99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#pragma ident "%Z%%M% %I% %E% SMI"

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <sys/types.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <sys/stat.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <errno.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <fcntl.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <synch.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <kmfapiP.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <ber_der.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <oidsalg.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/nss.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/cert.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/certdb.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/secoid.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/secder.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/secerr.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/cryptohi.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/keyhi.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/keythi.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/pk11func.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/pk11pqg.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/pkcs12.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/p12plcy.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#include <mps/prerror.h>

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#define NSS_OK 0

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysmutex_t init_lock = DEFAULTMUTEX;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic int nss_initialized = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_ConfigureKeystore(KMF_HANDLE_T, KMF_CONFIG_PARAMS *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_FindCert(KMF_HANDLE_T,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_FINDCERT_PARAMS *params,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_X509_DER_CERT *kmf_cert,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys uint32_t *num_certs);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_FreeKMFCert(KMF_HANDLE_T, KMF_X509_DER_CERT *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_StoreCert(KMF_HANDLE_T, KMF_STORECERT_PARAMS *params,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_DATA * pcert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_ImportCert(KMF_HANDLE_T, KMF_IMPORTCERT_PARAMS *params);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_DeleteCert(KMF_HANDLE_T, KMF_DELETECERT_PARAMS *params);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_CreateKeypair(KMF_HANDLE_T, KMF_CREATEKEYPAIR_PARAMS *,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_KEY_HANDLE *, KMF_KEY_HANDLE *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_EncodePubKeyData(KMF_HANDLE_T, KMF_KEY_HANDLE *, KMF_DATA *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_SignData(KMF_HANDLE_T, KMF_KEY_HANDLE *, KMF_OID *,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_DATA *, KMF_DATA *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_ImportCRL(KMF_HANDLE_T, KMF_IMPORTCRL_PARAMS *params);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_DeleteCRL(KMF_HANDLE_T, KMF_DELETECRL_PARAMS *params);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_FindCRL(KMF_HANDLE_T, KMF_FINDCRL_PARAMS *params,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys char **CRLNameList, int *CRLCount);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_FindKey(KMF_HANDLE_T, KMF_FINDKEY_PARAMS *,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_KEY_HANDLE *, uint32_t *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_FindCertInCRL(KMF_HANDLE_T, KMF_FINDCERTINCRL_PARAMS *params);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_GetErrorString(KMF_HANDLE_T, char **);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_DeleteKey(KMF_HANDLE_T, KMF_DELETEKEY_PARAMS *,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_KEY_HANDLE *, boolean_t);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_GetPrikeyByCert(KMF_HANDLE_T, KMF_CRYPTOWITHCERT_PARAMS *, KMF_DATA *,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_KEY_HANDLE *, KMF_KEY_ALG);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_DecryptData(KMF_HANDLE_T, KMF_KEY_HANDLE *, KMF_OID *,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_DATA *, KMF_DATA *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_ExportP12(KMF_HANDLE_T,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_EXPORTP12_PARAMS *,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys int, KMF_X509_DER_CERT *,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys int, KMF_KEY_HANDLE *,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys char *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_StorePrivateKey(KMF_HANDLE_T, KMF_STOREKEY_PARAMS *, KMF_RAW_KEY_DATA *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_CreateSymKey(KMF_HANDLE_T, KMF_CREATESYMKEY_PARAMS *, KMF_KEY_HANDLE *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_GetSymKeyValue(KMF_HANDLE_T, KMF_KEY_HANDLE *, KMF_RAW_SYM_KEY *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_SetTokenPin(KMF_HANDLE_T, KMF_SETPIN_PARAMS *, KMF_CREDENTIAL *);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysKMF_PLUGIN_FUNCLIST nss_plugin_table =

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys 1, /* Version */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_ConfigureKeystore,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_FindCert,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_FreeKMFCert,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_StoreCert,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_ImportCert,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_ImportCRL,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_DeleteCert,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_DeleteCRL,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_CreateKeypair,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_FindKey,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_EncodePubKeyData,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_SignData,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_DeleteKey,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NULL /* ListCRL */,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_FindCRL,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_FindCertInCRL,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_GetErrorString,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_GetPrikeyByCert,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_DecryptData,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_ExportP12,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_StorePrivateKey,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_CreateSymKey,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_GetSymKeyValue,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_SetTokenPin,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NULL /* Finalize */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys};

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllystypedef struct p12uContextStr {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys char *filename; /* name of file */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PRFileDesc *file; /* pointer to file */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PRBool error; /* error occurred? */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys int errorValue; /* which error occurred? */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys} p12uContext;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys#define SET_ERROR(h, c) h->lasterr.kstype = KMF_KEYSTORE_NSS; \

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys h->lasterr.errcode = c;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysKMF_PLUGIN_FUNCLIST *

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysKMF_Plugin_Initialize()

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SEC_PKCS12EnableCipher(PKCS12_RC4_40, 1);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SEC_PKCS12EnableCipher(PKCS12_RC4_128, 1);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SEC_PKCS12EnableCipher(PKCS12_RC2_CBC_40, 1);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SEC_PKCS12EnableCipher(PKCS12_RC2_CBC_128, 1);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SEC_PKCS12EnableCipher(PKCS12_DES_56, 1);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SEC_PKCS12EnableCipher(PKCS12_DES_EDE3_168, 1);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SEC_PKCS12SetPreferredCipher(PKCS12_DES_EDE3_168, 1);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (&nss_plugin_table);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic char *

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysnss_getpassword(PK11SlotInfo *slot, PRBool retry, void *arg)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (retry)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (NULL);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (arg != NULL)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return ((char *)strdup(arg));

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys else

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (NULL);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic KMF_RETURN

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysnss_authenticate(KMF_HANDLE_T handle,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11SlotInfo *nss_slot, KMF_CREDENTIAL *cred)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECStatus nssrv = SECSuccess;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_HANDLE *kmfh = (KMF_HANDLE *)handle;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* If a password was given, try to login to the slot */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (cred == NULL || cred->cred == NULL || cred->credlen == 0 ||

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nss_slot == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (PK11_IsLoggedIn(nss_slot, NULL)) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_OK);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_SetPasswordFunc(nss_getpassword);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nssrv = PK11_Authenticate(nss_slot, PR_TRUE,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void *)cred->cred);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nssrv != SECSuccess) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, nssrv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_FreeSlot(nss_slot);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_AUTH_FAILED);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_OK);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic SECStatus

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysInit_NSS_DBs(const char *configdir,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys const char *certPrefix,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys const char *keyPrefix,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys const char *secmodName)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECStatus rv = NSS_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) mutex_lock(&init_lock);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* If another thread already did it, return OK. */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_initialized) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) mutex_unlock(&init_lock);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (SECSuccess);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = NSS_Initialize((configdir && strlen(configdir)) ?

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys configdir : "./", certPrefix,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys keyPrefix, secmodName ? secmodName : "secmod.db",

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSS_INIT_COOPERATE);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != SECSuccess) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto end;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nss_initialized++;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysend:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) mutex_unlock(&init_lock);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_ConfigureKeystore(KMF_HANDLE_T handle, KMF_CONFIG_PARAMS *params)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN rv = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_HANDLE *kmfh = (KMF_HANDLE *)handle;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (params == NULL)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) mutex_lock(&init_lock);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_initialized == 0) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECStatus err;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) mutex_unlock(&init_lock);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys err = Init_NSS_DBs(params->nssconfig.configdir,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->nssconfig.certPrefix,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->nssconfig.keyPrefix,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->nssconfig.secModName);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (err != SECSuccess) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, err);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_INTERNAL);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_KEYSTORE_ALREADY_INITIALIZED;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) mutex_unlock(&init_lock);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic KMF_RETURN

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysDo_NSS_Init(

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys void *handle,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_NSS_PARAMS nss_opts,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys boolean_t internal_slot_only,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11SlotInfo **nss_slot)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_HANDLE *kmfh = (KMF_HANDLE *)handle;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (!nss_initialized)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_PLUGIN_INIT);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /*

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_opts.slotlabel == NULL ||

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys strcmp(nss_opts.slotlabel, "internal") == 0) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *nss_slot = PK11_GetInternalKeySlot();

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else if (internal_slot_only == TRUE) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_SLOTNAME);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *nss_slot = PK11_FindSlotByName(nss_opts.slotlabel);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (*nss_slot == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, PORT_GetError());

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_SLOTNAME);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /*

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (PK11_NeedUserInit(*nss_slot)) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_UNINITIALIZED_TOKEN);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_OK);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic KMF_RETURN

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysnss2kmf_cert(CERTCertificate *nss_cert, KMF_X509_DER_CERT *kmf_cert)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys kmf_cert->kmf_private.keystore_type = KMF_KEYSTORE_NSS;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys kmf_cert->kmf_private.flags = KMF_FLAG_CERT_VALID;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys kmf_cert->certificate.Length = nss_cert->derCert.len;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if ((kmf_cert->certificate.Data = malloc(nss_cert->derCert.len)) ==

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys kmf_cert->certificate.Length = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_MEMORY);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) memcpy(kmf_cert->certificate.Data, nss_cert->derCert.data,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nss_cert->derCert.len);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_cert->nickname != NULL)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys kmf_cert->kmf_private.label =

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (char *)strdup(nss_cert->nickname);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_OK);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic KMF_RETURN

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysnss_getcert_by_label(KMF_HANDLE *kmfh,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys char *name, KMF_X509_DER_CERT *kmf_cert,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys uint32_t *num_certs, KMF_CERT_VALIDITY find_criteria)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN rv = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertificate *nss_cert;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECCertTimeValidity validity;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nss_cert = PK11_FindCertFromNickname(name, NULL);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_cert == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *num_certs = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, PORT_GetError());

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *num_certs = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_CERT_NOT_FOUND);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *num_certs = 1;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys switch (find_criteria) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys case KMF_ALL_CERTS:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys break;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys case KMF_NONEXPIRED_CERTS:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys validity = CERT_CheckCertValidTimes(nss_cert, PR_Now(),

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PR_FALSE);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (validity != secCertTimeValid) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* this is an invalid cert, reject it */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *num_certs = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERT_DestroyCertificate(nss_cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_OK);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys break;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys case KMF_EXPIRED_CERTS:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys validity = CERT_CheckCertValidTimes(nss_cert, PR_Now(),

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PR_FALSE);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (validity == secCertTimeValid) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* this is a valid cert, reject it in this case. */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *num_certs = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERT_DestroyCertificate(nss_cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_OK);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys break;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys default:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (kmf_cert != NULL)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = nss2kmf_cert(nss_cert, kmf_cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* We copied the data we need, so cleanup the internal record */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERT_DestroyCertificate(nss_cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *num_certs = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic KMF_RETURN

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysnss_find_matching_certs(PK11SlotInfo *slot,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys char *issuer, char *subject, KMF_BIGINT *serial,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertList **certlist, KMF_CERT_VALIDITY find_criteria)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN rv = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECStatus ret;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertList *list;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertListNode *node;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_X509_NAME issuerDN, subjectDN;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys boolean_t findIssuer = FALSE;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys boolean_t findSubject = FALSE;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys boolean_t findSerial = FALSE;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (issuer != NULL && strlen(issuer)) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_DNParser(issuer, &issuerDN);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys findIssuer = TRUE;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (subject != NULL && strlen(subject)) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_DNParser(subject, &subjectDN);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys findSubject = TRUE;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (serial != 0 && serial->val != NULL && serial->len > 0)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys findSerial = TRUE;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys list = PK11_ListCertsInSlot(slot);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (list) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys node = CERT_LIST_HEAD(list);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys while (!CERT_LIST_END(node, list)) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_X509_NAME cmpDN;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_DATA der;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys boolean_t match;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertListNode *freenode;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (findIssuer) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys der.Data = node->cert->derIssuer.data;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys der.Length = node->cert->derIssuer.len;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = DerDecodeName(&der, &cmpDN);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv == KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys match = !KMF_CompareRDNs(&issuerDN,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys &cmpDN);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_FreeDN(&cmpDN);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (!match)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto delete_and_cont;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto delete_and_cont;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (findSubject) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys der.Data = node->cert->derSubject.data;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys der.Length = node->cert->derSubject.len;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = DerDecodeName(&der, &cmpDN);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv == KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys match = !KMF_CompareRDNs(&subjectDN,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys &cmpDN);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_FreeDN(&cmpDN);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (!match)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto delete_and_cont;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto delete_and_cont;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (findSerial) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECItem *sernum;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys sernum = &node->cert->serialNumber;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (serial->len != sernum->len)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto delete_and_cont;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (memcmp(sernum->data, serial->val,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys serial->len))

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto delete_and_cont;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* select the certs using find criteria */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys switch (find_criteria) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys case KMF_ALL_CERTS:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys break;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys case KMF_NONEXPIRED_CERTS:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = CERT_CertTimesValid(node->cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (ret == SECFailure) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* this is an invalid cert */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto skip;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys break;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys case KMF_EXPIRED_CERTS:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = CERT_CertTimesValid(node->cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (ret != SECFailure) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* this is a valid cert */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto skip;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys break;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysskip:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys node = CERT_LIST_NEXT(node);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys continue;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysdelete_and_cont:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys freenode = node;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys node = CERT_LIST_NEXT(node);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERT_RemoveCertListNode(freenode);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv == KMF_OK && certlist != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *certlist = list;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERT_DestroyCertList(list);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic KMF_RETURN

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysconvertCertList(void *kmfhandle,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertList *nsscerts, KMF_X509_DER_CERT *kmfcerts,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys uint32_t *numcerts)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN rv = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertListNode *node;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *numcerts = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys for (node = CERT_LIST_HEAD(nsscerts);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys !CERT_LIST_END(node, nsscerts) && rv == KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys node = CERT_LIST_NEXT(node), (*numcerts)++) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (kmfcerts != NULL)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = nss2kmf_cert(node->cert, &kmfcerts[*numcerts]);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /*

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys int i;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys for (i = 0; i < *numcerts; i++)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_FreeKMFCert(kmfhandle, &kmfcerts[i]);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_FindCert(KMF_HANDLE_T handle, KMF_FINDCERT_PARAMS *params,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_X509_DER_CERT *kmfcerts,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys uint32_t *num_certs)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN rv = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_HANDLE *kmfh = (KMF_HANDLE *)handle;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11SlotInfo *nss_slot = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertList *certlist = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = Do_NSS_Init(handle,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->ks_opt_u.nss_opts, FALSE, &nss_slot);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys *num_certs = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (params->certLabel) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = nss_getcert_by_label(kmfh,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->certLabel,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys kmfcerts, num_certs, params->find_cert_validity);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = nss_find_matching_certs(nss_slot,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->issuer, params->subject, params->serial,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys &certlist, params->find_cert_validity);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv == KMF_OK && certlist != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = convertCertList(handle,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys certlist, kmfcerts, num_certs);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERT_DestroyCertList(certlist);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_slot != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_FreeSlot(nss_slot);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv == KMF_OK && *num_certs == 0)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_ERR_CERT_NOT_FOUND;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_FreeKMFCert(KMF_HANDLE_T handle,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_X509_DER_CERT *kmf_cert)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (kmf_cert != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (kmf_cert->certificate.Data != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys free(kmf_cert->certificate.Data);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys kmf_cert->certificate.Data = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys kmf_cert->certificate.Length = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (kmf_cert->kmf_private.label != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys free(kmf_cert->kmf_private.label);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys kmf_cert->kmf_private.label = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_StoreCert(KMF_HANDLE_T handle, KMF_STORECERT_PARAMS *params,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_DATA *pcert)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN ret = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_HANDLE *kmfh = (KMF_HANDLE *)handle;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECStatus nss_rv;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertificate *nss_cert = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertTrust *nss_trust = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11SlotInfo *nss_slot = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertDBHandle *certHandle = CERT_GetDefaultCertDB();

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (pcert == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* NSS only support DER format */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (params == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = Do_NSS_Init(handle,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->ks_opt_u.nss_opts, FALSE, &nss_slot);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (ret != KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (ret);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nss_cert = CERT_DecodeCertFromPackage((char *)pcert->Data,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys pcert->Length);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_cert == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, PORT_GetError());

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = KMF_ERR_BAD_CERT_FORMAT;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto out;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nss_rv = PK11_ImportCert(nss_slot, nss_cert, CK_INVALID_HANDLE,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->certLabel, 0);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_rv) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, nss_rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = KMF_ERR_BAD_CERT_FORMAT;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto out;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (params->ks_opt_u.nss_opts.trustflag != NULL &&

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys strlen(params->ks_opt_u.nss_opts.trustflag)) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nss_trust = (CERTCertTrust *) malloc(sizeof (CERTCertTrust));

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_trust == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = KMF_ERR_MEMORY;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto out;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nss_rv = CERT_DecodeTrustString(nss_trust,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->ks_opt_u.nss_opts.trustflag);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_rv) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, nss_rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = KMF_ERR_BAD_PARAMETER;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto out;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nss_rv = CERT_ChangeCertTrust(certHandle, nss_cert, nss_trust);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_rv) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, nss_rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = KMF_ERR_BAD_PARAMETER;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysout:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_trust != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys free(nss_trust);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_cert != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERT_DestroyCertificate(nss_cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_slot != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_FreeSlot(nss_slot);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (ret);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_ImportCert(KMF_HANDLE_T handle, KMF_IMPORTCERT_PARAMS *params)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN ret = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_STORECERT_PARAMS scparams;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_DATA cert = {NULL, 0};

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_DATA cert_der = {NULL, 0};

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_DATA *cptr = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_ENCODE_FORMAT format;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (params == NULL || params->certfile == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /*

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = KMF_IsCertFile(handle, params->certfile, &format);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (ret != KMF_OK)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (ret);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = KMF_ReadInputFile(handle, params->certfile, &cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (ret != KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (ret);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /*

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (format == KMF_FORMAT_PEM) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys int derlen;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = KMF_Pem2Der(cert.Data, cert.Length,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys &cert_der.Data, &derlen);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (ret != KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto cleanup;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys cert_der.Length = (size_t)derlen;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys cptr = &cert_der;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys cptr = &cert;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) memset(&scparams, 0, sizeof (scparams));

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys scparams.kstype = params->kstype;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys scparams.certLabel = params->certLabel;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys scparams.nssparms = params->nssparms;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = NSS_StoreCert(handle, &scparams, cptr);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (format == KMF_FORMAT_PEM) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_FreeData(&cert_der);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllyscleanup:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_FreeData(&cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (ret);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_DeleteCert(KMF_HANDLE_T handle, KMF_DELETECERT_PARAMS *params)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN rv = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys int nssrv;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_HANDLE *kmfh = (KMF_HANDLE *)handle;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertificate *cert = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11SlotInfo *nss_slot = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* check params */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (params == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = Do_NSS_Init(handle,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->ks_opt_u.nss_opts,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys FALSE, &nss_slot);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (params->certLabel) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys cert = PK11_FindCertFromNickname(params->certLabel, NULL);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (cert == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_CERT_NOT_FOUND);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys switch (params->find_cert_validity) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys case KMF_ALL_CERTS:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys break;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys case KMF_NONEXPIRED_CERTS:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nssrv = CERT_CertTimesValid(cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nssrv == SECFailure) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* this is an invalid cert - skip it */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto out;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys break;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys case KMF_EXPIRED_CERTS:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nssrv = CERT_CertTimesValid(cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nssrv != SECFailure) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* this is a valid cert - skip it */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto out;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys break;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* delete it from database */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nssrv = SEC_DeletePermCertificate(cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nssrv) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, nssrv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_ERR_INTERNAL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertListNode *node;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertList *certlist = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = nss_find_matching_certs(nss_slot,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->issuer, params->subject, params->serial,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys &certlist, params->find_cert_validity);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys for (node = CERT_LIST_HEAD(certlist);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys !CERT_LIST_END(node, certlist) && rv == KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys node = CERT_LIST_NEXT(node)) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nssrv = SEC_DeletePermCertificate(node->cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nssrv) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, nssrv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_ERR_INTERNAL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv == KMF_OK && certlist != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERT_DestroyCertList(certlist);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else if (rv == KMF_OK && certlist == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_ERR_CERT_NOT_FOUND;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysout:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_slot != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_FreeSlot(nss_slot);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (cert != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERT_DestroyCertificate(cert);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysstatic void

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysInitRandom(char *filename)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys char buf[2048];

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys int fd;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PRInt32 count;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys fd = open(filename, O_RDONLY);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (!fd)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys count = read(fd, buf, sizeof (buf));

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (count > 0) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_RandomUpdate(buf, count);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) close(fd);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_CreateKeypair(KMF_HANDLE_T handle,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_CREATEKEYPAIR_PARAMS *params,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_KEY_HANDLE *privkey,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_KEY_HANDLE *pubkey)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN rv = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_HANDLE *kmfh = (KMF_HANDLE *)handle;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11RSAGenParams rsaparams;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys void *nssparams;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CK_MECHANISM_TYPE mechanism;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ulong_t publicExponent = 0x010001;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11SlotInfo *nss_slot = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECKEYPrivateKey *NSSprivkey = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECKEYPublicKey *NSSpubkey = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PQGParams *pqgParams = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (params == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = Do_NSS_Init(handle,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->ks_opt_u.nss_opts, FALSE, &nss_slot);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = nss_authenticate(handle, nss_slot, &params->cred);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* Get some random bits */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys InitRandom("/dev/urandom");

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (params->keytype == KMF_RSA) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rsaparams.keySizeInBits = params->keylength;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /*

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (params->rsa_exponent.len > 0 &&

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->rsa_exponent.len <= sizeof (publicExponent) &&

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->rsa_exponent.val != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) memcpy(&publicExponent,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->rsa_exponent.val,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->rsa_exponent.len);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rsaparams.pe = publicExponent;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys mechanism = CKM_RSA_PKCS_KEY_PAIR_GEN;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nssparams = &rsaparams;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else if (params->keytype == KMF_DSA) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PQGVerify *pqgVerify = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys int ks;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECStatus nssrv, passed;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys mechanism = CKM_DSA_KEY_PAIR_GEN;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ks = PQG_PBITS_TO_INDEX(params->keylength);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nssrv = PK11_PQG_ParamGen(ks, &pqgParams, &pqgVerify);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nssrv != SECSuccess) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_PQG_DestroyVerify(pqgVerify);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_ERR_KEYGEN_FAILED;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto cleanup;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nssrv = PK11_PQG_VerifyParams(pqgParams, pqgVerify, &passed);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nssrv != SECSuccess || passed != SECSuccess) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_ERR_KEYGEN_FAILED;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_PQG_DestroyVerify(pqgVerify);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, PORT_GetError());

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto cleanup;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nssparams = pqgParams;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_ERR_BAD_PARAMETER;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto cleanup;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSSprivkey = PK11_GenerateKeyPair(nss_slot,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys mechanism, nssparams, &NSSpubkey,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PR_TRUE, /* isPermanent */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PR_TRUE, /* isSensitive */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void *)params->cred.cred);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (NSSprivkey == NULL || NSSpubkey == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, PORT_GetError());

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_ERR_KEYGEN_FAILED;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (params->keylabel != NULL &&

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys strlen(params->keylabel)) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) PK11_SetPrivateKeyNickname(NSSprivkey,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->keylabel);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) PK11_SetPublicKeyNickname(NSSpubkey,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->keylabel);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* Now, convert it to a KMF_KEY object for the framework */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (privkey != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys privkey->kstype = KMF_KEYSTORE_NSS;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys privkey->keyalg = params->keytype;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys privkey->keyclass = KMF_ASYM_PRI;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys privkey->keylabel =

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_GetPrivateKeyNickname(NSSprivkey);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys privkey->keyp = (void *)NSSprivkey;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (pubkey != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys pubkey->kstype = KMF_KEYSTORE_NSS;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys pubkey->keyalg = params->keytype;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys pubkey->keyp = (void *)NSSpubkey;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys pubkey->keyclass = KMF_ASYM_PUB;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys pubkey->keylabel =

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_GetPublicKeyNickname(NSSpubkey);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllyscleanup:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (NSSpubkey)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_DeleteTokenPublicKey(NSSpubkey);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (NSSprivkey)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_DeleteTokenPrivateKey(NSSprivkey, PR_TRUE);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys privkey->keyp = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys pubkey->keyp = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (pqgParams != NULL)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_PQG_DestroyParams(pqgParams);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_slot != NULL)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_FreeSlot(nss_slot);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_SignData(KMF_HANDLE_T handle, KMF_KEY_HANDLE *key,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_OID *AlgOID, KMF_DATA *tobesigned,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_DATA *output)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN ret = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_ALGORITHM_INDEX AlgId;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECOidTag signAlgTag;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECKEYPrivateKey *NSSprivkey = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECStatus rv;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECItem signed_data;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_HANDLE *kmfh = (KMF_HANDLE *)handle;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys signed_data.data = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (key == NULL || AlgOID == NULL ||

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys tobesigned == NULL || output == NULL ||

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys tobesigned->Data == NULL ||

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys output->Data == NULL)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* Map the OID to a NSS algorithm */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys AlgId = X509_AlgorithmOidToAlgId(AlgOID);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (AlgId == KMF_ALGID_NONE)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NSSprivkey = (SECKEYPrivateKey *)key->keyp;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (AlgId == KMF_ALGID_MD5WithRSA)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys signAlgTag = SEC_OID_PKCS1_MD5_WITH_RSA_ENCRYPTION;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys else if (AlgId == KMF_ALGID_MD2WithRSA)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys signAlgTag = SEC_OID_PKCS1_MD2_WITH_RSA_ENCRYPTION;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys else if (AlgId == KMF_ALGID_SHA1WithRSA)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys signAlgTag = SEC_OID_PKCS1_SHA1_WITH_RSA_ENCRYPTION;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys else if (AlgId == KMF_ALGID_SHA1WithDSA)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys signAlgTag = SEC_OID_ANSIX9_DSA_SIGNATURE_WITH_SHA1_DIGEST;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys else

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = SEC_SignData(&signed_data, tobesigned->Data,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys tobesigned->Length, NSSprivkey, signAlgTag);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != 0) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_INTERNAL);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (signed_data.len <= output->Length) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) memcpy(output->Data, signed_data.data, signed_data.len);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys output->Length = signed_data.len;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys output->Length = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = KMF_ERR_BAD_PARAMETER;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys free(signed_data.data);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (ret);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_EncodePubKeyData(KMF_HANDLE_T handle, KMF_KEY_HANDLE *keyp,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_DATA *encoded)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN ret = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_HANDLE *kmfh = (KMF_HANDLE *)handle;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECItem *rvitem;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTSubjectPublicKeyInfo *spki = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (keyp == NULL || encoded == NULL || keyp->keyp == NULL)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys spki = SECKEY_CreateSubjectPublicKeyInfo(keyp->keyp);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (spki == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, PORT_GetError());

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_MEMORY);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rvitem = SEC_ASN1EncodeItem(NULL, NULL, spki,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERT_SubjectPublicKeyInfoTemplate);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rvitem != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys encoded->Data = malloc(rvitem->len);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (encoded->Data == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = KMF_ERR_MEMORY;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (void) memcpy(encoded->Data, rvitem->data, rvitem->len);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys encoded->Length = rvitem->len;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECITEM_FreeItem(rvitem, TRUE);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, PORT_GetError());

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys encoded->Data = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys encoded->Length = 0;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = KMF_ERR_ENCODING;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECKEY_DestroySubjectPublicKeyInfo(spki);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (ret);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_DeleteKey(KMF_HANDLE_T handle, KMF_DELETEKEY_PARAMS *params,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_KEY_HANDLE *key, boolean_t delete_token)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN rv = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11SlotInfo *nss_slot = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /*

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (key == NULL || key->keyp == NULL)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (delete_token) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECStatus nssrv = SECSuccess;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (key->keyclass != KMF_ASYM_PUB &&

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys key->keyclass != KMF_ASYM_PRI &&

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys key->keyclass != KMF_SYMMETRIC)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_KEY_CLASS);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (params == NULL)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = Do_NSS_Init(handle,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->ks_opt_u.nss_opts, FALSE, &nss_slot);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = nss_authenticate(handle, nss_slot, &params->cred);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (key->keyclass == KMF_ASYM_PUB) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nssrv = PK11_DeleteTokenPublicKey(

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (SECKEYPublicKey *)key->keyp);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else if (key->keyclass == KMF_ASYM_PRI) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nssrv = PK11_DeleteTokenPrivateKey(

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (SECKEYPrivateKey *)key->keyp, PR_TRUE);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else if (key->keyclass == KMF_SYMMETRIC) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nssrv = PK11_DeleteTokenSymKey(

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (PK11SymKey *) key->keyp);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nssrv == SECSuccess)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_FreeSymKey(

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (PK11SymKey *) key->keyp);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nssrv != SECSuccess) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(handle, PORT_GetError());

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_ERR_INTERNAL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (key->keyclass == KMF_ASYM_PUB) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECKEY_DestroyPublicKey((SECKEYPublicKey *)key->keyp);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else if (key->keyclass == KMF_ASYM_PRI) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECKEY_DestroyPrivateKey((SECKEYPrivateKey *)key->keyp);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else if (key->keyclass == KMF_SYMMETRIC) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_FreeSymKey((PK11SymKey *) key->keyp);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_KEY_CLASS);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys key->keyp = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_ImportCRL(KMF_HANDLE_T handle, KMF_IMPORTCRL_PARAMS *params)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN ret = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_HANDLE *kmfh = (KMF_HANDLE *)handle;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11SlotInfo *nss_slot = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTSignedCrl *nss_crl = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_ENCODE_FORMAT format;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys int importOptions;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SECItem crlDER;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_DATA crl1;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_DATA crl2;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (params == NULL || params->ks_opt_u.nss_opts.crlfile == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /*

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = KMF_IsCRLFile(handle, params->ks_opt_u.nss_opts.crlfile,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys &format);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (ret != KMF_OK)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (ret);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = Do_NSS_Init(handle,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->ks_opt_u.nss_opts, TRUE, &nss_slot);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (ret != KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (ret);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* set importOptions */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (params->ks_opt_u.nss_opts.crl_check == B_FALSE) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys importOptions = CRL_IMPORT_DEFAULT_OPTIONS |

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CRL_IMPORT_BYPASS_CHECKS;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys } else {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys importOptions = CRL_IMPORT_DEFAULT_OPTIONS;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* Read in the CRL file */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys crl1.Data = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys crl2.Data = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = KMF_ReadInputFile(handle, params->ks_opt_u.nss_opts.crlfile,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys &crl1);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (ret != KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (ret);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* If the input CRL is in PEM format, convert it to DER first. */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (format == KMF_FORMAT_PEM) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys int len;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = KMF_Pem2Der(crl1.Data, crl1.Length,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys &crl2.Data, &len);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (ret != KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto out;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys crl2.Length = (size_t)len;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys crlDER.data = format == KMF_FORMAT_ASN1 ? crl1.Data : crl2.Data;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys crlDER.len = format == KMF_FORMAT_ASN1 ? crl1.Length : crl2.Length;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys nss_crl = PK11_ImportCRL(nss_slot, &crlDER, NULL, SEC_CRL_TYPE,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys NULL, importOptions, NULL, CRL_DECODE_DEFAULT_OPTIONS);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_crl == NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, PORT_GetError());

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys ret = KMF_ERR_BAD_CRLFILE;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto out;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysout:

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_slot != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11_FreeSlot(nss_slot);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (crl1.Data != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys free(crl1.Data);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (crl2.Data != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys free(crl2.Data);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (nss_crl != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SEC_DestroyCrl(nss_crl);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (ret);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys}

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllysNSS_DeleteCRL(KMF_HANDLE_T handle, KMF_DELETECRL_PARAMS *params)

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys{

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_RETURN rv = KMF_OK;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys KMF_HANDLE *kmfh = (KMF_HANDLE *)handle;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTSignedCrl *crl = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertificate *cert = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PK11SlotInfo *nss_slot = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCrlHeadNode *crlList = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCrlNode *crlNode = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys PRArenaPool *arena = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTName *name = NULL;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys CERTCertDBHandle *certHandle = CERT_GetDefaultCertDB();

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* check params */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (params == NULL ||

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (params->ks_opt_u.nss_opts.crl_issuerName == NULL &&

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->ks_opt_u.nss_opts.crl_subjName == NULL) ||

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys (params->ks_opt_u.nss_opts.crl_issuerName != NULL &&

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->ks_opt_u.nss_opts.crl_subjName != NULL)) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (KMF_ERR_BAD_PARAMETER);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = Do_NSS_Init(handle,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->ks_opt_u.nss_opts, TRUE,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys &nss_slot);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (rv != KMF_OK) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys return (rv);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys }

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /* Find the CRL based on the deletion criteria. */

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (params->ks_opt_u.nss_opts.crl_issuerName != NULL) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys /*

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys cert = CERT_FindCertByNicknameOrEmailAddr(certHandle,

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys params->ks_opt_u.nss_opts.crl_issuerName);

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys if (!cert) {

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys SET_ERROR(kmfh, PORT_GetError());

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys rv = KMF_ERR_CERT_NOT_FOUND;

99ebb4ca412cb0a19d77a3899a87c055b9c30fa8wyllys goto out;