From c9fe358c5ae034c0f35c379ef488f61e286cd712 Mon Sep 17 00:00:00 2001 From: "jpierre%netscape.com" Date: Thu, 3 Oct 2002 03:35:32 +0000 Subject: [PATCH] Fix for 164744 - implement new functions for pk12util . r=wtc git-svn-id: svn://10.0.0.236/trunk@131051 18797224-902f-48f8-a5cc-f745e15eee43 --- mozilla/security/nss/cmd/pk12util/pk12util.c | 59 ++++---------------- mozilla/security/nss/lib/certdb/cert.h | 13 ++++- mozilla/security/nss/lib/certdb/certdb.c | 41 +++++++++++++- mozilla/security/nss/lib/certdb/certt.h | 3 +- mozilla/security/nss/lib/certhigh/certhigh.c | 30 +--------- mozilla/security/nss/lib/nss/nss.def | 2 + 6 files changed, 69 insertions(+), 79 deletions(-) diff --git a/mozilla/security/nss/cmd/pk12util/pk12util.c b/mozilla/security/nss/cmd/pk12util/pk12util.c index ddeaa1a7c4f..d0ba98ee827 100644 --- a/mozilla/security/nss/cmd/pk12util/pk12util.c +++ b/mozilla/security/nss/cmd/pk12util/pk12util.c @@ -552,38 +552,6 @@ p12u_WriteToExportFile(void *arg, const char *buf, unsigned long len) } } -static SECStatus -cert_UserCertsOnly(CERTCertList *certList) -{ - CERTCertListNode *node, *freenode; - CERTCertificate *cert; - PRUint32 numusercerts = 0; - - node = CERT_LIST_HEAD(certList); - - while ( ! CERT_LIST_END(node, certList) ) { - cert = node->cert; - if ( !( cert->trust->sslFlags & CERTDB_USER ) && - !( cert->trust->emailFlags & CERTDB_USER ) && - !( cert->trust->objectSigningFlags & CERTDB_USER ) ) { - /* Not a User Cert, so remove this cert from the list */ - freenode = node; - node = CERT_LIST_NEXT(node); - CERT_RemoveCertListNode(freenode); - } else { - /* Is a User cert, so leave it in the list */ - node = CERT_LIST_NEXT(node); - numusercerts ++; - } - } - - if (numusercerts) { - return(SECSuccess); - } else { - return(SECFailure); - } -} - void P12U_ExportPKCS12Object(char *nn, char *outfile, PK11SlotInfo *inSlot, secuPWData *slotPw, secuPWData *p12FilePw) @@ -609,10 +577,11 @@ P12U_ExportPKCS12Object(char *nn, char *outfile, PK11SlotInfo *inSlot, return; } - if (SECSuccess != cert_UserCertsOnly(certlist)) { - SECU_PrintError(progName,"find user certs from nickname failed"); + if ((SECSuccess != CERT_FilterCertListForUserCerts(certlist)) || + CERT_LIST_EMPTY(certlist)) { + SECU_PrintError(progName,"no user certs from given nickname"); pk12uErrno = PK12UERR_FINDCERTBYNN; - return; + goto loser; } /* Password to use for PKCS12 file. */ @@ -689,10 +658,11 @@ P12U_ExportPKCS12Object(char *nn, char *outfile, PK11SlotInfo *inSlot, pk12uErrno = PK12UERR_ADDCERTKEY; goto loser; } - CERT_DestroyCertificate(cert); - node->cert = NULL; } + CERT_DestroyCertList(certlist); + certlist = NULL; + if(SEC_PKCS12Encode(p12ecx, p12u_WriteToExportFile, p12cxt) != SECSuccess) { SECU_PrintError(progName,"PKCS12 encode failed"); @@ -710,17 +680,10 @@ P12U_ExportPKCS12Object(char *nn, char *outfile, PK11SlotInfo *inSlot, loser: SEC_PKCS12DestroyExportContext(p12ecx); - for (node = CERT_LIST_HEAD(certlist);!CERT_LIST_END(node,certlist);node=CERT_LIST_NEXT(node)) - { - CERTCertificate* cert = node->cert; - if (!node->cert) { - continue; - } - - if(cert) { - CERT_DestroyCertificate(cert); - } - } + if (certlist) { + CERT_DestroyCertList(certlist); + certlist = NULL; + } if (slotPw) PR_Free(slotPw->data); diff --git a/mozilla/security/nss/lib/certdb/cert.h b/mozilla/security/nss/lib/certdb/cert.h index d7a64b6bf08..2fb81573fae 100644 --- a/mozilla/security/nss/lib/certdb/cert.h +++ b/mozilla/security/nss/lib/certdb/cert.h @@ -34,7 +34,7 @@ /* * cert.h - public data structures and prototypes for the certificate library * - * $Id: cert.h,v 1.22 2002-09-23 21:31:35 wtc%netscape.com Exp $ + * $Id: cert.h,v 1.23 2002-10-03 03:34:35 jpierre%netscape.com Exp $ */ #ifndef _CERT_H_ @@ -968,6 +968,11 @@ CERT_DupCertList(CERTCertificateList * oldList); extern void CERT_DestroyCertificateList(CERTCertificateList *list); +/* is cert a user cert ? ie. does it have CERTDB_USER trust, + ie. a private key + */ +PRBool CERT_IsUserCert(CERTCertificate* cert); + /* is cert a newer than cert b? */ PRBool CERT_IsNewer(CERTCertificate *certa, CERTCertificate *certb); @@ -1241,6 +1246,12 @@ SECStatus CERT_FilterCertListByCANames(CERTCertList *certList, int nCANames, char **caNames, SECCertUsage usage); +/* + * Filter a list of certificates, removing those certs that aren't user certs + */ +SECStatus +CERT_FilterCertListForUserCerts(CERTCertList *certList); + /* * Collect the nicknames from all certs in a CertList. If the cert is not * valid, append a string to that nickname. diff --git a/mozilla/security/nss/lib/certdb/certdb.c b/mozilla/security/nss/lib/certdb/certdb.c index 57fe08b4798..87466a037b2 100644 --- a/mozilla/security/nss/lib/certdb/certdb.c +++ b/mozilla/security/nss/lib/certdb/certdb.c @@ -34,7 +34,7 @@ /* * Certificate handling code * - * $Id: certdb.c,v 1.43 2002-10-01 14:32:07 ian.mcgreer%sun.com Exp $ + * $Id: certdb.c,v 1.44 2002-10-03 03:34:36 jpierre%netscape.com Exp $ */ #include "nssilock.h" @@ -2603,6 +2603,45 @@ loser: return(SECFailure); } +PRBool CERT_IsUserCert(CERTCertificate* cert) +{ + if ( (cert->trust->sslFlags & CERTDB_USER ) || + (cert->trust->emailFlags & CERTDB_USER ) || + (cert->trust->objectSigningFlags & CERTDB_USER ) ) { + return PR_TRUE; + } else { + return PR_FALSE; + } +} + +SECStatus +CERT_FilterCertListForUserCerts(CERTCertList *certList) +{ + CERTCertListNode *node, *freenode; + CERTCertificate *cert; + + if (!certList) { + return SECFailure; + } + + node = CERT_LIST_HEAD(certList); + + while ( ! CERT_LIST_END(node, certList) ) { + cert = node->cert; + if ( PR_TRUE != CERT_IsUserCert(cert) ) { + /* Not a User Cert, so remove this cert from the list */ + freenode = node; + node = CERT_LIST_NEXT(node); + CERT_RemoveCertListNode(freenode); + } else { + /* Is a User cert, so leave it in the list */ + node = CERT_LIST_NEXT(node); + } + } + + return(SECSuccess); +} + static PZLock *certRefCountLock = NULL; /* diff --git a/mozilla/security/nss/lib/certdb/certt.h b/mozilla/security/nss/lib/certdb/certt.h index dc1a74b54a1..de1ec98f389 100644 --- a/mozilla/security/nss/lib/certdb/certt.h +++ b/mozilla/security/nss/lib/certdb/certt.h @@ -33,7 +33,7 @@ /* * certt.h - public data structures for the certificate library * - * $Id: certt.h,v 1.21 2002-10-01 14:32:09 ian.mcgreer%sun.com Exp $ + * $Id: certt.h,v 1.22 2002-10-03 03:34:36 jpierre%netscape.com Exp $ */ #ifndef _CERTT_H_ #define _CERTT_H_ @@ -371,6 +371,7 @@ struct CERTCertListStr { #define CERT_LIST_HEAD(l) ((CERTCertListNode *)PR_LIST_HEAD(&l->list)) #define CERT_LIST_NEXT(n) ((CERTCertListNode *)n->links.next) #define CERT_LIST_END(n,l) (((void *)n) == ((void *)&l->list)) +#define CERT_LIST_EMPTY(l) CERT_LIST_END(CERT_LIST_HEAD(l), l) struct CERTCrlEntryStr { SECItem serialNumber; diff --git a/mozilla/security/nss/lib/certhigh/certhigh.c b/mozilla/security/nss/lib/certhigh/certhigh.c index f3ab3a1bfb6..3b818d37028 100644 --- a/mozilla/security/nss/lib/certhigh/certhigh.c +++ b/mozilla/security/nss/lib/certhigh/certhigh.c @@ -89,32 +89,6 @@ CERT_MatchNickname(char *name1, char *name2) { return PR_TRUE; } -static SECStatus -cert_UserCertsOnly(CERTCertList *certList) -{ - CERTCertListNode *node, *freenode; - CERTCertificate *cert; - - node = CERT_LIST_HEAD(certList); - - while ( ! CERT_LIST_END(node, certList) ) { - cert = node->cert; - if ( !( cert->trust->sslFlags & CERTDB_USER ) && - !( cert->trust->emailFlags & CERTDB_USER ) && - !( cert->trust->objectSigningFlags & CERTDB_USER ) ) { - /* Not a User Cert, so remove this cert from the list */ - freenode = node; - node = CERT_LIST_NEXT(node); - CERT_RemoveCertListNode(freenode); - } else { - /* Is a User cert, so leave it in the list */ - node = CERT_LIST_NEXT(node); - } - } - - return(SECSuccess); -} - /* * Find all user certificates that match the given criteria. * @@ -181,7 +155,7 @@ CERT_FindUserCertsByUsage(CERTCertDBHandle *handle, certList = CERT_CreateSubjectCertList(certList, handle, &cert->derSubject, time, validOnly); - cert_UserCertsOnly(certList); + CERT_FilterCertListForUserCerts(certList); /* drop the extra reference */ CERT_DestroyCertificate(cert); @@ -312,7 +286,7 @@ CERT_FindUserCertByUsage(CERTCertDBHandle *handle, certList = CERT_CreateSubjectCertList(certList, handle, &cert->derSubject, time, validOnly); - cert_UserCertsOnly(certList); + CERT_FilterCertListForUserCerts(certList); /* drop the extra reference */ CERT_DestroyCertificate(cert); diff --git a/mozilla/security/nss/lib/nss/nss.def b/mozilla/security/nss/lib/nss/nss.def index 6d19fcaf986..d4c5d1c9132 100644 --- a/mozilla/security/nss/lib/nss/nss.def +++ b/mozilla/security/nss/lib/nss/nss.def @@ -691,8 +691,10 @@ CERT_DecodeOCSPResponse; CERT_DestroyOCSPCertID; CERT_DestroyOCSPRequest; CERT_EncodeOCSPRequest; +CERT_FilterCertListForUserCerts; CERT_GetOCSPResponseStatus; CERT_GetOCSPStatusForCertID; +CERT_IsUserCert; CERT_RemoveCertListNode; CERT_VerifyCACertForUsage; CERT_VerifyCertificate;