5ad42b1b1469908fabc0099764182e9ecbc04ddaSurya Prakki

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <sys/types.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <sys/stat.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <errno.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <fcntl.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <synch.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <kmfapiP.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <ber_der.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/nss.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/cert.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/certdb.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/secoid.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/secder.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/secerr.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/cryptohi.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/keyhi.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/keythi.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/pk11func.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/pk11pqg.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/pkcs12.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/p12plcy.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/prerror.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#define NSS_OK 0

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysmutex_t init_lock = DEFAULTMUTEX;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic int nss_initialized = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysNSS_ConfigureKeystore(KMF_HANDLE_T, int, KMF_ATTRIBUTE *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysNSS_FindCert(KMF_HANDLE_T, int, KMF_ATTRIBUTE *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_FreeKMFCert(KMF_HANDLE_T, KMF_X509_DER_CERT *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysNSS_StoreCert(KMF_HANDLE_T, int, KMF_ATTRIBUTE *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysNSS_ImportCert(KMF_HANDLE_T, int, KMF_ATTRIBUTE *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysNSS_DeleteCert(KMF_HANDLE_T, int, KMF_ATTRIBUTE *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysNSS_CreateKeypair(KMF_HANDLE_T, int, KMF_ATTRIBUTE *);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysNSS_StoreKey(KMF_HANDLE_T, int, KMF_ATTRIBUTE *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_EncodePubKeyData(KMF_HANDLE_T, KMF_KEY_HANDLE *, KMF_DATA *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_SignData(KMF_HANDLE_T, KMF_KEY_HANDLE *, KMF_OID *,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_DATA *, KMF_DATA *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysNSS_ImportCRL(KMF_HANDLE_T, int, KMF_ATTRIBUTE *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysNSS_DeleteCRL(KMF_HANDLE_T, int, KMF_ATTRIBUTE *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysNSS_FindCRL(KMF_HANDLE_T, int, KMF_ATTRIBUTE *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysNSS_FindKey(KMF_HANDLE_T, int, KMF_ATTRIBUTE *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysNSS_FindCertInCRL(KMF_HANDLE_T, int, KMF_ATTRIBUTE *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_GetErrorString(KMF_HANDLE_T, char **);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysNSS_DeleteKey(KMF_HANDLE_T, int, KMF_ATTRIBUTE *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysNSS_FindPrikeyByCert(KMF_HANDLE_T, int, KMF_ATTRIBUTE *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_DecryptData(KMF_HANDLE_T, KMF_KEY_HANDLE *, KMF_OID *,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_DATA *, KMF_DATA *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysNSS_ExportPK12(KMF_HANDLE_T, int, KMF_ATTRIBUTE *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysNSS_CreateSymKey(KMF_HANDLE_T, int, KMF_ATTRIBUTE *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_GetSymKeyValue(KMF_HANDLE_T, KMF_KEY_HANDLE *, KMF_RAW_SYM_KEY *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysNSS_SetTokenPin(KMF_HANDLE_T, int, KMF_ATTRIBUTE *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysKMF_PLUGIN_FUNCLIST nss_plugin_table =

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys 1, /* Version */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_ConfigureKeystore,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_FindCert,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_FreeKMFCert,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_StoreCert,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_ImportCert,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_ImportCRL,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_DeleteCert,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_DeleteCRL,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_CreateKeypair,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_FindKey,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_EncodePubKeyData,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_SignData,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_DeleteKey,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NULL /* ListCRL */,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_FindCRL,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_FindCertInCRL,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_GetErrorString,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys NSS_FindPrikeyByCert,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_DecryptData,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys NSS_ExportPK12,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_CreateSymKey,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_GetSymKeyValue,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_SetTokenPin,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys NSS_StoreKey,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NULL /* Finalize */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys};

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllystypedef struct p12uContextStr {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys char *filename; /* name of file */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PRFileDesc *file; /* pointer to file */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PRBool error; /* error occurred? */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys int errorValue; /* which error occurred? */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys} p12uContext;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#define SET_ERROR(h, c) h->lasterr.kstype = KMF_KEYSTORE_NSS; \

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys h->lasterr.errcode = c;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysKMF_PLUGIN_FUNCLIST *

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysKMF_Plugin_Initialize()

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

5ad42b1b1469908fabc0099764182e9ecbc04ddaSurya Prakki (void) SEC_PKCS12EnableCipher(PKCS12_RC4_40, 1);

5ad42b1b1469908fabc0099764182e9ecbc04ddaSurya Prakki (void) SEC_PKCS12EnableCipher(PKCS12_RC4_128, 1);

5ad42b1b1469908fabc0099764182e9ecbc04ddaSurya Prakki (void) SEC_PKCS12EnableCipher(PKCS12_RC2_CBC_40, 1);

5ad42b1b1469908fabc0099764182e9ecbc04ddaSurya Prakki (void) SEC_PKCS12EnableCipher(PKCS12_RC2_CBC_128, 1);

5ad42b1b1469908fabc0099764182e9ecbc04ddaSurya Prakki (void) SEC_PKCS12EnableCipher(PKCS12_DES_56, 1);

5ad42b1b1469908fabc0099764182e9ecbc04ddaSurya Prakki (void) SEC_PKCS12EnableCipher(PKCS12_DES_EDE3_168, 1);

5ad42b1b1469908fabc0099764182e9ecbc04ddaSurya Prakki (void) SEC_PKCS12SetPreferredCipher(PKCS12_DES_EDE3_168, 1);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (&nss_plugin_table);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic char *

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysnss_getpassword(PK11SlotInfo *slot, PRBool retry, void *arg)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (retry)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (NULL);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (arg != NULL)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return ((char *)strdup(arg));

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys else

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (NULL);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic KMF_RETURN

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysnss_authenticate(KMF_HANDLE_T handle,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11SlotInfo *nss_slot, KMF_CREDENTIAL *cred)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECStatus nssrv = SECSuccess;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_HANDLE *kmfh = (KMF_HANDLE *)handle;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* If a password was given, try to login to the slot */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (cred == NULL || cred->cred == NULL || cred->credlen == 0 ||

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys nss_slot == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (PK11_IsLoggedIn(nss_slot, NULL)) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_OK);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_SetPasswordFunc(nss_getpassword);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys nssrv = PK11_Authenticate(nss_slot, PR_TRUE, (void *)cred->cred);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nssrv != SECSuccess) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, nssrv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_FreeSlot(nss_slot);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_AUTH_FAILED);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_OK);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic SECStatus

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysInit_NSS_DBs(const char *configdir,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys const char *certPrefix,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys const char *keyPrefix,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys const char *secmodName)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECStatus rv = NSS_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) mutex_lock(&init_lock);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* If another thread already did it, return OK. */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_initialized) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) mutex_unlock(&init_lock);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (SECSuccess);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = NSS_Initialize((configdir && strlen(configdir)) ?

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys configdir : "./", certPrefix, keyPrefix,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys secmodName ? secmodName : "secmod.db", NSS_INIT_COOPERATE);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != SECSuccess) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto end;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nss_initialized++;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysend:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) mutex_unlock(&init_lock);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysNSS_ConfigureKeystore(KMF_HANDLE_T handle,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys int numattr, KMF_ATTRIBUTE *attrlist)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN rv = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_HANDLE *kmfh = (KMF_HANDLE *)handle;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys char *configdir;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys char *certPrefix;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys char *keyPrefix;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys char *secModName;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys configdir = kmf_get_attr_ptr(KMF_DIRPATH_ATTR, attrlist, numattr);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys certPrefix = kmf_get_attr_ptr(KMF_CERTPREFIX_ATTR, attrlist, numattr);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys keyPrefix = kmf_get_attr_ptr(KMF_KEYPREFIX_ATTR, attrlist, numattr);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys secModName = kmf_get_attr_ptr(KMF_SECMODNAME_ATTR, attrlist, numattr);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) mutex_lock(&init_lock);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_initialized == 0) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECStatus err;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) mutex_unlock(&init_lock);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys err = Init_NSS_DBs(configdir, certPrefix,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys keyPrefix, secModName);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (err != SECSuccess) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, err);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_INTERNAL);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_KEYSTORE_ALREADY_INITIALIZED;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) mutex_unlock(&init_lock);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysdo_nss_init(void *handle, int numattr,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys KMF_ATTRIBUTE *attrlist,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys boolean_t internal_slot_only,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11SlotInfo **nss_slot)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys KMF_RETURN rv = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_HANDLE *kmfh = (KMF_HANDLE *)handle;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys char *slotlabel = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (!nss_initialized)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_PLUGIN_INIT);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys slotlabel = kmf_get_attr_ptr(KMF_TOKEN_LABEL_ATTR, attrlist, numattr);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /*

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (slotlabel == NULL ||

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys strcmp(slotlabel, "internal") == 0) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *nss_slot = PK11_GetInternalKeySlot();

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else if (internal_slot_only == TRUE) {

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = KMF_ERR_SLOTNAME;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys goto end;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys *nss_slot = PK11_FindSlotByName(slotlabel);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (*nss_slot == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, PORT_GetError());

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = KMF_ERR_SLOTNAME;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys goto end;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /*

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (PK11_NeedUserInit(*nss_slot)) {

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = KMF_ERR_UNINITIALIZED_TOKEN;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysend:

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic KMF_RETURN

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysnss2kmf_cert(CERTCertificate *nss_cert, KMF_X509_DER_CERT *kmf_cert)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys kmf_cert->kmf_private.keystore_type = KMF_KEYSTORE_NSS;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys kmf_cert->kmf_private.flags = KMF_FLAG_CERT_VALID;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys kmf_cert->certificate.Length = nss_cert->derCert.len;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if ((kmf_cert->certificate.Data = malloc(nss_cert->derCert.len)) ==

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys kmf_cert->certificate.Length = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_MEMORY);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) memcpy(kmf_cert->certificate.Data, nss_cert->derCert.data,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys nss_cert->derCert.len);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_cert->nickname != NULL)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys kmf_cert->kmf_private.label =

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys (char *)strdup(nss_cert->nickname);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_OK);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic KMF_RETURN

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysnss_getcert_by_label(KMF_HANDLE *kmfh,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys char *name, KMF_X509_DER_CERT *kmf_cert,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys uint32_t *num_certs, KMF_CERT_VALIDITY find_criteria)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN rv = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertificate *nss_cert;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECCertTimeValidity validity;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nss_cert = PK11_FindCertFromNickname(name, NULL);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_cert == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *num_certs = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, PORT_GetError());

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *num_certs = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_CERT_NOT_FOUND);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *num_certs = 1;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys switch (find_criteria) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys case KMF_ALL_CERTS:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys break;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys case KMF_NONEXPIRED_CERTS:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys validity = CERT_CheckCertValidTimes(nss_cert, PR_Now(),

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys PR_FALSE);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (validity != secCertTimeValid) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* this is an invalid cert, reject it */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *num_certs = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERT_DestroyCertificate(nss_cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_OK);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys break;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys case KMF_EXPIRED_CERTS:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys validity = CERT_CheckCertValidTimes(nss_cert, PR_Now(),

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys PR_FALSE);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (validity == secCertTimeValid) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* this is a valid cert, reject it in this case. */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *num_certs = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERT_DestroyCertificate(nss_cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_OK);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys break;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys default:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (kmf_cert != NULL)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = nss2kmf_cert(nss_cert, kmf_cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* We copied the data we need, so cleanup the internal record */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERT_DestroyCertificate(nss_cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *num_certs = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic KMF_RETURN

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysnss_find_matching_certs(PK11SlotInfo *slot,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys char *issuer, char *subject, KMF_BIGINT *serial,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertList **certlist, KMF_CERT_VALIDITY find_criteria)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN rv = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECStatus ret;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertList *list;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertListNode *node;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_X509_NAME issuerDN, subjectDN;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys boolean_t findIssuer = FALSE;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys boolean_t findSubject = FALSE;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys boolean_t findSerial = FALSE;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (issuer != NULL && strlen(issuer)) {

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = kmf_dn_parser(issuer, &issuerDN);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys findIssuer = TRUE;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (subject != NULL && strlen(subject)) {

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = kmf_dn_parser(subject, &subjectDN);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys findSubject = TRUE;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (serial != 0 && serial->val != NULL && serial->len > 0)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys findSerial = TRUE;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys list = PK11_ListCertsInSlot(slot);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (list) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys node = CERT_LIST_HEAD(list);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys while (!CERT_LIST_END(node, list)) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_X509_NAME cmpDN;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_DATA der;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys boolean_t match;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertListNode *freenode;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (findIssuer) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys der.Data = node->cert->derIssuer.data;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys der.Length = node->cert->derIssuer.len;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = DerDecodeName(&der, &cmpDN);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv == KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys match = !KMF_CompareRDNs(&issuerDN,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys &cmpDN);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_free_dn(&cmpDN);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (!match)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto delete_and_cont;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto delete_and_cont;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (findSubject) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys der.Data = node->cert->derSubject.data;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys der.Length = node->cert->derSubject.len;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = DerDecodeName(&der, &cmpDN);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv == KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys match = !KMF_CompareRDNs(&subjectDN,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys &cmpDN);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_free_dn(&cmpDN);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (!match)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto delete_and_cont;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto delete_and_cont;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (findSerial) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECItem *sernum;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys sernum = &node->cert->serialNumber;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (serial->len != sernum->len)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto delete_and_cont;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (memcmp(sernum->data, serial->val,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys serial->len))

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto delete_and_cont;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* select the certs using find criteria */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys switch (find_criteria) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys case KMF_ALL_CERTS:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys break;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys case KMF_NONEXPIRED_CERTS:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = CERT_CertTimesValid(node->cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (ret == SECFailure) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* this is an invalid cert */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto skip;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys break;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys case KMF_EXPIRED_CERTS:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = CERT_CertTimesValid(node->cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (ret != SECFailure) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* this is a valid cert */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto skip;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys break;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysskip:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys node = CERT_LIST_NEXT(node);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys continue;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysdelete_and_cont:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys freenode = node;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys node = CERT_LIST_NEXT(node);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERT_RemoveCertListNode(freenode);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv == KMF_OK && certlist != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *certlist = list;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERT_DestroyCertList(list);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic KMF_RETURN

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysconvertCertList(void *kmfhandle,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertList *nsscerts, KMF_X509_DER_CERT *kmfcerts,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys uint32_t *numcerts)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN rv = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertListNode *node;

f482c776bc557f0256e776932c7842b9db390de1wyllys uint32_t maxcerts = *numcerts;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys maxcerts = *numcerts;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (maxcerts == 0)

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys maxcerts = 0xFFFFFFFF;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *numcerts = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys /*

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys for (node = CERT_LIST_HEAD(nsscerts);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys !CERT_LIST_END(node, nsscerts) && rv == KMF_OK &&

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys (*numcerts) < maxcerts;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys node = CERT_LIST_NEXT(node), (*numcerts)++) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (kmfcerts != NULL)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = nss2kmf_cert(node->cert, &kmfcerts[*numcerts]);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /*

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys int i;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys for (i = 0; i < *numcerts; i++)

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmf_free_kmf_cert(kmfhandle, &kmfcerts[i]);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

f482c776bc557f0256e776932c7842b9db390de1wyllys *numcerts = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysNSS_FindCert(KMF_HANDLE_T handle, int numattr, KMF_ATTRIBUTE *attrlist)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN rv = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_HANDLE *kmfh = (KMF_HANDLE *)handle;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11SlotInfo *nss_slot = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertList *certlist = NULL;

f482c776bc557f0256e776932c7842b9db390de1wyllys uint32_t maxcerts;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys uint32_t *num_certs;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys KMF_X509_DER_CERT *kmfcerts = NULL;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys char *certlabel = NULL;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys char *issuer = NULL;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys char *subject = NULL;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys KMF_BIGINT *serial = NULL;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys KMF_CERT_VALIDITY validity;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (handle == NULL || attrlist == NULL || numattr == 0) {

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = do_nss_init(handle, numattr, attrlist, FALSE, &nss_slot);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (rv != KMF_OK)

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys num_certs = kmf_get_attr_ptr(KMF_COUNT_ATTR, attrlist, numattr);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (num_certs == NULL)

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys return (KMF_ERR_BAD_PARAMETER);

f482c776bc557f0256e776932c7842b9db390de1wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys maxcerts = *num_certs;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (maxcerts == 0)

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys maxcerts = 0xFFFFFFFF;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *num_certs = 0;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys /* Get the optional returned certificate list */

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys kmfcerts = kmf_get_attr_ptr(KMF_X509_DER_CERT_ATTR, attrlist, numattr);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys /* Get optional search criteria attributes */

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys certlabel = kmf_get_attr_ptr(KMF_CERT_LABEL_ATTR, attrlist, numattr);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys issuer = kmf_get_attr_ptr(KMF_ISSUER_NAME_ATTR, attrlist, numattr);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys subject = kmf_get_attr_ptr(KMF_SUBJECT_NAME_ATTR, attrlist, numattr);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys serial = kmf_get_attr_ptr(KMF_BIGINT_ATTR, attrlist, numattr);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = kmf_get_attr(KMF_CERT_VALIDITY_ATTR, attrlist, numattr,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys &validity, NULL);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (rv != KMF_OK) {

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys validity = KMF_ALL_CERTS;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = KMF_OK;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys }

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (certlabel != NULL) {

f482c776bc557f0256e776932c7842b9db390de1wyllys /* This will only find 1 certificate */

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = nss_getcert_by_label(kmfh, certlabel, kmfcerts, num_certs,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys validity);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

f482c776bc557f0256e776932c7842b9db390de1wyllys /*

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = nss_find_matching_certs(nss_slot, issuer, subject, serial,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys &certlist, validity);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

f482c776bc557f0256e776932c7842b9db390de1wyllys /*

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv == KMF_OK && certlist != NULL) {

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = convertCertList(handle, certlist, kmfcerts,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys &maxcerts);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERT_DestroyCertList(certlist);

f482c776bc557f0256e776932c7842b9db390de1wyllys if (rv == KMF_OK)

f482c776bc557f0256e776932c7842b9db390de1wyllys *num_certs = maxcerts;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_slot != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_FreeSlot(nss_slot);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv == KMF_OK && *num_certs == 0)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_ERR_CERT_NOT_FOUND;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_FreeKMFCert(KMF_HANDLE_T handle,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_X509_DER_CERT *kmf_cert)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (kmf_cert != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (kmf_cert->certificate.Data != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys free(kmf_cert->certificate.Data);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys kmf_cert->certificate.Data = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys kmf_cert->certificate.Length = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (kmf_cert->kmf_private.label != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys free(kmf_cert->kmf_private.label);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys kmf_cert->kmf_private.label = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysNSS_DeleteCert(KMF_HANDLE_T handle, int numattr, KMF_ATTRIBUTE *attrlist)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN rv = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys int nssrv;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_HANDLE *kmfh = (KMF_HANDLE *)handle;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertificate *cert = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11SlotInfo *nss_slot = NULL;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys char *certlabel = NULL;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys char *issuer = NULL;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys char *subject = NULL;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys KMF_BIGINT *serial = NULL;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys KMF_CERT_VALIDITY validity;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (handle == NULL || attrlist == NULL || numattr == 0) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = do_nss_init(handle, numattr, attrlist, FALSE, &nss_slot);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (rv != KMF_OK)

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys return (rv);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys /* Get the search criteria attributes. They are all optional. */

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys certlabel = kmf_get_attr_ptr(KMF_CERT_LABEL_ATTR, attrlist, numattr);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys issuer = kmf_get_attr_ptr(KMF_ISSUER_NAME_ATTR, attrlist, numattr);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys subject = kmf_get_attr_ptr(KMF_SUBJECT_NAME_ATTR, attrlist, numattr);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys serial = kmf_get_attr_ptr(KMF_BIGINT_ATTR, attrlist, numattr);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = kmf_get_attr(KMF_CERT_VALIDITY_ATTR, attrlist, numattr,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys &validity, NULL);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK) {

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys validity = KMF_ALL_CERTS;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys /* Start finding the matched certificates and delete them. */

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (certlabel != NULL) {

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys cert = PK11_FindCertFromNickname(certlabel, NULL);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (cert == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_CERT_NOT_FOUND);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys switch (validity) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys case KMF_ALL_CERTS:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys break;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys case KMF_NONEXPIRED_CERTS:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nssrv = CERT_CertTimesValid(cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nssrv == SECFailure) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* this is an invalid cert - skip it */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto out;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys break;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys case KMF_EXPIRED_CERTS:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nssrv = CERT_CertTimesValid(cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nssrv != SECFailure) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* this is a valid cert - skip it */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto out;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys break;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* delete it from database */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nssrv = SEC_DeletePermCertificate(cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nssrv) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, nssrv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_ERR_INTERNAL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertListNode *node;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertList *certlist = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = nss_find_matching_certs(nss_slot, issuer, subject, serial,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys &certlist, validity);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys for (node = CERT_LIST_HEAD(certlist);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys !CERT_LIST_END(node, certlist) && rv == KMF_OK;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys node = CERT_LIST_NEXT(node)) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nssrv = SEC_DeletePermCertificate(node->cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nssrv) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, nssrv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_ERR_INTERNAL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv == KMF_OK && certlist != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERT_DestroyCertList(certlist);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else if (rv == KMF_OK && certlist == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_ERR_CERT_NOT_FOUND;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysout:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_slot != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_FreeSlot(nss_slot);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (cert != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERT_DestroyCertificate(cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic void

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysInitRandom(char *filename)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys char buf[2048];

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys int fd;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PRInt32 count;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys fd = open(filename, O_RDONLY);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (!fd)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys count = read(fd, buf, sizeof (buf));

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (count > 0) {

5ad42b1b1469908fabc0099764182e9ecbc04ddaSurya Prakki (void) PK11_RandomUpdate(buf, count);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) close(fd);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_CreateKeypair(KMF_HANDLE_T handle,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys int numattr, KMF_ATTRIBUTE *attrlist)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN rv = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_HANDLE *kmfh = (KMF_HANDLE *)handle;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys PK11RSAGenParams rsaparams;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys void *nssparams;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CK_MECHANISM_TYPE mechanism;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ulong_t publicExponent = 0x010001;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11SlotInfo *nss_slot = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECKEYPrivateKey *NSSprivkey = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECKEYPublicKey *NSSpubkey = NULL;

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll SECKEYECParams *ecparams = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PQGParams *pqgParams = NULL;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys KMF_CREDENTIAL cred;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys boolean_t storekey = TRUE;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys uint32_t keylen = 1024, len;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys uint32_t keylen_size = sizeof (uint32_t);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys KMF_KEY_ALG keytype = KMF_RSA;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys KMF_KEY_HANDLE *pubkey = NULL;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys KMF_KEY_HANDLE *privkey = NULL;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys char *keylabel = NULL;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (handle == NULL || attrlist == NULL || numattr == 0) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = do_nss_init(handle, numattr, attrlist, FALSE, &nss_slot);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = kmf_get_attr(KMF_CREDENTIAL_ATTR, attrlist, numattr,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys (void *)&cred, NULL);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (rv != KMF_OK)

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys return (rv);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = nss_authenticate(handle, nss_slot, &cred);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys /* "storekey" is optional. Default is TRUE */

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys (void) kmf_get_attr(KMF_STOREKEY_BOOL_ATTR, attrlist, numattr,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys &storekey, NULL);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys /* keytype is optional. KMF_RSA is default */

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys (void) kmf_get_attr(KMF_KEYALG_ATTR, attrlist, numattr,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys (void *)&keytype, NULL);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = kmf_get_attr(KMF_KEYLENGTH_ATTR, attrlist, numattr,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys &keylen, &keylen_size);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (rv == KMF_ERR_ATTR_NOT_FOUND)

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys /* Default keylen = 1024 */

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = KMF_OK;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys else if (rv != KMF_OK)

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys return (KMF_ERR_BAD_PARAMETER);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys pubkey = kmf_get_attr_ptr(KMF_PUBKEY_HANDLE_ATTR, attrlist, numattr);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys privkey = kmf_get_attr_ptr(KMF_PRIVKEY_HANDLE_ATTR, attrlist, numattr);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (pubkey == NULL || privkey == NULL)

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys return (KMF_ERR_BAD_PARAMETER);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys (void) memset(pubkey, 0, sizeof (KMF_KEY_HANDLE));

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys (void) memset(privkey, 0, sizeof (KMF_KEY_HANDLE));

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = kmf_get_attr(KMF_KEYLABEL_ATTR, attrlist, numattr, NULL, &len);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (rv == KMF_OK && len > 0) {

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys keylabel = malloc(len + 1);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (keylabel == NULL)

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys return (KMF_ERR_MEMORY);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys /* Now fill in the label value */

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys (void) memset(keylabel, 0, len + 1);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = kmf_get_attr(KMF_KEYLABEL_ATTR, attrlist, numattr,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys keylabel, NULL);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (rv != KMF_OK) {

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys free(keylabel);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys goto cleanup;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys }

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys }

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* Get some random bits */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys InitRandom("/dev/urandom");

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (keytype == KMF_RSA) {

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys KMF_BIGINT rsaexp;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rsaparams.keySizeInBits = keylen;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /*

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if ((rv = kmf_get_attr(KMF_RSAEXP_ATTR, attrlist, numattr,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys &rsaexp, NULL)) == KMF_OK) {

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (rsaexp.len > 0 &&

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rsaexp.len <= sizeof (publicExponent) &&

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rsaexp.val != NULL) {

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys (void) memcpy(&publicExponent, rsaexp.val,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rsaexp.len);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rsaparams.pe = publicExponent;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys mechanism = CKM_RSA_PKCS_KEY_PAIR_GEN;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nssparams = &rsaparams;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys } else if (keytype == KMF_DSA) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PQGVerify *pqgVerify = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys int ks;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECStatus nssrv, passed;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys mechanism = CKM_DSA_KEY_PAIR_GEN;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys ks = PQG_PBITS_TO_INDEX(keylen);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nssrv = PK11_PQG_ParamGen(ks, &pqgParams, &pqgVerify);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nssrv != SECSuccess) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_PQG_DestroyVerify(pqgVerify);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_ERR_KEYGEN_FAILED;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto cleanup;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nssrv = PK11_PQG_VerifyParams(pqgParams, pqgVerify, &passed);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nssrv != SECSuccess || passed != SECSuccess) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_ERR_KEYGEN_FAILED;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_PQG_DestroyVerify(pqgVerify);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, PORT_GetError());

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto cleanup;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nssparams = pqgParams;

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll } else if (keytype == KMF_ECDSA) {

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll KMF_OID *eccoid = kmf_get_attr_ptr(KMF_ECC_CURVE_OID_ATTR,

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll attrlist, numattr);

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (eccoid == NULL)

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (KMF_ERR_BAD_PARAMETER);

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll ecparams = SECITEM_AllocItem(NULL, NULL, (eccoid->Length));

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (!ecparams)

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll return (KMF_ERR_MEMORY);

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll (void) memcpy(ecparams->data, eccoid->Data, eccoid->Length);

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll mechanism = CKM_EC_KEY_PAIR_GEN;

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll nssparams = ecparams;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_ERR_BAD_PARAMETER;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto cleanup;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys NSSprivkey = PK11_GenerateKeyPair(nss_slot, mechanism, nssparams,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys &NSSpubkey,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys storekey, /* isPermanent */

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys PR_TRUE, /* isSensitive */

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys (void *)cred.cred);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (NSSprivkey == NULL || NSSpubkey == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, PORT_GetError());

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_ERR_KEYGEN_FAILED;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (keylabel != NULL && strlen(keylabel)) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) PK11_SetPrivateKeyNickname(NSSprivkey,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys keylabel);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys (void) PK11_SetPublicKeyNickname(NSSpubkey, keylabel);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* Now, convert it to a KMF_KEY object for the framework */

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys privkey->kstype = KMF_KEYSTORE_NSS;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys privkey->keyalg = keytype;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys privkey->keyclass = KMF_ASYM_PRI;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys privkey->keylabel = PK11_GetPrivateKeyNickname(NSSprivkey);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys privkey->keyp = (void *)NSSprivkey;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys pubkey->kstype = KMF_KEYSTORE_NSS;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys pubkey->keyalg = keytype;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys pubkey->keyp = (void *)NSSpubkey;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys pubkey->keyclass = KMF_ASYM_PUB;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys pubkey->keylabel = PK11_GetPublicKeyNickname(NSSpubkey);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllyscleanup:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (NSSpubkey)

5ad42b1b1469908fabc0099764182e9ecbc04ddaSurya Prakki (void) PK11_DeleteTokenPublicKey(NSSpubkey);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (NSSprivkey)

5ad42b1b1469908fabc0099764182e9ecbc04ddaSurya Prakki (void) PK11_DeleteTokenPrivateKey(NSSprivkey, PR_TRUE);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys privkey->keyp = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys pubkey->keyp = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (keylabel)

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys free(keylabel);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (pqgParams != NULL)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_PQG_DestroyParams(pqgParams);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll if (ecparams != NULL)

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll SECITEM_FreeItem(ecparams, PR_TRUE);

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_slot != NULL)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_FreeSlot(nss_slot);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_SignData(KMF_HANDLE_T handle, KMF_KEY_HANDLE *key,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys KMF_OID *AlgOID, KMF_DATA *tobesigned,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys KMF_DATA *output)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN ret = KMF_OK;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys KMF_ALGORITHM_INDEX AlgId;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECOidTag signAlgTag;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECKEYPrivateKey *NSSprivkey = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECStatus rv;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECItem signed_data;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_HANDLE *kmfh = (KMF_HANDLE *)handle;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys signed_data.data = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (key == NULL || AlgOID == NULL ||

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys tobesigned == NULL || output == NULL ||

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys tobesigned->Data == NULL ||

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys output->Data == NULL)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* Map the OID to a NSS algorithm */

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys AlgId = x509_algoid_to_algid(AlgOID);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (AlgId == KMF_ALGID_NONE)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSSprivkey = (SECKEYPrivateKey *)key->keyp;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (AlgId == KMF_ALGID_MD5WithRSA)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys signAlgTag = SEC_OID_PKCS1_MD5_WITH_RSA_ENCRYPTION;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys else if (AlgId == KMF_ALGID_MD2WithRSA)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys signAlgTag = SEC_OID_PKCS1_MD2_WITH_RSA_ENCRYPTION;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys else if (AlgId == KMF_ALGID_SHA1WithRSA)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys signAlgTag = SEC_OID_PKCS1_SHA1_WITH_RSA_ENCRYPTION;

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll else if (AlgId == KMF_ALGID_SHA256WithRSA)

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll signAlgTag = SEC_OID_PKCS1_SHA256_WITH_RSA_ENCRYPTION;

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll else if (AlgId == KMF_ALGID_SHA384WithRSA)

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll signAlgTag = SEC_OID_PKCS1_SHA384_WITH_RSA_ENCRYPTION;

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll else if (AlgId == KMF_ALGID_SHA512WithRSA)

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll signAlgTag = SEC_OID_PKCS1_SHA512_WITH_RSA_ENCRYPTION;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys else if (AlgId == KMF_ALGID_SHA1WithDSA)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys signAlgTag = SEC_OID_ANSIX9_DSA_SIGNATURE_WITH_SHA1_DIGEST;

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll else if (AlgId == KMF_ALGID_SHA1WithECDSA || AlgId == KMF_ALGID_ECDSA)

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll signAlgTag = SEC_OID_ANSIX962_ECDSA_SIGNATURE_WITH_SHA1_DIGEST;

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll else if (AlgId == KMF_ALGID_SHA256WithECDSA)

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll signAlgTag = SEC_OID_ANSIX962_ECDSA_SHA256_SIGNATURE;

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll else if (AlgId == KMF_ALGID_SHA384WithECDSA)

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll signAlgTag = SEC_OID_ANSIX962_ECDSA_SHA384_SIGNATURE;

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll else if (AlgId == KMF_ALGID_SHA512WithECDSA)

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll signAlgTag = SEC_OID_ANSIX962_ECDSA_SHA512_SIGNATURE;

e65e5c2d2f32a99e8c5f740cabae9075dab03ce7Wyllys Ingersoll else /* NSS does not support DSA with SHA2 hashes (FIPS 186-3) */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = SEC_SignData(&signed_data, tobesigned->Data,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys tobesigned->Length, NSSprivkey, signAlgTag);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != 0) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_INTERNAL);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (signed_data.len <= output->Length) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) memcpy(output->Data, signed_data.data, signed_data.len);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys output->Length = signed_data.len;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys output->Length = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = KMF_ERR_BAD_PARAMETER;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys free(signed_data.data);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (ret);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_EncodePubKeyData(KMF_HANDLE_T handle, KMF_KEY_HANDLE *keyp,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_DATA *encoded)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN ret = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_HANDLE *kmfh = (KMF_HANDLE *)handle;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECItem *rvitem;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTSubjectPublicKeyInfo *spki = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (keyp == NULL || encoded == NULL || keyp->keyp == NULL)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys spki = SECKEY_CreateSubjectPublicKeyInfo(keyp->keyp);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (spki == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, PORT_GetError());

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_MEMORY);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rvitem = SEC_ASN1EncodeItem(NULL, NULL, spki,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys CERT_SubjectPublicKeyInfoTemplate);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rvitem != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys encoded->Data = malloc(rvitem->len);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (encoded->Data == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = KMF_ERR_MEMORY;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) memcpy(encoded->Data, rvitem->data, rvitem->len);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys encoded->Length = rvitem->len;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECITEM_FreeItem(rvitem, TRUE);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, PORT_GetError());

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys encoded->Data = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys encoded->Length = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = KMF_ERR_ENCODING;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECKEY_DestroySubjectPublicKeyInfo(spki);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (ret);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysNSS_DeleteKey(KMF_HANDLE_T handle,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys int numattr, KMF_ATTRIBUTE *attrlist)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN rv = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11SlotInfo *nss_slot = NULL;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys KMF_KEY_HANDLE *key;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys KMF_CREDENTIAL cred;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys boolean_t delete_token = B_TRUE;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (handle == NULL || attrlist == NULL || numattr == 0) {

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys return (KMF_ERR_BAD_PARAMETER);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /*

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys key = kmf_get_attr_ptr(KMF_KEY_HANDLE_ATTR, attrlist, numattr);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (key == NULL || key->keyp == NULL)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = kmf_get_attr(KMF_DESTROY_BOOL_ATTR, attrlist, numattr,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys (void *)&delete_token, NULL);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (rv != KMF_OK)

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys /* "delete_token" is optional. Default is TRUE */

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = KMF_OK;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (delete_token) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECStatus nssrv = SECSuccess;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (key->keyclass != KMF_ASYM_PUB &&

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys key->keyclass != KMF_ASYM_PRI &&

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys key->keyclass != KMF_SYMMETRIC)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_KEY_CLASS);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = do_nss_init(handle, numattr, attrlist, FALSE, &nss_slot);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = kmf_get_attr(KMF_CREDENTIAL_ATTR, attrlist, numattr,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys (void *)&cred, NULL);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (rv != KMF_OK)

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys return (KMF_ERR_BAD_PARAMETER);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = nss_authenticate(handle, nss_slot, &cred);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (key->keyclass == KMF_ASYM_PUB) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nssrv = PK11_DeleteTokenPublicKey(

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys (SECKEYPublicKey *)key->keyp);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else if (key->keyclass == KMF_ASYM_PRI) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nssrv = PK11_DeleteTokenPrivateKey(

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys (SECKEYPrivateKey *)key->keyp, PR_TRUE);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else if (key->keyclass == KMF_SYMMETRIC) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nssrv = PK11_DeleteTokenSymKey(

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys (PK11SymKey *) key->keyp);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nssrv == SECSuccess)

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys PK11_FreeSymKey((PK11SymKey *) key->keyp);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nssrv != SECSuccess) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(handle, PORT_GetError());

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_ERR_INTERNAL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (key->keyclass == KMF_ASYM_PUB) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECKEY_DestroyPublicKey((SECKEYPublicKey *)key->keyp);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else if (key->keyclass == KMF_ASYM_PRI) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECKEY_DestroyPrivateKey((SECKEYPrivateKey *)key->keyp);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else if (key->keyclass == KMF_SYMMETRIC) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_FreeSymKey((PK11SymKey *) key->keyp);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_KEY_CLASS);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys key->keyp = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysNSS_GetErrorString(KMF_HANDLE_T handle, char **msgstr)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN ret = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_HANDLE *kmfh = (KMF_HANDLE *)handle;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys char *str;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys /* Get the error string in the default language */

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys str = (char *)PR_ErrorToName((PRErrorCode)kmfh->lasterr.errcode);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (str != NULL) {

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys *msgstr = (char *)strdup(str);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if ((*msgstr) == NULL)

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys ret = KMF_ERR_MEMORY;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys } else {

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys *msgstr = NULL;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys }

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys return (ret);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys}

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllysNSS_FindPrikeyByCert(KMF_HANDLE_T handle, int numattr, KMF_ATTRIBUTE *attrlist)

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys{

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys KMF_RETURN rv = KMF_OK;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys KMF_HANDLE *kmfh = (KMF_HANDLE *)handle;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11SlotInfo *nss_slot = NULL;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys KMF_CREDENTIAL cred;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys KMF_KEY_HANDLE *key = NULL;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys KMF_DATA *cert = NULL;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys CERTCertificate *nss_cert = NULL;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SECKEYPrivateKey* privkey = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (handle == NULL || attrlist == NULL || numattr == 0) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = do_nss_init(handle, numattr, attrlist, FALSE, &nss_slot);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (rv != KMF_OK)

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys /* Get the credential */

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = kmf_get_attr(KMF_CREDENTIAL_ATTR, attrlist, numattr,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys (void *)&cred, NULL);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (rv != KMF_OK)

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys return (KMF_ERR_BAD_PARAMETER);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys rv = nss_authenticate(handle, nss_slot, &cred);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (rv != KMF_OK)

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys /* Get the key handle */

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys key = kmf_get_attr_ptr(KMF_KEY_HANDLE_ATTR, attrlist, numattr);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (key == NULL)

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys /* Get the cert data and decode it */

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys cert = kmf_get_attr_ptr(KMF_CERT_DATA_ATTR, attrlist, numattr);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (cert == NULL || cert->Data == NULL)

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys nss_cert = CERT_DecodeCertFromPackage((char *)cert->Data,

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys cert->Length);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (nss_cert == NULL) {

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_ERROR(kmfh, PORT_GetError());

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys return (KMF_ERR_BAD_CERT_FORMAT);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys privkey = PK11_FindPrivateKeyFromCert(nss_slot, nss_cert, NULL);

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys if (privkey == NULL) {

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys SET_ERROR(kmfh, PORT_GetError());

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys return (KMF_ERR_KEY_NOT_FOUND);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys key->kstype = KMF_KEYSTORE_NSS;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys key->keyclass = KMF_ASYM_PRI;

30a5e8fa1253cb33980ee4514743cf683f584b4ewyllys key->keyp = (void *)privkey;