wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-20 23:37:33 +09:00
Code Issues Projects Releases Packages Wiki Activity

[NSS] sync with https://github.com/roytam1/NSS/tree/NSS_3_48_UXP_BRANCH, notably:

Browse source 
- Bug 1665715 - (1/2) revert e8f2720c8254 (bug 1593141) because it's no longer necessary r=jcj (a9bca998)
- Bug 1665715 - (2/2) pass encoded signed certificate timestamp extension (if present) in CheckRevocation r=jcj (429f9ef9)
This commit is contained in:
roytam1 2023-11-17 11:01:12 +08:00
commit 4e45ee69e0
22 changed files with 130 additions and 272 deletions
Download patch file Download diff file Expand all files Collapse all files

9
security/nss/lib/pk11wrap/pk11auth.c
View file

@ -4,8 +4,6 @@
/*
* This file deals with PKCS #11 passwords and authentication.
*/
#include "dev.h"
#include "dev3hack.h"
#include "seccomon.h"
#include "secmod.h"
#include "secmodi.h"
@ -639,11 +637,8 @@ PK11_DoPassword(PK11SlotInfo *slot, CK_SESSION_HANDLE session,
}
if (rv == SECSuccess) {
if (!contextSpecific && !PK11_IsFriendly(slot)) {
NSSToken *token = PK11Slot_GetNSSToken(slot);
if (token) {
nssTrustDomain_UpdateCachedTokenCerts(token->trustDomain, token);
(void)nssToken_Destroy(token);
}
nssTrustDomain_UpdateCachedTokenCerts(slot->nssToken->trustDomain,
slot->nssToken);
}
} else if (!attempt)
PORT_SetError(SEC_ERROR_BAD_PASSWORD);

74
security/nss/lib/pk11wrap/pk11cert.c
View file

@ -240,17 +240,16 @@ pk11_fastCert(PK11SlotInfo *slot, CK_OBJECT_HANDLE certID,
NSSCertificate *c;
nssCryptokiObject *co = NULL;
nssPKIObject *pkio;
NSSToken *token;
NSSTrustDomain *td = STAN_GetDefaultTrustDomain();
/* Get the cryptoki object from the handle */
NSSToken *token = PK11Slot_GetNSSToken(slot);
if (!token || !token->defaultSession) {
(void)nssToken_Destroy(token); /* null token is ok */
token = PK11Slot_GetNSSToken(slot);
if (token && token->defaultSession) {
co = nssCryptokiObject_Create(token, token->defaultSession, certID);
} else {
PORT_SetError(SEC_ERROR_NO_TOKEN);
return NULL;
}
co = nssCryptokiObject_Create(token, token->defaultSession, certID);
(void)nssToken_Destroy(token);
if (!co) {
return NULL;
}
@ -753,7 +752,7 @@ find_certs_from_uri(const char *uriString, void *wincx)
nssPKIObjectCollection_AddInstances(collection, instances, 0);
nss_ZFreeIf(instances);
}
(void)nssToken_Destroy(*tok);
nssToken_Destroy(*tok);
}
nss_ZFreeIf(tokens);
nssList_Destroy(certList);
@ -862,7 +861,9 @@ find_certs_from_nickname(const char *nickname, void *wincx)
} else {
slot = PK11_GetInternalKeySlot();
token = PK11Slot_GetNSSToken(slot);
if (!token) {
if (token) {
nssToken_AddRef(token);
} else {
PORT_SetError(SEC_ERROR_NO_TOKEN);
}
}
@ -926,7 +927,7 @@ find_certs_from_nickname(const char *nickname, void *wincx)
}
loser:
if (token) {
(void)nssToken_Destroy(token);
nssToken_Destroy(token);
}
if (slot) {
PK11_FreeSlot(slot);
@ -1126,15 +1127,15 @@ PK11_ImportCert(PK11SlotInfo *slot, CERTCertificate *cert,
PRStatus status;
NSSCertificate *c;
nssCryptokiObject *keyobj, *certobj;
NSSToken *token = NULL;
NSSToken *token = PK11Slot_GetNSSToken(slot);
SECItem *keyID = pk11_mkcertKeyID(cert);
char *emailAddr = NULL;
nssCertificateStoreTrace lockTrace = { NULL, NULL, PR_FALSE, PR_FALSE };
nssCertificateStoreTrace unlockTrace = { NULL, NULL, PR_FALSE, PR_FALSE };
SECItem *keyID = pk11_mkcertKeyID(cert);
if (keyID == NULL) {
goto loser; /* error code should be set already */
}
token = PK11Slot_GetNSSToken(slot);
if (!token) {
PORT_SetError(SEC_ERROR_NO_TOKEN);
goto loser;
@ -1227,12 +1228,8 @@ PK11_ImportCert(PK11SlotInfo *slot, CERTCertificate *cert,
(void)STAN_ForceCERTCertificateUpdate(c);
nssCertificate_Destroy(c);
SECITEM_FreeItem(keyID, PR_TRUE);
(void)nssToken_Destroy(token);
return SECSuccess;
loser:
if (token) {
(void)nssToken_Destroy(token);
}
CERT_MapStanError();
SECITEM_FreeItem(keyID, PR_TRUE);
if (PORT_GetError() != SEC_ERROR_TOKEN_NOT_LOGGED_IN) {
@ -1511,7 +1508,7 @@ PK11_FindCertByIssuerAndSNOnToken(PK11SlotInfo *slot,
NSSCertificate *cert = NULL;
NSSDER issuer, serial;
NSSTrustDomain *td = STAN_GetDefaultTrustDomain();
NSSToken *token = NULL;
NSSToken *token = slot->nssToken;
nssSession *session;
nssCryptokiObject *instance = NULL;
nssPKIObject *object = NULL;
@ -1526,18 +1523,12 @@ PK11_FindCertByIssuerAndSNOnToken(PK11SlotInfo *slot,
return NULL;
}
token = PK11Slot_GetNSSToken(slot);
if (!token) {
/* Paranoia */
if (token == NULL) {
PORT_SetError(SEC_ERROR_NO_TOKEN);
return NULL;
}
session = nssToken_GetDefaultSession(token); /* non-owning */
if (!session) {
(void)nssToken_Destroy(token);
return NULL;
}
/* PKCS#11 needs to use DER-encoded serial numbers. Create a
* CERTIssuerAndSN that actually has the encoded value and pass that
* to PKCS#11 (and the crypto context).
@ -1546,17 +1537,20 @@ PK11_FindCertByIssuerAndSNOnToken(PK11SlotInfo *slot,
&issuerSN->serialNumber,
SEC_ASN1_GET(SEC_IntegerTemplate));
if (!derSerial) {
(void)nssToken_Destroy(token);
return NULL;
}
NSSITEM_FROM_SECITEM(&issuer, &issuerSN->derIssuer);
NSSITEM_FROM_SECITEM(&serial, derSerial);
session = nssToken_GetDefaultSession(token);
if (!session) {
goto loser;
}
instance = nssToken_FindCertificateByIssuerAndSerialNumber(token, session,
&issuer, &serial, nssTokenSearchType_TokenForced, &status);
(void)nssToken_Destroy(token);
SECITEM_FreeItem(derSerial, PR_TRUE);
if (!instance) {
@ -2226,22 +2220,16 @@ PK11_TraverseCertsForSubjectInSlot(CERTCertificate *cert, PK11SlotInfo *slot,
td = STAN_GetDefaultTrustDomain();
NSSITEM_FROM_SECITEM(&subject, &cert->derSubject);
token = PK11Slot_GetNSSToken(slot);
if (!token) {
return SECSuccess;
}
if (!nssToken_IsPresent(token)) {
(void)nssToken_Destroy(token);
return SECSuccess;
}
collection = nssCertificateCollection_Create(td, NULL);
if (!collection) {
(void)nssToken_Destroy(token);
return SECFailure;
}
subjectList = nssList_Create(NULL, PR_FALSE);
if (!subjectList) {
nssPKIObjectCollection_Destroy(collection);
(void)nssToken_Destroy(token);
return SECFailure;
}
(void)nssTrustDomain_GetCertsForSubjectFromCache(td, &subject,
@ -2256,7 +2244,6 @@ PK11_TraverseCertsForSubjectInSlot(CERTCertificate *cert, PK11SlotInfo *slot,
certs = nssPKIObjectCollection_GetCertificates(collection,
NULL, 0, NULL);
nssPKIObjectCollection_Destroy(collection);
(void)nssToken_Destroy(token);
if (certs) {
CERTCertificate *oldie;
NSSCertificate **cp;
@ -2290,8 +2277,7 @@ PK11_TraverseCertsForNicknameInSlot(SECItem *nickname, PK11SlotInfo *slot,
nssList *nameList = NULL;
nssTokenSearchType tokenOnly = nssTokenSearchType_TokenOnly;
token = PK11Slot_GetNSSToken(slot);
if (!token || !nssToken_IsPresent(token)) {
(void)nssToken_Destroy(token);
if (!nssToken_IsPresent(token)) {
return SECSuccess;
}
if (nickname->data[nickname->len - 1] != '\0') {
@ -2321,7 +2307,6 @@ PK11_TraverseCertsForNicknameInSlot(SECItem *nickname, PK11SlotInfo *slot,
certs = nssPKIObjectCollection_GetCertificates(collection,
NULL, 0, NULL);
nssPKIObjectCollection_Destroy(collection);
(void)nssToken_Destroy(token);
if (certs) {
CERTCertificate *oldie;
NSSCertificate **cp;
@ -2341,7 +2326,6 @@ PK11_TraverseCertsForNicknameInSlot(SECItem *nickname, PK11SlotInfo *slot,
nss_ZFreeIf(nick);
return (nssrv == PR_SUCCESS) ? SECSuccess : SECFailure;
loser:
(void)nssToken_Destroy(token);
if (created) {
nss_ZFreeIf(nick);
}
@ -2367,22 +2351,16 @@ PK11_TraverseCertsInSlot(PK11SlotInfo *slot,
NSSCertificate **certs;
nssTokenSearchType tokenOnly = nssTokenSearchType_TokenOnly;
tok = PK11Slot_GetNSSToken(slot);
if (!tok) {
return SECSuccess;
}
if (!nssToken_IsPresent(tok)) {
(void)nssToken_Destroy(tok);
return SECSuccess;
}
collection = nssCertificateCollection_Create(td, NULL);
if (!collection) {
(void)nssToken_Destroy(tok);
return SECFailure;
}
certList = nssList_Create(NULL, PR_FALSE);
if (!certList) {
nssPKIObjectCollection_Destroy(collection);
(void)nssToken_Destroy(tok);
return SECFailure;
}
(void)nssTrustDomain_GetCertsFromCache(td, certList);
@ -2395,7 +2373,6 @@ PK11_TraverseCertsInSlot(PK11SlotInfo *slot,
certs = nssPKIObjectCollection_GetCertificates(collection,
NULL, 0, NULL);
nssPKIObjectCollection_Destroy(collection);
(void)nssToken_Destroy(tok);
if (certs) {
CERTCertificate *oldie;
NSSCertificate **cp;
@ -2435,6 +2412,7 @@ PK11_FindCertFromDERCertItem(PK11SlotInfo *slot, const SECItem *inDerCert,
SECStatus rv;
CERTCertificate *cert = NULL;
tok = PK11Slot_GetNSSToken(slot);
NSSITEM_FROM_SECITEM(&derCert, inDerCert);
rv = pk11_AuthenticateUnfriendly(slot, PR_TRUE, wincx);
if (rv != SECSuccess) {
@ -2442,14 +2420,8 @@ PK11_FindCertFromDERCertItem(PK11SlotInfo *slot, const SECItem *inDerCert,
return NULL;
}
tok = PK11Slot_GetNSSToken(slot);
if (!tok) {
PK11_FreeSlot(slot);
return NULL;
}
co = nssToken_FindCertificateByEncodedCertificate(tok, NULL, &derCert,
nssTokenSearchType_TokenOnly, NULL);
(void)nssToken_Destroy(tok);
if (co) {
cert = PK11_MakeCertFromHandle(slot, co->handle, NULL);

24
security/nss/lib/pk11wrap/pk11nobj.c
View file

@ -411,17 +411,12 @@ PK11_FindCrlByName(PK11SlotInfo **slot, CK_OBJECT_HANDLE *crlHandle,
nssPKIObjectCollection *collection;
nssTokenSearchType tokenOnly = nssTokenSearchType_TokenOnly;
NSSToken *token = PK11Slot_GetNSSToken(*slot);
if (!token) {
goto loser;
}
collection = nssCRLCollection_Create(td, NULL);
if (!collection) {
(void)nssToken_Destroy(token);
goto loser;
}
instances = nssToken_FindCRLsBySubject(token, NULL, &subject,
tokenOnly, 0, NULL);
(void)nssToken_Destroy(token);
nssPKIObjectCollection_AddInstances(collection, instances, 0);
nss_ZFreeIf(instances);
crls = nssPKIObjectCollection_GetCRLs(collection, NULL, 0, NULL);
@ -485,21 +480,16 @@ PK11_PutCrl(PK11SlotInfo *slot, SECItem *crl, SECItem *name,
char *url, int type)
{
NSSItem derCRL, derSubject;
NSSToken *token;
NSSToken *token = PK11Slot_GetNSSToken(slot);
nssCryptokiObject *object;
PRBool isKRL = (type == SEC_CRL_TYPE) ? PR_FALSE : PR_TRUE;
CK_OBJECT_HANDLE rvH;
NSSITEM_FROM_SECITEM(&derSubject, name);
NSSITEM_FROM_SECITEM(&derCRL, crl);
token = PK11Slot_GetNSSToken(slot);
if (!token) {
PORT_SetError(SEC_ERROR_NO_TOKEN);
return CK_INVALID_HANDLE;
}
object = nssToken_ImportCRL(token, NULL,
&derSubject, &derCRL, isKRL, url, PR_TRUE);
(void)nssToken_Destroy(token);
if (object) {
rvH = object->handle;
@ -518,8 +508,8 @@ SECStatus
SEC_DeletePermCRL(CERTSignedCrl *crl)
{
PRStatus status;
nssCryptokiObject *object;
NSSToken *token;
nssCryptokiObject *object;
PK11SlotInfo *slot = crl->slot;
if (slot == NULL) {
@ -528,17 +518,13 @@ SEC_DeletePermCRL(CERTSignedCrl *crl)
PORT_SetError(SEC_ERROR_CRL_INVALID);
return SECFailure;
}
token = PK11Slot_GetNSSToken(slot);
if (!token) {
return SECFailure;
}
object = nss_ZNEW(NULL, nssCryptokiObject);
if (!object) {
(void)nssToken_Destroy(token);
return SECFailure;
}
object->token = token; /* object takes ownership */
object->token = nssToken_AddRef(token);
object->handle = crl->pkcs11ID;
object->isTokenObject = PR_TRUE;

73
security/nss/lib/pk11wrap/pk11slot.c
View file

@ -359,24 +359,19 @@ PK11_NewSlotInfo(SECMODModule *mod)
PK11SlotInfo *slot;
slot = (PK11SlotInfo *)PORT_Alloc(sizeof(PK11SlotInfo));
if (slot == NULL) {
if (slot == NULL)
return slot;
slot->sessionLock = mod->isThreadSafe ? PZ_NewLock(nssILockSession) : mod->refLock;
if (slot->sessionLock == NULL) {
PORT_Free(slot);
return NULL;
}
slot->freeListLock = PZ_NewLock(nssILockFreelist);
if (slot->freeListLock == NULL) {
PORT_Free(slot);
return NULL;
}
slot->nssTokenLock = PZ_NewLock(nssILockOther);
if (slot->nssTokenLock == NULL) {
PZ_DestroyLock(slot->freeListLock);
PORT_Free(slot);
return NULL;
}
slot->sessionLock = mod->isThreadSafe ? PZ_NewLock(nssILockSession) : mod->refLock;
if (slot->sessionLock == NULL) {
PZ_DestroyLock(slot->nssTokenLock);
PZ_DestroyLock(slot->freeListLock);
if (mod->isThreadSafe) {
PZ_DestroyLock(slot->sessionLock);
}
PORT_Free(slot);
return NULL;
}
@ -464,10 +459,6 @@ PK11_DestroySlot(PK11SlotInfo *slot)
PZ_DestroyLock(slot->freeListLock);
slot->freeListLock = NULL;
}
if (slot->nssTokenLock) {
PZ_DestroyLock(slot->nssTokenLock);
slot->nssTokenLock = NULL;
}
/* finally Tell our parent module that we've gone away so it can unload */
if (slot->module) {
@ -1266,7 +1257,6 @@ PK11_InitToken(PK11SlotInfo *slot, PRBool loadCerts)
CK_RV crv;
SECStatus rv;
PRStatus status;
NSSToken *nssToken;
/* set the slot flags to the current token values */
if (!slot->isThreadSafe)
@ -1304,9 +1294,7 @@ PK11_InitToken(PK11SlotInfo *slot, PRBool loadCerts)
slot->maxPassword = slot->tokenInfo.ulMaxPinLen;
PORT_Memcpy(slot->serial, slot->tokenInfo.serialNumber, sizeof(slot->serial));
nssToken = PK11Slot_GetNSSToken(slot);
nssToken_UpdateName(nssToken); /* null token is OK */
(void)nssToken_Destroy(nssToken);
nssToken_UpdateName(slot->nssToken);
slot->defRWSession = (PRBool)((!slot->readOnly) &&
(slot->tokenInfo.ulMaxSessionCount == 1));
@ -1374,9 +1362,7 @@ PK11_InitToken(PK11SlotInfo *slot, PRBool loadCerts)
PK11_ExitSlotMonitor(slot);
}
nssToken = PK11Slot_GetNSSToken(slot);
status = nssToken_Refresh(nssToken); /* null token is OK */
(void)nssToken_Destroy(nssToken);
status = nssToken_Refresh(slot->nssToken);
if (status != PR_SUCCESS)
return SECFailure;
@ -1610,11 +1596,8 @@ pk11_IsPresentCertLoad(PK11SlotInfo *slot, PRBool loadCerts)
return PR_TRUE;
}
NSSToken *nssToken = PK11Slot_GetNSSToken(slot);
if (nssToken) {
PRBool present = nssToken_IsPresent(nssToken);
(void)nssToken_Destroy(nssToken);
return present;
if (slot->nssToken) {
return nssToken_IsPresent(slot->nssToken);
}
/* removable slots have a flag that says they are present */
@ -2651,44 +2634,20 @@ PK11_ResetToken(PK11SlotInfo *slot, char *sso_pwd)
PORT_SetError(PK11_MapError(crv));
return SECFailure;
}
NSSToken *token = PK11Slot_GetNSSToken(slot);
if (token) {
nssTrustDomain_UpdateCachedTokenCerts(token->trustDomain, token);
(void)nssToken_Destroy(token);
}
nssTrustDomain_UpdateCachedTokenCerts(slot->nssToken->trustDomain,
slot->nssToken);
return SECSuccess;
}
void
PK11Slot_SetNSSToken(PK11SlotInfo *sl, NSSToken *nsst)
{
NSSToken *old;
if (nsst) {
nsst = nssToken_AddRef(nsst);
}
PZ_Lock(sl->nssTokenLock);
old = sl->nssToken;
sl->nssToken = nsst;
PZ_Unlock(sl->nssTokenLock);
if (old) {
(void)nssToken_Destroy(old);
}
}
NSSToken *
PK11Slot_GetNSSToken(PK11SlotInfo *sl)
{
NSSToken *rv = NULL;
PZ_Lock(sl->nssTokenLock);
if (sl->nssToken) {
rv = nssToken_AddRef(sl->nssToken);
}
PZ_Unlock(sl->nssTokenLock);
return rv;
return sl->nssToken;
}
/*

27
security/nss/lib/pk11wrap/pk11util.c
View file

@ -13,7 +13,6 @@
#include "pki3hack.h"
#include "secerr.h"
#include "dev.h"
#include "dev3hack.h"
#include "utilpars.h"
#include "pkcs11uri.h"
@ -1267,14 +1266,8 @@ SECMOD_WaitForAnyTokenEvent(SECMODModule *mod, unsigned long flags,
}
/* if we are in the delay period for the "isPresent" call, reset
* the delay since we know things have probably changed... */
if (slot) {
NSSToken *nssToken = PK11Slot_GetNSSToken(slot);
if (nssToken) {
if (nssToken->slot) {
nssSlot_ResetDelay(nssToken->slot);
}
(void)nssToken_Destroy(nssToken);
}
if (slot && slot->nssToken && slot->nssToken->slot) {
nssSlot_ResetDelay(slot->nssToken->slot);
}
return slot;
@ -1507,12 +1500,8 @@ SECMOD_OpenNewSlot(SECMODModule *mod, const char *moduleSpec)
if (slot) {
/* if we are in the delay period for the "isPresent" call, reset
* the delay since we know things have probably changed... */
NSSToken *nssToken = PK11Slot_GetNSSToken(slot);
if (nssToken) {
if (nssToken->slot) {
nssSlot_ResetDelay(nssToken->slot);
}
(void)nssToken_Destroy(nssToken);
if (slot->nssToken && slot->nssToken->slot) {
nssSlot_ResetDelay(slot->nssToken->slot);
}
/* force the slot info structures to properly reset */
(void)PK11_IsPresent(slot);
@ -1642,12 +1631,8 @@ SECMOD_CloseUserDB(PK11SlotInfo *slot)
PR_smprintf_free(sendSpec);
/* if we are in the delay period for the "isPresent" call, reset
* the delay since we know things have probably changed... */
NSSToken *nssToken = PK11Slot_GetNSSToken(slot);
if (nssToken) {
if (nssToken->slot) {
nssSlot_ResetDelay(nssToken->slot);
}
(void)nssToken_Destroy(nssToken);
if (slot->nssToken && slot->nssToken->slot) {
nssSlot_ResetDelay(slot->nssToken->slot);
/* force the slot info structures to properly reset */
(void)PK11_IsPresent(slot);
}

1
security/nss/lib/pk11wrap/secmodti.h
View file

@ -107,7 +107,6 @@ struct PK11SlotInfoStr {
unsigned int lastState;
/* for Stan */
NSSToken *nssToken;
PZLock *nssTokenLock;
/* the tokeninfo struct */
CK_TOKEN_INFO tokenInfo;
/* fast mechanism lookup */