LG_TOKEN_TYPE_CRL|1)
#define LG_SEARCH_BLOCK_SIZE 10
#define LG_BUF_SPACE 50
#define LG_STRICT PR_FALSE
/*
* token object utilities
*/
void lg_addHandle(SDBFind *search, CK_OBJECT_HANDLE handle);
PRBool lg_poisonHandle(SDB *sdb, SECItem *dbkey, CK_OBJECT_HANDLE handle);
PRBool lg_tokenMatch(SDB *sdb, const SECItem *dbKey, CK_OBJECT_HANDLE class,
const CK_ATTRIBUTE *templ, CK_ULONG count);
const SECItem *lg_lookupTokenKeyByHandle(SDB *sdb, CK_OBJECT_HANDLE handle);
CK_OBJECT_HANDLE lg_mkHandle(SDB *sdb, SECItem *dbKey, CK_OBJECT_HANDLE class);
SECStatus lg_deleteTokenKeyByHandle(SDB *sdb, CK_OBJECT_HANDLE handle);
SECStatus lg_util_encrypt(PLArenaPool *arena, SDB *sdbpw,
SECItem *plainText, SECItem **cipherText);
SECStatus lg_util_decrypt(SDB *sdbpw,
SECItem *cipherText, SECItem **plainText);
PLHashTable *lg_GetHashTable(SDB *sdb);
void lg_DBLock(SDB *sdb);
void lg_DBUnlock(SDB *sdb);
typedef void (*LGFreeFunc)(void *);
/*
* database functions
*/
/* lg_FindObjectsInit initializes a search for token and session objects
* that match a template. */
CK_RV lg_FindObjectsInit(SDB *sdb, const CK_ATTRIBUTE *pTemplate,
CK_ULONG ulCount, SDBFind **search);
/* lg_FindObjects continues a search for token and session objects
* that match a template, obtaining additional object handles. */
CK_RV lg_FindObjects(SDB *sdb, SDBFind *search,
CK_OBJECT_HANDLE *phObject,CK_ULONG ulMaxObjectCount,
CK_ULONG *pulObjectCount);
/* lg_FindObjectsFinal finishes a search for token and session objects. */
CK_RV lg_FindObjectsFinal(SDB* lgdb, SDBFind *search);
/* lg_CreateObject parses the template and create an object stored in the
* DB that reflects the object specified in the template. */
CK_RV lg_CreateObject(SDB *sdb, CK_OBJECT_HANDLE *handle,
const CK_ATTRIBUTE *templ, CK_ULONG count);
CK_RV lg_GetAttributeValue(SDB *sdb, CK_OBJECT_HANDLE object_id,
CK_ATTRIBUTE *template, CK_ULONG count);
CK_RV lg_SetAttributeValue(SDB *sdb, CK_OBJECT_HANDLE object_id,
const CK_ATTRIBUTE *template, CK_ULONG count);
CK_RV lg_DestroyObject(SDB *sdb, CK_OBJECT_HANDLE object_id);
CK_RV lg_Close(SDB *sdb);
CK_RV lg_Reset(SDB *sdb);
/*
* The old database doesn't share and doesn't support
* transactions.
*/
CK_RV lg_Begin(SDB *sdb);
CK_RV lg_Commit(SDB *sdb);
CK_RV lg_Abort(SDB *sdb);
CK_RV lg_GetPWEntry(SDB *sdb, SDBPasswordEntry *entry);
CK_RV lg_PutPWEntry(SDB *sdb, SDBPasswordEntry *entry);
SEC_END_PROTOS
#endif /* _LGDB_H_ */

144
mozilla/security/nss/lib/softoken/legacydb/lgdestroy.c Normal file
View File

@@ -0,0 +1,144 @@
/* ***** BEGIN LICENSE BLOCK *****
* Version: MPL 1.1/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Mozilla Public License Version
* 1.1 (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
* http://www.mozilla.org/MPL/
*
* Software distributed under the License is distributed on an "AS IS" basis,
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
* for the specific language governing rights and limitations under the
* License.
*
* The Original Code is the Netscape security libraries.
*
* The Initial Developer of the Original Code is
* Netscape Communications Corporation.
* Portions created by the Initial Developer are Copyright (C) 1994-2000
* the Initial Developer. All Rights Reserved.
*
* Contributor(s):
* Dr Vipul Gupta <vipul.gupta@sun.com>, Sun Microsystems Laboratories
*
* Alternatively, the contents of this file may be used under the terms of
* either the GNU General Public License Version 2 or later (the "GPL"), or
* the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the MPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/*
* Internal PKCS #11 functions. Should only be called by pkcs11.c
*/
#include "pkcs11.h"
#include "lgdb.h"
#include "pcert.h"
#include "lowkeyi.h"
/*
* remove an object.
*/
CK_RV
lg_DestroyObject(SDB *sdb, CK_OBJECT_HANDLE object_id)
{
CK_RV crv = CKR_OK;
SECStatus rv;
NSSLOWCERTCertificate *cert;
NSSLOWCERTCertTrust tmptrust;
PRBool isKrl;
NSSLOWKEYDBHandle *keyHandle;
NSSLOWCERTCertDBHandle *certHandle;
const SECItem *dbKey;
object_id &= ~LG_TOKEN_MASK;
dbKey = lg_lookupTokenKeyByHandle(sdb,object_id);
if (dbKey == NULL) {
return CKR_OBJECT_HANDLE_INVALID;
}
/* remove the objects from the real data base */
switch (object_id & LG_TOKEN_TYPE_MASK) {
case LG_TOKEN_TYPE_PRIV:
case LG_TOKEN_TYPE_KEY:
/* KEYID is the public KEY for DSA and DH, and the MODULUS for
* RSA */
keyHandle = lg_getKeyDB(sdb);
if (!keyHandle) {
crv = CKR_TOKEN_WRITE_PROTECTED;
break;
}
rv = nsslowkey_DeleteKey(keyHandle, dbKey);
if (rv != SECSuccess) {
crv = CKR_DEVICE_ERROR;
}
break;
case LG_TOKEN_TYPE_PUB:
break; /* public keys only exist at the behest of the priv key */
case LG_TOKEN_TYPE_CERT:
certHandle = lg_getCertDB(sdb);
if (!certHandle) {
crv = CKR_TOKEN_WRITE_PROTECTED;
break;
}
cert = nsslowcert_FindCertByKey(certHandle,dbKey);
if (cert == NULL) {
crv = CKR_DEVICE_ERROR;
break;
}
rv = nsslowcert_DeletePermCertificate(cert);
if (rv != SECSuccess) {
crv = CKR_DEVICE_ERROR;
}
nsslowcert_DestroyCertificate(cert);
break;
case LG_TOKEN_TYPE_CRL:
certHandle = lg_getCertDB(sdb);
if (!certHandle) {
crv = CKR_TOKEN_WRITE_PROTECTED;
break;
}
isKrl = (PRBool) (object_id == LG_TOKEN_KRL_HANDLE);
rv = nsslowcert_DeletePermCRL(certHandle, dbKey, isKrl);
if (rv == SECFailure) crv = CKR_DEVICE_ERROR;
break;
case LG_TOKEN_TYPE_TRUST:
certHandle = lg_getCertDB(sdb);
if (!certHandle) {
crv = CKR_TOKEN_WRITE_PROTECTED;
break;
}
cert = nsslowcert_FindCertByKey(certHandle, dbKey);
if (cert == NULL) {
crv = CKR_DEVICE_ERROR;
break;
}
tmptrust = *cert->trust;
tmptrust.sslFlags &= CERTDB_PRESERVE_TRUST_BITS;
tmptrust.emailFlags &= CERTDB_PRESERVE_TRUST_BITS;
tmptrust.objectSigningFlags &= CERTDB_PRESERVE_TRUST_BITS;
tmptrust.sslFlags |= CERTDB_TRUSTED_UNKNOWN;
tmptrust.emailFlags |= CERTDB_TRUSTED_UNKNOWN;
tmptrust.objectSigningFlags |= CERTDB_TRUSTED_UNKNOWN;
rv = nsslowcert_ChangeCertTrust(certHandle, cert, &tmptrust);
if (rv != SECSuccess) crv = CKR_DEVICE_ERROR;
nsslowcert_DestroyCertificate(cert);
break;
default:
break;
}
lg_DBLock(sdb);
lg_deleteTokenKeyByHandle(sdb,object_id);
lg_DBUnlock(sdb);
return crv;
}

941
mozilla/security/nss/lib/softoken/legacydb/lgfind.c Normal file
View File

@@ -0,0 +1,941 @@
/* ***** BEGIN LICENSE BLOCK *****
* Version: MPL 1.1/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Mozilla Public License Version
* 1.1 (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
* http://www.mozilla.org/MPL/
*
* Software distributed under the License is distributed on an "AS IS" basis,
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
* for the specific language governing rights and limitations under the
* License.
*
* The Original Code is the Netscape security libraries.
*
* The Initial Developer of the Original Code is
* Netscape Communications Corporation.
* Portions created by the Initial Developer are Copyright (C) 1994-2000
* the Initial Developer. All Rights Reserved.
*
*
* Alternatively, the contents of this file may be used under the terms of
* either the GNU General Public License Version 2 or later (the "GPL"), or
* the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the MPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
#include "secitem.h"
#include "pkcs11.h"
#include "lgdb.h"
#include "lowkeyi.h"
#include "pcert.h"
#include "blapi.h"
#include "keydbi.h"
/*
* This code maps PKCS #11 Finds to legacy database searches. This code
* was orginally in pkcs11.c in previous versions of NSS.
*/
struct SDBFindStr {
CK_OBJECT_HANDLE *handles;
int size;
int index;
int array_size;
};
/*
* free a search structure
*/
void
lg_FreeSearch(SDBFind *search)
{
if (search->handles) {
PORT_Free(search->handles);
}
PORT_Free(search);
}
void
lg_addHandle(SDBFind *search, CK_OBJECT_HANDLE handle)
{
if (search->handles == NULL) {
return;
}
if (search->size >= search->array_size) {
search->array_size += LG_SEARCH_BLOCK_SIZE;
search->handles = (CK_OBJECT_HANDLE *) PORT_Realloc(search->handles,
sizeof(CK_OBJECT_HANDLE)* search->array_size);
if (search->handles == NULL) {
return;
}
}
search->handles[search->size] = handle;
search->size++;
}
/*
* find any certs that may match the template and load them.
*/
#define LG_CERT 0x00000001
#define LG_TRUST 0x00000002
#define LG_CRL 0x00000004
#define LG_SMIME 0x00000008
#define LG_PRIVATE 0x00000010
#define LG_PUBLIC 0x00000020
#define LG_KEY 0x00000040
/*
* structure to collect key handles.
*/
typedef struct lgEntryDataStr {
SDB *sdb;
SDBFind *searchHandles;
const CK_ATTRIBUTE *template;
CK_ULONG templ_count;
} lgEntryData;
static SECStatus
lg_crl_collect(SECItem *data, SECItem *key, certDBEntryType type, void *arg)
{
lgEntryData *crlData;
CK_OBJECT_HANDLE class_handle;
SDB *sdb;
crlData = (lgEntryData *)arg;
sdb = crlData->sdb;
class_handle = (type == certDBEntryTypeRevocation) ? LG_TOKEN_TYPE_CRL :
LG_TOKEN_KRL_HANDLE;
if (lg_tokenMatch(sdb, key, class_handle,
crlData->template, crlData->templ_count)) {
lg_addHandle(crlData->searchHandles,
lg_mkHandle(sdb,key,class_handle));
}
return(SECSuccess);
}
static void
lg_searchCrls(SDB *sdb, SECItem *derSubject, PRBool isKrl,
unsigned long classFlags, SDBFind *search,
const CK_ATTRIBUTE *pTemplate, CK_ULONG ulCount)
{
NSSLOWCERTCertDBHandle *certHandle = NULL;
certHandle = lg_getCertDB(sdb);
if (certHandle == NULL) {
return;
}
if (derSubject->data != NULL) {
certDBEntryRevocation *crl =
nsslowcert_FindCrlByKey(certHandle, derSubject, isKrl);
if (crl != NULL) {
lg_addHandle(search, lg_mkHandle(sdb, derSubject,
isKrl ? LG_TOKEN_KRL_HANDLE : LG_TOKEN_TYPE_CRL));
nsslowcert_DestroyDBEntry((certDBEntry *)crl);
}
} else {
lgEntryData crlData;
/* traverse */
crlData.sdb = sdb;
crlData.searchHandles = search;
crlData.template = pTemplate;
crlData.templ_count = ulCount;
nsslowcert_TraverseDBEntries(certHandle, certDBEntryTypeRevocation,
lg_crl_collect, (void *)&crlData);
nsslowcert_TraverseDBEntries(certHandle, certDBEntryTypeKeyRevocation,
lg_crl_collect, (void *)&crlData);
}
}
/*
* structure to collect key handles.
*/
typedef struct lgKeyDataStr {
SDB *sdb;
NSSLOWKEYDBHandle *keyHandle;
SDBFind *searchHandles;
SECItem *id;
const CK_ATTRIBUTE *template;
CK_ULONG templ_count;
unsigned long classFlags;
PRBool strict;
} lgKeyData;
static PRBool
isSecretKey(NSSLOWKEYPrivateKey *privKey)
{
if (privKey->keyType == NSSLOWKEYRSAKey &&
privKey->u.rsa.publicExponent.len == 1 &&
privKey->u.rsa.publicExponent.data[0] == 0)
return PR_TRUE;
return PR_FALSE;
}
static SECStatus
lg_key_collect(DBT *key, DBT *data, void *arg)
{
lgKeyData *keyData;
NSSLOWKEYPrivateKey *privKey = NULL;
SECItem tmpDBKey;
SDB *sdb;
unsigned long classFlags;
keyData = (lgKeyData *)arg;
sdb = keyData->sdb;
classFlags = keyData->classFlags;
tmpDBKey.data = key->data;
tmpDBKey.len = key->size;
tmpDBKey.type = siBuffer;
PORT_Assert(keyData->keyHandle);
if (!keyData->strict && keyData->id) {
SECItem result;
PRBool haveMatch= PR_FALSE;
unsigned char hashKey[SHA1_LENGTH];
result.data = hashKey;
result.len = sizeof(hashKey);
if (keyData->id->len == 0) {
/* Make sure this isn't a LG_KEY */
privKey = nsslowkey_FindKeyByPublicKey(keyData->keyHandle,
&tmpDBKey, keyData->sdb/*->password*/);
if (privKey) {
/* turn off the unneeded class flags */
classFlags &= isSecretKey(privKey) ? ~(LG_PRIVATE|LG_PUBLIC) :
~LG_KEY;
haveMatch = (PRBool)
((classFlags & (LG_KEY|LG_PRIVATE|LG_PUBLIC)) != 0);
nsslowkey_DestroyPrivateKey(privKey);
}
} else {
SHA1_HashBuf( hashKey, key->data, key->size ); /* match id */
haveMatch = SECITEM_ItemsAreEqual(keyData->id,&result);
if (!haveMatch && ((unsigned char *)key->data)[0] == 0) {
/* This is a fix for backwards compatibility. The key
* database indexes private keys by the public key, and
* versions of NSS prior to 3.4 stored the public key as
* a signed integer. The public key is now treated as an
* unsigned integer, with no leading zero. In order to
* correctly compute the hash of an old key, it is necessary
* to fallback and detect the leading zero.
*/
SHA1_HashBuf(hashKey,
(unsigned char *)key->data + 1, key->size - 1);
haveMatch = SECITEM_ItemsAreEqual(keyData->id,&result);
}
}
if (haveMatch) {
if (classFlags & LG_PRIVATE) {
lg_addHandle(keyData->searchHandles,
lg_mkHandle(sdb,&tmpDBKey,LG_TOKEN_TYPE_PRIV));
}
if (classFlags & LG_PUBLIC) {
lg_addHandle(keyData->searchHandles,
lg_mkHandle(sdb,&tmpDBKey,LG_TOKEN_TYPE_PUB));
}
if (classFlags & LG_KEY) {
lg_addHandle(keyData->searchHandles,
lg_mkHandle(sdb,&tmpDBKey,LG_TOKEN_TYPE_KEY));
}
}
return SECSuccess;
}
privKey = nsslowkey_FindKeyByPublicKey(keyData->keyHandle, &tmpDBKey,
keyData->sdb/*->password*/);
if ( privKey == NULL ) {
goto loser;
}
if (isSecretKey(privKey)) {
if ((classFlags & LG_KEY) &&
lg_tokenMatch(keyData->sdb, &tmpDBKey, LG_TOKEN_TYPE_KEY,
keyData->template, keyData->templ_count)) {
lg_addHandle(keyData->searchHandles,
lg_mkHandle(keyData->sdb, &tmpDBKey, LG_TOKEN_TYPE_KEY));
}
} else {
if ((classFlags & LG_PRIVATE) &&
lg_tokenMatch(keyData->sdb, &tmpDBKey, LG_TOKEN_TYPE_PRIV,
keyData->template, keyData->templ_count)) {
lg_addHandle(keyData->searchHandles,
lg_mkHandle(keyData->sdb,&tmpDBKey,LG_TOKEN_TYPE_PRIV));
}
if ((classFlags & LG_PUBLIC) &&
lg_tokenMatch(keyData->sdb, &tmpDBKey, LG_TOKEN_TYPE_PUB,
keyData->template, keyData->templ_count)) {
lg_addHandle(keyData->searchHandles,
lg_mkHandle(keyData->sdb, &tmpDBKey,LG_TOKEN_TYPE_PUB));
}
}
loser:
if ( privKey ) {
nsslowkey_DestroyPrivateKey(privKey);
}
return(SECSuccess);
}
static void
lg_searchKeys(SDB *sdb, SECItem *key_id,
unsigned long classFlags, SDBFind *search, PRBool mustStrict,
const CK_ATTRIBUTE *pTemplate, CK_ULONG ulCount)
{
NSSLOWKEYDBHandle *keyHandle = NULL;
NSSLOWKEYPrivateKey *privKey;
lgKeyData keyData;
PRBool found = PR_FALSE;
keyHandle = lg_getKeyDB(sdb);
if (keyHandle == NULL) {
return;
}
if (key_id->data) {
privKey = nsslowkey_FindKeyByPublicKey(keyHandle, key_id, sdb);
if (privKey) {
if ((classFlags & LG_KEY) && isSecretKey(privKey)) {
lg_addHandle(search,
lg_mkHandle(sdb,key_id,LG_TOKEN_TYPE_KEY));
found = PR_TRUE;
}
if ((classFlags & LG_PRIVATE) && !isSecretKey(privKey)) {
lg_addHandle(search,
lg_mkHandle(sdb,key_id,LG_TOKEN_TYPE_PRIV));
found = PR_TRUE;
}
if ((classFlags & LG_PUBLIC) && !isSecretKey(privKey)) {
lg_addHandle(search,
lg_mkHandle(sdb,key_id,LG_TOKEN_TYPE_PUB));
found = PR_TRUE;
}
nsslowkey_DestroyPrivateKey(privKey);
}
/* don't do the traversal if we have an up to date db */
if (keyHandle->version != 3) {
goto loser;
}
/* don't do the traversal if it can't possibly be the correct id */
/* all soft token id's are SHA1_HASH_LEN's */
if (key_id->len != SHA1_LENGTH) {
goto loser;
}
if (found) {
/* if we already found some keys, don't do the traversal */
goto loser;
}
}
keyData.sdb = sdb;
keyData.keyHandle = keyHandle;
keyData.searchHandles = search;
keyData.id = key_id;
keyData.template = pTemplate;
keyData.templ_count = ulCount;
keyData.classFlags = classFlags;
keyData.strict = mustStrict ? mustStrict : LG_STRICT;
nsslowkey_TraverseKeys(keyHandle, lg_key_collect, &keyData);
loser:
return;
}
/*
* structure to collect certs into
*/
typedef struct lgCertDataStr {
SDB *sdb;
int cert_count;
int max_cert_count;
NSSLOWCERTCertificate **certs;
const CK_ATTRIBUTE *template;
CK_ULONG templ_count;
unsigned long classFlags;
PRBool strict;
} lgCertData;
/*
* collect all the certs from the traverse call.
*/
static SECStatus
lg_cert_collect(NSSLOWCERTCertificate *cert,void *arg)
{
lgCertData *cd = (lgCertData *)arg;
if (cert == NULL) {
return SECSuccess;
}
if (cd->certs == NULL) {
return SECFailure;
}
if (cd->strict) {
if ((cd->classFlags & LG_CERT) && !lg_tokenMatch(cd->sdb,
&cert->certKey, LG_TOKEN_TYPE_CERT, cd->template,cd->templ_count)) {
return SECSuccess;
}
if ((cd->classFlags & LG_TRUST) && !lg_tokenMatch(cd->sdb,
&cert->certKey, LG_TOKEN_TYPE_TRUST,
cd->template, cd->templ_count)) {
return SECSuccess;
}
}
/* allocate more space if we need it. This should only happen in
* the general traversal case */
if (cd->cert_count >= cd->max_cert_count) {
int size;
cd->max_cert_count += LG_SEARCH_BLOCK_SIZE;
size = cd->max_cert_count * sizeof (NSSLOWCERTCertificate *);
cd->certs = (NSSLOWCERTCertificate **)PORT_Realloc(cd->certs,size);
if (cd->certs == NULL) {
return SECFailure;
}
}
cd->certs[cd->cert_count++] = nsslowcert_DupCertificate(cert);
return SECSuccess;
}
/* provide impedence matching ... */
static SECStatus
lg_cert_collect2(NSSLOWCERTCertificate *cert, SECItem *dymmy, void *arg)
{
return lg_cert_collect(cert, arg);
}
static void
lg_searchSingleCert(lgCertData *certData,NSSLOWCERTCertificate *cert)
{
if (cert == NULL) {
return;
}
if (certData->strict &&
!lg_tokenMatch(certData->sdb, &cert->certKey, LG_TOKEN_TYPE_CERT,
certData->template,certData->templ_count)) {
nsslowcert_DestroyCertificate(cert);
return;
}
certData->certs = (NSSLOWCERTCertificate **)
PORT_Alloc(sizeof (NSSLOWCERTCertificate *));
if (certData->certs == NULL) {
nsslowcert_DestroyCertificate(cert);
return;
}
certData->certs[0] = cert;
certData->cert_count = 1;
}
static void
lg_CertSetupData(lgCertData *certData,int count)
{
certData->max_cert_count = count;
if (certData->max_cert_count <= 0) {
return;
}
certData->certs = (NSSLOWCERTCertificate **)
PORT_Alloc( count * sizeof(NSSLOWCERTCertificate *));
return;
}
static void
lg_searchCertsAndTrust(SDB *sdb, SECItem *derCert, SECItem *name,
SECItem *derSubject, NSSLOWCERTIssuerAndSN *issuerSN,
SECItem *email,
unsigned long classFlags, SDBFind *handles,
const CK_ATTRIBUTE *pTemplate, CK_LONG ulCount)
{
NSSLOWCERTCertDBHandle *certHandle = NULL;
lgCertData certData;
int i;
certHandle = lg_getCertDB(sdb);
if (certHandle == NULL) return;
certData.sdb = sdb;
certData.max_cert_count = 0;
certData.certs = NULL;
certData.cert_count = 0;
certData.template = pTemplate;
certData.templ_count = ulCount;
certData.classFlags = classFlags;
certData.strict = LG_STRICT;
/*
* Find the Cert.
*/
if (derCert->data != NULL) {
NSSLOWCERTCertificate *cert =
nsslowcert_FindCertByDERCert(certHandle,derCert);
lg_searchSingleCert(&certData,cert);
} else if (name->data != NULL) {
char *tmp_name = (char*)PORT_Alloc(name->len+1);
int count;
if (tmp_name == NULL) {
return;
}
PORT_Memcpy(tmp_name,name->data,name->len);
tmp_name[name->len] = 0;
count= nsslowcert_NumPermCertsForNickname(certHandle,tmp_name);
lg_CertSetupData(&certData,count);
nsslowcert_TraversePermCertsForNickname(certHandle,tmp_name,
lg_cert_collect, &certData);
PORT_Free(tmp_name);
} else if (derSubject->data != NULL) {
int count;
count = nsslowcert_NumPermCertsForSubject(certHandle,derSubject);
lg_CertSetupData(&certData,count);
nsslowcert_TraversePermCertsForSubject(certHandle,derSubject,
lg_cert_collect, &certData);
} else if ((issuerSN->derIssuer.data != NULL) &&
(issuerSN->serialNumber.data != NULL)) {
if (classFlags & LG_CERT) {
NSSLOWCERTCertificate *cert =
nsslowcert_FindCertByIssuerAndSN(certHandle,issuerSN);
lg_searchSingleCert(&certData,cert);
}
if (classFlags & LG_TRUST) {
NSSLOWCERTTrust *trust =
nsslowcert_FindTrustByIssuerAndSN(certHandle, issuerSN);
if (trust) {
lg_addHandle(handles,
lg_mkHandle(sdb,&trust->dbKey,LG_TOKEN_TYPE_TRUST));
nsslowcert_DestroyTrust(trust);
}
}
} else if (email->data != NULL) {
char *tmp_name = (char*)PORT_Alloc(email->len+1);
certDBEntrySMime *entry = NULL;
if (tmp_name == NULL) {
return;
}
PORT_Memcpy(tmp_name,email->data,email->len);
tmp_name[email->len] = 0;
entry = nsslowcert_ReadDBSMimeEntry(certHandle,tmp_name);
if (entry) {
int count;
SECItem *subjectName = &entry->subjectName;
count = nsslowcert_NumPermCertsForSubject(certHandle, subjectName);
lg_CertSetupData(&certData,count);
nsslowcert_TraversePermCertsForSubject(certHandle, subjectName,
lg_cert_collect, &certData);
nsslowcert_DestroyDBEntry((certDBEntry *)entry);
}
PORT_Free(tmp_name);
} else {
/* we aren't filtering the certs, we are working on all, so turn
* on the strict filters. */
certData.strict = PR_TRUE;
lg_CertSetupData(&certData,LG_SEARCH_BLOCK_SIZE);
nsslowcert_TraversePermCerts(certHandle, lg_cert_collect2, &certData);
}
/*
* build the handles
*/
for (i=0 ; i < certData.cert_count ; i++) {
NSSLOWCERTCertificate *cert = certData.certs[i];
/* if we filtered it would have been on the stuff above */
if (classFlags & LG_CERT) {
lg_addHandle(handles,
lg_mkHandle(sdb,&cert->certKey,LG_TOKEN_TYPE_CERT));
}
if ((classFlags & LG_TRUST) && nsslowcert_hasTrust(cert->trust)) {
lg_addHandle(handles,
lg_mkHandle(sdb,&cert->certKey,LG_TOKEN_TYPE_TRUST));
}
nsslowcert_DestroyCertificate(cert);
}
if (certData.certs) PORT_Free(certData.certs);
return;
}
static SECStatus
lg_smime_collect(SECItem *data, SECItem *key, certDBEntryType type, void *arg)
{
lgEntryData *smimeData;
SDB *sdb;
smimeData = (lgEntryData *)arg;
sdb = smimeData->sdb;
if (lg_tokenMatch(sdb, key, LG_TOKEN_TYPE_SMIME,
smimeData->template, smimeData->templ_count)) {
lg_addHandle(smimeData->searchHandles,
lg_mkHandle(sdb,key,LG_TOKEN_TYPE_SMIME));
}
return(SECSuccess);
}
static void
lg_searchSMime(SDB *sdb, SECItem *email, SDBFind *handles,
const CK_ATTRIBUTE *pTemplate, CK_LONG ulCount)
{
NSSLOWCERTCertDBHandle *certHandle = NULL;
certDBEntrySMime *entry;
certHandle = lg_getCertDB(sdb);
if (certHandle == NULL) return;
if (email->data != NULL) {
char *tmp_name = (char*)PORT_Alloc(email->len+1);
if (tmp_name == NULL) {
return;
}
PORT_Memcpy(tmp_name,email->data,email->len);
tmp_name[email->len] = 0;
entry = nsslowcert_ReadDBSMimeEntry(certHandle,tmp_name);
if (entry) {
SECItem emailKey;
emailKey.data = (unsigned char *)tmp_name;
emailKey.len = PORT_Strlen(tmp_name)+1;
emailKey.type = 0;
lg_addHandle(handles,
lg_mkHandle(sdb,&emailKey,LG_TOKEN_TYPE_SMIME));
nsslowcert_DestroyDBEntry((certDBEntry *)entry);
}
PORT_Free(tmp_name);
} else {
/* traverse */
lgEntryData smimeData;
/* traverse */
smimeData.sdb = sdb;
smimeData.searchHandles = handles;
smimeData.template = pTemplate;
smimeData.templ_count = ulCount;
nsslowcert_TraverseDBEntries(certHandle, certDBEntryTypeSMimeProfile,
lg_smime_collect, (void *)&smimeData);
}
return;
}
static CK_RV
lg_searchTokenList(SDB *sdb, SDBFind *search,
const CK_ATTRIBUTE *pTemplate, CK_LONG ulCount)
{
int i;
PRBool isKrl = PR_FALSE;
SECItem derCert = { siBuffer, NULL, 0 };
SECItem derSubject = { siBuffer, NULL, 0 };
SECItem name = { siBuffer, NULL, 0 };
SECItem email = { siBuffer, NULL, 0 };
SECItem key_id = { siBuffer, NULL, 0 };
SECItem cert_sha1_hash = { siBuffer, NULL, 0 };
SECItem cert_md5_hash = { siBuffer, NULL, 0 };
NSSLOWCERTIssuerAndSN issuerSN = {
{ siBuffer, NULL, 0 },
{ siBuffer, NULL, 0 }
};
SECItem *copy = NULL;
CK_CERTIFICATE_TYPE certType;
CK_OBJECT_CLASS objectClass;
CK_RV crv;
unsigned long classFlags =
LG_CERT|LG_TRUST|LG_PRIVATE|LG_PUBLIC|LG_KEY|LG_SMIME|LG_CRL;
if (lg_getCertDB(sdb) == NULL) {
classFlags = LG_PRIVATE|LG_KEY;
} else {
classFlags = LG_CERT|LG_TRUST|LG_PUBLIC|LG_SMIME|LG_CRL;
}
/*
* look for things to search on token objects for. If the right options
* are specified, we can use them as direct indeces into the database
* (rather than using linear searches. We can also use the attributes to
* limit the kinds of objects we are searching for. Later we can use this
* array to filter the remaining objects more finely.
*/
for (i=0 ;classFlags && i < (int)ulCount; i++) {
switch (pTemplate[i].type) {
case CKA_SUBJECT:
copy = &derSubject;
classFlags &= (LG_CERT|LG_PRIVATE|LG_PUBLIC|LG_SMIME|LG_CRL);
break;
case CKA_ISSUER:
copy = &issuerSN.derIssuer;
classFlags &= (LG_CERT|LG_TRUST);
break;
case CKA_SERIAL_NUMBER:
copy = &issuerSN.serialNumber;
classFlags &= (LG_CERT|LG_TRUST);
break;
case CKA_VALUE:
copy = &derCert;
classFlags &= (LG_CERT|LG_CRL|LG_SMIME);
break;
case CKA_LABEL:
copy = &name;
break;
case CKA_NETSCAPE_EMAIL:
copy = &email;
classFlags &= LG_SMIME|LG_CERT;
break;
case CKA_NETSCAPE_SMIME_TIMESTAMP:
classFlags &= LG_SMIME;
break;
case CKA_CLASS:
crv = lg_GetULongAttribute(CKA_CLASS,&pTemplate[i],1, &objectClass);
if (crv != CKR_OK) {
classFlags = 0;
break;;
}
switch (objectClass) {
case CKO_CERTIFICATE:
classFlags &= LG_CERT;
break;
case CKO_NETSCAPE_TRUST:
classFlags &= LG_TRUST;
break;
case CKO_NETSCAPE_CRL:
classFlags &= LG_CRL;
break;
case CKO_NETSCAPE_SMIME:
classFlags &= LG_SMIME;
break;
case CKO_PRIVATE_KEY:
classFlags &= LG_PRIVATE;
break;
case CKO_PUBLIC_KEY:
classFlags &= LG_PUBLIC;
break;
case CKO_SECRET_KEY:
classFlags &= LG_KEY;
break;
default:
classFlags = 0;
break;
}
break;
case CKA_PRIVATE:
if (pTemplate[i].ulValueLen != sizeof(CK_BBOOL)) {
classFlags = 0;
}
if (*((CK_BBOOL *)pTemplate[i].pValue) == CK_TRUE) {
classFlags &= (LG_PRIVATE|LG_KEY);
} else {
classFlags &= ~(LG_PRIVATE|LG_KEY);
}
break;
case CKA_SENSITIVE:
if (pTemplate[i].ulValueLen != sizeof(CK_BBOOL)) {
classFlags = 0;
}
if (*((CK_BBOOL *)pTemplate[i].pValue) == CK_TRUE) {
classFlags &= (LG_PRIVATE|LG_KEY);
} else {
classFlags = 0;
}
break;
case CKA_TOKEN:
if (pTemplate[i].ulValueLen != sizeof(CK_BBOOL)) {
classFlags = 0;
}
if (*((CK_BBOOL *)pTemplate[i].pValue) != CK_TRUE) {
classFlags = 0;
}
break;
case CKA_CERT_SHA1_HASH:
classFlags &= LG_TRUST;
copy = &cert_sha1_hash; break;
case CKA_CERT_MD5_HASH:
classFlags &= LG_TRUST;
copy = &cert_md5_hash; break;
case CKA_CERTIFICATE_TYPE:
crv = lg_GetULongAttribute(CKA_CLASS,&pTemplate[i],1,&certType);
if (crv != CKR_OK) {
classFlags = 0;
}
classFlags &= LG_CERT;
if (certType != CKC_X_509) {
classFlags = 0;
}
break;
case CKA_ID:
copy = &key_id;
classFlags &= (LG_CERT|LG_PRIVATE|LG_KEY|LG_PUBLIC);
break;
case CKA_NETSCAPE_KRL:
if (pTemplate[i].ulValueLen != sizeof(CK_BBOOL)) {
classFlags = 0;
}
classFlags &= LG_CRL;
isKrl = (PRBool)(*((CK_BBOOL *)pTemplate[i].pValue) == CK_TRUE);
break;
case CKA_MODIFIABLE:
break;
case CKA_KEY_TYPE:
case CKA_DERIVE:
classFlags &= LG_PUBLIC|LG_PRIVATE|LG_KEY;
break;
case CKA_VERIFY_RECOVER:
classFlags &= LG_PUBLIC;
break;
case CKA_SIGN_RECOVER:
classFlags &= LG_PRIVATE;
break;
case CKA_ENCRYPT:
case CKA_VERIFY:
case CKA_WRAP:
classFlags &= LG_PUBLIC|LG_KEY;
break;
case CKA_DECRYPT:
case CKA_SIGN:
case CKA_UNWRAP:
case CKA_ALWAYS_SENSITIVE:
case CKA_EXTRACTABLE:
case CKA_NEVER_EXTRACTABLE:
classFlags &= LG_PRIVATE|LG_KEY;
break;
/* can't be a certificate if it doesn't match one of the above
* attributes */
default:
classFlags = 0;
break;
}
if (copy) {
copy->data = (unsigned char*)pTemplate[i].pValue;
copy->len = pTemplate[i].ulValueLen;
}
copy = NULL;
}
/* certs */
if (classFlags & (LG_CERT|LG_TRUST)) {
lg_searchCertsAndTrust(sdb,&derCert,&name,&derSubject,
&issuerSN, &email,classFlags,search,
pTemplate, ulCount);
}
/* keys */
if (classFlags & (LG_PRIVATE|LG_PUBLIC|LG_KEY)) {
PRBool mustStrict = ((classFlags & LG_KEY) != 0) && (name.len != 0);
lg_searchKeys(sdb, &key_id, classFlags, search,
mustStrict, pTemplate, ulCount);
}
/* crl's */
if (classFlags & LG_CRL) {
lg_searchCrls(sdb, &derSubject, isKrl, classFlags, search,
pTemplate, ulCount);
}
/* Add S/MIME entry stuff */
if (classFlags & LG_SMIME) {
lg_searchSMime(sdb, &email, search, pTemplate, ulCount);
}
return CKR_OK;
}
/* lg_FindObjectsInit initializes a search for token and session objects
* that match a template. */
CK_RV lg_FindObjectsInit(SDB *sdb, const CK_ATTRIBUTE *pTemplate,
CK_ULONG ulCount, SDBFind **retSearch)
{
SDBFind *search;
CK_RV crv = CKR_OK;
*retSearch = NULL;
search = (SDBFind *)PORT_Alloc(sizeof(SDBFind));
if (search == NULL) {
crv = CKR_HOST_MEMORY;
goto loser;
}
search->handles = (CK_OBJECT_HANDLE *)
PORT_Alloc(sizeof(CK_OBJECT_HANDLE) * LG_SEARCH_BLOCK_SIZE);
if (search->handles == NULL) {
crv = CKR_HOST_MEMORY;
goto loser;
}
search->index = 0;
search->size = 0;
search->array_size = LG_SEARCH_BLOCK_SIZE;
/* FIXME - do we still need to get Login state? */
crv = lg_searchTokenList(sdb, search, pTemplate, ulCount);
if (crv != CKR_OK) {
goto loser;
}
*retSearch = search;
return CKR_OK;
loser:
if (search) {
lg_FreeSearch(search);
}
return crv;
}
/* lg_FindObjects continues a search for token and session objects
* that match a template, obtaining additional object handles. */
CK_RV lg_FindObjects(SDB *sdb, SDBFind *search,
CK_OBJECT_HANDLE *phObject,CK_ULONG ulMaxObjectCount,
CK_ULONG *pulObjectCount)
{
int transfer;
int left;
*pulObjectCount = 0;
left = search->size - search->index;
transfer = ((int)ulMaxObjectCount > left) ? left : ulMaxObjectCount;
if (transfer > 0) {
PORT_Memcpy(phObject,&search->handles[search->index],
transfer*sizeof(CK_OBJECT_HANDLE_PTR));
} else {
*phObject = CK_INVALID_HANDLE;
}
search->index += transfer;
*pulObjectCount = transfer;
return CKR_OK;
}
/* lg_FindObjectsFinal finishes a search for token and session objects. */
CK_RV lg_FindObjectsFinal(SDB* lgdb, SDBFind *search)
{
if (search != NULL) {
lg_FreeSearch(search);
}
return CKR_OK;
}

574
mozilla/security/nss/lib/softoken/dbinit.c → mozilla/security/nss/lib/softoken/legacydb/lginit.c
View File

@@ -36,23 +36,22 @@
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/* $Id: dbinit.c,v 1.30 2006-09-22 00:19:49 julien.pierre.bugs%sun.com Exp $ */
/* $Id: lginit.c,v 1.2 2007-06-13 00:24:57 rrelyea%redhat.com Exp $ */
#include <ctype.h>
#include "seccomon.h"
#include "prinit.h"
#include "prprf.h"
#include "prmem.h"
#include "pratom.h"
#include "pcertt.h"
#include "lowkeyi.h"
#include "pcert.h"
#include "cdbhdl.h"
#include "keydbi.h"
#include "pkcs11i.h"
#include "lgdb.h"
typedef struct LGPrivateStr {
NSSLOWCERTCertDBHandle *certDB;
NSSLOWKEYDBHandle *keyDB;
PRLock *dbLock;
PLHashTable *hashTable;
} LGPrivate;
static char *
sftk_certdb_name_cb(void *arg, int dbVersion)
lg_certdb_name_cb(void *arg, int dbVersion)
{
const char *configdir = (const char *)arg;
const char *dbver;
@@ -89,7 +88,7 @@ sftk_certdb_name_cb(void *arg, int dbVersion)
}
static char *
sftk_keydb_name_cb(void *arg, int dbVersion)
lg_keydb_name_cb(void *arg, int dbVersion)
{
const char *configdir = (const char *)arg;
const char *dbver;
@@ -121,7 +120,7 @@ sftk_keydb_name_cb(void *arg, int dbVersion)
}
const char *
sftk_EvaluateConfigDir(const char *configdir,char **appName)
lg_EvaluateConfigDir(const char *configdir,char **appName)
{
if (PORT_Strncmp(configdir, MULTIACCESS, sizeof(MULTIACCESS)-1) == 0) {
char *cdir;
@@ -143,171 +142,9 @@ sftk_EvaluateConfigDir(const char *configdir,char **appName)
return configdir;
}
static CK_RV
sftk_OpenCertDB(const char * configdir, const char *prefix, PRBool readOnly,
NSSLOWCERTCertDBHandle **certdbPtr)
{
NSSLOWCERTCertDBHandle *certdb = NULL;
CK_RV crv = CKR_NETSCAPE_CERTDB_FAILED;
SECStatus rv;
char * name = NULL;
char * appName = NULL;
if (prefix == NULL) {
prefix = "";
}
configdir = sftk_EvaluateConfigDir(configdir, &appName);
name = PR_smprintf("%s" PATH_SEPARATOR "%s",configdir,prefix);
if (name == NULL) goto loser;
certdb = (NSSLOWCERTCertDBHandle*)PORT_ZAlloc(sizeof(NSSLOWCERTCertDBHandle));
if (certdb == NULL)
goto loser;
certdb->ref = 1;
/* fix when we get the DB in */
rv = nsslowcert_OpenCertDB(certdb, readOnly, appName, prefix,
sftk_certdb_name_cb, (void *)name, PR_FALSE);
if (rv == SECSuccess) {
crv = CKR_OK;
*certdbPtr = certdb;
certdb = NULL;
}
loser:
if (certdb) PR_Free(certdb);
if (name) PR_smprintf_free(name);
if (appName) PORT_Free(appName);
return crv;
}
static CK_RV
sftk_OpenKeyDB(const char * configdir, const char *prefix, PRBool readOnly,
NSSLOWKEYDBHandle **keydbPtr)
{
NSSLOWKEYDBHandle *keydb;
char * name = NULL;
char * appName = NULL;
if (prefix == NULL) {
prefix = "";
}
configdir = sftk_EvaluateConfigDir(configdir, &appName);
name = PR_smprintf("%s" PATH_SEPARATOR "%s",configdir,prefix);
if (name == NULL)
return CKR_HOST_MEMORY;
keydb = nsslowkey_OpenKeyDB(readOnly, appName, prefix,
sftk_keydb_name_cb, (void *)name);
PR_smprintf_free(name);
if (appName) PORT_Free(appName);
if (keydb == NULL)
return CKR_NETSCAPE_KEYDB_FAILED;
*keydbPtr = keydb;
return CKR_OK;
}
/*
* OK there are now lots of options here, lets go through them all:
*
* configdir - base directory where all the cert, key, and module datbases live.
* certPrefix - prefix added to the beginning of the cert database example: "
* "https-server1-"
* keyPrefix - prefix added to the beginning of the key database example: "
* "https-server1-"
* secmodName - name of the security module database (usually "secmod.db").
* readOnly - Boolean: true if the databases are to be openned read only.
* nocertdb - Don't open the cert DB and key DB's, just initialize the
* Volatile certdb.
* nomoddb - Don't open the security module DB, just initialize the
* PKCS #11 module.
* forceOpen - Continue to force initializations even if the databases cannot
* be opened.
*/
CK_RV
sftk_DBInit(const char *configdir, const char *certPrefix,
const char *keyPrefix, PRBool readOnly,
PRBool noCertDB, PRBool noKeyDB, PRBool forceOpen,
NSSLOWCERTCertDBHandle **certdbPtr, NSSLOWKEYDBHandle **keydbPtr)
{
CK_RV crv = CKR_OK;
if (!noCertDB) {
crv = sftk_OpenCertDB(configdir, certPrefix, readOnly, certdbPtr);
if (crv != CKR_OK) {
if (!forceOpen) goto loser;
crv = CKR_OK;
}
}
if (!noKeyDB) {
crv = sftk_OpenKeyDB(configdir, keyPrefix, readOnly, keydbPtr);
if (crv != CKR_OK) {
if (!forceOpen) goto loser;
crv = CKR_OK;
}
}
loser:
return crv;
}
NSSLOWCERTCertDBHandle *
sftk_getCertDB(SFTKSlot *slot)
{
NSSLOWCERTCertDBHandle *certHandle;
PZ_Lock(slot->slotLock);
certHandle = slot->certDB;
if (certHandle) {
PR_AtomicIncrement(&certHandle->ref);
}
PZ_Unlock(slot->slotLock);
return certHandle;
}
NSSLOWKEYDBHandle *
sftk_getKeyDB(SFTKSlot *slot)
{
NSSLOWKEYDBHandle *keyHandle;
PZ_Lock(slot->slotLock);
keyHandle = slot->keyDB;
if (keyHandle) {
PR_AtomicIncrement(&keyHandle->ref);
}
PZ_Unlock(slot->slotLock);
return keyHandle;
}
void
sftk_freeCertDB(NSSLOWCERTCertDBHandle *certHandle)
{
PRInt32 ref = PR_AtomicDecrement(&certHandle->ref);
if (ref == 0) {
nsslowcert_ClosePermCertDB(certHandle);
PORT_Free(certHandle);
}
}
void
sftk_freeKeyDB(NSSLOWKEYDBHandle *keyHandle)
{
PRInt32 ref = PR_AtomicDecrement(&keyHandle->ref);
if (ref == 0) {
nsslowkey_CloseKeyDB(keyHandle);
}
}
static int rdbmapflags(int flags);
static rdbfunc sftk_rdbfunc = NULL;
static rdbstatusfunc sftk_rdbstatusfunc = NULL;
static rdbfunc lg_rdbfunc = NULL;
static rdbstatusfunc lg_rdbstatusfunc = NULL;
/* NOTE: SHLIB_SUFFIX is defined on the command line */
#define RDBLIB SHLIB_PREFIX"rdb."SHLIB_SUFFIX
@@ -318,10 +155,10 @@ DB * rdbopen(const char *appName, const char *prefix,
PRLibrary *lib;
DB *db;
if (sftk_rdbfunc) {
db = (*sftk_rdbfunc)(appName,prefix,type,rdbmapflags(flags));
if (!db && status && sftk_rdbstatusfunc) {
*status = (*sftk_rdbstatusfunc)();
if (lg_rdbfunc) {
db = (*lg_rdbfunc)(appName,prefix,type,rdbmapflags(flags));
if (!db && status && lg_rdbstatusfunc) {
*status = (*lg_rdbstatusfunc)();
}
return db;
}
@@ -336,12 +173,12 @@ DB * rdbopen(const char *appName, const char *prefix,
}
/* get the entry points */
sftk_rdbstatusfunc = (rdbstatusfunc) PR_FindFunctionSymbol(lib,"rdbstatus");
sftk_rdbfunc = (rdbfunc) PR_FindFunctionSymbol(lib,"rdbopen");
if (sftk_rdbfunc) {
db = (*sftk_rdbfunc)(appName,prefix,type,rdbmapflags(flags));
if (!db && status && sftk_rdbstatusfunc) {
*status = (*sftk_rdbstatusfunc)();
lg_rdbstatusfunc = (rdbstatusfunc) PR_FindSymbol(lib,"rdbstatus");
lg_rdbfunc = (rdbfunc) PR_FindSymbol(lib,"rdbopen");
if (lg_rdbfunc) {
db = (*lg_rdbfunc)(appName,prefix,type,rdbmapflags(flags));
if (!db && status && lg_rdbstatusfunc) {
*status = (*lg_rdbstatusfunc)();
}
return db;
}
@@ -382,7 +219,6 @@ rdbmapflags(int flags) {
return 0;
}
PRBool
db_IsRDB(DB *db)
{
@@ -411,6 +247,71 @@ db_FinishTransaction(DB *db, PRBool abort)
return rdb->xactdone(db, abort);
}
static DB *
lg_getRawDB(SDB *sdb)
{
NSSLOWCERTCertDBHandle *certDB;
NSSLOWKEYDBHandle *keyDB;
certDB = lg_getCertDB(sdb);
if (certDB) {
return certDB->permCertDB;
}
keyDB = lg_getKeyDB(sdb);
if (keyDB) {
return keyDB->db;
}
return NULL;
}
CK_RV
lg_Begin(SDB *sdb)
{
DB *db = lg_getRawDB(sdb);
int ret;
if (db == NULL) {
return CKR_GENERAL_ERROR; /* shouldn't happen */
}
ret = db_BeginTransaction(db);
if (ret != 0) {
return CKR_GENERAL_ERROR; /* could happen */
}
return CKR_OK;
}
CK_RV
lg_Commit(SDB *sdb)
{
DB *db = lg_getRawDB(sdb);
int ret;
if (db == NULL) {
return CKR_GENERAL_ERROR; /* shouldn't happen */
}
ret = db_FinishTransaction(db, PR_FALSE);
if (ret != 0) {
return CKR_GENERAL_ERROR; /* could happen */
}
return CKR_OK;
}
CK_RV
lg_Abort(SDB *sdb)
{
DB *db = lg_getRawDB(sdb);
int ret;
if (db == NULL) {
return CKR_GENERAL_ERROR; /* shouldn't happen */
}
ret = db_FinishTransaction(db, PR_TRUE);
if (ret != 0) {
return CKR_GENERAL_ERROR; /* could happen */
}
return CKR_OK;
}
int
db_InitComplete(DB *db)
{
@@ -418,10 +319,10 @@ db_InitComplete(DB *db)
if (db->type != DB_RDB) {
return 0;
}
/* we should have addes a version number to the RDBS structure. Since we
/* we should have added a version number to the RDBS structure. Since we
* didn't, we detect that we have and 'extended' structure if the rdbstatus
* func exists */
if (!sftk_rdbstatusfunc) {
if (!lg_rdbstatusfunc) {
return 0;
}
@@ -448,3 +349,296 @@ db_Copy(DB *dest,DB *src)
return SECSuccess;
}
static CK_RV
lg_OpenCertDB(const char * configdir, const char *prefix, PRBool readOnly,
NSSLOWCERTCertDBHandle **certdbPtr)
{
NSSLOWCERTCertDBHandle *certdb = NULL;
CK_RV crv = CKR_NETSCAPE_CERTDB_FAILED;
SECStatus rv;
char * name = NULL;
char * appName = NULL;
if (prefix == NULL) {
prefix = "";
}
configdir = lg_EvaluateConfigDir(configdir, &appName);
name = PR_smprintf("%s" PATH_SEPARATOR "%s",configdir,prefix);
if (name == NULL) goto loser;
certdb = (NSSLOWCERTCertDBHandle*)PORT_ZAlloc(sizeof(NSSLOWCERTCertDBHandle));
if (certdb == NULL)
goto loser;
certdb->ref = 1;
/* fix when we get the DB in */
rv = nsslowcert_OpenCertDB(certdb, readOnly, appName, prefix,
lg_certdb_name_cb, (void *)name, PR_FALSE);
if (rv == SECSuccess) {
crv = CKR_OK;
*certdbPtr = certdb;
certdb = NULL;
}
loser:
if (certdb) PR_Free(certdb);
if (name) PR_smprintf_free(name);
if (appName) PORT_Free(appName);
return crv;
}
static CK_RV
lg_OpenKeyDB(const char * configdir, const char *prefix, PRBool readOnly,
NSSLOWKEYDBHandle **keydbPtr)
{
NSSLOWKEYDBHandle *keydb;
char * name = NULL;
char * appName = NULL;
if (prefix == NULL) {
prefix = "";
}
configdir = lg_EvaluateConfigDir(configdir, &appName);
name = PR_smprintf("%s" PATH_SEPARATOR "%s",configdir,prefix);
if (name == NULL)
return CKR_HOST_MEMORY;
keydb = nsslowkey_OpenKeyDB(readOnly, appName, prefix,
lg_keydb_name_cb, (void *)name);
PR_smprintf_free(name);
if (appName) PORT_Free(appName);
if (keydb == NULL)
return CKR_NETSCAPE_KEYDB_FAILED;
*keydbPtr = keydb;
return CKR_OK;
}
/*
* Accessors for the private parts of the sdb structure.
*/
void
lg_DBLock(SDB *sdb)
{
LGPrivate *lgdb_p = (LGPrivate *)sdb->private;
PR_Lock(lgdb_p->dbLock);
}
void
lg_DBUnlock(SDB *sdb)
{
LGPrivate *lgdb_p = (LGPrivate *)sdb->private;
PR_Unlock(lgdb_p->dbLock);
}
PLHashTable *
lg_GetHashTable(SDB *sdb)
{
LGPrivate *lgdb_p = (LGPrivate *)sdb->private;
return lgdb_p->hashTable;
}
NSSLOWCERTCertDBHandle *
lg_getCertDB(SDB *sdb)
{
LGPrivate *lgdb_p = (LGPrivate *)sdb->private;
return lgdb_p->certDB;
}
NSSLOWKEYDBHandle *
lg_getKeyDB(SDB *sdb)
{
LGPrivate *lgdb_p = (LGPrivate *)sdb->private;
return lgdb_p->keyDB;
}
CK_RV
lg_Close(SDB *sdb)
{
LGPrivate *lgdb_p = (LGPrivate *)sdb->private;
if (lgdb_p) {
if (lgdb_p->certDB) {
nsslowcert_ClosePermCertDB(lgdb_p->certDB);
} else if (lgdb_p->keyDB) {
nsslowkey_CloseKeyDB(lgdb_p->keyDB);
}
if (lgdb_p->dbLock) {
PR_DestroyLock(lgdb_p->dbLock);
}
if (lgdb_p->hashTable) {
PL_HashTableDestroy(lgdb_p->hashTable);
}
PORT_Free(lgdb_p);
}
PORT_Free(sdb);
return CKR_OK;
}
static PLHashNumber
lg_HashNumber(const void *key)
{
return (PLHashNumber) key;
}
/*
* helper function to wrap a NSSLOWCERTCertDBHandle or a NSSLOWKEYDBHandle
* with and sdb structure.
*/
CK_RV
lg_init(SDB **pSdb, int flags, NSSLOWCERTCertDBHandle *certdbPtr,
NSSLOWKEYDBHandle *keydbPtr)
{
SDB *sdb = NULL;
LGPrivate *lgdb_p = NULL;
CK_RV error = CKR_HOST_MEMORY;
*pSdb = NULL;
sdb = (SDB *) PORT_Alloc(sizeof(SDB));
if (sdb == NULL) {
goto loser;
}
lgdb_p = (LGPrivate *) PORT_Alloc(sizeof(LGPrivate));
if (lgdb_p == NULL) {
goto loser;
}
/* invariant fields */
lgdb_p->certDB = certdbPtr;
lgdb_p->keyDB = keydbPtr;
lgdb_p->dbLock = PR_NewLock();
if (lgdb_p->dbLock == NULL) {
goto loser;
}
lgdb_p->hashTable = PL_NewHashTable(64, lg_HashNumber, PL_CompareValues,
SECITEM_HashCompare, NULL, 0);
if (lgdb_p->hashTable == NULL) {
goto loser;
}
sdb->sdb_type = SDB_LEGACY;
sdb->sdb_flags = flags;
sdb->private = lgdb_p;
sdb->sdb_FindObjectsInit = lg_FindObjectsInit;
sdb->sdb_FindObjects = lg_FindObjects;
sdb->sdb_FindObjectsFinal = lg_FindObjectsFinal;
sdb->sdb_GetAttributeValue = lg_GetAttributeValue;
sdb->sdb_SetAttributeValue = lg_SetAttributeValue;
sdb->sdb_CreateObject = lg_CreateObject;
sdb->sdb_DestroyObject = lg_DestroyObject;
sdb->sdb_GetPWEntry = lg_GetPWEntry;
sdb->sdb_PutPWEntry = lg_PutPWEntry;
sdb->sdb_Begin = lg_Begin;
sdb->sdb_Commit = lg_Commit;
sdb->sdb_Abort = lg_Abort;
sdb->sdb_Close = lg_Reset;
sdb->sdb_Close = lg_Close;
*pSdb = sdb;
return CKR_OK;
loser:
if (sdb) {
PORT_Free(sdb);
}
if (lgdb_p) {
if (lgdb_p->dbLock) {
PR_DestroyLock(lgdb_p->dbLock);
}
if (lgdb_p->hashTable) {
PL_HashTableDestroy(lgdb_p->hashTable);
}
PORT_Free(lgdb_p);
}
return error;
}
extern SECStatus secoid_Init(void); /* util *REALLY* needs
* to be a shared library */
/*
* OK there are now lots of options here, lets go through them all:
*
* configdir - base directory where all the cert, key, and module datbases live.
* certPrefix - prefix added to the beginning of the cert database example: "
* "https-server1-"
* keyPrefix - prefix added to the beginning of the key database example: "
* "https-server1-"
* secmodName - name of the security module database (usually "secmod.db").
* readOnly - Boolean: true if the databases are to be openned read only.
* nocertdb - Don't open the cert DB and key DB's, just initialize the
* Volatile certdb.
* nomoddb - Don't open the security module DB, just initialize the
* PKCS #11 module.
* forceOpen - Continue to force initializations even if the databases cannot
* be opened.
*/
CK_RV
legacy_Open(const char *configdir, const char *certPrefix,
const char *keyPrefix, int certVersion, int keyVersion,
int flags, SDB **certDB, SDB **keyDB)
{
CK_RV crv = CKR_OK;
PRBool readOnly = (flags == SDB_RDONLY)? PR_TRUE: PR_FALSE;
secoid_Init();
nsslowcert_InitLocks();
if (keyDB) *keyDB = NULL;
if (certDB) *certDB = NULL;
if (certDB) {
NSSLOWCERTCertDBHandle *certdbPtr;
crv = lg_OpenCertDB(configdir, certPrefix, readOnly, &certdbPtr);
if (crv != CKR_OK) {
goto loser;
}
crv = lg_init(certDB, flags, certdbPtr, NULL);
if (crv != CKR_OK) {
nsslowcert_ClosePermCertDB(certdbPtr);
goto loser;
}
}
if (keyDB) {
NSSLOWKEYDBHandle *keydbPtr;
crv = lg_OpenKeyDB(configdir, keyPrefix, readOnly, &keydbPtr);
if (crv != CKR_OK) {
goto loser;
}
crv = lg_init(keyDB, flags, NULL, keydbPtr);
if (crv != CKR_OK) {
nsslowkey_CloseKeyDB(keydbPtr);
goto loser;
}
if (certDB && *certDB) {
LGPrivate *lgdb_p = (LGPrivate *)(*certDB)->private;
lgdb_p->keyDB = keydbPtr;
}
}
loser:
if (crv != CKR_OK) {
if (keyDB && *keyDB) {
lg_Close(*keyDB);
*keyDB = NULL;
}
if (certDB && *certDB) {
lg_Close(*certDB);
*certDB = NULL;
}
}
return crv;
}
CK_RV
legacy_Shutdown(void)
{
nsslowcert_DestroyFreeLists();
nsslowcert_DestroyGlobalLocks();
}

424
mozilla/security/nss/lib/softoken/legacydb/lgutil.c Normal file
View File

@@ -0,0 +1,424 @@
/* ***** BEGIN LICENSE BLOCK *****
* Version: MPL 1.1/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Mozilla Public License Version
* 1.1 (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
* http://www.mozilla.org/MPL/
*
* Software distributed under the License is distributed on an "AS IS" basis,
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
* for the specific language governing rights and limitations under the
* License.
*
* The Original Code is the Netscape security libraries.
*
* The Initial Developer of the Original Code is
* Netscape Communications Corporation.
* Portions created by the Initial Developer are Copyright (C) 1994-2000
* the Initial Developer. All Rights Reserved.
*
* Contributor(s):
* Dr Vipul Gupta <vipul.gupta@sun.com>, Sun Microsystems Laboratories
*
* Alternatively, the contents of this file may be used under the terms of
* either the GNU General Public License Version 2 or later (the "GPL"), or
* the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the MPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
#include "lgdb.h"
#include "secerr.h"
#include "lgglue.h"
/*
* ******************** Attribute Utilities *******************************
*/
/*
* look up and attribute structure from a type and Object structure.
* The returned attribute is referenced and needs to be freed when
* it is no longer needed.
*/
const CK_ATTRIBUTE *
lg_FindAttribute(CK_ATTRIBUTE_TYPE type, const CK_ATTRIBUTE *templ,
CK_ULONG count )
{
int i;
for (i=0; i < count; i++) {
if (templ[i].type == type) {
return &templ[i];
}
}
return NULL;
}
/*
* return true if object has attribute
*/
PRBool
lg_hasAttribute(CK_ATTRIBUTE_TYPE type, const CK_ATTRIBUTE *templ,
CK_ULONG count )
{
if (lg_FindAttribute(type, templ, count) == NULL) {
return PR_FALSE;
}
return PR_TRUE;
}
/*
* copy an attribute into a SECItem. Secitem is allocated in the specified
* arena.
*/
CK_RV
lg_Attribute2SecItem(PLArenaPool *arena, CK_ATTRIBUTE_TYPE type,
const CK_ATTRIBUTE *templ, CK_ULONG count,
SECItem *item)
{
int len;
const CK_ATTRIBUTE *attribute;
attribute = lg_FindAttribute(type, templ, count);
if (attribute == NULL) return CKR_TEMPLATE_INCOMPLETE;
len = attribute->ulValueLen;
if (arena) {
item->data = (unsigned char *) PORT_ArenaAlloc(arena,len);
} else {
item->data = (unsigned char *) PORT_Alloc(len);
}
if (item->data == NULL) {
return CKR_HOST_MEMORY;
}
item->len = len;
PORT_Memcpy(item->data, attribute->pValue, len);
return CKR_OK;
}
/*
* copy an unsigned attribute into a SECItem. Secitem is allocated in
* the specified arena.
*/
CK_RV
lg_Attribute2SSecItem(PLArenaPool *arena, CK_ATTRIBUTE_TYPE type,
const CK_ATTRIBUTE *templ, CK_ULONG count,
SECItem *item)
{
const CK_ATTRIBUTE *attribute;
item->data = NULL;
attribute = lg_FindAttribute(type, templ, count);
if (attribute == NULL) return CKR_TEMPLATE_INCOMPLETE;
(void)SECITEM_AllocItem(arena, item, attribute->ulValueLen);
if (item->data == NULL) {
return CKR_HOST_MEMORY;
}
PORT_Memcpy(item->data, attribute->pValue, item->len);
return CKR_OK;
}
/*
* copy an unsigned attribute into a SECItem. Secitem is allocated in
* the specified arena.
*/
CK_RV
lg_PrivAttr2SSecItem(PLArenaPool *arena, CK_ATTRIBUTE_TYPE type,
const CK_ATTRIBUTE *templ, CK_ULONG count,
SECItem *item, SDB *sdbpw)
{
const CK_ATTRIBUTE *attribute;
SECItem epki, *dest = NULL;
SECStatus rv;
item->data = NULL;
attribute = lg_FindAttribute(type, templ, count);
if (attribute == NULL) return CKR_TEMPLATE_INCOMPLETE;
epki.data = attribute->pValue;
epki.len = attribute->ulValueLen;
rv = lg_util_decrypt(sdbpw, &epki, &dest);
if (rv != SECSuccess) {
return CKR_USER_NOT_LOGGED_IN;
}
(void)SECITEM_AllocItem(arena, item, dest->len);
if (item->data == NULL) {
SECITEM_FreeItem(dest, PR_TRUE);
return CKR_HOST_MEMORY;
}
PORT_Memcpy(item->data, dest->data, item->len);
SECITEM_FreeItem(dest, PR_TRUE);
return CKR_OK;
}
CK_RV
lg_PrivAttr2SecItem(PLArenaPool *arena, CK_ATTRIBUTE_TYPE type,
const CK_ATTRIBUTE *templ, CK_ULONG count,
SECItem *item, SDB *sdbpw)
{
return lg_PrivAttr2SSecItem(arena, type, templ, count, item, sdbpw);
}
/*
* this is only valid for CK_BBOOL type attributes. Return the state
* of that attribute.
*/
PRBool
lg_isTrue(CK_ATTRIBUTE_TYPE type, const CK_ATTRIBUTE *templ, CK_ULONG count)
{
const CK_ATTRIBUTE *attribute;
PRBool tok = PR_FALSE;
attribute=lg_FindAttribute(type, templ, count);
if (attribute == NULL) { return PR_FALSE; }
tok = (PRBool)(*(CK_BBOOL *)attribute->pValue);
return tok;
}
/*
* return a null terminated string from attribute 'type'. This string
* is allocated and needs to be freed with PORT_Free() When complete.
*/
char *
lg_getString(CK_ATTRIBUTE_TYPE type, const CK_ATTRIBUTE *templ, CK_ULONG count)
{
const CK_ATTRIBUTE *attribute;
char *label = NULL;
attribute = lg_FindAttribute(type, templ, count);
if (attribute == NULL) return NULL;
if (attribute->pValue != NULL) {
label = (char *) PORT_Alloc(attribute->ulValueLen+1);
if (label == NULL) {
return NULL;
}
PORT_Memcpy(label,attribute->pValue, attribute->ulValueLen);
label[attribute->ulValueLen] = 0;
}
return label;
}
CK_RV
lg_GetULongAttribute(CK_ATTRIBUTE_TYPE type, const CK_ATTRIBUTE *templ,
CK_ULONG count, CK_ULONG *longData)
{
const CK_ATTRIBUTE *attribute;
CK_ULONG value = 0;
const unsigned char *data;
int i;
attribute = lg_FindAttribute(type, templ, count);
if (attribute == NULL) return CKR_TEMPLATE_INCOMPLETE;
if (attribute->ulValueLen != sizeof(CK_ULONG)) {
return CKR_ATTRIBUTE_VALUE_INVALID;
}
data = (const unsigned char *)attribute->pValue;
for (i=0; i < 4; i++) {
value |= (CK_ULONG)(data[i]) << ((3-i)*8);
}
*longData = value;
return CKR_OK;
}
/*
* ******************** Object Utilities *******************************
*/
SECStatus
lg_deleteTokenKeyByHandle(SDB *sdb, CK_OBJECT_HANDLE handle)
{
SECItem *item;
PRBool rem;
PLHashTable *hashTable= lg_GetHashTable(sdb);
item = (SECItem *)PL_HashTableLookup(hashTable, (void *)handle);
rem = PL_HashTableRemove(hashTable,(void *)handle) ;
if (rem && item) {
SECITEM_FreeItem(item,PR_TRUE);
}
return rem ? SECSuccess : SECFailure;
}
/* must be called holding lg_DBLock(sdb) */
static SECStatus
lg_addTokenKeyByHandle(SDB *sdb, CK_OBJECT_HANDLE handle, SECItem *key)
{
PLHashEntry *entry;
SECItem *item;
PLHashTable *hashTable= lg_GetHashTable(sdb);
item = SECITEM_DupItem(key);
if (item == NULL) {
return SECFailure;
}
entry = PL_HashTableAdd(hashTable,(void *)handle,item);
if (entry == NULL) {
SECITEM_FreeItem(item,PR_TRUE);
return SECFailure;
}
return SECSuccess;
}
/* must be called holding lg_DBLock(sdb) */
const SECItem *
lg_lookupTokenKeyByHandle(SDB *sdb, CK_OBJECT_HANDLE handle)
{
PLHashTable *hashTable= lg_GetHashTable(sdb);
return (const SECItem *)PL_HashTableLookup(hashTable, (void *)handle);
}
static PRIntn
lg_freeHashItem(PLHashEntry* entry, PRIntn index, void *arg)
{
SECItem *item = (SECItem *)entry->value;
SECITEM_FreeItem(item, PR_TRUE);
return HT_ENUMERATE_NEXT;
}
CK_RV
LG_ClearTokenKeyHashTable(SDB *sdb)
{
PLHashTable *hashTable;
lg_DBLock(sdb);
hashTable= lg_GetHashTable(sdb);
PL_HashTableEnumerateEntries(hashTable, lg_freeHashItem, NULL);
lg_DBLock(sdb);
return CKR_OK;
}
/*
* handle Token Object stuff
*/
static void
lg_XORHash(unsigned char *key, unsigned char *dbkey, int len)
{
int i;
PORT_Memset(key, 0, 4);
for (i=0; i < len-4; i += 4) {
key[0] ^= dbkey[i];
key[1] ^= dbkey[i+1];
key[2] ^= dbkey[i+2];
key[3] ^= dbkey[i+3];
}
}
/* Make a token handle for an object and record it so we can find it again */
CK_OBJECT_HANDLE
lg_mkHandle(SDB *sdb, SECItem *dbKey, CK_OBJECT_HANDLE class)
{
unsigned char hashBuf[4];
CK_OBJECT_HANDLE handle;
const SECItem *key;
handle = class;
/* there is only one KRL, use a fixed handle for it */
if (handle != LG_TOKEN_KRL_HANDLE) {
lg_XORHash(hashBuf,dbKey->data,dbKey->len);
handle = (hashBuf[0] << 24) | (hashBuf[1] << 16) |
(hashBuf[2] << 8) | hashBuf[3];
handle = class | (handle & ~(LG_TOKEN_TYPE_MASK|LG_TOKEN_MASK));
/* we have a CRL who's handle has randomly matched the reserved KRL
* handle, increment it */
if (handle == LG_TOKEN_KRL_HANDLE) {
handle++;
}
}
lg_DBLock(sdb);
while ((key = lg_lookupTokenKeyByHandle(sdb,handle)) != NULL) {
if (SECITEM_ItemsAreEqual(key,dbKey)) {
lg_DBUnlock(sdb);
return handle;
}
handle++;
}
lg_addTokenKeyByHandle(sdb,handle,dbKey);
lg_DBUnlock(sdb);
return handle;
}
PRBool
lg_poisonHandle(SDB *sdb, SECItem *dbKey, CK_OBJECT_HANDLE class)
{
unsigned char hashBuf[4];
CK_OBJECT_HANDLE handle;
const SECItem *key;
handle = class;
/* there is only one KRL, use a fixed handle for it */
if (handle != LG_TOKEN_KRL_HANDLE) {
lg_XORHash(hashBuf,dbKey->data,dbKey->len);
handle = (hashBuf[0] << 24) | (hashBuf[1] << 16) |
(hashBuf[2] << 8) | hashBuf[3];
handle = class | (handle & ~(LG_TOKEN_TYPE_MASK|LG_TOKEN_MASK));
/* we have a CRL who's handle has randomly matched the reserved KRL
* handle, increment it */
if (handle == LG_TOKEN_KRL_HANDLE) {
handle++;
}
}
lg_DBLock(sdb);
while ((key = lg_lookupTokenKeyByHandle(sdb,handle)) != NULL) {
if (SECITEM_ItemsAreEqual(key,dbKey)) {
key->data[0] ^= 0x80;
lg_DBUnlock(sdb);
return PR_TRUE;
}
handle++;
}
lg_DBUnlock(sdb);
return PR_FALSE;
}
static LGEncryptFunc lg_encrypt_stub = NULL;
static LGDecryptFunc lg_decrypt_stub = NULL;
void
legacy_SetCryptFunctions(LGEncryptFunc enc, LGDecryptFunc dec)
{
lg_encrypt_stub = enc;
lg_decrypt_stub = dec;
}
SECStatus lg_util_encrypt(PLArenaPool *arena, SDB *sdb,
SECItem *plainText, SECItem **cipherText)
{
if (lg_encrypt_stub == NULL) {
PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
return SECFailure;
}
return (*lg_encrypt_stub)(arena, sdb, plainText, cipherText);
}
SECStatus lg_util_decrypt(SDB *sdb, SECItem *cipherText, SECItem **plainText)
{
if (lg_decrypt_stub == NULL) {
PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
return SECFailure;
}
return (*lg_decrypt_stub)(sdb, cipherText, plainText);
}

248
mozilla/security/nss/lib/softoken/lowcert.c → mozilla/security/nss/lib/softoken/legacydb/lowcert.c
View File

@@ -38,21 +38,17 @@
/*
* Certificate handling code
*
* $Id: lowcert.c,v 1.23 2006-03-21 19:33:52 rrelyea%redhat.com Exp $
* $Id: lowcert.c,v 1.2 2007-06-13 00:24:57 rrelyea%redhat.com Exp $
*/
#include "seccomon.h"
#include "secder.h"
#include "nssilock.h"
#include "prmon.h"
#include "prtime.h"
#include "lowkeyi.h"
#include "pcert.h"
#include "secasn1.h"
#include "secoid.h"
#include "secerr.h"
#include "softoken.h"
#include "pcert.h"
static const SEC_ASN1Template nsslowcert_SubjectPublicKeyInfoTemplate[] = {
{ SEC_ASN1_SEQUENCE, 0, NULL, sizeof(NSSLOWCERTSubjectPublicKeyInfo) },
@@ -111,26 +107,6 @@ prepare_low_dh_pub_key_for_asn1(NSSLOWKEYPublicKey *pubk)
pubk->u.dh.publicValue.type = siUnsignedInteger;
}
/*
* Allow use of default cert database, so that apps(such as mozilla) don't
* have to pass the handle all over the place.
*/
static NSSLOWCERTCertDBHandle *default_pcert_db_handle = 0;
void
nsslowcert_SetDefaultCertDB(NSSLOWCERTCertDBHandle *handle)
{
default_pcert_db_handle = handle;
return;
}
NSSLOWCERTCertDBHandle *
nsslowcert_GetDefaultCertDB(void)
{
return(default_pcert_db_handle);
}
/*
* simple cert decoder to avoid the cost of asn1 engine
*/
@@ -211,7 +187,7 @@ nsslowcert_GetValidityFields(unsigned char *buf,int buf_length,
static int
nsslowcert_GetCertFields(unsigned char *cert,int cert_length,
SECItem *issuer, SECItem *serial, SECItem *derSN, SECItem *subject,
SECItem *valid, SECItem *subjkey)
SECItem *valid, SECItem *subjkey, SECItem *extensions)
{
unsigned char *buf;
unsigned int buf_length;
@@ -269,10 +245,25 @@ nsslowcert_GetCertFields(unsigned char *cert,int cert_length,
if (subjkey->data == NULL) return SECFailure;
buf_length -= (subjkey->data-buf) + subjkey->len;
buf = subjkey->data + subjkey->len;
extensions->data = NULL;
extensions->len = 0;
while (buf_length > 0) {
/* EXTENSIONS */
if (buf[0] == 0xa3) {
extensions->data = nsslowcert_dataStart(buf,buf_length,
&extensions->len, PR_FALSE, NULL);
break;
}
dummy = nsslowcert_dataStart(buf,buf_length,&dummylen,PR_FALSE,NULL);
if (dummy == NULL) return SECFailure;
buf_length -= (dummy - buf) + dummylen;
buf = dummy + dummylen;
}
return SECSuccess;
}
SECStatus
static SECStatus
nsslowcert_GetCertTimes(NSSLOWCERTCertificate *c, PRTime *notBefore, PRTime *notAfter)
{
int rv;
@@ -412,6 +403,196 @@ loser:
}
static char *
nsslowcert_EmailName(SECItem *derDN, char *space, unsigned int len)
{
unsigned char *buf;
unsigned int buf_length;
/* unwrap outer sequence */
buf=nsslowcert_dataStart(derDN->data,derDN->len,&buf_length,PR_FALSE,NULL);
if (buf == NULL) return NULL;
/* Walk each RDN */
while (buf_length > 0) {
unsigned char *rdn;
unsigned int rdn_length;
/* grab next rdn */
rdn=nsslowcert_dataStart(buf, buf_length, &rdn_length, PR_FALSE, NULL);
if (rdn == NULL) { return NULL; }
buf_length -= (rdn - buf) + rdn_length;
buf = rdn+rdn_length;
while (rdn_length > 0) {
unsigned char *ava;
unsigned int ava_length;
unsigned char *oid;
unsigned int oid_length;
unsigned char *name;
unsigned int name_length;
SECItem oidItem;
SECOidTag type;
/* unwrap the ava */
ava=nsslowcert_dataStart(rdn, rdn_length, &ava_length, PR_FALSE,
NULL);
if (ava == NULL) return NULL;
rdn_length -= (ava-rdn)+ava_length;
rdn = ava + ava_length;
oid=nsslowcert_dataStart(ava, ava_length, &oid_length, PR_FALSE,
NULL);
if (oid == NULL) { return NULL; }
ava_length -= (oid-ava)+oid_length;
ava = oid+oid_length;
name=nsslowcert_dataStart(ava, ava_length, &name_length, PR_FALSE,
NULL);
if (oid == NULL) { return NULL; }
ava_length -= (name-ava)+name_length;
ava = name+name_length;
oidItem.data = oid;
oidItem.len = oid_length;
type = SECOID_FindOIDTag(&oidItem);
if ((type == SEC_OID_PKCS9_EMAIL_ADDRESS) ||
(type == SEC_OID_RFC1274_MAIL)) {
/* Email is supposed to be IA5String, so no
* translation necessary */
char *emailAddr;
emailAddr = (char *)pkcs11_copyStaticData(name,name_length+1,
(unsigned char *)space,len);
if (emailAddr) {
emailAddr[name_length] = 0;
}
return emailAddr;
}
}
}
return NULL;
}
static char *
nsslowcert_EmailAltName(NSSLOWCERTCertificate *cert, char *space,
unsigned int len)
{
unsigned char *exts;
unsigned int exts_length;
/* unwrap the sequence */
exts = nsslowcert_dataStart(cert->extensions.data, cert->extensions.len,
&exts_length, PR_FALSE, NULL);
/* loop through extension */
while (exts && exts_length > 0) {
unsigned char * ext;
unsigned int ext_length;
unsigned char *oid;
unsigned int oid_length;
unsigned char *nameList;
unsigned int nameList_length;
SECItem oidItem;
SECOidTag type;
ext = nsslowcert_dataStart(exts, exts_length, &ext_length,
PR_FALSE, NULL);
if (ext == NULL) { break; }
exts_length -= (ext - exts) + ext_length;
exts = ext+ext_length;
oid=nsslowcert_dataStart(ext, ext_length, &oid_length, PR_FALSE, NULL);
if (oid == NULL) { break; }
ext_length -= (oid - ext) + oid_length;
ext = oid+oid_length;
oidItem.data = oid;
oidItem.len = oid_length;
type = SECOID_FindOIDTag(&oidItem);
/* get Alt Extension */
if (type != SEC_OID_X509_SUBJECT_ALT_NAME) {
continue;
}
/* skip passed the critical flag */
if (ext[0] == 0x01) { /* BOOLEAN */
unsigned char *dummy;
unsigned int dummy_length;
dummy = nsslowcert_dataStart(ext, ext_length, &dummy_length,
PR_FALSE, NULL);
if (dummy == NULL) { break; }
ext_length -= (dummy - ext) + dummy_length;
ext = dummy+dummy_length;
}
/* unwrap the name list */
nameList = nsslowcert_dataStart(ext, ext_length, &nameList_length,
PR_FALSE, NULL);
if (nameList == NULL) { break; }
ext_length -= (nameList - ext) + nameList_length;
ext = nameList+nameList_length;
nameList = nsslowcert_dataStart(nameList, nameList_length,
&nameList_length, PR_FALSE, NULL);
/* loop through the name list */
while (nameList && nameList_length > 0) {
unsigned char *thisName;
unsigned int thisName_length;
thisName = nsslowcert_dataStart(nameList, nameList_length,
&thisName_length, PR_FALSE, NULL);
if (thisName == NULL) { break; }
if (nameList[0] == 0xa2) { /* DNS Name */
SECItem dn;
char *emailAddr;
dn.data = thisName;
dn.len = thisName_length;
emailAddr = nsslowcert_EmailName(&dn, space, len);
if (emailAddr) {
return emailAddr;
}
}
if (nameList[0] == 0x81) { /* RFC 822name */
char *emailAddr;
emailAddr = (char *)pkcs11_copyStaticData(thisName,
thisName_length+1, (unsigned char *)space,len);
if (emailAddr) {
emailAddr[thisName_length] = 0;
}
return emailAddr;
}
nameList_length -= (thisName-nameList) + thisName_length;
nameList = thisName + thisName_length;
}
break;
}
return NULL;
}
static char *
nsslowcert_GetCertificateEmailAddress(NSSLOWCERTCertificate *cert)
{
char *emailAddr = NULL;
char *str;
emailAddr = nsslowcert_EmailName(&cert->derSubject,cert->emailAddrSpace,
sizeof(cert->emailAddrSpace));
/* couldn't find the email address in the DN, check the subject Alt name */
if (!emailAddr && cert->extensions.data) {
emailAddr = nsslowcert_EmailAltName(cert, cert->emailAddrSpace,
sizeof(cert->emailAddrSpace));
}
/* make it lower case */
str = emailAddr;
while ( str && *str ) {
*str = tolower( *str );
str++;
}
return emailAddr;
}
/*
* take a DER certificate and decode it into a certificate structure
@@ -438,7 +619,7 @@ nsslowcert_DecodeDERCertificate(SECItem *derSignedCert, char *nickname)
/* decode the certificate info */
rv = nsslowcert_GetCertFields(cert->derCert.data, cert->derCert.len,
&cert->derIssuer, &cert->serialNumber, &cert->derSN, &cert->derSubject,
&cert->validity, &cert->derSubjKeyInfo);
&cert->validity, &cert->derSubjKeyInfo, &cert->extensions);
/* cert->subjectKeyID; x509v3 subject key identifier */
cert->subjectKeyID.data = NULL;
@@ -470,11 +651,11 @@ nsslowcert_DecodeDERCertificate(SECItem *derSignedCert, char *nickname)
if ( rv != SECSuccess ) {
goto loser;
}
#endif
/* set the email address */
cert->emailAddr = CERT_GetCertificateEmailAddress(cert);
cert->emailAddr = nsslowcert_GetCertificateEmailAddress(cert);
#endif
cert->referenceCount = 1;
@@ -527,7 +708,8 @@ nsslowcert_KeyFromDERCert(PRArenaPool *arena, SECItem *derCert, SECItem *key)
PORT_Memset(&certkey, 0, sizeof(NSSLOWCERTCertKey));
rv = nsslowcert_GetCertFields(derCert->data, derCert->len,
&certkey.derIssuer, &certkey.serialNumber, NULL, NULL, NULL, NULL);
&certkey.derIssuer, &certkey.serialNumber, NULL, NULL,
NULL, NULL, NULL);
if ( rv ) {
goto loser;
@@ -623,7 +805,7 @@ nsslowcert_ExtractPublicKey(NSSLOWCERTCertificate *cert)
/* Fill out the rest of the ecParams structure
* based on the encoded params
*/
if (EC_FillParams(arena, &pubk->u.ec.ecParams.DEREncoding,
if (LGEC_FillParams(arena, &pubk->u.ec.ecParams.DEREncoding,
&pubk->u.ec.ecParams) != SECSuccess)
break;

462
mozilla/security/nss/lib/softoken/legacydb/lowkey.c Normal file
View File

@@ -0,0 +1,462 @@
/* ***** BEGIN LICENSE BLOCK *****
* Version: MPL 1.1/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Mozilla Public License Version
* 1.1 (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
* http://www.mozilla.org/MPL/
*
* Software distributed under the License is distributed on an "AS IS" basis,
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
* for the specific language governing rights and limitations under the
* License.
*
* The Original Code is the Netscape security libraries.
*
* The Initial Developer of the Original Code is
* Netscape Communications Corporation.
* Portions created by the Initial Developer are Copyright (C) 1994-2000
* the Initial Developer. All Rights Reserved.
*
* Contributor(s):
* Dr Vipul Gupta <vipul.gupta@sun.com>, Sun Microsystems Laboratories
*
* Alternatively, the contents of this file may be used under the terms of
* either the GNU General Public License Version 2 or later (the "GPL"), or
* the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the MPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
#include "lowkeyi.h"
#include "secoid.h"
#include "secitem.h"
#include "secder.h"
#include "secasn1.h"
#include "secerr.h"
static const SEC_ASN1Template nsslowkey_AttributeTemplate[] = {
{ SEC_ASN1_SEQUENCE,
0, NULL, sizeof(NSSLOWKEYAttribute) },
{ SEC_ASN1_OBJECT_ID, offsetof(NSSLOWKEYAttribute, attrType) },
{ SEC_ASN1_SET_OF, offsetof(NSSLOWKEYAttribute, attrValue),
SEC_AnyTemplate },
{ 0 }
};
static const SEC_ASN1Template nsslowkey_SetOfAttributeTemplate[] = {
{ SEC_ASN1_SET_OF, 0, nsslowkey_AttributeTemplate },
};
/* ASN1 Templates for new decoder/encoder */
const SEC_ASN1Template nsslowkey_PrivateKeyInfoTemplate[] = {
{ SEC_ASN1_SEQUENCE,
0, NULL, sizeof(NSSLOWKEYPrivateKeyInfo) },
{ SEC_ASN1_INTEGER,
offsetof(NSSLOWKEYPrivateKeyInfo,version) },
{ SEC_ASN1_INLINE,
offsetof(NSSLOWKEYPrivateKeyInfo,algorithm),
SECOID_AlgorithmIDTemplate },
{ SEC_ASN1_OCTET_STRING,
offsetof(NSSLOWKEYPrivateKeyInfo,privateKey) },
{ SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 0,
offsetof(NSSLOWKEYPrivateKeyInfo, attributes),
nsslowkey_SetOfAttributeTemplate },
{ 0 }
};
const SEC_ASN1Template nsslowkey_PQGParamsTemplate[] = {
{ SEC_ASN1_SEQUENCE, 0, NULL, sizeof(PQGParams) },
{ SEC_ASN1_INTEGER, offsetof(PQGParams,prime) },
{ SEC_ASN1_INTEGER, offsetof(PQGParams,subPrime) },
{ SEC_ASN1_INTEGER, offsetof(PQGParams,base) },
{ 0, }
};
const SEC_ASN1Template nsslowkey_RSAPrivateKeyTemplate[] = {
{ SEC_ASN1_SEQUENCE, 0, NULL, sizeof(NSSLOWKEYPrivateKey) },
{ SEC_ASN1_INTEGER, offsetof(NSSLOWKEYPrivateKey,u.rsa.version) },
{ SEC_ASN1_INTEGER, offsetof(NSSLOWKEYPrivateKey,u.rsa.modulus) },
{ SEC_ASN1_INTEGER, offsetof(NSSLOWKEYPrivateKey,u.rsa.publicExponent) },
{ SEC_ASN1_INTEGER, offsetof(NSSLOWKEYPrivateKey,u.rsa.privateExponent) },
{ SEC_ASN1_INTEGER, offsetof(NSSLOWKEYPrivateKey,u.rsa.prime1) },
{ SEC_ASN1_INTEGER, offsetof(NSSLOWKEYPrivateKey,u.rsa.prime2) },
{ SEC_ASN1_INTEGER, offsetof(NSSLOWKEYPrivateKey,u.rsa.exponent1) },
{ SEC_ASN1_INTEGER, offsetof(NSSLOWKEYPrivateKey,u.rsa.exponent2) },
{ SEC_ASN1_INTEGER, offsetof(NSSLOWKEYPrivateKey,u.rsa.coefficient) },
{ 0 }
};
const SEC_ASN1Template nsslowkey_DSAPrivateKeyTemplate[] = {
{ SEC_ASN1_SEQUENCE, 0, NULL, sizeof(NSSLOWKEYPrivateKey) },
{ SEC_ASN1_INTEGER, offsetof(NSSLOWKEYPrivateKey,u.dsa.publicValue) },
{ SEC_ASN1_INTEGER, offsetof(NSSLOWKEYPrivateKey,u.dsa.privateValue) },
{ 0, }
};
const SEC_ASN1Template nsslowkey_DSAPrivateKeyExportTemplate[] = {
{ SEC_ASN1_INTEGER, offsetof(NSSLOWKEYPrivateKey,u.dsa.privateValue) },
};
const SEC_ASN1Template nsslowkey_DHPrivateKeyTemplate[] = {
{ SEC_ASN1_SEQUENCE, 0, NULL, sizeof(NSSLOWKEYPrivateKey) },
{ SEC_ASN1_INTEGER, offsetof(NSSLOWKEYPrivateKey,u.dh.publicValue) },
{ SEC_ASN1_INTEGER, offsetof(NSSLOWKEYPrivateKey,u.dh.privateValue) },
{ SEC_ASN1_INTEGER, offsetof(NSSLOWKEYPrivateKey,u.dh.base) },
{ SEC_ASN1_INTEGER, offsetof(NSSLOWKEYPrivateKey,u.dh.prime) },
{ 0, }
};
#ifdef NSS_ENABLE_ECC
/* XXX This is just a placeholder for later when we support
* generic curves and need full-blown support for parsing EC
* parameters. For now, we only support named curves in which
* EC params are simply encoded as an object ID and we don't
* use nsslowkey_ECParamsTemplate.
*/
const SEC_ASN1Template nsslowkey_ECParamsTemplate[] = {
{ SEC_ASN1_CHOICE, offsetof(ECParams,type), NULL, sizeof(ECParams) },
{ SEC_ASN1_OBJECT_ID, offsetof(ECParams,curveOID), NULL, ec_params_named },
{ 0, }
};
/* NOTE: The SECG specification allows the private key structure
* to contain curve parameters but recommends that they be stored
* in the PrivateKeyAlgorithmIdentifier field of the PrivateKeyInfo
* instead.
*/
const SEC_ASN1Template nsslowkey_ECPrivateKeyTemplate[] = {
{ SEC_ASN1_SEQUENCE, 0, NULL, sizeof(NSSLOWKEYPrivateKey) },
{ SEC_ASN1_INTEGER, offsetof(NSSLOWKEYPrivateKey,u.ec.version) },
{ SEC_ASN1_OCTET_STRING,
offsetof(NSSLOWKEYPrivateKey,u.ec.privateValue) },
/* XXX The following template works for now since we only
* support named curves for which the parameters are
* encoded as an object ID. When we support generic curves,
* we'll need to define nsslowkey_ECParamsTemplate
*/
#if 1
{ SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED |
SEC_ASN1_EXPLICIT | SEC_ASN1_CONTEXT_SPECIFIC | 0,
offsetof(NSSLOWKEYPrivateKey,u.ec.ecParams.curveOID),
SEC_ObjectIDTemplate },
#else
{ SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED |
SEC_ASN1_EXPLICIT | SEC_ASN1_CONTEXT_SPECIFIC | 0,
offsetof(NSSLOWKEYPrivateKey,u.ec.ecParams),
nsslowkey_ECParamsTemplate },
#endif
{ SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED |
SEC_ASN1_EXPLICIT | SEC_ASN1_CONTEXT_SPECIFIC | 1,
offsetof(NSSLOWKEYPrivateKey,u.ec.publicValue),
SEC_BitStringTemplate },
{ 0, }
};
/*
* smaller version of EC_FillParams. In this code, we only need
* oid and DER data.
*/
SECStatus
LGEC_FillParams(PRArenaPool *arena, const SECItem *encodedParams,
ECParams *params)
{
SECOidTag tag;
SECItem oid = { siBuffer, NULL, 0};
#if EC_DEBUG
int i;
printf("Encoded params in EC_DecodeParams: ");
for (i = 0; i < encodedParams->len; i++) {
printf("%02x:", encodedParams->data[i]);
}
printf("\n");
#endif
oid.len = encodedParams->len - 2;
oid.data = encodedParams->data + 2;
if ((encodedParams->data[0] != SEC_ASN1_OBJECT_ID) ||
((tag = SECOID_FindOIDTag(&oid)) == SEC_OID_UNKNOWN)) {
PORT_SetError(SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE);
return SECFailure;
}
params->arena = arena;
/* For named curves, fill out curveOID */
params->curveOID.len = oid.len;
params->curveOID.data = (unsigned char *) PORT_ArenaAlloc(arena, oid.len);
if (params->curveOID.data == NULL) {
return SECFailure;
}
memcpy(params->curveOID.data, oid.data, oid.len);
return SECSuccess;
}
/* Copy all of the fields from srcParams into dstParams
*/
SECStatus
LGEC_CopyParams(PRArenaPool *arena, ECParams *dstParams,
const ECParams *srcParams)
{
SECStatus rv = SECFailure;
dstParams->arena = arena;
rv = SECITEM_CopyItem(arena, &dstParams->DEREncoding,
&srcParams->DEREncoding);
if (rv != SECSuccess) {
goto loser;
}
rv =SECITEM_CopyItem(arena, &dstParams->curveOID,
&srcParams->curveOID);
if (rv != SECSuccess) {
goto loser;
}
return SECSuccess;
loser:
return SECFailure;
}
#endif /* NSS_ENABLE_ECC */
/*
* See bugzilla bug 125359
* Since NSS (via PKCS#11) wants to handle big integers as unsigned ints,
* all of the templates above that en/decode into integers must be converted
* from ASN.1's signed integer type. This is done by marking either the
* source or destination (encoding or decoding, respectively) type as
* siUnsignedInteger.
*/
void
prepare_low_rsa_priv_key_for_asn1(NSSLOWKEYPrivateKey *key)
{
key->u.rsa.modulus.type = siUnsignedInteger;
key->u.rsa.publicExponent.type = siUnsignedInteger;
key->u.rsa.privateExponent.type = siUnsignedInteger;
key->u.rsa.prime1.type = siUnsignedInteger;
key->u.rsa.prime2.type = siUnsignedInteger;
key->u.rsa.exponent1.type = siUnsignedInteger;
key->u.rsa.exponent2.type = siUnsignedInteger;
key->u.rsa.coefficient.type = siUnsignedInteger;
}
void
prepare_low_pqg_params_for_asn1(PQGParams *params)
{
params->prime.type = siUnsignedInteger;
params->subPrime.type = siUnsignedInteger;
params->base.type = siUnsignedInteger;
}
void
prepare_low_dsa_priv_key_for_asn1(NSSLOWKEYPrivateKey *key)
{
key->u.dsa.publicValue.type = siUnsignedInteger;
key->u.dsa.privateValue.type = siUnsignedInteger;
key->u.dsa.params.prime.type = siUnsignedInteger;
key->u.dsa.params.subPrime.type = siUnsignedInteger;
key->u.dsa.params.base.type = siUnsignedInteger;
}
void
prepare_low_dsa_priv_key_export_for_asn1(NSSLOWKEYPrivateKey *key)
{
key->u.dsa.privateValue.type = siUnsignedInteger;
}
void
prepare_low_dh_priv_key_for_asn1(NSSLOWKEYPrivateKey *key)
{
key->u.dh.prime.type = siUnsignedInteger;
key->u.dh.base.type = siUnsignedInteger;
key->u.dh.publicValue.type = siUnsignedInteger;
key->u.dh.privateValue.type = siUnsignedInteger;
}
#ifdef NSS_ENABLE_ECC
void
prepare_low_ecparams_for_asn1(ECParams *params)
{
params->DEREncoding.type = siUnsignedInteger;
params->curveOID.type = siUnsignedInteger;
}
void
prepare_low_ec_priv_key_for_asn1(NSSLOWKEYPrivateKey *key)
{
key->u.ec.version.type = siUnsignedInteger;
key->u.ec.ecParams.DEREncoding.type = siUnsignedInteger;
key->u.ec.ecParams.curveOID.type = siUnsignedInteger;
key->u.ec.privateValue.type = siUnsignedInteger;
key->u.ec.publicValue.type = siUnsignedInteger;
}
#endif /* NSS_ENABLE_ECC */
void
nsslowkey_DestroyPrivateKey(NSSLOWKEYPrivateKey *privk)
{
if (privk && privk->arena) {
PORT_FreeArena(privk->arena, PR_TRUE);
}
}
void
nsslowkey_DestroyPublicKey(NSSLOWKEYPublicKey *pubk)
{
if (pubk && pubk->arena) {
PORT_FreeArena(pubk->arena, PR_FALSE);
}
}
unsigned
nsslowkey_PublicModulusLen(NSSLOWKEYPublicKey *pubk)
{
unsigned char b0;
/* interpret modulus length as key strength... in
* fortezza that's the public key length */
switch (pubk->keyType) {
case NSSLOWKEYRSAKey:
b0 = pubk->u.rsa.modulus.data[0];
return b0 ? pubk->u.rsa.modulus.len : pubk->u.rsa.modulus.len - 1;
default:
break;
}
return 0;
}
unsigned
nsslowkey_PrivateModulusLen(NSSLOWKEYPrivateKey *privk)
{
unsigned char b0;
switch (privk->keyType) {
case NSSLOWKEYRSAKey:
b0 = privk->u.rsa.modulus.data[0];
return b0 ? privk->u.rsa.modulus.len : privk->u.rsa.modulus.len - 1;
default:
break;
}
return 0;
}
NSSLOWKEYPublicKey *
nsslowkey_ConvertToPublicKey(NSSLOWKEYPrivateKey *privk)
{
NSSLOWKEYPublicKey *pubk;
PLArenaPool *arena;
arena = PORT_NewArena (DER_DEFAULT_CHUNKSIZE);
if (arena == NULL) {
PORT_SetError (SEC_ERROR_NO_MEMORY);
return NULL;
}
switch(privk->keyType) {
case NSSLOWKEYRSAKey:
case NSSLOWKEYNullKey:
pubk = (NSSLOWKEYPublicKey *)PORT_ArenaZAlloc(arena,
sizeof (NSSLOWKEYPublicKey));
if (pubk != NULL) {
SECStatus rv;
pubk->arena = arena;
pubk->keyType = privk->keyType;
if (privk->keyType == NSSLOWKEYNullKey) return pubk;
rv = SECITEM_CopyItem(arena, &pubk->u.rsa.modulus,
&privk->u.rsa.modulus);
if (rv == SECSuccess) {
rv = SECITEM_CopyItem (arena, &pubk->u.rsa.publicExponent,
&privk->u.rsa.publicExponent);
if (rv == SECSuccess)
return pubk;
}
} else {
PORT_SetError (SEC_ERROR_NO_MEMORY);
}
break;
case NSSLOWKEYDSAKey:
pubk = (NSSLOWKEYPublicKey *)PORT_ArenaZAlloc(arena,
sizeof(NSSLOWKEYPublicKey));
if (pubk != NULL) {
SECStatus rv;
pubk->arena = arena;
pubk->keyType = privk->keyType;
rv = SECITEM_CopyItem(arena, &pubk->u.dsa.publicValue,
&privk->u.dsa.publicValue);
if (rv != SECSuccess) break;
rv = SECITEM_CopyItem(arena, &pubk->u.dsa.params.prime,
&privk->u.dsa.params.prime);
if (rv != SECSuccess) break;
rv = SECITEM_CopyItem(arena, &pubk->u.dsa.params.subPrime,
&privk->u.dsa.params.subPrime);
if (rv != SECSuccess) break;
rv = SECITEM_CopyItem(arena, &pubk->u.dsa.params.base,
&privk->u.dsa.params.base);
if (rv == SECSuccess) return pubk;
}
break;
case NSSLOWKEYDHKey:
pubk = (NSSLOWKEYPublicKey *)PORT_ArenaZAlloc(arena,
sizeof(NSSLOWKEYPublicKey));
if (pubk != NULL) {
SECStatus rv;
pubk->arena = arena;
pubk->keyType = privk->keyType;
rv = SECITEM_CopyItem(arena, &pubk->u.dh.publicValue,
&privk->u.dh.publicValue);
if (rv != SECSuccess) break;
rv = SECITEM_CopyItem(arena, &pubk->u.dh.prime,
&privk->u.dh.prime);
if (rv != SECSuccess) break;
rv = SECITEM_CopyItem(arena, &pubk->u.dh.base,
&privk->u.dh.base);
if (rv == SECSuccess) return pubk;
}
break;
#ifdef NSS_ENABLE_ECC
case NSSLOWKEYECKey:
pubk = (NSSLOWKEYPublicKey *)PORT_ArenaZAlloc(arena,
sizeof(NSSLOWKEYPublicKey));
if (pubk != NULL) {
SECStatus rv;
pubk->arena = arena;
pubk->keyType = privk->keyType;
rv = SECITEM_CopyItem(arena, &pubk->u.ec.publicValue,
&privk->u.ec.publicValue);
if (rv != SECSuccess) break;
pubk->u.ec.ecParams.arena = arena;
/* Copy the rest of the params */
rv = LGEC_CopyParams(arena, &(pubk->u.ec.ecParams),
&(privk->u.ec.ecParams));
if (rv == SECSuccess) return pubk;
}
break;
#endif /* NSS_ENABLE_ECC */
/* No Fortezza in Low Key implementations (Fortezza keys aren't
* stored in our data base */
default:
break;
}
PORT_FreeArena (arena, PR_FALSE);
return NULL;
}

198
mozilla/security/nss/lib/softoken/legacydb/lowkeyi.h Normal file
View File

@@ -0,0 +1,198 @@
/* ***** BEGIN LICENSE BLOCK *****
* Version: MPL 1.1/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Mozilla Public License Version
* 1.1 (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
* http://www.mozilla.org/MPL/
*
* Software distributed under the License is distributed on an "AS IS" basis,
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
* for the specific language governing rights and limitations under the
* License.
*
* The Original Code is the Netscape security libraries.
*
* The Initial Developer of the Original Code is
* Netscape Communications Corporation.
* Portions created by the Initial Developer are Copyright (C) 1994-2000
* the Initial Developer. All Rights Reserved.
*
* Contributor(s):
* Dr Vipul Gupta <vipul.gupta@sun.com>, Sun Microsystems Laboratories
*
* Alternatively, the contents of this file may be used under the terms of
* either the GNU General Public License Version 2 or later (the "GPL"), or
* the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the MPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/* $Id: lowkeyi.h,v 1.2 2007-06-13 00:24:57 rrelyea%redhat.com Exp $ */
#ifndef _LOWKEYI_H_
#define _LOWKEYI_H_
#include "prtypes.h"
#include "seccomon.h"
#include "secoidt.h"
#include "pcertt.h"
#include "lowkeyti.h"
#include "sdb.h"
SEC_BEGIN_PROTOS
/*
* See bugzilla bug 125359
* Since NSS (via PKCS#11) wants to handle big integers as unsigned ints,
* all of the templates above that en/decode into integers must be converted
* from ASN.1's signed integer type. This is done by marking either the
* source or destination (encoding or decoding, respectively) type as
* siUnsignedInteger.
*/
extern void prepare_low_rsa_priv_key_for_asn1(NSSLOWKEYPrivateKey *key);
extern void prepare_low_pqg_params_for_asn1(PQGParams *params);
extern void prepare_low_dsa_priv_key_for_asn1(NSSLOWKEYPrivateKey *key);
extern void prepare_low_dsa_priv_key_export_for_asn1(NSSLOWKEYPrivateKey *key);
extern void prepare_low_dh_priv_key_for_asn1(NSSLOWKEYPrivateKey *key);
#ifdef NSS_ENABLE_ECC
extern void prepare_low_ec_priv_key_for_asn1(NSSLOWKEYPrivateKey *key);
extern void prepare_low_ecparams_for_asn1(ECParams *params);
#endif /* NSS_ENABLE_ECC */
typedef char * (* NSSLOWKEYDBNameFunc)(void *arg, int dbVersion);
/*
** Open a key database.
*/
extern NSSLOWKEYDBHandle *nsslowkey_OpenKeyDB(PRBool readOnly,
const char *domain,
const char *prefix,
NSSLOWKEYDBNameFunc namecb,
void *cbarg);
/*
** Close the specified key database.
*/
extern void nsslowkey_CloseKeyDB(NSSLOWKEYDBHandle *handle);
/*
* Get the version number of the database
*/
extern int nsslowkey_GetKeyDBVersion(NSSLOWKEYDBHandle *handle);
/*
** Delete a key from the database
*/
extern SECStatus nsslowkey_DeleteKey(NSSLOWKEYDBHandle *handle,
const SECItem *pubkey);
/*
** Store a key in the database, indexed by its public key modulus.
** "pk" is the private key to store
** "f" is a the callback function for getting the password
** "arg" is the argument for the callback
*/
extern SECStatus nsslowkey_StoreKeyByPublicKey(NSSLOWKEYDBHandle *handle,
NSSLOWKEYPrivateKey *pk,
SECItem *pubKeyData,
char *nickname,
SDB *sdb);
/* does the key for this cert exist in the database filed by modulus */
extern PRBool nsslowkey_KeyForCertExists(NSSLOWKEYDBHandle *handle,
NSSLOWCERTCertificate *cert);
/* does a key with this ID already exist? */
extern PRBool nsslowkey_KeyForIDExists(NSSLOWKEYDBHandle *handle, SECItem *id);
/*
** Destroy a private key object.
** "key" the object
** "freeit" if PR_TRUE then free the object as well as its sub-objects
*/
extern void nsslowkey_DestroyPrivateKey(NSSLOWKEYPrivateKey *key);
/*
** Destroy a public key object.
** "key" the object
** "freeit" if PR_TRUE then free the object as well as its sub-objects
*/
extern void nsslowkey_DestroyPublicKey(NSSLOWKEYPublicKey *key);
/*
** Return the modulus length of "pubKey".
*/
extern unsigned int nsslowkey_PublicModulusLen(NSSLOWKEYPublicKey *pubKey);
/*
** Return the modulus length of "privKey".
*/
extern unsigned int nsslowkey_PrivateModulusLen(NSSLOWKEYPrivateKey *privKey);
/*
** Convert a low private key "privateKey" into a public low key
*/
extern NSSLOWKEYPublicKey
*nsslowkey_ConvertToPublicKey(NSSLOWKEYPrivateKey *privateKey);
SECStatus
nsslowkey_UpdateNickname(NSSLOWKEYDBHandle *handle,
NSSLOWKEYPrivateKey *privkey,
SECItem *pubKeyData,
char *nickname,
SDB *sdb);
/* Store key by modulus and specify an encryption algorithm to use.
* handle is the pointer to the key database,
* privkey is the private key to be stored,
* f and arg are the function and arguments to the callback
* to get a password,
* algorithm is the algorithm which the privKey is to be stored.
* A return of anything but SECSuccess indicates failure.
*/
extern SECStatus
nsslowkey_StoreKeyByPublicKeyAlg(NSSLOWKEYDBHandle *handle,
NSSLOWKEYPrivateKey *privkey,
SECItem *pubKeyData,
char *nickname,
SDB *sdb,
PRBool update);
/* Find key by modulus. This function is the inverse of store key
* by modulus. An attempt to locate the key with "modulus" is
* performed. If the key is found, the private key is returned,
* else NULL is returned.
* modulus is the modulus to locate
*/
extern NSSLOWKEYPrivateKey *
nsslowkey_FindKeyByPublicKey(NSSLOWKEYDBHandle *handle, SECItem *modulus,
SDB *sdb);
extern char *
nsslowkey_FindKeyNicknameByPublicKey(NSSLOWKEYDBHandle *handle,
SECItem *modulus, SDB *sdb);
#ifdef NSS_ENABLE_ECC
/*
* smaller version of EC_FillParams. In this code, we only need
* oid and DER data.
*/
SECStatus LGEC_FillParams(PRArenaPool *arena, const SECItem *encodedParams,
ECParams *params);
/* Copy all of the fields from srcParams into dstParams */
SECStatus LGEC_CopyParams(PRArenaPool *arena, ECParams *dstParams,
const ECParams *srcParams);
#endif
SEC_END_PROTOS
#endif /* _LOWKEYI_H_ */

161
mozilla/security/nss/lib/softoken/legacydb/lowkeyti.h Normal file
View File

@@ -0,0 +1,161 @@
/* ***** BEGIN LICENSE BLOCK *****
* Version: MPL 1.1/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Mozilla Public License Version
* 1.1 (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
* http://www.mozilla.org/MPL/
*
* Software distributed under the License is distributed on an "AS IS" basis,
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
* for the specific language governing rights and limitations under the
* License.
*
* The Original Code is the Netscape security libraries.
*
* The Initial Developer of the Original Code is
* Netscape Communications Corporation.
* Portions created by the Initial Developer are Copyright (C) 1994-2000
* the Initial Developer. All Rights Reserved.
*
* Contributor(s):
* Dr Vipul Gupta <vipul.gupta@sun.com>, Sun Microsystems Laboratories
*
* Alternatively, the contents of this file may be used under the terms of
* either the GNU General Public License Version 2 or later (the "GPL"), or
* the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the MPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
#ifndef _LOWKEYTI_H_
#define _LOWKEYTI_H_ 1
#include "blapit.h"
#include "prtypes.h"
#include "plarena.h"
#include "secitem.h"
#include "secasn1t.h"
#include "secoidt.h"
/*
* a key in/for the data base
*/
struct NSSLOWKEYDBKeyStr {
PLArenaPool *arena;
int version;
char *nickname;
SECItem salt;
SECItem derPK;
};
typedef struct NSSLOWKEYDBKeyStr NSSLOWKEYDBKey;
typedef struct NSSLOWKEYDBHandleStr NSSLOWKEYDBHandle;
#ifdef NSS_USE_KEY4_DB
#define NSSLOWKEY_DB_FILE_VERSION 4
#else
#define NSSLOWKEY_DB_FILE_VERSION 3
#endif
#define NSSLOWKEY_VERSION 0 /* what we *create* */
/*
** Typedef for callback to get a password "key".
*/
extern const SEC_ASN1Template nsslowkey_PQGParamsTemplate[];
extern const SEC_ASN1Template nsslowkey_RSAPrivateKeyTemplate[];
extern const SEC_ASN1Template nsslowkey_DSAPrivateKeyTemplate[];
extern const SEC_ASN1Template nsslowkey_DSAPrivateKeyExportTemplate[];
extern const SEC_ASN1Template nsslowkey_DHPrivateKeyTemplate[];
extern const SEC_ASN1Template nsslowkey_DHPrivateKeyExportTemplate[];
#ifdef NSS_ENABLE_ECC
#define NSSLOWKEY_EC_PRIVATE_KEY_VERSION 1 /* as per SECG 1 C.4 */
extern const SEC_ASN1Template nsslowkey_ECParamsTemplate[];
extern const SEC_ASN1Template nsslowkey_ECPrivateKeyTemplate[];
#endif /* NSS_ENABLE_ECC */
extern const SEC_ASN1Template nsslowkey_PrivateKeyInfoTemplate[];
extern const SEC_ASN1Template nsslowkey_EncryptedPrivateKeyInfoTemplate[];
/*
* PKCS #8 attributes
*/
struct NSSLOWKEYAttributeStr {
SECItem attrType;
SECItem *attrValue;
};
typedef struct NSSLOWKEYAttributeStr NSSLOWKEYAttribute;
/*
** A PKCS#8 private key info object
*/
struct NSSLOWKEYPrivateKeyInfoStr {
PLArenaPool *arena;
SECItem version;
SECAlgorithmID algorithm;
SECItem privateKey;
NSSLOWKEYAttribute **attributes;
};
typedef struct NSSLOWKEYPrivateKeyInfoStr NSSLOWKEYPrivateKeyInfo;
#define NSSLOWKEY_PRIVATE_KEY_INFO_VERSION 0 /* what we *create* */
/*
** A PKCS#8 private key info object
*/
struct NSSLOWKEYEncryptedPrivateKeyInfoStr {
PLArenaPool *arena;
SECAlgorithmID algorithm;
SECItem encryptedData;
};
typedef struct NSSLOWKEYEncryptedPrivateKeyInfoStr NSSLOWKEYEncryptedPrivateKeyInfo;
typedef enum {
NSSLOWKEYNullKey = 0,
NSSLOWKEYRSAKey = 1,
NSSLOWKEYDSAKey = 2,
NSSLOWKEYDHKey = 4,
NSSLOWKEYECKey = 5
} NSSLOWKEYType;
/*
** An RSA public key object.
*/
struct NSSLOWKEYPublicKeyStr {
PLArenaPool *arena;
NSSLOWKEYType keyType ;
union {
RSAPublicKey rsa;
DSAPublicKey dsa;
DHPublicKey dh;
ECPublicKey ec;
} u;
};
typedef struct NSSLOWKEYPublicKeyStr NSSLOWKEYPublicKey;
/*
** Low Level private key object
** This is only used by the raw Crypto engines (crypto), keydb (keydb),
** and PKCS #11. Everyone else uses the high level key structure.
*/
struct NSSLOWKEYPrivateKeyStr {
PLArenaPool *arena;
NSSLOWKEYType keyType;
union {
RSAPrivateKey rsa;
DSAPrivateKey dsa;
DHPrivateKey dh;
ECPrivateKey ec;
} u;
};
typedef struct NSSLOWKEYPrivateKeyStr NSSLOWKEYPrivateKey;
#endif /* _LOWKEYTI_H_ */

68
mozilla/security/nss/lib/softoken/legacydb/manifest.mn Normal file
View File

@@ -0,0 +1,68 @@
#
# ***** BEGIN LICENSE BLOCK *****
# Version: MPL 1.1/GPL 2.0/LGPL 2.1
#
# The contents of this file are subject to the Mozilla Public License Version
# 1.1 (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at
# http://www.mozilla.org/MPL/
#
# Software distributed under the License is distributed on an "AS IS" basis,
# WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
# for the specific language governing rights and limitations under the
# License.
#
# The Original Code is the Netscape security libraries.
#
# The Initial Developer of the Original Code is
# Netscape Communications Corporation.
# Portions created by the Initial Developer are Copyright (C) 1994-2000
# the Initial Developer. All Rights Reserved.
#
# Contributor(s):
#
# Alternatively, the contents of this file may be used under the terms of
# either the GNU General Public License Version 2 or later (the "GPL"), or
# the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
# in which case the provisions of the GPL or the LGPL are applicable instead
# of those above. If you wish to allow use of your version of this file only
# under the terms of either the GPL or the LGPL, and not to allow others to
# use your version of this file under the terms of the MPL, indicate your
# decision by deleting the provisions above and replace them with the notice
# and other provisions required by the GPL or the LGPL. If you do not delete
# the provisions above, a recipient may use your version of this file under
# the terms of any one of the MPL, the GPL or the LGPL.
#
# ***** END LICENSE BLOCK *****
CORE_DEPTH = ../../../..
MODULE = nss
REQUIRES = dbm
LIBRARY_NAME = legacydb
LIBRARY_VERSION = 3
MAPFILE = $(OBJDIR)/legacydb.def
DEFINES += -DSHLIB_SUFFIX=\"$(DLL_SUFFIX)\" -DSHLIB_PREFIX=\"$(DLL_PREFIX)\" -DSOFTOKEN_LIB_NAME=\"$(notdir $(SHARED_LIBRARY))\"
CSRCS = \
dbmshim.c \
keydb.c \
lgattr.c \
lgcreate.c \
lgdestroy.c \
lgfind.c \
lginit.c \
lgutil.c \
lowcert.c \
lowkey.c \
pcertdb.c \
pk11db.c \
$(NULL)
ifdef NSS_ENABLE_ECC
DEFINES += -DNSS_ENABLE_ECC
endif

8
mozilla/security/nss/lib/softoken/pcert.h → mozilla/security/nss/lib/softoken/legacydb/pcert.h
View File

@@ -85,7 +85,7 @@ nsslowcert_FindCrlByKey(NSSLOWCERTCertDBHandle *handle,
SECItem *crlKey, PRBool isKRL);
SECStatus
nsslowcert_DeletePermCRL(NSSLOWCERTCertDBHandle *handle,SECItem *derName,
nsslowcert_DeletePermCRL(NSSLOWCERTCertDBHandle *handle,const SECItem *derName,
PRBool isKRL);
SECStatus
nsslowcert_AddCrl(NSSLOWCERTCertDBHandle *handle, SECItem *derCrl ,
@@ -110,7 +110,7 @@ void nsslowcert_DestroyTrust(NSSLOWCERTTrust *Trust);
* traversal.
*/
NSSLOWCERTCertificate *
nsslowcert_FindCertByKey(NSSLOWCERTCertDBHandle *handle, SECItem *certKey);
nsslowcert_FindCertByKey(NSSLOWCERTCertDBHandle *handle, const SECItem *certKey);
/*
* Lookup trust for a certificate in the databases without locking
@@ -120,7 +120,7 @@ nsslowcert_FindCertByKey(NSSLOWCERTCertDBHandle *handle, SECItem *certKey);
* traversal.
*/
NSSLOWCERTTrust *
nsslowcert_FindTrustByKey(NSSLOWCERTCertDBHandle *handle, SECItem *certKey);
nsslowcert_FindTrustByKey(NSSLOWCERTCertDBHandle *handle, const SECItem *certKey);
/*
** Generate a certificate key from the issuer and serialnumber, then look it
@@ -253,7 +253,7 @@ NSSLOWCERTCertificate *
nsslowcert_CreateCert(void);
certDBEntry *
nsslowcert_DecodeAnyDBEntry(SECItem *dbData, SECItem *dbKey,
nsslowcert_DecodeAnyDBEntry(SECItem *dbData, const SECItem *dbKey,
certDBEntryType entryType, void *pdata);
SEC_END_PROTOS

186
mozilla/security/nss/lib/softoken/pcertdb.c → mozilla/security/nss/lib/softoken/legacydb/pcertdb.c
View File

@@ -37,10 +37,8 @@
/*
* Permanent Certificate database handling code
*
* $Id: pcertdb.c,v 1.64 2007-01-04 20:25:41 alexei.volkov.bugs%sun.com Exp $
* $Id: pcertdb.c,v 1.2 2007-06-13 00:24:57 rrelyea%redhat.com Exp $
*/
#include "prtime.h"
#include "lowkeyti.h"
#include "pcert.h"
#include "mcom_db.h"
@@ -48,19 +46,9 @@
#include "secitem.h"
#include "secder.h"
/* Call to SFTK_FreeSlot below */
#include "secasn1.h"
#include "secerr.h"
#include "nssilock.h"
#include "prmon.h"
#include "nsslocks.h"
#include "base64.h"
#include "sechash.h"
#include "plhash.h"
#include "cdbhdl.h"
#include "pkcs11i.h"
#include "secerr.h"
#include "lgdb.h"
/* forward declaration */
NSSLOWCERTCertificate *
@@ -198,7 +186,7 @@ nsslowcert_UnlockCertRefCount(NSSLOWCERTCertificate *cert)
* arg here so that it will be easy to make it per-cert in the future if
* that turns out to be necessary.
*/
void
static void
nsslowcert_LockCertTrust(NSSLOWCERTCertificate *cert)
{
PORT_Assert(certTrustLock != NULL);
@@ -210,7 +198,7 @@ nsslowcert_LockCertTrust(NSSLOWCERTCertificate *cert)
/*
* Free the cert trust lock
*/
void
static void
nsslowcert_UnlockCertTrust(NSSLOWCERTCertificate *cert)
{
PRStatus prstat;
@@ -677,7 +665,7 @@ loser:
* encode a database key for a cert record
*/
static SECStatus
EncodeDBCertKey(SECItem *certKey, PRArenaPool *arena, SECItem *dbkey)
EncodeDBCertKey(const SECItem *certKey, PRArenaPool *arena, SECItem *dbkey)
{
unsigned int len = certKey->len + SEC_DB_KEY_HEADER_LEN;
if (arena) {
@@ -701,7 +689,7 @@ loser:
}
static SECStatus
EncodeDBGenericKey(SECItem *certKey, PRArenaPool *arena, SECItem *dbkey,
EncodeDBGenericKey(const SECItem *certKey, PRArenaPool *arena, SECItem *dbkey,
certDBEntryType entryType)
{
/*
@@ -1090,7 +1078,7 @@ DestroyCertEntryFreeList(void)
* Read a certificate entry
*/
static certDBEntryCert *
ReadDBCertEntry(NSSLOWCERTCertDBHandle *handle, SECItem *certKey)
ReadDBCertEntry(NSSLOWCERTCertDBHandle *handle, const SECItem *certKey)
{
certDBEntryCert *entry;
SECItem dbkey;
@@ -1239,6 +1227,68 @@ loser:
return(SECFailure);
}
/*
* Create a new certDBEntryRevocation from existing data
*/
static certDBEntryRevocation *
NewDBCrlEntry(SECItem *derCrl, char * url, certDBEntryType crlType, int flags)
{
certDBEntryRevocation *entry;
PRArenaPool *arena = NULL;
int nnlen;
arena = PORT_NewArena( DER_DEFAULT_CHUNKSIZE );
if ( !arena ) {
goto loser;
}
entry = PORT_ArenaZNew(arena, certDBEntryRevocation);
if ( entry == NULL ) {
goto loser;
}
/* fill in the dbRevolcation */
entry->common.arena = arena;
entry->common.type = crlType;
entry->common.version = CERT_DB_FILE_VERSION;
entry->common.flags = flags;
entry->derCrl.data = (unsigned char *)PORT_ArenaAlloc(arena, derCrl->len);
if ( !entry->derCrl.data ) {
goto loser;
}
if (url) {
nnlen = PORT_Strlen(url) + 1;
entry->url = (char *)PORT_ArenaAlloc(arena, nnlen);
if ( !entry->url ) {
goto loser;
}
PORT_Memcpy(entry->url, url, nnlen);
} else {
entry->url = NULL;
}
entry->derCrl.len = derCrl->len;
PORT_Memcpy(entry->derCrl.data, derCrl->data, derCrl->len);
return(entry);
loser:
/* allocation error, free arena and return */
if ( arena ) {
PORT_FreeArena(arena, PR_FALSE);
}
PORT_SetError(SEC_ERROR_NO_MEMORY);
return(0);
}
static SECStatus
WriteDBCrlEntry(NSSLOWCERTCertDBHandle *handle, certDBEntryRevocation *entry,
SECItem *crlKey )
@@ -1282,7 +1332,7 @@ loser:
* delete a crl entry
*/
static SECStatus
DeleteDBCrlEntry(NSSLOWCERTCertDBHandle *handle, SECItem *crlKey,
DeleteDBCrlEntry(NSSLOWCERTCertDBHandle *handle, const SECItem *crlKey,
certDBEntryType crlType)
{
SECItem dbkey;
@@ -1696,7 +1746,7 @@ loser:
}
SECStatus
static SECStatus
EncodeDBSMimeEntry(certDBEntrySMime *entry, PRArenaPool *arena,
SECItem *dbitem)
{
@@ -2218,7 +2268,7 @@ loser:
static SECStatus
DecodeDBSubjectEntry(certDBEntrySubject *entry, SECItem *dbentry,
SECItem *derSubject)
const SECItem *derSubject)
{
unsigned int ncerts;
PRArenaPool *arena;
@@ -3311,10 +3361,7 @@ AddCertToPermDB(NSSLOWCERTCertDBHandle *handle, NSSLOWCERTCertificate *cert,
state = 2;
/* "Change" handles if necessary */
if (cert->dbhandle) {
sftk_freeCertDB(cert->dbhandle);
}
cert->dbhandle = nsslowcert_reference(handle);
cert->dbhandle = handle;
/* add to or create new subject entry */
if ( subjectEntry ) {
@@ -3977,12 +4024,6 @@ openNewCertDB(const char *appName, const char *prefix, const char *certdbname,
return status == RDB_RETRY ? SECWouldBlock : SECFailure;
}
rv = db_BeginTransaction(handle->permCertDB);
if (rv != SECSuccess) {
db_InitComplete(handle->permCertDB);
return SECFailure;
}
/* Verify version number; */
versionEntry = NewDBVersionEntry(0);
if ( versionEntry == NULL ) {
@@ -4020,7 +4061,6 @@ openNewCertDB(const char *appName, const char *prefix, const char *certdbname,
loser:
db_FinishTransaction(handle->permCertDB,rv != SECSuccess);
db_InitComplete(handle->permCertDB);
return rv;
}
@@ -4159,10 +4199,6 @@ nsslowcert_DeletePermCertificate(NSSLOWCERTCertificate *cert)
nsslowcert_LockDB(cert->dbhandle);
rv = db_BeginTransaction(cert->dbhandle->permCertDB);
if ( rv != SECSuccess ) {
goto loser;
}
/* delete the records from the permanent database */
rv = DeletePermCert(cert);
@@ -4170,9 +4206,6 @@ nsslowcert_DeletePermCertificate(NSSLOWCERTCertificate *cert)
DestroyDBEntry((certDBEntry *)cert->dbEntry);
cert->dbEntry = NULL;
cert->trust = NULL;
db_FinishTransaction(cert->dbhandle->permCertDB,rv != SECSuccess);
loser:
nsslowcert_UnlockDB(cert->dbhandle);
return(rv);
@@ -4243,7 +4276,7 @@ DecodeACert(NSSLOWCERTCertDBHandle *handle, certDBEntryCert *entry)
goto loser;
}
cert->dbhandle = nsslowcert_reference(handle);
cert->dbhandle = handle;
cert->dbEntry = entry;
cert->trust = &entry->trust;
@@ -4291,13 +4324,13 @@ DestroyTrustFreeList(void)
static NSSLOWCERTTrust *
DecodeTrustEntry(NSSLOWCERTCertDBHandle *handle, certDBEntryCert *entry,
SECItem *dbKey)
const SECItem *dbKey)
{
NSSLOWCERTTrust *trust = CreateTrust();
if (trust == NULL) {
return trust;
}
trust->dbhandle = nsslowcert_reference(handle);
trust->dbhandle = handle;
trust->dbEntry = entry;
trust->dbKey.data = pkcs11_copyStaticData(dbKey->data,dbKey->len,
trust->dbKeySpace, sizeof(trust->dbKeySpace));
@@ -4544,18 +4577,11 @@ nsslowcert_AddPermCert(NSSLOWCERTCertDBHandle *dbhandle,
NSSLOWCERTCertificate *cert, char *nickname, NSSLOWCERTCertTrust *trust)
{
SECStatus ret;
SECStatus rv;
nsslowcert_LockDB(dbhandle);
rv = db_BeginTransaction(dbhandle->permCertDB);
if (rv != SECSuccess) {
nsslowcert_UnlockDB(dbhandle);
return SECFailure;
}
ret = nsslowcert_UpdatePermCert(dbhandle, cert, nickname, trust);
db_FinishTransaction(dbhandle->permCertDB, ret != SECSuccess);
nsslowcert_UnlockDB(dbhandle);
return(ret);
}
@@ -4609,7 +4635,7 @@ nsslowcert_setDBVerify(NSSLOWCERTCertDBHandle *handle, PRBool value)
* Lookup a certificate in the databases.
*/
static NSSLOWCERTCertificate *
FindCertByKey(NSSLOWCERTCertDBHandle *handle, SECItem *certKey, PRBool lockdb)
FindCertByKey(NSSLOWCERTCertDBHandle *handle, const SECItem *certKey, PRBool lockdb)
{
NSSLOWCERTCertificate *cert = NULL;
certDBEntryCert *entry;
@@ -4648,7 +4674,7 @@ loser:
* Lookup a certificate in the databases.
*/
static NSSLOWCERTTrust *
FindTrustByKey(NSSLOWCERTCertDBHandle *handle, SECItem *certKey, PRBool lockdb)
FindTrustByKey(NSSLOWCERTCertDBHandle *handle, const SECItem *certKey, PRBool lockdb)
{
NSSLOWCERTTrust *trust = NULL;
certDBEntryCert *entry;
@@ -4691,7 +4717,7 @@ loser:
* Lookup a certificate in the databases without locking
*/
NSSLOWCERTCertificate *
nsslowcert_FindCertByKey(NSSLOWCERTCertDBHandle *handle, SECItem *certKey)
nsslowcert_FindCertByKey(NSSLOWCERTCertDBHandle *handle, const SECItem *certKey)
{
return(FindCertByKey(handle, certKey, PR_FALSE));
}
@@ -4700,7 +4726,7 @@ nsslowcert_FindCertByKey(NSSLOWCERTCertDBHandle *handle, SECItem *certKey)
* Lookup a trust object in the databases without locking
*/
NSSLOWCERTTrust *
nsslowcert_FindTrustByKey(NSSLOWCERTCertDBHandle *handle, SECItem *certKey)
nsslowcert_FindTrustByKey(NSSLOWCERTCertDBHandle *handle, const SECItem *certKey)
{
return(FindTrustByKey(handle, certKey, PR_FALSE));
}
@@ -4931,9 +4957,6 @@ DestroyCertificate(NSSLOWCERTCertificate *cert, PRBool lockdb)
*/
if ( lockdb && handle ) {
nsslowcert_LockDB(handle);
/* keep a reference until we unlock, so handle won't disappear
* before we are through with it */
nsslowcert_reference(handle);
}
nsslowcert_LockCertRefCount(cert);
@@ -4949,6 +4972,7 @@ DestroyCertificate(NSSLOWCERTCertificate *cert, PRBool lockdb)
}
pkcs11_freeNickname(cert->nickname,cert->nicknameSpace);
pkcs11_freeNickname(cert->emailAddr,cert->emailAddrSpace);
pkcs11_freeStaticData(cert->certKey.data,cert->certKeySpace);
cert->certKey.data = NULL;
cert->nickname = NULL;
@@ -4967,15 +4991,10 @@ DestroyCertificate(NSSLOWCERTCertificate *cert, PRBool lockdb)
certListHead = cert;
}
nsslowcert_UnlockFreeList();
if (handle) {
sftk_freeCertDB(handle);
}
cert = NULL;
}
if ( lockdb && handle ) {
nsslowcert_UnlockDB(handle);
sftk_freeCertDB(handle);
}
}
@@ -5024,9 +5043,6 @@ nsslowcert_DestroyTrust(NSSLOWCERTTrust *trust)
if ( entry ) {
DestroyDBEntry((certDBEntry *)entry);
}
if (trust->dbhandle) {
sftk_freeCertDB(trust->dbhandle);
}
pkcs11_freeStaticData(trust->dbKey.data,trust->dbKeySpace);
PORT_Memset(trust, 0, sizeof(*trust));
@@ -5109,23 +5125,22 @@ nsslowcert_UpdateCrl(NSSLOWCERTCertDBHandle *handle, SECItem *derCrl,
SECItem *crlKey, char *url, PRBool isKRL)
{
SECStatus rv = SECFailure;
certDBEntryRevocation entry;
certDBEntryRevocation *entry = NULL;
certDBEntryType crlType = isKRL ? certDBEntryTypeKeyRevocation
: certDBEntryTypeRevocation;
DeleteDBCrlEntry(handle, crlKey, crlType);
/* Write the new entry into the data base */
entry.common.arena = NULL;
entry.common.type = crlType;
entry.common.version = CERT_DB_FILE_VERSION;
entry.common.flags = 0;
entry = NewDBCrlEntry(derCrl, url, crlType, 0);
if (entry == NULL) goto done;
entry.derCrl.data = derCrl->data;
entry.derCrl.len = derCrl->len;
entry.url = url;
rv = WriteDBCrlEntry(handle, &entry, crlKey);
rv = WriteDBCrlEntry(handle, entry, crlKey);
if (rv != SECSuccess) goto done;
done:
if (entry) {
DestroyDBEntry((certDBEntry *)entry);
}
return rv;
}
@@ -5135,33 +5150,23 @@ nsslowcert_AddCrl(NSSLOWCERTCertDBHandle *handle, SECItem *derCrl,
{
SECStatus rv;
rv = db_BeginTransaction(handle->permCertDB);
if (rv != SECSuccess) {
return SECFailure;
}
rv = nsslowcert_UpdateCrl(handle, derCrl, crlKey, url, isKRL);
db_FinishTransaction(handle->permCertDB, rv != SECSuccess);
return rv;
}
SECStatus
nsslowcert_DeletePermCRL(NSSLOWCERTCertDBHandle *handle, SECItem *derName,
nsslowcert_DeletePermCRL(NSSLOWCERTCertDBHandle *handle, const SECItem *derName,
PRBool isKRL)
{
SECStatus rv;
certDBEntryType crlType = isKRL ? certDBEntryTypeKeyRevocation
: certDBEntryTypeRevocation;
rv = db_BeginTransaction(handle->permCertDB);
if (rv != SECSuccess) {
return SECFailure;
}
rv = DeleteDBCrlEntry(handle, derName, crlType);
if (rv != SECSuccess) goto done;
done:
db_FinishTransaction(handle->permCertDB, rv != SECSuccess);
return rv;
}
@@ -5248,15 +5253,10 @@ nsslowcert_SaveSMimeProfile(NSSLOWCERTCertDBHandle *dbhandle, char *emailAddr,
{
SECStatus rv = SECFailure;;
rv = db_BeginTransaction(dbhandle->permCertDB);
if (rv != SECSuccess) {
return SECFailure;
}
rv = nsslowcert_UpdateSMimeProfile(dbhandle, emailAddr,
derSubject, emailProfile, profileTime);
db_FinishTransaction(dbhandle->permCertDB, rv != SECSuccess);
return(rv);
}
@@ -5288,7 +5288,7 @@ nsslowcert_DestroyGlobalLocks(void)
}
certDBEntry *
nsslowcert_DecodeAnyDBEntry(SECItem *dbData, SECItem *dbKey,
nsslowcert_DecodeAnyDBEntry(SECItem *dbData, const SECItem *dbKey,
certDBEntryType entryType, void *pdata)
{
PLArenaPool *arena = NULL;

4
mozilla/security/nss/lib/softoken/pcertt.h → mozilla/security/nss/lib/softoken/legacydb/pcertt.h
View File

@@ -36,7 +36,7 @@
/*
* certt.h - public data structures for the certificate library
*
* $Id: pcertt.h,v 1.14 2006-01-19 02:09:37 nelsonb%netscape.com Exp $
* $Id: pcertt.h,v 1.2 2007-06-13 00:24:57 rrelyea%redhat.com Exp $
*/
#ifndef _PCERTT_H_
#define _PCERTT_H_
@@ -146,6 +146,7 @@ struct NSSLOWCERTCertificateStr {
SECItem validity;
certDBEntryCert *dbEntry; /* database entry struct */
SECItem subjectKeyID; /* x509v3 subject key identifier */
SECItem extensions;
char *nickname;
char *emailAddr;
NSSLOWCERTCertTrust *trust;
@@ -156,6 +157,7 @@ struct NSSLOWCERTCertificateStr {
int referenceCount;
char nicknameSpace[200];
char emailAddrSpace[200];
unsigned char certKeySpace[512];
};

271
mozilla/security/nss/lib/softoken/pk11db.c → mozilla/security/nss/lib/softoken/legacydb/pk11db.c
View File

@@ -40,266 +40,12 @@
*/
#include "pk11pars.h"
#include "pkcs11i.h"
#include "lgdb.h"
#include "mcom_db.h"
#include "cdbhdl.h"
#include "secerr.h"
#define FREE_CLEAR(p) if (p) { PORT_Free(p); p = NULL; }
static void
secmod_parseTokenFlags(char *tmp, sftk_token_parameters *parsed) {
parsed->readOnly = secmod_argHasFlag("flags","readOnly",tmp);
parsed->noCertDB = secmod_argHasFlag("flags","noCertDB",tmp);
parsed->noKeyDB = secmod_argHasFlag("flags","noKeyDB",tmp);
parsed->forceOpen = secmod_argHasFlag("flags","forceOpen",tmp);
parsed->pwRequired = secmod_argHasFlag("flags","passwordRequired",tmp);
parsed->optimizeSpace = secmod_argHasFlag("flags","optimizeSpace",tmp);
return;
}
static void
secmod_parseFlags(char *tmp, sftk_parameters *parsed) {
parsed->noModDB = secmod_argHasFlag("flags","noModDB",tmp);
parsed->readOnly = secmod_argHasFlag("flags","readOnly",tmp);
/* keep legacy interface working */
parsed->noCertDB = secmod_argHasFlag("flags","noCertDB",tmp);
parsed->forceOpen = secmod_argHasFlag("flags","forceOpen",tmp);
parsed->pwRequired = secmod_argHasFlag("flags","passwordRequired",tmp);
parsed->optimizeSpace = secmod_argHasFlag("flags","optimizeSpace",tmp);
return;
}
CK_RV
secmod_parseTokenParameters(char *param, sftk_token_parameters *parsed)
{
int next;
char *tmp = NULL;
char *index;
index = secmod_argStrip(param);
while (*index) {
SECMOD_HANDLE_STRING_ARG(index,parsed->configdir,"configDir=",;)
SECMOD_HANDLE_STRING_ARG(index,parsed->certPrefix,"certPrefix=",;)
SECMOD_HANDLE_STRING_ARG(index,parsed->keyPrefix,"keyPrefix=",;)
SECMOD_HANDLE_STRING_ARG(index,parsed->tokdes,"tokenDescription=",;)
SECMOD_HANDLE_STRING_ARG(index,parsed->slotdes,"slotDescription=",;)
SECMOD_HANDLE_STRING_ARG(index,tmp,"minPWLen=",
if (tmp) { parsed->minPW=atoi(tmp); })
SECMOD_HANDLE_STRING_ARG(index,tmp,"flags=",
if (tmp) { secmod_parseTokenFlags(param,parsed); })
SECMOD_HANDLE_FINAL_ARG(index)
}
if (tmp)
PORT_Free(tmp);
return CKR_OK;
}
static void
secmod_parseTokens(char *tokenParams, sftk_parameters *parsed)
{
char *tokenIndex;
sftk_token_parameters *tokens = NULL;
int i=0,count = 0,next;
if ((tokenParams == NULL) || (*tokenParams == 0)) return;
/* first count the number of slots */
for (tokenIndex = secmod_argStrip(tokenParams); *tokenIndex;
tokenIndex = secmod_argStrip(secmod_argSkipParameter(tokenIndex))) {
count++;
}
/* get the data structures */
tokens = (sftk_token_parameters *)
PORT_ZAlloc(count*sizeof(sftk_token_parameters));
if (tokens == NULL) return;
for (tokenIndex = secmod_argStrip(tokenParams), i = 0;
*tokenIndex && i < count ; i++ ) {
char *name;
name = secmod_argGetName(tokenIndex,&next);
tokenIndex += next;
tokens[i].slotID = secmod_argDecodeNumber(name);
tokens[i].readOnly = PR_FALSE;
tokens[i].noCertDB = PR_FALSE;
tokens[i].noKeyDB = PR_FALSE;
if (!secmod_argIsBlank(*tokenIndex)) {
char *args = secmod_argFetchValue(tokenIndex,&next);
tokenIndex += next;
if (args) {
secmod_parseTokenParameters(args,&tokens[i]);
PORT_Free(args);
}
}
if (name) PORT_Free(name);
tokenIndex = secmod_argStrip(tokenIndex);
}
parsed->token_count = i;
parsed->tokens = tokens;
return;
}
CK_RV
secmod_parseParameters(char *param, sftk_parameters *parsed, PRBool isFIPS)
{
int next;
char *tmp = NULL;
char *index;
char *certPrefix = NULL, *keyPrefix = NULL;
char *tokdes = NULL, *ptokdes = NULL;
char *slotdes = NULL, *pslotdes = NULL;
char *fslotdes = NULL, *fpslotdes = NULL;
char *minPW = NULL;
index = secmod_argStrip(param);
PORT_Memset(parsed, 0, sizeof(sftk_parameters));
while (*index) {
SECMOD_HANDLE_STRING_ARG(index,parsed->configdir,"configDir=",;)
SECMOD_HANDLE_STRING_ARG(index,parsed->secmodName,"secmod=",;)
SECMOD_HANDLE_STRING_ARG(index,parsed->man,"manufacturerID=",;)
SECMOD_HANDLE_STRING_ARG(index,parsed->libdes,"libraryDescription=",;)
/* constructed values, used so legacy interfaces still work */
SECMOD_HANDLE_STRING_ARG(index,certPrefix,"certPrefix=",;)
SECMOD_HANDLE_STRING_ARG(index,keyPrefix,"keyPrefix=",;)
SECMOD_HANDLE_STRING_ARG(index,tokdes,"cryptoTokenDescription=",;)
SECMOD_HANDLE_STRING_ARG(index,ptokdes,"dbTokenDescription=",;)
SECMOD_HANDLE_STRING_ARG(index,slotdes,"cryptoSlotDescription=",;)
SECMOD_HANDLE_STRING_ARG(index,pslotdes,"dbSlotDescription=",;)
SECMOD_HANDLE_STRING_ARG(index,fslotdes,"FIPSSlotDescription=",;)
SECMOD_HANDLE_STRING_ARG(index,fpslotdes,"FIPSTokenDescription=",;)
SECMOD_HANDLE_STRING_ARG(index,minPW,"minPWLen=",;)
SECMOD_HANDLE_STRING_ARG(index,tmp,"flags=",
if (tmp) { secmod_parseFlags(param,parsed); })
SECMOD_HANDLE_STRING_ARG(index,tmp,"tokens=",
if (tmp) { secmod_parseTokens(tmp,parsed); })
SECMOD_HANDLE_FINAL_ARG(index)
}
if (tmp)
PORT_Free(tmp);
if (parsed->tokens == NULL) {
int count = isFIPS ? 1 : 2;
int index = count-1;
sftk_token_parameters *tokens = NULL;
tokens = (sftk_token_parameters *)
PORT_ZAlloc(count*sizeof(sftk_token_parameters));
if (tokens == NULL) {
goto loser;
}
parsed->tokens = tokens;
parsed->token_count = count;
tokens[index].slotID = isFIPS ? FIPS_SLOT_ID : PRIVATE_KEY_SLOT_ID;
tokens[index].certPrefix = certPrefix;
tokens[index].keyPrefix = keyPrefix;
tokens[index].minPW = minPW ? atoi(minPW) : 0;
tokens[index].readOnly = parsed->readOnly;
tokens[index].noCertDB = parsed->noCertDB;
tokens[index].noKeyDB = parsed->noCertDB;
tokens[index].forceOpen = parsed->forceOpen;
tokens[index].pwRequired = parsed->pwRequired;
tokens[index].optimizeSpace = parsed->optimizeSpace;
tokens[0].optimizeSpace = parsed->optimizeSpace;
certPrefix = NULL;
keyPrefix = NULL;
if (isFIPS) {
tokens[index].tokdes = fslotdes;
tokens[index].slotdes = fpslotdes;
fslotdes = NULL;
fpslotdes = NULL;
} else {
tokens[index].tokdes = ptokdes;
tokens[index].slotdes = pslotdes;
tokens[0].slotID = NETSCAPE_SLOT_ID;
tokens[0].tokdes = tokdes;
tokens[0].slotdes = slotdes;
tokens[0].noCertDB = PR_TRUE;
tokens[0].noKeyDB = PR_TRUE;
ptokdes = NULL;
pslotdes = NULL;
tokdes = NULL;
slotdes = NULL;
}
}
loser:
FREE_CLEAR(certPrefix);
FREE_CLEAR(keyPrefix);
FREE_CLEAR(tokdes);
FREE_CLEAR(ptokdes);
FREE_CLEAR(slotdes);
FREE_CLEAR(pslotdes);
FREE_CLEAR(fslotdes);
FREE_CLEAR(fpslotdes);
FREE_CLEAR(minPW);
return CKR_OK;
}
void
secmod_freeParams(sftk_parameters *params)
{
int i;
for (i=0; i < params->token_count; i++) {
FREE_CLEAR(params->tokens[i].configdir);
FREE_CLEAR(params->tokens[i].certPrefix);
FREE_CLEAR(params->tokens[i].keyPrefix);
FREE_CLEAR(params->tokens[i].tokdes);
FREE_CLEAR(params->tokens[i].slotdes);
}
FREE_CLEAR(params->configdir);
FREE_CLEAR(params->secmodName);
FREE_CLEAR(params->man);
FREE_CLEAR(params->libdes);
FREE_CLEAR(params->tokens);
}
char *
secmod_getSecmodName(char *param, char **appName, char **filename,PRBool *rw)
{
int next;
char *configdir = NULL;
char *secmodName = NULL;
char *value = NULL;
char *save_params = param;
const char *lconfigdir = NULL;
param = secmod_argStrip(param);
while (*param) {
SECMOD_HANDLE_STRING_ARG(param,configdir,"configDir=",;)
SECMOD_HANDLE_STRING_ARG(param,secmodName,"secmod=",;)
SECMOD_HANDLE_FINAL_ARG(param)
}
*rw = PR_TRUE;
if (secmod_argHasFlag("flags","readOnly",save_params) ||
secmod_argHasFlag("flags","noModDB",save_params)) *rw = PR_FALSE;
if (!secmodName || *secmodName == '\0') {
if (secmodName) PORT_Free(secmodName);
secmodName = PORT_Strdup(SECMOD_DB);
}
*filename = secmodName;
if (configdir) {
lconfigdir = sftk_EvaluateConfigDir(configdir, appName);
}
if (lconfigdir) {
value = PR_smprintf("%s" PATH_SEPARATOR "%s",lconfigdir,secmodName);
} else {
value = PR_smprintf("%s",secmodName);
}
if (configdir) PORT_Free(configdir);
return value;
}
/* Construct a database key for a given module */
static SECStatus secmod_MakeKey(DBT *key, char * module) {
int len = 0;
@@ -768,8 +514,6 @@ loser:
return NULL;
}
static DB *
secmod_OpenDB(const char *appName, const char *filename, const char *dbName,
PRBool readOnly, PRBool update)
@@ -862,13 +606,16 @@ secmod_addEscape(const char *string, char quote)
return newString;
}
SECStatus legacy_AddSecmodDB(const char *appName, const char *filename,
const char *dbname, char *module, PRBool rw);
#define SECMOD_STEP 10
#define SFTK_DEFAULT_INTERNAL_INIT "library= name=\"NSS Internal PKCS #11 Module\" parameters=\"%s\" NSS=\"Flags=internal,critical trustOrder=75 cipherOrder=100 slotParams=(1={%s askpw=any timeout=30})\""
/*
* Read all the existing modules in
*/
char **
secmod_ReadPermDB(const char *appName, const char *filename,
legacy_ReadSecmodDB(const char *appName, const char *filename,
const char *dbname, char *params, PRBool rw)
{
DBT key,data;
@@ -924,7 +671,7 @@ done:
if (pkcs11db) {
secmod_CloseDB(pkcs11db);
} else if (moduleList[0] && rw) {
secmod_AddPermDB(appName,filename,dbname,moduleList[0], rw) ;
legacy_AddSecmodDB(appName,filename,dbname,moduleList[0], rw) ;
}
if (!moduleList[0]) {
PORT_Free(moduleList);
@@ -934,7 +681,7 @@ done:
}
SECStatus
secmod_ReleasePermDBData(const char *appName, const char *filename,
legacy_ReleaseSecmodDBData(const char *appName, const char *filename,
const char *dbname, char **moduleSpecList, PRBool rw)
{
if (moduleSpecList) {
@@ -951,7 +698,7 @@ secmod_ReleasePermDBData(const char *appName, const char *filename,
* Delete a module from the Data Base
*/
SECStatus
secmod_DeletePermDB(const char *appName, const char *filename,
legacy_DeleteSecmodDB(const char *appName, const char *filename,
const char *dbname, char *args, PRBool rw)
{
DBT key;
@@ -987,7 +734,7 @@ done:
* Add a module to the Data base
*/
SECStatus
secmod_AddPermDB(const char *appName, const char *filename,
legacy_AddSecmodDB(const char *appName, const char *filename,
const char *dbname, char *module, PRBool rw)
{
DBT key,data;

341
mozilla/security/nss/lib/softoken/lgglue.c Normal file
View File

@@ -0,0 +1,341 @@
/* ***** BEGIN LICENSE BLOCK *****
* Version: MPL 1.1/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Mozilla Public License Version
* 1.1 (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
* http://www.mozilla.org/MPL/
*
* Software distributed under the License is distributed on an "AS IS" basis,
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
* for the specific language governing rights and limitations under the
* License.
*
* The Original Code is the Netscape security libraries.
*
* The Initial Developer of the Original Code is
* Netscape Communications Corporation.
* Portions created by the Initial Developer are Copyright (C) 1994-2000
* the Initial Developer. All Rights Reserved.
*
* Contributor(s):
*
* Alternatively, the contents of this file may be used under the terms of
* either the GNU General Public License Version 2 or later (the "GPL"), or
* the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the MPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/*
* The following code handles the storage of PKCS 11 modules used by the
* NSS. This file is written to abstract away how the modules are
* stored so we can deside that later.
*/
#include "sftkdb.h"
#include "sdb.h"
#include "prsystem.h"
#include "prprf.h"
#include "lgglue.h"
#include "secerr.h"
static LGOpenFunc legacy_glue_open = NULL;
static LGReadSecmodFunc legacy_glue_readSecmod = NULL;
static LGReleaseSecmodFunc legacy_glue_releaseSecmod = NULL;
static LGDeleteSecmodFunc legacy_glue_deleteSecmod = NULL;
static LGAddSecmodFunc legacy_glue_addSecmod = NULL;
static LGShutdownFunc legacy_glue_shutdown = NULL;
/*
* The following 3 functions duplicate the work done by bl_LoadLibrary.
* We should make bl_LoadLibrary a global and replace the call to
* sftkdb_LoadLibrary(const char *libname) with it.
*/
#ifdef XP_UNIX
#include <unistd.h>
#define LG_MAX_LINKS 20
static char *
sftkdb_resolvePath(const char *orig)
{
int count = 0;
int len =0;
int ret = -1;
char *resolved = NULL;
char *source = NULL;
len = 1025; /* MAX PATH +1*/
if (strlen(orig)+1 > len) {
/* PATH TOO LONG */
return NULL;
}
resolved = PORT_Alloc(len);
if (!resolved) {
return NULL;
}
source = PORT_Alloc(len);
if (!source) {
goto loser;
}
PORT_Strcpy(source, orig);
/* Walk down all the links */
while ( count++ < LG_MAX_LINKS) {
char *tmp;
/* swap our previous sorce out with resolved */
/* read it */
ret = readlink(source, resolved, len-1);
if (ret < 0) {
break;
}
resolved[ret] = 0;
tmp = source; source = resolved; resolved = tmp;
}
if (count > 1) {
ret = 0;
}
loser:
if (resolved) {
PORT_Free(resolved);
}
if (ret < 0) {
if (source) {
PORT_Free(source);
source = NULL;
}
}
return source;
}
#endif
static PRLibrary *
sftkdb_LoadFromPath(const char *path, const char *libname)
{
char *c;
int pathLen, nameLen, fullPathLen;
char *fullPathName = NULL;
PRLibSpec libSpec;
PRLibrary *lib = NULL;
/* strip of our parent's library name */
c = strrchr(path, PR_GetDirectorySeparator());
if (!c) {
return NULL; /* invalid path */
}
pathLen = (c-path)+1;
nameLen = strlen(libname);
fullPathLen = pathLen + nameLen +1;
fullPathName = (char *)PORT_Alloc(fullPathLen);
if (fullPathName == NULL) {
return NULL; /* memory allocation error */
}
PORT_Memcpy(fullPathName, path, pathLen);
PORT_Memcpy(fullPathName+pathLen, libname, nameLen);
fullPathName[fullPathLen-1] = 0;
libSpec.type = PR_LibSpec_Pathname;
libSpec.value.pathname = fullPathName;
lib = PR_LoadLibraryWithFlags(libSpec, PR_LD_NOW | PR_LD_LOCAL);
PORT_Free(fullPathName);
return lib;
}
static PRLibrary *
sftkdb_LoadLibrary(const char *libname)
{
PRLibrary *lib = NULL;
PRFuncPtr fn_addr;
char *parentLibPath = NULL;
fn_addr = (PRFuncPtr) &sftkdb_LoadLibrary;
parentLibPath = PR_GetLibraryFilePathname(SOFTOKEN_LIB_NAME, fn_addr);
if (!parentLibPath) {
goto done;
}
lib = sftkdb_LoadFromPath(parentLibPath, libname);
#ifdef XP_UNIX
/* handle symbolic link case */
if (!lib) {
char *trueParentLibPath = sftkdb_resolvePath(parentLibPath);
if (!trueParentLibPath) {
goto done;
}
lib = sftkdb_LoadFromPath(trueParentLibPath, libname);
PORT_Free(trueParentLibPath);
}
#endif
PORT_Free(parentLibPath);
done:
/* still couldn't load it, try the generic path */
if (!lib) {
PRLibSpec libSpec;
libSpec.type = PR_LibSpec_Pathname;
libSpec.value.pathname = libname;
lib = PR_LoadLibraryWithFlags(libSpec, PR_LD_NOW | PR_LD_LOCAL);
}
return lib;
}
static PRLibrary *legacy_glue_lib = NULL;
static SECStatus
sftkdbLoad_Legacy()
{
PRLibrary *lib = NULL;
LGSetCryptFunc setCryptFunction = NULL;
if (legacy_glue_lib) {
return SECSuccess;
}
lib = sftkdb_LoadLibrary(SHLIB_PREFIX"legacydb"SHLIB_VERSION"."SHLIB_SUFFIX);
if (lib == NULL) {
return SECFailure;
}
legacy_glue_open = (LGOpenFunc)PR_FindFunctionSymbol(lib, "legacy_Open");
legacy_glue_readSecmod = (LGReadSecmodFunc) PR_FindFunctionSymbol(lib,
"legacy_ReadSecmodDB");
legacy_glue_releaseSecmod = (LGReleaseSecmodFunc) PR_FindFunctionSymbol(lib,
"legacy_ReleaseSecmodDBData");
legacy_glue_deleteSecmod = (LGDeleteSecmodFunc) PR_FindFunctionSymbol(lib,
"legacy_DeleteSecmodDB");
legacy_glue_addSecmod = (LGAddSecmodFunc)PR_FindFunctionSymbol(lib,
"legacy_AddSecmodDB");
legacy_glue_shutdown = (LGShutdownFunc) PR_FindFunctionSymbol(lib,
"legacy_Shutdown");
setCryptFunction = (LGSetCryptFunc) PR_FindFunctionSymbol(lib,
"legacy_SetCryptFunctions");
if (!legacy_glue_open || !legacy_glue_readSecmod ||
!legacy_glue_releaseSecmod || !legacy_glue_deleteSecmod ||
!legacy_glue_addSecmod || !setCryptFunction) {
PR_UnloadLibrary(lib);
return SECFailure;
}
setCryptFunction(sftkdb_encrypt_stub,sftkdb_decrypt_stub);
legacy_glue_lib = lib;
return SECSuccess;
}
CK_RV
sftkdbCall_open(const char *dir, const char *certPrefix, const char *keyPrefix,
int certVersion, int keyVersion, int flags,
SDB **certDB, SDB **keyDB)
{
SECStatus rv;
rv = sftkdbLoad_Legacy();
if (rv != SECSuccess) {
return CKR_GENERAL_ERROR;
}
if (!legacy_glue_open) {
PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
return SECFailure;
}
return (*legacy_glue_open)(dir, certPrefix, keyPrefix,
certVersion, keyVersion,
flags, certDB, keyDB);
}
char **
sftkdbCall_ReadSecmodDB(const char *appName, const char *filename,
const char *dbname, char *params, PRBool rw)
{
SECStatus rv;
rv = sftkdbLoad_Legacy();
if (rv != SECSuccess) {
return NULL;
}
if (!legacy_glue_readSecmod) {
PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
return NULL;
}
return (*legacy_glue_readSecmod)(appName, filename, dbname, params, rw);
}
SECStatus
sftkdbCall_ReleaseSecmodDBData(const char *appName,
const char *filename, const char *dbname,
char **moduleSpecList, PRBool rw)
{
SECStatus rv;
rv = sftkdbLoad_Legacy();
if (rv != SECSuccess) {
return rv;
}
if (!legacy_glue_releaseSecmod) {
PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
return SECFailure;
}
return (*legacy_glue_releaseSecmod)(appName, filename, dbname,
moduleSpecList, rw);
}
SECStatus
sftkdbCall_DeleteSecmodDB(const char *appName,
const char *filename, const char *dbname,
char *args, PRBool rw)
{
SECStatus rv;
rv = sftkdbLoad_Legacy();
if (rv != SECSuccess) {
return rv;
}
if (!legacy_glue_deleteSecmod) {
PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
return SECFailure;
}
return (*legacy_glue_deleteSecmod)(appName, filename, dbname, args, rw);
}
SECStatus
sftkdbCall_AddSecmodDB(const char *appName,
const char *filename, const char *dbname,
char *module, PRBool rw)
{
SECStatus rv;
rv = sftkdbLoad_Legacy();
if (rv != SECSuccess) {
return rv;
}
if (!legacy_glue_addSecmod) {
PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
return SECFailure;
}
return (*legacy_glue_addSecmod)(appName, filename, dbname, module, rw);
}
CK_RV
sftkdbCall_Shutdown(void)
{
CK_RV crv = CKR_OK;
if (legacy_glue_lib) {
return CKR_OK;
}
if (legacy_glue_shutdown) {
crv = (*legacy_glue_shutdown)();
}
PR_UnloadLibrary(legacy_glue_lib);
legacy_glue_lib = NULL;
legacy_glue_open = NULL;
legacy_glue_readSecmod = NULL;
legacy_glue_releaseSecmod = NULL;
legacy_glue_deleteSecmod = NULL;
legacy_glue_addSecmod = NULL;
return crv;
}

92
mozilla/security/nss/lib/softoken/lgglue.h Normal file
View File

@@ -0,0 +1,92 @@
/* ***** BEGIN LICENSE BLOCK *****
* Version: MPL 1.1/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Mozilla Public License Version
* 1.1 (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
* http://www.mozilla.org/MPL/
*
* Software distributed under the License is distributed on an "AS IS" basis,
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
* for the specific language governing rights and limitations under the
* License.
*
* The Original Code is the Netscape security libraries.
*
* The Initial Developer of the Original Code is
* Netscape Communications Corporation.
* Portions created by the Initial Developer are Copyright (C) 1994-2000
* the Initial Developer. All Rights Reserved.
*
* Contributor(s):
*
* Alternatively, the contents of this file may be used under the terms of
* either the GNU General Public License Version 2 or later (the "GPL"), or
* the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the MPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/*
* This code defines the glue layer between softoken and the legacy DB library
*/
#include "sdb.h"
/*
* function prototypes for the callbacks into softoken from the legacyDB
*/
typedef SECStatus (*LGEncryptFunc)(PRArenaPool *arena, SDB *sdb,
SECItem *plainText, SECItem **cipherText);
typedef SECStatus (*LGDecryptFunc)(SDB *sdb, SECItem *cipherText,
SECItem **plainText);
/*
* function prototypes for the exported functions.
*/
typedef CK_RV (*LGOpenFunc) (const char *dir, const char *certPrefix,
const char *keyPrefix,
int certVersion, int keyVersion, int flags,
SDB **certDB, SDB **keyDB);
typedef char ** (*LGReadSecmodFunc)(const char *appName,
const char *filename,
const char *dbname, char *params, PRBool rw);
typedef SECStatus (*LGReleaseSecmodFunc)(const char *appName,
const char *filename,
const char *dbname, char **params, PRBool rw);
typedef SECStatus (*LGDeleteSecmodFunc)(const char *appName,
const char *filename,
const char *dbname, char *params, PRBool rw);
typedef SECStatus (*LGAddSecmodFunc)(const char *appName,
const char *filename,
const char *dbname, char *params, PRBool rw);
typedef SECStatus (*LGShutdownFunc)(void);
typedef void (*LGSetCryptFunc)(LGEncryptFunc, LGDecryptFunc);
/*
* Softoken Glue Functions
*/
CK_RV sftkdbCall_open(const char *dir, const char *certPrefix,
const char *keyPrefix,
int certVersion, int keyVersion, int flags,
SDB **certDB, SDB **keyDB);
char ** sftkdbCall_ReadSecmodDB(const char *appName, const char *filename,
const char *dbname, char *params, PRBool rw);
SECStatus sftkdbCall_ReleaseSecmodDBData(const char *appName,
const char *filename, const char *dbname,
char **moduleSpecList, PRBool rw);
SECStatus sftkdbCall_DeleteSecmodDB(const char *appName,
const char *filename, const char *dbname,
char *args, PRBool rw);
SECStatus sftkdbCall_AddSecmodDB(const char *appName,
const char *filename, const char *dbname,
char *module, PRBool rw);
CK_RV sftkdbCall_Shutdown(void);

34
mozilla/security/nss/lib/softoken/lowkey.c
View File

@@ -40,15 +40,41 @@
#include "secder.h"
#include "base64.h"
#include "secasn1.h"
#include "pcert.h"
#include "secerr.h"
#ifdef NSS_ENABLE_ECC
extern SECStatus EC_CopyParams(PRArenaPool *arena,
ECParams *dstParams,
const ECParams *srcParams);
#include "softoken.h"
#endif
const SEC_ASN1Template nsslowkey_AttributeTemplate[] = {
{ SEC_ASN1_SEQUENCE,
0, NULL, sizeof(NSSLOWKEYAttribute) },
{ SEC_ASN1_OBJECT_ID, offsetof(NSSLOWKEYAttribute, attrType) },
{ SEC_ASN1_SET_OF, offsetof(NSSLOWKEYAttribute, attrValue),
SEC_AnyTemplate },
{ 0 }
};
const SEC_ASN1Template nsslowkey_SetOfAttributeTemplate[] = {
{ SEC_ASN1_SET_OF, 0, nsslowkey_AttributeTemplate },
};
/* ASN1 Templates for new decoder/encoder */
const SEC_ASN1Template nsslowkey_PrivateKeyInfoTemplate[] = {
{ SEC_ASN1_SEQUENCE,
0, NULL, sizeof(NSSLOWKEYPrivateKeyInfo) },
{ SEC_ASN1_INTEGER,
offsetof(NSSLOWKEYPrivateKeyInfo,version) },
{ SEC_ASN1_INLINE,
offsetof(NSSLOWKEYPrivateKeyInfo,algorithm),
SECOID_AlgorithmIDTemplate },
{ SEC_ASN1_OCTET_STRING,
offsetof(NSSLOWKEYPrivateKeyInfo,privateKey) },
{ SEC_ASN1_OPTIONAL | SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 0,
offsetof(NSSLOWKEYPrivateKeyInfo, attributes),
nsslowkey_SetOfAttributeTemplate },
{ 0 }
};
const SEC_ASN1Template nsslowkey_PQGParamsTemplate[] = {
{ SEC_ASN1_SEQUENCE, 0, NULL, sizeof(PQGParams) },
{ SEC_ASN1_INTEGER, offsetof(PQGParams,prime) },

168
mozilla/security/nss/lib/softoken/lowkeyi.h
View File

@@ -34,7 +34,7 @@
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/* $Id: lowkeyi.h,v 1.10 2004-04-27 23:04:38 gerv%gerv.net Exp $ */
/* $Id: lowkeyi.h,v 1.11 2007-06-13 00:24:56 rrelyea%redhat.com Exp $ */
#ifndef _LOWKEYI_H_
#define _LOWKEYI_H_
@@ -42,7 +42,6 @@
#include "prtypes.h"
#include "seccomon.h"
#include "secoidt.h"
#include "pcertt.h"
#include "lowkeyti.h"
SEC_BEGIN_PROTOS
@@ -65,89 +64,6 @@ extern void prepare_low_ec_priv_key_for_asn1(NSSLOWKEYPrivateKey *key);
extern void prepare_low_ecparams_for_asn1(ECParams *params);
#endif /* NSS_ENABLE_ECC */
typedef char * (* NSSLOWKEYDBNameFunc)(void *arg, int dbVersion);
/*
** Open a key database.
*/
extern NSSLOWKEYDBHandle *nsslowkey_OpenKeyDB(PRBool readOnly,
const char *domain,
const char *prefix,
NSSLOWKEYDBNameFunc namecb,
void *cbarg);
/*
* Clear out all the keys in the existing database
*/
extern SECStatus nsslowkey_ResetKeyDB(NSSLOWKEYDBHandle *handle);
/*
** Close the specified key database.
*/
extern void nsslowkey_CloseKeyDB(NSSLOWKEYDBHandle *handle);
/*
* Get the version number of the database
*/
extern int nsslowkey_GetKeyDBVersion(NSSLOWKEYDBHandle *handle);
/*
** Support a default key database.
*/
extern void nsslowkey_SetDefaultKeyDB(NSSLOWKEYDBHandle *handle);
extern NSSLOWKEYDBHandle *nsslowkey_GetDefaultKeyDB(void);
/* set the alg id of the key encryption algorithm */
extern void nsslowkey_SetDefaultKeyDBAlg(SECOidTag alg);
/*
* given a password and salt, produce a hash of the password
*/
extern SECItem *nsslowkey_HashPassword(char *pw, SECItem *salt);
/*
* Derive the actual password value for a key database from the
* password string value. The derivation uses global salt value
* stored in the key database.
*/
extern SECItem *
nsslowkey_DeriveKeyDBPassword(NSSLOWKEYDBHandle *handle, char *pw);
/*
** Delete a key from the database
*/
extern SECStatus nsslowkey_DeleteKey(NSSLOWKEYDBHandle *handle,
SECItem *pubkey);
/*
** Store a key in the database, indexed by its public key modulus.
** "pk" is the private key to store
** "f" is a the callback function for getting the password
** "arg" is the argument for the callback
*/
extern SECStatus nsslowkey_StoreKeyByPublicKey(NSSLOWKEYDBHandle *handle,
NSSLOWKEYPrivateKey *pk,
SECItem *pubKeyData,
char *nickname,
SECItem *arg);
/* does the key for this cert exist in the database filed by modulus */
extern PRBool nsslowkey_KeyForCertExists(NSSLOWKEYDBHandle *handle,
NSSLOWCERTCertificate *cert);
/* does a key with this ID already exist? */
extern PRBool nsslowkey_KeyForIDExists(NSSLOWKEYDBHandle *handle, SECItem *id);
extern SECStatus nsslowkey_HasKeyDBPassword(NSSLOWKEYDBHandle *handle);
extern SECStatus nsslowkey_SetKeyDBPassword(NSSLOWKEYDBHandle *handle,
SECItem *pwitem);
extern SECStatus nsslowkey_CheckKeyDBPassword(NSSLOWKEYDBHandle *handle,
SECItem *pwitem);
extern SECStatus nsslowkey_ChangeKeyDBPassword(NSSLOWKEYDBHandle *handle,
SECItem *oldpwitem,
SECItem *newpwitem);
/*
** Destroy a private key object.
** "key" the object
@@ -180,88 +96,6 @@ extern unsigned int nsslowkey_PrivateModulusLen(NSSLOWKEYPrivateKey *privKey);
extern NSSLOWKEYPublicKey
*nsslowkey_ConvertToPublicKey(NSSLOWKEYPrivateKey *privateKey);
/*
* Set the Key Database password.
* handle is a handle to the key database
* pwitem is the new password
* algorithm is the algorithm by which the key database
* password is to be encrypted.
* On failure, SECFailure is returned, otherwise SECSuccess is
* returned.
*/
extern SECStatus
nsslowkey_SetKeyDBPasswordAlg(NSSLOWKEYDBHandle *handle,
SECItem *pwitem,
SECOidTag algorithm);
/* Check the key database password.
* handle is a handle to the key database
* pwitem is the suspect password
* algorithm is the algorithm by which the key database
* password is to be encrypted.
* The password is checked against plaintext to see if it is the
* actual password. If it is not, SECFailure is returned.
*/
extern SECStatus
nsslowkey_CheckKeyDBPasswordAlg(NSSLOWKEYDBHandle *handle,
SECItem *pwitem,
SECOidTag algorithm);
/* Change the key database password and/or algorithm by which
* the password is stored with.
* handle is a handle to the key database
* old_pwitem is the current password
* new_pwitem is the new password
* old_algorithm is the algorithm by which the key database
* password is currently encrypted.
* new_algorithm is the algorithm with which the new password
* is to be encrypted.
* A return of anything but SECSuccess indicates failure.
*/
extern SECStatus
nsslowkey_ChangeKeyDBPasswordAlg(NSSLOWKEYDBHandle *handle,
SECItem *oldpwitem, SECItem *newpwitem,
SECOidTag old_algorithm);
SECStatus
nsslowkey_UpdateNickname(NSSLOWKEYDBHandle *handle,
NSSLOWKEYPrivateKey *privkey,
SECItem *pubKeyData,
char *nickname,
SECItem *arg);
/* Store key by modulus and specify an encryption algorithm to use.
* handle is the pointer to the key database,
* privkey is the private key to be stored,
* f and arg are the function and arguments to the callback
* to get a password,
* algorithm is the algorithm which the privKey is to be stored.
* A return of anything but SECSuccess indicates failure.
*/
extern SECStatus
nsslowkey_StoreKeyByPublicKeyAlg(NSSLOWKEYDBHandle *handle,
NSSLOWKEYPrivateKey *privkey,
SECItem *pubKeyData,
char *nickname,
SECItem *arg,
SECOidTag algorithm,
PRBool update);
/* Find key by modulus. This function is the inverse of store key
* by modulus. An attempt to locate the key with "modulus" is
* performed. If the key is found, the private key is returned,
* else NULL is returned.
* modulus is the modulus to locate
*/
extern NSSLOWKEYPrivateKey *
nsslowkey_FindKeyByPublicKey(NSSLOWKEYDBHandle *handle, SECItem *modulus,
SECItem *arg);
extern char *
nsslowkey_FindKeyNicknameByPublicKey(NSSLOWKEYDBHandle *handle,
SECItem *modulus, SECItem *pwitem);
/* Make a copy of a low private key in it's own arena.
* a return of NULL indicates an error.
*/

36
mozilla/security/nss/lib/softoken/lowkeyti.h
View File

@@ -43,31 +43,6 @@
#include "secitem.h"
#include "secasn1t.h"
#include "secoidt.h"
/*#include "secmodt.h"
#include "pkcs11t.h" */
/*
* a key in/for the data base
*/
struct NSSLOWKEYDBKeyStr {
PLArenaPool *arena;
int version;
char *nickname;
SECItem salt;
SECItem derPK;
};
typedef struct NSSLOWKEYDBKeyStr NSSLOWKEYDBKey;
typedef struct NSSLOWKEYDBHandleStr NSSLOWKEYDBHandle;
#ifdef NSS_USE_KEY4_DB
#define NSSLOWKEY_DB_FILE_VERSION 4
#else
#define NSSLOWKEY_DB_FILE_VERSION 3
#endif
#define NSSLOWKEY_VERSION 0 /* what we *create* */
/*
** Typedef for callback to get a password "key".
@@ -109,17 +84,6 @@ struct NSSLOWKEYPrivateKeyInfoStr {
typedef struct NSSLOWKEYPrivateKeyInfoStr NSSLOWKEYPrivateKeyInfo;
#define NSSLOWKEY_PRIVATE_KEY_INFO_VERSION 0 /* what we *create* */
/*
** A PKCS#8 private key info object
*/
struct NSSLOWKEYEncryptedPrivateKeyInfoStr {
PLArenaPool *arena;
SECAlgorithmID algorithm;
SECItem encryptedData;
};
typedef struct NSSLOWKEYEncryptedPrivateKeyInfoStr NSSLOWKEYEncryptedPrivateKeyInfo;
typedef enum {
NSSLOWKEYNullKey = 0,
NSSLOWKEYRSAKey = 1,

23
mozilla/security/nss/lib/softoken/manifest.mn
View File

@@ -37,6 +37,7 @@
CORE_DEPTH = ../../..
MODULE = nss
DIRS = legacydb
REQUIRES = dbm
@@ -44,7 +45,7 @@ LIBRARY_NAME = softokn
LIBRARY_VERSION = 3
MAPFILE = $(OBJDIR)/softokn.def
DEFINES += -DSHLIB_SUFFIX=\"$(DLL_SUFFIX)\" -DSHLIB_PREFIX=\"$(DLL_PREFIX)\" -DSOFTOKEN_LIB_NAME=\"$(notdir $(SHARED_LIBRARY))\"
DEFINES += -DSHLIB_SUFFIX=\"$(DLL_SUFFIX)\" -DSHLIB_PREFIX=\"$(DLL_PREFIX)\" -DSOFTOKEN_LIB_NAME=\"$(notdir $(SHARED_LIBRARY))\" -DSHLIB_VERSION=\"$(LIBRARY_VERSION)\"
EXPORTS = \
@@ -54,37 +55,35 @@ EXPORTS = \
pkcs11t.h \
pkcs11n.h \
pkcs11u.h \
sdb.h \
sftkdbt.h \
$(NULL)
PRIVATE_EXPORTS = \
lgglue.h \
pk11pars.h \
pkcs11ni.h \
lowkeyi.h \
lowkeyti.h \
pcertt.h \
softoken.h \
softoknt.h \
softkver.h \
$(NULL)
CSRCS = \
dbinit.c \
dbmshim.c \
ecdecode.c \
fipsaudt.c \
fipstest.c \
fipstokn.c \
keydb.c \
lowcert.c \
lgglue.c \
lowkey.c \
lowpbe.c \
padbuf.c \
pcertdb.c \
pk11db.c \
pkcs11.c \
pkcs11c.c \
pkcs11u.c \
rsawrapr.c \
sdb.c \
sftkdb.c \
sftkpars.c \
softkver.c \
tlsprf.c \
$(NULL)
@@ -93,3 +92,7 @@ ifdef NSS_ENABLE_ECC
DEFINES += -DNSS_ENABLE_ECC
endif
ifdef SQLITE_UNSAFE_THREADS
DEFINES += -DSQLITE_UNSAFE_THREADS
endif

1823
mozilla/security/nss/lib/softoken/pkcs11.c
View File

File diff suppressed because it is too large Load Diff

4
mozilla/security/nss/lib/softoken/pkcs11c.c
View File

@@ -59,7 +59,6 @@
#include "pkcs11.h"
#include "pkcs11i.h"
#include "lowkeyi.h"
#include "pcert.h"
#include "sechash.h"
#include "secder.h"
#include "secdig.h"
@@ -71,7 +70,6 @@
#include "secasn1.h"
#include "secerr.h"
#include "pcert.h"
#include "ssl3prot.h" /* for SSL3_RANDOM_LENGTH */
#include "prprf.h"
@@ -97,8 +95,6 @@ static void sftk_Null(void *data, PRBool freeit)
}
#ifdef NSS_ENABLE_ECC
extern SECStatus EC_DecodeParams(const SECItem *encodedParams,
ECParams **ecparams);
#ifdef EC_DEBUG
#define SEC_PRINT(str1, str2, num, sitem) \
printf("pkcs11c.c:%s:%s (keytype=%d) [len=%d]\n", \

54
mozilla/security/nss/lib/softoken/pkcs11i.h
View File

@@ -44,7 +44,8 @@
#include "secoidt.h"
#include "lowkeyti.h"
#include "pkcs11t.h"
#include "pcertt.h"
#include "sftkdbt.h"
/*
@@ -348,7 +349,6 @@ struct SFTKSlotStr {
unsigned long sessionLockMask; /* invariant */
PZLock *objectLock; /* invariant */
PRLock *pwCheckLock; /* invariant */
SECItem *password; /* variable - reset */
PRBool present; /* variable -set */
PRBool hasTokens; /* per load */
PRBool isLoggedIn; /* variable - reset */
@@ -357,8 +357,8 @@ struct SFTKSlotStr {
PRBool DB_loaded; /* per load */
PRBool readOnly; /* per load */
PRBool optimizeSpace; /* invariant */
NSSLOWCERTCertDBHandle *certDB; /* per load */
NSSLOWKEYDBHandle *keyDB; /* per load */
SFTKDBHandle *certDB; /* per load */
SFTKDBHandle *keyDB; /* per load */
int minimumPinLen; /* per load */
PRInt32 sessionIDCount; /* atomically incremented */
/* (preserved) */
@@ -367,7 +367,7 @@ struct SFTKSlotStr {
int sessionCount; /* variable - reset */
PRInt32 rwSessionCount; /* set by atomic operations */
/* (reset) */
PRUint32 sessionObjectHandleCount; /* variable - preserved */
int sessionObjectHandleCount;/* variable - perserved */
int index; /* invariant */
PLHashTable *tokObjHashTable; /* invariant */
SFTKObject **sessObjHashTable; /* variable - reset */
@@ -650,53 +650,13 @@ extern void sftk_FormatDESKey(unsigned char *key, int length);
extern PRBool sftk_CheckDESKey(unsigned char *key);
extern PRBool sftk_IsWeakKey(unsigned char *key,CK_KEY_TYPE key_type);
extern CK_RV secmod_parseParameters(char *param, sftk_parameters *parsed,
PRBool isFIPS);
extern void secmod_freeParams(sftk_parameters *params);
extern char *secmod_getSecmodName(char *params, char **domain,
char **filename, PRBool *rw);
extern char ** secmod_ReadPermDB(const char *domain, const char *filename,
const char *dbname, char *params, PRBool rw);
extern SECStatus secmod_DeletePermDB(const char *domain, const char *filename,
const char *dbname, char *args, PRBool rw);
extern SECStatus secmod_AddPermDB(const char *domain, const char *filename,
const char *dbname, char *module, PRBool rw);
extern SECStatus secmod_ReleasePermDBData(const char *domain,
const char *filename, const char *dbname, char **specList, PRBool rw);
/* mechanism allows this operation */
extern CK_RV sftk_MechAllowsOperation(CK_MECHANISM_TYPE type, CK_ATTRIBUTE_TYPE op);
/*
* OK there are now lots of options here, lets go through them all:
*
* configdir - base directory where all the cert, key, and module datbases live.
* certPrefix - prefix added to the beginning of the cert database example: "
* "https-server1-"
* keyPrefix - prefix added to the beginning of the key database example: "
* "https-server1-"
* secmodName - name of the security module database (usually "secmod.db").
* readOnly - Boolean: true if the databases are to be openned read only.
* nocertdb - Don't open the cert DB and key DB's, just initialize the
* Volatile certdb.
* nomoddb - Don't open the security module DB, just initialize the
* PKCS #11 module.
* forceOpen - Continue to force initializations even if the databases cannot
* be opened.
*/
CK_RV sftk_DBInit(const char *configdir, const char *certPrefix,
const char *keyPrefix, PRBool readOnly, PRBool noCertDB,
PRBool noKeyDB, PRBool forceOpen,
NSSLOWCERTCertDBHandle **certDB, NSSLOWKEYDBHandle **keyDB);
NSSLOWCERTCertDBHandle *sftk_getCertDB(SFTKSlot *slot);
NSSLOWKEYDBHandle *sftk_getKeyDB(SFTKSlot *slot);
void sftk_freeCertDB(NSSLOWCERTCertDBHandle *certHandle);
void sftk_freeKeyDB(NSSLOWKEYDBHandle *keyHandle);
/* helper function which calls nsslowkey_FindKeyByPublicKey after safely
* acquiring a reference to the keydb from the slot */
NSSLOWKEYPrivateKey *sftk_FindKeyByPublicKey(SFTKSlot *slot, SECItem *dbKey);
const char *sftk_EvaluateConfigDir(const char *configdir, char **domain);
/*
* narrow objects
*/
@@ -709,10 +669,6 @@ SFTKTokenObject * sftk_narrowToTokenObject(SFTKObject *);
void sftk_addHandle(SFTKSearchResults *search, CK_OBJECT_HANDLE handle);
PRBool sftk_poisonHandle(SFTKSlot *slot, SECItem *dbkey,
CK_OBJECT_HANDLE handle);
PRBool sftk_tokenMatch(SFTKSlot *slot, SECItem *dbKey, CK_OBJECT_HANDLE class,
CK_ATTRIBUTE_PTR theTemplate,int count);
CK_OBJECT_HANDLE sftk_mkHandle(SFTKSlot *slot,
SECItem *dbKey, CK_OBJECT_HANDLE class);
SFTKObject * sftk_NewTokenObject(SFTKSlot *slot, SECItem *dbKey,
CK_OBJECT_HANDLE handle);
SFTKTokenObject *sftk_convertSessionToToken(SFTKObject *so);

139
mozilla/security/nss/lib/softoken/pkcs11n.h
View File

@@ -39,7 +39,7 @@
#define _PKCS11N_H_
#ifdef DEBUG
static const char CKT_CVS_ID[] = "@(#) $RCSfile: pkcs11n.h,v $ $Revision: 1.15 $ $Date: 2005-09-28 17:12:17 $";
static const char CKT_CVS_ID[] = "@(#) $RCSfile: pkcs11n.h,v $ $Revision: 1.16 $ $Date: 2007-06-13 00:24:56 $";
#endif /* DEBUG */
/*
@@ -50,10 +50,10 @@ static const char CKT_CVS_ID[] = "@(#) $RCSfile: pkcs11n.h,v $ $Revision: 1.15 $
*/
/*
* NSSCK_VENDOR_NETSCAPE
* NSSCK_VENDOR_NSS
*
* Cryptoki reserves the high half of all the number spaces for
* vendor-defined use. I'd like to keep all of our Netscape-
* vendor-defined use. I'd like to keep all of our NSS-
* specific values together, but not in the oh-so-obvious
* 0x80000001, 0x80000002, etc. area. So I've picked an offset,
* and constructed values for the beginnings of our spaces.
@@ -61,54 +61,56 @@ static const char CKT_CVS_ID[] = "@(#) $RCSfile: pkcs11n.h,v $ $Revision: 1.15 $
* Note that some "historical" Netscape values don't fall within
* this range.
*/
#define NSSCK_VENDOR_NETSCAPE 0x4E534350 /* NSCP */
#define NSSCK_VENDOR_NSS 0x4E534350 /* NSCP */
/*
* Netscape-defined object classes
* NSS-defined object classes
*
*/
#define CKO_NETSCAPE (CKO_VENDOR_DEFINED|NSSCK_VENDOR_NETSCAPE)
#define CKO_NSS (CKO_VENDOR_DEFINED|NSSCK_VENDOR_NSS)
#define CKO_NSS_CRL (CKO_NSS + 1)
#define CKO_NSS_SMIME (CKO_NSS + 2)
#define CKO_NSS_TRUST (CKO_NSS + 3)
#define CKO_NSS_BUILTIN_ROOT_LIST (CKO_NSS + 4)
#define CKO_NSS_NEWSLOT (CKO_NSS + 5)
#define CKO_NSS_DELSLOT (CKO_NSS + 6)
#define CKO_NETSCAPE_CRL (CKO_NETSCAPE + 1)
#define CKO_NETSCAPE_SMIME (CKO_NETSCAPE + 2)
#define CKO_NETSCAPE_TRUST (CKO_NETSCAPE + 3)
#define CKO_NETSCAPE_BUILTIN_ROOT_LIST (CKO_NETSCAPE + 4)
#define CKO_NETSCAPE_NEWSLOT (CKO_NETSCAPE + 5)
#define CKO_NETSCAPE_DELSLOT (CKO_NETSCAPE + 6)
/*
* Netscape-defined key types
* NSS-defined key types
*
*/
#define CKK_NETSCAPE (CKK_VENDOR_DEFINED|NSSCK_VENDOR_NETSCAPE)
#define CKK_NSS (CKK_VENDOR_DEFINED|NSSCK_VENDOR_NSS)
#define CKK_NETSCAPE_PKCS8 (CKK_NETSCAPE + 1)
#define CKK_NSS_PKCS8 (CKK_NSS + 1)
/*
* Netscape-defined certificate types
* NSS-defined certificate types
*
*/
#define CKC_NETSCAPE (CKC_VENDOR_DEFINED|NSSCK_VENDOR_NETSCAPE)
#define CKC_NSS (CKC_VENDOR_DEFINED|NSSCK_VENDOR_NSS)
/*
* Netscape-defined object attributes
* NSS-defined object attributes
*
*/
#define CKA_NETSCAPE (CKA_VENDOR_DEFINED|NSSCK_VENDOR_NETSCAPE)
#define CKA_NSS (CKA_VENDOR_DEFINED|NSSCK_VENDOR_NSS)
#define CKA_NETSCAPE_URL (CKA_NETSCAPE + 1)
#define CKA_NETSCAPE_EMAIL (CKA_NETSCAPE + 2)
#define CKA_NETSCAPE_SMIME_INFO (CKA_NETSCAPE + 3)
#define CKA_NETSCAPE_SMIME_TIMESTAMP (CKA_NETSCAPE + 4)
#define CKA_NETSCAPE_PKCS8_SALT (CKA_NETSCAPE + 5)
#define CKA_NETSCAPE_PASSWORD_CHECK (CKA_NETSCAPE + 6)
#define CKA_NETSCAPE_EXPIRES (CKA_NETSCAPE + 7)
#define CKA_NETSCAPE_KRL (CKA_NETSCAPE + 8)
#define CKA_NSS_URL (CKA_NSS + 1)
#define CKA_NSS_EMAIL (CKA_NSS + 2)
#define CKA_NSS_SMIME_INFO (CKA_NSS + 3)
#define CKA_NSS_SMIME_TIMESTAMP (CKA_NSS + 4)
#define CKA_NSS_PKCS8_SALT (CKA_NSS + 5)
#define CKA_NSS_PASSWORD_CHECK (CKA_NSS + 6)
#define CKA_NSS_EXPIRES (CKA_NSS + 7)
#define CKA_NSS_KRL (CKA_NSS + 8)
#define CKA_NETSCAPE_PQG_COUNTER (CKA_NETSCAPE + 20)
#define CKA_NETSCAPE_PQG_SEED (CKA_NETSCAPE + 21)
#define CKA_NETSCAPE_PQG_H (CKA_NETSCAPE + 22)
#define CKA_NETSCAPE_PQG_SEED_BITS (CKA_NETSCAPE + 23)
#define CKA_NETSCAPE_MODULE_SPEC (CKA_NETSCAPE + 24)
#define CKA_NSS_PQG_COUNTER (CKA_NSS + 20)
#define CKA_NSS_PQG_SEED (CKA_NSS + 21)
#define CKA_NSS_PQG_H (CKA_NSS + 22)
#define CKA_NSS_PQG_SEED_BITS (CKA_NSS + 23)
#define CKA_NSS_MODULE_SPEC (CKA_NSS + 24)
#define CKA_NSS_OVERRIDE_EXTENSIONS (CKA_NSS + 25)
/*
* Trust attributes:
@@ -117,7 +119,7 @@ static const char CKT_CVS_ID[] = "@(#) $RCSfile: pkcs11n.h,v $ $Revision: 1.15 $
* put them all in one place.
*/
#define CKA_TRUST (CKA_NETSCAPE + 0x2000)
#define CKA_TRUST (CKA_NSS + 0x2000)
/* "Usage" key information */
#define CKA_TRUST_DIGITAL_SIGNATURE (CKA_TRUST + 1)
@@ -142,7 +144,7 @@ static const char CKT_CVS_ID[] = "@(#) $RCSfile: pkcs11n.h,v $ $Revision: 1.15 $
#define CKA_CERT_SHA1_HASH (CKA_TRUST + 100)
#define CKA_CERT_MD5_HASH (CKA_TRUST + 101)
/* Netscape trust stuff */
/* NSS trust stuff */
/* XXX fgmr new ones here-- step-up, etc. */
/* HISTORICAL: define used to pass in the database key for DSA private keys */
@@ -150,13 +152,13 @@ static const char CKT_CVS_ID[] = "@(#) $RCSfile: pkcs11n.h,v $ $Revision: 1.15 $
#define CKA_NETSCAPE_TRUST 0x80000001L
/*
* Netscape-defined crypto mechanisms
* NSS-defined crypto mechanisms
*
*/
#define CKM_NETSCAPE (CKM_VENDOR_DEFINED|NSSCK_VENDOR_NETSCAPE)
#define CKM_NSS (CKM_VENDOR_DEFINED|NSSCK_VENDOR_NSS)
#define CKM_NETSCAPE_AES_KEY_WRAP (CKM_NETSCAPE + 1)
#define CKM_NETSCAPE_AES_KEY_WRAP_PAD (CKM_NETSCAPE + 2)
#define CKM_NSS_AES_KEY_WRAP (CKM_NSS + 1)
#define CKM_NSS_AES_KEY_WRAP_PAD (CKM_NSS + 2)
/*
* HISTORICAL:
@@ -178,13 +180,13 @@ static const char CKT_CVS_ID[] = "@(#) $RCSfile: pkcs11n.h,v $ $Revision: 1.15 $
#define CKM_TLS_PRF_GENERAL 0x80000373L
/*
* Netscape-defined return values
* NSS-defined return values
*
*/
#define CKR_NETSCAPE (CKM_VENDOR_DEFINED|NSSCK_VENDOR_NETSCAPE)
#define CKR_NSS (CKM_VENDOR_DEFINED|NSSCK_VENDOR_NSS)
#define CKR_NETSCAPE_CERTDB_FAILED (CKR_NETSCAPE + 1)
#define CKR_NETSCAPE_KEYDB_FAILED (CKR_NETSCAPE + 2)
#define CKR_NSS_CERTDB_FAILED (CKR_NSS + 1)
#define CKR_NSS_KEYDB_FAILED (CKR_NSS + 2)
/*
* Trust info
@@ -192,7 +194,7 @@ static const char CKT_CVS_ID[] = "@(#) $RCSfile: pkcs11n.h,v $ $Revision: 1.15 $
* This isn't part of the Cryptoki standard (yet), so I'm putting
* all the definitions here. Some of this would move to nssckt.h
* if trust info were made part of the standard. In view of this
* possibility, I'm putting my (Netscape) values in the netscape
* possibility, I'm putting my (NSS) values in the NSS
* vendor space, like everything else.
*/
@@ -201,22 +203,55 @@ typedef CK_ULONG CK_TRUST;
/* The following trust types are defined: */
#define CKT_VENDOR_DEFINED 0x80000000
#define CKT_NETSCAPE (CKT_VENDOR_DEFINED|NSSCK_VENDOR_NETSCAPE)
#define CKT_NSS (CKT_VENDOR_DEFINED|NSSCK_VENDOR_NSS)
/* If trust goes standard, these'll probably drop out of vendor space. */
#define CKT_NETSCAPE_TRUSTED (CKT_NETSCAPE + 1)
#define CKT_NETSCAPE_TRUSTED_DELEGATOR (CKT_NETSCAPE + 2)
#define CKT_NETSCAPE_UNTRUSTED (CKT_NETSCAPE + 3)
#define CKT_NETSCAPE_MUST_VERIFY (CKT_NETSCAPE + 4)
#define CKT_NETSCAPE_TRUST_UNKNOWN (CKT_NETSCAPE + 5) /* default */
#define CKT_NSS_TRUSTED (CKT_NSS + 1)
#define CKT_NSS_TRUSTED_DELEGATOR (CKT_NSS + 2)
#define CKT_NSS_UNTRUSTED (CKT_NSS + 3)
#define CKT_NSS_MUST_VERIFY (CKT_NSS + 4)
#define CKT_NSS_TRUST_UNKNOWN (CKT_NSS + 5) /* default */
/*
* These may well remain Netscape-specific; I'm only using them
* These may well remain NSS-specific; I'm only using them
* to cache resolution data.
*/
#define CKT_NETSCAPE_VALID (CKT_NETSCAPE + 10)
#define CKT_NETSCAPE_VALID_DELEGATOR (CKT_NETSCAPE + 11)
#define CKT_NSS_VALID (CKT_NSS + 10)
#define CKT_NSS_VALID_DELEGATOR (CKT_NSS + 11)
/* don't leave old programs in a lurch just yet, give them the old NETSCAPE
* synonym */
#define CKO_NETSCAPE_CRL CKO_NSS_CRL
#define CKO_NETSCAPE_SMIME CKO_NSS_SMIME
#define CKO_NETSCAPE_TRUST CKO_NSS_TRUST
#define CKO_NETSCAPE_BUILTIN_ROOT_LIST CKO_NSS_BUILTIN_ROOT_LIST
#define CKO_NETSCAPE_NEWSLOT CKO_NSS_NEWSLOT
#define CKO_NETSCAPE_DELSLOT CKO_NSS_DELSLOT
#define CKK_NETSCAPE_PKCS8 CKK_NSS_PKCS8
#define CKA_NETSCAPE_URL CKA_NSS_URL
#define CKA_NETSCAPE_EMAIL CKA_NSS_EMAIL
#define CKA_NETSCAPE_SMIME_INFO CKA_NSS_SMIME_INFO
#define CKA_NETSCAPE_SMIME_TIMESTAMP CKA_NSS_SMIME_TIMESTAMP
#define CKA_NETSCAPE_PKCS8_SALT CKA_NSS_PKCS8_SALT
#define CKA_NETSCAPE_PASSWORD_CHECK CKA_NSS_PASSWORD_CHECK
#define CKA_NETSCAPE_EXPIRES CKA_NSS_EXPIRES
#define CKA_NETSCAPE_KRL CKA_NSS_KRL
#define CKA_NETSCAPE_PQG_COUNTER CKA_NSS_PQG_COUNTER
#define CKA_NETSCAPE_PQG_SEED CKA_NSS_PQG_SEED
#define CKA_NETSCAPE_PQG_H CKA_NSS_PQG_H
#define CKA_NETSCAPE_PQG_SEED_BITS CKA_NSS_PQG_SEED_BITS
#define CKA_NETSCAPE_MODULE_SPEC CKA_NSS_MODULE_SPEC
#define CKM_NETSCAPE_AES_KEY_WRAP CKM_NSS_AES_KEY_WRAP
#define CKM_NETSCAPE_AES_KEY_WRAP_PAD CKM_NSS_AES_KEY_WRAP_PAD
#define CKR_NETSCAPE_CERTDB_FAILED CKR_NSS_CERTDB_FAILED
#define CKR_NETSCAPE_KEYDB_FAILED CKR_NSS_KEYDB_FAILED
#define CKT_NETSCAPE_TRUSTED CKT_NSS_TRUSTED
#define CKT_NETSCAPE_TRUSTED_DELEGATOR CKT_NSS_TRUSTED_DELEGATOR
#define CKT_NETSCAPE_UNTRUSTED CKT_NSS_UNTRUSTED
#define CKT_NETSCAPE_MUST_VERIFY CKT_NSS_MUST_VERIFY
#define CKT_NETSCAPE_TRUST_UNKNOWN CKT_NSS_TRUST_UNKNOWN
#define CKT_NETSCAPE_VALID CKT_NSS_VALID
#define CKT_NETSCAPE_VALID_DELEGATOR CKT_NSS_VALID_DELEGATOR
/*
* These are not really PKCS #11 values specifically. They are the 'loadable'

10
mozilla/security/nss/lib/softoken/pkcs11t.h
View File

@@ -912,12 +912,12 @@ typedef CK_ULONG CK_MECHANISM_TYPE;
#define CKM_TWOFISH_CBC 0x00001093
/* Camellia is proposed for v2.20 Amendment 3 */
#define CKM_CAMELLIA_KEY_GEN 0x00000550
#define CKM_CAMELLIA_ECB 0x00000551
#define CKM_CAMELLIA_CBC 0x00000552
#define CKM_CAMELLIA_MAC 0x00000553
#define CKM_CAMELLIA_KEY_GEN 0x00000550
#define CKM_CAMELLIA_ECB 0x00000551
#define CKM_CAMELLIA_CBC 0x00000552
#define CKM_CAMELLIA_MAC 0x00000553
#define CKM_CAMELLIA_MAC_GENERAL 0x00000554
#define CKM_CAMELLIA_CBC_PAD 0x00000555
#define CKM_CAMELLIA_CBC_PAD 0x00000555
#define CKM_CAMELLIA_ECB_ENCRYPT_DATA 0x00000556
#define CKM_CAMELLIA_CBC_ENCRYPT_DATA 0x00000557

1793
mozilla/security/nss/lib/softoken/pkcs11u.c
View File

File diff suppressed because it is too large Load Diff

1518
mozilla/security/nss/lib/softoken/sdb.c Normal file
View File

File diff suppressed because it is too large Load Diff

115
mozilla/security/nss/lib/softoken/sdb.h Normal file
View File

@@ -0,0 +1,115 @@
/* ***** BEGIN LICENSE BLOCK *****
* Version: MPL 1.1/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Mozilla Public License Version
* 1.1 (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
* http://www.mozilla.org/MPL/
*
* Software distributed under the License is distributed on an "AS IS" basis,
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
* for the specific language governing rights and limitations under the
* License.
*
* The Original Code is Red Hat, Inc.
*
* The Initial Developer of the Original Code is
* Red Hat, Inc.
* Portions created by the Initial Developer are Copyright (C) 2005
* the Initial Developer. All Rights Reserved.
*
* Contributor(s):
* Robert Relyea (rrelyea@redhat.com)
*
* Alternatively, the contents of this file may be used under the terms of
* either the GNU General Public License Version 2 or later (the "GPL"), or
* the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the MPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/*
* This file implements PKCS 11 on top of our existing security modules
*
* For more information about PKCS 11 See PKCS 11 Token Inteface Standard.
* This implementation has two slots:
* slot 1 is our generic crypto support. It does not require login.
* It supports Public Key ops, and all they bulk ciphers and hashes.
* It can also support Private Key ops for imported Private keys. It does
* not have any token storage.
* slot 2 is our private key support. It requires a login before use. It
* can store Private Keys and Certs as token objects. Currently only private
* keys and their associated Certificates are saved on the token.
*
* In this implementation, session objects are only visible to the session
* that created or generated them.
*/
/*
* the following data structures should be moved to a 'rdb.h'.
*/
#ifndef _SDB_H
#define _SDB_H 1
#include "pkcs11t.h"
#include "secitem.h"
#include "sftkdbt.h"
#include <sqlite3.h>
#define STATIC_CMD_SIZE 2048
typedef struct SDBFindStr SDBFind;
typedef struct SDBStr SDB;
typedef struct SDBPasswordEntryStr SDBPasswordEntry;
struct SDBStr {
void *private;
int version;
SDBType sdb_type;
int sdb_flags;
void *app_private;
CK_RV (*sdb_FindObjectsInit)(SDB *sdb, const CK_ATTRIBUTE *template,
CK_ULONG count, SDBFind **find);
CK_RV (*sdb_FindObjects)(SDB *sdb, SDBFind *find, CK_OBJECT_HANDLE *ids,
CK_ULONG arraySize, CK_ULONG *count);
CK_RV (*sdb_FindObjectsFinal)(SDB *sdb, SDBFind *find);
CK_RV (*sdb_GetAttributeValue)(SDB *sdb, CK_OBJECT_HANDLE object,
CK_ATTRIBUTE *template, CK_ULONG count);
CK_RV (*sdb_SetAttributeValue)(SDB *sdb, CK_OBJECT_HANDLE object,
const CK_ATTRIBUTE *template, CK_ULONG count);
CK_RV (*sdb_CreateObject)(SDB *sdb, CK_OBJECT_HANDLE *object,
const CK_ATTRIBUTE *template, CK_ULONG count);
CK_RV (*sdb_DestroyObject)(SDB *sdb, CK_OBJECT_HANDLE object);
CK_RV (*sdb_GetPWEntry)(SDB *sdb, SDBPasswordEntry *entry);
CK_RV (*sdb_PutPWEntry)(SDB *sdb, SDBPasswordEntry *entry);
CK_RV (*sdb_Begin)(SDB *sdb);
CK_RV (*sdb_Commit)(SDB *sdb);
CK_RV (*sdb_Abort)(SDB *sdb);
CK_RV (*sdb_Reset)(SDB *sdb);
CK_RV (*sdb_Close)(SDB *sdb);
};
struct SDBPasswordEntryStr {
SECItem salt;
SECItem value;
unsigned char data[128];
};
CK_RV s_open(const char *directory, const char *certPrefix,
const char *keyPrefix,
int cert_version, int key_version,
int flags, SDB **certdb, SDB **keydb, int *newInit);
CK_RV s_shutdown();
/* flags */
#define SDB_RDONLY 1
#define SDB_RDWR 2
#define SDB_CREATE 4
#endif

2738
mozilla/security/nss/lib/softoken/sftkdb.c Normal file
View File

File diff suppressed because it is too large Load Diff

90
mozilla/security/nss/lib/softoken/sftkdb.h Normal file
View File

@@ -0,0 +1,90 @@
/*
* license
*/
#include "sftkdbt.h"
#include "sdb.h"
#include "pkcs11i.h"
#include "pkcs11t.h"
/* raw database stuff */
CK_RV sftkdb_write(SFTKDBHandle *handle, SFTKObject *,CK_OBJECT_HANDLE *);
CK_RV sftkdb_FindObjectsInit(SFTKDBHandle *sdb, const CK_ATTRIBUTE *template,
CK_ULONG count, SDBFind **find);
CK_RV sftkdb_FindObjects(SFTKDBHandle *sdb, SDBFind *find,
CK_OBJECT_HANDLE *ids, int arraySize, CK_ULONG *count);
CK_RV sftkdb_FindObjectsFinal(SFTKDBHandle *sdb, SDBFind *find);
CK_RV sftkdb_GetAttributeValue(SFTKDBHandle *handle,
CK_OBJECT_HANDLE object_id, CK_ATTRIBUTE *template, CK_ULONG count);
CK_RV sftkdb_SetAttributeValue(SFTKDBHandle *handle,
CK_OBJECT_HANDLE object_id, const CK_ATTRIBUTE *template,
CK_ULONG count);
CK_RV sftkdb_DestroyObject(SFTKDBHandle *handle, CK_OBJECT_HANDLE object_id);
CK_RV sftkdb_closeDB(SFTKDBHandle *handle);
/* secmod.db functions */
char ** sftkdb_ReadSecmodDB(SDBType dbType, const char *appName,
const char *filename, const char *dbname,
char *params, PRBool rw);
SECStatus sftkdb_ReleaseSecmodDBData(SDBType dbType, const char *appName,
const char *filename, const char *dbname,
char **moduleSpecList, PRBool rw);
SECStatus sftkdb_DeleteSecmodDB(SDBType dbType, const char *appName,
const char *filename, const char *dbname,
char *args, PRBool rw);
SECStatus sftkdb_AddSecmodDB(SDBType dbType, const char *appName,
const char *filename, const char *dbname,
char *module, PRBool rw);
/* keydb functions */
SECStatus sftkdb_PWIsInitialized(SFTKDBHandle *keydb);
SECStatus sftkdb_CheckPassword(SFTKDBHandle *keydb, const char *pw);
SECStatus sftkdb_PWCached(SFTKDBHandle *keydb);
SECStatus sftkdb_HasPasswordSet(SFTKDBHandle *keydb);
SECStatus sftkdb_ResetKeyDB(SFTKDBHandle *keydb);
SECStatus sftkdb_ChangePassword(SFTKDBHandle *keydb, char *oldPin, char *newPin);
SECStatus sftkdb_ClearPassword(SFTKDBHandle *keydb);
/* Utility functions */
/*
* OK there are now lots of options here, lets go through them all:
*
* configdir - base directory where all the cert, key, and module datbases live.
* certPrefix - prefix added to the beginning of the cert database example: "
* "https-server1-"
* keyPrefix - prefix added to the beginning of the key database example: "
* "https-server1-"
* secmodName - name of the security module database (usually "secmod.db").
* readOnly - Boolean: true if the databases are to be openned read only.
* nocertdb - Don't open the cert DB and key DB's, just initialize the
* Volatile certdb.
* nomoddb - Don't open the security module DB, just initialize the
* PKCS #11 module.
* forceOpen - Continue to force initializations even if the databases cannot
* be opened.
*/
CK_RV sftk_DBInit(const char *configdir, const char *certPrefix,
const char *keyPrefix, PRBool readOnly, PRBool noCertDB,
PRBool noKeyDB, PRBool forceOpen,
SFTKDBHandle **certDB, SFTKDBHandle **keyDB);
CK_RV sftkdb_Shutdown(void);
SFTKDBHandle *sftk_getCertDB(SFTKSlot *slot);
SFTKDBHandle *sftk_getKeyDB(SFTKSlot *slot);
SFTKDBHandle *sftk_getDBForTokenObject(SFTKSlot *slot,
CK_OBJECT_HANDLE objectID);
void sftk_freeDB(SFTKDBHandle *certHandle);
/*
* for lgglue, stubs to encrypt and decrypt password entries
*/
SECStatus sftkdb_encrypt_stub(PRArenaPool *arena, SDB *sdb, SECItem *plainText,
SECItem **cipherText);
SECStatus sftkdb_decrypt_stub(SDB *sdb, SECItem *cipherText,
SECItem **plainText);

17
mozilla/security/nss/lib/softoken/sftkdbt.h Normal file
View File

@@ -0,0 +1,17 @@
/*
* license
*/
#ifndef SFTKDBT_H
#define SFTKDBT_H 1
typedef struct SFTKDBHandleStr SFTKDBHandle;
typedef enum {
SDB_SQL,
SDB_EXTERN,
SDB_LEGACY,
SDB_MULTIACCESS
} SDBType;
#endif

616
mozilla/security/nss/lib/softoken/sftkpars.c Normal file
View File

@@ -0,0 +1,616 @@
/* ***** BEGIN LICENSE BLOCK *****
* Version: MPL 1.1/GPL 2.0/LGPL 2.1
*
* The contents of this file are subject to the Mozilla Public License Version
* 1.1 (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
* http://www.mozilla.org/MPL/
*
* Software distributed under the License is distributed on an "AS IS" basis,
* WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
* for the specific language governing rights and limitations under the
* License.
*
* The Original Code is the Netscape security libraries.
*
* The Initial Developer of the Original Code is
* Netscape Communications Corporation.
* Portions created by the Initial Developer are Copyright (C) 1994-2000
* the Initial Developer. All Rights Reserved.
*
* Contributor(s):
*
* Alternatively, the contents of this file may be used under the terms of
* either the GNU General Public License Version 2 or later (the "GPL"), or
* the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
* in which case the provisions of the GPL or the LGPL are applicable instead
* of those above. If you wish to allow use of your version of this file only
* under the terms of either the GPL or the LGPL, and not to allow others to
* use your version of this file under the terms of the MPL, indicate your
* decision by deleting the provisions above and replace them with the notice
* and other provisions required by the GPL or the LGPL. If you do not delete
* the provisions above, a recipient may use your version of this file under
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/*
* The following code handles the storage of PKCS 11 modules used by the
* NSS. This file is written to abstract away how the modules are
* stored so we can deside that later.
*/
#include "sftkpars.h"
#include "pkcs11i.h"
#include "sdb.h"
#include "prprf.h"
#include "prenv.h"
/*
* this file contains routines for parsing PKCS #11 module spec
* strings.
*/
#define SFTK_HANDLE_STRING_ARG(param,target,value,command) \
if (PORT_Strncasecmp(param,value,sizeof(value)-1) == 0) { \
param += sizeof(value)-1; \
target = sftk_argFetchValue(param,&next); \
param += next; \
command ;\
} else
#define SFTK_HANDLE_FINAL_ARG(param) \
{ param = sftk_argSkipParameter(param); } param = sftk_argStrip(param);
static PRBool sftk_argGetPair(char c) {
switch (c) {
case '\'': return c;
case '\"': return c;
case '<': return '>';
case '{': return '}';
case '[': return ']';
case '(': return ')';
default: break;
}
return ' ';
}
static PRBool sftk_argIsBlank(char c) {
return isspace(c);
}
static PRBool sftk_argIsEscape(char c) {
return c == '\\';
}
static PRBool sftk_argIsQuote(char c) {
switch (c) {
case '\'':
case '\"':
case '<':
case '{': /* } end curly to keep vi bracket matching working */
case '(': /* ) */
case '[': /* ] */ return PR_TRUE;
default: break;
}
return PR_FALSE;
}
char *sftk_argStrip(char *c) {
while (*c && sftk_argIsBlank(*c)) c++;
return c;
}
static char *
sftk_argFindEnd(char *string) {
char endChar = ' ';
PRBool lastEscape = PR_FALSE;
if (sftk_argIsQuote(*string)) {
endChar = sftk_argGetPair(*string);
string++;
}
for (;*string; string++) {
if (lastEscape) {
lastEscape = PR_FALSE;
continue;
}
if (sftk_argIsEscape(*string) && !lastEscape) {
lastEscape = PR_TRUE;
continue;
}
if ((endChar == ' ') && sftk_argIsBlank(*string)) break;
if (*string == endChar) {
break;
}
}
return string;
}
char *
sftk_argFetchValue(char *string, int *pcount)
{
char *end = sftk_argFindEnd(string);
char *retString, *copyString;
PRBool lastEscape = PR_FALSE;
int len;
len = end - string;
if (len == 0) {
*pcount = 0;
return NULL;
}
copyString = retString = (char *)PORT_Alloc(len+1);
if (*end) len++;
*pcount = len;
if (retString == NULL) return NULL;
if (sftk_argIsQuote(*string)) string++;
for (; string < end; string++) {
if (sftk_argIsEscape(*string) && !lastEscape) {
lastEscape = PR_TRUE;
continue;
}
lastEscape = PR_FALSE;
*copyString++ = *string;
}
*copyString = 0;
return retString;
}
static char *
sftk_argSkipParameter(char *string)
{
char *end;
/* look for the end of the <name>= */
for (;*string; string++) {
if (*string == '=') { string++; break; }
if (sftk_argIsBlank(*string)) return(string);
}
end = sftk_argFindEnd(string);
if (*end) end++;
return end;
}
char *
sftk_argGetParamValue(char *paramName,char *parameters)
{
char searchValue[256];
int paramLen = strlen(paramName);
char *returnValue = NULL;
int next;
if ((parameters == NULL) || (*parameters == 0)) return NULL;
PORT_Assert(paramLen+2 < sizeof(searchValue));
PORT_Strcpy(searchValue,paramName);
PORT_Strcat(searchValue,"=");
while (*parameters) {
if (PORT_Strncasecmp(parameters,searchValue,paramLen+1) == 0) {
parameters += paramLen+1;
returnValue = sftk_argFetchValue(parameters,&next);
break;
} else {
parameters = sftk_argSkipParameter(parameters);
}
parameters = sftk_argStrip(parameters);
}
return returnValue;
}
static char *
sftk_argNextFlag(char *flags)
{
for (; *flags ; flags++) {
if (*flags == ',') {
flags++;
break;
}
}
return flags;
}
static PRBool
sftk_argHasFlag(char *label, char *flag, char *parameters)
{
char *flags,*index;
int len = strlen(flag);
PRBool found = PR_FALSE;
flags = sftk_argGetParamValue(label,parameters);
if (flags == NULL) return PR_FALSE;
for (index=flags; *index; index=sftk_argNextFlag(index)) {
if (PORT_Strncasecmp(index,flag,len) == 0) {
found=PR_TRUE;
break;
}
}
PORT_Free(flags);
return found;
}
/*
* decode a number. handle octal (leading '0'), hex (leading '0x') or decimal
*/
static long
sftk_argDecodeNumber(char *num)
{
int radix = 10;
unsigned long value = 0;
long retValue = 0;
int sign = 1;
int digit;
if (num == NULL) return retValue;
num = sftk_argStrip(num);
if (*num == '-') {
sign = -1;
num++;
}
if (*num == '0') {
radix = 8;
num++;
if ((*num == 'x') || (*num == 'X')) {
radix = 16;
num++;
}
}
for ( ;*num; num++ ) {
if (isdigit(*num)) {
digit = *num - '0';
} else if ((*num >= 'a') && (*num <= 'f')) {
digit = *num - 'a' + 10;
} else if ((*num >= 'A') && (*num <= 'F')) {
digit = *num - 'A' + 10;
} else {
break;
}
if (digit >= radix) break;
value = value*radix + digit;
}
retValue = ((int) value) * sign;
return retValue;
}
static char *
sftk_argGetName(char *inString, int *next)
{
char *name=NULL;
char *string;
int len;
/* look for the end of the <name>= */
for (string = inString;*string; string++) {
if (*string == '=') { break; }
if (sftk_argIsBlank(*string)) break;
}
len = string - inString;
*next = len;
if (*string == '=') (*next) += 1;
if (len > 0) {
name = PORT_Alloc(len+1);
PORT_Strncpy(name,inString,len);
name[len] = 0;
}
return name;
}
#define FREE_CLEAR(p) if (p) { PORT_Free(p); p = NULL; }
static void
sftk_parseTokenFlags(char *tmp, sftk_token_parameters *parsed) {
parsed->readOnly = sftk_argHasFlag("flags","readOnly",tmp);
parsed->noCertDB = sftk_argHasFlag("flags","noCertDB",tmp);
parsed->noKeyDB = sftk_argHasFlag("flags","noKeyDB",tmp);
parsed->forceOpen = sftk_argHasFlag("flags","forceOpen",tmp);
parsed->pwRequired = sftk_argHasFlag("flags","passwordRequired",tmp);
parsed->optimizeSpace = sftk_argHasFlag("flags","optimizeSpace",tmp);
return;
}
static void
sftk_parseFlags(char *tmp, sftk_parameters *parsed) {
parsed->noModDB = sftk_argHasFlag("flags","noModDB",tmp);
parsed->readOnly = sftk_argHasFlag("flags","readOnly",tmp);
/* keep legacy interface working */
parsed->noCertDB = sftk_argHasFlag("flags","noCertDB",tmp);
parsed->forceOpen = sftk_argHasFlag("flags","forceOpen",tmp);
parsed->pwRequired = sftk_argHasFlag("flags","passwordRequired",tmp);
parsed->optimizeSpace = sftk_argHasFlag("flags","optimizeSpace",tmp);
return;
}
static CK_RV
sftk_parseTokenParameters(char *param, sftk_token_parameters *parsed)
{
int next;
char *tmp;
char *index;
index = sftk_argStrip(param);
while (*index) {
SFTK_HANDLE_STRING_ARG(index,parsed->configdir,"configDir=",;)
SFTK_HANDLE_STRING_ARG(index,parsed->certPrefix,"certPrefix=",;)
SFTK_HANDLE_STRING_ARG(index,parsed->keyPrefix,"keyPrefix=",;)
SFTK_HANDLE_STRING_ARG(index,parsed->tokdes,"tokenDescription=",;)
SFTK_HANDLE_STRING_ARG(index,parsed->slotdes,"slotDescription=",;)
SFTK_HANDLE_STRING_ARG(index,tmp,"minPWLen=",
if(tmp) { parsed->minPW=atoi(tmp); PORT_Free(tmp); })
SFTK_HANDLE_STRING_ARG(index,tmp,"flags=",
if(tmp) { sftk_parseTokenFlags(param,parsed); PORT_Free(tmp); })
SFTK_HANDLE_FINAL_ARG(index)
}
return CKR_OK;
}
static void
sftk_parseTokens(char *tokenParams, sftk_parameters *parsed)
{
char *tokenIndex;
sftk_token_parameters *tokens = NULL;
int i=0,count = 0,next;
if ((tokenParams == NULL) || (*tokenParams == 0)) return;
/* first count the number of slots */
for (tokenIndex = sftk_argStrip(tokenParams); *tokenIndex;
tokenIndex = sftk_argStrip(sftk_argSkipParameter(tokenIndex))) {
count++;
}
/* get the data structures */
tokens = (sftk_token_parameters *)
PORT_ZAlloc(count*sizeof(sftk_token_parameters));
if (tokens == NULL) return;
for (tokenIndex = sftk_argStrip(tokenParams), i = 0;
*tokenIndex && i < count ; i++ ) {
char *name;
name = sftk_argGetName(tokenIndex,&next);
tokenIndex += next;
tokens[i].slotID = sftk_argDecodeNumber(name);
tokens[i].readOnly = PR_FALSE;
tokens[i].noCertDB = PR_FALSE;
tokens[i].noKeyDB = PR_FALSE;
if (!sftk_argIsBlank(*tokenIndex)) {
char *args = sftk_argFetchValue(tokenIndex,&next);
tokenIndex += next;
if (args) {
sftk_parseTokenParameters(args,&tokens[i]);
PORT_Free(args);
}
}
if (name) PORT_Free(name);
tokenIndex = sftk_argStrip(tokenIndex);
}
parsed->token_count = i;
parsed->tokens = tokens;
return;
}
CK_RV
sftk_parseParameters(char *param, sftk_parameters *parsed, PRBool isFIPS)
{
int next;
char *tmp;
char *index;
char *certPrefix = NULL, *keyPrefix = NULL;
char *tokdes = NULL, *ptokdes = NULL;
char *slotdes = NULL, *pslotdes = NULL;
char *fslotdes = NULL, *fpslotdes = NULL;
char *minPW = NULL;
index = sftk_argStrip(param);
PORT_Memset(parsed, 0, sizeof(sftk_parameters));
while (*index) {
SFTK_HANDLE_STRING_ARG(index,parsed->configdir,"configDir=",;)
SFTK_HANDLE_STRING_ARG(index,parsed->secmodName,"secmod=",;)
SFTK_HANDLE_STRING_ARG(index,parsed->man,"manufacturerID=",;)
SFTK_HANDLE_STRING_ARG(index,parsed->libdes,"libraryDescription=",;)
/* constructed values, used so legacy interfaces still work */
SFTK_HANDLE_STRING_ARG(index,certPrefix,"certPrefix=",;)
SFTK_HANDLE_STRING_ARG(index,keyPrefix,"keyPrefix=",;)
SFTK_HANDLE_STRING_ARG(index,tokdes,"cryptoTokenDescription=",;)
SFTK_HANDLE_STRING_ARG(index,ptokdes,"dbTokenDescription=",;)
SFTK_HANDLE_STRING_ARG(index,slotdes,"cryptoSlotDescription=",;)
SFTK_HANDLE_STRING_ARG(index,pslotdes,"dbSlotDescription=",;)
SFTK_HANDLE_STRING_ARG(index,fslotdes,"FIPSSlotDescription=",;)
SFTK_HANDLE_STRING_ARG(index,fpslotdes,"FIPSTokenDescription=",;)
SFTK_HANDLE_STRING_ARG(index,minPW,"minPWLen=",;)
SFTK_HANDLE_STRING_ARG(index,tmp,"flags=",
if(tmp) { sftk_parseFlags(param,parsed); PORT_Free(tmp); })
SFTK_HANDLE_STRING_ARG(index,tmp,"tokens=",
if(tmp) { sftk_parseTokens(tmp,parsed); PORT_Free(tmp); })
SFTK_HANDLE_FINAL_ARG(index)
}
if (parsed->tokens == NULL) {
int count = isFIPS ? 1 : 2;
int index = count-1;
sftk_token_parameters *tokens = NULL;
tokens = (sftk_token_parameters *)
PORT_ZAlloc(count*sizeof(sftk_token_parameters));
if (tokens == NULL) {
goto loser;
}
parsed->tokens = tokens;
parsed->token_count = count;
tokens[index].slotID = isFIPS ? FIPS_SLOT_ID : PRIVATE_KEY_SLOT_ID;
tokens[index].certPrefix = certPrefix;
tokens[index].keyPrefix = keyPrefix;
tokens[index].minPW = minPW ? atoi(minPW) : 0;
tokens[index].readOnly = parsed->readOnly;
tokens[index].noCertDB = parsed->noCertDB;
tokens[index].noKeyDB = parsed->noCertDB;
tokens[index].forceOpen = parsed->forceOpen;
tokens[index].pwRequired = parsed->pwRequired;
tokens[index].optimizeSpace = parsed->optimizeSpace;
tokens[0].optimizeSpace = parsed->optimizeSpace;
certPrefix = NULL;
keyPrefix = NULL;
if (isFIPS) {
tokens[index].tokdes = fslotdes;
tokens[index].slotdes = fpslotdes;
fslotdes = NULL;
fpslotdes = NULL;
} else {
tokens[index].tokdes = ptokdes;
tokens[index].slotdes = pslotdes;
tokens[0].slotID = NETSCAPE_SLOT_ID;
tokens[0].tokdes = tokdes;
tokens[0].slotdes = slotdes;
tokens[0].noCertDB = PR_TRUE;
tokens[0].noKeyDB = PR_TRUE;
ptokdes = NULL;
pslotdes = NULL;
tokdes = NULL;
slotdes = NULL;
}
}
loser:
FREE_CLEAR(certPrefix);
FREE_CLEAR(keyPrefix);
FREE_CLEAR(tokdes);
FREE_CLEAR(ptokdes);
FREE_CLEAR(slotdes);
FREE_CLEAR(pslotdes);
FREE_CLEAR(fslotdes);
FREE_CLEAR(fpslotdes);
FREE_CLEAR(minPW);
return CKR_OK;
}
void
sftk_freeParams(sftk_parameters *params)
{
int i;
for (i=0; i < params->token_count; i++) {
FREE_CLEAR(params->tokens[i].configdir);
FREE_CLEAR(params->tokens[i].certPrefix);
FREE_CLEAR(params->tokens[i].keyPrefix);
FREE_CLEAR(params->tokens[i].tokdes);
FREE_CLEAR(params->tokens[i].slotdes);
}
FREE_CLEAR(params->configdir);
FREE_CLEAR(params->secmodName);
FREE_CLEAR(params->man);
FREE_CLEAR(params->libdes);
FREE_CLEAR(params->tokens);
}
#define SQLDB "sql:"
#define EXTERNDB "extern:"
#define LEGACY "dbm:"
const char *
sftk_EvaluateConfigDir(const char *configdir, SDBType *dbType, char **appName)
{
*appName = NULL;
*dbType = SDB_LEGACY;
if (PORT_Strncmp(configdir, MULTIACCESS, sizeof(MULTIACCESS)-1) == 0) {
char *cdir;
*dbType = SDB_MULTIACCESS;
*appName = PORT_Strdup(configdir+sizeof(MULTIACCESS)-1);
if (*appName == NULL) {
return configdir;
}
cdir = *appName;
while (*cdir && *cdir != ':') {
cdir++;
}
if (*cdir == ':') {
*cdir = 0;
cdir++;
}
configdir = cdir;
} else if (PORT_Strncmp(configdir, SQLDB, sizeof(SQLDB)-1) == 0) {
*dbType = SDB_SQL;
configdir = configdir + sizeof(SQLDB) -1;
} else if (PORT_Strncmp(configdir, EXTERNDB, sizeof(EXTERNDB)-1) == 0) {
*dbType = SDB_EXTERN;
configdir = configdir + sizeof(EXTERNDB) -1;
} else if (PORT_Strncmp(configdir, LEGACY, sizeof(LEGACY)-1) == 0) {
*dbType = SDB_LEGACY;
configdir = configdir + sizeof(LEGACY) -1;
} else {
/* look up the default from the environment */
char *defaultType = PR_GetEnv("NSS_DEFAULT_DB_TYPE");
if (defaultType == NULL) {
/* none specified, go with the legacy */
return configdir;
}
if (PORT_Strncmp(defaultType, SQLDB, sizeof(SQLDB)-2) == 0) {
*dbType = SDB_SQL;
} else if (PORT_Strncmp(defaultType,EXTERNDB,sizeof(EXTERNDB)-2)==0) {
*dbType = SDB_EXTERN;
} else if (PORT_Strncmp(defaultType, LEGACY, sizeof(LEGACY)-2) == 0) {
*dbType = SDB_LEGACY;
}
}
return configdir;
}
char *
sftk_getSecmodName(char *param, SDBType *dbType, char **appName,
char **filename, PRBool *rw)
{
int next;
char *configdir = NULL;
char *secmodName = NULL;
char *value = NULL;
char *save_params = param;
const char *lconfigdir;
param = sftk_argStrip(param);
while (*param) {
SFTK_HANDLE_STRING_ARG(param,configdir,"configDir=",;)
SFTK_HANDLE_STRING_ARG(param,secmodName,"secmod=",;)
SFTK_HANDLE_FINAL_ARG(param)
}
*rw = PR_TRUE;
if (sftk_argHasFlag("flags","readOnly",save_params) ||
sftk_argHasFlag("flags","noModDB",save_params)) *rw = PR_FALSE;
if (!secmodName || *secmodName == '\0') {
if (secmodName) PORT_Free(secmodName);
secmodName = PORT_Strdup(SECMOD_DB);
}
*filename = secmodName;
lconfigdir = sftk_EvaluateConfigDir(configdir, dbType, appName);
/* only use the renamed secmod for legacy databases */
if ((*dbType != SDB_LEGACY) && (*dbType != SDB_MULTIACCESS)) {
secmodName="pkcs11.txt";
}
if (lconfigdir) {
value = PR_smprintf("%s" PATH_SEPARATOR "%s",lconfigdir,secmodName);
} else {
value = PR_smprintf("%s",secmodName);
}
if (configdir) PORT_Free(configdir);
return value;
}

17
mozilla/security/nss/lib/softoken/sftkpars.h Normal file
View File

@@ -0,0 +1,17 @@
/*
* license
*/
#include "pkcs11i.h"
#include "sftkdbt.h"
/* parsing functions */
char * sftk_argFetchValue(char *string, int *pcount);
char * sftk_getSecmodName(char *param, SDBType *dbType, char **appName, char **filename,PRBool *rw);
char *sftk_argStrip(char *c);
CK_RV sftk_parseParameters(char *param, sftk_parameters *parsed, PRBool isFIPS);
void sftk_freeParams(sftk_parameters *params);
const char *sftk_EvaluateConfigDir(const char *configdir, SDBType *dbType, char **app);
char * sftk_argGetParamValue(char *paramName,char *parameters);

6
mozilla/security/nss/lib/softoken/softoken.h
View File

@@ -36,7 +36,7 @@
* the terms of any one of the MPL, the GPL or the LGPL.
*
* ***** END LICENSE BLOCK ***** */
/* $Id: softoken.h,v 1.14 2006-10-02 22:48:31 wtchang%redhat.com Exp $ */
/* $Id: softoken.h,v 1.15 2007-06-13 00:24:56 rrelyea%redhat.com Exp $ */
#ifndef _SOFTOKEN_H_
#define _SOFTOKEN_H_
@@ -147,6 +147,10 @@ SECStatus RSA_DecryptRaw(NSSLOWKEYPrivateKey *key, unsigned char *output,
*/
extern SECStatus EC_FillParams(PRArenaPool *arena,
const SECItem *encodedParams, ECParams *params);
extern SECStatus EC_DecodeParams(const SECItem *encodedParams,
ECParams **ecparams);
extern SECStatus EC_CopyParams(PRArenaPool *arena, ECParams *dstParams,
const ECParams *srcParams);
#endif