| /* This Source Code Form is subject to the terms of the Mozilla Public |
| * License, v. 2.0. If a copy of the MPL was not distributed with this |
| * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ |
| #include "secitem.h" |
| #include "pkcs11.h" |
| #include "lgdb.h" |
| #include "lowkeyi.h" |
| #include "pcert.h" |
| #include "blapi.h" |
| |
| #include "keydbi.h" |
| |
| /* |
| * This code maps PKCS #11 Finds to legacy database searches. This code |
| * was orginally in pkcs11.c in previous versions of NSS. |
| */ |
| |
| struct SDBFindStr { |
| CK_OBJECT_HANDLE *handles; |
| int size; |
| int index; |
| int array_size; |
| }; |
| |
| /* |
| * free a search structure |
| */ |
| void |
| lg_FreeSearch(SDBFind *search) |
| { |
| if (search->handles) { |
| PORT_Free(search->handles); |
| } |
| PORT_Free(search); |
| } |
| |
| void |
| lg_addHandle(SDBFind *search, CK_OBJECT_HANDLE handle) |
| { |
| if (search->handles == NULL) { |
| return; |
| } |
| if (search->size >= search->array_size) { |
| search->array_size += LG_SEARCH_BLOCK_SIZE; |
| search->handles = (CK_OBJECT_HANDLE *)PORT_Realloc(search->handles, |
| sizeof(CK_OBJECT_HANDLE) * search->array_size); |
| if (search->handles == NULL) { |
| return; |
| } |
| } |
| search->handles[search->size] = handle; |
| search->size++; |
| } |
| |
| /* |
| * find any certs that may match the template and load them. |
| */ |
| #define LG_CERT 0x00000001 |
| #define LG_TRUST 0x00000002 |
| #define LG_CRL 0x00000004 |
| #define LG_SMIME 0x00000008 |
| #define LG_PRIVATE 0x00000010 |
| #define LG_PUBLIC 0x00000020 |
| #define LG_KEY 0x00000040 |
| |
| /* |
| * structure to collect key handles. |
| */ |
| typedef struct lgEntryDataStr { |
| SDB *sdb; |
| SDBFind *searchHandles; |
| const CK_ATTRIBUTE *template; |
| CK_ULONG templ_count; |
| } lgEntryData; |
| |
| static SECStatus |
| lg_crl_collect(SECItem *data, SECItem *key, certDBEntryType type, void *arg) |
| { |
| lgEntryData *crlData; |
| CK_OBJECT_HANDLE class_handle; |
| SDB *sdb; |
| |
| crlData = (lgEntryData *)arg; |
| sdb = crlData->sdb; |
| |
| class_handle = (type == certDBEntryTypeRevocation) ? LG_TOKEN_TYPE_CRL : LG_TOKEN_KRL_HANDLE; |
| if (lg_tokenMatch(sdb, key, class_handle, |
| crlData->template, crlData->templ_count)) { |
| lg_addHandle(crlData->searchHandles, |
| lg_mkHandle(sdb, key, class_handle)); |
| } |
| return (SECSuccess); |
| } |
| |
| static void |
| lg_searchCrls(SDB *sdb, SECItem *derSubject, PRBool isKrl, |
| unsigned long classFlags, SDBFind *search, |
| const CK_ATTRIBUTE *pTemplate, CK_ULONG ulCount) |
| { |
| NSSLOWCERTCertDBHandle *certHandle = NULL; |
| |
| certHandle = lg_getCertDB(sdb); |
| if (certHandle == NULL) { |
| return; |
| } |
| if (derSubject->data != NULL) { |
| certDBEntryRevocation *crl = |
| nsslowcert_FindCrlByKey(certHandle, derSubject, isKrl); |
| |
| if (crl != NULL) { |
| lg_addHandle(search, lg_mkHandle(sdb, derSubject, |
| isKrl ? LG_TOKEN_KRL_HANDLE : LG_TOKEN_TYPE_CRL)); |
| nsslowcert_DestroyDBEntry((certDBEntry *)crl); |
| } |
| } else { |
| lgEntryData crlData; |
| |
| /* traverse */ |
| crlData.sdb = sdb; |
| crlData.searchHandles = search; |
| crlData.template = pTemplate; |
| crlData.templ_count = ulCount; |
| nsslowcert_TraverseDBEntries(certHandle, certDBEntryTypeRevocation, |
| lg_crl_collect, (void *)&crlData); |
| nsslowcert_TraverseDBEntries(certHandle, certDBEntryTypeKeyRevocation, |
| lg_crl_collect, (void *)&crlData); |
| } |
| } |
| |
| /* |
| * structure to collect key handles. |
| */ |
| typedef struct lgKeyDataStr { |
| SDB *sdb; |
| NSSLOWKEYDBHandle *keyHandle; |
| SDBFind *searchHandles; |
| SECItem *id; |
| const CK_ATTRIBUTE *template; |
| CK_ULONG templ_count; |
| unsigned long classFlags; |
| PRBool strict; |
| } lgKeyData; |
| |
| static PRBool |
| isSecretKey(NSSLOWKEYPrivateKey *privKey) |
| { |
| if (privKey->keyType == NSSLOWKEYRSAKey && |
| privKey->u.rsa.publicExponent.len == 1 && |
| privKey->u.rsa.publicExponent.data[0] == 0) |
| return PR_TRUE; |
| |
| return PR_FALSE; |
| } |
| |
| static SECStatus |
| lg_key_collect(DBT *key, DBT *data, void *arg) |
| { |
| lgKeyData *keyData; |
| NSSLOWKEYPrivateKey *privKey = NULL; |
| SECItem tmpDBKey; |
| SDB *sdb; |
| unsigned long classFlags; |
| |
| keyData = (lgKeyData *)arg; |
| sdb = keyData->sdb; |
| classFlags = keyData->classFlags; |
| |
| tmpDBKey.data = key->data; |
| tmpDBKey.len = key->size; |
| tmpDBKey.type = siBuffer; |
| |
| PORT_Assert(keyData->keyHandle); |
| if (!keyData->strict && keyData->id && keyData->id->data) { |
| SECItem result; |
| PRBool haveMatch = PR_FALSE; |
| unsigned char hashKey[SHA1_LENGTH]; |
| result.data = hashKey; |
| result.len = sizeof(hashKey); |
| |
| if (keyData->id->len == 0) { |
| /* Make sure this isn't a LG_KEY */ |
| privKey = nsslowkey_FindKeyByPublicKey(keyData->keyHandle, |
| &tmpDBKey, keyData->sdb /*->password*/); |
| if (privKey) { |
| /* turn off the unneeded class flags */ |
| classFlags &= isSecretKey(privKey) ? ~(LG_PRIVATE | LG_PUBLIC) : ~LG_KEY; |
| haveMatch = (PRBool)((classFlags & (LG_KEY | LG_PRIVATE | LG_PUBLIC)) != 0); |
| lg_nsslowkey_DestroyPrivateKey(privKey); |
| } |
| } else { |
| SHA1_HashBuf(hashKey, key->data, key->size); /* match id */ |
| haveMatch = SECITEM_ItemsAreEqual(keyData->id, &result); |
| if (!haveMatch && ((unsigned char *)key->data)[0] == 0) { |
| /* This is a fix for backwards compatibility. The key |
| * database indexes private keys by the public key, and |
| * versions of NSS prior to 3.4 stored the public key as |
| * a signed integer. The public key is now treated as an |
| * unsigned integer, with no leading zero. In order to |
| * correctly compute the hash of an old key, it is necessary |
| * to fallback and detect the leading zero. |
| */ |
| SHA1_HashBuf(hashKey, |
| (unsigned char *)key->data + 1, key->size - 1); |
| haveMatch = SECITEM_ItemsAreEqual(keyData->id, &result); |
| } |
| } |
| if (haveMatch) { |
| if (classFlags & LG_PRIVATE) { |
| lg_addHandle(keyData->searchHandles, |
| lg_mkHandle(sdb, &tmpDBKey, LG_TOKEN_TYPE_PRIV)); |
| } |
| if (classFlags & LG_PUBLIC) { |
| lg_addHandle(keyData->searchHandles, |
| lg_mkHandle(sdb, &tmpDBKey, LG_TOKEN_TYPE_PUB)); |
| } |
| if (classFlags & LG_KEY) { |
| lg_addHandle(keyData->searchHandles, |
| lg_mkHandle(sdb, &tmpDBKey, LG_TOKEN_TYPE_KEY)); |
| } |
| } |
| return SECSuccess; |
| } |
| |
| privKey = nsslowkey_FindKeyByPublicKey(keyData->keyHandle, &tmpDBKey, |
| keyData->sdb /*->password*/); |
| if (privKey == NULL) { |
| goto loser; |
| } |
| |
| if (isSecretKey(privKey)) { |
| if ((classFlags & LG_KEY) && |
| lg_tokenMatch(keyData->sdb, &tmpDBKey, LG_TOKEN_TYPE_KEY, |
| keyData->template, keyData->templ_count)) { |
| lg_addHandle(keyData->searchHandles, |
| lg_mkHandle(keyData->sdb, &tmpDBKey, LG_TOKEN_TYPE_KEY)); |
| } |
| } else { |
| if ((classFlags & LG_PRIVATE) && |
| lg_tokenMatch(keyData->sdb, &tmpDBKey, LG_TOKEN_TYPE_PRIV, |
| keyData->template, keyData->templ_count)) { |
| lg_addHandle(keyData->searchHandles, |
| lg_mkHandle(keyData->sdb, &tmpDBKey, LG_TOKEN_TYPE_PRIV)); |
| } |
| if ((classFlags & LG_PUBLIC) && |
| lg_tokenMatch(keyData->sdb, &tmpDBKey, LG_TOKEN_TYPE_PUB, |
| keyData->template, keyData->templ_count)) { |
| lg_addHandle(keyData->searchHandles, |
| lg_mkHandle(keyData->sdb, &tmpDBKey, LG_TOKEN_TYPE_PUB)); |
| } |
| } |
| |
| loser: |
| if (privKey) { |
| lg_nsslowkey_DestroyPrivateKey(privKey); |
| } |
| return (SECSuccess); |
| } |
| |
| static void |
| lg_searchKeys(SDB *sdb, SECItem *key_id, |
| unsigned long classFlags, SDBFind *search, PRBool mustStrict, |
| const CK_ATTRIBUTE *pTemplate, CK_ULONG ulCount) |
| { |
| NSSLOWKEYDBHandle *keyHandle = NULL; |
| NSSLOWKEYPrivateKey *privKey; |
| lgKeyData keyData; |
| PRBool found = PR_FALSE; |
| |
| keyHandle = lg_getKeyDB(sdb); |
| if (keyHandle == NULL) { |
| return; |
| } |
| |
| if (key_id->data) { |
| privKey = nsslowkey_FindKeyByPublicKey(keyHandle, key_id, sdb); |
| if (privKey) { |
| if ((classFlags & LG_KEY) && isSecretKey(privKey)) { |
| lg_addHandle(search, |
| lg_mkHandle(sdb, key_id, LG_TOKEN_TYPE_KEY)); |
| found = PR_TRUE; |
| } |
| if ((classFlags & LG_PRIVATE) && !isSecretKey(privKey)) { |
| lg_addHandle(search, |
| lg_mkHandle(sdb, key_id, LG_TOKEN_TYPE_PRIV)); |
| found = PR_TRUE; |
| } |
| if ((classFlags & LG_PUBLIC) && !isSecretKey(privKey)) { |
| lg_addHandle(search, |
| lg_mkHandle(sdb, key_id, LG_TOKEN_TYPE_PUB)); |
| found = PR_TRUE; |
| } |
| lg_nsslowkey_DestroyPrivateKey(privKey); |
| } |
| /* don't do the traversal if we have an up to date db */ |
| if (keyHandle->version != 3) { |
| goto loser; |
| } |
| /* don't do the traversal if it can't possibly be the correct id */ |
| /* all soft token id's are SHA1_HASH_LEN's */ |
| if (key_id->len != SHA1_LENGTH) { |
| goto loser; |
| } |
| if (found) { |
| /* if we already found some keys, don't do the traversal */ |
| goto loser; |
| } |
| } |
| keyData.sdb = sdb; |
| keyData.keyHandle = keyHandle; |
| keyData.searchHandles = search; |
| keyData.id = key_id; |
| keyData.template = pTemplate; |
| keyData.templ_count = ulCount; |
| keyData.classFlags = classFlags; |
| keyData.strict = mustStrict ? mustStrict : LG_STRICT; |
| |
| nsslowkey_TraverseKeys(keyHandle, lg_key_collect, &keyData); |
| |
| loser: |
| return; |
| } |
| |
| /* |
| * structure to collect certs into |
| */ |
| typedef struct lgCertDataStr { |
| SDB *sdb; |
| int cert_count; |
| int max_cert_count; |
| NSSLOWCERTCertificate **certs; |
| const CK_ATTRIBUTE *template; |
| CK_ULONG templ_count; |
| unsigned long classFlags; |
| PRBool strict; |
| } lgCertData; |
| |
| /* |
| * collect all the certs from the traverse call. |
| */ |
| static SECStatus |
| lg_cert_collect(NSSLOWCERTCertificate *cert, void *arg) |
| { |
| lgCertData *cd = (lgCertData *)arg; |
| |
| if (cert == NULL) { |
| return SECSuccess; |
| } |
| |
| if (cd->certs == NULL) { |
| return SECFailure; |
| } |
| |
| if (cd->strict) { |
| if ((cd->classFlags & LG_CERT) && |
| !lg_tokenMatch(cd->sdb, &cert->certKey, LG_TOKEN_TYPE_CERT, cd->template, cd->templ_count)) { |
| return SECSuccess; |
| } |
| if ((cd->classFlags & LG_TRUST) && |
| !lg_tokenMatch(cd->sdb, &cert->certKey, LG_TOKEN_TYPE_TRUST, cd->template, cd->templ_count)) { |
| return SECSuccess; |
| } |
| } |
| |
| /* allocate more space if we need it. This should only happen in |
| * the general traversal case */ |
| if (cd->cert_count >= cd->max_cert_count) { |
| int size; |
| cd->max_cert_count += LG_SEARCH_BLOCK_SIZE; |
| size = cd->max_cert_count * sizeof(NSSLOWCERTCertificate *); |
| cd->certs = (NSSLOWCERTCertificate **)PORT_Realloc(cd->certs, size); |
| if (cd->certs == NULL) { |
| return SECFailure; |
| } |
| } |
| |
| cd->certs[cd->cert_count++] = nsslowcert_DupCertificate(cert); |
| return SECSuccess; |
| } |
| |
| /* provide impedence matching ... */ |
| static SECStatus |
| lg_cert_collect2(NSSLOWCERTCertificate *cert, SECItem *dymmy, void *arg) |
| { |
| return lg_cert_collect(cert, arg); |
| } |
| |
| static void |
| lg_searchSingleCert(lgCertData *certData, NSSLOWCERTCertificate *cert) |
| { |
| if (cert == NULL) { |
| return; |
| } |
| if (certData->strict && |
| !lg_tokenMatch(certData->sdb, &cert->certKey, LG_TOKEN_TYPE_CERT, |
| certData->template, certData->templ_count)) { |
| nsslowcert_DestroyCertificate(cert); |
| return; |
| } |
| certData->certs = (NSSLOWCERTCertificate **) |
| PORT_Alloc(sizeof(NSSLOWCERTCertificate *)); |
| if (certData->certs == NULL) { |
| nsslowcert_DestroyCertificate(cert); |
| return; |
| } |
| certData->certs[0] = cert; |
| certData->cert_count = 1; |
| } |
| |
| static void |
| lg_CertSetupData(lgCertData *certData, int count) |
| { |
| certData->max_cert_count = count; |
| |
| if (certData->max_cert_count <= 0) { |
| return; |
| } |
| certData->certs = (NSSLOWCERTCertificate **) |
| PORT_Alloc(count * sizeof(NSSLOWCERTCertificate *)); |
| return; |
| } |
| |
| static void |
| lg_searchCertsAndTrust(SDB *sdb, SECItem *derCert, SECItem *name, |
| SECItem *derSubject, NSSLOWCERTIssuerAndSN *issuerSN, |
| SECItem *email, |
| unsigned long classFlags, SDBFind *handles, |
| const CK_ATTRIBUTE *pTemplate, CK_LONG ulCount) |
| { |
| NSSLOWCERTCertDBHandle *certHandle = NULL; |
| lgCertData certData; |
| int i; |
| |
| certHandle = lg_getCertDB(sdb); |
| if (certHandle == NULL) |
| return; |
| |
| certData.sdb = sdb; |
| certData.max_cert_count = 0; |
| certData.certs = NULL; |
| certData.cert_count = 0; |
| certData.template = pTemplate; |
| certData.templ_count = ulCount; |
| certData.classFlags = classFlags; |
| certData.strict = LG_STRICT; |
| |
| /* |
| * Find the Cert. |
| */ |
| if (derCert->data != NULL) { |
| NSSLOWCERTCertificate *cert = |
| nsslowcert_FindCertByDERCert(certHandle, derCert); |
| lg_searchSingleCert(&certData, cert); |
| } else if (name->data != NULL) { |
| char *tmp_name = (char *)PORT_Alloc(name->len + 1); |
| int count; |
| |
| if (tmp_name == NULL) { |
| return; |
| } |
| PORT_Memcpy(tmp_name, name->data, name->len); |
| tmp_name[name->len] = 0; |
| |
| count = nsslowcert_NumPermCertsForNickname(certHandle, tmp_name); |
| lg_CertSetupData(&certData, count); |
| nsslowcert_TraversePermCertsForNickname(certHandle, tmp_name, |
| lg_cert_collect, &certData); |
| PORT_Free(tmp_name); |
| } else if (derSubject->data != NULL) { |
| int count; |
| |
| count = nsslowcert_NumPermCertsForSubject(certHandle, derSubject); |
| lg_CertSetupData(&certData, count); |
| nsslowcert_TraversePermCertsForSubject(certHandle, derSubject, |
| lg_cert_collect, &certData); |
| } else if ((issuerSN->derIssuer.data != NULL) && |
| (issuerSN->serialNumber.data != NULL)) { |
| if (classFlags & LG_CERT) { |
| NSSLOWCERTCertificate *cert = |
| nsslowcert_FindCertByIssuerAndSN(certHandle, issuerSN); |
| |
| lg_searchSingleCert(&certData, cert); |
| } |
| if (classFlags & LG_TRUST) { |
| NSSLOWCERTTrust *trust = |
| nsslowcert_FindTrustByIssuerAndSN(certHandle, issuerSN); |
| |
| if (trust) { |
| lg_addHandle(handles, |
| lg_mkHandle(sdb, &trust->dbKey, LG_TOKEN_TYPE_TRUST)); |
| nsslowcert_DestroyTrust(trust); |
| } |
| } |
| } else if (email->data != NULL) { |
| char *tmp_name = (char *)PORT_Alloc(email->len + 1); |
| certDBEntrySMime *entry = NULL; |
| |
| if (tmp_name == NULL) { |
| return; |
| } |
| PORT_Memcpy(tmp_name, email->data, email->len); |
| tmp_name[email->len] = 0; |
| |
| entry = nsslowcert_ReadDBSMimeEntry(certHandle, tmp_name); |
| if (entry) { |
| int count; |
| SECItem *subjectName = &entry->subjectName; |
| |
| count = nsslowcert_NumPermCertsForSubject(certHandle, subjectName); |
| lg_CertSetupData(&certData, count); |
| nsslowcert_TraversePermCertsForSubject(certHandle, subjectName, |
| lg_cert_collect, &certData); |
| |
| nsslowcert_DestroyDBEntry((certDBEntry *)entry); |
| } |
| PORT_Free(tmp_name); |
| } else { |
| /* we aren't filtering the certs, we are working on all, so turn |
| * on the strict filters. */ |
| certData.strict = PR_TRUE; |
| lg_CertSetupData(&certData, LG_SEARCH_BLOCK_SIZE); |
| nsslowcert_TraversePermCerts(certHandle, lg_cert_collect2, &certData); |
| } |
| |
| /* |
| * build the handles |
| */ |
| for (i = 0; i < certData.cert_count; i++) { |
| NSSLOWCERTCertificate *cert = certData.certs[i]; |
| |
| /* if we filtered it would have been on the stuff above */ |
| if (classFlags & LG_CERT) { |
| lg_addHandle(handles, |
| lg_mkHandle(sdb, &cert->certKey, LG_TOKEN_TYPE_CERT)); |
| } |
| if ((classFlags & LG_TRUST) && nsslowcert_hasTrust(cert->trust)) { |
| lg_addHandle(handles, |
| lg_mkHandle(sdb, &cert->certKey, LG_TOKEN_TYPE_TRUST)); |
| } |
| nsslowcert_DestroyCertificate(cert); |
| } |
| |
| if (certData.certs) |
| PORT_Free(certData.certs); |
| return; |
| } |
| |
| static SECStatus |
| lg_smime_collect(SECItem *data, SECItem *key, certDBEntryType type, void *arg) |
| { |
| lgEntryData *smimeData; |
| SDB *sdb; |
| |
| smimeData = (lgEntryData *)arg; |
| sdb = smimeData->sdb; |
| |
| if (lg_tokenMatch(sdb, key, LG_TOKEN_TYPE_SMIME, |
| smimeData->template, smimeData->templ_count)) { |
| lg_addHandle(smimeData->searchHandles, |
| lg_mkHandle(sdb, key, LG_TOKEN_TYPE_SMIME)); |
| } |
| return (SECSuccess); |
| } |
| |
| static void |
| lg_searchSMime(SDB *sdb, SECItem *email, SDBFind *handles, |
| const CK_ATTRIBUTE *pTemplate, CK_LONG ulCount) |
| { |
| NSSLOWCERTCertDBHandle *certHandle = NULL; |
| certDBEntrySMime *entry; |
| |
| certHandle = lg_getCertDB(sdb); |
| if (certHandle == NULL) |
| return; |
| |
| if (email->data != NULL) { |
| char *tmp_name = (char *)PORT_Alloc(email->len + 1); |
| |
| if (tmp_name == NULL) { |
| return; |
| } |
| PORT_Memcpy(tmp_name, email->data, email->len); |
| tmp_name[email->len] = 0; |
| |
| entry = nsslowcert_ReadDBSMimeEntry(certHandle, tmp_name); |
| if (entry) { |
| SECItem emailKey; |
| |
| emailKey.data = (unsigned char *)tmp_name; |
| emailKey.len = PORT_Strlen(tmp_name) + 1; |
| emailKey.type = 0; |
| lg_addHandle(handles, |
| lg_mkHandle(sdb, &emailKey, LG_TOKEN_TYPE_SMIME)); |
| nsslowcert_DestroyDBEntry((certDBEntry *)entry); |
| } |
| PORT_Free(tmp_name); |
| } else { |
| /* traverse */ |
| lgEntryData smimeData; |
| |
| /* traverse */ |
| smimeData.sdb = sdb; |
| smimeData.searchHandles = handles; |
| smimeData.template = pTemplate; |
| smimeData.templ_count = ulCount; |
| nsslowcert_TraverseDBEntries(certHandle, certDBEntryTypeSMimeProfile, |
| lg_smime_collect, (void *)&smimeData); |
| } |
| return; |
| } |
| |
| static CK_RV |
| lg_searchTokenList(SDB *sdb, SDBFind *search, |
| const CK_ATTRIBUTE *pTemplate, CK_LONG ulCount) |
| { |
| int i; |
| PRBool isKrl = PR_FALSE; |
| SECItem derCert = { siBuffer, NULL, 0 }; |
| SECItem derSubject = { siBuffer, NULL, 0 }; |
| SECItem name = { siBuffer, NULL, 0 }; |
| SECItem email = { siBuffer, NULL, 0 }; |
| SECItem key_id = { siBuffer, NULL, 0 }; |
| SECItem cert_sha1_hash = { siBuffer, NULL, 0 }; |
| SECItem cert_md5_hash = { siBuffer, NULL, 0 }; |
| NSSLOWCERTIssuerAndSN issuerSN = { |
| { siBuffer, NULL, 0 }, |
| { siBuffer, NULL, 0 } |
| }; |
| SECItem *copy = NULL; |
| CK_CERTIFICATE_TYPE certType; |
| CK_OBJECT_CLASS objectClass; |
| CK_RV crv; |
| unsigned long classFlags; |
| |
| if (lg_getCertDB(sdb) == NULL) { |
| classFlags = LG_PRIVATE | LG_KEY; |
| } else { |
| classFlags = LG_CERT | LG_TRUST | LG_PUBLIC | LG_SMIME | LG_CRL; |
| } |
| |
| /* |
| * look for things to search on token objects for. If the right options |
| * are specified, we can use them as direct indeces into the database |
| * (rather than using linear searches. We can also use the attributes to |
| * limit the kinds of objects we are searching for. Later we can use this |
| * array to filter the remaining objects more finely. |
| */ |
| for (i = 0; classFlags && i < (int)ulCount; i++) { |
| |
| switch (pTemplate[i].type) { |
| case CKA_SUBJECT: |
| copy = &derSubject; |
| classFlags &= (LG_CERT | LG_PRIVATE | LG_PUBLIC | LG_SMIME | LG_CRL); |
| break; |
| case CKA_ISSUER: |
| copy = &issuerSN.derIssuer; |
| classFlags &= (LG_CERT | LG_TRUST); |
| break; |
| case CKA_SERIAL_NUMBER: |
| copy = &issuerSN.serialNumber; |
| classFlags &= (LG_CERT | LG_TRUST); |
| break; |
| case CKA_VALUE: |
| copy = &derCert; |
| classFlags &= (LG_CERT | LG_CRL | LG_SMIME); |
| break; |
| case CKA_LABEL: |
| copy = &name; |
| break; |
| case CKA_NETSCAPE_EMAIL: |
| copy = &email; |
| classFlags &= LG_SMIME | LG_CERT; |
| break; |
| case CKA_NETSCAPE_SMIME_TIMESTAMP: |
| classFlags &= LG_SMIME; |
| break; |
| case CKA_CLASS: |
| crv = lg_GetULongAttribute(CKA_CLASS, &pTemplate[i], 1, &objectClass); |
| if (crv != CKR_OK) { |
| classFlags = 0; |
| break; |
| } |
| switch (objectClass) { |
| case CKO_CERTIFICATE: |
| classFlags &= LG_CERT; |
| break; |
| case CKO_NETSCAPE_TRUST: |
| classFlags &= LG_TRUST; |
| break; |
| case CKO_NETSCAPE_CRL: |
| classFlags &= LG_CRL; |
| break; |
| case CKO_NETSCAPE_SMIME: |
| classFlags &= LG_SMIME; |
| break; |
| case CKO_PRIVATE_KEY: |
| classFlags &= LG_PRIVATE; |
| break; |
| case CKO_PUBLIC_KEY: |
| classFlags &= LG_PUBLIC; |
| break; |
| case CKO_SECRET_KEY: |
| classFlags &= LG_KEY; |
| break; |
| default: |
| classFlags = 0; |
| break; |
| } |
| break; |
| case CKA_PRIVATE: |
| if (pTemplate[i].ulValueLen != sizeof(CK_BBOOL)) { |
| classFlags = 0; |
| break; |
| } |
| if (*((CK_BBOOL *)pTemplate[i].pValue) == CK_TRUE) { |
| classFlags &= (LG_PRIVATE | LG_KEY); |
| } else { |
| classFlags &= ~(LG_PRIVATE | LG_KEY); |
| } |
| break; |
| case CKA_SENSITIVE: |
| if (pTemplate[i].ulValueLen != sizeof(CK_BBOOL)) { |
| classFlags = 0; |
| break; |
| } |
| if (*((CK_BBOOL *)pTemplate[i].pValue) == CK_TRUE) { |
| classFlags &= (LG_PRIVATE | LG_KEY); |
| } else { |
| classFlags = 0; |
| } |
| break; |
| case CKA_TOKEN: |
| if (pTemplate[i].ulValueLen != sizeof(CK_BBOOL)) { |
| classFlags = 0; |
| break; |
| } |
| if (*((CK_BBOOL *)pTemplate[i].pValue) != CK_TRUE) { |
| classFlags = 0; |
| } |
| break; |
| case CKA_CERT_SHA1_HASH: |
| classFlags &= LG_TRUST; |
| copy = &cert_sha1_hash; |
| break; |
| case CKA_CERT_MD5_HASH: |
| classFlags &= LG_TRUST; |
| copy = &cert_md5_hash; |
| break; |
| case CKA_CERTIFICATE_TYPE: |
| crv = lg_GetULongAttribute(CKA_CERTIFICATE_TYPE, &pTemplate[i], |
| 1, &certType); |
| if (crv != CKR_OK) { |
| classFlags = 0; |
| break; |
| } |
| classFlags &= LG_CERT; |
| if (certType != CKC_X_509) { |
| classFlags = 0; |
| } |
| break; |
| case CKA_ID: |
| copy = &key_id; |
| classFlags &= (LG_CERT | LG_PRIVATE | LG_KEY | LG_PUBLIC); |
| break; |
| case CKA_NETSCAPE_KRL: |
| if (pTemplate[i].ulValueLen != sizeof(CK_BBOOL)) { |
| classFlags = 0; |
| break; |
| } |
| classFlags &= LG_CRL; |
| isKrl = (PRBool)(*((CK_BBOOL *)pTemplate[i].pValue) == CK_TRUE); |
| break; |
| case CKA_MODIFIABLE: |
| break; |
| case CKA_KEY_TYPE: |
| case CKA_DERIVE: |
| classFlags &= LG_PUBLIC | LG_PRIVATE | LG_KEY; |
| break; |
| case CKA_VERIFY_RECOVER: |
| classFlags &= LG_PUBLIC; |
| break; |
| case CKA_SIGN_RECOVER: |
| classFlags &= LG_PRIVATE; |
| break; |
| case CKA_ENCRYPT: |
| case CKA_VERIFY: |
| case CKA_WRAP: |
| classFlags &= LG_PUBLIC | LG_KEY; |
| break; |
| case CKA_DECRYPT: |
| case CKA_SIGN: |
| case CKA_UNWRAP: |
| case CKA_ALWAYS_SENSITIVE: |
| case CKA_EXTRACTABLE: |
| case CKA_NEVER_EXTRACTABLE: |
| classFlags &= LG_PRIVATE | LG_KEY; |
| break; |
| /* can't be a certificate if it doesn't match one of the above |
| * attributes */ |
| default: |
| classFlags = 0; |
| break; |
| } |
| if (copy) { |
| copy->data = (unsigned char *)pTemplate[i].pValue; |
| copy->len = pTemplate[i].ulValueLen; |
| } |
| copy = NULL; |
| } |
| |
| /* certs */ |
| if (classFlags & (LG_CERT | LG_TRUST)) { |
| lg_searchCertsAndTrust(sdb, &derCert, &name, &derSubject, |
| &issuerSN, &email, classFlags, search, |
| pTemplate, ulCount); |
| } |
| |
| /* keys */ |
| if (classFlags & (LG_PRIVATE | LG_PUBLIC | LG_KEY)) { |
| PRBool mustStrict = (name.len != 0); |
| lg_searchKeys(sdb, &key_id, classFlags, search, |
| mustStrict, pTemplate, ulCount); |
| } |
| |
| /* crl's */ |
| if (classFlags & LG_CRL) { |
| lg_searchCrls(sdb, &derSubject, isKrl, classFlags, search, |
| pTemplate, ulCount); |
| } |
| /* Add S/MIME entry stuff */ |
| if (classFlags & LG_SMIME) { |
| lg_searchSMime(sdb, &email, search, pTemplate, ulCount); |
| } |
| return CKR_OK; |
| } |
| |
| /* lg_FindObjectsInit initializes a search for token and session objects |
| * that match a template. */ |
| CK_RV |
| lg_FindObjectsInit(SDB *sdb, const CK_ATTRIBUTE *pTemplate, |
| CK_ULONG ulCount, SDBFind **retSearch) |
| { |
| SDBFind *search; |
| CK_RV crv = CKR_OK; |
| |
| *retSearch = NULL; |
| |
| search = (SDBFind *)PORT_Alloc(sizeof(SDBFind)); |
| if (search == NULL) { |
| crv = CKR_HOST_MEMORY; |
| goto loser; |
| } |
| search->handles = (CK_OBJECT_HANDLE *) |
| PORT_Alloc(sizeof(CK_OBJECT_HANDLE) * LG_SEARCH_BLOCK_SIZE); |
| if (search->handles == NULL) { |
| crv = CKR_HOST_MEMORY; |
| goto loser; |
| } |
| search->index = 0; |
| search->size = 0; |
| search->array_size = LG_SEARCH_BLOCK_SIZE; |
| /* FIXME - do we still need to get Login state? */ |
| |
| crv = lg_searchTokenList(sdb, search, pTemplate, ulCount); |
| if (crv != CKR_OK) { |
| goto loser; |
| } |
| |
| *retSearch = search; |
| return CKR_OK; |
| |
| loser: |
| if (search) { |
| lg_FreeSearch(search); |
| } |
| return crv; |
| } |
| |
| /* lg_FindObjects continues a search for token and session objects |
| * that match a template, obtaining additional object handles. */ |
| CK_RV |
| lg_FindObjects(SDB *sdb, SDBFind *search, |
| CK_OBJECT_HANDLE *phObject, CK_ULONG ulMaxObjectCount, |
| CK_ULONG *pulObjectCount) |
| { |
| int transfer; |
| int left; |
| |
| *pulObjectCount = 0; |
| left = search->size - search->index; |
| transfer = ((int)ulMaxObjectCount > left) ? left : ulMaxObjectCount; |
| if (transfer > 0) { |
| PORT_Memcpy(phObject, &search->handles[search->index], |
| transfer * sizeof(CK_OBJECT_HANDLE)); |
| } else { |
| *phObject = CK_INVALID_HANDLE; |
| } |
| |
| search->index += transfer; |
| *pulObjectCount = transfer; |
| return CKR_OK; |
| } |
| |
| /* lg_FindObjectsFinal finishes a search for token and session objects. */ |
| CK_RV |
| lg_FindObjectsFinal(SDB *lgdb, SDBFind *search) |
| { |
| |
| if (search != NULL) { |
| lg_FreeSearch(search); |
| } |
| return CKR_OK; |
| } |
