wuggy/Dactyloidae
wuggy/Dactyloidae
1
0
Fork 0
mirror of https://repo.dactyloidae.xyz/Dactyloidae/UXP.git synced 2026-09-21 15:57:31 +09:00
Code Issues Projects Releases Packages Wiki Activity

Replace NSS with Pale Moon's

Browse source
This commit is contained in:
wuggy 2026-06-29 21:29:25 +01:00
commit 8c2e376f94
2870 changed files with 1762232 additions and 1374220 deletions
Download patch file Download diff file Expand all files Collapse all files

3
security/nss/lib/util/Makefile
View file

@ -14,8 +14,6 @@ include manifest.mn
# (2) Include "global" configuration information. (OPTIONAL) #
#######################################################################
# include $(CORE_DEPTH)/coreconf/arch.mk
include $(CORE_DEPTH)/coreconf/config.mk
#######################################################################
@ -47,4 +45,3 @@ include $(CORE_DEPTH)/coreconf/rules.mk
#######################################################################
export:: private_export

12
security/nss/lib/util/SECerrs.h
View file

@ -549,3 +549,15 @@ ER3(SEC_ERROR_LEGACY_DATABASE, (SEC_ERROR_BASE + 177),
ER3(SEC_ERROR_APPLICATION_CALLBACK_ERROR, (SEC_ERROR_BASE + 178),
"The certificate was rejected by extra checks in the application.")
ER3(SEC_ERROR_INVALID_STATE, (SEC_ERROR_BASE + 179),
"The attempted operation is invalid for the current state.")
ER3(SEC_ERROR_POLICY_LOCKED, (SEC_ERROR_BASE + 180),
"Could not change the policy because the policy is now locked.")
ER3(SEC_ERROR_SIGNATURE_ALGORITHM_DISABLED, (SEC_ERROR_BASE + 181),
"Could not create or verify a signature using a signature algorithm that is disabled because it is not secure.")
ER3(SEC_ERROR_ALGORITHM_MISMATCH, (SEC_ERROR_BASE + 182),
"The signature algorithm in the signature field of the certificate does not match the algorithm in its signatureAlgorithm field.")

7
security/nss/lib/util/config.mk
View file

@ -6,13 +6,6 @@
# can't do this in manifest.mn because OS_TARGET isn't defined there.
ifeq (,$(filter-out WIN%,$(OS_TARGET)))
# don't want the 32 in the shared library name
SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
IMPORT_LIBRARY = $(OBJDIR)/$(IMPORT_LIB_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION)$(IMPORT_LIB_SUFFIX)
RES = $(OBJDIR)/$(LIBRARY_NAME).res
RESNAME = $(LIBRARY_NAME).rc
ifdef NS_USE_GCC
EXTRA_SHARED_LIBS += \
-L$(DIST)/lib \

4
security/nss/lib/util/dertime.c
View file

@ -81,8 +81,8 @@ DER_TimeToUTCTime(SECItem *dst, PRTime gmttime)
}
static SECStatus /* forward */
der_TimeStringToTime(PRTime *dst, const char *string, int generalized,
const char **endptr);
der_TimeStringToTime(PRTime *dst, const char *string, int generalized,
const char **endptr);
#define GEN_STRING 2 /* TimeString is a GeneralizedTime */
#define UTC_STRING 0 /* TimeString is a UTCTime */

4
security/nss/lib/util/manifest.mn
View file

@ -82,11 +82,9 @@ CSRCS = \
MODULE = nss
# don't duplicate module name in REQUIRES
MAPFILE = $(OBJDIR)/nssutil.def
LIBRARY_NAME = nssutil
LIBRARY_VERSION = 3
MAPFILE = $(OBJDIR)/$(LIBRARY_NAME).def
# This part of the code, including all sub-dirs, can be optimized for size
export ALLOW_OPT_CODE_SIZE = 1

97
security/nss/lib/util/nssb64d.c
View file

@ -91,34 +91,63 @@ struct PLBase64DecoderStr {
PR_END_EXTERN_C
/*
* Table to convert an ascii "code" to its corresponding binary value.
* For ease of use, the binary values in the table are the actual values
* PLUS ONE. This is so that the special value of zero can denote an
* invalid mapping; that was much easier than trying to fill in the other
* values with some value other than zero, and to check for it.
/* A constant time range check for unsigned chars.
* Returns 255 if a <= x <= b and 0 otherwise.
*/
static inline unsigned char
ct_u8_in_range(unsigned char x, unsigned char a, unsigned char b)
{
/* Let x, a, b be ints in {0, 1, ... 255}.
* The value (a - x - 1) is in {-256, ..., 254}, so the low
* 8 bits of
* (a - x - 1) >> 8
* are all 1 if a <= x and all 0 if a > x.
*
* Likewise the low 8 bits of
* ((a - x - 1) >> 8) & ((x - c - 1) >> 8)
* are all 1 if a <= x <= c and all 0 otherwise.
*
* The same is true if we perform the shift after the AND
* ((a - x - 1) & (x - b - 1)) >> 8.
*/
return (unsigned char)(((a - x - 1) & (x - b - 1)) >> 8);
}
/* Convert a base64 code [A-Za-z0-9+/] to its value in {1, 2, ..., 64}.
* The use of 1-64 instead of 0-63 is so that the special value of zero can
* denote an invalid mapping; that was much easier than trying to fill in the
* other values with some value other than zero, and to check for it.
* Just remember to SUBTRACT ONE when using the value retrieved.
*/
static unsigned char base64_codetovaluep1[256] = {
/* 0: */ 0, 0, 0, 0, 0, 0, 0, 0,
/* 8: */ 0, 0, 0, 0, 0, 0, 0, 0,
/* 16: */ 0, 0, 0, 0, 0, 0, 0, 0,
/* 24: */ 0, 0, 0, 0, 0, 0, 0, 0,
/* 32: */ 0, 0, 0, 0, 0, 0, 0, 0,
/* 40: */ 0, 0, 0, 63, 0, 0, 0, 64,
/* 48: */ 53, 54, 55, 56, 57, 58, 59, 60,
/* 56: */ 61, 62, 0, 0, 0, 0, 0, 0,
/* 64: */ 0, 1, 2, 3, 4, 5, 6, 7,
/* 72: */ 8, 9, 10, 11, 12, 13, 14, 15,
/* 80: */ 16, 17, 18, 19, 20, 21, 22, 23,
/* 88: */ 24, 25, 26, 0, 0, 0, 0, 0,
/* 96: */ 0, 27, 28, 29, 30, 31, 32, 33,
/* 104: */ 34, 35, 36, 37, 38, 39, 40, 41,
/* 112: */ 42, 43, 44, 45, 46, 47, 48, 49,
/* 120: */ 50, 51, 52, 0, 0, 0, 0, 0,
/* 128: */ 0, 0, 0, 0, 0, 0, 0, 0
/* and rest are all zero as well */
};
static unsigned char
pl_base64_codetovaluep1(unsigned char code)
{
unsigned char mask;
unsigned char res = 0;
/* The range 'A' to 'Z' is mapped to 1 to 26 */
mask = ct_u8_in_range(code, 'A', 'Z');
res |= mask & (code - 'A' + 1);
/* The range 'a' to 'z' is mapped to 27 to 52 */
mask = ct_u8_in_range(code, 'a', 'z');
res |= mask & (code - 'a' + 27);
/* The range '0' to '9' is mapped to 53 to 62 */
mask = ct_u8_in_range(code, '0', '9');
res |= mask & (code - '0' + 53);
/* The code '+' is mapped to 63 */
mask = ct_u8_in_range(code, '+', '+');
res |= mask & 63;
/* The code '/' is mapped to 64 */
mask = ct_u8_in_range(code, '/', '/');
res |= mask & 64;
/* All other characters, including '=' are mapped to 0. */
return res;
}
#define B64_PAD '='
@ -134,7 +163,7 @@ pl_base64_decode_4to3(const unsigned char *in, unsigned char *out)
unsigned char bits;
for (j = 0; j < 4; j++) {
bits = base64_codetovaluep1[in[j]];
bits = pl_base64_codetovaluep1(in[j]);
if (bits == 0)
return -1;
num = (num << 6) | (bits - 1);
@ -157,9 +186,9 @@ pl_base64_decode_3to2(const unsigned char *in, unsigned char *out)
PRUint32 num = 0;
unsigned char bits1, bits2, bits3;
bits1 = base64_codetovaluep1[in[0]];
bits2 = base64_codetovaluep1[in[1]];
bits3 = base64_codetovaluep1[in[2]];
bits1 = pl_base64_codetovaluep1(in[0]);
bits2 = pl_base64_codetovaluep1(in[1]);
bits3 = pl_base64_codetovaluep1(in[2]);
if ((bits1 == 0) || (bits2 == 0) || (bits3 == 0))
return -1;
@ -184,8 +213,8 @@ pl_base64_decode_2to1(const unsigned char *in, unsigned char *out)
PRUint32 num = 0;
unsigned char bits1, bits2;
bits1 = base64_codetovaluep1[in[0]];
bits2 = base64_codetovaluep1[in[1]];
bits1 = pl_base64_codetovaluep1(in[0]);
bits2 = pl_base64_codetovaluep1(in[1]);
if ((bits1 == 0) || (bits2 == 0))
return -1;
@ -236,7 +265,7 @@ pl_base64_decode_buffer(PLBase64Decoder *data, const unsigned char *in,
* the processing down doing more complicated checking, but
* someone else might have different ideas in the future.
*/
if (base64_codetovaluep1[*in] > 0 || *in == B64_PAD)
if (pl_base64_codetovaluep1(*in) > 0 || *in == B64_PAD)
token[i++] = *in;
in++;
length--;
@ -298,7 +327,7 @@ pl_base64_decode_buffer(PLBase64Decoder *data, const unsigned char *in,
* we would expect to decode, something is wrong.
*/
while (length > 0) {
if (base64_codetovaluep1[*in] > 0)
if (pl_base64_codetovaluep1(*in) > 0)
return PR_FAILURE;
in++;
length--;

5
security/nss/lib/util/nssrwlk.h
View file

@ -5,12 +5,13 @@
/*
** File: nsrwlock.h
** Description: API to basic reader-writer lock functions of NSS.
** These are re-entrant reader writer locks; that is,
** These locks allow re-entry from writers but not readers. That is,
** If I hold the write lock, I can ask for it and get it again.
** If I hold the write lock, I can also ask for and get a read lock.
** I can then release the locks in any order (read or write).
** If I hold a read lock, I must not ask for another read lock or
** the write lock.
** I must release each lock type as many times as I acquired it.
** Otherwise, these are normal reader/writer locks.
**
** For deadlock detection, locks should be ranked, and no lock may be aquired
** while I hold a lock of higher rank number.

20
security/nss/lib/util/nssutil.def
View file

@ -334,3 +334,23 @@ NSSUTIL_AddNSSFlagToModuleSpec;
;+ local:
;+ *;
;+};
;+NSSUTIL_3.59 { # NSS Utilities 3.59 release
;+ global:
NSS_IsPolicyLocked;
NSS_LockPolicy;
;+ local:
;+ *;
;+};
;+NSSUTIL_3.82 { # NSS Utilities 3.82 release
;+ global:
PK11URI_GetPathAttributeItem;
PK11URI_GetQueryAttributeItem;
;+ local:
;+ *;
;+};
;+NSSUTIL_3.90 { # NSS Utilities 3.90 release
;+ global:
NSS_SecureSelect;
;+ local:
;+ *;
;+};

6
security/nss/lib/util/nssutil.h
View file

@ -19,10 +19,10 @@
* The format of the version string should be
* "<major version>.<minor version>[.<patch level>[.<build number>]][ <Beta>]"
*/
#define NSSUTIL_VERSION "3.48.6"
#define NSSUTIL_VERSION "3.90.12.0 (UXP)"
#define NSSUTIL_VMAJOR 3
#define NSSUTIL_VMINOR 48
#define NSSUTIL_VPATCH 6
#define NSSUTIL_VMINOR 90
#define NSSUTIL_VPATCH 12
#define NSSUTIL_VBUILD 0
#define NSSUTIL_BETA PR_FALSE

34
security/nss/lib/util/pkcs11.h
View file

@ -179,8 +179,12 @@ extern "C" {
#define __PASTE(x, y) x##y
/* packing defines */
#include "pkcs11p.h"
#ifndef CK_PKCS11_3_0
/* remember that we set it so we can unset it at the end */
#define __NSS_CK_PKCS11_3_IMPLICIT 1
#define CK_PKCS11_3_0 1
#endif
/* ==============================================================
* Define the "extern" form of all the entry points.
* ==============================================================
@ -216,7 +220,7 @@ extern "C" {
#undef CK_PKCS11_FUNCTION_INFO
/* ==============================================================
* Define structed vector of entry points. A CK_FUNCTION_LIST
* Define structed vector of entry points. A CK_FUNCTION_3_0_LIST
* contains a CK_VERSION indicating a library's PKCS #11 version
* and then a whole slew of function pointers to the routines in
* the library. This type was declared, but not defined, in
@ -228,6 +232,20 @@ extern "C" {
__PASTE(CK_, name) \
name;
#include "pkcs11p.h"
struct CK_FUNCTION_LIST_3_0 {
CK_VERSION version; /* PKCS #11 version */
/* Pile all the function pointers into the CK_FUNCTION_LIST_3_0. */
/* pkcs11f.h has all the information about the PKCS #11
* function prototypes. */
#include "pkcs11f.h"
};
#define CK_PKCS11_2_0_ONLY 1
/* now define the 2.0 function list */
struct CK_FUNCTION_LIST {
CK_VERSION version; /* PKCS #11 version */
@ -237,14 +255,18 @@ struct CK_FUNCTION_LIST {
* function prototypes. */
#include "pkcs11f.h"
};
#include "pkcs11u.h"
#undef CK_PKCS11_FUNCTION_INFO
#undef CK_PKCS11_2_0_ONLY
#ifdef __NSS_CK_PKCS11_3_IMPLICIT
#undef CK_PKCS11_3_0
#undef __NSS_CK_PKCS11_3_IMPLICIT
#endif
#undef __PASTE
/* unpack */
#include "pkcs11u.h"
#ifdef __cplusplus
}
#endif

368
security/nss/lib/util/pkcs11f.h
View file

@ -22,7 +22,7 @@ CK_PKCS11_FUNCTION_INFO(C_Initialize)
CK_VOID_PTR pInitArgs /* if this is not NULL_PTR, it gets
* cast to CK_C_INITIALIZE_ARGS_PTR
* and dereferenced */
);
);
#endif
/* C_Finalize indicates that an application is done with the
@ -31,7 +31,7 @@ CK_PKCS11_FUNCTION_INFO(C_Finalize)
#ifdef CK_NEED_ARG_LIST
(
CK_VOID_PTR pReserved /* reserved. Should be NULL_PTR */
);
);
#endif
/* C_GetInfo returns general information about PKCS #11. */
@ -39,7 +39,7 @@ CK_PKCS11_FUNCTION_INFO(C_GetInfo)
#ifdef CK_NEED_ARG_LIST
(
CK_INFO_PTR pInfo /* location that receives information */
);
);
#endif
/* C_GetFunctionList returns the function list. */
@ -48,7 +48,7 @@ CK_PKCS11_FUNCTION_INFO(C_GetFunctionList)
(
CK_FUNCTION_LIST_PTR_PTR ppFunctionList /* receives pointer to
* function list */
);
);
#endif
/* Slot and token management */
@ -60,7 +60,7 @@ CK_PKCS11_FUNCTION_INFO(C_GetSlotList)
CK_BBOOL tokenPresent, /* only slots with tokens? */
CK_SLOT_ID_PTR pSlotList, /* receives array of slot IDs */
CK_ULONG_PTR pulCount /* receives number of slots */
);
);
#endif
/* C_GetSlotInfo obtains information about a particular slot in
@ -70,7 +70,7 @@ CK_PKCS11_FUNCTION_INFO(C_GetSlotInfo)
(
CK_SLOT_ID slotID, /* the ID of the slot */
CK_SLOT_INFO_PTR pInfo /* receives the slot information */
);
);
#endif
/* C_GetTokenInfo obtains information about a particular token
@ -80,7 +80,7 @@ CK_PKCS11_FUNCTION_INFO(C_GetTokenInfo)
(
CK_SLOT_ID slotID, /* ID of the token's slot */
CK_TOKEN_INFO_PTR pInfo /* receives the token information */
);
);
#endif
/* C_GetMechanismList obtains a list of mechanism types
@ -91,7 +91,7 @@ CK_PKCS11_FUNCTION_INFO(C_GetMechanismList)
CK_SLOT_ID slotID, /* ID of token's slot */
CK_MECHANISM_TYPE_PTR pMechanismList, /* gets mech. array */
CK_ULONG_PTR pulCount /* gets # of mechs. */
);
);
#endif
/* C_GetMechanismInfo obtains information about a particular
@ -102,7 +102,7 @@ CK_PKCS11_FUNCTION_INFO(C_GetMechanismInfo)
CK_SLOT_ID slotID, /* ID of the token's slot */
CK_MECHANISM_TYPE type, /* type of mechanism */
CK_MECHANISM_INFO_PTR pInfo /* receives mechanism info */
);
);
#endif
/* C_InitToken initializes a token. */
@ -114,7 +114,7 @@ CK_PKCS11_FUNCTION_INFO(C_InitToken)
CK_UTF8CHAR_PTR pPin, /* the SO's initial PIN */
CK_ULONG ulPinLen, /* length in bytes of the PIN */
CK_UTF8CHAR_PTR pLabel /* 32-byte token label (blank padded) */
);
);
#endif
/* C_InitPIN initializes the normal user's PIN. */
@ -124,7 +124,7 @@ CK_PKCS11_FUNCTION_INFO(C_InitPIN)
CK_SESSION_HANDLE hSession, /* the session's handle */
CK_UTF8CHAR_PTR pPin, /* the normal user's PIN */
CK_ULONG ulPinLen /* length in bytes of the PIN */
);
);
#endif
/* C_SetPIN modifies the PIN of the user who is logged in. */
@ -136,7 +136,7 @@ CK_PKCS11_FUNCTION_INFO(C_SetPIN)
CK_ULONG ulOldLen, /* length of the old PIN */
CK_UTF8CHAR_PTR pNewPin, /* the new PIN */
CK_ULONG ulNewLen /* length of the new PIN */
);
);
#endif
/* Session management */
@ -151,7 +151,7 @@ CK_PKCS11_FUNCTION_INFO(C_OpenSession)
CK_VOID_PTR pApplication, /* passed to callback */
CK_NOTIFY Notify, /* callback function */
CK_SESSION_HANDLE_PTR phSession /* gets session handle */
);
);
#endif
/* C_CloseSession closes a session between an application and a
@ -160,7 +160,7 @@ CK_PKCS11_FUNCTION_INFO(C_CloseSession)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession /* the session's handle */
);
);
#endif
/* C_CloseAllSessions closes all sessions with a token. */
@ -168,7 +168,7 @@ CK_PKCS11_FUNCTION_INFO(C_CloseAllSessions)
#ifdef CK_NEED_ARG_LIST
(
CK_SLOT_ID slotID /* the token's slot */
);
);
#endif
/* C_GetSessionInfo obtains information about the session. */
@ -177,7 +177,7 @@ CK_PKCS11_FUNCTION_INFO(C_GetSessionInfo)
(
CK_SESSION_HANDLE hSession, /* the session's handle */
CK_SESSION_INFO_PTR pInfo /* receives session info */
);
);
#endif
/* C_GetOperationState obtains the state of the cryptographic operation
@ -188,7 +188,7 @@ CK_PKCS11_FUNCTION_INFO(C_GetOperationState)
CK_SESSION_HANDLE hSession, /* session's handle */
CK_BYTE_PTR pOperationState, /* gets state */
CK_ULONG_PTR pulOperationStateLen /* gets state length */
);
);
#endif
/* C_SetOperationState restores the state of the cryptographic
@ -201,7 +201,7 @@ CK_PKCS11_FUNCTION_INFO(C_SetOperationState)
CK_ULONG ulOperationStateLen, /* holds state length */
CK_OBJECT_HANDLE hEncryptionKey, /* en/decryption key */
CK_OBJECT_HANDLE hAuthenticationKey /* sign/verify key */
);
);
#endif
/* C_Login logs a user into a token. */
@ -212,7 +212,7 @@ CK_PKCS11_FUNCTION_INFO(C_Login)
CK_USER_TYPE userType, /* the user type */
CK_UTF8CHAR_PTR pPin, /* the user's PIN */
CK_ULONG ulPinLen /* the length of the PIN */
);
);
#endif
/* C_Logout logs a user out from a token. */
@ -220,7 +220,7 @@ CK_PKCS11_FUNCTION_INFO(C_Logout)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession /* the session's handle */
);
);
#endif
/* Object management */
@ -233,7 +233,7 @@ CK_PKCS11_FUNCTION_INFO(C_CreateObject)
CK_ATTRIBUTE_PTR pTemplate, /* the object's template */
CK_ULONG ulCount, /* attributes in template */
CK_OBJECT_HANDLE_PTR phObject /* gets new object's handle. */
);
);
#endif
/* C_CopyObject copies an object, creating a new object for the
@ -246,7 +246,7 @@ CK_PKCS11_FUNCTION_INFO(C_CopyObject)
CK_ATTRIBUTE_PTR pTemplate, /* template for new object */
CK_ULONG ulCount, /* attributes in template */
CK_OBJECT_HANDLE_PTR phNewObject /* receives handle of copy */
);
);
#endif
/* C_DestroyObject destroys an object. */
@ -255,7 +255,7 @@ CK_PKCS11_FUNCTION_INFO(C_DestroyObject)
(
CK_SESSION_HANDLE hSession, /* the session's handle */
CK_OBJECT_HANDLE hObject /* the object's handle */
);
);
#endif
/* C_GetObjectSize gets the size of an object in bytes. */
@ -265,7 +265,7 @@ CK_PKCS11_FUNCTION_INFO(C_GetObjectSize)
CK_SESSION_HANDLE hSession, /* the session's handle */
CK_OBJECT_HANDLE hObject, /* the object's handle */
CK_ULONG_PTR pulSize /* receives size of object */
);
);
#endif
/* C_GetAttributeValue obtains the value of one or more object
@ -277,7 +277,7 @@ CK_PKCS11_FUNCTION_INFO(C_GetAttributeValue)
CK_OBJECT_HANDLE hObject, /* the object's handle */
CK_ATTRIBUTE_PTR pTemplate, /* specifies attrs; gets vals */
CK_ULONG ulCount /* attributes in template */
);
);
#endif
/* C_SetAttributeValue modifies the value of one or more object
@ -289,7 +289,7 @@ CK_PKCS11_FUNCTION_INFO(C_SetAttributeValue)
CK_OBJECT_HANDLE hObject, /* the object's handle */
CK_ATTRIBUTE_PTR pTemplate, /* specifies attrs and values */
CK_ULONG ulCount /* attributes in template */
);
);
#endif
/* C_FindObjectsInit initializes a search for token and session
@ -300,7 +300,7 @@ CK_PKCS11_FUNCTION_INFO(C_FindObjectsInit)
CK_SESSION_HANDLE hSession, /* the session's handle */
CK_ATTRIBUTE_PTR pTemplate, /* attribute values to match */
CK_ULONG ulCount /* attrs in search template */
);
);
#endif
/* C_FindObjects continues a search for token and session
@ -313,7 +313,7 @@ CK_PKCS11_FUNCTION_INFO(C_FindObjects)
CK_OBJECT_HANDLE_PTR phObject, /* gets obj. handles */
CK_ULONG ulMaxObjectCount, /* max handles to get */
CK_ULONG_PTR pulObjectCount /* actual # returned */
);
);
#endif
/* C_FindObjectsFinal finishes a search for token and session
@ -322,7 +322,7 @@ CK_PKCS11_FUNCTION_INFO(C_FindObjectsFinal)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession /* the session's handle */
);
);
#endif
/* Encryption and decryption */
@ -334,7 +334,7 @@ CK_PKCS11_FUNCTION_INFO(C_EncryptInit)
CK_SESSION_HANDLE hSession, /* the session's handle */
CK_MECHANISM_PTR pMechanism, /* the encryption mechanism */
CK_OBJECT_HANDLE hKey /* handle of encryption key */
);
);
#endif
/* C_Encrypt encrypts single-part data. */
@ -346,7 +346,7 @@ CK_PKCS11_FUNCTION_INFO(C_Encrypt)
CK_ULONG ulDataLen, /* bytes of plaintext */
CK_BYTE_PTR pEncryptedData, /* gets ciphertext */
CK_ULONG_PTR pulEncryptedDataLen /* gets c-text size */
);
);
#endif
/* C_EncryptUpdate continues a multiple-part encryption
@ -359,7 +359,7 @@ CK_PKCS11_FUNCTION_INFO(C_EncryptUpdate)
CK_ULONG ulPartLen, /* plaintext data len */
CK_BYTE_PTR pEncryptedPart, /* gets ciphertext */
CK_ULONG_PTR pulEncryptedPartLen /* gets c-text size */
);
);
#endif
/* C_EncryptFinal finishes a multiple-part encryption
@ -370,7 +370,7 @@ CK_PKCS11_FUNCTION_INFO(C_EncryptFinal)
CK_SESSION_HANDLE hSession, /* session handle */
CK_BYTE_PTR pLastEncryptedPart, /* last c-text */
CK_ULONG_PTR pulLastEncryptedPartLen /* gets last size */
);
);
#endif
/* C_DecryptInit initializes a decryption operation. */
@ -380,7 +380,7 @@ CK_PKCS11_FUNCTION_INFO(C_DecryptInit)
CK_SESSION_HANDLE hSession, /* the session's handle */
CK_MECHANISM_PTR pMechanism, /* the decryption mechanism */
CK_OBJECT_HANDLE hKey /* handle of decryption key */
);
);
#endif
/* C_Decrypt decrypts encrypted data in a single part. */
@ -392,7 +392,7 @@ CK_PKCS11_FUNCTION_INFO(C_Decrypt)
CK_ULONG ulEncryptedDataLen, /* ciphertext length */
CK_BYTE_PTR pData, /* gets plaintext */
CK_ULONG_PTR pulDataLen /* gets p-text size */
);
);
#endif
/* C_DecryptUpdate continues a multiple-part decryption
@ -405,7 +405,7 @@ CK_PKCS11_FUNCTION_INFO(C_DecryptUpdate)
CK_ULONG ulEncryptedPartLen, /* input length */
CK_BYTE_PTR pPart, /* gets plaintext */
CK_ULONG_PTR pulPartLen /* p-text size */
);
);
#endif
/* C_DecryptFinal finishes a multiple-part decryption
@ -416,7 +416,7 @@ CK_PKCS11_FUNCTION_INFO(C_DecryptFinal)
CK_SESSION_HANDLE hSession, /* the session's handle */
CK_BYTE_PTR pLastPart, /* gets plaintext */
CK_ULONG_PTR pulLastPartLen /* p-text size */
);
);
#endif
/* Message digesting */
@ -427,7 +427,7 @@ CK_PKCS11_FUNCTION_INFO(C_DigestInit)
(
CK_SESSION_HANDLE hSession, /* the session's handle */
CK_MECHANISM_PTR pMechanism /* the digesting mechanism */
);
);
#endif
/* C_Digest digests data in a single part. */
@ -439,7 +439,7 @@ CK_PKCS11_FUNCTION_INFO(C_Digest)
CK_ULONG ulDataLen, /* bytes of data to digest */
CK_BYTE_PTR pDigest, /* gets the message digest */
CK_ULONG_PTR pulDigestLen /* gets digest length */
);
);
#endif
/* C_DigestUpdate continues a multiple-part message-digesting
@ -450,7 +450,7 @@ CK_PKCS11_FUNCTION_INFO(C_DigestUpdate)
CK_SESSION_HANDLE hSession, /* the session's handle */
CK_BYTE_PTR pPart, /* data to be digested */
CK_ULONG ulPartLen /* bytes of data to be digested */
);
);
#endif
/* C_DigestKey continues a multi-part message-digesting
@ -461,7 +461,7 @@ CK_PKCS11_FUNCTION_INFO(C_DigestKey)
(
CK_SESSION_HANDLE hSession, /* the session's handle */
CK_OBJECT_HANDLE hKey /* secret key to digest */
);
);
#endif
/* C_DigestFinal finishes a multiple-part message-digesting
@ -472,7 +472,7 @@ CK_PKCS11_FUNCTION_INFO(C_DigestFinal)
CK_SESSION_HANDLE hSession, /* the session's handle */
CK_BYTE_PTR pDigest, /* gets the message digest */
CK_ULONG_PTR pulDigestLen /* gets byte count of digest */
);
);
#endif
/* Signing and MACing */
@ -487,7 +487,7 @@ CK_PKCS11_FUNCTION_INFO(C_SignInit)
CK_SESSION_HANDLE hSession, /* the session's handle */
CK_MECHANISM_PTR pMechanism, /* the signature mechanism */
CK_OBJECT_HANDLE hKey /* handle of signature key */
);
);
#endif
/* C_Sign signs (encrypts with private key) data in a single
@ -501,7 +501,7 @@ CK_PKCS11_FUNCTION_INFO(C_Sign)
CK_ULONG ulDataLen, /* count of bytes to sign */
CK_BYTE_PTR pSignature, /* gets the signature */
CK_ULONG_PTR pulSignatureLen /* gets signature length */
);
);
#endif
/* C_SignUpdate continues a multiple-part signature operation,
@ -513,7 +513,7 @@ CK_PKCS11_FUNCTION_INFO(C_SignUpdate)
CK_SESSION_HANDLE hSession, /* the session's handle */
CK_BYTE_PTR pPart, /* the data to sign */
CK_ULONG ulPartLen /* count of bytes to sign */
);
);
#endif
/* C_SignFinal finishes a multiple-part signature operation,
@ -524,7 +524,7 @@ CK_PKCS11_FUNCTION_INFO(C_SignFinal)
CK_SESSION_HANDLE hSession, /* the session's handle */
CK_BYTE_PTR pSignature, /* gets the signature */
CK_ULONG_PTR pulSignatureLen /* gets signature length */
);
);
#endif
/* C_SignRecoverInit initializes a signature operation, where
@ -535,7 +535,7 @@ CK_PKCS11_FUNCTION_INFO(C_SignRecoverInit)
CK_SESSION_HANDLE hSession, /* the session's handle */
CK_MECHANISM_PTR pMechanism, /* the signature mechanism */
CK_OBJECT_HANDLE hKey /* handle of the signature key */
);
);
#endif
/* C_SignRecover signs data in a single operation, where the
@ -548,7 +548,7 @@ CK_PKCS11_FUNCTION_INFO(C_SignRecover)
CK_ULONG ulDataLen, /* count of bytes to sign */
CK_BYTE_PTR pSignature, /* gets the signature */
CK_ULONG_PTR pulSignatureLen /* gets signature length */
);
);
#endif
/* Verifying signatures and MACs */
@ -562,7 +562,7 @@ CK_PKCS11_FUNCTION_INFO(C_VerifyInit)
CK_SESSION_HANDLE hSession, /* the session's handle */
CK_MECHANISM_PTR pMechanism, /* the verification mechanism */
CK_OBJECT_HANDLE hKey /* verification key */
);
);
#endif
/* C_Verify verifies a signature in a single-part operation,
@ -576,7 +576,7 @@ CK_PKCS11_FUNCTION_INFO(C_Verify)
CK_ULONG ulDataLen, /* length of signed data */
CK_BYTE_PTR pSignature, /* signature */
CK_ULONG ulSignatureLen /* signature length*/
);
);
#endif
/* C_VerifyUpdate continues a multiple-part verification
@ -588,7 +588,7 @@ CK_PKCS11_FUNCTION_INFO(C_VerifyUpdate)
CK_SESSION_HANDLE hSession, /* the session's handle */
CK_BYTE_PTR pPart, /* signed data */
CK_ULONG ulPartLen /* length of signed data */
);
);
#endif
/* C_VerifyFinal finishes a multiple-part verification
@ -599,7 +599,7 @@ CK_PKCS11_FUNCTION_INFO(C_VerifyFinal)
CK_SESSION_HANDLE hSession, /* the session's handle */
CK_BYTE_PTR pSignature, /* signature to verify */
CK_ULONG ulSignatureLen /* signature length */
);
);
#endif
/* C_VerifyRecoverInit initializes a signature verification
@ -610,7 +610,7 @@ CK_PKCS11_FUNCTION_INFO(C_VerifyRecoverInit)
CK_SESSION_HANDLE hSession, /* the session's handle */
CK_MECHANISM_PTR pMechanism, /* the verification mechanism */
CK_OBJECT_HANDLE hKey /* verification key */
);
);
#endif
/* C_VerifyRecover verifies a signature in a single-part
@ -623,7 +623,7 @@ CK_PKCS11_FUNCTION_INFO(C_VerifyRecover)
CK_ULONG ulSignatureLen, /* signature length */
CK_BYTE_PTR pData, /* gets signed data */
CK_ULONG_PTR pulDataLen /* gets signed data len */
);
);
#endif
/* Dual-function cryptographic operations */
@ -638,7 +638,7 @@ CK_PKCS11_FUNCTION_INFO(C_DigestEncryptUpdate)
CK_ULONG ulPartLen, /* plaintext length */
CK_BYTE_PTR pEncryptedPart, /* gets ciphertext */
CK_ULONG_PTR pulEncryptedPartLen /* gets c-text length */
);
);
#endif
/* C_DecryptDigestUpdate continues a multiple-part decryption and
@ -651,7 +651,7 @@ CK_PKCS11_FUNCTION_INFO(C_DecryptDigestUpdate)
CK_ULONG ulEncryptedPartLen, /* ciphertext length */
CK_BYTE_PTR pPart, /* gets plaintext */
CK_ULONG_PTR pulPartLen /* gets plaintext len */
);
);
#endif
/* C_SignEncryptUpdate continues a multiple-part signing and
@ -664,7 +664,7 @@ CK_PKCS11_FUNCTION_INFO(C_SignEncryptUpdate)
CK_ULONG ulPartLen, /* plaintext length */
CK_BYTE_PTR pEncryptedPart, /* gets ciphertext */
CK_ULONG_PTR pulEncryptedPartLen /* gets c-text length */
);
);
#endif
/* C_DecryptVerifyUpdate continues a multiple-part decryption and
@ -677,7 +677,7 @@ CK_PKCS11_FUNCTION_INFO(C_DecryptVerifyUpdate)
CK_ULONG ulEncryptedPartLen, /* ciphertext length */
CK_BYTE_PTR pPart, /* gets plaintext */
CK_ULONG_PTR pulPartLen /* gets p-text length */
);
);
#endif
/* Key management */
@ -692,7 +692,7 @@ CK_PKCS11_FUNCTION_INFO(C_GenerateKey)
CK_ATTRIBUTE_PTR pTemplate, /* template for new key */
CK_ULONG ulCount, /* # of attrs in template */
CK_OBJECT_HANDLE_PTR phKey /* gets handle of new key */
);
);
#endif
/* C_GenerateKeyPair generates a public-key/private-key pair,
@ -708,7 +708,7 @@ CK_PKCS11_FUNCTION_INFO(C_GenerateKeyPair)
CK_ULONG ulPrivateKeyAttributeCount, /* # priv. attrs. */
CK_OBJECT_HANDLE_PTR phPublicKey, /* gets pub. key handle */
CK_OBJECT_HANDLE_PTR phPrivateKey /* gets priv. key handle */
);
);
#endif
/* C_WrapKey wraps (i.e., encrypts) a key. */
@ -721,7 +721,7 @@ CK_PKCS11_FUNCTION_INFO(C_WrapKey)
CK_OBJECT_HANDLE hKey, /* key to be wrapped */
CK_BYTE_PTR pWrappedKey, /* gets wrapped key */
CK_ULONG_PTR pulWrappedKeyLen /* gets wrapped key size */
);
);
#endif
/* C_UnwrapKey unwraps (decrypts) a wrapped key, creating a new
@ -737,7 +737,7 @@ CK_PKCS11_FUNCTION_INFO(C_UnwrapKey)
CK_ATTRIBUTE_PTR pTemplate, /* new key template */
CK_ULONG ulAttributeCount, /* template length */
CK_OBJECT_HANDLE_PTR phKey /* gets new handle */
);
);
#endif
/* C_DeriveKey derives a key from a base key, creating a new key
@ -751,7 +751,7 @@ CK_PKCS11_FUNCTION_INFO(C_DeriveKey)
CK_ATTRIBUTE_PTR pTemplate, /* new key template */
CK_ULONG ulAttributeCount, /* template length */
CK_OBJECT_HANDLE_PTR phKey /* gets new handle */
);
);
#endif
/* Random number generation */
@ -764,7 +764,7 @@ CK_PKCS11_FUNCTION_INFO(C_SeedRandom)
CK_SESSION_HANDLE hSession, /* the session's handle */
CK_BYTE_PTR pSeed, /* the seed material */
CK_ULONG ulSeedLen /* length of seed material */
);
);
#endif
/* C_GenerateRandom generates random data. */
@ -774,7 +774,7 @@ CK_PKCS11_FUNCTION_INFO(C_GenerateRandom)
CK_SESSION_HANDLE hSession, /* the session's handle */
CK_BYTE_PTR RandomData, /* receives the random data */
CK_ULONG ulRandomLen /* # of bytes to generate */
);
);
#endif
/* Parallel function management */
@ -786,7 +786,7 @@ CK_PKCS11_FUNCTION_INFO(C_GetFunctionStatus)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession /* the session's handle */
);
);
#endif
/* C_CancelFunction is a legacy function; it cancels a function
@ -795,7 +795,7 @@ CK_PKCS11_FUNCTION_INFO(C_CancelFunction)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession /* the session's handle */
);
);
#endif
/* Functions added in for PKCS #11 Version 2.01 or later */
@ -808,5 +808,237 @@ CK_PKCS11_FUNCTION_INFO(C_WaitForSlotEvent)
CK_FLAGS flags, /* blocking/nonblocking flag */
CK_SLOT_ID_PTR pSlot, /* location that receives the slot ID */
CK_VOID_PTR pRserved /* reserved. Should be NULL_PTR */
);
);
#endif
#if defined(CK_PKCS11_3_0) && !defined(CK_PKCS11_2_0_ONLY)
CK_PKCS11_FUNCTION_INFO(C_GetInterfaceList)
#ifdef CK_NEED_ARG_LIST
(
CK_INTERFACE_PTR interfaces,
CK_ULONG_PTR pulCount);
#endif
CK_PKCS11_FUNCTION_INFO(C_GetInterface)
#ifdef CK_NEED_ARG_LIST
(
CK_UTF8CHAR_PTR pInterfaceName,
CK_VERSION_PTR pVersion,
CK_INTERFACE_PTR_PTR ppInterface,
CK_FLAGS flags);
#endif
CK_PKCS11_FUNCTION_INFO(C_LoginUser)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession,
CK_USER_TYPE userType,
CK_CHAR_PTR pPin,
CK_ULONG ulPinLen,
CK_UTF8CHAR_PTR pUsername,
CK_ULONG ulUsernameLen);
#endif
CK_PKCS11_FUNCTION_INFO(C_SessionCancel)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession,
CK_FLAGS flags);
#endif
CK_PKCS11_FUNCTION_INFO(C_MessageEncryptInit)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession,
CK_MECHANISM_PTR pMechanism,
CK_OBJECT_HANDLE hKey);
#endif
CK_PKCS11_FUNCTION_INFO(C_EncryptMessage)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession,
CK_VOID_PTR pParameter,
CK_ULONG ulParameterLen,
CK_BYTE_PTR pAssociatedData,
CK_ULONG ulAssociatedDataLen,
CK_BYTE_PTR pPlaintext,
CK_ULONG ulPlaintextLen,
CK_BYTE_PTR pCiphertext,
CK_ULONG_PTR pulCiphertextLen);
#endif
CK_PKCS11_FUNCTION_INFO(C_EncryptMessageBegin)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession,
CK_VOID_PTR pParameter,
CK_ULONG ulParameterLen,
CK_BYTE_PTR pAssociatedData,
CK_ULONG ulAssociatedDataLen);
#endif
CK_PKCS11_FUNCTION_INFO(C_EncryptMessageNext)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession,
CK_VOID_PTR pParameter,
CK_ULONG ulParameterLen,
CK_BYTE_PTR pPlaintextPart,
CK_ULONG ulPlaintextPartLen,
CK_BYTE_PTR pCiphertextPart,
CK_ULONG_PTR pulCiphertextPartLen,
CK_FLAGS flags);
#endif
CK_PKCS11_FUNCTION_INFO(C_MessageEncryptFinal)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession);
#endif
CK_PKCS11_FUNCTION_INFO(C_MessageDecryptInit)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession,
CK_MECHANISM_PTR pMechanism,
CK_OBJECT_HANDLE hKey);
#endif
CK_PKCS11_FUNCTION_INFO(C_DecryptMessage)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession,
CK_VOID_PTR pParameter,
CK_ULONG ulParameterLen,
CK_BYTE_PTR pAssociatedData,
CK_ULONG ulAssociatedDataLen,
CK_BYTE_PTR pCiphertext,
CK_ULONG ulCiphertextLen,
CK_BYTE_PTR pPlaintext,
CK_ULONG_PTR pulPlaintextLen);
#endif
CK_PKCS11_FUNCTION_INFO(C_DecryptMessageBegin)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession,
CK_VOID_PTR pParameter,
CK_ULONG ulParameterLen,
CK_BYTE_PTR pAssociatedData,
CK_ULONG ulAssociatedDataLen);
#endif
CK_PKCS11_FUNCTION_INFO(C_DecryptMessageNext)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession,
CK_VOID_PTR pParameter,
CK_ULONG ulParameterLen,
CK_BYTE_PTR pCiphertextPart,
CK_ULONG ulCiphertextPartLen,
CK_BYTE_PTR pPlaintextPart,
CK_ULONG_PTR pulPlaintextPartLen,
CK_FLAGS flags);
#endif
CK_PKCS11_FUNCTION_INFO(C_MessageDecryptFinal)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession);
#endif
CK_PKCS11_FUNCTION_INFO(C_MessageSignInit)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession,
CK_MECHANISM_PTR pMechanism,
CK_OBJECT_HANDLE hKey);
#endif
CK_PKCS11_FUNCTION_INFO(C_SignMessage)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession,
CK_VOID_PTR pParameter,
CK_ULONG ulParameterLen,
CK_BYTE_PTR pData,
CK_ULONG ulDataLen,
CK_BYTE_PTR pSignature,
CK_ULONG_PTR pulSignatureLen);
#endif
CK_PKCS11_FUNCTION_INFO(C_SignMessageBegin)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession,
CK_VOID_PTR pParameter,
CK_ULONG ulParameterLen);
#endif
CK_PKCS11_FUNCTION_INFO(C_SignMessageNext)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession,
CK_VOID_PTR pParameter,
CK_ULONG ulParameterLen,
CK_BYTE_PTR pData,
CK_ULONG ulDataLen,
CK_BYTE_PTR pSignature,
CK_ULONG_PTR pulSignatureLen);
#endif
CK_PKCS11_FUNCTION_INFO(C_MessageSignFinal)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession);
#endif
CK_PKCS11_FUNCTION_INFO(C_MessageVerifyInit)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession,
CK_MECHANISM_PTR pMechanism,
CK_OBJECT_HANDLE hKey);
#endif
CK_PKCS11_FUNCTION_INFO(C_VerifyMessage)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession,
CK_VOID_PTR pParameter,
CK_ULONG ulParameterLen,
CK_BYTE_PTR pData,
CK_ULONG ulDataLen,
CK_BYTE_PTR pSignature,
CK_ULONG ulSignatureLen);
#endif
CK_PKCS11_FUNCTION_INFO(C_VerifyMessageBegin)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession,
CK_VOID_PTR pParameter,
CK_ULONG ulParameterLen);
#endif
CK_PKCS11_FUNCTION_INFO(C_VerifyMessageNext)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession,
CK_VOID_PTR pParameter,
CK_ULONG ulParameterLen,
CK_BYTE_PTR pData,
CK_ULONG ulDataLen,
CK_BYTE_PTR pSignature,
CK_ULONG ulSignatureLen);
#endif
CK_PKCS11_FUNCTION_INFO(C_MessageVerifyFinal)
#ifdef CK_NEED_ARG_LIST
(
CK_SESSION_HANDLE hSession);
#endif
#endif

216
security/nss/lib/util/pkcs11n.h
View file

@ -38,6 +38,9 @@
#define CKO_NSS_BUILTIN_ROOT_LIST (CKO_NSS + 4)
#define CKO_NSS_NEWSLOT (CKO_NSS + 5)
#define CKO_NSS_DELSLOT (CKO_NSS + 6)
#define CKO_NSS_VALIDATION (CKO_NSS + 7)
#define CKV_NSS_FIPS_140 (CKO_NSS + 1)
/*
* NSS-defined key types
@ -60,6 +63,8 @@
/* FAKE PKCS #11 defines */
#define CKA_DIGEST 0x81000000L
#define CKA_NSS_MESSAGE 0x82000000L
#define CKA_NSS_MESSAGE_MASK 0xff000000L
#define CKA_FLAGS_ONLY 0 /* CKA_CLASS */
/*
@ -97,6 +102,11 @@
#define CKA_NSS_SERVER_DISTRUST_AFTER (CKA_NSS + 35)
#define CKA_NSS_EMAIL_DISTRUST_AFTER (CKA_NSS + 36)
#define CKA_NSS_VALIDATION_TYPE (CKA_NSS + 36)
#define CKA_NSS_VALIDATION_VERSION (CKA_NSS + 37)
#define CKA_NSS_VALIDATION_LEVEL (CKA_NSS + 38)
#define CKA_NSS_VALIDATION_MODULE_ID (CKA_NSS + 39)
/*
* Trust attributes:
*
@ -132,12 +142,13 @@
/* NSS trust stuff */
/* HISTORICAL: define used to pass in the database key for DSA private keys */
#define CKA_NETSCAPE_DB 0xD5A0DB00L
#define CKA_NETSCAPE_TRUST 0x80000001L
#define CKA_NSS_DB 0xD5A0DB00L
#define CKA_NSS_TRUST 0x80000001L
/* FAKE PKCS #11 defines */
#define CKM_FAKE_RANDOM 0x80000efeUL
#define CKM_INVALID_MECHANISM 0xffffffffUL
#define CKT_INVALID_TYPE 0xffffffffUL
/*
* NSS-defined crypto mechanisms
@ -242,25 +253,40 @@
#define CKM_NSS_PUB_FROM_PRIV (CKM_NSS + 40)
/* SP800-108 NSS mechanism with support for data object derivation */
#define CKM_NSS_SP800_108_COUNTER_KDF_DERIVE_DATA (CKM_NSS + 42)
#define CKM_NSS_SP800_108_FEEDBACK_KDF_DERIVE_DATA (CKM_NSS + 43)
#define CKM_NSS_SP800_108_DOUBLE_PIPELINE_KDF_DERIVE_DATA (CKM_NSS + 44)
/*
* HISTORICAL:
* Do not attempt to use these. They are only used by NETSCAPE's internal
* Do not attempt to use these. They are only used by NSS's internal
* PKCS #11 interface. Most of these are place holders for other mechanism
* and will change in the future.
*/
#define CKM_NETSCAPE_PBE_SHA1_DES_CBC 0x80000002UL
#define CKM_NETSCAPE_PBE_SHA1_TRIPLE_DES_CBC 0x80000003UL
#define CKM_NETSCAPE_PBE_SHA1_40_BIT_RC2_CBC 0x80000004UL
#define CKM_NETSCAPE_PBE_SHA1_128_BIT_RC2_CBC 0x80000005UL
#define CKM_NETSCAPE_PBE_SHA1_40_BIT_RC4 0x80000006UL
#define CKM_NETSCAPE_PBE_SHA1_128_BIT_RC4 0x80000007UL
#define CKM_NETSCAPE_PBE_SHA1_FAULTY_3DES_CBC 0x80000008UL
#define CKM_NETSCAPE_PBE_SHA1_HMAC_KEY_GEN 0x80000009UL
#define CKM_NETSCAPE_PBE_MD5_HMAC_KEY_GEN 0x8000000aUL
#define CKM_NETSCAPE_PBE_MD2_HMAC_KEY_GEN 0x8000000bUL
#define CKM_NSS_PBE_SHA1_DES_CBC 0x80000002UL
#define CKM_NSS_PBE_SHA1_TRIPLE_DES_CBC 0x80000003UL
#define CKM_NSS_PBE_SHA1_40_BIT_RC2_CBC 0x80000004UL
#define CKM_NSS_PBE_SHA1_128_BIT_RC2_CBC 0x80000005UL
#define CKM_NSS_PBE_SHA1_40_BIT_RC4 0x80000006UL
#define CKM_NSS_PBE_SHA1_128_BIT_RC4 0x80000007UL
#define CKM_NSS_PBE_SHA1_FAULTY_3DES_CBC 0x80000008UL
#define CKM_NSS_PBE_SHA1_HMAC_KEY_GEN 0x80000009UL
#define CKM_NSS_PBE_MD5_HMAC_KEY_GEN 0x8000000aUL
#define CKM_NSS_PBE_MD2_HMAC_KEY_GEN 0x8000000bUL
#define CKM_TLS_PRF_GENERAL 0x80000373UL
/* FIPS Indicator defines */
#define CKS_NSS_UNINITIALIZED 0xffffffffUL
#define CKS_NSS_FIPS_NOT_OK 0UL
#define CKS_NSS_FIPS_OK 1UL
#define CKT_NSS_SESSION_CHECK 1UL
#define CKT_NSS_OBJECT_CHECK 2UL
#define CKT_NSS_BOTH_CHECK 3UL
#define CKT_NSS_SESSION_LAST_CHECK 4UL
typedef struct CK_NSS_JPAKEPublicValue {
CK_BYTE *pGX;
CK_ULONG ulGXLen;
@ -326,6 +352,9 @@ typedef struct CK_NSS_AEAD_PARAMS {
#define CKR_NSS_CERTDB_FAILED (CKR_NSS + 1)
#define CKR_NSS_KEYDB_FAILED (CKR_NSS + 2)
/* NSS specific types */
typedef CK_ULONG CK_NSS_VALIDATION_TYPE;
/* Mandatory parameter for the CKM_NSS_HKDF_* key deriviation mechanisms.
See RFC 5869.
@ -419,6 +448,28 @@ typedef struct CK_NSS_IKE1_PRF_DERIVE_PARAMS {
CK_BYTE keyNumber;
} CK_NSS_IKE1_PRF_DERIVE_PARAMS;
/* CK_NSS_IKE1_APP_B_PRF_DERIVE_PARAMS is a structure that provides the
* parameters to the CKM_NSS_IKE_APP_B_PRF_DERIVE mechanism.
*
* The fields of the structure have the following meanings:
* prfMechanism underlying MAC mechanism used to generate the prf.
* bHasKeygxy hKeygxy exists
* hKeygxy optional key to hash in the prf
* pExtraData optional extra data to hash in the prf
* ulExtraData length of the optional extra data.
*
* CK_NSS_IKE_APP_B_PRF_DERIVE can take wither CK_NSS_IKE1_APP_B_PRF_DRIVE_PARAMS
* or a single CK_MECHANISM_TYPE. In the latter cases bHashKeygx is assumed to
* be false and ulExtraDataLen is assumed to be '0'.
*/
typedef struct CK_NSS_IKE1_APP_B_PRF_DERIVE_PARAMS {
CK_MECHANISM_TYPE prfMechanism;
CK_BBOOL bHasKeygxy;
CK_OBJECT_HANDLE hKeygxy;
CK_BYTE_PTR pExtraData;
CK_ULONG ulExtraDataLen;
} CK_NSS_IKE1_APP_B_PRF_DERIVE_PARAMS;
/*
* Parameter for the TLS extended master secret key derivation mechanisms:
*
@ -525,44 +576,9 @@ typedef CK_TRUST __CKT_NSS_MUST_VERIFY __attribute__((deprecated("CKT_NSS_MUST_V
#define CKT_NSS_MUST_VERIFY (CKT_NSS + 4) /*really means trust unknown*/
#endif
/* don't leave old programs in a lurch just yet, give them the old NETSCAPE
* synonym */
#define CKO_NETSCAPE_CRL CKO_NSS_CRL
#define CKO_NETSCAPE_SMIME CKO_NSS_SMIME
#define CKO_NETSCAPE_TRUST CKO_NSS_TRUST
#define CKO_NETSCAPE_BUILTIN_ROOT_LIST CKO_NSS_BUILTIN_ROOT_LIST
#define CKO_NETSCAPE_NEWSLOT CKO_NSS_NEWSLOT
#define CKO_NETSCAPE_DELSLOT CKO_NSS_DELSLOT
#define CKK_NETSCAPE_PKCS8 CKK_NSS_PKCS8
#define CKA_NETSCAPE_URL CKA_NSS_URL
#define CKA_NETSCAPE_EMAIL CKA_NSS_EMAIL
#define CKA_NETSCAPE_SMIME_INFO CKA_NSS_SMIME_INFO
#define CKA_NETSCAPE_SMIME_TIMESTAMP CKA_NSS_SMIME_TIMESTAMP
#define CKA_NETSCAPE_PKCS8_SALT CKA_NSS_PKCS8_SALT
#define CKA_NETSCAPE_PASSWORD_CHECK CKA_NSS_PASSWORD_CHECK
#define CKA_NETSCAPE_EXPIRES CKA_NSS_EXPIRES
#define CKA_NETSCAPE_KRL CKA_NSS_KRL
#define CKA_NETSCAPE_PQG_COUNTER CKA_NSS_PQG_COUNTER
#define CKA_NETSCAPE_PQG_SEED CKA_NSS_PQG_SEED
#define CKA_NETSCAPE_PQG_H CKA_NSS_PQG_H
#define CKA_NETSCAPE_PQG_SEED_BITS CKA_NSS_PQG_SEED_BITS
#define CKA_NETSCAPE_MODULE_SPEC CKA_NSS_MODULE_SPEC
#define CKM_NETSCAPE_AES_KEY_WRAP CKM_NSS_AES_KEY_WRAP
#define CKM_NETSCAPE_AES_KEY_WRAP_PAD CKM_NSS_AES_KEY_WRAP_PAD
#define CKR_NETSCAPE_CERTDB_FAILED CKR_NSS_CERTDB_FAILED
#define CKR_NETSCAPE_KEYDB_FAILED CKR_NSS_KEYDB_FAILED
#define CKT_NETSCAPE_TRUSTED CKT_NSS_TRUSTED
#define CKT_NETSCAPE_TRUSTED_DELEGATOR CKT_NSS_TRUSTED_DELEGATOR
#define CKT_NETSCAPE_UNTRUSTED CKT_NSS_UNTRUSTED
#define CKT_NETSCAPE_MUST_VERIFY CKT_NSS_MUST_VERIFY
#define CKT_NETSCAPE_TRUST_UNKNOWN CKT_NSS_TRUST_UNKNOWN
#define CKT_NETSCAPE_VALID CKT_NSS_VALID
#define CKT_NETSCAPE_VALID_DELEGATOR CKT_NSS_VALID_DELEGATOR
/*
* These are not really PKCS #11 values specifically. They are the 'loadable'
* module spec NSS uses. The are available for others to use as well, but not
* module spec NSS uses. They are available for others to use as well, but not
* part of the formal PKCS #11 spec.
*
* The function 'FIND' returns an array of PKCS #11 initialization strings
@ -584,4 +600,106 @@ typedef char **(PR_CALLBACK *SECMODModuleDBFunc)(unsigned long function,
#define SFTK_MIN_FIPS_USER_SLOT_ID 101
#define SFTK_MAX_FIPS_USER_SLOT_ID 127
/* Module Interface. This is the old NSS private module interface, now exported
* as a PKCS #11 v3 interface. It's interface name is
* "Vendor NSS Module Interface" */
typedef char **(*CK_NSS_ModuleDBFunc)(unsigned long function,
char *parameters, void *args);
typedef struct CK_NSS_MODULE_FUNCTIONS {
CK_VERSION version;
CK_NSS_ModuleDBFunc NSC_ModuleDBFunc;
} CK_NSS_MODULE_FUNCTIONS;
/* FIPS Indicator Interface. This may move to the normal PKCS #11 table
* in the future. For now it's called "Vendor NSS FIPS Interface" */
typedef CK_RV (*CK_NSS_GetFIPSStatus)(CK_SESSION_HANDLE hSession,
CK_OBJECT_HANDLE hObject,
CK_ULONG ulOperationType,
CK_ULONG *pulFIPSStatus);
typedef struct CK_NSS_FIPS_FUNCTIONS {
CK_VERSION version;
CK_NSS_GetFIPSStatus NSC_NSSGetFIPSStatus;
} CK_NSS_FIPS_FUNCTIONS;
/* There was an inconsistency between the spec and the header file in defining
* the CK_GCM_PARAMS structure. The authoritative reference is the header file,
* but NSS used the spec when adding it to its own header. In V3 we've
* corrected it, but we need to handle the old case for devices that followed
* us in using the incorrect specification. */
typedef struct CK_NSS_GCM_PARAMS {
CK_BYTE_PTR pIv;
CK_ULONG ulIvLen;
CK_BYTE_PTR pAAD;
CK_ULONG ulAADLen;
CK_ULONG ulTagBits;
} CK_NSS_GCM_PARAMS;
typedef CK_NSS_GCM_PARAMS CK_PTR CK_NSS_GCM_PARAMS_PTR;
/* deprecated #defines. Drop in future NSS releases */
#ifdef NSS_PKCS11_2_0_COMPAT
/* defines that were changed between NSS's PKCS #11 and the Oasis headers */
#define CKF_EC_FP CKF_EC_F_P
#define CKO_KG_PARAMETERS CKO_DOMAIN_PARAMETERS
#define CK_INVALID_SESSION CK_INVALID_HANDLE
#define CKR_KEY_PARAMS_INVALID 0x0000006B
/* use the old wrong CK_GCM_PARAMS if NSS_PCKS11_2_0_COMPAT is defined */
typedef struct CK_NSS_GCM_PARAMS CK_GCM_PARAMS;
typedef CK_NSS_GCM_PARAMS CK_PTR CK_GCM_PARAMS_PTR;
/* don't leave old programs in a lurch just yet, give them the old NETSCAPE
* synonym if NSS_PKCS11_2_0_COMPAT is defined*/
#define CKO_NETSCAPE_CRL CKO_NSS_CRL
#define CKO_NETSCAPE_SMIME CKO_NSS_SMIME
#define CKO_NETSCAPE_TRUST CKO_NSS_TRUST
#define CKO_NETSCAPE_BUILTIN_ROOT_LIST CKO_NSS_BUILTIN_ROOT_LIST
#define CKO_NETSCAPE_NEWSLOT CKO_NSS_NEWSLOT
#define CKO_NETSCAPE_DELSLOT CKO_NSS_DELSLOT
#define CKK_NETSCAPE_PKCS8 CKK_NSS_PKCS8
#define CKA_NETSCAPE_URL CKA_NSS_URL
#define CKA_NETSCAPE_EMAIL CKA_NSS_EMAIL
#define CKA_NETSCAPE_SMIME_INFO CKA_NSS_SMIME_INFO
#define CKA_NETSCAPE_SMIME_TIMESTAMP CKA_NSS_SMIME_TIMESTAMP
#define CKA_NETSCAPE_PKCS8_SALT CKA_NSS_PKCS8_SALT
#define CKA_NETSCAPE_PASSWORD_CHECK CKA_NSS_PASSWORD_CHECK
#define CKA_NETSCAPE_EXPIRES CKA_NSS_EXPIRES
#define CKA_NETSCAPE_KRL CKA_NSS_KRL
#define CKA_NETSCAPE_PQG_COUNTER CKA_NSS_PQG_COUNTER
#define CKA_NETSCAPE_PQG_SEED CKA_NSS_PQG_SEED
#define CKA_NETSCAPE_PQG_H CKA_NSS_PQG_H
#define CKA_NETSCAPE_PQG_SEED_BITS CKA_NSS_PQG_SEED_BITS
#define CKA_NETSCAPE_MODULE_SPEC CKA_NSS_MODULE_SPEC
#define CKA_NETSCAPE_DB CKA_NSS_DB
#define CKA_NETSCAPE_TRUST CKA_NSS_TRUST
#define CKM_NETSCAPE_AES_KEY_WRAP CKM_NSS_AES_KEY_WRAP
#define CKM_NETSCAPE_AES_KEY_WRAP_PAD CKM_NSS_AES_KEY_WRAP_PAD
#define CKM_NETSCAPE_PBE_SHA1_DES_CBC CKM_NSS_PBE_SHA1_DES_CBC
#define CKM_NETSCAPE_PBE_SHA1_TRIPLE_DES_CBC CKM_NSS_PBE_SHA1_TRIPLE_DES_CBC
#define CKM_NETSCAPE_PBE_SHA1_40_BIT_RC2_CBC CKM_NSS_PBE_SHA1_40_BIT_RC2_CBC
#define CKM_NETSCAPE_PBE_SHA1_128_BIT_RC2_CBC CKM_NSS_PBE_SHA1_128_BIT_RC2_CBC
#define CKM_NETSCAPE_PBE_SHA1_40_BIT_RC4 CKM_NSS_PBE_SHA1_40_BIT_RC4
#define CKM_NETSCAPE_PBE_SHA1_128_BIT_RC4 CKM_NSS_PBE_SHA1_128_BIT_RC4
#define CKM_NETSCAPE_PBE_SHA1_FAULTY_3DES_CBC CKM_NSS_PBE_SHA1_FAULTY_3DES_CBC
#define CKM_NETSCAPE_PBE_SHA1_HMAC_KEY_GEN CKM_NSS_PBE_SHA1_HMAC_KEY_GEN
#define CKM_NETSCAPE_PBE_MD5_HMAC_KEY_GEN CKM_NSS_PBE_MD5_HMAC_KEY_GEN
#define CKM_NETSCAPE_PBE_MD2_HMAC_KEY_GEN CKM_NSS_PBE_MD2_HMAC_KEY_GEN
#define CKR_NETSCAPE_CERTDB_FAILED CKR_NSS_CERTDB_FAILED
#define CKR_NETSCAPE_KEYDB_FAILED CKR_NSS_KEYDB_FAILED
#define CKT_NETSCAPE_TRUSTED CKT_NSS_TRUSTED
#define CKT_NETSCAPE_TRUSTED_DELEGATOR CKT_NSS_TRUSTED_DELEGATOR
#define CKT_NETSCAPE_UNTRUSTED CKT_NSS_UNTRUSTED
#define CKT_NETSCAPE_MUST_VERIFY CKT_NSS_MUST_VERIFY
#define CKT_NETSCAPE_TRUST_UNKNOWN CKT_NSS_TRUST_UNKNOWN
#define CKT_NETSCAPE_VALID CKT_NSS_VALID
#define CKT_NETSCAPE_VALID_DELEGATOR CKT_NSS_VALID_DELEGATOR
#else
/* use the new CK_GCM_PARAMS if NSS_PKCS11_2_0_COMPAT is not defined */
typedef struct CK_GCM_PARAMS_V3 CK_GCM_PARAMS;
typedef CK_GCM_PARAMS_V3 CK_PTR CK_GCM_PARAMS_PTR;
#endif
#endif /* _PKCS11N_H_ */

1929
security/nss/lib/util/pkcs11t.h
View file

File diff suppressed because it is too large Load diff

92
security/nss/lib/util/pkcs11uri.c
View file

@ -47,7 +47,7 @@ static const char *qattr_names[] = {
struct PK11URIBufferStr {
PLArenaPool *arena;
char *data;
unsigned char *data;
size_t size;
size_t allocated;
};
@ -55,7 +55,7 @@ typedef struct PK11URIBufferStr PK11URIBuffer;
struct PK11URIAttributeListEntryStr {
char *name;
char *value;
SECItem value;
};
typedef struct PK11URIAttributeListEntryStr PK11URIAttributeListEntry;
@ -133,11 +133,11 @@ pk11uri_DestroyBuffer(PK11URIBuffer *buffer)
/* URI encoding functions. */
static char *
pk11uri_Escape(PLArenaPool *arena, const char *value, size_t length,
pk11uri_Escape(PLArenaPool *arena, const unsigned char *value, size_t length,
const char *available)
{
PK11URIBuffer buffer;
const char *p;
const unsigned char *p;
unsigned char buf[4];
char *result = NULL;
SECStatus ret;
@ -154,7 +154,7 @@ pk11uri_Escape(PLArenaPool *arena, const char *value, size_t length,
goto fail;
}
} else {
ret = pk11uri_AppendBuffer(&buffer, (const unsigned char *)p, 1);
ret = pk11uri_AppendBuffer(&buffer, p, 1);
if (ret != SECSuccess) {
goto fail;
}
@ -167,7 +167,7 @@ pk11uri_Escape(PLArenaPool *arena, const char *value, size_t length,
}
/* Steal the memory allocated in buffer. */
result = buffer.data;
result = (char *)buffer.data;
buffer.data = NULL;
fail:
@ -176,18 +176,18 @@ fail:
return result;
}
static char *
pk11uri_Unescape(PLArenaPool *arena, const char *value, size_t length)
static unsigned char *
pk11uri_Unescape(PLArenaPool *arena, const char *value, size_t *length)
{
PK11URIBuffer buffer;
const char *p;
unsigned char buf[1];
char *result = NULL;
unsigned char *result = NULL;
SECStatus ret;
pk11uri_InitBuffer(&buffer, arena);
for (p = value; p < value + length; p++) {
for (p = value; p < value + *length; p++) {
if (*p == '%') {
int c;
size_t i;
@ -218,6 +218,7 @@ pk11uri_Unescape(PLArenaPool *arena, const char *value, size_t length)
goto fail;
}
}
*length = buffer.size;
buf[0] = '\0';
ret = pk11uri_AppendBuffer(&buffer, buf, 1);
if (ret != SECSuccess) {
@ -277,7 +278,7 @@ pk11uri_CompareQueryAttributeName(const char *a, const char *b)
static SECStatus
pk11uri_InsertToAttributeList(PK11URIAttributeList *attrs,
char *name, char *value,
char *name, unsigned char *value, size_t size,
PK11URIAttributeCompareNameFunc compare_name,
PRBool allow_duplicate)
{
@ -309,7 +310,9 @@ pk11uri_InsertToAttributeList(PK11URIAttributeList *attrs,
}
attrs->attrs[i].name = name;
attrs->attrs[i].value = value;
attrs->attrs[i].value.type = siBuffer;
attrs->attrs[i].value.data = value;
attrs->attrs[i].value.len = size;
attrs->num_attrs++;
@ -323,7 +326,8 @@ pk11uri_InsertToAttributeListEscaped(PK11URIAttributeList *attrs,
PK11URIAttributeCompareNameFunc compare_name,
PRBool allow_duplicate)
{
char *name_copy = NULL, *value_copy = NULL;
char *name_copy = NULL;
unsigned char *value_copy = NULL;
SECStatus ret;
if (attrs->arena) {
@ -337,13 +341,13 @@ pk11uri_InsertToAttributeListEscaped(PK11URIAttributeList *attrs,
memcpy(name_copy, name, name_size);
name_copy[name_size] = '\0';
value_copy = pk11uri_Unescape(attrs->arena, value, value_size);
value_copy = pk11uri_Unescape(attrs->arena, value, &value_size);
if (value_copy == NULL) {
goto fail;
}
ret = pk11uri_InsertToAttributeList(attrs, name_copy, value_copy, compare_name,
allow_duplicate);
ret = pk11uri_InsertToAttributeList(attrs, name_copy, value_copy, value_size,
compare_name, allow_duplicate);
if (ret != SECSuccess) {
goto fail;
}
@ -374,7 +378,7 @@ pk11uri_DestroyAttributeList(PK11URIAttributeList *attrs)
for (i = 0; i < attrs->num_attrs; i++) {
PORT_Free(attrs->attrs[i].name);
PORT_Free(attrs->attrs[i].value);
PORT_Free(attrs->attrs[i].value.data);
}
PORT_Free(attrs->attrs);
}
@ -414,7 +418,7 @@ pk11uri_AppendAttributeListToBuffer(PK11URIBuffer *buffer,
return ret;
}
escaped = pk11uri_Escape(buffer->arena, attr->value, strlen(attr->value),
escaped = pk11uri_Escape(buffer->arena, attr->value.data, attr->value.len,
unescaped);
if (escaped == NULL) {
return ret;
@ -510,7 +514,9 @@ pk11uri_InsertAttributes(PK11URIAttributeList *dest_attrs,
if (j < num_attr_names) {
/* Named attribute. */
ret = pk11uri_InsertToAttributeList(dest_attrs,
name, value,
name,
(unsigned char *)value,
strlen(value),
compare_name,
allow_duplicate);
if (ret != SECSuccess) {
@ -519,7 +525,9 @@ pk11uri_InsertAttributes(PK11URIAttributeList *dest_attrs,
} else {
/* Vendor attribute. */
ret = pk11uri_InsertToAttributeList(dest_vattrs,
name, value,
name,
(unsigned char *)value,
strlen(value),
strcmp,
vendor_allow_duplicate);
if (ret != SECSuccess) {
@ -616,9 +624,9 @@ pk11uri_ParseAttributes(const char **string,
}
if (*p == '%') {
const char ch2 = *++p;
if (strchr(PK11URI_HEXDIG, ch2) != NULL) {
if (ch2 != '\0' && strchr(PK11URI_HEXDIG, ch2) != NULL) {
const char ch3 = *++p;
if (strchr(PK11URI_HEXDIG, ch3) != NULL)
if (ch3 != '\0' && strchr(PK11URI_HEXDIG, ch3) != NULL)
continue;
}
}
@ -777,7 +785,7 @@ PK11URI_FormatURI(PLArenaPool *arena, PK11URI *uri)
goto fail;
}
result = buffer.data;
result = (char *)buffer.data;
buffer.data = NULL;
fail:
@ -798,7 +806,7 @@ PK11URI_DestroyURI(PK11URI *uri)
}
/* Accessors. */
static const char *
static const SECItem *
pk11uri_GetAttribute(PK11URIAttributeList *attrs,
PK11URIAttributeList *vattrs,
const char *name)
@ -807,27 +815,53 @@ pk11uri_GetAttribute(PK11URIAttributeList *attrs,
for (i = 0; i < attrs->num_attrs; i++) {
if (strcmp(name, attrs->attrs[i].name) == 0) {
return attrs->attrs[i].value;
return &attrs->attrs[i].value;
}
}
for (i = 0; i < vattrs->num_attrs; i++) {
if (strcmp(name, vattrs->attrs[i].name) == 0) {
return vattrs->attrs[i].value;
return &vattrs->attrs[i].value;
}
}
return NULL;
}
const char *
PK11URI_GetPathAttribute(PK11URI *uri, const char *name)
const SECItem *
PK11URI_GetPathAttributeItem(PK11URI *uri, const char *name)
{
return pk11uri_GetAttribute(&uri->pattrs, &uri->vpattrs, name);
}
const char *
PK11URI_GetQueryAttribute(PK11URI *uri, const char *name)
PK11URI_GetPathAttribute(PK11URI *uri, const char *name)
{
const SECItem *value;
value = PK11URI_GetPathAttributeItem(uri, name);
if (!value) {
return NULL;
}
return (const char *)value->data;
}
const SECItem *
PK11URI_GetQueryAttributeItem(PK11URI *uri, const char *name)
{
return pk11uri_GetAttribute(&uri->qattrs, &uri->vqattrs, name);
}
const char *
PK11URI_GetQueryAttribute(PK11URI *uri, const char *name)
{
const SECItem *value;
value = PK11URI_GetQueryAttributeItem(uri, name);
if (!value) {
return NULL;
}
return (const char *)value->data;
}

17
security/nss/lib/util/pkcs11uri.h
View file

@ -56,12 +56,25 @@ extern char *PK11URI_FormatURI(PLArenaPool *arena, PK11URI *uri);
/* Destroy a PK11URI object. */
extern void PK11URI_DestroyURI(PK11URI *uri);
/* Retrieve a path attribute with the given name. */
/* Retrieve a path attribute with the given name. This function can be used only
* when we can assume that the attribute value is a string (such as "label" or
* "type"). If it can be a binary blob (such as "id"), use
* PK11URI_GetPathAttributeItem.
*/
extern const char *PK11URI_GetPathAttribute(PK11URI *uri, const char *name);
/* Retrieve a query attribute with the given name. */
/* Retrieve a query attribute with the given name. This function can be used
* only when we can assume that the attribute value is a string (such as
* "module-name"). If it can be a binary blob, use
* PK11URI_GetQueryAttributeItem.*/
extern const char *PK11URI_GetQueryAttribute(PK11URI *uri, const char *name);
/* Retrieve a path attribute with the given name as a SECItem. */
extern const SECItem *PK11URI_GetPathAttributeItem(PK11URI *uri, const char *name);
/* Retrieve a query attribute with the given name as a SECItem. */
extern const SECItem *PK11URI_GetQueryAttributeItem(PK11URI *uri, const char *name);
SEC_END_PROTOS
#endif /* _PKCS11URI_H_ */

27
security/nss/lib/util/quickder.c
View file

@ -92,6 +92,11 @@ definite_length_decoder(const unsigned char* buf,
}
}
if ((tag & SEC_ASN1_TAGNUM_MASK) == SEC_ASN1_NULL && data_length != 0) {
/* The DER encoding of NULL has no contents octets */
return NULL;
}
if (data_length > (buf_length - used_length)) {
/* The decoded length exceeds the available buffer */
return NULL;
@ -517,11 +522,18 @@ DecodeGroup(void* dest,
}
} while ((SECSuccess == rv) && (counter.len));
/* Limit entry data to 1 GiB. */
if (SECSuccess == rv && subTemplate->size &&
totalEntries > ((size_t)1 << 30) / subTemplate->size) {
PORT_SetError(SEC_ERROR_BAD_DER);
rv = SECFailure;
}
if (SECSuccess == rv) {
/* allocate room for pointer array and entries */
/* we want to allocate the array even if there is 0 entry */
entries = (void**)PORT_ArenaZAlloc(arena, sizeof(void*) * (totalEntries + 1) + /* the extra one is for NULL termination */
subTemplate->size * totalEntries);
(size_t)subTemplate->size * totalEntries);
if (entries) {
entries[totalEntries] = NULL; /* terminate the array */
@ -535,7 +547,7 @@ DecodeGroup(void* dest,
PRUint32 entriesIndex = 0;
for (entriesIndex = 0; entriesIndex < totalEntries; entriesIndex++) {
entries[entriesIndex] =
(char*)entriesData + (subTemplate->size * entriesIndex);
(char*)entriesData + ((size_t)subTemplate->size * entriesIndex);
}
}
}
@ -742,15 +754,18 @@ DecodeItem(void* dest,
switch (tagnum) {
/* special cases of primitive types */
case SEC_ASN1_INTEGER: {
/* remove leading zeroes if the caller requested
siUnsignedInteger
This is to allow RSA key operations to work */
SECItem* destItem = (SECItem*)((char*)dest +
templateEntry->offset);
if (destItem && (siUnsignedInteger == destItem->type)) {
while (temp.len > 1 && temp.data[0] == 0) { /* leading 0 */
/* A leading 0 is only allowed when a value
* would otherwise be interpreted as negative. */
if (temp.len > 1 && temp.data[0] == 0) {
temp.data++;
temp.len--;
if (!(temp.data[0] & 0x80)) {
PORT_SetError(SEC_ERROR_BAD_DER);
rv = SECFailure;
}
}
}
break;

2
security/nss/lib/util/secalgid.c
View file

@ -110,7 +110,7 @@ SECOID_CopyAlgorithmID(PLArenaPool *arena, SECAlgorithmID *to,
void
SECOID_DestroyAlgorithmID(SECAlgorithmID *algid, PRBool freeit)
{
SECITEM_FreeItem(&algid->parameters, PR_FALSE);
SECITEM_ZfreeItem(&algid->parameters, PR_FALSE);
SECITEM_FreeItem(&algid->algorithm, PR_FALSE);
if (freeit == PR_TRUE)
PORT_Free(algid);

52
security/nss/lib/util/secasn1d.c
View file

@ -149,7 +149,7 @@ static const char *const flag_names[] = {
};
static int /* bool */
formatKind(unsigned long kind, char *buf)
formatKind(unsigned long kind, char *buf, int space_in_buffer)
{
int i;
unsigned long k = kind & SEC_ASN1_TAGNUM_MASK;
@ -158,30 +158,30 @@ static int /* bool */
buf[0] = 0;
if ((kind & SEC_ASN1_CLASS_MASK) != SEC_ASN1_UNIVERSAL) {
sprintf(buf, " %s", class_names[(kind & SEC_ASN1_CLASS_MASK) >> 6]);
space_in_buffer -= snprintf(buf, space_in_buffer, " %s", class_names[(kind & SEC_ASN1_CLASS_MASK) >> 6]);
buf += strlen(buf);
}
if (kind & SEC_ASN1_METHOD_MASK) {
sprintf(buf, " %s", method_names[1]);
space_in_buffer -= snprintf(buf, space_in_buffer, " %s", method_names[1]);
buf += strlen(buf);
}
if ((kind & SEC_ASN1_CLASS_MASK) == SEC_ASN1_UNIVERSAL) {
if (k || !notag) {
sprintf(buf, " %s", type_names[k]);
space_in_buffer -= snprintf(buf, space_in_buffer, " %s", type_names[k]);
if ((k == SEC_ASN1_SET || k == SEC_ASN1_SEQUENCE) &&
(kind & SEC_ASN1_GROUP)) {
buf += strlen(buf);
sprintf(buf, "_OF");
space_in_buffer -= snprintf(buf, space_in_buffer, "_OF");
}
}
} else {
sprintf(buf, " [%lu]", k);
space_in_buffer -= snprintf(buf, space_in_buffer, " [%lu]", k);
}
buf += strlen(buf);
for (k = kind >> 8, i = 0; k; k >>= 1, ++i) {
if (k & 1) {
sprintf(buf, " %s", flag_names[i]);
space_in_buffer -= snprintf(buf, space_in_buffer, " %s", flag_names[i]);
buf += strlen(buf);
}
}
@ -248,7 +248,7 @@ typedef struct sec_asn1d_state_struct {
PRPackedBool
allocate, /* when true, need to allocate the destination */
endofcontents, /* this state ended up parsing end-of-contents octets */
endofcontents, /* this state ended up parsing its parent's end-of-contents octets */
explicit, /* we are handling an explicit header */
indefinite, /* the current item has indefinite-length encoding */
missing, /* an optional field that was not present */
@ -365,6 +365,11 @@ sec_asn1d_push_state(SEC_ASN1DecoderContext *cx,
state->our_mark = PORT_ArenaMark(cx->our_pool);
}
if (theTemplate == NULL) {
PORT_SetError(SEC_ERROR_BAD_TEMPLATE);
goto loser;
}
new_state = (sec_asn1d_state *)sec_asn1d_zalloc(cx->our_pool,
sizeof(*new_state));
if (new_state == NULL) {
@ -746,8 +751,9 @@ sec_asn1d_parse_identifier(sec_asn1d_state *state,
byte = (unsigned char)*buf;
#ifdef DEBUG_ASN1D_STATES
{
char kindBuf[256];
formatKind(byte, kindBuf);
int bufsize = 256;
char kindBuf[bufsize];
formatKind(byte, kindBuf, bufsize);
printf("Found tag %02x %s\n", byte, kindBuf);
}
#endif
@ -1982,8 +1988,15 @@ sec_asn1d_next_in_group(sec_asn1d_state *state)
* compensating for "offset", as is done a little farther below
* in the more normal case.
*/
PORT_Assert(state->indefinite);
PORT_Assert(state->pending == 0);
/*
* XXX We used to assert our overall state was that we were decoding
* an indefinite-length object here (state->indefinite == TRUE and no
* pending bytes in the decoder), but those assertions aren't correct
* as it's legitimate to wrap indefinite sequences inside definite ones
* and this code handles that case. Additionally, when compiled in
* release mode these assertions aren't checked anyway, yet function
* safely.
*/
if (child->dest && !state->subitems_head) {
sec_asn1d_add_to_subitems(state, child->dest, 0, PR_FALSE);
child->dest = NULL;
@ -2195,9 +2208,13 @@ sec_asn1d_next_in_sequence(sec_asn1d_state *state)
* In practice this does not happen, but for completeness
* sake it should probably be made to work at some point.
*/
PORT_Assert(child_found_tag_number < SEC_ASN1_HIGH_TAG_NUMBER);
identifier = (unsigned char)(child_found_tag_modifiers | child_found_tag_number);
sec_asn1d_record_any_header(child, (char *)&identifier, 1);
if (child_found_tag_modifiers >= SEC_ASN1_HIGH_TAG_NUMBER) {
PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
state->top->status = decodeError;
} else {
identifier = (unsigned char)(child_found_tag_modifiers | child_found_tag_number);
sec_asn1d_record_any_header(child, (char *)&identifier, 1);
}
}
}
}
@ -2715,7 +2732,8 @@ static void
dump_states(SEC_ASN1DecoderContext *cx)
{
sec_asn1d_state *state;
char kindBuf[256];
int bufsize = 256;
char kindBuf[bufsize];
for (state = cx->current; state->parent; state = state->parent) {
;
@ -2727,7 +2745,7 @@ dump_states(SEC_ASN1DecoderContext *cx)
printf(" ");
}
i = formatKind(state->theTemplate->kind, kindBuf);
i = formatKind(state->theTemplate->kind, kindBuf, bufsize);
printf("%s: tmpl kind %s",
(state == cx->current) ? "STATE" : "State",
kindBuf);

10
security/nss/lib/util/secasn1e.c
View file

@ -94,8 +94,12 @@ sec_asn1e_push_state(SEC_ASN1EncoderContext *cx,
{
sec_asn1e_state *state, *new_state;
state = cx->current;
if (theTemplate == NULL) {
cx->status = encodeError;
return NULL;
}
state = cx->current;
new_state = (sec_asn1e_state *)PORT_ArenaZAlloc(cx->our_pool,
sizeof(*new_state));
if (new_state == NULL) {
@ -702,6 +706,10 @@ sec_asn1e_contents_length(const SEC_ASN1Template *theTemplate, void *src,
}
break;
case SEC_ASN1_NULL:
len = 0;
break;
default:
len = ((SECItem *)src)->len;
break;

4
security/nss/lib/util/seccomon.h
View file

@ -61,7 +61,7 @@ struct SECItemArrayStr {
};
/*
** A status code. Status's are used by procedures that return status
** A status code. Statuses are used by procedures that return status
** values. Again the motivation is so that a compiler can generate
** warnings when return values are wrong. Correct testing of status codes:
**
@ -78,7 +78,7 @@ typedef enum _SECStatus {
} SECStatus;
/*
** A comparison code. Used for procedures that return comparision
** A comparison code. Used for procedures that return comparison
** values. Again the motivation is so that a compiler can generate
** warnings when return values are wrong.
*/

2
security/nss/lib/util/secdig.c
View file

@ -135,7 +135,7 @@ void
SGN_DestroyDigestInfo(SGNDigestInfo *di)
{
if (di && di->arena) {
PORT_FreeArena(di->arena, PR_FALSE);
PORT_FreeArena(di->arena, PR_TRUE);
}
return;

6
security/nss/lib/util/secerr.h
View file

@ -210,6 +210,12 @@ typedef enum {
SEC_ERROR_APPLICATION_CALLBACK_ERROR = (SEC_ERROR_BASE + 178),
SEC_ERROR_INVALID_STATE = (SEC_ERROR_BASE + 179),
SEC_ERROR_POLICY_LOCKED = (SEC_ERROR_BASE + 180),
SEC_ERROR_SIGNATURE_ALGORITHM_DISABLED = (SEC_ERROR_BASE + 181),
SEC_ERROR_ALGORITHM_MISMATCH = (SEC_ERROR_BASE + 182),
/* Add new error codes above here. */
SEC_ERROR_END_OF_LIST
} SECErrorCodes;

50
security/nss/lib/util/secitem.c
View file

@ -238,35 +238,20 @@ SECITEM_ArenaDupItem(PLArenaPool *arena, const SECItem *from)
SECItem *to;
if (from == NULL) {
return (NULL);
return NULL;
}
if (arena != NULL) {
to = (SECItem *)PORT_ArenaAlloc(arena, sizeof(SECItem));
} else {
to = (SECItem *)PORT_Alloc(sizeof(SECItem));
}
to = SECITEM_AllocItem(arena, NULL, from->len);
if (to == NULL) {
return (NULL);
return NULL;
}
if (arena != NULL) {
to->data = (unsigned char *)PORT_ArenaAlloc(arena, from->len);
} else {
to->data = (unsigned char *)PORT_Alloc(from->len);
}
if (to->data == NULL) {
PORT_Free(to);
return (NULL);
}
to->len = from->len;
to->type = from->type;
if (to->len) {
PORT_Memcpy(to->data, from->data, to->len);
}
return (to);
return to;
}
SECStatus
@ -469,8 +454,9 @@ SECITEM_ZfreeArray(SECItemArray *array, PRBool freeit)
SECItemArray *
SECITEM_DupArray(PLArenaPool *arena, const SECItemArray *from)
{
SECItemArray *result;
SECItemArray *result = NULL;
unsigned int i;
void *mark = NULL;
/* Require a "from" array.
* Reject an inconsistent "from" array with NULL data and nonzero length.
@ -479,18 +465,36 @@ SECITEM_DupArray(PLArenaPool *arena, const SECItemArray *from)
if (!from || (!from->items && from->len))
return NULL;
if (arena != NULL) {
mark = PORT_ArenaMark(arena);
}
result = SECITEM_AllocArray(arena, NULL, from->len);
if (!result)
return NULL;
goto loser;
for (i = 0; i < from->len; ++i) {
SECStatus rv = SECITEM_CopyItem(arena,
&result->items[i], &from->items[i]);
if (rv != SECSuccess) {
SECITEM_ZfreeArray(result, PR_TRUE);
return NULL;
goto loser;
}
}
if (mark) {
PORT_ArenaUnmark(arena, mark);
}
return result;
loser:
if (arena != NULL) {
/* Release rolls back all allocations made since the mark. */
if (mark) {
PORT_ArenaZRelease(arena, mark);
}
} else if (result != NULL) {
/* Non-arena path: heap-free is correct here. */
SECITEM_ZfreeArray(result, PR_TRUE);
}
return NULL;
}

2
security/nss/lib/util/secload.c
View file

@ -88,7 +88,7 @@ loader_LoadLibInReferenceDir(const char* referencePath, const char* name)
* on Windows even if PATH is not set. Requires NSPR 4.8.1 . */
| PR_LD_ALT_SEARCH_PATH
#endif
);
);
PORT_Free(fullName);
}
}

52
security/nss/lib/util/secoid.c
View file

@ -694,7 +694,7 @@ const static SECOidData oids[SEC_OID_TOTAL] = {
CKM_PBE_MD5_DES_CBC, INVALID_CERT_EXTENSION),
OD(pkcs5PbeWithSha1AndDEScbc, SEC_OID_PKCS5_PBE_WITH_SHA1_AND_DES_CBC,
"PKCS #5 Password Based Encryption with SHA-1 and DES-CBC",
CKM_NETSCAPE_PBE_SHA1_DES_CBC, INVALID_CERT_EXTENSION),
CKM_NSS_PBE_SHA1_DES_CBC, INVALID_CERT_EXTENSION),
OD(pkcs7, SEC_OID_PKCS7,
"PKCS #7", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION),
OD(pkcs7Data, SEC_OID_PKCS7_DATA,
@ -962,23 +962,23 @@ const static SECOidData oids[SEC_OID_TOTAL] = {
OD(pkcs12PBEWithSha1And128BitRC4,
SEC_OID_PKCS12_PBE_WITH_SHA1_AND_128_BIT_RC4,
"PKCS #12 PBE With SHA-1 and 128 Bit RC4",
CKM_NETSCAPE_PBE_SHA1_128_BIT_RC4, INVALID_CERT_EXTENSION),
CKM_NSS_PBE_SHA1_128_BIT_RC4, INVALID_CERT_EXTENSION),
OD(pkcs12PBEWithSha1And40BitRC4,
SEC_OID_PKCS12_PBE_WITH_SHA1_AND_40_BIT_RC4,
"PKCS #12 PBE With SHA-1 and 40 Bit RC4",
CKM_NETSCAPE_PBE_SHA1_40_BIT_RC4, INVALID_CERT_EXTENSION),
CKM_NSS_PBE_SHA1_40_BIT_RC4, INVALID_CERT_EXTENSION),
OD(pkcs12PBEWithSha1AndTripleDESCBC,
SEC_OID_PKCS12_PBE_WITH_SHA1_AND_TRIPLE_DES_CBC,
"PKCS #12 PBE With SHA-1 and Triple DES-CBC",
CKM_NETSCAPE_PBE_SHA1_TRIPLE_DES_CBC, INVALID_CERT_EXTENSION),
CKM_NSS_PBE_SHA1_TRIPLE_DES_CBC, INVALID_CERT_EXTENSION),
OD(pkcs12PBEWithSha1And128BitRC2CBC,
SEC_OID_PKCS12_PBE_WITH_SHA1_AND_128_BIT_RC2_CBC,
"PKCS #12 PBE With SHA-1 and 128 Bit RC2 CBC",
CKM_NETSCAPE_PBE_SHA1_128_BIT_RC2_CBC, INVALID_CERT_EXTENSION),
CKM_NSS_PBE_SHA1_128_BIT_RC2_CBC, INVALID_CERT_EXTENSION),
OD(pkcs12PBEWithSha1And40BitRC2CBC,
SEC_OID_PKCS12_PBE_WITH_SHA1_AND_40_BIT_RC2_CBC,
"PKCS #12 PBE With SHA-1 and 40 Bit RC2 CBC",
CKM_NETSCAPE_PBE_SHA1_40_BIT_RC2_CBC, INVALID_CERT_EXTENSION),
CKM_NSS_PBE_SHA1_40_BIT_RC2_CBC, INVALID_CERT_EXTENSION),
OD(pkcs12RSAEncryptionWith128BitRC4,
SEC_OID_PKCS12_RSA_ENCRYPTION_WITH_128_BIT_RC4,
"PKCS #12 RSA Encryption with 128 Bit RC4",
@ -2058,7 +2058,7 @@ SECOID_Init(void)
{
PLHashEntry *entry;
const SECOidData *oid;
int i;
SECOidTag i;
char *envVal;
#define NSS_VERSION_VARIABLE __nss_util_version
@ -2118,7 +2118,7 @@ SECOID_Init(void)
if (oid->mechanism != CKM_INVALID_MECHANISM) {
entry = PL_HashTableAdd(oidmechhash,
(void *)oid->mechanism, (void *)oid);
(void *)(uintptr_t)oid->mechanism, (void *)oid);
if (entry == NULL) {
PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
PORT_Assert(0); /* This function should never fail. */
@ -2137,9 +2137,13 @@ SECOID_FindOIDByMechanism(unsigned long mechanism)
{
SECOidData *ret;
PR_ASSERT(oidhash != NULL);
PR_ASSERT(oidmechhash != NULL);
if (oidmechhash == NULL && SECOID_Init() != SECSuccess) {
PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
return NULL;
}
ret = PL_HashTableLookupConst(oidmechhash, (void *)mechanism);
ret = PL_HashTableLookupConst(oidmechhash, (void *)(uintptr_t)mechanism);
if (ret == NULL) {
PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
}
@ -2153,6 +2157,10 @@ SECOID_FindOID(const SECItem *oid)
SECOidData *ret;
PR_ASSERT(oidhash != NULL);
if (oidhash == NULL && SECOID_Init() != SECSuccess) {
PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
return NULL;
}
ret = PL_HashTableLookupConst(oidhash, oid);
if (ret == NULL) {
@ -2244,6 +2252,8 @@ NSS_GetAlgorithmPolicy(SECOidTag tag, PRUint32 *pValue)
return SECSuccess;
}
static PRBool nss_policy_locked = PR_FALSE;
/* The Set function modifies the stored value according to the following
* algorithm:
* policy[tag] = (policy[tag] & ~clearBits) | setBits;
@ -2255,6 +2265,11 @@ NSS_SetAlgorithmPolicy(SECOidTag tag, PRUint32 setBits, PRUint32 clearBits)
PRUint32 policyFlags;
if (!pxo)
return SECFailure;
if (nss_policy_locked) {
PORT_SetError(SEC_ERROR_POLICY_LOCKED);
return SECFailure;
}
/* The stored policy flags are the ones complement of the flags as
* seen by the user. This is not atomic, but these changes should
* be done rarely, e.g. at initialization time.
@ -2265,6 +2280,20 @@ NSS_SetAlgorithmPolicy(SECOidTag tag, PRUint32 setBits, PRUint32 clearBits)
return SECSuccess;
}
/* Get the state of nss_policy_locked */
PRBool
NSS_IsPolicyLocked(void)
{
return nss_policy_locked;
}
/* Once the policy is locked, it can't be unlocked */
void
NSS_LockPolicy(void)
{
nss_policy_locked = PR_TRUE;
}
/* --------- END OF opaque extended OID table accessor functions ---------*/
/* for now, this is only used in a single place, so it can remain static */
@ -2326,6 +2355,9 @@ SECOID_Shutdown(void)
dynOidEntriesAllocated = 0;
dynOidEntriesUsed = 0;
}
/* we are trashing the old policy state now, also reenable changing
* the policy as well */
nss_policy_locked = PR_FALSE;
memset(xOids, 0, sizeof xOids);
return SECSuccess;
}

9
security/nss/lib/util/secoid.h
View file

@ -135,6 +135,15 @@ extern SECStatus NSS_GetAlgorithmPolicy(SECOidTag tag, PRUint32 *pValue);
extern SECStatus
NSS_SetAlgorithmPolicy(SECOidTag tag, PRUint32 setBits, PRUint32 clearBits);
/* Lock the policy so NSS_SetAlgorithmPolicy (and other policy functions)
* No longer function */
void
NSS_LockPolicy(void);
/* return true if policy changes are now locked out */
PRBool
NSS_IsPolicyLocked(void);
SEC_END_PROTOS
#endif /* _SECOID_H_ */

20
security/nss/lib/util/secoidt.h
View file

@ -538,7 +538,25 @@ struct SECOidDataStr {
#define NSS_USE_ALG_IN_SSL_KX 0x00000004 /* used in SSL key exchange */
#define NSS_USE_ALG_IN_SSL 0x00000008 /* used in SSL record protocol */
#define NSS_USE_POLICY_IN_SSL 0x00000010 /* enable policy in SSL protocol */
#define NSS_USE_ALG_RESERVED 0xfffffffc /* may be used in future */
#define NSS_USE_ALG_IN_ANY_SIGNATURE 0x00000020 /* used in any signature */
#define NSS_USE_ALG_IN_PKCS12 0x00000040 /* used in pkcs12 */
#define NSS_USE_DEFAULT_NOT_VALID 0x80000000 /* clear to make the default flag valid */
#define NSS_USE_DEFAULT_SSL_ENABLE 0x40000000 /* default cipher suite setting 1=enable */
/* Combo policy bites */
#define NSS_USE_ALG_RESERVED 0x3fffffc0 /* may be used in future */
/* Alias of all the signature values. */
#define NSS_USE_ALG_IN_SIGNATURE (NSS_USE_ALG_IN_CERT_SIGNATURE | \
NSS_USE_ALG_IN_CMS_SIGNATURE | \
NSS_USE_ALG_IN_ANY_SIGNATURE)
/* all the bits needed for a certificate signature
* and only the bits needed for a certificate signature */
#define NSS_USE_CERT_SIGNATURE_OK (NSS_USE_ALG_IN_CERT_SIGNATURE | \
NSS_USE_ALG_IN_ANY_SIGNATURE)
/* all the bits needed for an SMIME signature
* and only the bits needed for an SMIME signature */
#define NSS_USE_CMS_SIGNATURE_OK (NSS_USE_ALG_IN_CMS_SIGNATURE | \
NSS_USE_ALG_IN_ANY_SIGNATURE)
/* Code MUST NOT SET or CLEAR reserved bits, and must NOT depend on them
* being all zeros or having any other known value. The reserved bits

119
security/nss/lib/util/secport.c
View file

@ -31,7 +31,7 @@
#include "prthread.h"
#endif /* THREADMARK */
#if defined(XP_UNIX) || defined(XP_OS2) || defined(XP_BEOS)
#if defined(XP_UNIX) || defined(XP_OS2)
#include <stdlib.h>
#else
#include "wtypes.h"
@ -730,8 +730,6 @@ int
NSS_PutEnv(const char *envVarName, const char *envValue)
{
SECStatus result = SECSuccess;
char *encoded;
int putEnvFailed;
#ifdef _WIN32
PRBool setOK;
@ -740,22 +738,29 @@ NSS_PutEnv(const char *envVarName, const char *envValue)
SET_ERROR_CODE
return SECFailure;
}
#endif
encoded = (char *)PORT_ZAlloc(strlen(envVarName) + 2 + strlen(envValue));
#elif defined(__GNUC__) && __GNUC__ >= 7
int setEnvFailed;
setEnvFailed = setenv(envVarName, envValue, 1);
if (setEnvFailed) {
SET_ERROR_CODE
return SECFailure;
}
#else
char *encoded = (char *)PORT_ZAlloc(strlen(envVarName) + 2 + strlen(envValue));
if (!encoded) {
return SECFailure;
}
strcpy(encoded, envVarName);
strcat(encoded, "=");
strcat(encoded, envValue);
int putEnvFailed = putenv(encoded); /* adopt. */
putEnvFailed = putenv(encoded); /* adopt. */
if (putEnvFailed) {
SET_ERROR_CODE
result = SECFailure;
PORT_Free(encoded);
}
#endif
return result;
}
@ -768,14 +773,14 @@ NSS_SecureMemcmp(const void *ia, const void *ib, size_t n)
{
const unsigned char *a = (const unsigned char *)ia;
const unsigned char *b = (const unsigned char *)ib;
size_t i;
unsigned char r = 0;
int r = 0;
for (i = 0; i < n; ++i) {
r |= *a++ ^ *b++;
for (size_t i = 0; i < n; ++i) {
r |= a[i] ^ b[i];
}
return r;
/* 0 <= r < 256, so -r has bit 8 set when r != 0 */
return 1 & (-r >> 8);
}
/*
@ -785,10 +790,90 @@ NSS_SecureMemcmp(const void *ia, const void *ib, size_t n)
unsigned int
NSS_SecureMemcmpZero(const void *mem, size_t n)
{
PRUint8 zero = 0;
size_t i;
for (i = 0; i < n; ++i) {
zero |= *(PRUint8 *)((uintptr_t)mem + i);
const unsigned char *a = (const unsigned char *)mem;
int r = 0;
for (size_t i = 0; i < n; ++i) {
r |= a[i];
}
/* 0 <= r < 256, so -r has bit 8 set when r != 0 */
return 1 & (-r >> 8);
}
/*
* A "value barrier" prevents the compiler from making optimizations based on
* the value that a variable takes.
*
* Standard C does not have value barriers, so C implementations of them are
* compiler-specific and are not guaranteed to be effective. Thus, the value
* barriers here are a best-effort, defense-in-depth, strategy. They are not a
* substitute for standard constant-time programming discipline.
*
* Some implementations have a performance penalty, so value barriers should
* be used sparingly.
*/
static inline int
value_barrier_int(int x)
{
#if defined(__GNUC__) || defined(__clang__)
/* This inline assembly trick from Chandler Carruth's CppCon 2015 talk
* generates no instructions.
*
* "+r"(x) means that x will be mapped to a register that is both an input
* and an output to the assembly routine (""). The compiler will not
* inspect the assembly routine itself, so it cannot assume anything about
* the value of x after this line.
*/
__asm__(""
: "+r"(x)
: /* no other inputs */);
return x;
#else
/* If the compiler does not support the inline assembly trick above, we can
* put x in `volatile` storage and read it out again. This will generate
* explict store and load instructions, and possibly more depending on the
* target.
*/
volatile int y = x;
return y;
#endif
}
/*
* A branch-free implementation of
* if (!b) {
* memmove(dest, src0, n);
* } else {
* memmove(dest, src1, n);
* }
*
* The memmove is performed with src0 if `b == 0` and with src1
* otherwise.
*
* As with memmove, the selected src can overlap dest.
*
* Each of dest, src0, and src1 must point to an allocated buffer
* of at least n bytes.
*/
void
NSS_SecureSelect(void *dest, const void *src0, const void *src1, size_t n, unsigned char b)
{
// This value barrier makes it safe for the compiler to inline
// NSS_SecureSelect into a routine where it could otherwise infer something
// about the value of b, e.g. that b is 0/1 valued.
int w = value_barrier_int(b);
// 0 <= b < 256, and int is at least 16 bits, so -w has bits 8-15
// set when w != 0.
unsigned char mask = 0xff & (-w >> 8);
for (size_t i = 0; i < n; ++i) {
unsigned char s0i = ((unsigned char *)src0)[i];
unsigned char s1i = ((unsigned char *)src1)[i];
// if mask == 0 this simplifies to s0 ^ 0
// if mask == -1 this simplifies to s0 ^ s0 ^ s1
((unsigned char *)dest)[i] = s0i ^ (mask & (s0i ^ s1i));
}
return zero;
}

83
security/nss/lib/util/secport.h
View file

@ -13,7 +13,7 @@
#include "prlink.h"
/*
* define XP_WIN, XP_BEOS, or XP_UNIX, in case they are not defined
* define XP_WIN, or XP_UNIX, in case they are not defined
* by anyone else
*/
#ifdef _WINDOWS
@ -27,12 +27,6 @@
#endif
#endif
#ifdef __BEOS__
#ifndef XP_BEOS
#define XP_BEOS
#endif
#endif
#ifdef unix
#ifndef XP_UNIX
#define XP_UNIX
@ -126,6 +120,15 @@ SEC_END_PROTOS
* ignored. See more details in Bug 1588015. */
#define PORT_AssertArg PR_ASSERT_ARG
/* Assert the current location can't be reached, passing a reason-string. */
#define PORT_AssertNotReached(reasonStr) PR_NOT_REACHED(reasonStr)
/* macros to handle endian based byte conversion */
#define PORT_GET_BYTE_BE(value, offset, len) \
((unsigned char)(((len) - (offset)-1) >= sizeof(value) ? 0 : (((value) >> (((len) - (offset)-1) * PR_BITS_PER_BYTE)) & 0xff)))
#define PORT_GET_BYTE_LE(value, offset, len) \
((unsigned char)((offset) > sizeof(value) ? 0 : (((value) >> ((offset)*PR_BITS_PER_BYTE)) & 0xff)))
/* This runs a function that should return SECSuccess.
* Intended for NSS internal use only.
* The return value is asserted in a debug build, otherwise it is ignored.
@ -258,6 +261,7 @@ extern int NSS_PutEnv(const char *envVarName, const char *envValue);
extern int NSS_SecureMemcmp(const void *a, const void *b, size_t n);
extern unsigned int NSS_SecureMemcmpZero(const void *mem, size_t n);
extern void NSS_SecureSelect(void *dest, const void *src0, const void *src1, size_t n, unsigned char b);
/*
* Load a shared library called "newShLibName" in the same directory as
@ -296,4 +300,69 @@ PORT_LoadLibraryFromOrigin(const char *existingShLibName,
SEC_END_PROTOS
/*
* Constant time macros
*/
/* These macros use the fact that arithmetic shift shifts-in the sign bit.
* However, this is not ensured by the C standard so you may need to replace
* them with something else for odd compilers. These macros work for object
* sizes up to 32 bits. The inequalities will produce incorrect results if
* abs(a-b) >= PR_UINT32_MAX/2. This can be a voided if unsigned values stay
* within the range 0-PRUINT32_MAX/2 and signed values stay within the range
* -PRINT32_MAX/2-PRINT32_MAX/2. If these are insufficient, we can fix
* this by either expanding the PORT_CT_DUPLICATE_MSB_TO_ALL to PRUint64
* or by creating the following new macros for inequality:
*
* PORT_CT_OVERFLOW prevents the overflow condition by handling the case
* where the high bits in a and b are different specially. Basically if
* the high bit in a and b differs we can just
* copy the high bit of one of the parameters to determine the result as
* follows:
* GxU if a has the high bit on, a>b, so d=a
* LxU if b has the high bit on, a<b, so d=b
* GxS if b has the high bit on, it's negative a>b so d=b
* LxS if a has the high bit on, it's negative a<b so d=a
* where PORT_CT_xxU() macros do unsigned compares and PORT_CT_xxS() do signed
* compares.
*
* #define PORT_CT_OVERFLOW(a,b,c,d) \
* PORT_CT_SEL(PORT_CT_DUPLICATE_MSB_TO_ALL((a)^(b)), \
* (PORT_CT_DUPLICATE_MSB_TO_ALL(d)),c)
* #define PORT_CT_GTU(a,b) PORT_CT_OVERFLOW(a,b,PORT_CT_GT(a,b),a)
* #define PORT_CT_LTU(a,b) PORT_CT_OVERFLOW(a,b,PORT_CT_LT(a,b),b)
* #define PORT_CT_GEU(a,b) PORT_CT_OVERFLOW(a,b,PORT_CT_GE(a,b),a)
* #define PORT_CT_LEU(a,b) PORT_CT_OVERFLOW(a,b,PORT_CT_LE(a,b),b)
* #define PORT_CT_GTS(a,b) PORT_CT_OVERFLOW(a,b,PORT_CT_GT(a,b),b)
* #define PORT_CT_LTS(a,b) PORT_CT_OVERFLOW(a,b,PORT_CT_LT(a,b),a)
* #define PORT_CT_GES(a,b) PORT_CT_OVERFLOW(a,b,PORT_CT_GE(a,b),b)
* #define PORT_CT_LES(a,b) PORT_CT_OVERFLOW(a,b,PORT_CT_LE(a,b),a)
*
*
* */
/* Constant-time helper macro that copies the MSB of x to all other bits. */
#define PORT_CT_DUPLICATE_MSB_TO_ALL(x) ((PRUint32)((PRInt32)(x) >> (sizeof(PRInt32) * 8 - 1)))
/* Constant-time helper macro that selects l or r depending on all-1 or all-0
* mask m */
#define PORT_CT_SEL(m, l, r) (((m) & (l)) | (~(m) & (r)))
/* Constant-time helper macro that returns all-1s if x is not 0; and all-0s
* otherwise. */
#define PORT_CT_NOT_ZERO(x) (PORT_CT_DUPLICATE_MSB_TO_ALL(((x) | (0 - (x)))))
/* Constant-time helper macro that returns all-1s if x is 0; and all-0s
* otherwise. */
#define PORT_CT_ZERO(x) (~PORT_CT_DUPLICATE_MSB_TO_ALL(((x) | (0 - (x)))))
/* Constant-time helper macro for equalities and inequalities.
* returns all-1's for true and all-0's for false */
#define PORT_CT_EQ(a, b) PORT_CT_ZERO(((a) - (b)))
#define PORT_CT_NE(a, b) PORT_CT_NOT_ZERO(((a) - (b)))
#define PORT_CT_GT(a, b) PORT_CT_DUPLICATE_MSB_TO_ALL((b) - (a))
#define PORT_CT_LT(a, b) PORT_CT_DUPLICATE_MSB_TO_ALL((a) - (b))
#define PORT_CT_GE(a, b) (~PORT_CT_LT(a, b))
#define PORT_CT_LE(a, b) (~PORT_CT_GT(a, b))
#define PORT_CT_TRUE (~0)
#define PORT_CT_FALSE 0
#endif /* _SECPORT_H_ */

27
security/nss/lib/util/utilpars.c
View file

@ -178,7 +178,7 @@ char *
NSSUTIL_ArgGetParamValue(const char *paramName, const char *parameters)
{
char searchValue[256];
int paramLen = strlen(paramName);
size_t paramLen = strlen(paramName);
char *returnValue = NULL;
int next;
@ -585,7 +585,7 @@ struct nssutilArgSlotFlagTable {
#define NSSUTIL_ARG_ENTRY(arg, flag) \
{ \
#arg, sizeof(#arg) - 1, flag \
#arg, sizeof(#arg) - 1, flag \
}
static struct nssutilArgSlotFlagTable nssutil_argSlotFlagTable[] = {
NSSUTIL_ARG_ENTRY(RSA, SECMOD_RSA_FLAG),
@ -913,6 +913,23 @@ NSSUTIL_MkModuleSpec(char *dllName, char *commonName, char *parameters,
return NSSUTIL_MkModuleSpecEx(dllName, commonName, parameters, NSS, NULL);
}
/* Count the number of name=value parameters in a parameter string. */
static size_t
nssutil_CountParams(const char *params)
{
size_t count = 0;
const char *p = params;
while (*p) {
p = NSSUTIL_ArgStrip(p);
if (!*p) {
break;
}
p = NSSUTIL_ArgSkipParameter(p);
count++;
}
return count;
}
/************************************************************************
* add a single flag to the Flags= section inside the spec's NSS= section */
char *
@ -946,7 +963,11 @@ NSSUTIL_AddNSSFlagToModuleSpec(char *spec, char *addFlag)
} else {
const char *iNss = nss;
PRBool alreadyAdded = PR_FALSE;
size_t maxSize = strlen(nss) + strlen(addFlag) + prefixLen + 2; /* space and null terminator */
// Allocate enough space for the current string, space delimiters
// between all existing parameters, a space before the new flags
// parameter, and a null terminator.
size_t nParams = nssutil_CountParams(nss);
size_t maxSize = strlen(nss) + nParams + strlen(addFlag) + prefixLen + 2;
nss2 = PORT_Alloc(maxSize);
*nss2 = 0;
while (*iNss) {

2
security/nss/lib/util/verref.h
View file

@ -28,7 +28,7 @@
#endif
{
extern const char NSS_VERSION_VARIABLE[];
#if defined(__GNUC__)
#if defined(__GNUC__) || defined(__clang__)
__attribute__((unused))
#endif
volatile const char _nss_version_c = NSS_VERSION_VARIABLE[0];