| /* This Source Code Form is subject to the terms of the Mozilla Public |
| * License, v. 2.0. If a copy of the MPL was not distributed with this |
| * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ |
| |
| /* |
| * Merge the source token into the target token. |
| */ |
| |
| #include "secmod.h" |
| #include "secmodi.h" |
| #include "secmodti.h" |
| #include "pk11pub.h" |
| #include "pk11priv.h" |
| #include "pkcs11.h" |
| #include "seccomon.h" |
| #include "secerr.h" |
| #include "keyhi.h" |
| #include "hasht.h" |
| #include "cert.h" |
| #include "certdb.h" |
| |
| /************************************************************************* |
| * |
| * short utilities to aid in the merge |
| * |
| *************************************************************************/ |
| |
| /* |
| * write a bunch of attributes out to an existing object. |
| */ |
| static SECStatus |
| pk11_setAttributes(PK11SlotInfo *slot, CK_OBJECT_HANDLE id, |
| CK_ATTRIBUTE *setTemplate, CK_ULONG setTemplCount) |
| { |
| CK_RV crv; |
| CK_SESSION_HANDLE rwsession; |
| |
| rwsession = PK11_GetRWSession(slot); |
| if (rwsession == CK_INVALID_HANDLE) { |
| PORT_SetError(SEC_ERROR_BAD_DATA); |
| return SECFailure; |
| } |
| crv = PK11_GETTAB(slot)->C_SetAttributeValue(rwsession, id, |
| setTemplate, setTemplCount); |
| PK11_RestoreROSession(slot, rwsession); |
| if (crv != CKR_OK) { |
| PORT_SetError(PK11_MapError(crv)); |
| return SECFailure; |
| } |
| return SECSuccess; |
| } |
| |
| /* |
| * copy a template of attributes from a source object to a target object. |
| * if target object is not given, create it. |
| */ |
| static SECStatus |
| pk11_copyAttributes(PLArenaPool *arena, |
| PK11SlotInfo *targetSlot, CK_OBJECT_HANDLE targetID, |
| PK11SlotInfo *sourceSlot, CK_OBJECT_HANDLE sourceID, |
| CK_ATTRIBUTE *copyTemplate, CK_ULONG copyTemplateCount) |
| { |
| SECStatus rv; |
| CK_ATTRIBUTE *newTemplate = NULL; |
| CK_RV crv; |
| |
| crv = PK11_GetAttributes(arena, sourceSlot, sourceID, |
| copyTemplate, copyTemplateCount); |
| /* if we have missing attributes, just skip them and create the object */ |
| if (crv == CKR_ATTRIBUTE_TYPE_INVALID) { |
| CK_ULONG i, j; |
| newTemplate = PORT_NewArray(CK_ATTRIBUTE, copyTemplateCount); |
| if (!newTemplate) { |
| return SECFailure; |
| } |
| /* remove the unknown attributes. If we don't have enough attributes |
| * PK11_CreateNewObject() will fail */ |
| for (i = 0, j = 0; i < copyTemplateCount; i++) { |
| if (copyTemplate[i].ulValueLen != -1) { |
| newTemplate[j] = copyTemplate[i]; |
| j++; |
| } |
| } |
| copyTemplate = newTemplate; |
| copyTemplateCount = j; |
| crv = PK11_GetAttributes(arena, sourceSlot, sourceID, |
| copyTemplate, copyTemplateCount); |
| } |
| if (crv != CKR_OK) { |
| PORT_SetError(PK11_MapError(crv)); |
| PORT_Free(newTemplate); |
| return SECFailure; |
| } |
| if (targetID == CK_INVALID_HANDLE) { |
| /* we need to create the object */ |
| rv = PK11_CreateNewObject(targetSlot, CK_INVALID_HANDLE, |
| copyTemplate, copyTemplateCount, PR_TRUE, &targetID); |
| } else { |
| /* update the existing object with the new attributes */ |
| rv = pk11_setAttributes(targetSlot, targetID, |
| copyTemplate, copyTemplateCount); |
| } |
| if (newTemplate) { |
| PORT_Free(newTemplate); |
| } |
| return rv; |
| } |
| |
| /* |
| * look for a matching object across tokens. |
| */ |
| static SECStatus |
| pk11_matchAcrossTokens(PLArenaPool *arena, PK11SlotInfo *targetSlot, |
| PK11SlotInfo *sourceSlot, |
| CK_ATTRIBUTE *template, CK_ULONG tsize, |
| CK_OBJECT_HANDLE id, CK_OBJECT_HANDLE *peer) |
| { |
| |
| CK_RV crv; |
| *peer = CK_INVALID_HANDLE; |
| |
| crv = PK11_GetAttributes(arena, sourceSlot, id, template, tsize); |
| if (crv != CKR_OK) { |
| PORT_SetError(PK11_MapError(crv)); |
| goto loser; |
| } |
| |
| if (template[0].ulValueLen == -1) { |
| crv = CKR_ATTRIBUTE_TYPE_INVALID; |
| PORT_SetError(PK11_MapError(crv)); |
| goto loser; |
| } |
| |
| *peer = pk11_FindObjectByTemplate(targetSlot, template, tsize); |
| return SECSuccess; |
| |
| loser: |
| return SECFailure; |
| } |
| |
| /* |
| * Encrypt using key and parameters |
| */ |
| SECStatus |
| pk11_encrypt(PK11SymKey *symKey, CK_MECHANISM_TYPE mechType, SECItem *param, |
| SECItem *input, SECItem **output) |
| { |
| PK11Context *ctxt = NULL; |
| SECStatus rv = SECSuccess; |
| |
| if (*output) { |
| SECITEM_FreeItem(*output, PR_TRUE); |
| } |
| *output = SECITEM_AllocItem(NULL, NULL, input->len + 20 /*slop*/); |
| if (!*output) { |
| rv = SECFailure; |
| goto done; |
| } |
| |
| ctxt = PK11_CreateContextBySymKey(mechType, CKA_ENCRYPT, symKey, param); |
| if (ctxt == NULL) { |
| rv = SECFailure; |
| goto done; |
| } |
| |
| rv = PK11_CipherOp(ctxt, (*output)->data, |
| (int *)&((*output)->len), |
| (*output)->len, input->data, input->len); |
| |
| done: |
| if (ctxt) { |
| PK11_Finalize(ctxt); |
| PK11_DestroyContext(ctxt, PR_TRUE); |
| } |
| if (rv != SECSuccess) { |
| if (*output) { |
| SECITEM_FreeItem(*output, PR_TRUE); |
| *output = NULL; |
| } |
| } |
| return rv; |
| } |
| |
| /************************************************************************* |
| * |
| * Private Keys |
| * |
| *************************************************************************/ |
| |
| /* |
| * Fetch the key usage based on the pkcs #11 flags |
| */ |
| unsigned int |
| pk11_getPrivateKeyUsage(PK11SlotInfo *slot, CK_OBJECT_HANDLE id) |
| { |
| unsigned int usage = 0; |
| |
| if ((PK11_HasAttributeSet(slot, id, CKA_UNWRAP, PR_FALSE) || |
| PK11_HasAttributeSet(slot, id, CKA_DECRYPT, PR_FALSE))) { |
| usage |= KU_KEY_ENCIPHERMENT; |
| } |
| if (PK11_HasAttributeSet(slot, id, CKA_DERIVE, PR_FALSE)) { |
| usage |= KU_KEY_AGREEMENT; |
| } |
| if ((PK11_HasAttributeSet(slot, id, CKA_SIGN_RECOVER, PR_FALSE) || |
| PK11_HasAttributeSet(slot, id, CKA_SIGN, PR_FALSE))) { |
| usage |= KU_DIGITAL_SIGNATURE; |
| } |
| return usage; |
| } |
| |
| /* |
| * merge a private key, |
| * |
| * Private keys are merged using PBE wrapped keys with a random |
| * value as the 'password'. Once the base key is moved, The remaining |
| * attributes (SUBJECT) is copied. |
| */ |
| static SECStatus |
| pk11_mergePrivateKey(PK11SlotInfo *targetSlot, PK11SlotInfo *sourceSlot, |
| CK_OBJECT_HANDLE id, void *targetPwArg, void *sourcePwArg) |
| { |
| SECKEYPrivateKey *sourceKey = NULL; |
| CK_OBJECT_HANDLE targetKeyID; |
| SECKEYEncryptedPrivateKeyInfo *epki = NULL; |
| char *nickname = NULL; |
| SECItem nickItem; |
| SECItem pwitem; |
| SECItem publicValue; |
| PLArenaPool *arena = NULL; |
| SECStatus rv = SECSuccess; |
| unsigned int keyUsage; |
| unsigned char randomData[SHA1_LENGTH]; |
| SECOidTag algTag = SEC_OID_PKCS12_V2_PBE_WITH_SHA1_AND_3KEY_TRIPLE_DES_CBC; |
| CK_ATTRIBUTE privTemplate[] = { |
| { CKA_ID, NULL, 0 }, |
| { CKA_CLASS, NULL, 0 } |
| }; |
| CK_ULONG privTemplateCount = sizeof(privTemplate) / sizeof(privTemplate[0]); |
| CK_ATTRIBUTE privCopyTemplate[] = { |
| { CKA_SUBJECT, NULL, 0 } |
| }; |
| CK_ULONG privCopyTemplateCount = |
| sizeof(privCopyTemplate) / sizeof(privCopyTemplate[0]); |
| |
| arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); |
| if (arena == NULL) { |
| rv = SECFailure; |
| goto done; |
| } |
| |
| /* check to see if the key is already in the target slot */ |
| rv = pk11_matchAcrossTokens(arena, targetSlot, sourceSlot, privTemplate, |
| privTemplateCount, id, &targetKeyID); |
| if (rv != SECSuccess) { |
| goto done; |
| } |
| |
| if (targetKeyID != CK_INVALID_HANDLE) { |
| /* match found, not an error ... */ |
| goto done; |
| } |
| |
| /* get an NSS representation of our source key */ |
| sourceKey = PK11_MakePrivKey(sourceSlot, nullKey, PR_FALSE, |
| id, sourcePwArg); |
| if (sourceKey == NULL) { |
| rv = SECFailure; |
| goto done; |
| } |
| |
| /* Load the private key */ |
| /* generate a random pwitem */ |
| rv = PK11_GenerateRandom(randomData, sizeof(randomData)); |
| if (rv != SECSuccess) { |
| goto done; |
| } |
| pwitem.data = randomData; |
| pwitem.len = sizeof(randomData); |
| /* fetch the private key encrypted */ |
| epki = PK11_ExportEncryptedPrivKeyInfo(sourceSlot, algTag, &pwitem, |
| sourceKey, 1, sourcePwArg); |
| if (epki == NULL) { |
| rv = SECFailure; |
| goto done; |
| } |
| nickname = PK11_GetObjectNickname(sourceSlot, id); |
| /* NULL nickanme is fine (in fact is often normal) */ |
| if (nickname) { |
| nickItem.data = (unsigned char *)nickname; |
| nickItem.len = PORT_Strlen(nickname); |
| } |
| keyUsage = pk11_getPrivateKeyUsage(sourceSlot, id); |
| /* pass in the CKA_ID */ |
| publicValue.data = privTemplate[0].pValue; |
| publicValue.len = privTemplate[0].ulValueLen; |
| rv = PK11_ImportEncryptedPrivateKeyInfo(targetSlot, epki, &pwitem, |
| nickname ? &nickItem : NULL, &publicValue, |
| PR_TRUE, PR_TRUE, sourceKey->keyType, keyUsage, |
| targetPwArg); |
| if (rv != SECSuccess) { |
| goto done; |
| } |
| |
| /* make sure it made it */ |
| rv = pk11_matchAcrossTokens(arena, targetSlot, sourceSlot, privTemplate, |
| privTemplateCount, id, &targetKeyID); |
| if (rv != SECSuccess) { |
| goto done; |
| } |
| |
| if (targetKeyID == CK_INVALID_HANDLE) { |
| /* this time the key should exist */ |
| rv = SECFailure; |
| goto done; |
| } |
| |
| /* fill in remaining attributes */ |
| rv = pk11_copyAttributes(arena, targetSlot, targetKeyID, sourceSlot, id, |
| privCopyTemplate, privCopyTemplateCount); |
| done: |
| /* make sure the 'key' is cleared */ |
| PORT_Memset(randomData, 0, sizeof(randomData)); |
| if (nickname) { |
| PORT_Free(nickname); |
| } |
| if (sourceKey) { |
| SECKEY_DestroyPrivateKey(sourceKey); |
| } |
| if (epki) { |
| SECKEY_DestroyEncryptedPrivateKeyInfo(epki, PR_TRUE); |
| } |
| if (arena) { |
| PORT_FreeArena(arena, PR_FALSE); |
| } |
| return rv; |
| } |
| |
| /************************************************************************* |
| * |
| * Secret Keys |
| * |
| *************************************************************************/ |
| |
| /* |
| * we need to find a unique CKA_ID. |
| * The basic idea is to just increment the lowest byte. |
| * This code also handles the following corner cases: |
| * 1) the single byte overflows. On overflow we increment the next byte up |
| * and so forth until we have overflowed the entire CKA_ID. |
| * 2) If we overflow the entire CKA_ID we expand it by one byte. |
| * 3) the CKA_ID is non-existent, we create a new one with one byte. |
| * This means no matter what CKA_ID is passed, the result of this function |
| * is always a new CKA_ID, and this function will never return the same |
| * CKA_ID the it has returned in the passed. |
| */ |
| static SECStatus |
| pk11_incrementID(PLArenaPool *arena, CK_ATTRIBUTE *ptemplate) |
| { |
| unsigned char *buf = ptemplate->pValue; |
| CK_ULONG len = ptemplate->ulValueLen; |
| |
| if (buf == NULL || len == (CK_ULONG)-1) { |
| /* we have no valid CKAID, we'll create a basic one byte CKA_ID below */ |
| len = 0; |
| } else { |
| CK_ULONG i; |
| |
| /* walk from the back to front, incrementing |
| * the CKA_ID until we no longer have a carry, |
| * or have hit the front of the id. */ |
| for (i = len; i != 0; i--) { |
| buf[i - 1]++; |
| if (buf[i - 1] != 0) { |
| /* no more carries, the increment is complete */ |
| return SECSuccess; |
| } |
| } |
| /* we've now overflowed, fall through and expand the CKA_ID by |
| * one byte */ |
| } |
| /* if we are here we've run the counter to zero (indicating an overflow). |
| * create an CKA_ID that is all zeros, but has one more zero than |
| * the previous CKA_ID */ |
| buf = PORT_ArenaZAlloc(arena, len + 1); |
| if (buf == NULL) { |
| return SECFailure; |
| } |
| ptemplate->pValue = buf; |
| ptemplate->ulValueLen = len + 1; |
| return SECSuccess; |
| } |
| |
| static CK_FLAGS |
| pk11_getSecretKeyFlags(PK11SlotInfo *slot, CK_OBJECT_HANDLE id) |
| { |
| CK_FLAGS flags = 0; |
| |
| if (PK11_HasAttributeSet(slot, id, CKA_UNWRAP, PR_FALSE)) { |
| flags |= CKF_UNWRAP; |
| } |
| if (PK11_HasAttributeSet(slot, id, CKA_WRAP, PR_FALSE)) { |
| flags |= CKF_WRAP; |
| } |
| if (PK11_HasAttributeSet(slot, id, CKA_ENCRYPT, PR_FALSE)) { |
| flags |= CKF_ENCRYPT; |
| } |
| if (PK11_HasAttributeSet(slot, id, CKA_DECRYPT, PR_FALSE)) { |
| flags |= CKF_DECRYPT; |
| } |
| if (PK11_HasAttributeSet(slot, id, CKA_DERIVE, PR_FALSE)) { |
| flags |= CKF_DERIVE; |
| } |
| if (PK11_HasAttributeSet(slot, id, CKA_SIGN, PR_FALSE)) { |
| flags |= CKF_SIGN; |
| } |
| if (PK11_HasAttributeSet(slot, id, CKA_SIGN_RECOVER, PR_FALSE)) { |
| flags |= CKF_SIGN_RECOVER; |
| } |
| if (PK11_HasAttributeSet(slot, id, CKA_VERIFY, PR_FALSE)) { |
| flags |= CKF_VERIFY; |
| } |
| if (PK11_HasAttributeSet(slot, id, CKA_VERIFY_RECOVER, PR_FALSE)) { |
| flags |= CKF_VERIFY_RECOVER; |
| } |
| return flags; |
| } |
| |
| static const char testString[] = |
| "My Encrytion Test Data (should be at least 32 bytes long)"; |
| /* |
| * merge a secret key, |
| * |
| * Secret keys may collide by CKA_ID as we merge 2 token. If we collide |
| * on the CKA_ID, we need to make sure we are dealing with different keys. |
| * The reason for this is it is possible that we've merged this database |
| * before, and this key could have been merged already. If the keys are |
| * the same, we are done. If they are not, we need to update the CKA_ID of |
| * the source key and try again. |
| * |
| * Once we know we have a unique key to merge in, we use NSS's underlying |
| * key Move function which will do a key exchange if necessary to move |
| * the key from one token to another. Then we set the CKA_ID and additional |
| * pkcs #11 attributes. |
| */ |
| static SECStatus |
| pk11_mergeSecretKey(PK11SlotInfo *targetSlot, PK11SlotInfo *sourceSlot, |
| CK_OBJECT_HANDLE id, void *targetPwArg, void *sourcePwArg) |
| { |
| PK11SymKey *sourceKey = NULL; |
| PK11SymKey *targetKey = NULL; |
| SECItem *sourceOutput = NULL; |
| SECItem *targetOutput = NULL; |
| SECItem *param = NULL; |
| int blockSize; |
| SECItem input; |
| CK_OBJECT_HANDLE targetKeyID; |
| CK_FLAGS flags; |
| PLArenaPool *arena = NULL; |
| SECStatus rv = SECSuccess; |
| CK_MECHANISM_TYPE keyMechType, cryptoMechType; |
| CK_KEY_TYPE sourceKeyType, targetKeyType; |
| CK_ATTRIBUTE symTemplate[] = { |
| { CKA_ID, NULL, 0 }, |
| { CKA_CLASS, NULL, 0 } |
| }; |
| const CK_ULONG symTemplateCount = sizeof(symTemplate) / sizeof(symTemplate[0]); |
| CK_ATTRIBUTE symCopyTemplate[] = { |
| { CKA_LABEL, NULL, 0 } |
| }; |
| CK_ULONG symCopyTemplateCount = |
| sizeof(symCopyTemplate) / sizeof(symCopyTemplate[0]); |
| |
| arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); |
| if (arena == NULL) { |
| rv = SECFailure; |
| goto done; |
| } |
| |
| sourceKeyType = PK11_ReadULongAttribute(sourceSlot, id, CKA_KEY_TYPE); |
| if (sourceKeyType == (CK_ULONG)-1) { |
| rv = SECFailure; |
| goto done; |
| } |
| |
| /* get the key mechanism */ |
| keyMechType = PK11_GetKeyMechanism(sourceKeyType); |
| /* get a mechanism suitable to encryption. |
| * PK11_GetKeyMechanism returns a mechanism that is unique to the key |
| * type. It tries to return encryption/decryption mechanisms, however |
| * CKM_DES3_CBC uses and abmiguous keyType, so keyMechType is returned as |
| * 'keygen' mechanism. Detect that case here */ |
| cryptoMechType = keyMechType; |
| if ((keyMechType == CKM_DES3_KEY_GEN) || |
| (keyMechType == CKM_DES2_KEY_GEN)) { |
| cryptoMechType = CKM_DES3_CBC; |
| } |
| |
| sourceKey = PK11_SymKeyFromHandle(sourceSlot, NULL, PK11_OriginDerive, |
| keyMechType, id, PR_FALSE, sourcePwArg); |
| if (sourceKey == NULL) { |
| rv = SECFailure; |
| goto done; |
| } |
| |
| /* check to see a key with the same CKA_ID already exists in |
| * the target slot. If it does, then we need to verify if the keys |
| * really matches. If they don't import the key with a new CKA_ID |
| * value. */ |
| rv = pk11_matchAcrossTokens(arena, targetSlot, sourceSlot, |
| symTemplate, symTemplateCount, id, &targetKeyID); |
| if (rv != SECSuccess) { |
| goto done; |
| } |
| |
| /* set up the input test */ |
| input.data = (unsigned char *)testString; |
| blockSize = PK11_GetBlockSize(cryptoMechType, NULL); |
| if (blockSize < 0) { |
| rv = SECFailure; |
| goto done; |
| } |
| input.len = blockSize; |
| if (input.len == 0) { |
| input.len = sizeof(testString); |
| } |
| while (targetKeyID != CK_INVALID_HANDLE) { |
| /* test to see if the keys are identical */ |
| targetKeyType = PK11_ReadULongAttribute(sourceSlot, id, CKA_KEY_TYPE); |
| if (targetKeyType == sourceKeyType) { |
| /* same keyType - see if it's the same key */ |
| targetKey = PK11_SymKeyFromHandle(targetSlot, NULL, |
| PK11_OriginDerive, keyMechType, targetKeyID, PR_FALSE, |
| targetPwArg); |
| /* get a parameter if we don't already have one */ |
| if (!param) { |
| param = PK11_GenerateNewParam(cryptoMechType, sourceKey); |
| if (param == NULL) { |
| rv = SECFailure; |
| goto done; |
| } |
| } |
| /* use the source key to encrypt a reference */ |
| if (!sourceOutput) { |
| rv = pk11_encrypt(sourceKey, cryptoMechType, param, &input, |
| &sourceOutput); |
| if (rv != SECSuccess) { |
| goto done; |
| } |
| } |
| /* encrypt the reference with the target key */ |
| rv = pk11_encrypt(targetKey, cryptoMechType, param, &input, |
| &targetOutput); |
| if (rv == SECSuccess) { |
| if (SECITEM_ItemsAreEqual(sourceOutput, targetOutput)) { |
| /* they produce the same output, they must be the |
| * same key */ |
| goto done; |
| } |
| SECITEM_FreeItem(targetOutput, PR_TRUE); |
| targetOutput = NULL; |
| } |
| PK11_FreeSymKey(targetKey); |
| targetKey = NULL; |
| } |
| /* keys aren't equal, update the KEY_ID and look again */ |
| rv = pk11_incrementID(arena, &symTemplate[0]); |
| if (rv != SECSuccess) { |
| goto done; |
| } |
| targetKeyID = pk11_FindObjectByTemplate(targetSlot, |
| symTemplate, symTemplateCount); |
| } |
| |
| /* we didn't find a matching key, import this one with the new |
| * CKAID */ |
| flags = pk11_getSecretKeyFlags(sourceSlot, id); |
| targetKey = PK11_MoveSymKey(targetSlot, PK11_OriginDerive, flags, PR_TRUE, |
| sourceKey); |
| if (targetKey == NULL) { |
| rv = SECFailure; |
| goto done; |
| } |
| /* set the key new CKAID */ |
| rv = pk11_setAttributes(targetSlot, targetKey->objectID, symTemplate, 1); |
| if (rv != SECSuccess) { |
| goto done; |
| } |
| |
| /* fill in remaining attributes */ |
| rv = pk11_copyAttributes(arena, targetSlot, targetKey->objectID, |
| sourceSlot, id, symCopyTemplate, symCopyTemplateCount); |
| done: |
| if (sourceKey) { |
| PK11_FreeSymKey(sourceKey); |
| } |
| if (targetKey) { |
| PK11_FreeSymKey(targetKey); |
| } |
| if (sourceOutput) { |
| SECITEM_FreeItem(sourceOutput, PR_TRUE); |
| } |
| if (targetOutput) { |
| SECITEM_FreeItem(targetOutput, PR_TRUE); |
| } |
| if (param) { |
| SECITEM_FreeItem(param, PR_TRUE); |
| } |
| if (arena) { |
| PORT_FreeArena(arena, PR_FALSE); |
| } |
| return rv; |
| } |
| |
| /************************************************************************* |
| * |
| * Public Keys |
| * |
| *************************************************************************/ |
| |
| /* |
| * Merge public key |
| * |
| * Use the high level NSS calls to extract the public key and import it |
| * into the token. Extra attributes are then copied to the new token. |
| */ |
| static SECStatus |
| pk11_mergePublicKey(PK11SlotInfo *targetSlot, PK11SlotInfo *sourceSlot, |
| CK_OBJECT_HANDLE id, void *targetPwArg, void *sourcePwArg) |
| { |
| SECKEYPublicKey *sourceKey = NULL; |
| CK_OBJECT_HANDLE targetKeyID; |
| PLArenaPool *arena = NULL; |
| SECStatus rv = SECSuccess; |
| CK_ATTRIBUTE pubTemplate[] = { |
| { CKA_ID, NULL, 0 }, |
| { CKA_CLASS, NULL, 0 } |
| }; |
| CK_ULONG pubTemplateCount = sizeof(pubTemplate) / sizeof(pubTemplate[0]); |
| CK_ATTRIBUTE pubCopyTemplate[] = { |
| { CKA_ID, NULL, 0 }, |
| { CKA_LABEL, NULL, 0 }, |
| { CKA_SUBJECT, NULL, 0 } |
| }; |
| CK_ULONG pubCopyTemplateCount = |
| sizeof(pubCopyTemplate) / sizeof(pubCopyTemplate[0]); |
| |
| arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); |
| if (arena == NULL) { |
| rv = SECFailure; |
| goto done; |
| } |
| |
| /* check to see if the key is already in the target slot */ |
| rv = pk11_matchAcrossTokens(arena, targetSlot, sourceSlot, pubTemplate, |
| pubTemplateCount, id, &targetKeyID); |
| if (rv != SECSuccess) { |
| goto done; |
| } |
| |
| /* Key is already in the target slot */ |
| if (targetKeyID != CK_INVALID_HANDLE) { |
| /* not an error ... */ |
| goto done; |
| } |
| |
| /* fetch an NSS representation of the public key */ |
| sourceKey = PK11_ExtractPublicKey(sourceSlot, nullKey, id); |
| if (sourceKey == NULL) { |
| rv = SECFailure; |
| goto done; |
| } |
| |
| /* load the public key into the target token. */ |
| targetKeyID = PK11_ImportPublicKey(targetSlot, sourceKey, PR_TRUE); |
| if (targetKeyID == CK_INVALID_HANDLE) { |
| rv = SECFailure; |
| goto done; |
| } |
| |
| /* fill in remaining attributes */ |
| rv = pk11_copyAttributes(arena, targetSlot, targetKeyID, sourceSlot, id, |
| pubCopyTemplate, pubCopyTemplateCount); |
| |
| done: |
| if (sourceKey) { |
| SECKEY_DestroyPublicKey(sourceKey); |
| } |
| if (arena) { |
| PORT_FreeArena(arena, PR_FALSE); |
| } |
| return rv; |
| } |
| |
| /************************************************************************* |
| * |
| * Certificates |
| * |
| *************************************************************************/ |
| |
| /* |
| * Two copies of the source code for this algorithm exist in NSS. |
| * Changes must be made in both copies. |
| * The other copy is in sftkdb_resolveConflicts() in softoken/sftkdb.c. |
| */ |
| static char * |
| pk11_IncrementNickname(char *nickname) |
| { |
| char *newNickname = NULL; |
| int end; |
| int digit; |
| int len = strlen(nickname); |
| |
| /* does nickname end with " #n*" ? */ |
| for (end = len - 1; |
| end >= 2 && (digit = nickname[end]) <= '9' && digit >= '0'; |
| end--) /* just scan */ |
| ; |
| if (len >= 3 && |
| end < (len - 1) /* at least one digit */ && |
| nickname[end] == '#' && |
| nickname[end - 1] == ' ') { |
| /* Already has a suitable suffix string */ |
| } else { |
| /* ... append " #2" to the name */ |
| static const char num2[] = " #2"; |
| newNickname = PORT_Realloc(nickname, len + sizeof(num2)); |
| if (newNickname) { |
| PORT_Strcat(newNickname, num2); |
| } else { |
| PORT_Free(nickname); |
| } |
| return newNickname; |
| } |
| |
| for (end = len - 1; |
| end >= 0 && (digit = nickname[end]) <= '9' && digit >= '0'; |
| end--) { |
| if (digit < '9') { |
| nickname[end]++; |
| return nickname; |
| } |
| nickname[end] = '0'; |
| } |
| |
| /* we overflowed, insert a new '1' for a carry in front of the number */ |
| newNickname = PORT_Realloc(nickname, len + 2); |
| if (newNickname) { |
| newNickname[++end] = '1'; |
| PORT_Memset(&newNickname[end + 1], '0', len - end); |
| newNickname[len + 1] = 0; |
| } else { |
| PORT_Free(nickname); |
| } |
| return newNickname; |
| } |
| |
| /* |
| * merge a certificate object |
| * |
| * Use the high level NSS calls to extract and import the certificate. |
| */ |
| static SECStatus |
| pk11_mergeCert(PK11SlotInfo *targetSlot, PK11SlotInfo *sourceSlot, |
| CK_OBJECT_HANDLE id, void *targetPwArg, void *sourcePwArg) |
| { |
| CERTCertificate *sourceCert = NULL; |
| CK_OBJECT_HANDLE targetCertID = CK_INVALID_HANDLE; |
| char *nickname = NULL; |
| SECStatus rv = SECSuccess; |
| PLArenaPool *arena = NULL; |
| CK_ATTRIBUTE sourceCKAID = { CKA_ID, NULL, 0 }; |
| CK_ATTRIBUTE targetCKAID = { CKA_ID, NULL, 0 }; |
| SECStatus lrv = SECSuccess; |
| int error = SEC_ERROR_LIBRARY_FAILURE; |
| |
| sourceCert = PK11_MakeCertFromHandle(sourceSlot, id, NULL); |
| if (sourceCert == NULL) { |
| rv = SECFailure; |
| goto done; |
| } |
| |
| nickname = PK11_GetObjectNickname(sourceSlot, id); |
| |
| /* The database code will prevent nickname collisions for certs with |
| * different subjects. This code will prevent us from getting |
| * actual import errors */ |
| if (nickname) { |
| const char *tokenName = PK11_GetTokenName(targetSlot); |
| char *tokenNickname = NULL; |
| |
| do { |
| tokenNickname = PR_smprintf("%s:%s", tokenName, nickname); |
| if (!tokenNickname) { |
| break; |
| } |
| if (!SEC_CertNicknameConflict(tokenNickname, |
| &sourceCert->derSubject, CERT_GetDefaultCertDB())) { |
| break; |
| } |
| nickname = pk11_IncrementNickname(nickname); |
| if (!nickname) { |
| break; |
| } |
| PR_smprintf_free(tokenNickname); |
| } while (1); |
| if (tokenNickname) { |
| PR_smprintf_free(tokenNickname); |
| } |
| } |
| |
| /* see if the cert is already there */ |
| targetCertID = PK11_FindCertInSlot(targetSlot, sourceCert, targetPwArg); |
| if (targetCertID == CK_INVALID_HANDLE) { |
| /* cert doesn't exist load the cert in. */ |
| /* OK for the nickname to be NULL, not all certs have nicknames */ |
| rv = PK11_ImportCert(targetSlot, sourceCert, CK_INVALID_HANDLE, |
| nickname, PR_FALSE); |
| goto done; |
| } |
| |
| /* the cert already exists, see if the nickname and/or CKA_ID need |
| * to be updated */ |
| |
| arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); |
| if (arena == NULL) { |
| rv = SECFailure; |
| goto done; |
| } |
| |
| /* does our source have a CKA_ID ? */ |
| rv = PK11_GetAttributes(arena, sourceSlot, id, &sourceCKAID, 1); |
| if (rv != SECSuccess) { |
| sourceCKAID.ulValueLen = 0; |
| } |
| |
| /* if we have a source CKA_ID, see of we need to update the |
| * target's CKA_ID */ |
| if (sourceCKAID.ulValueLen != 0) { |
| rv = PK11_GetAttributes(arena, targetSlot, targetCertID, |
| &targetCKAID, 1); |
| if (rv != SECSuccess) { |
| targetCKAID.ulValueLen = 0; |
| } |
| /* if the target has no CKA_ID, update it from the source */ |
| if (targetCKAID.ulValueLen == 0) { |
| lrv = pk11_setAttributes(targetSlot, targetCertID, &sourceCKAID, 1); |
| if (lrv != SECSuccess) { |
| error = PORT_GetError(); |
| } |
| } |
| } |
| rv = SECSuccess; |
| |
| /* now check if we need to update the nickname */ |
| if (nickname && *nickname) { |
| char *targetname; |
| targetname = PK11_GetObjectNickname(targetSlot, targetCertID); |
| if (!targetname || !*targetname) { |
| /* target has no nickname, or it's empty, update it */ |
| rv = PK11_SetObjectNickname(targetSlot, targetCertID, nickname); |
| } |
| if (targetname) { |
| PORT_Free(targetname); |
| } |
| } |
| |
| /* restore the error code if CKA_ID failed, but nickname didn't */ |
| if ((rv == SECSuccess) && (lrv != SECSuccess)) { |
| rv = lrv; |
| PORT_SetError(error); |
| } |
| |
| done: |
| if (nickname) { |
| PORT_Free(nickname); |
| } |
| if (sourceCert) { |
| CERT_DestroyCertificate(sourceCert); |
| } |
| if (arena) { |
| PORT_FreeArena(arena, PR_FALSE); |
| } |
| return rv; |
| } |
| |
| /************************************************************************* |
| * |
| * Crls |
| * |
| *************************************************************************/ |
| |
| /* |
| * Use the raw PKCS #11 interface to merge the CRLs. |
| * |
| * In the case where of collision, choose the newest CRL that is valid. |
| */ |
| static SECStatus |
| pk11_mergeCrl(PK11SlotInfo *targetSlot, PK11SlotInfo *sourceSlot, |
| CK_OBJECT_HANDLE id, void *targetPwArg, void *sourcePwArg) |
| { |
| CK_OBJECT_HANDLE targetCrlID; |
| PLArenaPool *arena = NULL; |
| SECStatus rv = SECSuccess; |
| CK_ATTRIBUTE crlTemplate[] = { |
| { CKA_SUBJECT, NULL, 0 }, |
| { CKA_CLASS, NULL, 0 }, |
| { CKA_NSS_KRL, NULL, 0 } |
| }; |
| CK_ULONG crlTemplateCount = sizeof(crlTemplate) / sizeof(crlTemplate[0]); |
| CK_ATTRIBUTE crlCopyTemplate[] = { |
| { CKA_CLASS, NULL, 0 }, |
| { CKA_TOKEN, NULL, 0 }, |
| { CKA_LABEL, NULL, 0 }, |
| { CKA_PRIVATE, NULL, 0 }, |
| { CKA_MODIFIABLE, NULL, 0 }, |
| { CKA_SUBJECT, NULL, 0 }, |
| { CKA_NSS_KRL, NULL, 0 }, |
| { CKA_NSS_URL, NULL, 0 }, |
| { CKA_VALUE, NULL, 0 } |
| }; |
| CK_ULONG crlCopyTemplateCount = |
| sizeof(crlCopyTemplate) / sizeof(crlCopyTemplate[0]); |
| |
| arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); |
| if (arena == NULL) { |
| rv = SECFailure; |
| goto done; |
| } |
| /* check to see if the crl is already in the target slot */ |
| rv = pk11_matchAcrossTokens(arena, targetSlot, sourceSlot, crlTemplate, |
| crlTemplateCount, id, &targetCrlID); |
| if (rv != SECSuccess) { |
| goto done; |
| } |
| if (targetCrlID != CK_INVALID_HANDLE) { |
| /* we already have a CRL, check to see which is more up-to-date. */ |
| goto done; |
| } |
| |
| /* load the CRL into the target token. */ |
| rv = pk11_copyAttributes(arena, targetSlot, targetCrlID, sourceSlot, id, |
| crlCopyTemplate, crlCopyTemplateCount); |
| done: |
| if (arena) { |
| PORT_FreeArena(arena, PR_FALSE); |
| } |
| return rv; |
| } |
| |
| /************************************************************************* |
| * |
| * SMIME objects |
| * |
| *************************************************************************/ |
| |
| /* |
| * use the raw PKCS #11 interface to merge the S/MIME records |
| */ |
| static SECStatus |
| pk11_mergeSmime(PK11SlotInfo *targetSlot, PK11SlotInfo *sourceSlot, |
| CK_OBJECT_HANDLE id, void *targetPwArg, void *sourcePwArg) |
| { |
| CK_OBJECT_HANDLE targetSmimeID; |
| PLArenaPool *arena = NULL; |
| SECStatus rv = SECSuccess; |
| CK_ATTRIBUTE smimeTemplate[] = { |
| { CKA_SUBJECT, NULL, 0 }, |
| { CKA_NSS_EMAIL, NULL, 0 }, |
| { CKA_CLASS, NULL, 0 }, |
| }; |
| CK_ULONG smimeTemplateCount = |
| sizeof(smimeTemplate) / sizeof(smimeTemplate[0]); |
| CK_ATTRIBUTE smimeCopyTemplate[] = { |
| { CKA_CLASS, NULL, 0 }, |
| { CKA_TOKEN, NULL, 0 }, |
| { CKA_LABEL, NULL, 0 }, |
| { CKA_PRIVATE, NULL, 0 }, |
| { CKA_MODIFIABLE, NULL, 0 }, |
| { CKA_SUBJECT, NULL, 0 }, |
| { CKA_NSS_EMAIL, NULL, 0 }, |
| { CKA_NSS_SMIME_TIMESTAMP, NULL, 0 }, |
| { CKA_VALUE, NULL, 0 } |
| }; |
| CK_ULONG smimeCopyTemplateCount = |
| sizeof(smimeCopyTemplate) / sizeof(smimeCopyTemplate[0]); |
| |
| arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); |
| if (arena == NULL) { |
| rv = SECFailure; |
| goto done; |
| } |
| /* check to see if the crl is already in the target slot */ |
| rv = pk11_matchAcrossTokens(arena, targetSlot, sourceSlot, smimeTemplate, |
| smimeTemplateCount, id, &targetSmimeID); |
| if (rv != SECSuccess) { |
| goto done; |
| } |
| if (targetSmimeID != CK_INVALID_HANDLE) { |
| /* we already have a SMIME record */ |
| goto done; |
| } |
| |
| /* load the SMime Record into the target token. */ |
| rv = pk11_copyAttributes(arena, targetSlot, targetSmimeID, sourceSlot, id, |
| smimeCopyTemplate, smimeCopyTemplateCount); |
| done: |
| if (arena) { |
| PORT_FreeArena(arena, PR_FALSE); |
| } |
| return rv; |
| } |
| |
| /************************************************************************* |
| * |
| * Trust Objects |
| * |
| *************************************************************************/ |
| |
| /* |
| * decide which trust record entry wins. PR_TRUE (source) or PR_FALSE (target) |
| */ |
| #define USE_TARGET PR_FALSE |
| #define USE_SOURCE PR_TRUE |
| PRBool |
| pk11_mergeTrustEntry(CK_ATTRIBUTE *target, CK_ATTRIBUTE *source) |
| { |
| CK_ULONG targetTrust = (target->ulValueLen == sizeof(CK_LONG)) ? *(CK_ULONG *)target->pValue |
| : CKT_NSS_TRUST_UNKNOWN; |
| CK_ULONG sourceTrust = (source->ulValueLen == sizeof(CK_LONG)) ? *(CK_ULONG *)source->pValue |
| : CKT_NSS_TRUST_UNKNOWN; |
| |
| /* |
| * Examine a single entry and deside if the source or target version |
| * should win out. When all the entries have been checked, if there is |
| * any case we need to update, we will write the whole source record |
| * to the target database. That means for each individual record, if the |
| * target wins, we need to update the source (in case later we have a |
| * case where the source wins). If the source wins, it already |
| */ |
| if (sourceTrust == targetTrust) { |
| return USE_TARGET; /* which equates to 'do nothing' */ |
| } |
| |
| if (sourceTrust == CKT_NSS_TRUST_UNKNOWN) { |
| return USE_TARGET; |
| } |
| |
| /* target has no idea, use the source's idea of the trust value */ |
| if (targetTrust == CKT_NSS_TRUST_UNKNOWN) { |
| /* source overwrites the target */ |
| return USE_SOURCE; |
| } |
| |
| /* so both the target and the source have some idea of what this |
| * trust attribute should be, and neither agree exactly. |
| * At this point, we prefer 'hard' attributes over 'soft' ones. |
| * 'hard' ones are CKT_NSS_TRUSTED, CKT_NSS_TRUSTED_DELEGATOR, and |
| * CKT_NSS_UNTRUTED. Soft ones are ones which don't change the |
| * actual trust of the cert (CKT_MUST_VERIFY, CKT_NSS_VALID, |
| * CKT_NSS_VALID_DELEGATOR). |
| */ |
| if ((sourceTrust == CKT_NSS_MUST_VERIFY_TRUST) || |
| (sourceTrust == CKT_NSS_VALID_DELEGATOR)) { |
| return USE_TARGET; |
| } |
| if ((targetTrust == CKT_NSS_MUST_VERIFY_TRUST) || |
| (targetTrust == CKT_NSS_VALID_DELEGATOR)) { |
| /* source overrites the target */ |
| return USE_SOURCE; |
| } |
| |
| /* both have hard attributes, we have a conflict, let the target win. */ |
| return USE_TARGET; |
| } |
| /* |
| * use the raw PKCS #11 interface to merge the S/MIME records |
| */ |
| static SECStatus |
| pk11_mergeTrust(PK11SlotInfo *targetSlot, PK11SlotInfo *sourceSlot, |
| CK_OBJECT_HANDLE id, void *targetPwArg, void *sourcePwArg) |
| { |
| CK_OBJECT_HANDLE targetTrustID; |
| PLArenaPool *arena = NULL; |
| SECStatus rv = SECSuccess; |
| int error = 0; |
| CK_ATTRIBUTE trustTemplate[] = { |
| { CKA_ISSUER, NULL, 0 }, |
| { CKA_SERIAL_NUMBER, NULL, 0 }, |
| { CKA_CLASS, NULL, 0 }, |
| }; |
| CK_ULONG trustTemplateCount = |
| sizeof(trustTemplate) / sizeof(trustTemplate[0]); |
| CK_ATTRIBUTE trustCopyTemplate[] = { |
| { CKA_CLASS, NULL, 0 }, |
| { CKA_TOKEN, NULL, 0 }, |
| { CKA_LABEL, NULL, 0 }, |
| { CKA_PRIVATE, NULL, 0 }, |
| { CKA_MODIFIABLE, NULL, 0 }, |
| { CKA_ISSUER, NULL, 0 }, |
| { CKA_SERIAL_NUMBER, NULL, 0 }, |
| { CKA_CERT_SHA1_HASH, NULL, 0 }, |
| { CKA_CERT_MD5_HASH, NULL, 0 }, |
| { CKA_TRUST_SERVER_AUTH, NULL, 0 }, |
| { CKA_TRUST_CLIENT_AUTH, NULL, 0 }, |
| { CKA_TRUST_CODE_SIGNING, NULL, 0 }, |
| { CKA_TRUST_EMAIL_PROTECTION, NULL, 0 }, |
| { CKA_TRUST_STEP_UP_APPROVED, NULL, 0 } |
| }; |
| CK_ULONG trustCopyTemplateCount = |
| sizeof(trustCopyTemplate) / sizeof(trustCopyTemplate[0]); |
| |
| arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); |
| if (arena == NULL) { |
| rv = SECFailure; |
| goto done; |
| } |
| /* check to see if the crl is already in the target slot */ |
| rv = pk11_matchAcrossTokens(arena, targetSlot, sourceSlot, trustTemplate, |
| trustTemplateCount, id, &targetTrustID); |
| if (rv != SECSuccess) { |
| goto done; |
| } |
| if (targetTrustID != CK_INVALID_HANDLE) { |
| /* a matching trust record already exists, merge it in */ |
| CK_ATTRIBUTE_TYPE trustAttrs[] = { |
| CKA_TRUST_SERVER_AUTH, CKA_TRUST_CLIENT_AUTH, |
| CKA_TRUST_CODE_SIGNING, CKA_TRUST_EMAIL_PROTECTION, |
| CKA_TRUST_IPSEC_TUNNEL, CKA_TRUST_IPSEC_USER, |
| CKA_TRUST_TIME_STAMPING |
| }; |
| CK_ULONG trustAttrsCount = |
| sizeof(trustAttrs) / sizeof(trustAttrs[0]); |
| |
| CK_ULONG i; |
| CK_ATTRIBUTE targetTemplate, sourceTemplate; |
| |
| /* existing trust record, merge the two together */ |
| for (i = 0; i < trustAttrsCount; i++) { |
| targetTemplate.type = sourceTemplate.type = trustAttrs[i]; |
| targetTemplate.pValue = sourceTemplate.pValue = NULL; |
| targetTemplate.ulValueLen = sourceTemplate.ulValueLen = 0; |
| PK11_GetAttributes(arena, sourceSlot, id, &sourceTemplate, 1); |
| PK11_GetAttributes(arena, targetSlot, targetTrustID, |
| &targetTemplate, 1); |
| if (pk11_mergeTrustEntry(&targetTemplate, &sourceTemplate)) { |
| /* source wins, write out the source attribute to the target */ |
| SECStatus lrv = pk11_setAttributes(targetSlot, targetTrustID, |
| &sourceTemplate, 1); |
| if (lrv != SECSuccess) { |
| rv = SECFailure; |
| error = PORT_GetError(); |
| } |
| } |
| } |
| |
| /* handle step */ |
| sourceTemplate.type = CKA_TRUST_STEP_UP_APPROVED; |
| sourceTemplate.pValue = NULL; |
| sourceTemplate.ulValueLen = 0; |
| |
| /* if the source has steup set, then set it in the target */ |
| PK11_GetAttributes(arena, sourceSlot, id, &sourceTemplate, 1); |
| if ((sourceTemplate.ulValueLen == sizeof(CK_BBOOL)) && |
| (sourceTemplate.pValue) && |
| (*(CK_BBOOL *)sourceTemplate.pValue == CK_TRUE)) { |
| SECStatus lrv = pk11_setAttributes(targetSlot, targetTrustID, |
| &sourceTemplate, 1); |
| if (lrv != SECSuccess) { |
| rv = SECFailure; |
| error = PORT_GetError(); |
| } |
| } |
| |
| goto done; |
| } |
| |
| /* load the new trust Record into the target token. */ |
| rv = pk11_copyAttributes(arena, targetSlot, targetTrustID, sourceSlot, id, |
| trustCopyTemplate, trustCopyTemplateCount); |
| done: |
| if (arena) { |
| PORT_FreeArena(arena, PR_FALSE); |
| } |
| |
| /* restore the error code */ |
| if (rv == SECFailure && error) { |
| PORT_SetError(error); |
| } |
| |
| return rv; |
| } |
| |
| /************************************************************************* |
| * |
| * Central merge code |
| * |
| *************************************************************************/ |
| /* |
| * merge a single object from sourceToken to targetToken |
| */ |
| static SECStatus |
| pk11_mergeObject(PK11SlotInfo *targetSlot, PK11SlotInfo *sourceSlot, |
| CK_OBJECT_HANDLE id, void *targetPwArg, void *sourcePwArg) |
| { |
| |
| CK_OBJECT_CLASS objClass; |
| |
| objClass = PK11_ReadULongAttribute(sourceSlot, id, CKA_CLASS); |
| if (objClass == (CK_ULONG)-1) { |
| PORT_SetError(SEC_ERROR_UNKNOWN_OBJECT_TYPE); |
| return SECFailure; |
| } |
| |
| switch (objClass) { |
| case CKO_CERTIFICATE: |
| return pk11_mergeCert(targetSlot, sourceSlot, id, |
| targetPwArg, sourcePwArg); |
| case CKO_NSS_TRUST: |
| return pk11_mergeTrust(targetSlot, sourceSlot, id, |
| targetPwArg, sourcePwArg); |
| case CKO_PUBLIC_KEY: |
| return pk11_mergePublicKey(targetSlot, sourceSlot, id, |
| targetPwArg, sourcePwArg); |
| case CKO_PRIVATE_KEY: |
| return pk11_mergePrivateKey(targetSlot, sourceSlot, id, |
| targetPwArg, sourcePwArg); |
| case CKO_SECRET_KEY: |
| return pk11_mergeSecretKey(targetSlot, sourceSlot, id, |
| targetPwArg, sourcePwArg); |
| case CKO_NSS_CRL: |
| return pk11_mergeCrl(targetSlot, sourceSlot, id, |
| targetPwArg, sourcePwArg); |
| case CKO_NSS_SMIME: |
| return pk11_mergeSmime(targetSlot, sourceSlot, id, |
| targetPwArg, sourcePwArg); |
| default: |
| break; |
| } |
| |
| PORT_SetError(SEC_ERROR_UNKNOWN_OBJECT_TYPE); |
| return SECFailure; |
| } |
| |
| PK11MergeLogNode * |
| pk11_newMergeLogNode(PLArenaPool *arena, |
| PK11SlotInfo *slot, CK_OBJECT_HANDLE id, int error) |
| { |
| PK11MergeLogNode *newLog; |
| PK11GenericObject *obj; |
| |
| newLog = PORT_ArenaZNew(arena, PK11MergeLogNode); |
| if (newLog == NULL) { |
| return NULL; |
| } |
| |
| obj = PORT_ArenaZNew(arena, PK11GenericObject); |
| if (!obj) { |
| return NULL; |
| } |
| |
| /* initialize it */ |
| obj->slot = slot; |
| obj->objectID = id; |
| obj->owner = PR_FALSE; |
| |
| newLog->object = obj; |
| newLog->error = error; |
| return newLog; |
| } |
| |
| /* |
| * walk down each entry and merge it. keep track of the errors in the log |
| */ |
| static SECStatus |
| pk11_mergeByObjectIDs(PK11SlotInfo *targetSlot, PK11SlotInfo *sourceSlot, |
| CK_OBJECT_HANDLE *objectIDs, int count, |
| PK11MergeLog *log, void *targetPwArg, void *sourcePwArg) |
| { |
| SECStatus rv = SECSuccess; |
| int error = SEC_ERROR_LIBRARY_FAILURE; |
| int i; |
| |
| for (i = 0; i < count; i++) { |
| /* try to update the entire database. On failure, keep going, |
| * but remember the error to report back to the caller */ |
| SECStatus lrv; |
| PK11MergeLogNode *newLog; |
| |
| lrv = pk11_mergeObject(targetSlot, sourceSlot, objectIDs[i], |
| targetPwArg, sourcePwArg); |
| if (lrv == SECSuccess) { |
| /* merged with no problem, go to next object */ |
| continue; |
| } |
| |
| /* remember that we failed and why */ |
| rv = SECFailure; |
| error = PORT_GetError(); |
| |
| /* log the errors */ |
| if (!log) { |
| /* not logging, go to next entry */ |
| continue; |
| } |
| newLog = pk11_newMergeLogNode(log->arena, sourceSlot, |
| objectIDs[i], error); |
| if (!newLog) { |
| /* failed to allocate entry, just keep going */ |
| continue; |
| } |
| |
| /* link in the errorlog entry */ |
| newLog->next = NULL; |
| if (log->tail) { |
| log->tail->next = newLog; |
| } else { |
| log->head = newLog; |
| } |
| newLog->prev = log->tail; |
| log->tail = newLog; |
| } |
| |
| /* restore the last error code */ |
| if (rv != SECSuccess) { |
| PORT_SetError(error); |
| } |
| return rv; |
| } |
| |
| /* |
| * Merge all the records in sourceSlot that aren't in targetSlot |
| * |
| * This function will return failure if not all the objects |
| * successfully merged. |
| * |
| * Applications can pass in an optional error log which will record |
| * each failing object and why it failed to import. PK11MergeLog |
| * is modelled after the CERTVerifyLog. |
| */ |
| SECStatus |
| PK11_MergeTokens(PK11SlotInfo *targetSlot, PK11SlotInfo *sourceSlot, |
| PK11MergeLog *log, void *targetPwArg, void *sourcePwArg) |
| { |
| SECStatus rv = SECSuccess, lrv = SECSuccess; |
| int error = SEC_ERROR_LIBRARY_FAILURE; |
| int count = 0; |
| CK_ATTRIBUTE search[2]; |
| CK_OBJECT_HANDLE *objectIDs = NULL; |
| CK_BBOOL ck_true = CK_TRUE; |
| CK_OBJECT_CLASS privKey = CKO_PRIVATE_KEY; |
| |
| PK11_SETATTRS(&search[0], CKA_TOKEN, &ck_true, sizeof(ck_true)); |
| PK11_SETATTRS(&search[1], CKA_CLASS, &privKey, sizeof(privKey)); |
| /* |
| * make sure both tokens are already authenticated if need be. |
| */ |
| rv = PK11_Authenticate(targetSlot, PR_TRUE, targetPwArg); |
| if (rv != SECSuccess) { |
| goto loser; |
| } |
| rv = PK11_Authenticate(sourceSlot, PR_TRUE, sourcePwArg); |
| if (rv != SECSuccess) { |
| goto loser; |
| } |
| |
| /* turns out the old DB's are rather fragile if the private keys aren't |
| * merged in first, so do the private keys explicity. */ |
| objectIDs = pk11_FindObjectsByTemplate(sourceSlot, search, 2, &count); |
| if (objectIDs) { |
| lrv = pk11_mergeByObjectIDs(targetSlot, sourceSlot, |
| objectIDs, count, log, |
| targetPwArg, sourcePwArg); |
| if (lrv != SECSuccess) { |
| error = PORT_GetError(); |
| } |
| PORT_Free(objectIDs); |
| count = 0; |
| } |
| |
| /* now do the rest (NOTE: this will repeat the private keys, but |
| * that shouldnt' be an issue as we will notice they are already |
| * merged in */ |
| objectIDs = pk11_FindObjectsByTemplate(sourceSlot, search, 1, &count); |
| if (!objectIDs) { |
| rv = SECFailure; |
| goto loser; |
| } |
| |
| rv = pk11_mergeByObjectIDs(targetSlot, sourceSlot, objectIDs, count, log, |
| targetPwArg, sourcePwArg); |
| if (rv == SECSuccess) { |
| /* if private keys failed, but the rest succeeded, be sure to let |
| * the caller know that private keys failed and why. |
| * NOTE: this is highly unlikely since the same keys that failed |
| * in the previous merge call will most likely fail in this one */ |
| if (lrv != SECSuccess) { |
| rv = lrv; |
| PORT_SetError(error); |
| } |
| } |
| |
| loser: |
| if (objectIDs) { |
| PORT_Free(objectIDs); |
| } |
| return rv; |
| } |
| |
| PK11MergeLog * |
| PK11_CreateMergeLog(void) |
| { |
| PLArenaPool *arena; |
| PK11MergeLog *log; |
| |
| arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); |
| if (arena == NULL) { |
| return NULL; |
| } |
| |
| log = PORT_ArenaZNew(arena, PK11MergeLog); |
| if (log == NULL) { |
| PORT_FreeArena(arena, PR_FALSE); |
| return NULL; |
| } |
| log->arena = arena; |
| log->version = 1; |
| return log; |
| } |
| |
| void |
| PK11_DestroyMergeLog(PK11MergeLog *log) |
| { |
| if (log && log->arena) { |
| PORT_FreeArena(log->arena, PR_FALSE); |
| } |
| } |
