From 45744cd59b610c3ae24086dead5d9ae91051134a Mon Sep 17 00:00:00 2001
From: "javi%netscape.com"
 <javi%netscape.com@18797224-902f-48f8-a5cc-f745e15eee43>
Date: Thu, 17 May 2001 23:45:22 +0000
Subject: [PATCH] Fix for Bug 81322 r=mcgreer@netscape.com
 sr=blizzard@mozilla.org

  Give users the ability to turn on FIPS mode when using PSM 2.0


git-svn-id: svn://10.0.0.236/trunk@95336 18797224-902f-48f8-a5cc-f745e15eee43
---
 .../pki/resources/content/device_manager.js   | 26 +++++++++++++++++
 .../pki/resources/content/device_manager.xul  |  1 +
 .../resources/locale/en-US/pippki.properties  |  2 ++
 .../manager/ssl/public/nsIPKCS11Slot.idl      |  3 ++
 .../security/manager/ssl/src/nsPKCS11Slot.cpp | 29 +++++++++++++++++++
 5 files changed, 61 insertions(+)

diff --git a/mozilla/security/manager/pki/resources/content/device_manager.js b/mozilla/security/manager/pki/resources/content/device_manager.js
index 62d835a98d7..5ccfb18a7b5 100644
--- a/mozilla/security/manager/pki/resources/content/device_manager.js
+++ b/mozilla/security/manager/pki/resources/content/device_manager.js
@@ -71,6 +71,20 @@ function LoadModules()
       modules.next();
     } catch (e) { done = true; }
   }
+  /* Set the text on the fips button */
+  SetFIPSButtonText();
+}
+
+function SetFIPSButtonText()
+{
+  var fipsButton = document.getElementById("fipsbutton");
+  var label;
+  if (secmoddb.isFIPSEnabled) {
+   label = bundle.GetStringFromName("disable_fips"); 
+  } else {
+   label = bundle.GetStringFromName("enable_fips"); 
+  }
+  fipsButton.setAttribute("label", label);
 }
 
 /* Add a module to the tree.  slots is the array of slots in the module,
@@ -351,3 +365,15 @@ function showTokenInfo()
   AddInfoRow(bundle.GetStringFromName("devinfo_fwversion"),
              selected_token.tokenFWVersion, "tok_fwv");
 }
+
+function toggleFIPS()
+{
+  secmoddb.toggleFIPSMode();
+  //Remove the existing listed modules so that re-fresh doesn't 
+  //display the module that just changed.
+  var device_list = document.getElementById("device_list");
+  while (device_list.firstChild)
+    device_list.removeChild(device_list.firstChild);
+
+  LoadModules();
+}
diff --git a/mozilla/security/manager/pki/resources/content/device_manager.xul b/mozilla/security/manager/pki/resources/content/device_manager.xul
index 587ef221d73..23cb781cdbb 100644
--- a/mozilla/security/manager/pki/resources/content/device_manager.xul
+++ b/mozilla/security/manager/pki/resources/content/device_manager.xul
@@ -104,6 +104,7 @@
         <button id="unload_button" 
                 label="&devmgr.button.unload.label;"
                 onclick="doUnload();" disabled="true"/> 
+        <button id="fipsbutton" onclick="toggleFIPS();" />
       </vbox> <!-- / Buttons for manipulating devices -->
     </row>
     <row>
diff --git a/mozilla/security/manager/pki/resources/locale/en-US/pippki.properties b/mozilla/security/manager/pki/resources/locale/en-US/pippki.properties
index 904f9f536ad..1bd0ebb69c7 100644
--- a/mozilla/security/manager/pki/resources/locale/en-US/pippki.properties
+++ b/mozilla/security/manager/pki/resources/locale/en-US/pippki.properties
@@ -92,3 +92,5 @@ devinfo_stat_unitialized=Unitialized
 devinfo_stat_notloggedin=Not Logged In
 devinfo_stat_loggedin=Logged In
 devinfo_stat_ready=Ready
+enable_fips=Enable FIPS
+disable_fips=Disable FIPS
diff --git a/mozilla/security/manager/ssl/public/nsIPKCS11Slot.idl b/mozilla/security/manager/ssl/public/nsIPKCS11Slot.idl
index e934bd11b2f..33634176b09 100644
--- a/mozilla/security/manager/ssl/public/nsIPKCS11Slot.idl
+++ b/mozilla/security/manager/ssl/public/nsIPKCS11Slot.idl
@@ -94,5 +94,8 @@ interface nsIPKCS11ModuleDB : nsISupports
 
   nsIEnumerator listModules();
 
+  void toggleFIPSMode();
+
+  readonly attribute boolean isFIPSEnabled;
 };
 
diff --git a/mozilla/security/manager/ssl/src/nsPKCS11Slot.cpp b/mozilla/security/manager/ssl/src/nsPKCS11Slot.cpp
index bfca7366102..8187d05c25a 100644
--- a/mozilla/security/manager/ssl/src/nsPKCS11Slot.cpp
+++ b/mozilla/security/manager/ssl/src/nsPKCS11Slot.cpp
@@ -347,3 +347,32 @@ nsPKCS11ModuleDB::ListModules(nsIEnumerator **_retval)
   return rv;
 }
 
+/* void toggleFIPSMode (); */
+NS_IMETHODIMP nsPKCS11ModuleDB::ToggleFIPSMode()
+{
+  // The way to toggle FIPS mode in NSS is extremely obscure.
+  // Basically, we delete the internal module, and voila it
+  // gets replaced with the opposite module, ie if it was 
+  // FIPS before, then it becomes non-FIPS next.
+  SECMODModule *internal;
+
+  // This function returns us a pointer to a local copy of 
+  // the internal module stashed in NSS.  We don't want to
+  // delete it since it will cause much pain in NSS.
+  internal = SECMOD_GetInternalModule();
+  if (!internal)
+    return NS_ERROR_FAILURE;
+
+  SECStatus srv = SECMOD_DeleteInternalModule(internal->commonName);
+  if (srv != SECSuccess)
+    return NS_ERROR_FAILURE;
+
+  return NS_OK;
+}
+
+/* readonly attribute boolean isFIPSEnabled; */
+NS_IMETHODIMP nsPKCS11ModuleDB::GetIsFIPSEnabled(PRBool *aIsFIPSEnabled)
+{
+  *aIsFIPSEnabled = PK11_IsFIPS();
+  return NS_OK;
+}