mirror of
https://repo.dactyloidae.xyz/Dactyloidae/UXP.git
synced 2026-09-24 09:27:31 +09:00
Replace NSS with Pale Moon's
This commit is contained in:
wuggy
parent
ff1e5e48bf
commit
8c2e376f94
2870 changed files with 1762232 additions and 1374220 deletions
|
|
@ -49,6 +49,8 @@
|
|||
#define NSC_SEARCH_BLOCK_SIZE 5
|
||||
#define NSC_SLOT_LIST_BLOCK_SIZE 10
|
||||
|
||||
#define NSC_MIN_SESSION_OBJECT_HANDLE 1U
|
||||
|
||||
#define NSC_FIPS_MODULE 1
|
||||
#define NSC_NON_FIPS_MODULE 0
|
||||
|
||||
|
|
@ -105,8 +107,9 @@ typedef struct SFTKSessionContextStr SFTKSessionContext;
|
|||
typedef struct SFTKSearchResultsStr SFTKSearchResults;
|
||||
typedef struct SFTKHashVerifyInfoStr SFTKHashVerifyInfo;
|
||||
typedef struct SFTKHashSignInfoStr SFTKHashSignInfo;
|
||||
typedef struct SFTKOAEPEncryptInfoStr SFTKOAEPEncryptInfo;
|
||||
typedef struct SFTKOAEPDecryptInfoStr SFTKOAEPDecryptInfo;
|
||||
typedef struct SFTKOAEPInfoStr SFTKOAEPInfo;
|
||||
typedef struct SFTKPSSSignInfoStr SFTKPSSSignInfo;
|
||||
typedef struct SFTKPSSVerifyInfoStr SFTKPSSVerifyInfo;
|
||||
typedef struct SFTKSSLMACInfoStr SFTKSSLMACInfo;
|
||||
typedef struct SFTKChaCha20Poly1305InfoStr SFTKChaCha20Poly1305Info;
|
||||
typedef struct SFTKChaCha20CtrInfoStr SFTKChaCha20CtrInfo;
|
||||
|
|
@ -117,6 +120,9 @@ typedef void (*SFTKDestroy)(void *, PRBool);
|
|||
typedef void (*SFTKBegin)(void *);
|
||||
typedef SECStatus (*SFTKCipher)(void *, void *, unsigned int *, unsigned int,
|
||||
void *, unsigned int);
|
||||
typedef SECStatus (*SFTKAEADCipher)(void *, void *, unsigned int *,
|
||||
unsigned int, void *, unsigned int,
|
||||
void *, unsigned int, void *, unsigned int);
|
||||
typedef SECStatus (*SFTKVerify)(void *, void *, unsigned int, void *, unsigned int);
|
||||
typedef void (*SFTKHash)(void *, const void *, unsigned int);
|
||||
typedef void (*SFTKEnd)(void *, void *, unsigned int *, unsigned int);
|
||||
|
|
@ -187,6 +193,7 @@ struct SFTKObjectStr {
|
|||
SFTKSlot *slot;
|
||||
void *objectInfo;
|
||||
SFTKFree infoFree;
|
||||
PRBool isFIPS;
|
||||
};
|
||||
|
||||
struct SFTKTokenObjectStr {
|
||||
|
|
@ -235,7 +242,11 @@ typedef enum {
|
|||
SFTK_SIGN,
|
||||
SFTK_SIGN_RECOVER,
|
||||
SFTK_VERIFY,
|
||||
SFTK_VERIFY_RECOVER
|
||||
SFTK_VERIFY_RECOVER,
|
||||
SFTK_MESSAGE_ENCRYPT,
|
||||
SFTK_MESSAGE_DECRYPT,
|
||||
SFTK_MESSAGE_SIGN,
|
||||
SFTK_MESSAGE_VERIFY
|
||||
} SFTKContextType;
|
||||
|
||||
/** max block size of supported block ciphers */
|
||||
|
|
@ -258,6 +269,7 @@ struct SFTKSessionContextStr {
|
|||
PRBool rsa; /* is rsa */
|
||||
PRBool doPad; /* use PKCS padding for block ciphers */
|
||||
PRBool isXCBC; /* xcbc, use special handling in final */
|
||||
PRBool isFIPS; /* current operation is in FIPS mode */
|
||||
unsigned int blockSize; /* blocksize for padding */
|
||||
unsigned int padDataLength; /* length of the valid data in padbuf */
|
||||
/** latest incomplete block of data for block cipher */
|
||||
|
|
@ -272,6 +284,7 @@ struct SFTKSessionContextStr {
|
|||
unsigned int cipherInfoLen;
|
||||
CK_MECHANISM_TYPE currentMech;
|
||||
SFTKCipher update;
|
||||
SFTKAEADCipher aeadUpdate;
|
||||
SFTKHash hashUpdate;
|
||||
SFTKEnd end;
|
||||
SFTKDestroy destroy;
|
||||
|
|
@ -298,6 +311,7 @@ struct SFTKSessionStr {
|
|||
SFTKSessionContext *enc_context;
|
||||
SFTKSessionContext *hash_context;
|
||||
SFTKSessionContext *sign_context;
|
||||
PRBool lastOpWasFIPS;
|
||||
SFTKObjectList *objects[1];
|
||||
};
|
||||
|
||||
|
|
@ -309,9 +323,9 @@ struct SFTKSessionStr {
|
|||
* (head[]->refCount), objectLock protects all elements of the slot's
|
||||
* object hash tables (sessObjHashTable[] and tokObjHashTable), and
|
||||
* sessionObjectHandleCount.
|
||||
* slotLock protects the remaining protected elements:
|
||||
* password, needLogin, isLoggedIn, ssoLoggedIn, and sessionCount,
|
||||
* and pwCheckLock serializes the key database password checks in
|
||||
* slotLock protects password, needLogin, isLoggedIn, ssoLoggedIn,
|
||||
* sessionCount, and rwSessionCount.
|
||||
* pwCheckLock serializes the key database password checks in
|
||||
* NSC_SetPIN and NSC_Login.
|
||||
*
|
||||
* Each of the fields below has the following lifetime as commented
|
||||
|
|
@ -351,8 +365,7 @@ struct SFTKSlotStr {
|
|||
int sessionIDConflict; /* not protected by a lock */
|
||||
/* (preserved) */
|
||||
int sessionCount; /* variable - reset */
|
||||
PRInt32 rwSessionCount; /* set by atomic operations */
|
||||
/* (reset) */
|
||||
int rwSessionCount; /* variable - reset */
|
||||
int sessionObjectHandleCount; /* variable - perserved */
|
||||
CK_ULONG index; /* invariant */
|
||||
PLHashTable *tokObjHashTable; /* invariant */
|
||||
|
|
@ -363,6 +376,9 @@ struct SFTKSlotStr {
|
|||
char tokDescription[33]; /* per load */
|
||||
char updateTokDescription[33]; /* per load */
|
||||
char slotDescription[65]; /* invariant */
|
||||
SFTKSession moduleObjects; /* global session to hang module specific
|
||||
* objects like profile objects or
|
||||
* validation objects */
|
||||
};
|
||||
|
||||
/*
|
||||
|
|
@ -380,21 +396,33 @@ struct SFTKHashSignInfoStr {
|
|||
NSSLOWKEYPrivateKey *key;
|
||||
};
|
||||
|
||||
/**
|
||||
* Contexts for RSA-OAEP
|
||||
*/
|
||||
struct SFTKOAEPEncryptInfoStr {
|
||||
CK_RSA_PKCS_OAEP_PARAMS *params;
|
||||
struct SFTKPSSVerifyInfoStr {
|
||||
size_t size; /* must be first */
|
||||
CK_RSA_PKCS_PSS_PARAMS params;
|
||||
NSSLOWKEYPublicKey *key;
|
||||
};
|
||||
|
||||
struct SFTKOAEPDecryptInfoStr {
|
||||
CK_RSA_PKCS_OAEP_PARAMS *params;
|
||||
struct SFTKPSSSignInfoStr {
|
||||
size_t size; /* must be first */
|
||||
CK_RSA_PKCS_PSS_PARAMS params;
|
||||
NSSLOWKEYPrivateKey *key;
|
||||
};
|
||||
|
||||
/**
|
||||
* Contexts for RSA-OAEP
|
||||
*/
|
||||
struct SFTKOAEPInfoStr {
|
||||
CK_RSA_PKCS_OAEP_PARAMS params;
|
||||
PRBool isEncrypt;
|
||||
union {
|
||||
NSSLOWKEYPublicKey *pub;
|
||||
NSSLOWKEYPrivateKey *priv;
|
||||
} key;
|
||||
};
|
||||
|
||||
/* context for the Final SSLMAC message */
|
||||
struct SFTKSSLMACInfoStr {
|
||||
size_t size; /* must be first */
|
||||
void *hashContext;
|
||||
SFTKBegin begin;
|
||||
SFTKHash update;
|
||||
|
|
@ -473,6 +501,8 @@ struct SFTKItemTemplateStr {
|
|||
/* slot helper macros */
|
||||
#define sftk_SlotFromSession(sp) ((sp)->slot)
|
||||
#define sftk_isToken(id) (((id)&SFTK_TOKEN_MASK) == SFTK_TOKEN_MAGIC)
|
||||
#define sftk_isFIPS(id) \
|
||||
(((id) == FIPS_SLOT_ID) || ((id) >= SFTK_MIN_FIPS_USER_SLOT_ID))
|
||||
|
||||
/* the session hash multiplier (see bug 201081) */
|
||||
#define SHMULTIPLIER 1791398085
|
||||
|
|
@ -665,6 +695,9 @@ struct sftk_MACCtxStr {
|
|||
};
|
||||
typedef struct sftk_MACCtxStr sftk_MACCtx;
|
||||
|
||||
extern CK_NSS_MODULE_FUNCTIONS sftk_module_funcList;
|
||||
extern CK_NSS_FIPS_FUNCTIONS sftk_fips_funcList;
|
||||
|
||||
SEC_BEGIN_PROTOS
|
||||
|
||||
/* shared functions between pkcs11.c and fipstokn.c */
|
||||
|
|
@ -673,20 +706,26 @@ extern CK_RV nsc_CommonInitialize(CK_VOID_PTR pReserved, PRBool isFIPS);
|
|||
extern CK_RV nsc_CommonFinalize(CK_VOID_PTR pReserved, PRBool isFIPS);
|
||||
extern PRBool sftk_ForkReset(CK_VOID_PTR pReserved, CK_RV *crv);
|
||||
extern CK_RV nsc_CommonGetSlotList(CK_BBOOL tokPresent,
|
||||
CK_SLOT_ID_PTR pSlotList, CK_ULONG_PTR pulCount, int moduleIndex);
|
||||
CK_SLOT_ID_PTR pSlotList,
|
||||
CK_ULONG_PTR pulCount,
|
||||
unsigned int moduleIndex);
|
||||
|
||||
/* slot initialization, reinit, shutdown and destruction */
|
||||
extern CK_RV SFTK_SlotInit(char *configdir, char *updatedir, char *updateID,
|
||||
sftk_token_parameters *params, int moduleIndex);
|
||||
sftk_token_parameters *params,
|
||||
unsigned int moduleIndex);
|
||||
extern CK_RV SFTK_SlotReInit(SFTKSlot *slot, char *configdir,
|
||||
char *updatedir, char *updateID,
|
||||
sftk_token_parameters *params, int moduleIndex);
|
||||
sftk_token_parameters *params,
|
||||
unsigned int moduleIndex);
|
||||
extern CK_RV SFTK_DestroySlotData(SFTKSlot *slot);
|
||||
extern CK_RV SFTK_ShutdownSlot(SFTKSlot *slot);
|
||||
extern CK_RV sftk_CloseAllSessions(SFTKSlot *slot, PRBool logout);
|
||||
|
||||
/* internal utility functions used by pkcs11.c */
|
||||
extern CK_RV sftk_MapCryptError(int error);
|
||||
extern CK_RV sftk_MapDecryptError(int error);
|
||||
extern CK_RV sftk_MapVerifyError(int error);
|
||||
extern SFTKAttribute *sftk_FindAttribute(SFTKObject *object,
|
||||
CK_ATTRIBUTE_TYPE type);
|
||||
extern void sftk_FreeAttribute(SFTKAttribute *attribute);
|
||||
|
|
@ -731,6 +770,7 @@ extern CK_RV sftk_DeleteObject(SFTKSession *session, SFTKObject *object);
|
|||
extern void sftk_ReferenceObject(SFTKObject *object);
|
||||
extern SFTKObject *sftk_ObjectFromHandle(CK_OBJECT_HANDLE handle,
|
||||
SFTKSession *session);
|
||||
extern CK_OBJECT_HANDLE sftk_getNextHandle(SFTKSlot *slot);
|
||||
extern void sftk_AddSlotObject(SFTKSlot *slot, SFTKObject *object);
|
||||
extern void sftk_AddObject(SFTKSession *session, SFTKObject *object);
|
||||
/* clear out all the existing object ID to database key mappings.
|
||||
|
|
@ -752,15 +792,38 @@ extern SFTKSlot *sftk_SlotFromSessionHandle(CK_SESSION_HANDLE handle);
|
|||
extern CK_SLOT_ID sftk_SlotIDFromSessionHandle(CK_SESSION_HANDLE handle);
|
||||
extern SFTKSession *sftk_SessionFromHandle(CK_SESSION_HANDLE handle);
|
||||
extern void sftk_FreeSession(SFTKSession *session);
|
||||
extern void sftk_ClearSession(SFTKSession *session);
|
||||
extern void sftk_DestroySession(SFTKSession *session);
|
||||
extern CK_RV sftk_InitSession(SFTKSession *session, SFTKSlot *slot,
|
||||
CK_SLOT_ID slotID, CK_NOTIFY notify,
|
||||
CK_VOID_PTR pApplication, CK_FLAGS flags);
|
||||
extern SFTKSession *sftk_NewSession(CK_SLOT_ID slotID, CK_NOTIFY notify,
|
||||
CK_VOID_PTR pApplication, CK_FLAGS flags);
|
||||
extern void sftk_update_state(SFTKSlot *slot, SFTKSession *session);
|
||||
extern void sftk_update_all_states(SFTKSlot *slot);
|
||||
extern void sftk_FreeContext(SFTKSessionContext *context);
|
||||
extern void sftk_InitFreeLists(void);
|
||||
extern void sftk_CleanupFreeLists(void);
|
||||
|
||||
/*
|
||||
* Helper functions to handle the session crypto contexts
|
||||
*/
|
||||
extern CK_RV sftk_InitGeneric(SFTKSession *session,
|
||||
CK_MECHANISM *pMechanism,
|
||||
SFTKSessionContext **contextPtr,
|
||||
SFTKContextType ctype, SFTKObject **keyPtr,
|
||||
CK_OBJECT_HANDLE hKey, CK_KEY_TYPE *keyTypePtr,
|
||||
CK_OBJECT_CLASS pubKeyType,
|
||||
CK_ATTRIBUTE_TYPE operation);
|
||||
void sftk_SetContextByType(SFTKSession *session, SFTKContextType type,
|
||||
SFTKSessionContext *context);
|
||||
extern CK_RV sftk_GetContext(CK_SESSION_HANDLE handle,
|
||||
SFTKSessionContext **contextPtr,
|
||||
SFTKContextType type, PRBool needMulti,
|
||||
SFTKSession **sessionPtr);
|
||||
extern void sftk_TerminateOp(SFTKSession *session, SFTKContextType ctype,
|
||||
SFTKSessionContext *context);
|
||||
extern void sftk_FreeContext(SFTKSessionContext *context);
|
||||
|
||||
extern NSSLOWKEYPublicKey *sftk_GetPubKey(SFTKObject *object,
|
||||
CK_KEY_TYPE key_type, CK_RV *crvp);
|
||||
extern NSSLOWKEYPrivateKey *sftk_GetPrivKey(SFTKObject *object,
|
||||
|
|
@ -770,6 +833,8 @@ extern CK_RV sftk_PutPubKey(SFTKObject *publicKey, SFTKObject *privKey, CK_KEY_T
|
|||
extern void sftk_FormatDESKey(unsigned char *key, int length);
|
||||
extern PRBool sftk_CheckDESKey(unsigned char *key);
|
||||
extern PRBool sftk_IsWeakKey(unsigned char *key, CK_KEY_TYPE key_type);
|
||||
extern void sftk_EncodeInteger(PRUint64 integer, CK_ULONG num_bits, CK_BBOOL littleEndian,
|
||||
CK_BYTE_PTR output, CK_ULONG_PTR output_len);
|
||||
|
||||
/* ike and xcbc helpers */
|
||||
extern CK_RV sftk_ike_prf(CK_SESSION_HANDLE hSession,
|
||||
|
|
@ -781,7 +846,8 @@ extern CK_RV sftk_ike1_prf(CK_SESSION_HANDLE hSession,
|
|||
unsigned int keySize);
|
||||
extern CK_RV sftk_ike1_appendix_b_prf(CK_SESSION_HANDLE hSession,
|
||||
const SFTKAttribute *inKey,
|
||||
const CK_MECHANISM_TYPE *params, SFTKObject *outKey,
|
||||
const CK_NSS_IKE1_APP_B_PRF_DERIVE_PARAMS *params,
|
||||
SFTKObject *outKey,
|
||||
unsigned int keySize);
|
||||
extern CK_RV sftk_ike_prf_plus(CK_SESSION_HANDLE hSession,
|
||||
const SFTKAttribute *inKey,
|
||||
|
|
@ -791,7 +857,7 @@ extern CK_RV sftk_aes_xcbc_new_keys(CK_SESSION_HANDLE hSession,
|
|||
CK_OBJECT_HANDLE hKey, CK_OBJECT_HANDLE_PTR phKey,
|
||||
unsigned char *k2, unsigned char *k3);
|
||||
extern CK_RV sftk_xcbc_mac_pad(unsigned char *padBuf, unsigned int bufLen,
|
||||
int blockSize, const unsigned char *k2,
|
||||
unsigned int blockSize, const unsigned char *k2,
|
||||
const unsigned char *k3);
|
||||
extern SECStatus sftk_fips_IKE_PowerUpSelfTests(void);
|
||||
|
||||
|
|
@ -807,6 +873,7 @@ NSSLOWKEYPrivateKey *sftk_FindKeyByPublicKey(SFTKSlot *slot, SECItem *dbKey);
|
|||
*/
|
||||
CK_RV sftk_parseParameters(char *param, sftk_parameters *parsed, PRBool isFIPS);
|
||||
void sftk_freeParams(sftk_parameters *params);
|
||||
PRBool sftk_RawArgHasFlag(const char *entry, const char *flag, const void *pReserved);
|
||||
|
||||
/*
|
||||
* narrow objects
|
||||
|
|
@ -846,6 +913,9 @@ void sftk_MACConstantTime_EndHash(
|
|||
void *pctx, void *out, unsigned int *outLength, unsigned int maxLength);
|
||||
void sftk_MACConstantTime_DestroyContext(void *pctx, PRBool);
|
||||
|
||||
/* Crypto Utilities */
|
||||
HASH_HashType sftk_GetHashTypeFromMechanism(CK_MECHANISM_TYPE mech);
|
||||
|
||||
/****************************************
|
||||
* implement TLS Pseudo Random Function (PRF)
|
||||
*/
|
||||
|
|
@ -859,14 +929,48 @@ sftk_TLSPRFInit(SFTKSessionContext *context,
|
|||
|
||||
/* PKCS#11 MAC implementation. See sftk_MACCtxStr declaration above for
|
||||
* calling semantics for these functions. */
|
||||
HASH_HashType sftk_HMACMechanismToHash(CK_MECHANISM_TYPE mech);
|
||||
CK_RV sftk_MAC_Create(CK_MECHANISM_TYPE mech, SFTKObject *key, sftk_MACCtx **ret_ctx);
|
||||
CK_RV sftk_MAC_Init(sftk_MACCtx *ctx, CK_MECHANISM_TYPE mech, SFTKObject *key);
|
||||
CK_RV sftk_MAC_InitRaw(sftk_MACCtx *ctx, CK_MECHANISM_TYPE mech, const unsigned char *key, unsigned int key_len, PRBool isFIPS);
|
||||
CK_RV sftk_MAC_Update(sftk_MACCtx *ctx, CK_BYTE_PTR data, unsigned int data_len);
|
||||
CK_RV sftk_MAC_Update(sftk_MACCtx *ctx, const CK_BYTE *data, unsigned int data_len);
|
||||
CK_RV sftk_MAC_Finish(sftk_MACCtx *ctx, CK_BYTE_PTR result, unsigned int *result_len, unsigned int max_result_len);
|
||||
CK_RV sftk_MAC_Reset(sftk_MACCtx *ctx);
|
||||
void sftk_MAC_Destroy(sftk_MACCtx *ctx, PRBool free_it);
|
||||
|
||||
/* constant time helpers */
|
||||
unsigned int sftk_CKRVToMask(CK_RV rv);
|
||||
CK_RV sftk_CheckCBCPadding(CK_BYTE_PTR pBuf, unsigned int bufLen,
|
||||
unsigned int blockSize, unsigned int *outPadSize);
|
||||
|
||||
/* NIST 800-108 (kbkdf.c) implementations */
|
||||
extern CK_RV kbkdf_Dispatch(CK_MECHANISM_TYPE mech, CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechanism, SFTKObject *base_key, SFTKObject *ret_key, CK_ULONG keySize);
|
||||
extern SECStatus sftk_fips_SP800_108_PowerUpSelfTests(void);
|
||||
|
||||
/* export the HKDF function for use in PowerupSelfTests */
|
||||
CK_RV sftk_HKDF(CK_HKDF_PARAMS_PTR params, CK_SESSION_HANDLE hSession,
|
||||
SFTKObject *sourceKey, const unsigned char *sourceKeyBytes,
|
||||
int sourceKeyLen, SFTKObject *key,
|
||||
unsigned char *outKeyBytes, int keySize,
|
||||
PRBool canBeData, PRBool isFIPS);
|
||||
|
||||
char **NSC_ModuleDBFunc(unsigned long function, char *parameters, void *args);
|
||||
|
||||
/* dh verify functions */
|
||||
/* verify that dhPrime matches one of our known primes, and if so return
|
||||
* it's subprime value */
|
||||
const SECItem *sftk_VerifyDH_Prime(SECItem *dhPrime, PRBool isFIPS);
|
||||
/* check if dhSubPrime claims dhPrime is a safe prime. */
|
||||
SECStatus sftk_IsSafePrime(SECItem *dhPrime, SECItem *dhSubPrime, PRBool *isSafe);
|
||||
/* map an operation Attribute to a Mechanism flag */
|
||||
CK_FLAGS sftk_AttributeToFlags(CK_ATTRIBUTE_TYPE op);
|
||||
/* check the FIPS table to determine if this current operation is allowed by
|
||||
* FIPS security policy */
|
||||
PRBool sftk_operationIsFIPS(SFTKSlot *slot, CK_MECHANISM *mech,
|
||||
CK_ATTRIBUTE_TYPE op, SFTKObject *source);
|
||||
/* add validation objects to the slot */
|
||||
CK_RV sftk_CreateValidationObjects(SFTKSlot *slot);
|
||||
|
||||
SEC_END_PROTOS
|
||||
|
||||
#endif /* _PKCS11I_H_ */
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue