mirror of
https://repo.dactyloidae.xyz/Dactyloidae/UXP.git
synced 2026-09-27 10:57:34 +09:00
Replace NSS with Pale Moon's
This commit is contained in:
wuggy
parent
ff1e5e48bf
commit
8c2e376f94
2870 changed files with 1762232 additions and 1374220 deletions
|
|
@ -127,6 +127,10 @@ secmod_NewModule(void)
|
|||
*the other flags are set */
|
||||
#define SECMOD_FLAG_INTERNAL_KEY_SLOT 0x02
|
||||
|
||||
/* private flags for policy check. */
|
||||
#define SECMOD_FLAG_POLICY_CHECK_IDENTIFIER 0x01
|
||||
#define SECMOD_FLAG_POLICY_CHECK_VALUE 0x02
|
||||
|
||||
/*
|
||||
* for 3.4 we continue to use the old SECMODModule structure
|
||||
*/
|
||||
|
|
@ -158,16 +162,17 @@ SECMOD_CreateModule(const char *library, const char *moduleName,
|
|||
* Disallow values are parsed first, then allow values, independent of the
|
||||
* order they appear.
|
||||
*
|
||||
* Future key words (not yet implemented):
|
||||
* flags: turn on the following flags:
|
||||
* policy-lock: turn off the ability for applications to change policy with
|
||||
* the call NSS_SetAlgorithmPolicy or the other system policy
|
||||
* calls (SSL_SetPolicy, etc.)
|
||||
* ssl-lock: turn off the ability to change the ssl defaults.
|
||||
*
|
||||
* The following only apply to ssl cipher suites (future smime)
|
||||
*
|
||||
* enable: turn on ciphersuites by default.
|
||||
* disable: turn off ciphersuites by default without disallowing them by policy.
|
||||
* flags: turn on the following flags:
|
||||
* ssl-lock: turn off the ability for applications to change policy with
|
||||
* the SSL_SetCipherPolicy (or SSL_SetPolicy).
|
||||
* policy-lock: turn off the ability for applications to change policy with
|
||||
* the call NSS_SetAlgorithmPolicy.
|
||||
* ssl-default-lock: turn off the ability for applications to change cipher
|
||||
* suite states with SSL_EnableCipher, SSL_DisableCipher.
|
||||
*
|
||||
*
|
||||
*/
|
||||
|
||||
|
|
@ -323,21 +328,21 @@ static const oidValDef curveOptList[] = {
|
|||
static const oidValDef hashOptList[] = {
|
||||
/* Hashes */
|
||||
{ CIPHER_NAME("MD2"), SEC_OID_MD2,
|
||||
NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_CERT_SIGNATURE },
|
||||
NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_SIGNATURE },
|
||||
{ CIPHER_NAME("MD4"), SEC_OID_MD4,
|
||||
NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_CERT_SIGNATURE },
|
||||
NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_SIGNATURE },
|
||||
{ CIPHER_NAME("MD5"), SEC_OID_MD5,
|
||||
NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_CERT_SIGNATURE },
|
||||
NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_SIGNATURE },
|
||||
{ CIPHER_NAME("SHA1"), SEC_OID_SHA1,
|
||||
NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_CERT_SIGNATURE },
|
||||
NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_SIGNATURE },
|
||||
{ CIPHER_NAME("SHA224"), SEC_OID_SHA224,
|
||||
NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_CERT_SIGNATURE },
|
||||
NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_SIGNATURE },
|
||||
{ CIPHER_NAME("SHA256"), SEC_OID_SHA256,
|
||||
NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_CERT_SIGNATURE },
|
||||
NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_SIGNATURE },
|
||||
{ CIPHER_NAME("SHA384"), SEC_OID_SHA384,
|
||||
NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_CERT_SIGNATURE },
|
||||
NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_SIGNATURE },
|
||||
{ CIPHER_NAME("SHA512"), SEC_OID_SHA512,
|
||||
NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_CERT_SIGNATURE },
|
||||
NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_SIGNATURE }
|
||||
};
|
||||
|
||||
static const oidValDef macOptList[] = {
|
||||
|
|
@ -389,7 +394,13 @@ static const oidValDef kxOptList[] = {
|
|||
static const oidValDef signOptList[] = {
|
||||
/* Signatures */
|
||||
{ CIPHER_NAME("DSA"), SEC_OID_ANSIX9_DSA_SIGNATURE,
|
||||
NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_CERT_SIGNATURE },
|
||||
NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_SIGNATURE },
|
||||
{ CIPHER_NAME("RSA-PKCS"), SEC_OID_PKCS1_RSA_ENCRYPTION,
|
||||
NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_SIGNATURE },
|
||||
{ CIPHER_NAME("RSA-PSS"), SEC_OID_PKCS1_RSA_PSS_SIGNATURE,
|
||||
NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_SIGNATURE },
|
||||
{ CIPHER_NAME("ECDSA"), SEC_OID_ANSIX962_EC_PUBLIC_KEY,
|
||||
NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_SIGNATURE },
|
||||
};
|
||||
|
||||
typedef struct {
|
||||
|
|
@ -405,7 +416,7 @@ static const algListsDef algOptLists[] = {
|
|||
{ macOptList, PR_ARRAY_SIZE(macOptList), "MAC", PR_FALSE },
|
||||
{ cipherOptList, PR_ARRAY_SIZE(cipherOptList), "CIPHER", PR_FALSE },
|
||||
{ kxOptList, PR_ARRAY_SIZE(kxOptList), "OTHER-KX", PR_FALSE },
|
||||
{ signOptList, PR_ARRAY_SIZE(signOptList), "OTHER-SIGN", PR_TRUE },
|
||||
{ signOptList, PR_ARRAY_SIZE(signOptList), "OTHER-SIGN", PR_FALSE },
|
||||
};
|
||||
|
||||
static const optionFreeDef sslOptList[] = {
|
||||
|
|
@ -423,12 +434,21 @@ static const optionFreeDef sslOptList[] = {
|
|||
{ CIPHER_NAME("DTLS1.3"), 0x304 },
|
||||
};
|
||||
|
||||
static const optionFreeDef keySizeFlagsList[] = {
|
||||
{ CIPHER_NAME("KEY-SIZE-SSL"), NSS_KEY_SIZE_POLICY_SSL_FLAG },
|
||||
{ CIPHER_NAME("KEY-SIZE-SIGN"), NSS_KEY_SIZE_POLICY_SIGN_FLAG },
|
||||
{ CIPHER_NAME("KEY-SIZE-VERIFY"), NSS_KEY_SIZE_POLICY_VERIFY_FLAG },
|
||||
};
|
||||
|
||||
static const optionFreeDef freeOptList[] = {
|
||||
|
||||
/* Restrictions for asymetric keys */
|
||||
{ CIPHER_NAME("RSA-MIN"), NSS_RSA_MIN_KEY_SIZE },
|
||||
{ CIPHER_NAME("DH-MIN"), NSS_DH_MIN_KEY_SIZE },
|
||||
{ CIPHER_NAME("DSA-MIN"), NSS_DSA_MIN_KEY_SIZE },
|
||||
{ CIPHER_NAME("ECC-MIN"), NSS_ECC_MIN_KEY_SIZE },
|
||||
/* what operations doe the key size apply to */
|
||||
{ CIPHER_NAME("KEY-SIZE-FLAGS"), NSS_KEY_SIZE_POLICY_FLAGS },
|
||||
/* constraints on SSL Protocols */
|
||||
{ CIPHER_NAME("TLS-VERSION-MIN"), NSS_TLS_VERSION_MIN_POLICY },
|
||||
{ CIPHER_NAME("TLS-VERSION-MAX"), NSS_TLS_VERSION_MAX_POLICY },
|
||||
|
|
@ -443,10 +463,19 @@ static const policyFlagDef policyFlagList[] = {
|
|||
/* add other key exhanges in the future */
|
||||
{ CIPHER_NAME("KEY-EXCHANGE"), NSS_USE_ALG_IN_SSL_KX },
|
||||
{ CIPHER_NAME("CERT-SIGNATURE"), NSS_USE_ALG_IN_CERT_SIGNATURE },
|
||||
/* add other signatures in the future */
|
||||
{ CIPHER_NAME("SIGNATURE"), NSS_USE_ALG_IN_CERT_SIGNATURE },
|
||||
/* enable everything */
|
||||
{ CIPHER_NAME("ALL"), NSS_USE_ALG_IN_SSL | NSS_USE_ALG_IN_SSL_KX | NSS_USE_ALG_IN_CERT_SIGNATURE },
|
||||
{ CIPHER_NAME("CMS-SIGNATURE"), NSS_USE_ALG_IN_CMS_SIGNATURE },
|
||||
{ CIPHER_NAME("ALL-SIGNATURE"), NSS_USE_ALG_IN_SIGNATURE },
|
||||
/* sign turns off all signatures, but doesn't change the
|
||||
* allowance for specific sigantures... for example:
|
||||
* disallow=sha256/all allow=sha256/signature doesn't allow
|
||||
* cert-sigantures, where disallow=sha256/all allow=sha256/all-signature
|
||||
* does.
|
||||
* however, disallow=sha356/signature and disallow=sha256/all-siganture are
|
||||
* equivalent in effect */
|
||||
{ CIPHER_NAME("SIGNATURE"), NSS_USE_ALG_IN_ANY_SIGNATURE },
|
||||
/* enable/disable everything */
|
||||
{ CIPHER_NAME("ALL"), NSS_USE_ALG_IN_SSL | NSS_USE_ALG_IN_SSL_KX |
|
||||
NSS_USE_ALG_IN_SIGNATURE },
|
||||
{ CIPHER_NAME("NONE"), 0 }
|
||||
};
|
||||
|
||||
|
|
@ -480,7 +509,7 @@ secmod_ArgGetSubValue(const char *cipher, char sep1, char sep2,
|
|||
|
||||
static PRUint32
|
||||
secmod_parsePolicyValue(const char *policyFlags, int policyLength,
|
||||
PRBool printPolicyFeedback)
|
||||
PRBool printPolicyFeedback, PRUint32 policyCheckFlags)
|
||||
{
|
||||
const char *flag, *currentString;
|
||||
PRUint32 flags = 0;
|
||||
|
|
@ -505,7 +534,8 @@ secmod_parsePolicyValue(const char *policyFlags, int policyLength,
|
|||
break;
|
||||
}
|
||||
}
|
||||
if (unknown && printPolicyFeedback) {
|
||||
if (unknown && printPolicyFeedback &&
|
||||
(policyCheckFlags & SECMOD_FLAG_POLICY_CHECK_VALUE)) {
|
||||
PR_SetEnv("NSS_POLICY_FAIL=1");
|
||||
fprintf(stderr, "NSS-POLICY-FAIL %.*s: unknown value: %.*s\n",
|
||||
policyLength, policyFlags, length, flag);
|
||||
|
|
@ -527,6 +557,7 @@ secmod_getPolicyOptValue(const char *policyValue, int policyValueLength,
|
|||
*result = val;
|
||||
return SECSuccess;
|
||||
}
|
||||
/* handle any ssl strings */
|
||||
for (i = 0; i < PR_ARRAY_SIZE(sslOptList); i++) {
|
||||
if (policyValueLength == sslOptList[i].name_size &&
|
||||
PORT_Strncasecmp(sslOptList[i].name, policyValue,
|
||||
|
|
@ -535,12 +566,108 @@ secmod_getPolicyOptValue(const char *policyValue, int policyValueLength,
|
|||
return SECSuccess;
|
||||
}
|
||||
}
|
||||
return SECFailure;
|
||||
/* handle key_size flags. Each flag represents a bit, which
|
||||
* gets or'd together. They can be separated by , | or + */
|
||||
val = 0;
|
||||
while (*policyValue) {
|
||||
PRBool found = PR_FALSE;
|
||||
for (i = 0; i < PR_ARRAY_SIZE(keySizeFlagsList); i++) {
|
||||
if (PORT_Strncasecmp(keySizeFlagsList[i].name, policyValue,
|
||||
keySizeFlagsList[i].name_size) == 0) {
|
||||
val |= keySizeFlagsList[i].option;
|
||||
found = PR_TRUE;
|
||||
policyValue += keySizeFlagsList[i].name_size;
|
||||
break;
|
||||
}
|
||||
}
|
||||
if (!found) {
|
||||
return SECFailure;
|
||||
}
|
||||
if (*policyValue == ',' || *policyValue == '|' || *policyValue == '+') {
|
||||
policyValue++;
|
||||
}
|
||||
}
|
||||
*result = val;
|
||||
return SECSuccess;
|
||||
}
|
||||
|
||||
/* Policy operations:
|
||||
* Disallow: operation is disallowed by policy. Implies disabled.
|
||||
* Allow: operation is allowed by policy (but could be disabled).
|
||||
* Disable: operation is turned off by default (but could be allowed).
|
||||
* Enable: operation is enabled by default. Implies allowed.
|
||||
*/
|
||||
typedef enum {
|
||||
NSS_DISALLOW,
|
||||
NSS_ALLOW,
|
||||
NSS_DISABLE,
|
||||
NSS_ENABLE
|
||||
} NSSPolicyOperation;
|
||||
|
||||
/* apply the operator specific policy */
|
||||
SECStatus
|
||||
secmod_setPolicyOperation(SECOidTag oid, NSSPolicyOperation operation,
|
||||
PRUint32 value)
|
||||
{
|
||||
SECStatus rv = SECSuccess;
|
||||
switch (operation) {
|
||||
case NSS_DISALLOW:
|
||||
/* clear the requested policy bits */
|
||||
rv = NSS_SetAlgorithmPolicy(oid, 0, value);
|
||||
break;
|
||||
case NSS_ALLOW:
|
||||
/* set the requested policy bits */
|
||||
rv = NSS_SetAlgorithmPolicy(oid, value, 0);
|
||||
break;
|
||||
/* enable/disable only apply to SSL cipher suites (future S/MIME).
|
||||
* Enable/disable is implemented by clearing the DEFAULT_NOT_VALID
|
||||
* flag, then setting the NSS_USE_DEFAULT_SSL_ENABLE flag to the
|
||||
* correct value. The ssl policy code will then sort out what to
|
||||
* set based on ciphers and cipher suite values.*/
|
||||
case NSS_DISABLE:
|
||||
if (value & (NSS_USE_ALG_IN_SSL | NSS_USE_ALG_IN_SSL_KX)) {
|
||||
/* clear not valid and enable */
|
||||
rv = NSS_SetAlgorithmPolicy(oid, 0,
|
||||
NSS_USE_DEFAULT_NOT_VALID |
|
||||
NSS_USE_DEFAULT_SSL_ENABLE);
|
||||
}
|
||||
break;
|
||||
case NSS_ENABLE:
|
||||
if (value & (NSS_USE_ALG_IN_SSL | NSS_USE_ALG_IN_SSL_KX)) {
|
||||
/* set enable, clear not valid. NOTE: enable implies allow! */
|
||||
rv = NSS_SetAlgorithmPolicy(oid, value | NSS_USE_DEFAULT_SSL_ENABLE,
|
||||
NSS_USE_DEFAULT_NOT_VALID);
|
||||
}
|
||||
break;
|
||||
default:
|
||||
PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
|
||||
rv = SECFailure;
|
||||
break;
|
||||
}
|
||||
return rv;
|
||||
}
|
||||
|
||||
const char *
|
||||
secmod_getOperationString(NSSPolicyOperation operation)
|
||||
{
|
||||
switch (operation) {
|
||||
case NSS_DISALLOW:
|
||||
return "disallow";
|
||||
case NSS_ALLOW:
|
||||
return "allow";
|
||||
case NSS_DISABLE:
|
||||
return "disable";
|
||||
case NSS_ENABLE:
|
||||
return "enable";
|
||||
default:
|
||||
break;
|
||||
}
|
||||
return "invalid";
|
||||
}
|
||||
|
||||
static SECStatus
|
||||
secmod_applyCryptoPolicy(const char *policyString, PRBool allow,
|
||||
PRBool printPolicyFeedback)
|
||||
secmod_applyCryptoPolicy(const char *policyString, NSSPolicyOperation operation,
|
||||
PRBool printPolicyFeedback, PRUint32 policyCheckFlags)
|
||||
{
|
||||
const char *cipher, *currentString;
|
||||
unsigned i, j;
|
||||
|
|
@ -568,23 +695,15 @@ secmod_applyCryptoPolicy(const char *policyString, PRBool allow,
|
|||
/* disable or enable all options by default */
|
||||
PRUint32 value = 0;
|
||||
if (newValue) {
|
||||
value = secmod_parsePolicyValue(&cipher[3] + 1, length - 3 - 1, printPolicyFeedback);
|
||||
value = secmod_parsePolicyValue(&cipher[3] + 1, length - 3 - 1, printPolicyFeedback, policyCheckFlags);
|
||||
}
|
||||
for (i = 0; i < PR_ARRAY_SIZE(algOptLists); i++) {
|
||||
const algListsDef *algOptList = &algOptLists[i];
|
||||
for (j = 0; j < algOptList->entries; j++) {
|
||||
PRUint32 enable, disable;
|
||||
if (!newValue) {
|
||||
value = algOptList->list[j].val;
|
||||
}
|
||||
if (allow) {
|
||||
enable = value;
|
||||
disable = 0;
|
||||
} else {
|
||||
enable = 0;
|
||||
disable = value;
|
||||
}
|
||||
NSS_SetAlgorithmPolicy(algOptList->list[j].oid, enable, disable);
|
||||
secmod_setPolicyOperation(algOptList->list[j].oid, operation, value);
|
||||
}
|
||||
}
|
||||
continue;
|
||||
|
|
@ -603,20 +722,13 @@ secmod_applyCryptoPolicy(const char *policyString, PRBool allow,
|
|||
if ((newOption || algOpt->name_size == length) &&
|
||||
PORT_Strncasecmp(algOpt->name, cipher, name_size) == 0) {
|
||||
PRUint32 value = algOpt->val;
|
||||
PRUint32 enable, disable;
|
||||
if (newOption) {
|
||||
value = secmod_parsePolicyValue(&cipher[name_size] + 1,
|
||||
length - name_size - 1,
|
||||
printPolicyFeedback);
|
||||
printPolicyFeedback,
|
||||
policyCheckFlags);
|
||||
}
|
||||
if (allow) {
|
||||
enable = value;
|
||||
disable = 0;
|
||||
} else {
|
||||
enable = 0;
|
||||
disable = value;
|
||||
}
|
||||
rv = NSS_SetAlgorithmPolicy(algOpt->oid, enable, disable);
|
||||
rv = secmod_setPolicyOperation(algOptList->list[j].oid, operation, value);
|
||||
if (rv != SECSuccess) {
|
||||
/* could not enable option */
|
||||
/* NSS_SetAlgorithPolicy should have set the error code */
|
||||
|
|
@ -643,7 +755,8 @@ secmod_applyCryptoPolicy(const char *policyString, PRBool allow,
|
|||
rv = secmod_getPolicyOptValue(policyValue, policyValueLength,
|
||||
&val);
|
||||
if (rv != SECSuccess) {
|
||||
if (printPolicyFeedback) {
|
||||
if (printPolicyFeedback &&
|
||||
(policyCheckFlags & SECMOD_FLAG_POLICY_CHECK_VALUE)) {
|
||||
PR_SetEnv("NSS_POLICY_FAIL=1");
|
||||
fprintf(stderr, "NSS-POLICY-FAIL %.*s: unknown value: %.*s\n",
|
||||
length, cipher, policyValueLength, policyValue);
|
||||
|
|
@ -663,10 +776,11 @@ secmod_applyCryptoPolicy(const char *policyString, PRBool allow,
|
|||
}
|
||||
}
|
||||
|
||||
if (unknown && printPolicyFeedback) {
|
||||
if (unknown && printPolicyFeedback &&
|
||||
(policyCheckFlags & SECMOD_FLAG_POLICY_CHECK_IDENTIFIER)) {
|
||||
PR_SetEnv("NSS_POLICY_FAIL=1");
|
||||
fprintf(stderr, "NSS-POLICY-FAIL %s: unknown identifier: %.*s\n",
|
||||
allow ? "allow" : "disallow", length, cipher);
|
||||
secmod_getOperationString(operation), length, cipher);
|
||||
}
|
||||
}
|
||||
return rv;
|
||||
|
|
@ -709,7 +823,8 @@ secmod_sanityCheckCryptoPolicy(void)
|
|||
anyEnabled = PR_TRUE;
|
||||
fprintf(stderr, "NSS-POLICY-INFO: %s is enabled for SSL\n", algOpt->name);
|
||||
}
|
||||
if ((algOpt->val & NSS_USE_ALG_IN_CERT_SIGNATURE) && (value & NSS_USE_ALG_IN_CERT_SIGNATURE)) {
|
||||
if ((algOpt->val & NSS_USE_ALG_IN_CERT_SIGNATURE) &&
|
||||
((value & NSS_USE_CERT_SIGNATURE_OK) == NSS_USE_CERT_SIGNATURE_OK)) {
|
||||
++num_sig_enabled;
|
||||
anyEnabled = PR_TRUE;
|
||||
fprintf(stderr, "NSS-POLICY-INFO: %s is enabled for CERT-SIGNATURE\n", algOpt->name);
|
||||
|
|
@ -738,9 +853,10 @@ secmod_sanityCheckCryptoPolicy(void)
|
|||
}
|
||||
|
||||
static SECStatus
|
||||
secmod_parseCryptoPolicy(const char *policyConfig, PRBool printPolicyFeedback)
|
||||
secmod_parseCryptoPolicy(const char *policyConfig, PRBool printPolicyFeedback,
|
||||
PRUint32 policyCheckFlags)
|
||||
{
|
||||
char *disallow, *allow;
|
||||
char *args;
|
||||
SECStatus rv;
|
||||
|
||||
if (policyConfig == NULL) {
|
||||
|
|
@ -752,20 +868,53 @@ secmod_parseCryptoPolicy(const char *policyConfig, PRBool printPolicyFeedback)
|
|||
if (rv != SECSuccess) {
|
||||
return rv;
|
||||
}
|
||||
disallow = NSSUTIL_ArgGetParamValue("disallow", policyConfig);
|
||||
rv = secmod_applyCryptoPolicy(disallow, PR_FALSE, printPolicyFeedback);
|
||||
if (disallow)
|
||||
PORT_Free(disallow);
|
||||
args = NSSUTIL_ArgGetParamValue("disallow", policyConfig);
|
||||
rv = secmod_applyCryptoPolicy(args, NSS_DISALLOW, printPolicyFeedback,
|
||||
policyCheckFlags);
|
||||
if (args)
|
||||
PORT_Free(args);
|
||||
if (rv != SECSuccess) {
|
||||
return rv;
|
||||
}
|
||||
allow = NSSUTIL_ArgGetParamValue("allow", policyConfig);
|
||||
rv = secmod_applyCryptoPolicy(allow, PR_TRUE, printPolicyFeedback);
|
||||
if (allow)
|
||||
PORT_Free(allow);
|
||||
args = NSSUTIL_ArgGetParamValue("allow", policyConfig);
|
||||
rv = secmod_applyCryptoPolicy(args, NSS_ALLOW, printPolicyFeedback,
|
||||
policyCheckFlags);
|
||||
if (args)
|
||||
PORT_Free(args);
|
||||
if (rv != SECSuccess) {
|
||||
return rv;
|
||||
}
|
||||
args = NSSUTIL_ArgGetParamValue("disable", policyConfig);
|
||||
rv = secmod_applyCryptoPolicy(args, NSS_DISABLE, printPolicyFeedback,
|
||||
policyCheckFlags);
|
||||
if (args)
|
||||
PORT_Free(args);
|
||||
if (rv != SECSuccess) {
|
||||
return rv;
|
||||
}
|
||||
args = NSSUTIL_ArgGetParamValue("enable", policyConfig);
|
||||
rv = secmod_applyCryptoPolicy(args, NSS_ENABLE, printPolicyFeedback,
|
||||
policyCheckFlags);
|
||||
if (args)
|
||||
PORT_Free(args);
|
||||
if (rv != SECSuccess) {
|
||||
return rv;
|
||||
}
|
||||
/* this has to be last. Everything after this will be a noop */
|
||||
if (NSSUTIL_ArgHasFlag("flags", "ssl-lock", policyConfig)) {
|
||||
PRInt32 locks;
|
||||
/* don't overwrite other (future) lock flags */
|
||||
rv = NSS_OptionGet(NSS_DEFAULT_LOCKS, &locks);
|
||||
if (rv == SECSuccess) {
|
||||
rv = NSS_OptionSet(NSS_DEFAULT_LOCKS, locks | NSS_DEFAULT_SSL_LOCK);
|
||||
}
|
||||
if (rv != SECSuccess) {
|
||||
return rv;
|
||||
}
|
||||
}
|
||||
if (NSSUTIL_ArgHasFlag("flags", "policy-lock", policyConfig)) {
|
||||
NSS_LockPolicy();
|
||||
}
|
||||
if (printPolicyFeedback) {
|
||||
/* This helps to distinguish configurations that don't contain any
|
||||
* policy config= statement. */
|
||||
|
|
@ -776,6 +925,22 @@ secmod_parseCryptoPolicy(const char *policyConfig, PRBool printPolicyFeedback)
|
|||
return rv;
|
||||
}
|
||||
|
||||
static PRUint32
|
||||
secmod_parsePolicyCheckFlags(const char *nss)
|
||||
{
|
||||
PRUint32 policyCheckFlags = 0;
|
||||
|
||||
if (NSSUTIL_ArgHasFlag("flags", "policyCheckIdentifier", nss)) {
|
||||
policyCheckFlags |= SECMOD_FLAG_POLICY_CHECK_IDENTIFIER;
|
||||
}
|
||||
|
||||
if (NSSUTIL_ArgHasFlag("flags", "policyCheckValue", nss)) {
|
||||
policyCheckFlags |= SECMOD_FLAG_POLICY_CHECK_VALUE;
|
||||
}
|
||||
|
||||
return policyCheckFlags;
|
||||
}
|
||||
|
||||
/*
|
||||
* for 3.4 we continue to use the old SECMODModule structure
|
||||
*/
|
||||
|
|
@ -787,11 +952,10 @@ SECMOD_CreateModuleEx(const char *library, const char *moduleName,
|
|||
SECMODModule *mod;
|
||||
SECStatus rv;
|
||||
char *slotParams, *ciphers;
|
||||
/* pk11pars.h still does not have const char * interfaces */
|
||||
char *nssc = (char *)nss;
|
||||
PRBool printPolicyFeedback = NSSUTIL_ArgHasFlag("flags", "printPolicyFeedback", nssc);
|
||||
PRBool printPolicyFeedback = NSSUTIL_ArgHasFlag("flags", "printPolicyFeedback", nss);
|
||||
PRUint32 policyCheckFlags = secmod_parsePolicyCheckFlags(nss);
|
||||
|
||||
rv = secmod_parseCryptoPolicy(config, printPolicyFeedback);
|
||||
rv = secmod_parseCryptoPolicy(config, printPolicyFeedback, policyCheckFlags);
|
||||
|
||||
/* do not load the module if policy parsing fails */
|
||||
if (rv != SECSuccess) {
|
||||
|
|
@ -815,27 +979,27 @@ SECMOD_CreateModuleEx(const char *library, const char *moduleName,
|
|||
mod->libraryParams = PORT_ArenaStrdup(mod->arena, parameters);
|
||||
}
|
||||
|
||||
mod->internal = NSSUTIL_ArgHasFlag("flags", "internal", nssc);
|
||||
mod->isFIPS = NSSUTIL_ArgHasFlag("flags", "FIPS", nssc);
|
||||
mod->internal = NSSUTIL_ArgHasFlag("flags", "internal", nss);
|
||||
mod->isFIPS = NSSUTIL_ArgHasFlag("flags", "FIPS", nss);
|
||||
/* if the system FIPS mode is enabled, force FIPS to be on */
|
||||
if (secmod_GetSystemFIPSEnabled()) {
|
||||
if (SECMOD_GetSystemFIPSEnabled()) {
|
||||
mod->isFIPS = PR_TRUE;
|
||||
}
|
||||
mod->isCritical = NSSUTIL_ArgHasFlag("flags", "critical", nssc);
|
||||
slotParams = NSSUTIL_ArgGetParamValue("slotParams", nssc);
|
||||
mod->isCritical = NSSUTIL_ArgHasFlag("flags", "critical", nss);
|
||||
slotParams = NSSUTIL_ArgGetParamValue("slotParams", nss);
|
||||
mod->slotInfo = NSSUTIL_ArgParseSlotInfo(mod->arena, slotParams,
|
||||
&mod->slotInfoCount);
|
||||
if (slotParams)
|
||||
PORT_Free(slotParams);
|
||||
/* new field */
|
||||
mod->trustOrder = NSSUTIL_ArgReadLong("trustOrder", nssc,
|
||||
mod->trustOrder = NSSUTIL_ArgReadLong("trustOrder", nss,
|
||||
NSSUTIL_DEFAULT_TRUST_ORDER, NULL);
|
||||
/* new field */
|
||||
mod->cipherOrder = NSSUTIL_ArgReadLong("cipherOrder", nssc,
|
||||
mod->cipherOrder = NSSUTIL_ArgReadLong("cipherOrder", nss,
|
||||
NSSUTIL_DEFAULT_CIPHER_ORDER, NULL);
|
||||
/* new field */
|
||||
mod->isModuleDB = NSSUTIL_ArgHasFlag("flags", "moduleDB", nssc);
|
||||
mod->moduleDBOnly = NSSUTIL_ArgHasFlag("flags", "moduleDBOnly", nssc);
|
||||
mod->isModuleDB = NSSUTIL_ArgHasFlag("flags", "moduleDB", nss);
|
||||
mod->moduleDBOnly = NSSUTIL_ArgHasFlag("flags", "moduleDBOnly", nss);
|
||||
if (mod->moduleDBOnly)
|
||||
mod->isModuleDB = PR_TRUE;
|
||||
|
||||
|
|
@ -847,13 +1011,13 @@ SECMOD_CreateModuleEx(const char *library, const char *moduleName,
|
|||
* code checking if (mod->isModuleDB) will continue to work correctly. */
|
||||
if (mod->isModuleDB) {
|
||||
char flags = SECMOD_FLAG_MODULE_DB_IS_MODULE_DB;
|
||||
if (NSSUTIL_ArgHasFlag("flags", "skipFirst", nssc)) {
|
||||
if (NSSUTIL_ArgHasFlag("flags", "skipFirst", nss)) {
|
||||
flags |= SECMOD_FLAG_MODULE_DB_SKIP_FIRST;
|
||||
}
|
||||
if (NSSUTIL_ArgHasFlag("flags", "defaultModDB", nssc)) {
|
||||
if (NSSUTIL_ArgHasFlag("flags", "defaultModDB", nss)) {
|
||||
flags |= SECMOD_FLAG_MODULE_DB_DEFAULT_MODDB;
|
||||
}
|
||||
if (NSSUTIL_ArgHasFlag("flags", "policyOnly", nssc)) {
|
||||
if (NSSUTIL_ArgHasFlag("flags", "policyOnly", nss)) {
|
||||
flags |= SECMOD_FLAG_MODULE_DB_POLICY_ONLY;
|
||||
}
|
||||
/* additional moduleDB flags could be added here in the future */
|
||||
|
|
@ -863,13 +1027,13 @@ SECMOD_CreateModuleEx(const char *library, const char *moduleName,
|
|||
if (mod->internal) {
|
||||
char flags = SECMOD_FLAG_INTERNAL_IS_INTERNAL;
|
||||
|
||||
if (NSSUTIL_ArgHasFlag("flags", "internalKeySlot", nssc)) {
|
||||
if (NSSUTIL_ArgHasFlag("flags", "internalKeySlot", nss)) {
|
||||
flags |= SECMOD_FLAG_INTERNAL_KEY_SLOT;
|
||||
}
|
||||
mod->internal = (PRBool)flags;
|
||||
}
|
||||
|
||||
ciphers = NSSUTIL_ArgGetParamValue("ciphers", nssc);
|
||||
ciphers = NSSUTIL_ArgGetParamValue("ciphers", nss);
|
||||
NSSUTIL_ArgParseCipherFlags(&mod->ssl[0], ciphers);
|
||||
if (ciphers)
|
||||
PORT_Free(ciphers);
|
||||
|
|
@ -934,8 +1098,8 @@ secmod_SetInternalKeySlotFlag(SECMODModule *mod, PRBool val)
|
|||
* try to expand the buffer with Realloc.
|
||||
*/
|
||||
static char *
|
||||
secmod_doDescCopy(char *target, int *targetLen, const char *desc,
|
||||
int descLen, char *value)
|
||||
secmod_doDescCopy(char *target, char **base, int *baseLen,
|
||||
const char *desc, int descLen, char *value)
|
||||
{
|
||||
int diff, esc_len;
|
||||
|
||||
|
|
@ -944,12 +1108,14 @@ secmod_doDescCopy(char *target, int *targetLen, const char *desc,
|
|||
if (diff > 0) {
|
||||
/* we need to escape... expand newSpecPtr as well to make sure
|
||||
* we don't overflow it */
|
||||
char *newPtr = PORT_Realloc(target, *targetLen * diff);
|
||||
int offset = target - *base;
|
||||
char *newPtr = PORT_Realloc(*base, *baseLen + diff);
|
||||
if (!newPtr) {
|
||||
return target; /* not enough space, just drop the whole copy */
|
||||
}
|
||||
*targetLen += diff;
|
||||
target = newPtr;
|
||||
*baseLen += diff;
|
||||
target = newPtr + offset;
|
||||
*base = newPtr;
|
||||
value = NSSUTIL_Escape(value, '\"');
|
||||
if (value == NULL) {
|
||||
return target; /* couldn't escape value, just drop the copy */
|
||||
|
|
@ -1045,54 +1211,60 @@ secmod_ParseModuleSpecForTokens(PRBool convert, PRBool isFIPS,
|
|||
NSSUTIL_HANDLE_STRING_ARG(moduleSpec, target, "tokens=",
|
||||
modulePrev = moduleSpec;
|
||||
/* skip copying */)
|
||||
NSSUTIL_HANDLE_STRING_ARG(moduleSpec, tmp, "cryptoTokenDescription=",
|
||||
if (convert) { modulePrev = moduleSpec; });
|
||||
NSSUTIL_HANDLE_STRING_ARG(moduleSpec, tmp, "cryptoSlotDescription=",
|
||||
if (convert) { modulePrev = moduleSpec; });
|
||||
NSSUTIL_HANDLE_STRING_ARG(moduleSpec, tmp, "dbTokenDescription=",
|
||||
if (convert) {
|
||||
modulePrev = moduleSpec;
|
||||
if (!isFIPS) {
|
||||
newSpecPtr = secmod_doDescCopy(newSpecPtr,
|
||||
&newSpecLen,
|
||||
SECMOD_TOKEN_DESCRIPTION,
|
||||
sizeof(SECMOD_TOKEN_DESCRIPTION) - 1,
|
||||
tmp);
|
||||
}
|
||||
});
|
||||
NSSUTIL_HANDLE_STRING_ARG(moduleSpec, tmp, "dbSlotDescription=",
|
||||
if (convert) {
|
||||
modulePrev = moduleSpec; /* skip copying */
|
||||
if (!isFIPS) {
|
||||
newSpecPtr = secmod_doDescCopy(newSpecPtr,
|
||||
&newSpecLen,
|
||||
SECMOD_SLOT_DESCRIPTION,
|
||||
sizeof(SECMOD_SLOT_DESCRIPTION) - 1,
|
||||
tmp);
|
||||
}
|
||||
});
|
||||
NSSUTIL_HANDLE_STRING_ARG(moduleSpec, tmp, "FIPSTokenDescription=",
|
||||
if (convert) {
|
||||
modulePrev = moduleSpec; /* skip copying */
|
||||
if (isFIPS) {
|
||||
newSpecPtr = secmod_doDescCopy(newSpecPtr,
|
||||
&newSpecLen,
|
||||
SECMOD_TOKEN_DESCRIPTION,
|
||||
sizeof(SECMOD_TOKEN_DESCRIPTION) - 1,
|
||||
tmp);
|
||||
}
|
||||
});
|
||||
NSSUTIL_HANDLE_STRING_ARG(moduleSpec, tmp, "FIPSSlotDescription=",
|
||||
if (convert) {
|
||||
modulePrev = moduleSpec; /* skip copying */
|
||||
if (isFIPS) {
|
||||
newSpecPtr = secmod_doDescCopy(newSpecPtr,
|
||||
&newSpecLen,
|
||||
SECMOD_SLOT_DESCRIPTION,
|
||||
sizeof(SECMOD_SLOT_DESCRIPTION) - 1,
|
||||
tmp);
|
||||
}
|
||||
});
|
||||
NSSUTIL_HANDLE_STRING_ARG(
|
||||
moduleSpec, tmp, "cryptoTokenDescription=",
|
||||
if (convert) { modulePrev = moduleSpec; })
|
||||
NSSUTIL_HANDLE_STRING_ARG(
|
||||
moduleSpec, tmp, "cryptoSlotDescription=",
|
||||
if (convert) { modulePrev = moduleSpec; })
|
||||
NSSUTIL_HANDLE_STRING_ARG(
|
||||
moduleSpec, tmp, "dbTokenDescription=",
|
||||
if (convert) {
|
||||
modulePrev = moduleSpec;
|
||||
if (!isFIPS) {
|
||||
newSpecPtr = secmod_doDescCopy(newSpecPtr,
|
||||
&newSpec, &newSpecLen,
|
||||
SECMOD_TOKEN_DESCRIPTION,
|
||||
sizeof(SECMOD_TOKEN_DESCRIPTION) - 1,
|
||||
tmp);
|
||||
}
|
||||
})
|
||||
NSSUTIL_HANDLE_STRING_ARG(
|
||||
moduleSpec, tmp, "dbSlotDescription=",
|
||||
if (convert) {
|
||||
modulePrev = moduleSpec; /* skip copying */
|
||||
if (!isFIPS) {
|
||||
newSpecPtr = secmod_doDescCopy(newSpecPtr,
|
||||
&newSpec, &newSpecLen,
|
||||
SECMOD_SLOT_DESCRIPTION,
|
||||
sizeof(SECMOD_SLOT_DESCRIPTION) - 1,
|
||||
tmp);
|
||||
}
|
||||
})
|
||||
NSSUTIL_HANDLE_STRING_ARG(
|
||||
moduleSpec, tmp, "FIPSTokenDescription=",
|
||||
if (convert) {
|
||||
modulePrev = moduleSpec; /* skip copying */
|
||||
if (isFIPS) {
|
||||
newSpecPtr = secmod_doDescCopy(newSpecPtr,
|
||||
&newSpec, &newSpecLen,
|
||||
SECMOD_TOKEN_DESCRIPTION,
|
||||
sizeof(SECMOD_TOKEN_DESCRIPTION) - 1,
|
||||
tmp);
|
||||
}
|
||||
})
|
||||
NSSUTIL_HANDLE_STRING_ARG(
|
||||
moduleSpec, tmp, "FIPSSlotDescription=",
|
||||
if (convert) {
|
||||
modulePrev = moduleSpec; /* skip copying */
|
||||
if (isFIPS) {
|
||||
newSpecPtr = secmod_doDescCopy(newSpecPtr,
|
||||
&newSpec, &newSpecLen,
|
||||
SECMOD_SLOT_DESCRIPTION,
|
||||
sizeof(SECMOD_SLOT_DESCRIPTION) - 1,
|
||||
tmp);
|
||||
}
|
||||
})
|
||||
NSSUTIL_HANDLE_FINAL_ARG(moduleSpec)
|
||||
SECMOD_SPEC_COPY(newSpecPtr, modulePrev, moduleSpec);
|
||||
}
|
||||
|
|
@ -1797,6 +1969,7 @@ SECMOD_LoadModule(char *modulespec, SECMODModule *parent, PRBool recurse)
|
|||
SECMODModule *oldModule = NULL;
|
||||
SECStatus rv;
|
||||
PRBool forwardPolicyFeedback = PR_FALSE;
|
||||
PRUint32 forwardPolicyCheckFlags;
|
||||
|
||||
/* initialize the underlying module structures */
|
||||
SECMOD_Init();
|
||||
|
|
@ -1810,6 +1983,8 @@ SECMOD_LoadModule(char *modulespec, SECMODModule *parent, PRBool recurse)
|
|||
|
||||
module = SECMOD_CreateModuleEx(library, moduleName, parameters, nss, config);
|
||||
forwardPolicyFeedback = NSSUTIL_ArgHasFlag("flags", "printPolicyFeedback", nss);
|
||||
forwardPolicyCheckFlags = secmod_parsePolicyCheckFlags(nss);
|
||||
|
||||
if (library)
|
||||
PORT_Free(library);
|
||||
if (moduleName)
|
||||
|
|
@ -1878,6 +2053,17 @@ SECMOD_LoadModule(char *modulespec, SECMODModule *parent, PRBool recurse)
|
|||
/* Add printPolicyFeedback to the nss flags */
|
||||
char *specWithForwards =
|
||||
NSSUTIL_AddNSSFlagToModuleSpec(*index, "printPolicyFeedback");
|
||||
char *tmp;
|
||||
if (forwardPolicyCheckFlags & SECMOD_FLAG_POLICY_CHECK_IDENTIFIER) {
|
||||
tmp = NSSUTIL_AddNSSFlagToModuleSpec(specWithForwards, "policyCheckIdentifier");
|
||||
PORT_Free(specWithForwards);
|
||||
specWithForwards = tmp;
|
||||
}
|
||||
if (forwardPolicyCheckFlags & SECMOD_FLAG_POLICY_CHECK_VALUE) {
|
||||
tmp = NSSUTIL_AddNSSFlagToModuleSpec(specWithForwards, "policyCheckValue");
|
||||
PORT_Free(specWithForwards);
|
||||
specWithForwards = tmp;
|
||||
}
|
||||
child = SECMOD_LoadModule(specWithForwards, module, PR_TRUE);
|
||||
PORT_Free(specWithForwards);
|
||||
}
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue