import FIREFOX_52_6_0esr_RELEASE from mozilla-esr52 hg repo

security/nss/lib/ckfw/Makefile

@@ -0,0 +1,39 @@
+# 
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+include manifest.mn
+include $(CORE_DEPTH)/coreconf/config.mk
+include config.mk
+include $(CORE_DEPTH)/coreconf/rules.mk
+
+ifdef NOTDEF # was ifdef MOZILLA_CLIENT
+NSS_BUILD_CAPI = 1
+endif
+
+# This'll need some help from a build person.
+
+# The generated files are checked in, and differ from what ckapi.perl
+# will produce.  ckapi.perl is currently newer than the targets, so
+# these rules are invoked, causing the wrong files to be generated.
+# Turning off to fix builds.
+#
+# nssckepv.h: ck.api ckapi.perl
+# nssckft.h: ck.api ckapi.perl
+# nssckg.h: ck.api ckapi.perl
+# nssck.api: ck.api ckapi.perl
+# 	$(PERL) ckapi.perl ck.api
+
+export:: private_export
+
+# can't do this in manifest.mn because OS_TARGET isn't defined there.
+ifeq (,$(filter-out WINNT WIN95,$(OS_TARGET)))
+ifdef NSS_BUILD_CAPI
+DIRS += capi
+endif
+endif
+
+#ifeq ($(OS_ARCH), Darwin)
+#DIRS += nssmkey
+#endif

security/nss/lib/ckfw/builtins/Makefile

@@ -0,0 +1,54 @@
+# 
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+include manifest.mn
+include $(CORE_DEPTH)/coreconf/config.mk
+include config.mk
+
+EXTRA_LIBS = \
+	$(DIST)/lib/$(LIB_PREFIX)nssckfw.$(LIB_SUFFIX) \
+	$(DIST)/lib/$(LIB_PREFIX)nssb.$(LIB_SUFFIX) \
+	$(NULL)
+
+# can't do this in manifest.mn because OS_TARGET isn't defined there.
+ifeq (,$(filter-out WIN%,$(OS_TARGET)))
+
+ifdef NS_USE_GCC
+EXTRA_SHARED_LIBS += \
+	-L$(NSPR_LIB_DIR) \
+	-lplc4 \
+	-lplds4 \
+	-lnspr4 \
+	$(NULL)
+else 
+EXTRA_SHARED_LIBS += \
+        $(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plc4.lib \
+        $(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plds4.lib \
+        $(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)nspr4.lib \
+        $(NULL)
+endif # NS_USE_GCC
+else
+
+EXTRA_SHARED_LIBS += \
+	-L$(NSPR_LIB_DIR) \
+	-lplc4 \
+	-lplds4 \
+	-lnspr4 \
+	$(NULL)
+endif
+
+
+include $(CORE_DEPTH)/coreconf/rules.mk
+
+# Generate certdata.c.
+
+# By default, use the unmodified certdata.txt.
+ifndef NSS_CERTDATA_TXT
+NSS_CERTDATA_TXT = certdata.txt
+endif
+
+$(OBJDIR)/certdata.c: $(NSS_CERTDATA_TXT) certdata.perl
+	@$(MAKE_OBJDIR)
+	$(PERL) certdata.perl $(NSS_CERTDATA_TXT) $@

security/nss/lib/ckfw/builtins/README

@@ -0,0 +1,45 @@
+This README file explains how to add a builtin root CA certificate to NSS
+or remove a builtin root CA certificate from NSS.
+
+The builtin root CA certificates in NSS are stored in the nssckbi PKCS #11
+module. The sources to the nssckbi module are in this directory.
+
+I. Adding a Builtin Root CA Certificate
+
+You need to use the addbuiltin command-line tool to add a root CA certificate
+to the nssckbi module. In the procedure described below, we assume that the
+new root CA certificate is distributed in DER format in the file newroot.der.
+
+1. Add the directory where the addbuiltin executable resides to your PATH
+environment variable. Then, add the directory where the NSPR and NSS shared
+libraries (DLLs) reside to the platform-specific environment variable that
+specifies your shared library search path: LD_LIBRARY_PATH (most Unix
+variants), SHLIB_PATH (32-bit HP-UX), LIBPATH (AIX), or PATH (Windows).
+
+2. Copy newroot.der to this directory.
+
+3. In this directory, run addbuiltin to add the new root certificate. The
+argument to the -n option should be replaced by the nickname of the root
+certificate.
+
+    % addbuiltin -n "Nickname of the Root Certificate" -t C,C,C < newroot.der >> certdata.txt
+
+4. Edit nssckbi.h to bump the version of the module.
+
+5. Run gmake in this directory to build the nssckbi module.
+
+6. After you verify that the new nssckbi module is correct, check in
+certdata.txt and nssckbi.h.
+
+II. Removing a Builtin Root CA Certificate
+
+1. Change directory to this directory.
+
+2. Edit certdata.txt and remove the root CA certificate.
+
+3. Edit nssckbi.h to bump the version of the module.
+
+4. Run gmake in this directory to build the nssckbi module.
+
+5. After you verify that the new nssckbi module is correct, check in
+certdata.txt and nssckbi.h.

security/nss/lib/ckfw/builtins/anchor.c

@@ -0,0 +1,17 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * builtins/anchor.c
+ *
+ * This file "anchors" the actual cryptoki entry points in this module's
+ * shared library, which is required for dynamic loading.  See the
+ * comments in nssck.api for more information.
+ */
+
+#include "builtins.h"
+
+#define MODULE_NAME builtins
+#define INSTANCE_NAME (NSSCKMDInstance *)&nss_builtins_mdInstance
+#include "nssck.api"

security/nss/lib/ckfw/builtins/bfind.c

@@ -0,0 +1,261 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef BUILTINS_H
+#include "builtins.h"
+#endif /* BUILTINS_H */
+
+/*
+ * builtins/find.c
+ *
+ * This file implements the NSSCKMDFindObjects object for the
+ * "builtin objects" cryptoki module.
+ */
+
+struct builtinsFOStr {
+    NSSArena *arena;
+    CK_ULONG n;
+    CK_ULONG i;
+    builtinsInternalObject **objs;
+};
+
+static void
+builtins_mdFindObjects_Final(
+    NSSCKMDFindObjects *mdFindObjects,
+    NSSCKFWFindObjects *fwFindObjects,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    struct builtinsFOStr *fo = (struct builtinsFOStr *)mdFindObjects->etc;
+    NSSArena *arena = fo->arena;
+
+    nss_ZFreeIf(fo->objs);
+    nss_ZFreeIf(fo);
+    nss_ZFreeIf(mdFindObjects);
+    if ((NSSArena *)NULL != arena) {
+        NSSArena_Destroy(arena);
+    }
+
+    return;
+}
+
+static NSSCKMDObject *
+builtins_mdFindObjects_Next(
+    NSSCKMDFindObjects *mdFindObjects,
+    NSSCKFWFindObjects *fwFindObjects,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    NSSArena *arena,
+    CK_RV *pError)
+{
+    struct builtinsFOStr *fo = (struct builtinsFOStr *)mdFindObjects->etc;
+    builtinsInternalObject *io;
+
+    if (fo->i == fo->n) {
+        *pError = CKR_OK;
+        return (NSSCKMDObject *)NULL;
+    }
+
+    io = fo->objs[fo->i];
+    fo->i++;
+
+    return nss_builtins_CreateMDObject(arena, io, pError);
+}
+
+static int
+builtins_derUnwrapInt(unsigned char *src, int size, unsigned char **dest)
+{
+    unsigned char *start = src;
+    int len = 0;
+
+    if (*src++ != 2) {
+        return 0;
+    }
+    len = *src++;
+    if (len & 0x80) {
+        int count = len & 0x7f;
+        len = 0;
+
+        if (count + 2 > size) {
+            return 0;
+        }
+        while (count-- > 0) {
+            len = (len << 8) | *src++;
+        }
+    }
+    if (len + (src - start) != size) {
+        return 0;
+    }
+    *dest = src;
+    return len;
+}
+
+static CK_BBOOL
+builtins_attrmatch(
+    CK_ATTRIBUTE_PTR a,
+    const NSSItem *b)
+{
+    PRBool prb;
+
+    if (a->ulValueLen != b->size) {
+        /* match a decoded serial number */
+        if ((a->type == CKA_SERIAL_NUMBER) && (a->ulValueLen < b->size)) {
+            int len;
+            unsigned char *data = NULL;
+
+            len = builtins_derUnwrapInt(b->data, b->size, &data);
+            if (data &&
+                (len == a->ulValueLen) &&
+                nsslibc_memequal(a->pValue, data, len, (PRStatus *)NULL)) {
+                return CK_TRUE;
+            }
+        }
+        return CK_FALSE;
+    }
+
+    prb = nsslibc_memequal(a->pValue, b->data, b->size, (PRStatus *)NULL);
+
+    if (PR_TRUE == prb) {
+        return CK_TRUE;
+    } else {
+        return CK_FALSE;
+    }
+}
+
+static CK_BBOOL
+builtins_match(
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    builtinsInternalObject *o)
+{
+    CK_ULONG i;
+
+    for (i = 0; i < ulAttributeCount; i++) {
+        CK_ULONG j;
+
+        for (j = 0; j < o->n; j++) {
+            if (o->types[j] == pTemplate[i].type) {
+                if (CK_FALSE == builtins_attrmatch(&pTemplate[i], &o->items[j])) {
+                    return CK_FALSE;
+                } else {
+                    break;
+                }
+            }
+        }
+
+        if (j == o->n) {
+            /* Loop ran to the end: no matching attribute */
+            return CK_FALSE;
+        }
+    }
+
+    /* Every attribute passed */
+    return CK_TRUE;
+}
+
+NSS_IMPLEMENT NSSCKMDFindObjects *
+nss_builtins_FindObjectsInit(
+    NSSCKFWSession *fwSession,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    CK_RV *pError)
+{
+    /* This could be made more efficient.  I'm rather rushed. */
+    NSSArena *arena;
+    NSSCKMDFindObjects *rv = (NSSCKMDFindObjects *)NULL;
+    struct builtinsFOStr *fo = (struct builtinsFOStr *)NULL;
+
+/*
+   * 99% of the time we get 0 or 1 matches. So we start with a small
+   * stack-allocated array to hold the matches and switch to a heap-allocated
+   * array later if the number of matches exceeds STACK_BUF_LENGTH.
+   */
+#define STACK_BUF_LENGTH 1
+    builtinsInternalObject *stackTemp[STACK_BUF_LENGTH];
+    builtinsInternalObject **temp = stackTemp;
+    PRBool tempIsHeapAllocated = PR_FALSE;
+    PRUint32 i;
+
+    arena = NSSArena_Create();
+    if ((NSSArena *)NULL == arena) {
+        goto loser;
+    }
+
+    rv = nss_ZNEW(arena, NSSCKMDFindObjects);
+    if ((NSSCKMDFindObjects *)NULL == rv) {
+        *pError = CKR_HOST_MEMORY;
+        goto loser;
+    }
+
+    fo = nss_ZNEW(arena, struct builtinsFOStr);
+    if ((struct builtinsFOStr *)NULL == fo) {
+        *pError = CKR_HOST_MEMORY;
+        goto loser;
+    }
+
+    fo->arena = arena;
+    /* fo->n and fo->i are already zero */
+
+    rv->etc = (void *)fo;
+    rv->Final = builtins_mdFindObjects_Final;
+    rv->Next = builtins_mdFindObjects_Next;
+    rv->null = (void *)NULL;
+
+    for (i = 0; i < nss_builtins_nObjects; i++) {
+        builtinsInternalObject *o = (builtinsInternalObject *)&nss_builtins_data[i];
+
+        if (CK_TRUE == builtins_match(pTemplate, ulAttributeCount, o)) {
+            if (fo->n == STACK_BUF_LENGTH) {
+                /* Switch from the small stack array to a heap-allocated array large
+         * enough to handle matches in all remaining cases. */
+                temp = nss_ZNEWARRAY((NSSArena *)NULL, builtinsInternalObject *,
+                                     fo->n + nss_builtins_nObjects - i);
+                if ((builtinsInternalObject **)NULL == temp) {
+                    *pError =
+                        CKR_HOST_MEMORY;
+                    goto loser;
+                }
+                tempIsHeapAllocated = PR_TRUE;
+                (void)nsslibc_memcpy(temp, stackTemp,
+                                     sizeof(builtinsInternalObject *) * fo->n);
+            }
+
+            temp[fo->n] = o;
+            fo->n++;
+        }
+    }
+
+    fo->objs = nss_ZNEWARRAY(arena, builtinsInternalObject *, fo->n);
+    if ((builtinsInternalObject **)NULL == fo->objs) {
+        *pError = CKR_HOST_MEMORY;
+        goto loser;
+    }
+
+    (void)nsslibc_memcpy(fo->objs, temp, sizeof(builtinsInternalObject *) * fo->n);
+    if (tempIsHeapAllocated) {
+        nss_ZFreeIf(temp);
+        temp = (builtinsInternalObject **)NULL;
+    }
+
+    return rv;
+
+loser:
+    if (tempIsHeapAllocated) {
+        nss_ZFreeIf(temp);
+    }
+    nss_ZFreeIf(fo);
+    nss_ZFreeIf(rv);
+    if ((NSSArena *)NULL != arena) {
+        NSSArena_Destroy(arena);
+    }
+    return (NSSCKMDFindObjects *)NULL;
+}

security/nss/lib/ckfw/builtins/binst.c

@@ -0,0 +1,87 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "builtins.h"
+
+/*
+ * builtins/instance.c
+ *
+ * This file implements the NSSCKMDInstance object for the
+ * "builtin objects" cryptoki module.
+ */
+
+/*
+ * NSSCKMDInstance methods
+ */
+
+static CK_ULONG
+builtins_mdInstance_GetNSlots(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (CK_ULONG)1;
+}
+
+static CK_VERSION
+builtins_mdInstance_GetCryptokiVersion(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return nss_builtins_CryptokiVersion;
+}
+
+static NSSUTF8 *
+builtins_mdInstance_GetManufacturerID(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_builtins_ManufacturerID;
+}
+
+static NSSUTF8 *
+builtins_mdInstance_GetLibraryDescription(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_builtins_LibraryDescription;
+}
+
+static CK_VERSION
+builtins_mdInstance_GetLibraryVersion(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+#define NSS_VERSION_VARIABLE __nss_builtins_version
+#include "verref.h"
+    return nss_builtins_LibraryVersion;
+}
+
+static CK_RV
+builtins_mdInstance_GetSlots(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    NSSCKMDSlot *slots[])
+{
+    slots[0] = (NSSCKMDSlot *)&nss_builtins_mdSlot;
+    return CKR_OK;
+}
+
+const NSSCKMDInstance
+    nss_builtins_mdInstance = {
+        (void *)NULL, /* etc */
+        NULL,         /* Initialize */
+        NULL,         /* Finalize */
+        builtins_mdInstance_GetNSlots,
+        builtins_mdInstance_GetCryptokiVersion,
+        builtins_mdInstance_GetManufacturerID,
+        builtins_mdInstance_GetLibraryDescription,
+        builtins_mdInstance_GetLibraryVersion,
+        NULL, /* ModuleHandlesSessionObjects -- defaults to false */
+        builtins_mdInstance_GetSlots,
+        NULL,        /* WaitForSlotEvent */
+        (void *)NULL /* null terminator */
+    };

security/nss/lib/ckfw/builtins/bobject.c

@@ -0,0 +1,206 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "builtins.h"
+
+/*
+ * builtins/object.c
+ *
+ * This file implements the NSSCKMDObject object for the
+ * "builtin objects" cryptoki module.
+ */
+
+/*
+ * Finalize - unneeded
+ * Destroy - CKR_SESSION_READ_ONLY
+ * IsTokenObject - CK_TRUE
+ * GetAttributeCount
+ * GetAttributeTypes
+ * GetAttributeSize
+ * GetAttribute
+ * SetAttribute - unneeded
+ * GetObjectSize
+ */
+
+static CK_RV
+builtins_mdObject_Destroy(
+    NSSCKMDObject *mdObject,
+    NSSCKFWObject *fwObject,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return CKR_SESSION_READ_ONLY;
+}
+
+static CK_BBOOL
+builtins_mdObject_IsTokenObject(
+    NSSCKMDObject *mdObject,
+    NSSCKFWObject *fwObject,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return CK_TRUE;
+}
+
+static CK_ULONG
+builtins_mdObject_GetAttributeCount(
+    NSSCKMDObject *mdObject,
+    NSSCKFWObject *fwObject,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    builtinsInternalObject *io = (builtinsInternalObject *)mdObject->etc;
+    return io->n;
+}
+
+static CK_RV
+builtins_mdObject_GetAttributeTypes(
+    NSSCKMDObject *mdObject,
+    NSSCKFWObject *fwObject,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_ATTRIBUTE_TYPE_PTR typeArray,
+    CK_ULONG ulCount)
+{
+    builtinsInternalObject *io = (builtinsInternalObject *)mdObject->etc;
+    CK_ULONG i;
+
+    if (io->n != ulCount) {
+        return CKR_BUFFER_TOO_SMALL;
+    }
+
+    for (i = 0; i < io->n; i++) {
+        typeArray[i] = io->types[i];
+    }
+
+    return CKR_OK;
+}
+
+static CK_ULONG
+builtins_mdObject_GetAttributeSize(
+    NSSCKMDObject *mdObject,
+    NSSCKFWObject *fwObject,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_ATTRIBUTE_TYPE attribute,
+    CK_RV *pError)
+{
+    builtinsInternalObject *io = (builtinsInternalObject *)mdObject->etc;
+    CK_ULONG i;
+
+    for (i = 0; i < io->n; i++) {
+        if (attribute == io->types[i]) {
+            return (CK_ULONG)(io->items[i].size);
+        }
+    }
+
+    *pError = CKR_ATTRIBUTE_TYPE_INVALID;
+    return 0;
+}
+
+static NSSCKFWItem
+builtins_mdObject_GetAttribute(
+    NSSCKMDObject *mdObject,
+    NSSCKFWObject *fwObject,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_ATTRIBUTE_TYPE attribute,
+    CK_RV *pError)
+{
+    NSSCKFWItem mdItem;
+    builtinsInternalObject *io = (builtinsInternalObject *)mdObject->etc;
+    CK_ULONG i;
+
+    mdItem.needsFreeing = PR_FALSE;
+    mdItem.item = (NSSItem *)NULL;
+
+    for (i = 0; i < io->n; i++) {
+        if (attribute == io->types[i]) {
+            mdItem.item = (NSSItem *)&io->items[i];
+            return mdItem;
+        }
+    }
+
+    *pError = CKR_ATTRIBUTE_TYPE_INVALID;
+    return mdItem;
+}
+
+static CK_ULONG
+builtins_mdObject_GetObjectSize(
+    NSSCKMDObject *mdObject,
+    NSSCKFWObject *fwObject,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    builtinsInternalObject *io = (builtinsInternalObject *)mdObject->etc;
+    CK_ULONG i;
+    CK_ULONG rv = sizeof(CK_ULONG);
+
+    for (i = 0; i < io->n; i++) {
+        rv += sizeof(CK_ATTRIBUTE_TYPE) + sizeof(NSSItem) + io->items[i].size;
+    }
+
+    return rv;
+}
+
+static const NSSCKMDObject
+    builtins_prototype_mdObject = {
+        (void *)NULL, /* etc */
+        NULL,         /* Finalize */
+        builtins_mdObject_Destroy,
+        builtins_mdObject_IsTokenObject,
+        builtins_mdObject_GetAttributeCount,
+        builtins_mdObject_GetAttributeTypes,
+        builtins_mdObject_GetAttributeSize,
+        builtins_mdObject_GetAttribute,
+        NULL, /* FreeAttribute */
+        NULL, /* SetAttribute */
+        builtins_mdObject_GetObjectSize,
+        (void *)NULL /* null terminator */
+    };
+
+NSS_IMPLEMENT NSSCKMDObject *
+nss_builtins_CreateMDObject(
+    NSSArena *arena,
+    builtinsInternalObject *io,
+    CK_RV *pError)
+{
+    if ((void *)NULL == io->mdObject.etc) {
+        (void)nsslibc_memcpy(&io->mdObject, &builtins_prototype_mdObject,
+                             sizeof(builtins_prototype_mdObject));
+        io->mdObject.etc = (void *)io;
+    }
+
+    return &io->mdObject;
+}

security/nss/lib/ckfw/builtins/bsession.c

@@ -0,0 +1,71 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "builtins.h"
+
+/*
+ * builtins/session.c
+ *
+ * This file implements the NSSCKMDSession object for the
+ * "builtin objects" cryptoki module.
+ */
+
+static NSSCKMDFindObjects *
+builtins_mdSession_FindObjectsInit(
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    CK_RV *pError)
+{
+    return nss_builtins_FindObjectsInit(fwSession, pTemplate, ulAttributeCount, pError);
+}
+
+NSS_IMPLEMENT NSSCKMDSession *
+nss_builtins_CreateSession(
+    NSSCKFWSession *fwSession,
+    CK_RV *pError)
+{
+    NSSArena *arena;
+    NSSCKMDSession *rv;
+
+    arena = NSSCKFWSession_GetArena(fwSession, pError);
+    if ((NSSArena *)NULL == arena) {
+        return (NSSCKMDSession *)NULL;
+    }
+
+    rv = nss_ZNEW(arena, NSSCKMDSession);
+    if ((NSSCKMDSession *)NULL == rv) {
+        *pError = CKR_HOST_MEMORY;
+        return (NSSCKMDSession *)NULL;
+    }
+
+    /*
+     * rv was zeroed when allocated, so we only
+     * need to set the non-zero members.
+     */
+
+    rv->etc = (void *)fwSession;
+    /* rv->Close */
+    /* rv->GetDeviceError */
+    /* rv->Login */
+    /* rv->Logout */
+    /* rv->InitPIN */
+    /* rv->SetPIN */
+    /* rv->GetOperationStateLen */
+    /* rv->GetOperationState */
+    /* rv->SetOperationState */
+    /* rv->CreateObject */
+    /* rv->CopyObject */
+    rv->FindObjectsInit = builtins_mdSession_FindObjectsInit;
+    /* rv->SeedRandom */
+    /* rv->GetRandom */
+    /* rv->null */
+
+    return rv;
+}

security/nss/lib/ckfw/builtins/bslot.c

@@ -0,0 +1,81 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "builtins.h"
+
+/*
+ * builtins/slot.c
+ *
+ * This file implements the NSSCKMDSlot object for the
+ * "builtin objects" cryptoki module.
+ */
+
+static NSSUTF8 *
+builtins_mdSlot_GetSlotDescription(
+    NSSCKMDSlot *mdSlot,
+    NSSCKFWSlot *fwSlot,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_builtins_SlotDescription;
+}
+
+static NSSUTF8 *
+builtins_mdSlot_GetManufacturerID(
+    NSSCKMDSlot *mdSlot,
+    NSSCKFWSlot *fwSlot,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_builtins_ManufacturerID;
+}
+
+static CK_VERSION
+builtins_mdSlot_GetHardwareVersion(
+    NSSCKMDSlot *mdSlot,
+    NSSCKFWSlot *fwSlot,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return nss_builtins_HardwareVersion;
+}
+
+static CK_VERSION
+builtins_mdSlot_GetFirmwareVersion(
+    NSSCKMDSlot *mdSlot,
+    NSSCKFWSlot *fwSlot,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return nss_builtins_FirmwareVersion;
+}
+
+static NSSCKMDToken *
+builtins_mdSlot_GetToken(
+    NSSCKMDSlot *mdSlot,
+    NSSCKFWSlot *fwSlot,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSCKMDToken *)&nss_builtins_mdToken;
+}
+
+const NSSCKMDSlot
+    nss_builtins_mdSlot = {
+        (void *)NULL, /* etc */
+        NULL,         /* Initialize */
+        NULL,         /* Destroy */
+        builtins_mdSlot_GetSlotDescription,
+        builtins_mdSlot_GetManufacturerID,
+        NULL, /* GetTokenPresent -- defaults to true */
+        NULL, /* GetRemovableDevice -- defaults to false */
+        NULL, /* GetHardwareSlot -- defaults to false */
+        builtins_mdSlot_GetHardwareVersion,
+        builtins_mdSlot_GetFirmwareVersion,
+        builtins_mdSlot_GetToken,
+        (void *)NULL /* null terminator */
+    };

security/nss/lib/ckfw/builtins/btoken.c

@@ -0,0 +1,135 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "builtins.h"
+
+/*
+ * builtins/token.c
+ *
+ * This file implements the NSSCKMDToken object for the
+ * "builtin objects" cryptoki module.
+ */
+
+static NSSUTF8 *
+builtins_mdToken_GetLabel(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_builtins_TokenLabel;
+}
+
+static NSSUTF8 *
+builtins_mdToken_GetManufacturerID(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_builtins_ManufacturerID;
+}
+
+static NSSUTF8 *
+builtins_mdToken_GetModel(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_builtins_TokenModel;
+}
+
+static NSSUTF8 *
+builtins_mdToken_GetSerialNumber(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_builtins_TokenSerialNumber;
+}
+
+static CK_BBOOL
+builtins_mdToken_GetIsWriteProtected(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return CK_TRUE;
+}
+
+static CK_VERSION
+builtins_mdToken_GetHardwareVersion(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return nss_builtins_HardwareVersion;
+}
+
+static CK_VERSION
+builtins_mdToken_GetFirmwareVersion(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return nss_builtins_FirmwareVersion;
+}
+
+static NSSCKMDSession *
+builtins_mdToken_OpenSession(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    NSSCKFWSession *fwSession,
+    CK_BBOOL rw,
+    CK_RV *pError)
+{
+    return nss_builtins_CreateSession(fwSession, pError);
+}
+
+const NSSCKMDToken
+    nss_builtins_mdToken = {
+        (void *)NULL, /* etc */
+        NULL,         /* Setup */
+        NULL,         /* Invalidate */
+        NULL,         /* InitToken -- default errs */
+        builtins_mdToken_GetLabel,
+        builtins_mdToken_GetManufacturerID,
+        builtins_mdToken_GetModel,
+        builtins_mdToken_GetSerialNumber,
+        NULL, /* GetHasRNG -- default is false */
+        builtins_mdToken_GetIsWriteProtected,
+        NULL, /* GetLoginRequired -- default is false */
+        NULL, /* GetUserPinInitialized -- default is false */
+        NULL, /* GetRestoreKeyNotNeeded -- irrelevant */
+        NULL, /* GetHasClockOnToken -- default is false */
+        NULL, /* GetHasProtectedAuthenticationPath -- default is false */
+        NULL, /* GetSupportsDualCryptoOperations -- default is false */
+        NULL, /* GetMaxSessionCount -- default is CK_UNAVAILABLE_INFORMATION */
+        NULL, /* GetMaxRwSessionCount -- default is CK_UNAVAILABLE_INFORMATION */
+        NULL, /* GetMaxPinLen -- irrelevant */
+        NULL, /* GetMinPinLen -- irrelevant */
+        NULL, /* GetTotalPublicMemory -- default is CK_UNAVAILABLE_INFORMATION */
+        NULL, /* GetFreePublicMemory -- default is CK_UNAVAILABLE_INFORMATION */
+        NULL, /* GetTotalPrivateMemory -- default is CK_UNAVAILABLE_INFORMATION */
+        NULL, /* GetFreePrivateMemory -- default is CK_UNAVAILABLE_INFORMATION */
+        builtins_mdToken_GetHardwareVersion,
+        builtins_mdToken_GetFirmwareVersion,
+        NULL, /* GetUTCTime -- no clock */
+        builtins_mdToken_OpenSession,
+        NULL,        /* GetMechanismCount -- default is zero */
+        NULL,        /* GetMechanismTypes -- irrelevant */
+        NULL,        /* GetMechanism -- irrelevant */
+        (void *)NULL /* null terminator */
+    };

security/nss/lib/ckfw/builtins/builtins.gyp

@@ -0,0 +1,61 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'nssckbi',
+      'type': 'shared_library',
+      'sources': [
+        'anchor.c',
+        'bfind.c',
+        'binst.c',
+        'bobject.c',
+        'bsession.c',
+        'bslot.c',
+        'btoken.c',
+        'ckbiver.c',
+        'constants.c',
+        '<(INTERMEDIATE_DIR)/certdata.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports',
+        '<(DEPTH)/lib/ckfw/ckfw.gyp:nssckfw',
+        '<(DEPTH)/lib/base/base.gyp:nssb'
+      ],
+      'actions': [
+        {
+          'msvs_cygwin_shell': 0,
+          'action': [
+            'perl',
+            'certdata.perl',
+            'certdata.txt',
+            '<@(_outputs)',
+          ],
+          'inputs': [
+            'certdata.perl',
+            'certdata.txt'
+          ],
+          'outputs': [
+            '<(INTERMEDIATE_DIR)/certdata.c'
+          ],
+          'action_name': 'generate_certdata_c'
+        }
+      ],
+      'variables': {
+        'mapfile': 'nssckbi.def'
+      }
+    }
+  ],
+  'target_defaults': {
+    'include_dirs': [
+      '.'
+    ]
+  },
+  'variables': {
+    'module': 'nss',
+  }
+}

security/nss/lib/ckfw/builtins/builtins.h

@@ -0,0 +1,66 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nssckmdt.h"
+#include "nssckfw.h"
+
+/*
+ * I'm including this for access to the arena functions.
+ * Looks like we should publish that API.
+ */
+#ifndef BASE_H
+#include "base.h"
+#endif /* BASE_H */
+
+/*
+ * This is where the Netscape extensions live, at least for now.
+ */
+#ifndef CKT_H
+#include "ckt.h"
+#endif /* CKT_H */
+
+struct builtinsInternalObjectStr {
+    CK_ULONG n;
+    const CK_ATTRIBUTE_TYPE *types;
+    const NSSItem *items;
+    NSSCKMDObject mdObject;
+};
+typedef struct builtinsInternalObjectStr builtinsInternalObject;
+
+extern builtinsInternalObject nss_builtins_data[];
+extern const PRUint32 nss_builtins_nObjects;
+
+extern const CK_VERSION nss_builtins_CryptokiVersion;
+extern const CK_VERSION nss_builtins_LibraryVersion;
+extern const CK_VERSION nss_builtins_HardwareVersion;
+extern const CK_VERSION nss_builtins_FirmwareVersion;
+
+extern const NSSUTF8 nss_builtins_ManufacturerID[];
+extern const NSSUTF8 nss_builtins_LibraryDescription[];
+extern const NSSUTF8 nss_builtins_SlotDescription[];
+extern const NSSUTF8 nss_builtins_TokenLabel[];
+extern const NSSUTF8 nss_builtins_TokenModel[];
+extern const NSSUTF8 nss_builtins_TokenSerialNumber[];
+
+extern const NSSCKMDInstance nss_builtins_mdInstance;
+extern const NSSCKMDSlot nss_builtins_mdSlot;
+extern const NSSCKMDToken nss_builtins_mdToken;
+
+NSS_EXTERN NSSCKMDSession *
+nss_builtins_CreateSession(
+    NSSCKFWSession *fwSession,
+    CK_RV *pError);
+
+NSS_EXTERN NSSCKMDFindObjects *
+nss_builtins_FindObjectsInit(
+    NSSCKFWSession *fwSession,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    CK_RV *pError);
+
+NSS_EXTERN NSSCKMDObject *
+nss_builtins_CreateMDObject(
+    NSSArena *arena,
+    builtinsInternalObject *io,
+    CK_RV *pError);

security/nss/lib/ckfw/builtins/certdata.perl

@@ -0,0 +1,192 @@
+#!perl -w
+# 
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+use strict;
+
+my %constants;
+my $count = 0;
+my $o;
+my @objects = ();
+my @objsize;
+
+$constants{CK_TRUE} = "static const CK_BBOOL ck_true = CK_TRUE;\n";
+$constants{CK_FALSE} = "static const CK_BBOOL ck_false = CK_FALSE;\n";
+
+if( scalar @ARGV == 0 ) {
+  print STDERR "Usage: $0 <input-file> [output-file]\n";
+  exit 1;
+}
+
+open(STDIN, '<', $ARGV[0])
+  or die "Could not open input file '$ARGV[0]' $!";
+if( scalar @ARGV > 1 ) {
+  open(STDOUT, '>', $ARGV[1])
+    or die "Could not open output file '$ARGV[1]' $!";
+}
+
+while(<>) {
+  my @fields = ();
+  my $size;
+
+  s/^((?:[^"#]+|"[^"]*")*)(\s*#.*$)/$1/;
+  next if (/^\s*$/);
+
+  # This was taken from the perl faq #4.
+  my $text = $_;
+  push(@fields, $+) while $text =~ m{
+      "([^\"\\]*(?:\\.[^\"\\]*)*)"\s?  # groups the phrase inside the quotes
+    | ([^\s]+)\s?
+    | \s
+  }gx;
+  push(@fields, undef) if substr($text,-1,1) eq '\s';
+
+  if( $fields[0] =~ /BEGINDATA/ ) {
+    next;
+  }
+
+  if( $fields[1] =~ /MULTILINE/ ) {
+    $fields[2] = "";
+    while(<>) {
+      last if /END/;
+      chomp;
+      $fields[2] .= "\"$_\"\n";
+    }
+  }
+
+  if( $fields[1] =~ /UTF8/ ) {
+    if( $fields[2] =~ /^"/ ) {
+      ;
+    } else {
+      $fields[2] = "\"" . $fields[2] . "\"";
+    }
+
+    my $scratch = eval($fields[2]);
+
+    $size = length($scratch) + 1; # null terminate
+  }
+
+  if( $fields[1] =~ /OCTAL/ ) {
+    if( $fields[2] =~ /^"/ ) {
+      ;
+    } else {
+      $fields[2] = "\"" . $fields[2] . "\"";
+    }
+
+    my $scratch = $fields[2];
+    $size = $scratch =~ tr/\\//;
+    # no null termination
+  }
+
+  if( $fields[1] =~ /^CK_/ ) {
+    my $lcv = $fields[2];
+    $lcv =~ tr/A-Z/a-z/;
+    if( !defined($constants{$fields[2]}) ) {
+      $constants{$fields[2]} = "static const $fields[1] $lcv = $fields[2];\n";
+    }
+    
+    $size = "sizeof($fields[1])";
+    $fields[2] = "&$lcv";
+  }
+
+  if( $fields[0] =~ /CKA_CLASS/ ) {
+    $count++;
+    $objsize[$count] = 0;
+  }
+
+  @{$objects[$count][$objsize[$count]++]} = ( "$fields[0]", $fields[2], "$size" );
+
+ # print "$fields[0] | $fields[1] | $size | $fields[2]\n";
+}
+
+doprint();
+
+sub dudump {
+my $i;
+for( $i = 1; $i <= $count; $i++ ) {
+  print "\n";
+  $o = $objects[$i];
+  my @ob = @{$o};
+  my $l;
+  my $j;
+  for( $j = 0; $j < @ob; $j++ ) {
+    $l = $ob[$j];
+    my @a = @{$l};
+    print "$a[0] ! $a[1] ! $a[2]\n";
+  }
+}
+
+}
+
+sub doprint {
+my $i;
+
+print <<EOD
+/* THIS IS A GENERATED FILE */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef BUILTINS_H
+#include "builtins.h"
+#endif /* BUILTINS_H */
+
+EOD
+    ;
+
+foreach $b (sort values(%constants)) {
+  print $b;
+}
+
+for( $i = 1; $i <= $count; $i++ ) {
+  print "static const CK_ATTRIBUTE_TYPE nss_builtins_types_$i [] = {\n";
+  $o = $objects[$i];
+  my @ob = @{$o};
+  my $j;
+  for( $j = 0; $j < @ob; $j++ ) {
+    my $l = $ob[$j];
+    my @a = @{$l};
+    print " $a[0]";
+    if( $j+1 != @ob ) {
+      print ", ";
+    }
+  }
+  print "\n};\n";
+}
+
+for( $i = 1; $i <= $count; $i++ ) {
+  print "static const NSSItem nss_builtins_items_$i [] = {\n";
+  $o = $objects[$i];
+  my @ob = @{$o};
+  my $j;
+  for( $j = 0; $j < @ob; $j++ ) {
+    my $l = $ob[$j];
+    my @a = @{$l};
+    print "  { (void *)$a[1], (PRUint32)$a[2] }";
+    if( $j+1 != @ob ) {
+      print ",\n";
+    } else {
+      print "\n";
+    }
+  }
+  print "};\n";
+}
+
+print "\nbuiltinsInternalObject\n";
+print "nss_builtins_data[] = {\n";
+
+for( $i = 1; $i <= $count; $i++ ) {
+  print "  { $objsize[$i], nss_builtins_types_$i, nss_builtins_items_$i, {NULL} }";
+  if( $i == $count ) {
+    print "\n";
+  } else {
+    print ",\n";
+  }
+}
+
+print "};\n";
+
+print "const PRUint32\n";
+print "nss_builtins_nObjects = $count;\n";
+}

security/nss/lib/ckfw/builtins/ckbiver.c

@@ -0,0 +1,18 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* Library identity and versioning */
+
+#include "nssckbi.h"
+
+#if defined(DEBUG)
+#define _DEBUG_STRING " (debug)"
+#else
+#define _DEBUG_STRING ""
+#endif
+
+/*
+ * Version information
+ */
+const char __nss_builtins_version[] = "Version: NSS Builtin Trusted Root CAs " NSS_BUILTINS_LIBRARY_VERSION _DEBUG_STRING;

security/nss/lib/ckfw/builtins/config.mk

@@ -0,0 +1,38 @@
+# 
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#
+#  Override TARGETS variable so that only shared libraries
+#  are specifed as dependencies within rules.mk.
+#
+
+TARGETS        = $(SHARED_LIBRARY)
+LIBRARY        =
+IMPORT_LIBRARY =
+PROGRAM        =
+
+ifeq (,$(filter-out WIN%,$(OS_TARGET)))
+    SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+    RES = $(OBJDIR)/$(LIBRARY_NAME).res
+    RESNAME = $(LIBRARY_NAME).rc
+endif
+
+ifdef BUILD_IDG
+    DEFINES += -DNSSDEBUG
+endif
+
+# Needed for compilation of $(OBJDIR)/certdata.c
+INCLUDES += -I.
+
+#
+# To create a loadable module on Darwin, we must use -bundle.
+#
+ifeq ($(OS_TARGET),Darwin)
+DSO_LDOPTS = -bundle
+endif
+
+ifdef USE_GCOV
+DSO_LDOPTS += --coverage
+endif

security/nss/lib/ckfw/builtins/constants.c

@@ -0,0 +1,64 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * builtins/constants.c
+ *
+ * Identification and other constants, all collected here in one place.
+ */
+
+#ifndef NSSBASET_H
+#include "nssbaset.h"
+#endif /* NSSBASET_H */
+
+#ifndef NSSCKT_H
+#include "nssckt.h"
+#endif /* NSSCKT_H */
+
+#ifndef NSSCKBI_H
+#include "nssckbi.h"
+#endif /* NSSCKBI_H */
+
+const CK_VERSION
+    nss_builtins_CryptokiVersion = {
+        NSS_BUILTINS_CRYPTOKI_VERSION_MAJOR,
+        NSS_BUILTINS_CRYPTOKI_VERSION_MINOR
+    };
+
+const CK_VERSION
+    nss_builtins_LibraryVersion = {
+        NSS_BUILTINS_LIBRARY_VERSION_MAJOR,
+        NSS_BUILTINS_LIBRARY_VERSION_MINOR
+    };
+
+const CK_VERSION
+    nss_builtins_HardwareVersion = {
+        NSS_BUILTINS_HARDWARE_VERSION_MAJOR,
+        NSS_BUILTINS_HARDWARE_VERSION_MINOR
+    };
+
+const CK_VERSION
+    nss_builtins_FirmwareVersion = {
+        NSS_BUILTINS_FIRMWARE_VERSION_MAJOR,
+        NSS_BUILTINS_FIRMWARE_VERSION_MINOR
+    };
+
+const NSSUTF8
+    nss_builtins_ManufacturerID[] = { "Mozilla Foundation" };
+
+const NSSUTF8
+    nss_builtins_LibraryDescription[] = { "NSS Builtin Object Cryptoki Module" };
+
+const NSSUTF8
+    nss_builtins_SlotDescription[] = { "NSS Builtin Objects" };
+
+const NSSUTF8
+    nss_builtins_TokenLabel[] = { "Builtin Object Token" };
+
+const NSSUTF8
+    nss_builtins_TokenModel[] = { "1" };
+
+/* should this be e.g. the certdata.txt RCS revision number? */
+const NSSUTF8
+    nss_builtins_TokenSerialNumber[] = { "1" };

security/nss/lib/ckfw/builtins/exports.gyp

@@ -0,0 +1,25 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_ckfw_builtins_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'nssckbi.h'
+          ],
+          'destination': '<(nss_public_dist_dir)/<(module)'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}

security/nss/lib/ckfw/builtins/manifest.mn

@@ -0,0 +1,30 @@
+# 
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+CORE_DEPTH = ../../..
+
+MODULE = nss
+MAPFILE = $(OBJDIR)/nssckbi.def
+
+EXPORTS =		\
+	nssckbi.h	\
+	$(NULL)
+
+CSRCS =			\
+	anchor.c	\
+	constants.c	\
+	bfind.c		\
+	binst.c 	\
+	bobject.c	\
+	bsession.c	\
+	bslot.c		\
+	btoken.c	\
+	certdata.c	\
+	ckbiver.c	\
+	$(NULL)
+
+REQUIRES = nspr
+
+LIBRARY_NAME = nssckbi

security/nss/lib/ckfw/builtins/nssckbi.def

@@ -0,0 +1,26 @@
+;+#
+;+# This Source Code Form is subject to the terms of the Mozilla Public
+;+# License, v. 2.0. If a copy of the MPL was not distributed with this
+;+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;+#
+;+# OK, this file is meant to support SUN, LINUX, AIX and WINDOWS
+;+#   1. For all unix platforms, the string ";-"  means "remove this line"
+;+#   2. For all unix platforms, the string " DATA " will be removed from any 
+;+#     line on which it occurs.
+;+#   3. Lines containing ";+" will have ";+" removed on SUN and LINUX.
+;+#      On AIX, lines containing ";+" will be removed.
+;+#   4. For all unix platforms, the string ";;" will thave the ";;" removed.
+;+#   5. For all unix platforms, after the above processing has taken place,
+;+#    all characters after the first ";" on the line will be removed.
+;+#    And for AIX, the first ";" will also be removed.
+;+#  This file is passed directly to windows. Since ';' is a comment, all UNIX
+;+#   directives are hidden behind ";", ";+", and ";-"
+;+
+;+NSS_3.1 {       # NSS 3.1 release
+;+    global:
+LIBRARY nssckbi ;-
+EXPORTS ;-
+C_GetFunctionList;
+;+    local:
+;+*;
+;+};

security/nss/lib/ckfw/builtins/nssckbi.h

@@ -0,0 +1,61 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef NSSCKBI_H
+#define NSSCKBI_H
+
+/*
+ * NSS BUILTINS Version numbers.
+ *
+ * These are the version numbers for the builtins module packaged with
+ * this release on NSS. To determine the version numbers of the builtin
+ * module you are using, use the appropriate PKCS #11 calls.
+ *
+ * These version numbers detail changes to the PKCS #11 interface. They map
+ * to the PKCS #11 spec versions.
+ */
+#define NSS_BUILTINS_CRYPTOKI_VERSION_MAJOR 2
+#define NSS_BUILTINS_CRYPTOKI_VERSION_MINOR 20
+
+/* These version numbers detail the changes
+ * to the list of trusted certificates.
+ *
+ * The NSS_BUILTINS_LIBRARY_VERSION_MINOR macro needs to be bumped
+ * whenever we change the list of trusted certificates.
+ *
+ * Please use the following rules when increasing the version number:
+ *
+ * - starting with version 2.14, NSS_BUILTINS_LIBRARY_VERSION_MINOR
+ *   must always be an EVEN number (e.g. 16, 18, 20 etc.)
+ *
+ * - whenever possible, if older branches require a modification to the
+ *   list, these changes should be made on the main line of development (trunk),
+ *   and the older branches should update to the most recent list.
+ * 
+ * - ODD minor version numbers are reserved to indicate a snapshot that has
+ *   deviated from the main line of development, e.g. if it was necessary
+ *   to modify the list on a stable branch.
+ *   Once the version has been changed to an odd number (e.g. 2.13) on a branch,
+ *   it should remain unchanged on that branch, even if further changes are
+ *   made on that branch.
+ *
+ * NSS_BUILTINS_LIBRARY_VERSION_MINOR is a CK_BYTE.  It's not clear
+ * whether we may use its full range (0-255) or only 0-99 because
+ * of the comment in the CK_VERSION type definition.
+ * It's recommend to switch back to 0 after having reached version 98/99.
+ */
+#define NSS_BUILTINS_LIBRARY_VERSION_MAJOR 2
+#define NSS_BUILTINS_LIBRARY_VERSION_MINOR 14
+#define NSS_BUILTINS_LIBRARY_VERSION "2.14"
+
+/* These version numbers detail the semantic changes to the ckfw engine. */
+#define NSS_BUILTINS_HARDWARE_VERSION_MAJOR 1
+#define NSS_BUILTINS_HARDWARE_VERSION_MINOR 0
+
+/* These version numbers detail the semantic changes to ckbi itself
+ * (new PKCS #11 objects), etc. */
+#define NSS_BUILTINS_FIRMWARE_VERSION_MAJOR 1
+#define NSS_BUILTINS_FIRMWARE_VERSION_MINOR 0
+
+#endif /* NSSCKBI_H */

security/nss/lib/ckfw/builtins/nssckbi.rc

@@ -0,0 +1,64 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nssckbi.h"
+#include <winver.h>
+
+#define MY_LIBNAME "nssckbi"
+#define MY_FILEDESCRIPTION "NSS Builtin Trusted Root CAs"
+
+#ifdef _DEBUG
+#define MY_DEBUG_STR " (debug)"
+#define MY_FILEFLAGS_1 VS_FF_DEBUG
+#else
+#define MY_DEBUG_STR ""
+#define MY_FILEFLAGS_1 0x0L
+#endif
+#if NSS_BETA
+#define MY_FILEFLAGS_2 MY_FILEFLAGS_1|VS_FF_PRERELEASE
+#else
+#define MY_FILEFLAGS_2 MY_FILEFLAGS_1
+#endif
+
+#ifdef WINNT
+#define MY_FILEOS VOS_NT_WINDOWS32
+#else
+#define MY_FILEOS VOS__WINDOWS32
+#endif
+
+#define MY_INTERNAL_NAME MY_LIBNAME
+
+/////////////////////////////////////////////////////////////////////////////
+//
+// Version-information resource
+//
+
+VS_VERSION_INFO VERSIONINFO
+ FILEVERSION NSS_BUILTINS_LIBRARY_VERSION_MAJOR,NSS_BUILTINS_LIBRARY_VERSION_MINOR,0,0
+ PRODUCTVERSION NSS_BUILTINS_LIBRARY_VERSION_MAJOR,NSS_BUILTINS_LIBRARY_VERSION_MINOR,0,0
+ FILEFLAGSMASK VS_FFI_FILEFLAGSMASK
+ FILEFLAGS MY_FILEFLAGS_2
+ FILEOS MY_FILEOS
+ FILETYPE VFT_DLL
+ FILESUBTYPE 0x0L // not used
+
+BEGIN
+    BLOCK "StringFileInfo"
+    BEGIN
+        BLOCK "040904B0" // Lang=US English, CharSet=Unicode
+        BEGIN
+            VALUE "CompanyName", "Mozilla Foundation\0"
+            VALUE "FileDescription", MY_FILEDESCRIPTION MY_DEBUG_STR "\0"
+            VALUE "FileVersion", NSS_BUILTINS_LIBRARY_VERSION "\0"
+            VALUE "InternalName", MY_INTERNAL_NAME "\0"
+            VALUE "OriginalFilename", MY_INTERNAL_NAME ".dll\0"
+            VALUE "ProductName", "Network Security Services\0"
+            VALUE "ProductVersion", NSS_BUILTINS_LIBRARY_VERSION "\0"
+        END
+    END
+    BLOCK "VarFileInfo"
+    BEGIN
+        VALUE "Translation", 0x409, 1200
+    END
+END

security/nss/lib/ckfw/capi/Makefile

@@ -0,0 +1,75 @@
+# 
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+include manifest.mn
+include $(CORE_DEPTH)/coreconf/config.mk
+include config.mk
+
+EXTRA_LIBS = \
+	$(DIST)/lib/$(LIB_PREFIX)nssckfw.$(LIB_SUFFIX) \
+	$(DIST)/lib/$(LIB_PREFIX)nssb.$(LIB_SUFFIX) \
+	$(NULL)
+
+# can't do this in manifest.mn because OS_TARGET isn't defined there.
+ifeq (,$(filter-out WIN%,$(OS_TARGET)))
+
+ifdef NS_USE_GCC
+EXTRA_LIBS += \
+	-L$(NSPR_LIB_DIR) \
+	-lplc4 \
+	-lplds4 \
+	-lnspr4 \
+	-lcrypt32 \
+	-ladvapi32 \
+	-lrpcrt4 \
+	$(NULL)
+else 
+EXTRA_SHARED_LIBS += \
+        $(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plc4.lib \
+        $(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plds4.lib \
+        $(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)nspr4.lib \
+        crypt32.lib \
+	advapi32.lib \
+	rpcrt4.lib \
+        $(NULL)
+endif # NS_USE_GCC
+else
+
+EXTRA_LIBS += \
+	-L$(NSPR_LIB_DIR) \
+	-lplc4 \
+	-lplds4 \
+	-lnspr4 \
+	$(NULL)
+endif
+
+
+include $(CORE_DEPTH)/coreconf/rules.mk
+
+# Generate certdata.c.
+generate:
+	$(PERL) certdata.perl < certdata.txt
+
+# This'll need some help from a build person.
+
+
+ifeq ($(OS_TARGET)$(OS_RELEASE), AIX4.1)
+DSO_LDOPTS              = -bM:SRE -bh:4 -bnoentry
+EXTRA_DSO_LDOPTS        = -lc
+MKSHLIB                 = xlC $(DSO_LDOPTS)
+
+$(SHARED_LIBRARY): $(OBJS)
+	@$(MAKE_OBJDIR)
+	rm -f $@
+	$(MKSHLIB) -o $@ $(OBJS) $(EXTRA_LIBS) $(EXTRA_DSO_LDOPTS)
+	chmod +x $@
+
+endif
+
+ifeq ($(OS_TARGET)$(OS_RELEASE), AIX4.2)
+LD      += -G
+endif 
+
+

security/nss/lib/ckfw/capi/README

@@ -0,0 +1,7 @@
+This Cryptoki module provides acces to certs and keys stored in
+Microsofts CAPI certificate store.
+
+It does not import or export CA Root trust from the CAPI.
+It does not import or export CRLs from the CAPI.
+It does not handle S/MIME objects (pkcs #7 in capi terms?).
+It does not yet handle it's own PIN. (CAPI does all the pin prompting).

security/nss/lib/ckfw/capi/anchor.c

@@ -0,0 +1,17 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * capi/canchor.c
+ *
+ * This file "anchors" the actual cryptoki entry points in this module's
+ * shared library, which is required for dynamic loading.  See the
+ * comments in nssck.api for more information.
+ */
+
+#include "ckcapi.h"
+
+#define MODULE_NAME ckcapi
+#define INSTANCE_NAME (NSSCKMDInstance *)&nss_ckcapi_mdInstance
+#include "nssck.api"

security/nss/lib/ckfw/capi/cfind.c

@@ -0,0 +1,562 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef CKCAPI_H
+#include "ckcapi.h"
+#endif /* CKCAPI_H */
+
+/*
+ * ckcapi/cfind.c
+ *
+ * This file implements the NSSCKMDFindObjects object for the
+ * "capi" cryptoki module.
+ */
+
+struct ckcapiFOStr {
+    NSSArena *arena;
+    CK_ULONG n;
+    CK_ULONG i;
+    ckcapiInternalObject **objs;
+};
+
+static void
+ckcapi_mdFindObjects_Final(
+    NSSCKMDFindObjects *mdFindObjects,
+    NSSCKFWFindObjects *fwFindObjects,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    struct ckcapiFOStr *fo = (struct ckcapiFOStr *)mdFindObjects->etc;
+    NSSArena *arena = fo->arena;
+    PRUint32 i;
+
+    /* walk down an free the unused 'objs' */
+    for (i = fo->i; i < fo->n; i++) {
+        nss_ckcapi_DestroyInternalObject(fo->objs[i]);
+    }
+
+    nss_ZFreeIf(fo->objs);
+    nss_ZFreeIf(fo);
+    nss_ZFreeIf(mdFindObjects);
+    if ((NSSArena *)NULL != arena) {
+        NSSArena_Destroy(arena);
+    }
+
+    return;
+}
+
+static NSSCKMDObject *
+ckcapi_mdFindObjects_Next(
+    NSSCKMDFindObjects *mdFindObjects,
+    NSSCKFWFindObjects *fwFindObjects,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    NSSArena *arena,
+    CK_RV *pError)
+{
+    struct ckcapiFOStr *fo = (struct ckcapiFOStr *)mdFindObjects->etc;
+    ckcapiInternalObject *io;
+
+    if (fo->i == fo->n) {
+        *pError = CKR_OK;
+        return (NSSCKMDObject *)NULL;
+    }
+
+    io = fo->objs[fo->i];
+    fo->i++;
+
+    return nss_ckcapi_CreateMDObject(arena, io, pError);
+}
+
+static CK_BBOOL
+ckcapi_attrmatch(
+    CK_ATTRIBUTE_PTR a,
+    ckcapiInternalObject *o)
+{
+    PRBool prb;
+    const NSSItem *b;
+
+    b = nss_ckcapi_FetchAttribute(o, a->type);
+    if (b == NULL) {
+        return CK_FALSE;
+    }
+
+    if (a->ulValueLen != b->size) {
+        /* match a decoded serial number */
+        if ((a->type == CKA_SERIAL_NUMBER) && (a->ulValueLen < b->size)) {
+            unsigned int len;
+            unsigned char *data;
+
+            data = nss_ckcapi_DERUnwrap(b->data, b->size, &len, NULL);
+            if ((len == a->ulValueLen) &&
+                nsslibc_memequal(a->pValue, data, len, (PRStatus *)NULL)) {
+                return CK_TRUE;
+            }
+        }
+        return CK_FALSE;
+    }
+
+    prb = nsslibc_memequal(a->pValue, b->data, b->size, (PRStatus *)NULL);
+
+    if (PR_TRUE == prb) {
+        return CK_TRUE;
+    } else {
+        return CK_FALSE;
+    }
+}
+
+static CK_BBOOL
+ckcapi_match(
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    ckcapiInternalObject *o)
+{
+    CK_ULONG i;
+
+    for (i = 0; i < ulAttributeCount; i++) {
+        if (CK_FALSE == ckcapi_attrmatch(&pTemplate[i], o)) {
+            return CK_FALSE;
+        }
+    }
+
+    /* Every attribute passed */
+    return CK_TRUE;
+}
+
+#define CKAPI_ITEM_CHUNK 20
+
+#define PUT_Object(obj, err)                                                    \
+    {                                                                           \
+        if (count >= size) {                                                    \
+            *listp = *listp ? nss_ZREALLOCARRAY(*listp, ckcapiInternalObject *, \
+                                                (size +                         \
+                                                 CKAPI_ITEM_CHUNK))             \
+                            : nss_ZNEWARRAY(NULL, ckcapiInternalObject *,       \
+                                            (size +                             \
+                                             CKAPI_ITEM_CHUNK));                \
+            if ((ckcapiInternalObject **)NULL == *listp) {                      \
+                err = CKR_HOST_MEMORY;                                          \
+                goto loser;                                                     \
+            }                                                                   \
+            size += CKAPI_ITEM_CHUNK;                                           \
+        }                                                                       \
+        (*listp)[count] = (obj);                                                \
+        count++;                                                                \
+    }
+
+/*
+ * pass parameters back through the callback.
+ */
+typedef struct BareCollectParamsStr {
+    CK_OBJECT_CLASS objClass;
+    CK_ATTRIBUTE_PTR pTemplate;
+    CK_ULONG ulAttributeCount;
+    ckcapiInternalObject ***listp;
+    PRUint32 size;
+    PRUint32 count;
+} BareCollectParams;
+
+/* collect_bare's callback. Called for each object that
+ * supposedly has a PROVINDER_INFO property */
+static BOOL WINAPI
+doBareCollect(
+    const CRYPT_HASH_BLOB *msKeyID,
+    DWORD flags,
+    void *reserved,
+    void *args,
+    DWORD cProp,
+    DWORD *propID,
+    void **propData,
+    DWORD *propSize)
+{
+    BareCollectParams *bcp = (BareCollectParams *)args;
+    PRUint32 size = bcp->size;
+    PRUint32 count = bcp->count;
+    ckcapiInternalObject ***listp = bcp->listp;
+    ckcapiInternalObject *io = NULL;
+    DWORD i;
+    CRYPT_KEY_PROV_INFO *keyProvInfo = NULL;
+    void *idData;
+    CK_RV error;
+
+    /* make sure there is a Key Provider Info property */
+    for (i = 0; i < cProp; i++) {
+        if (CERT_KEY_PROV_INFO_PROP_ID == propID[i]) {
+            keyProvInfo = (CRYPT_KEY_PROV_INFO *)propData[i];
+            break;
+        }
+    }
+    if ((CRYPT_KEY_PROV_INFO *)NULL == keyProvInfo) {
+        return 1;
+    }
+
+    /* copy the key ID */
+    idData = nss_ZNEWARRAY(NULL, char, msKeyID->cbData);
+    if ((void *)NULL == idData) {
+        goto loser;
+    }
+    nsslibc_memcpy(idData, msKeyID->pbData, msKeyID->cbData);
+
+    /* build a bare internal object */
+    io = nss_ZNEW(NULL, ckcapiInternalObject);
+    if ((ckcapiInternalObject *)NULL == io) {
+        goto loser;
+    }
+    io->type = ckcapiBareKey;
+    io->objClass = bcp->objClass;
+    io->u.key.provInfo = *keyProvInfo;
+    io->u.key.provInfo.pwszContainerName =
+        nss_ckcapi_WideDup(keyProvInfo->pwszContainerName);
+    io->u.key.provInfo.pwszProvName =
+        nss_ckcapi_WideDup(keyProvInfo->pwszProvName);
+    io->u.key.provName = nss_ckcapi_WideToUTF8(keyProvInfo->pwszProvName);
+    io->u.key.containerName =
+        nss_ckcapi_WideToUTF8(keyProvInfo->pwszContainerName);
+    io->u.key.hProv = 0;
+    io->idData = idData;
+    io->id.data = idData;
+    io->id.size = msKeyID->cbData;
+    idData = NULL;
+
+    /* see if it matches */
+    if (CK_FALSE == ckcapi_match(bcp->pTemplate, bcp->ulAttributeCount, io)) {
+        goto loser;
+    }
+    PUT_Object(io, error);
+    bcp->size = size;
+    bcp->count = count;
+    return 1;
+
+loser:
+    if (io) {
+        nss_ckcapi_DestroyInternalObject(io);
+    }
+    nss_ZFreeIf(idData);
+    return 1;
+}
+
+/*
+ * collect the bare keys running around
+ */
+static PRUint32
+collect_bare(
+    CK_OBJECT_CLASS objClass,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    ckcapiInternalObject ***listp,
+    PRUint32 *sizep,
+    PRUint32 count,
+    CK_RV *pError)
+{
+    BOOL rc;
+    BareCollectParams bareCollectParams;
+
+    bareCollectParams.objClass = objClass;
+    bareCollectParams.pTemplate = pTemplate;
+    bareCollectParams.ulAttributeCount = ulAttributeCount;
+    bareCollectParams.listp = listp;
+    bareCollectParams.size = *sizep;
+    bareCollectParams.count = count;
+
+    rc = CryptEnumKeyIdentifierProperties(NULL, CERT_KEY_PROV_INFO_PROP_ID, 0,
+                                          NULL, NULL, &bareCollectParams, doBareCollect);
+
+    *sizep = bareCollectParams.size;
+    return bareCollectParams.count;
+}
+
+/* find all the certs that represent the appropriate object (cert, priv key, or
+ *  pub key) in the cert store.
+ */
+static PRUint32
+collect_class(
+    CK_OBJECT_CLASS objClass,
+    LPCSTR storeStr,
+    PRBool hasID,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    ckcapiInternalObject ***listp,
+    PRUint32 *sizep,
+    PRUint32 count,
+    CK_RV *pError)
+{
+    PRUint32 size = *sizep;
+    ckcapiInternalObject *next = NULL;
+    HCERTSTORE hStore;
+    PCCERT_CONTEXT certContext = NULL;
+    PRBool isKey =
+        (objClass == CKO_PUBLIC_KEY) | (objClass == CKO_PRIVATE_KEY);
+
+    hStore = CertOpenSystemStore((HCRYPTPROV)NULL, storeStr);
+    if (NULL == hStore) {
+        return count; /* none found does not imply an error */
+    }
+
+    /* FUTURE: use CertFindCertificateInStore to filter better -- so we don't
+   * have to enumerate all the certificates */
+    while ((PCERT_CONTEXT)NULL !=
+           (certContext = CertEnumCertificatesInStore(hStore, certContext))) {
+        /* first filter out non user certs if we are looking for keys */
+        if (isKey) {
+            /* make sure there is a Key Provider Info property */
+            CRYPT_KEY_PROV_INFO *keyProvInfo;
+            DWORD size = 0;
+            BOOL rv;
+            rv = CertGetCertificateContextProperty(certContext,
+                                                   CERT_KEY_PROV_INFO_PROP_ID, NULL, &size);
+            if (!rv) {
+                int reason = GetLastError();
+                /* we only care if it exists, we don't really need to fetch it yet */
+                if (reason == CRYPT_E_NOT_FOUND) {
+                    continue;
+                }
+            }
+            /* filter out the non-microsoft providers */
+            keyProvInfo = (CRYPT_KEY_PROV_INFO *)nss_ZAlloc(NULL, size);
+            if (keyProvInfo) {
+                rv = CertGetCertificateContextProperty(certContext,
+                                                       CERT_KEY_PROV_INFO_PROP_ID, keyProvInfo, &size);
+                if (rv) {
+                    char *provName =
+                        nss_ckcapi_WideToUTF8(keyProvInfo->pwszProvName);
+                    nss_ZFreeIf(keyProvInfo);
+
+                    if (provName &&
+                        (strncmp(provName, "Microsoft", sizeof("Microsoft") -
+                                                            1) != 0)) {
+                        continue;
+                    }
+                } else {
+                    int reason =
+                        GetLastError();
+                    /* we only care if it exists, we don't really need to fetch it yet */
+                    nss_ZFreeIf(keyProvInfo);
+                    if (reason ==
+                        CRYPT_E_NOT_FOUND) {
+                        continue;
+                    }
+                }
+            }
+        }
+
+        if ((ckcapiInternalObject *)NULL == next) {
+            next = nss_ZNEW(NULL, ckcapiInternalObject);
+            if ((ckcapiInternalObject *)NULL == next) {
+                *pError = CKR_HOST_MEMORY;
+                goto loser;
+            }
+        }
+        next->type = ckcapiCert;
+        next->objClass = objClass;
+        next->u.cert.certContext = certContext;
+        next->u.cert.hasID = hasID;
+        next->u.cert.certStore = storeStr;
+        if (CK_TRUE == ckcapi_match(pTemplate, ulAttributeCount, next)) {
+            /* clear cached values that may be dependent on our old certContext */
+            memset(&next->u.cert, 0, sizeof(next->u.cert));
+            /* get a 'permanent' context */
+            next->u.cert.certContext = CertDuplicateCertificateContext(certContext);
+            next->objClass = objClass;
+            next->u.cert.certContext = certContext;
+            next->u.cert.hasID = hasID;
+            next->u.cert.certStore = storeStr;
+            PUT_Object(next, *pError);
+            next = NULL; /* need to allocate a new one now */
+        } else {
+            /* don't cache the values we just loaded */
+            memset(&next->u.cert, 0, sizeof(next->u.cert));
+        }
+    }
+loser:
+    CertCloseStore(hStore, 0);
+    nss_ZFreeIf(next);
+    *sizep = size;
+    return count;
+}
+
+NSS_IMPLEMENT PRUint32
+nss_ckcapi_collect_all_certs(
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    ckcapiInternalObject ***listp,
+    PRUint32 *sizep,
+    PRUint32 count,
+    CK_RV *pError)
+{
+    count = collect_class(CKO_CERTIFICATE, "My", PR_TRUE, pTemplate,
+                          ulAttributeCount, listp, sizep, count, pError);
+    /*count = collect_class(CKO_CERTIFICATE, "AddressBook", PR_FALSE, pTemplate,
+                        ulAttributeCount, listp, sizep, count, pError); */
+    count = collect_class(CKO_CERTIFICATE, "CA", PR_FALSE, pTemplate,
+                          ulAttributeCount, listp, sizep, count, pError);
+    count = collect_class(CKO_CERTIFICATE, "Root", PR_FALSE, pTemplate,
+                          ulAttributeCount, listp, sizep, count, pError);
+    count = collect_class(CKO_CERTIFICATE, "Trust", PR_FALSE, pTemplate,
+                          ulAttributeCount, listp, sizep, count, pError);
+    count = collect_class(CKO_CERTIFICATE, "TrustedPeople", PR_FALSE, pTemplate,
+                          ulAttributeCount, listp, sizep, count, pError);
+    count = collect_class(CKO_CERTIFICATE, "AuthRoot", PR_FALSE, pTemplate,
+                          ulAttributeCount, listp, sizep, count, pError);
+    return count;
+}
+
+CK_OBJECT_CLASS
+ckcapi_GetObjectClass(CK_ATTRIBUTE_PTR pTemplate,
+                      CK_ULONG ulAttributeCount)
+{
+    CK_ULONG i;
+
+    for (i = 0; i < ulAttributeCount; i++) {
+        if (pTemplate[i].type == CKA_CLASS) {
+            return *(CK_OBJECT_CLASS *)pTemplate[i].pValue;
+        }
+    }
+    /* need to return a value that says 'fetch them all' */
+    return CK_INVALID_HANDLE;
+}
+
+static PRUint32
+collect_objects(
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    ckcapiInternalObject ***listp,
+    CK_RV *pError)
+{
+    PRUint32 i;
+    PRUint32 count = 0;
+    PRUint32 size = 0;
+    CK_OBJECT_CLASS objClass;
+
+    /*
+     * first handle the static build in objects (if any)
+     */
+    for (i = 0; i < nss_ckcapi_nObjects; i++) {
+        ckcapiInternalObject *o = (ckcapiInternalObject *)&nss_ckcapi_data[i];
+
+        if (CK_TRUE == ckcapi_match(pTemplate, ulAttributeCount, o)) {
+            PUT_Object(o, *pError);
+        }
+    }
+
+    /*
+     * now handle the various object types
+     */
+    objClass = ckcapi_GetObjectClass(pTemplate, ulAttributeCount);
+    *pError = CKR_OK;
+    switch (objClass) {
+        case CKO_CERTIFICATE:
+            count = nss_ckcapi_collect_all_certs(pTemplate, ulAttributeCount, listp,
+                                                 &size, count, pError);
+            break;
+        case CKO_PUBLIC_KEY:
+            count = collect_class(objClass, "My", PR_TRUE, pTemplate,
+                                  ulAttributeCount, listp, &size, count, pError);
+            count = collect_bare(objClass, pTemplate, ulAttributeCount, listp,
+                                 &size, count, pError);
+            break;
+        case CKO_PRIVATE_KEY:
+            count = collect_class(objClass, "My", PR_TRUE, pTemplate,
+                                  ulAttributeCount, listp, &size, count, pError);
+            count = collect_bare(objClass, pTemplate, ulAttributeCount, listp,
+                                 &size, count, pError);
+            break;
+        /* all of them */
+        case CK_INVALID_HANDLE:
+            count = nss_ckcapi_collect_all_certs(pTemplate, ulAttributeCount, listp,
+                                                 &size, count, pError);
+            count = collect_class(CKO_PUBLIC_KEY, "My", PR_TRUE, pTemplate,
+                                  ulAttributeCount, listp, &size, count, pError);
+            count = collect_bare(CKO_PUBLIC_KEY, pTemplate, ulAttributeCount, listp,
+                                 &size, count, pError);
+            count = collect_class(CKO_PRIVATE_KEY, "My", PR_TRUE, pTemplate,
+                                  ulAttributeCount, listp, &size, count, pError);
+            count = collect_bare(CKO_PRIVATE_KEY, pTemplate, ulAttributeCount, listp,
+                                 &size, count, pError);
+            break;
+        default:
+            goto done; /* no other object types we understand in this module */
+    }
+    if (CKR_OK != *pError) {
+        goto loser;
+    }
+
+done:
+    return count;
+loser:
+    nss_ZFreeIf(*listp);
+    return 0;
+}
+
+NSS_IMPLEMENT NSSCKMDFindObjects *
+nss_ckcapi_FindObjectsInit(
+    NSSCKFWSession *fwSession,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    CK_RV *pError)
+{
+    /* This could be made more efficient.  I'm rather rushed. */
+    NSSArena *arena;
+    NSSCKMDFindObjects *rv = (NSSCKMDFindObjects *)NULL;
+    struct ckcapiFOStr *fo = (struct ckcapiFOStr *)NULL;
+    ckcapiInternalObject **temp = (ckcapiInternalObject **)NULL;
+
+    arena = NSSArena_Create();
+    if ((NSSArena *)NULL == arena) {
+        goto loser;
+    }
+
+    rv = nss_ZNEW(arena, NSSCKMDFindObjects);
+    if ((NSSCKMDFindObjects *)NULL == rv) {
+        *pError = CKR_HOST_MEMORY;
+        goto loser;
+    }
+
+    fo = nss_ZNEW(arena, struct ckcapiFOStr);
+    if ((struct ckcapiFOStr *)NULL == fo) {
+        *pError = CKR_HOST_MEMORY;
+        goto loser;
+    }
+
+    fo->arena = arena;
+    /* fo->n and fo->i are already zero */
+
+    rv->etc = (void *)fo;
+    rv->Final = ckcapi_mdFindObjects_Final;
+    rv->Next = ckcapi_mdFindObjects_Next;
+    rv->null = (void *)NULL;
+
+    fo->n = collect_objects(pTemplate, ulAttributeCount, &temp, pError);
+    if (*pError != CKR_OK) {
+        goto loser;
+    }
+
+    fo->objs = nss_ZNEWARRAY(arena, ckcapiInternalObject *, fo->n);
+    if ((ckcapiInternalObject **)NULL == fo->objs) {
+        *pError = CKR_HOST_MEMORY;
+        goto loser;
+    }
+
+    (void)nsslibc_memcpy(fo->objs, temp, sizeof(ckcapiInternalObject *) * fo->n);
+    nss_ZFreeIf(temp);
+    temp = (ckcapiInternalObject **)NULL;
+
+    return rv;
+
+loser:
+    nss_ZFreeIf(temp);
+    nss_ZFreeIf(fo);
+    nss_ZFreeIf(rv);
+    if ((NSSArena *)NULL != arena) {
+        NSSArena_Destroy(arena);
+    }
+    return (NSSCKMDFindObjects *)NULL;
+}

security/nss/lib/ckfw/capi/cinst.c

@@ -0,0 +1,97 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ckcapi.h"
+
+/*
+ * ckcapi/cinstance.c
+ *
+ * This file implements the NSSCKMDInstance object for the
+ * "capi" cryptoki module.
+ */
+
+/*
+ * NSSCKMDInstance methods
+ */
+
+static CK_ULONG
+ckcapi_mdInstance_GetNSlots(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (CK_ULONG)1;
+}
+
+static CK_VERSION
+ckcapi_mdInstance_GetCryptokiVersion(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return nss_ckcapi_CryptokiVersion;
+}
+
+static NSSUTF8 *
+ckcapi_mdInstance_GetManufacturerID(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_ckcapi_ManufacturerID;
+}
+
+static NSSUTF8 *
+ckcapi_mdInstance_GetLibraryDescription(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_ckcapi_LibraryDescription;
+}
+
+static CK_VERSION
+ckcapi_mdInstance_GetLibraryVersion(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return nss_ckcapi_LibraryVersion;
+}
+
+static CK_RV
+ckcapi_mdInstance_GetSlots(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    NSSCKMDSlot *slots[])
+{
+    slots[0] = (NSSCKMDSlot *)&nss_ckcapi_mdSlot;
+    return CKR_OK;
+}
+
+static CK_BBOOL
+ckcapi_mdInstance_ModuleHandlesSessionObjects(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    /* we don't want to allow any session object creation, at least
+     * until we can investigate whether or not we can use those objects
+     */
+    return CK_TRUE;
+}
+
+NSS_IMPLEMENT_DATA const NSSCKMDInstance
+    nss_ckcapi_mdInstance = {
+        (void *)NULL, /* etc */
+        NULL,         /* Initialize */
+        NULL,         /* Finalize */
+        ckcapi_mdInstance_GetNSlots,
+        ckcapi_mdInstance_GetCryptokiVersion,
+        ckcapi_mdInstance_GetManufacturerID,
+        ckcapi_mdInstance_GetLibraryDescription,
+        ckcapi_mdInstance_GetLibraryVersion,
+        ckcapi_mdInstance_ModuleHandlesSessionObjects,
+        /*NULL, /* HandleSessionObjects */
+        ckcapi_mdInstance_GetSlots,
+        NULL,        /* WaitForSlotEvent */
+        (void *)NULL /* null terminator */
+    };

security/nss/lib/ckfw/capi/ckcapi.h

@@ -0,0 +1,242 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef CKCAPI_H
+#define CKCAPI_H 1
+
+#include "nssckmdt.h"
+#include "nssckfw.h"
+
+/*
+ * I'm including this for access to the arena functions.
+ * Looks like we should publish that API.
+ */
+#ifndef BASE_H
+#include "base.h"
+#endif /* BASE_H */
+
+/*
+ * This is where the Netscape extensions live, at least for now.
+ */
+#ifndef CKT_H
+#include "ckt.h"
+#endif /* CKT_H */
+
+#include "wtypes.h"
+#include "wincrypt.h"
+
+/*
+ * statically defined raw objects. Allows us to data description objects
+ * to this PKCS #11 module.
+ */
+struct ckcapiRawObjectStr {
+    CK_ULONG n;
+    const CK_ATTRIBUTE_TYPE *types;
+    const NSSItem *items;
+};
+typedef struct ckcapiRawObjectStr ckcapiRawObject;
+
+/*
+ * common values needed for both bare keys and cert referenced keys.
+ */
+struct ckcapiKeyParamsStr {
+    NSSItem modulus;
+    NSSItem exponent;
+    NSSItem privateExponent;
+    NSSItem prime1;
+    NSSItem prime2;
+    NSSItem exponent1;
+    NSSItem exponent2;
+    NSSItem coefficient;
+    unsigned char publicExponentData[sizeof(CK_ULONG)];
+    void *privateKey;
+    void *pubKey;
+};
+typedef struct ckcapiKeyParamsStr ckcapiKeyParams;
+
+/*
+ * Key objects. Handles bare keys which do not yet have certs associated
+ * with them. These are usually short lived, but may exist for several days
+ * while the CA is issuing the certificate.
+ */
+struct ckcapiKeyObjectStr {
+    CRYPT_KEY_PROV_INFO provInfo;
+    char *provName;
+    char *containerName;
+    HCRYPTPROV hProv;
+    ckcapiKeyParams key;
+};
+typedef struct ckcapiKeyObjectStr ckcapiKeyObject;
+
+/*
+ * Certificate and certificate referenced keys.
+ */
+struct ckcapiCertObjectStr {
+    PCCERT_CONTEXT certContext;
+    PRBool hasID;
+    const char *certStore;
+    NSSItem label;
+    NSSItem subject;
+    NSSItem issuer;
+    NSSItem serial;
+    NSSItem derCert;
+    ckcapiKeyParams key;
+    unsigned char *labelData;
+    /* static data: to do, make this dynamic like labelData */
+    unsigned char derSerial[128];
+};
+typedef struct ckcapiCertObjectStr ckcapiCertObject;
+
+typedef enum {
+    ckcapiRaw,
+    ckcapiCert,
+    ckcapiBareKey
+} ckcapiObjectType;
+
+/*
+ * all the various types of objects are abstracted away in cobject and
+ * cfind as ckcapiInternalObjects.
+ */
+struct ckcapiInternalObjectStr {
+    ckcapiObjectType type;
+    union {
+        ckcapiRawObject raw;
+        ckcapiCertObject cert;
+        ckcapiKeyObject key;
+    } u;
+    CK_OBJECT_CLASS objClass;
+    NSSItem hashKey;
+    NSSItem id;
+    void *idData;
+    unsigned char hashKeyData[128];
+    NSSCKMDObject mdObject;
+};
+typedef struct ckcapiInternalObjectStr ckcapiInternalObject;
+
+/* our raw object data array */
+NSS_EXTERN_DATA ckcapiInternalObject nss_ckcapi_data[];
+NSS_EXTERN_DATA const PRUint32 nss_ckcapi_nObjects;
+
+NSS_EXTERN_DATA const CK_VERSION nss_ckcapi_CryptokiVersion;
+NSS_EXTERN_DATA const NSSUTF8 *nss_ckcapi_ManufacturerID;
+NSS_EXTERN_DATA const NSSUTF8 *nss_ckcapi_LibraryDescription;
+NSS_EXTERN_DATA const CK_VERSION nss_ckcapi_LibraryVersion;
+NSS_EXTERN_DATA const NSSUTF8 *nss_ckcapi_SlotDescription;
+NSS_EXTERN_DATA const CK_VERSION nss_ckcapi_HardwareVersion;
+NSS_EXTERN_DATA const CK_VERSION nss_ckcapi_FirmwareVersion;
+NSS_EXTERN_DATA const NSSUTF8 *nss_ckcapi_TokenLabel;
+NSS_EXTERN_DATA const NSSUTF8 *nss_ckcapi_TokenModel;
+NSS_EXTERN_DATA const NSSUTF8 *nss_ckcapi_TokenSerialNumber;
+
+NSS_EXTERN_DATA const NSSCKMDInstance nss_ckcapi_mdInstance;
+NSS_EXTERN_DATA const NSSCKMDSlot nss_ckcapi_mdSlot;
+NSS_EXTERN_DATA const NSSCKMDToken nss_ckcapi_mdToken;
+NSS_EXTERN_DATA const NSSCKMDMechanism nss_ckcapi_mdMechanismRSA;
+
+NSS_EXTERN NSSCKMDSession *
+nss_ckcapi_CreateSession(
+    NSSCKFWSession *fwSession,
+    CK_RV *pError);
+
+NSS_EXTERN NSSCKMDFindObjects *
+nss_ckcapi_FindObjectsInit(
+    NSSCKFWSession *fwSession,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    CK_RV *pError);
+
+/*
+ * Object Utilities
+ */
+NSS_EXTERN NSSCKMDObject *
+nss_ckcapi_CreateMDObject(
+    NSSArena *arena,
+    ckcapiInternalObject *io,
+    CK_RV *pError);
+
+NSS_EXTERN NSSCKMDObject *
+nss_ckcapi_CreateObject(
+    NSSCKFWSession *fwSession,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    CK_RV *pError);
+
+NSS_EXTERN const NSSItem *
+nss_ckcapi_FetchAttribute(
+    ckcapiInternalObject *io,
+    CK_ATTRIBUTE_TYPE type);
+
+NSS_EXTERN void
+nss_ckcapi_DestroyInternalObject(
+    ckcapiInternalObject *io);
+
+NSS_EXTERN CK_RV
+nss_ckcapi_FetchKeyContainer(
+    ckcapiInternalObject *iKey,
+    HCRYPTPROV *hProv,
+    DWORD *keySpec,
+    HCRYPTKEY *hKey);
+
+/*
+ * generic utilities
+ */
+
+/*
+ * So everyone else in the worlds stores their bignum data MSB first, but not
+ * Microsoft, we need to byte swap everything coming into and out of CAPI.
+ */
+void
+ckcapi_ReverseData(
+    NSSItem *item);
+
+/*
+ * unwrap a single DER value
+ */
+unsigned char *
+nss_ckcapi_DERUnwrap(
+    unsigned char *src,
+    unsigned int size,
+    unsigned int *outSize,
+    unsigned char **next);
+
+/*
+ * Return the size in bytes of a wide string
+ */
+int
+nss_ckcapi_WideSize(
+    LPCWSTR wide);
+
+/*
+ * Covert a Unicode wide character string to a UTF8 string
+ */
+char *
+nss_ckcapi_WideToUTF8(
+    LPCWSTR wide);
+
+/*
+ * Return a Wide String duplicated with nss allocated memory.
+ */
+LPWSTR
+nss_ckcapi_WideDup(
+    LPCWSTR wide);
+
+/*
+ * Covert a UTF8 string to Unicode wide character
+ */
+LPWSTR
+nss_ckcapi_UTF8ToWide(
+    char *buf);
+
+NSS_EXTERN PRUint32
+nss_ckcapi_collect_all_certs(
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    ckcapiInternalObject ***listp,
+    PRUint32 *sizep,
+    PRUint32 count,
+    CK_RV *pError);
+
+#define NSS_CKCAPI_ARRAY_SIZE(x) ((sizeof(x)) / (sizeof((x)[0])))
+
+#endif

security/nss/lib/ckfw/capi/ckcapiver.c

@@ -0,0 +1,17 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+/* Library identity and versioning */
+
+#include "nsscapi.h"
+
+#if defined(DEBUG)
+#define _DEBUG_STRING " (debug)"
+#else
+#define _DEBUG_STRING ""
+#endif
+
+/*
+ * Version information
+ */
+const char __nss_ckcapi_version[] = "Version: NSS Access to Microsoft Certificate Store " NSS_CKCAPI_LIBRARY_VERSION _DEBUG_STRING;

security/nss/lib/ckfw/capi/config.mk

@@ -0,0 +1,31 @@
+# 
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+#
+#  Override TARGETS variable so that only shared libraries
+#  are specifed as dependencies within rules.mk.
+#
+
+TARGETS        = $(SHARED_LIBRARY)
+LIBRARY        =
+IMPORT_LIBRARY =
+PROGRAM        =
+
+ifeq (,$(filter-out WIN%,$(OS_TARGET)))
+    SHARED_LIBRARY = $(OBJDIR)/$(DLL_PREFIX)$(LIBRARY_NAME)$(LIBRARY_VERSION).$(DLL_SUFFIX)
+    RES = $(OBJDIR)/$(LIBRARY_NAME).res
+    RESNAME = $(LIBRARY_NAME).rc
+endif
+
+ifdef BUILD_IDG
+    DEFINES += -DNSSDEBUG
+endif
+
+#
+# To create a loadable module on Darwin, we must use -bundle.
+#
+ifeq ($(OS_TARGET),Darwin)
+DSO_LDOPTS = -bundle
+endif

security/nss/lib/ckfw/capi/constants.c

@@ -0,0 +1,63 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * ckcapi/constants.c
+ *
+ * Identification and other constants, all collected here in one place.
+ */
+
+#ifndef NSSBASET_H
+#include "nssbaset.h"
+#endif /* NSSBASET_H */
+
+#ifndef NSSCKT_H
+#include "nssckt.h"
+#endif /* NSSCKT_H */
+
+#ifndef NSSCAPI_H
+#include "nsscapi.h"
+#endif /* NSSCAPI_H */
+
+NSS_IMPLEMENT_DATA const CK_VERSION
+    nss_ckcapi_CryptokiVersion = {
+        NSS_CKCAPI_CRYPTOKI_VERSION_MAJOR,
+        NSS_CKCAPI_CRYPTOKI_VERSION_MINOR
+    };
+
+NSS_IMPLEMENT_DATA const NSSUTF8 *
+    nss_ckcapi_ManufacturerID = (NSSUTF8 *)"Mozilla Foundation";
+
+NSS_IMPLEMENT_DATA const NSSUTF8 *
+    nss_ckcapi_LibraryDescription = (NSSUTF8 *)"NSS Access to Microsoft Certificate Store";
+
+NSS_IMPLEMENT_DATA const CK_VERSION
+    nss_ckcapi_LibraryVersion = {
+        NSS_CKCAPI_LIBRARY_VERSION_MAJOR,
+        NSS_CKCAPI_LIBRARY_VERSION_MINOR
+    };
+
+NSS_IMPLEMENT_DATA const NSSUTF8 *
+    nss_ckcapi_SlotDescription = (NSSUTF8 *)"Microsoft Certificate Store";
+
+NSS_IMPLEMENT_DATA const CK_VERSION
+    nss_ckcapi_HardwareVersion = {
+        NSS_CKCAPI_HARDWARE_VERSION_MAJOR,
+        NSS_CKCAPI_HARDWARE_VERSION_MINOR
+    };
+
+NSS_IMPLEMENT_DATA const CK_VERSION
+    nss_ckcapi_FirmwareVersion = {
+        NSS_CKCAPI_FIRMWARE_VERSION_MAJOR,
+        NSS_CKCAPI_FIRMWARE_VERSION_MINOR
+    };
+
+NSS_IMPLEMENT_DATA const NSSUTF8 *
+    nss_ckcapi_TokenLabel = (NSSUTF8 *)"Microsoft Certificate Store";
+
+NSS_IMPLEMENT_DATA const NSSUTF8 *
+    nss_ckcapi_TokenModel = (NSSUTF8 *)"1";
+
+NSS_IMPLEMENT_DATA const NSSUTF8 *
+    nss_ckcapi_TokenSerialNumber = (NSSUTF8 *)"1";

security/nss/lib/ckfw/capi/crsa.c

@@ -0,0 +1,687 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ckcapi.h"
+#include "secdert.h"
+
+#define SSL3_SHAMD5_HASH_SIZE 36 /* LEN_MD5 (16) + LEN_SHA1 (20) */
+
+/*
+ * ckcapi/crsa.c
+ *
+ * This file implements the NSSCKMDMechnaism and NSSCKMDCryptoOperation objects
+ * for the RSA operation on the CAPI cryptoki module.
+ */
+
+/*
+ * write a Decimal value to a string
+ */
+
+static char *
+putDecimalString(char *cstr, unsigned long value)
+{
+    unsigned long tenpower;
+    int first = 1;
+
+    for (tenpower = 10000000; tenpower; tenpower /= 10) {
+        unsigned char digit = (unsigned char)(value / tenpower);
+        value = value % tenpower;
+
+        /* drop leading zeros */
+        if (first && (0 == digit)) {
+            continue;
+        }
+        first = 0;
+        *cstr++ = digit + '0';
+    }
+
+    /* if value was zero, put one of them out */
+    if (first) {
+        *cstr++ = '0';
+    }
+    return cstr;
+}
+
+/*
+ * Create a Capi OID string value from a DER OID
+ */
+static char *
+nss_ckcapi_GetOidString(
+    unsigned char *oidTag,
+    unsigned int oidTagSize,
+    CK_RV *pError)
+{
+    unsigned char *oid;
+    char *oidStr;
+    char *cstr;
+    unsigned long value;
+    unsigned int oidSize;
+
+    if (DER_OBJECT_ID != *oidTag) {
+        /* wasn't an oid */
+        *pError = CKR_DATA_INVALID;
+        return NULL;
+    }
+    oid = nss_ckcapi_DERUnwrap(oidTag, oidTagSize, &oidSize, NULL);
+
+    if (oidSize < 2) {
+        *pError = CKR_DATA_INVALID;
+        return NULL;
+    }
+
+    oidStr = nss_ZNEWARRAY(NULL, char, oidSize * 4);
+    if ((char *)NULL == oidStr) {
+        *pError = CKR_HOST_MEMORY;
+        return NULL;
+    }
+    cstr = oidStr;
+    cstr = putDecimalString(cstr, (*oid) / 40);
+    *cstr++ = '.';
+    cstr = putDecimalString(cstr, (*oid) % 40);
+    oidSize--;
+
+    value = 0;
+    while (oidSize--) {
+        oid++;
+        value = (value << 7) + (*oid & 0x7f);
+        if (0 == (*oid & 0x80)) {
+            *cstr++ = '.';
+            cstr = putDecimalString(cstr, value);
+            value = 0;
+        }
+    }
+
+    *cstr = 0; /* NULL terminate */
+
+    if (value != 0) {
+        nss_ZFreeIf(oidStr);
+        *pError = CKR_DATA_INVALID;
+        return NULL;
+    }
+    return oidStr;
+}
+
+/*
+ * PKCS #11 sign for RSA expects to take a fully DER-encoded hash value,
+ * which includes the hash OID. CAPI expects to take a Hash Context. While
+ * CAPI does have the capability of setting a raw hash value, it does not
+ * have the ability to sign an arbitrary value. This function tries to
+ * reduce the passed in data into something that CAPI could actually sign.
+ */
+static CK_RV
+ckcapi_GetRawHash(
+    const NSSItem *input,
+    NSSItem *hash,
+    ALG_ID *hashAlg)
+{
+    unsigned char *current;
+    unsigned char *algid;
+    unsigned char *oid;
+    unsigned char *hashData;
+    char *oidStr;
+    CK_RV error;
+    unsigned int oidSize;
+    unsigned int size;
+    /*
+    * there are 2 types of hashes NSS typically tries to sign, regular
+    * RSA signature format (with encoded DER_OIDS), and SSL3 Signed hashes.
+    * CAPI knows not to add any oids to SSL3_Signed hashes, so if we have any
+    * random hash that is exactly the same size as an SSL3 hash, then we can
+    * just pass the data through. CAPI has know way of knowing if the value
+    * is really a combined hash or some other arbitrary data, so it's safe to
+    * handle this case first.
+    */
+    if (SSL3_SHAMD5_HASH_SIZE == input->size) {
+        hash->data = input->data;
+        hash->size = input->size;
+        *hashAlg = CALG_SSL3_SHAMD5;
+        return CKR_OK;
+    }
+
+    current = (unsigned char *)input->data;
+
+    /* make sure we have a sequence tag */
+    if ((DER_SEQUENCE | DER_CONSTRUCTED) != *current) {
+        return CKR_DATA_INVALID;
+    }
+
+    /* parse the input block to get 1) the hash oid, and 2) the raw hash value.
+     * unfortunatly CAPI doesn't have a builtin function to do this work, so
+     * we go ahead and do it by hand here.
+     *
+     * format is:
+     *  SEQUENCE {
+     *     SECQUENCE { // algid
+     *       OID {}    // oid
+     *       ANY {}    // optional params
+     *     }
+     *     OCTECT {}   // hash
+     */
+
+    /* unwrap */
+    algid = nss_ckcapi_DERUnwrap(current, input->size, &size, NULL);
+
+    if (algid + size != current + input->size) {
+        /* make sure there is not extra data at the end */
+        return CKR_DATA_INVALID;
+    }
+
+    if ((DER_SEQUENCE | DER_CONSTRUCTED) != *algid) {
+        /* wasn't an algid */
+        return CKR_DATA_INVALID;
+    }
+    oid = nss_ckcapi_DERUnwrap(algid, size, &oidSize, &hashData);
+
+    if (DER_OCTET_STRING != *hashData) {
+        /* wasn't a hash */
+        return CKR_DATA_INVALID;
+    }
+
+    /* get the real hash */
+    current = hashData;
+    size = size - (hashData - algid);
+    hash->data = nss_ckcapi_DERUnwrap(current, size, &hash->size, NULL);
+
+    /* get the real oid as a string. Again, Microsoft does not
+     * export anything that does this for us */
+    oidStr = nss_ckcapi_GetOidString(oid, oidSize, &error);
+    if ((char *)NULL == oidStr) {
+        return error;
+    }
+
+    /* look up the hash alg from the oid (fortunately CAPI does to this) */
+    *hashAlg = CertOIDToAlgId(oidStr);
+    nss_ZFreeIf(oidStr);
+    if (0 == *hashAlg) {
+        return CKR_HOST_MEMORY;
+    }
+
+    /* hash looks reasonably consistent, we should be able to sign it now */
+    return CKR_OK;
+}
+
+/*
+ * So everyone else in the worlds stores their bignum data MSB first, but not
+ * Microsoft, we need to byte swap everything coming into and out of CAPI.
+ */
+void
+ckcapi_ReverseData(NSSItem *item)
+{
+    int end = (item->size) - 1;
+    int middle = (item->size) / 2;
+    unsigned char *buf = item->data;
+    int i;
+
+    for (i = 0; i < middle; i++) {
+        unsigned char tmp = buf[i];
+        buf[i] = buf[end - i];
+        buf[end - i] = tmp;
+    }
+    return;
+}
+
+typedef struct ckcapiInternalCryptoOperationRSAPrivStr
+    ckcapiInternalCryptoOperationRSAPriv;
+struct ckcapiInternalCryptoOperationRSAPrivStr {
+    NSSCKMDCryptoOperation mdOperation;
+    NSSCKMDMechanism *mdMechanism;
+    ckcapiInternalObject *iKey;
+    HCRYPTPROV hProv;
+    DWORD keySpec;
+    HCRYPTKEY hKey;
+    NSSItem *buffer;
+};
+
+/*
+ * ckcapi_mdCryptoOperationRSAPriv_Create
+ */
+static NSSCKMDCryptoOperation *
+ckcapi_mdCryptoOperationRSAPriv_Create(
+    const NSSCKMDCryptoOperation *proto,
+    NSSCKMDMechanism *mdMechanism,
+    NSSCKMDObject *mdKey,
+    CK_RV *pError)
+{
+    ckcapiInternalObject *iKey = (ckcapiInternalObject *)mdKey->etc;
+    const NSSItem *classItem = nss_ckcapi_FetchAttribute(iKey, CKA_CLASS);
+    const NSSItem *keyType = nss_ckcapi_FetchAttribute(iKey, CKA_KEY_TYPE);
+    ckcapiInternalCryptoOperationRSAPriv *iOperation;
+    CK_RV error;
+    HCRYPTPROV hProv;
+    DWORD keySpec;
+    HCRYPTKEY hKey;
+
+    /* make sure we have the right objects */
+    if (((const NSSItem *)NULL == classItem) ||
+        (sizeof(CK_OBJECT_CLASS) != classItem->size) ||
+        (CKO_PRIVATE_KEY != *(CK_OBJECT_CLASS *)classItem->data) ||
+        ((const NSSItem *)NULL == keyType) ||
+        (sizeof(CK_KEY_TYPE) != keyType->size) ||
+        (CKK_RSA != *(CK_KEY_TYPE *)keyType->data)) {
+        *pError = CKR_KEY_TYPE_INCONSISTENT;
+        return (NSSCKMDCryptoOperation *)NULL;
+    }
+
+    error = nss_ckcapi_FetchKeyContainer(iKey, &hProv, &keySpec, &hKey);
+    if (error != CKR_OK) {
+        *pError = error;
+        return (NSSCKMDCryptoOperation *)NULL;
+    }
+
+    iOperation = nss_ZNEW(NULL, ckcapiInternalCryptoOperationRSAPriv);
+    if ((ckcapiInternalCryptoOperationRSAPriv *)NULL == iOperation) {
+        *pError = CKR_HOST_MEMORY;
+        return (NSSCKMDCryptoOperation *)NULL;
+    }
+    iOperation->mdMechanism = mdMechanism;
+    iOperation->iKey = iKey;
+    iOperation->hProv = hProv;
+    iOperation->keySpec = keySpec;
+    iOperation->hKey = hKey;
+
+    nsslibc_memcpy(&iOperation->mdOperation,
+                   proto, sizeof(NSSCKMDCryptoOperation));
+    iOperation->mdOperation.etc = iOperation;
+
+    return &iOperation->mdOperation;
+}
+
+static CK_RV
+ckcapi_mdCryptoOperationRSAPriv_Destroy(
+    NSSCKMDCryptoOperation *mdOperation,
+    NSSCKFWCryptoOperation *fwOperation,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    ckcapiInternalCryptoOperationRSAPriv *iOperation =
+        (ckcapiInternalCryptoOperationRSAPriv *)mdOperation->etc;
+
+    if (iOperation->hKey) {
+        CryptDestroyKey(iOperation->hKey);
+    }
+    if (iOperation->buffer) {
+        nssItem_Destroy(iOperation->buffer);
+    }
+    nss_ZFreeIf(iOperation);
+    return CKR_OK;
+}
+
+static CK_ULONG
+ckcapi_mdCryptoOperationRSA_GetFinalLength(
+    NSSCKMDCryptoOperation *mdOperation,
+    NSSCKFWCryptoOperation *fwOperation,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    ckcapiInternalCryptoOperationRSAPriv *iOperation =
+        (ckcapiInternalCryptoOperationRSAPriv *)mdOperation->etc;
+    const NSSItem *modulus =
+        nss_ckcapi_FetchAttribute(iOperation->iKey, CKA_MODULUS);
+
+    return modulus->size;
+}
+
+/*
+ * ckcapi_mdCryptoOperationRSADecrypt_GetOperationLength
+ * we won't know the length until we actually decrypt the
+ * input block. Since we go to all the work to decrypt the
+ * the block, we'll save if for when the block is asked for
+ */
+static CK_ULONG
+ckcapi_mdCryptoOperationRSADecrypt_GetOperationLength(
+    NSSCKMDCryptoOperation *mdOperation,
+    NSSCKFWCryptoOperation *fwOperation,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    const NSSItem *input,
+    CK_RV *pError)
+{
+    ckcapiInternalCryptoOperationRSAPriv *iOperation =
+        (ckcapiInternalCryptoOperationRSAPriv *)mdOperation->etc;
+    BOOL rc;
+
+    /* Microsoft's Decrypt operation works in place. Since we don't want
+     * to trash our input buffer, we make a copy of it */
+    iOperation->buffer = nssItem_Duplicate((NSSItem *)input, NULL, NULL);
+    if ((NSSItem *)NULL == iOperation->buffer) {
+        *pError = CKR_HOST_MEMORY;
+        return 0;
+    }
+    /* Sigh, reverse it */
+    ckcapi_ReverseData(iOperation->buffer);
+
+    rc = CryptDecrypt(iOperation->hKey, 0, TRUE, 0,
+                      iOperation->buffer->data, &iOperation->buffer->size);
+    if (!rc) {
+        DWORD msError = GetLastError();
+        switch (msError) {
+            case NTE_BAD_DATA:
+                *pError =
+                    CKR_ENCRYPTED_DATA_INVALID;
+                break;
+            case NTE_FAIL:
+            case NTE_BAD_UID:
+                *pError =
+                    CKR_DEVICE_ERROR;
+                break;
+            default:
+                *pError =
+                    CKR_GENERAL_ERROR;
+        }
+        return 0;
+    }
+
+    return iOperation->buffer->size;
+}
+
+/*
+ * ckcapi_mdCryptoOperationRSADecrypt_UpdateFinal
+ *
+ * NOTE: ckcapi_mdCryptoOperationRSADecrypt_GetOperationLength is presumed to
+ * have been called previously.
+ */
+static CK_RV
+ckcapi_mdCryptoOperationRSADecrypt_UpdateFinal(
+    NSSCKMDCryptoOperation *mdOperation,
+    NSSCKFWCryptoOperation *fwOperation,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    const NSSItem *input,
+    NSSItem *output)
+{
+    ckcapiInternalCryptoOperationRSAPriv *iOperation =
+        (ckcapiInternalCryptoOperationRSAPriv *)mdOperation->etc;
+    NSSItem *buffer = iOperation->buffer;
+
+    if ((NSSItem *)NULL == buffer) {
+        return CKR_GENERAL_ERROR;
+    }
+    nsslibc_memcpy(output->data, buffer->data, buffer->size);
+    output->size = buffer->size;
+    return CKR_OK;
+}
+
+/*
+ * ckcapi_mdCryptoOperationRSASign_UpdateFinal
+ *
+ */
+static CK_RV
+ckcapi_mdCryptoOperationRSASign_UpdateFinal(
+    NSSCKMDCryptoOperation *mdOperation,
+    NSSCKFWCryptoOperation *fwOperation,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    const NSSItem *input,
+    NSSItem *output)
+{
+    ckcapiInternalCryptoOperationRSAPriv *iOperation =
+        (ckcapiInternalCryptoOperationRSAPriv *)mdOperation->etc;
+    CK_RV error = CKR_OK;
+    DWORD msError;
+    NSSItem hash;
+    HCRYPTHASH hHash = 0;
+    ALG_ID hashAlg;
+    DWORD hashSize;
+    DWORD len; /* temp length value we throw away */
+    BOOL rc;
+
+    /*
+     * PKCS #11 sign for RSA expects to take a fully DER-encoded hash value,
+     * which includes the hash OID. CAPI expects to take a Hash Context. While
+     * CAPI does have the capability of setting a raw hash value, it does not
+     * have the ability to sign an arbitrary value. This function tries to
+     * reduce the passed in data into something that CAPI could actually sign.
+     */
+    error = ckcapi_GetRawHash(input, &hash, &hashAlg);
+    if (CKR_OK != error) {
+        goto loser;
+    }
+
+    rc = CryptCreateHash(iOperation->hProv, hashAlg, 0, 0, &hHash);
+    if (!rc) {
+        goto loser;
+    }
+
+    /* make sure the hash lens match before we set it */
+    len = sizeof(DWORD);
+    rc = CryptGetHashParam(hHash, HP_HASHSIZE, (BYTE *)&hashSize, &len, 0);
+    if (!rc) {
+        goto loser;
+    }
+
+    if (hash.size != hashSize) {
+        /* The input must have been bad for this to happen */
+        error = CKR_DATA_INVALID;
+        goto loser;
+    }
+
+    /* we have an explicit hash, set it, note that the length is
+     * implicit by the hashAlg used in create */
+    rc = CryptSetHashParam(hHash, HP_HASHVAL, hash.data, 0);
+    if (!rc) {
+        goto loser;
+    }
+
+    /* OK, we have the data in a hash structure, sign it! */
+    rc = CryptSignHash(hHash, iOperation->keySpec, NULL, 0,
+                       output->data, &output->size);
+    if (!rc) {
+        goto loser;
+    }
+
+    /* Don't return a signature that might have been broken because of a cosmic
+     * ray, or a broken processor, verify that it is valid... */
+    rc = CryptVerifySignature(hHash, output->data, output->size,
+                              iOperation->hKey, NULL, 0);
+    if (!rc) {
+        goto loser;
+    }
+
+    /* OK, Microsoft likes to do things completely differently than anyone
+     * else. We need to reverse the data we received here */
+    ckcapi_ReverseData(output);
+    CryptDestroyHash(hHash);
+    return CKR_OK;
+
+loser:
+    /* map the microsoft error */
+    if (CKR_OK == error) {
+        msError = GetLastError();
+        switch (msError) {
+            case ERROR_NOT_ENOUGH_MEMORY:
+                error =
+                    CKR_HOST_MEMORY;
+                break;
+            case NTE_NO_MEMORY:
+                error =
+                    CKR_DEVICE_MEMORY;
+                break;
+            case ERROR_MORE_DATA:
+                return CKR_BUFFER_TOO_SMALL;
+            case ERROR_INVALID_PARAMETER: /* these params were derived from the */
+            case ERROR_INVALID_HANDLE:    /* inputs, so if they are bad, the input */
+            case NTE_BAD_ALGID:           /* data is bad */
+            case NTE_BAD_HASH:
+                error =
+                    CKR_DATA_INVALID;
+                break;
+            case ERROR_BUSY:
+            case NTE_FAIL:
+            case NTE_BAD_UID:
+                error =
+                    CKR_DEVICE_ERROR;
+                break;
+            default:
+                error =
+                    CKR_GENERAL_ERROR;
+                break;
+        }
+    }
+    if (hHash) {
+        CryptDestroyHash(hHash);
+    }
+    return error;
+}
+
+NSS_IMPLEMENT_DATA const NSSCKMDCryptoOperation
+    ckcapi_mdCryptoOperationRSADecrypt_proto = {
+        NULL, /* etc */
+        ckcapi_mdCryptoOperationRSAPriv_Destroy,
+        NULL, /* GetFinalLengh - not needed for one shot Decrypt/Encrypt */
+        ckcapi_mdCryptoOperationRSADecrypt_GetOperationLength,
+        NULL, /* Final - not needed for one shot operation */
+        NULL, /* Update - not needed for one shot operation */
+        NULL, /* DigetUpdate - not needed for one shot operation */
+        ckcapi_mdCryptoOperationRSADecrypt_UpdateFinal,
+        NULL,        /* UpdateCombo - not needed for one shot operation */
+        NULL,        /* DigetKey - not needed for one shot operation */
+        (void *)NULL /* null terminator */
+    };
+
+NSS_IMPLEMENT_DATA const NSSCKMDCryptoOperation
+    ckcapi_mdCryptoOperationRSASign_proto = {
+        NULL, /* etc */
+        ckcapi_mdCryptoOperationRSAPriv_Destroy,
+        ckcapi_mdCryptoOperationRSA_GetFinalLength,
+        NULL, /* GetOperationLengh - not needed for one shot Sign/Verify */
+        NULL, /* Final - not needed for one shot operation */
+        NULL, /* Update - not needed for one shot operation */
+        NULL, /* DigetUpdate - not needed for one shot operation */
+        ckcapi_mdCryptoOperationRSASign_UpdateFinal,
+        NULL,        /* UpdateCombo - not needed for one shot operation */
+        NULL,        /* DigetKey - not needed for one shot operation */
+        (void *)NULL /* null terminator */
+    };
+
+/********** NSSCKMDMechansim functions ***********************/
+/*
+ * ckcapi_mdMechanismRSA_Destroy
+ */
+static void
+ckcapi_mdMechanismRSA_Destroy(
+    NSSCKMDMechanism *mdMechanism,
+    NSSCKFWMechanism *fwMechanism,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    nss_ZFreeIf(fwMechanism);
+}
+
+/*
+ * ckcapi_mdMechanismRSA_GetMinKeySize
+ */
+static CK_ULONG
+ckcapi_mdMechanismRSA_GetMinKeySize(
+    NSSCKMDMechanism *mdMechanism,
+    NSSCKFWMechanism *fwMechanism,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return 384;
+}
+
+/*
+ * ckcapi_mdMechanismRSA_GetMaxKeySize
+ */
+static CK_ULONG
+ckcapi_mdMechanismRSA_GetMaxKeySize(
+    NSSCKMDMechanism *mdMechanism,
+    NSSCKFWMechanism *fwMechanism,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return 16384;
+}
+
+/*
+ * ckcapi_mdMechanismRSA_DecryptInit
+ */
+static NSSCKMDCryptoOperation *
+ckcapi_mdMechanismRSA_DecryptInit(
+    NSSCKMDMechanism *mdMechanism,
+    NSSCKFWMechanism *fwMechanism,
+    CK_MECHANISM *pMechanism,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    NSSCKMDObject *mdKey,
+    NSSCKFWObject *fwKey,
+    CK_RV *pError)
+{
+    return ckcapi_mdCryptoOperationRSAPriv_Create(
+        &ckcapi_mdCryptoOperationRSADecrypt_proto,
+        mdMechanism, mdKey, pError);
+}
+
+/*
+ * ckcapi_mdMechanismRSA_SignInit
+ */
+static NSSCKMDCryptoOperation *
+ckcapi_mdMechanismRSA_SignInit(
+    NSSCKMDMechanism *mdMechanism,
+    NSSCKFWMechanism *fwMechanism,
+    CK_MECHANISM *pMechanism,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    NSSCKMDObject *mdKey,
+    NSSCKFWObject *fwKey,
+    CK_RV *pError)
+{
+    return ckcapi_mdCryptoOperationRSAPriv_Create(
+        &ckcapi_mdCryptoOperationRSASign_proto,
+        mdMechanism, mdKey, pError);
+}
+
+NSS_IMPLEMENT_DATA const NSSCKMDMechanism
+    nss_ckcapi_mdMechanismRSA = {
+        (void *)NULL, /* etc */
+        ckcapi_mdMechanismRSA_Destroy,
+        ckcapi_mdMechanismRSA_GetMinKeySize,
+        ckcapi_mdMechanismRSA_GetMaxKeySize,
+        NULL, /* GetInHardware - default false */
+        NULL, /* EncryptInit - default errs */
+        ckcapi_mdMechanismRSA_DecryptInit,
+        NULL, /* DigestInit - default errs*/
+        ckcapi_mdMechanismRSA_SignInit,
+        NULL,                           /* VerifyInit - default errs */
+        ckcapi_mdMechanismRSA_SignInit, /* SignRecoverInit */
+        NULL,                           /* VerifyRecoverInit - default errs */
+        NULL,                           /* GenerateKey - default errs */
+        NULL,                           /* GenerateKeyPair - default errs */
+        NULL,                           /* GetWrapKeyLength - default errs */
+        NULL,                           /* WrapKey - default errs */
+        NULL,                           /* UnwrapKey - default errs */
+        NULL,                           /* DeriveKey - default errs */
+        (void *)NULL                    /* null terminator */
+    };

security/nss/lib/ckfw/capi/csession.c

@@ -0,0 +1,87 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ckcapi.h"
+
+/*
+ * ckcapi/csession.c
+ *
+ * This file implements the NSSCKMDSession object for the
+ * "nss to capi" cryptoki module.
+ */
+
+static NSSCKMDFindObjects *
+ckcapi_mdSession_FindObjectsInit(
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    CK_RV *pError)
+{
+    return nss_ckcapi_FindObjectsInit(fwSession, pTemplate, ulAttributeCount, pError);
+}
+
+static NSSCKMDObject *
+ckcapi_mdSession_CreateObject(
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    NSSArena *arena,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    CK_RV *pError)
+{
+    return nss_ckcapi_CreateObject(fwSession, pTemplate, ulAttributeCount, pError);
+}
+
+NSS_IMPLEMENT NSSCKMDSession *
+nss_ckcapi_CreateSession(
+    NSSCKFWSession *fwSession,
+    CK_RV *pError)
+{
+    NSSArena *arena;
+    NSSCKMDSession *rv;
+
+    arena = NSSCKFWSession_GetArena(fwSession, pError);
+    if ((NSSArena *)NULL == arena) {
+        return (NSSCKMDSession *)NULL;
+    }
+
+    rv = nss_ZNEW(arena, NSSCKMDSession);
+    if ((NSSCKMDSession *)NULL == rv) {
+        *pError = CKR_HOST_MEMORY;
+        return (NSSCKMDSession *)NULL;
+    }
+
+    /*
+     * rv was zeroed when allocated, so we only
+     * need to set the non-zero members.
+     */
+
+    rv->etc = (void *)fwSession;
+    /* rv->Close */
+    /* rv->GetDeviceError */
+    /* rv->Login */
+    /* rv->Logout */
+    /* rv->InitPIN */
+    /* rv->SetPIN */
+    /* rv->GetOperationStateLen */
+    /* rv->GetOperationState */
+    /* rv->SetOperationState */
+    rv->CreateObject = ckcapi_mdSession_CreateObject;
+    /* rv->CopyObject */
+    rv->FindObjectsInit = ckcapi_mdSession_FindObjectsInit;
+    /* rv->SeedRandom */
+    /* rv->GetRandom */
+    /* rv->null */
+
+    return rv;
+}

security/nss/lib/ckfw/capi/cslot.c

@@ -0,0 +1,81 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ckcapi.h"
+
+/*
+ * ckcapi/cslot.c
+ *
+ * This file implements the NSSCKMDSlot object for the
+ * "nss to capi" cryptoki module.
+ */
+
+static NSSUTF8 *
+ckcapi_mdSlot_GetSlotDescription(
+    NSSCKMDSlot *mdSlot,
+    NSSCKFWSlot *fwSlot,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_ckcapi_SlotDescription;
+}
+
+static NSSUTF8 *
+ckcapi_mdSlot_GetManufacturerID(
+    NSSCKMDSlot *mdSlot,
+    NSSCKFWSlot *fwSlot,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_ckcapi_ManufacturerID;
+}
+
+static CK_VERSION
+ckcapi_mdSlot_GetHardwareVersion(
+    NSSCKMDSlot *mdSlot,
+    NSSCKFWSlot *fwSlot,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return nss_ckcapi_HardwareVersion;
+}
+
+static CK_VERSION
+ckcapi_mdSlot_GetFirmwareVersion(
+    NSSCKMDSlot *mdSlot,
+    NSSCKFWSlot *fwSlot,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return nss_ckcapi_FirmwareVersion;
+}
+
+static NSSCKMDToken *
+ckcapi_mdSlot_GetToken(
+    NSSCKMDSlot *mdSlot,
+    NSSCKFWSlot *fwSlot,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSCKMDToken *)&nss_ckcapi_mdToken;
+}
+
+NSS_IMPLEMENT_DATA const NSSCKMDSlot
+    nss_ckcapi_mdSlot = {
+        (void *)NULL, /* etc */
+        NULL,         /* Initialize */
+        NULL,         /* Destroy */
+        ckcapi_mdSlot_GetSlotDescription,
+        ckcapi_mdSlot_GetManufacturerID,
+        NULL, /* GetTokenPresent -- defaults to true */
+        NULL, /* GetRemovableDevice -- defaults to false */
+        NULL, /* GetHardwareSlot -- defaults to false */
+        ckcapi_mdSlot_GetHardwareVersion,
+        ckcapi_mdSlot_GetFirmwareVersion,
+        ckcapi_mdSlot_GetToken,
+        (void *)NULL /* null terminator */
+    };

security/nss/lib/ckfw/capi/ctoken.c

@@ -0,0 +1,184 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ckcapi.h"
+
+/*
+ * ckcapi/ctoken.c
+ *
+ * This file implements the NSSCKMDToken object for the
+ * "nss to capi" cryptoki module.
+ */
+
+static NSSUTF8 *
+ckcapi_mdToken_GetLabel(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_ckcapi_TokenLabel;
+}
+
+static NSSUTF8 *
+ckcapi_mdToken_GetManufacturerID(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_ckcapi_ManufacturerID;
+}
+
+static NSSUTF8 *
+ckcapi_mdToken_GetModel(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_ckcapi_TokenModel;
+}
+
+static NSSUTF8 *
+ckcapi_mdToken_GetSerialNumber(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_ckcapi_TokenSerialNumber;
+}
+
+static CK_BBOOL
+ckcapi_mdToken_GetIsWriteProtected(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return CK_FALSE;
+}
+
+/* fake out Mozilla so we don't try to initialize the token */
+static CK_BBOOL
+ckcapi_mdToken_GetUserPinInitialized(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return CK_TRUE;
+}
+
+static CK_VERSION
+ckcapi_mdToken_GetHardwareVersion(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return nss_ckcapi_HardwareVersion;
+}
+
+static CK_VERSION
+ckcapi_mdToken_GetFirmwareVersion(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return nss_ckcapi_FirmwareVersion;
+}
+
+static NSSCKMDSession *
+ckcapi_mdToken_OpenSession(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    NSSCKFWSession *fwSession,
+    CK_BBOOL rw,
+    CK_RV *pError)
+{
+    return nss_ckcapi_CreateSession(fwSession, pError);
+}
+
+static CK_ULONG
+ckcapi_mdToken_GetMechanismCount(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return (CK_ULONG)1;
+}
+
+static CK_RV
+ckcapi_mdToken_GetMechanismTypes(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_MECHANISM_TYPE types[])
+{
+    types[0] = CKM_RSA_PKCS;
+    return CKR_OK;
+}
+
+static NSSCKMDMechanism *
+ckcapi_mdToken_GetMechanism(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_MECHANISM_TYPE which,
+    CK_RV *pError)
+{
+    if (which != CKM_RSA_PKCS) {
+        *pError = CKR_MECHANISM_INVALID;
+        return (NSSCKMDMechanism *)NULL;
+    }
+    return (NSSCKMDMechanism *)&nss_ckcapi_mdMechanismRSA;
+}
+
+NSS_IMPLEMENT_DATA const NSSCKMDToken
+    nss_ckcapi_mdToken = {
+        (void *)NULL, /* etc */
+        NULL,         /* Setup */
+        NULL,         /* Invalidate */
+        NULL,         /* InitToken -- default errs */
+        ckcapi_mdToken_GetLabel,
+        ckcapi_mdToken_GetManufacturerID,
+        ckcapi_mdToken_GetModel,
+        ckcapi_mdToken_GetSerialNumber,
+        NULL, /* GetHasRNG -- default is false */
+        ckcapi_mdToken_GetIsWriteProtected,
+        NULL, /* GetLoginRequired -- default is false */
+        ckcapi_mdToken_GetUserPinInitialized,
+        NULL, /* GetRestoreKeyNotNeeded -- irrelevant */
+        NULL, /* GetHasClockOnToken -- default is false */
+        NULL, /* GetHasProtectedAuthenticationPath -- default is false */
+        NULL, /* GetSupportsDualCryptoOperations -- default is false */
+        NULL, /* GetMaxSessionCount -- default is CK_UNAVAILABLE_INFORMATION */
+        NULL, /* GetMaxRwSessionCount -- default is CK_UNAVAILABLE_INFORMATION */
+        NULL, /* GetMaxPinLen -- irrelevant */
+        NULL, /* GetMinPinLen -- irrelevant */
+        NULL, /* GetTotalPublicMemory -- default is CK_UNAVAILABLE_INFORMATION */
+        NULL, /* GetFreePublicMemory -- default is CK_UNAVAILABLE_INFORMATION */
+        NULL, /* GetTotalPrivateMemory -- default is CK_UNAVAILABLE_INFORMATION */
+        NULL, /* GetFreePrivateMemory -- default is CK_UNAVAILABLE_INFORMATION */
+        ckcapi_mdToken_GetHardwareVersion,
+        ckcapi_mdToken_GetFirmwareVersion,
+        NULL, /* GetUTCTime -- no clock */
+        ckcapi_mdToken_OpenSession,
+        ckcapi_mdToken_GetMechanismCount,
+        ckcapi_mdToken_GetMechanismTypes,
+        ckcapi_mdToken_GetMechanism,
+        (void *)NULL /* null terminator */
+    };

security/nss/lib/ckfw/capi/manifest.mn

@@ -0,0 +1,33 @@
+# 
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+CORE_DEPTH = ../../../..
+
+MODULE = nss
+MAPFILE = $(OBJDIR)/nsscapi.def
+
+EXPORTS =		\
+	nsscapi.h	\
+	$(NULL)
+
+CSRCS =			\
+	anchor.c	\
+	constants.c	\
+	cfind.c		\
+	cinst.c 	\
+	cobject.c	\
+	crsa.c		\
+	csession.c	\
+	cslot.c		\
+	ctoken.c	\
+	ckcapiver.c	\
+	staticobj.c	\
+	$(NULL)
+
+REQUIRES = nspr
+
+LIBRARY_NAME = nsscapi
+
+#EXTRA_SHARED_LIBS = -L$(DIST)/lib -lnssckfw -lnssb -lplc4 -lplds4

security/nss/lib/ckfw/capi/nsscapi.def

@@ -0,0 +1,26 @@
+;+#
+;+# This Source Code Form is subject to the terms of the Mozilla Public
+;+# License, v. 2.0. If a copy of the MPL was not distributed with this
+;+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;+#
+;+# OK, this file is meant to support SUN, LINUX, AIX and WINDOWS
+;+#   1. For all unix platforms, the string ";-"  means "remove this line"
+;+#   2. For all unix platforms, the string " DATA " will be removed from any 
+;+#     line on which it occurs.
+;+#   3. Lines containing ";+" will have ";+" removed on SUN and LINUX.
+;+#      On AIX, lines containing ";+" will be removed.
+;+#   4. For all unix platforms, the string ";;" will thave the ";;" removed.
+;+#   5. For all unix platforms, after the above processing has taken place,
+;+#    all characters after the first ";" on the line will be removed.
+;+#    And for AIX, the first ";" will also be removed.
+;+#  This file is passed directly to windows. Since ';' is a comment, all UNIX
+;+#   directives are hidden behind ";", ";+", and ";-"
+;+
+;+NSS_3.1 {       # NSS 3.1 release
+;+    global:
+LIBRARY nsscapi ;-
+EXPORTS ;-
+C_GetFunctionList;
+;+    local:
+;+*;
+;+};

security/nss/lib/ckfw/capi/nsscapi.h

@@ -0,0 +1,41 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef NSSCAPI_H
+#define NSSCAPI_H
+
+/*
+ * NSS CKCAPI Version numbers.
+ *
+ * These are the version numbers for the capi module packaged with
+ * this release on NSS. To determine the version numbers of the builtin
+ * module you are using, use the appropriate PKCS #11 calls.
+ *
+ * These version numbers detail changes to the PKCS #11 interface. They map
+ * to the PKCS #11 spec versions.
+ */
+#define NSS_CKCAPI_CRYPTOKI_VERSION_MAJOR 2
+#define NSS_CKCAPI_CRYPTOKI_VERSION_MINOR 20
+
+/* These version numbers detail the changes
+ * to the list of trusted certificates.
+ *
+ * NSS_CKCAPI_LIBRARY_VERSION_MINOR is a CK_BYTE.  It's not clear
+ * whether we may use its full range (0-255) or only 0-99 because
+ * of the comment in the CK_VERSION type definition.
+ */
+#define NSS_CKCAPI_LIBRARY_VERSION_MAJOR 1
+#define NSS_CKCAPI_LIBRARY_VERSION_MINOR 1
+#define NSS_CKCAPI_LIBRARY_VERSION "1.1"
+
+/* These version numbers detail the semantic changes to the ckfw engine. */
+#define NSS_CKCAPI_HARDWARE_VERSION_MAJOR 1
+#define NSS_CKCAPI_HARDWARE_VERSION_MINOR 0
+
+/* These version numbers detail the semantic changes to ckbi itself
+ * (new PKCS #11 objects), etc. */
+#define NSS_CKCAPI_FIRMWARE_VERSION_MAJOR 1
+#define NSS_CKCAPI_FIRMWARE_VERSION_MINOR 0
+
+#endif /* NSSCKBI_H */

security/nss/lib/ckfw/capi/nsscapi.rc

@@ -0,0 +1,64 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "nsscapi.h"
+#include <winver.h>
+
+#define MY_LIBNAME "nsscapi"
+#define MY_FILEDESCRIPTION "NSS Access to Microsoft CAPI"
+
+#ifdef _DEBUG
+#define MY_DEBUG_STR " (debug)"
+#define MY_FILEFLAGS_1 VS_FF_DEBUG
+#else
+#define MY_DEBUG_STR ""
+#define MY_FILEFLAGS_1 0x0L
+#endif
+#if NSS_BETA
+#define MY_FILEFLAGS_2 MY_FILEFLAGS_1|VS_FF_PRERELEASE
+#else
+#define MY_FILEFLAGS_2 MY_FILEFLAGS_1
+#endif
+
+#ifdef WINNT
+#define MY_FILEOS VOS_NT_WINDOWS32
+#else
+#define MY_FILEOS VOS__WINDOWS32
+#endif
+
+#define MY_INTERNAL_NAME MY_LIBNAME
+
+/////////////////////////////////////////////////////////////////////////////
+//
+// Version-information resource
+//
+
+VS_VERSION_INFO VERSIONINFO
+ FILEVERSION NSS_CKCAPI_LIBRARY_VERSION_MAJOR,NSS_CKCAPI_LIBRARY_VERSION_MINOR,0,0
+ PRODUCTVERSION NSS_CKCAPI_LIBRARY_VERSION_MAJOR,NSS_CKCAPI_LIBRARY_VERSION_MINOR,0,0
+ FILEFLAGSMASK VS_FFI_FILEFLAGSMASK
+ FILEFLAGS MY_FILEFLAGS_2
+ FILEOS MY_FILEOS
+ FILETYPE VFT_DLL
+ FILESUBTYPE 0x0L // not used
+
+BEGIN
+    BLOCK "StringFileInfo"
+    BEGIN
+        BLOCK "040904B0" // Lang=US English, CharSet=Unicode
+        BEGIN
+            VALUE "CompanyName", "Mozilla Foundation\0"
+            VALUE "FileDescription", MY_FILEDESCRIPTION MY_DEBUG_STR "\0"
+            VALUE "FileVersion", NSS_CKCAPI_LIBRARY_VERSION "\0"
+            VALUE "InternalName", MY_INTERNAL_NAME "\0"
+            VALUE "OriginalFilename", MY_INTERNAL_NAME ".dll\0"
+            VALUE "ProductName", "Network Security Services\0"
+            VALUE "ProductVersion", NSS_CKCAPI_LIBRARY_VERSION "\0"
+        END
+    END
+    BLOCK "VarFileInfo"
+    BEGIN
+        VALUE "Translation", 0x409, 1200
+    END
+END

security/nss/lib/ckfw/capi/staticobj.c

@@ -0,0 +1,40 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef CKCAPI_H
+#include "ckcapi.h"
+#endif /* CKCAPI_H */
+
+static const CK_TRUST ckt_netscape_valid = CKT_NETSCAPE_VALID;
+static const CK_OBJECT_CLASS cko_certificate = CKO_CERTIFICATE;
+static const CK_TRUST ckt_netscape_trusted_delegator = CKT_NETSCAPE_TRUSTED_DELEGATOR;
+static const CK_OBJECT_CLASS cko_netscape_trust = CKO_NETSCAPE_TRUST;
+static const CK_BBOOL ck_true = CK_TRUE;
+static const CK_OBJECT_CLASS cko_data = CKO_DATA;
+static const CK_CERTIFICATE_TYPE ckc_x_509 = CKC_X_509;
+static const CK_BBOOL ck_false = CK_FALSE;
+static const CK_OBJECT_CLASS cko_netscape_builtin_root_list = CKO_NETSCAPE_BUILTIN_ROOT_LIST;
+
+/* example of a static object */
+static const CK_ATTRIBUTE_TYPE nss_ckcapi_types_1[] = {
+    CKA_CLASS, CKA_TOKEN, CKA_PRIVATE, CKA_MODIFIABLE, CKA_LABEL
+};
+
+static const NSSItem nss_ckcapi_items_1[] = {
+    { (void *)&cko_data, (PRUint32)sizeof(CK_OBJECT_CLASS) },
+    { (void *)&ck_true, (PRUint32)sizeof(CK_BBOOL) },
+    { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
+    { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
+    { (void *)"Mozilla CAPI Access", (PRUint32)20 }
+};
+
+ckcapiInternalObject nss_ckcapi_data[] = {
+    {
+        ckcapiRaw,
+        { 5, nss_ckcapi_types_1, nss_ckcapi_items_1 },
+    },
+
+};
+
+const PRUint32 nss_ckcapi_nObjects = 1;

security/nss/lib/ckfw/ck.api

@@ -0,0 +1,541 @@
+# 
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+# This file is in part derived from a file "pkcs11f.h" made available
+# by RSA Security at ftp://ftp.rsasecurity.com/pub/pkcs/pkcs-11/pkcs11f.h
+
+# Fields
+#  FUNCTION introduces a Cryptoki function
+#  CK_type specifies and introduces an argument
+#
+
+# General-purpose
+
+# C_Initialize initializes the Cryptoki library.
+FUNCTION C_Initialize
+CK_VOID_PTR pInitArgs   # if this is not NULL_PTR, it gets
+                        # cast to CK_C_INITIALIZE_ARGS_PTR
+                        # and dereferenced
+
+# C_Finalize indicates that an application is done with the
+# Cryptoki library.
+FUNCTION C_Finalize
+CK_VOID_PTR pReserved   # reserved.  Should be NULL_PTR
+
+# C_GetInfo returns general information about Cryptoki. 
+FUNCTION C_GetInfo
+CK_INFO_PTR pInfo       # location that receives information
+
+# C_GetFunctionList returns the function list. 
+FUNCTION C_GetFunctionList
+CK_FUNCTION_LIST_PTR_PTR ppFunctionList # receives pointer to function 
+                                        # list
+
+
+# Slot and token management 
+
+# C_GetSlotList obtains a list of slots in the system. 
+FUNCTION C_GetSlotList
+CK_BBOOL       tokenPresent # only slots with tokens? 
+CK_SLOT_ID_PTR pSlotList    # receives array of slot IDs 
+CK_ULONG_PTR   pulCount     # receives number of slots 
+
+# C_GetSlotInfo obtains information about a particular slot in the 
+# system.
+FUNCTION C_GetSlotInfo
+CK_SLOT_ID       slotID     # the ID of the slot 
+CK_SLOT_INFO_PTR pInfo      # receives the slot information 
+
+# C_GetTokenInfo obtains information about a particular token in the 
+# system. 
+FUNCTION C_GetTokenInfo
+CK_SLOT_ID        slotID    # ID of the token's slot 
+CK_TOKEN_INFO_PTR pInfo     # receives the token information 
+
+# C_GetMechanismList obtains a list of mechanism types supported by a 
+# token. 
+FUNCTION C_GetMechanismList
+CK_SLOT_ID            slotID            # ID of token's slot 
+CK_MECHANISM_TYPE_PTR pMechanismList    # gets mech. array 
+CK_ULONG_PTR          pulCount          # gets # of mechs. 
+
+# C_GetMechanismInfo obtains information about a particular mechanism 
+# possibly supported by a token. 
+FUNCTION C_GetMechanismInfo
+CK_SLOT_ID            slotID    # ID of the token's slot 
+CK_MECHANISM_TYPE     type      # type of mechanism 
+CK_MECHANISM_INFO_PTR pInfo     # receives mechanism info 
+
+# C_InitToken initializes a token. 
+FUNCTION C_InitToken
+CK_SLOT_ID  slotID      # ID of the token's slot 
+CK_CHAR_PTR pPin        # the SO's initial PIN 
+CK_ULONG    ulPinLen    # length in bytes of the PIN 
+CK_CHAR_PTR pLabel      # 32-byte token label (blank padded) 
+
+# C_InitPIN initializes the normal user's PIN. 
+FUNCTION C_InitPIN
+CK_SESSION_HANDLE hSession  # the session's handle 
+CK_CHAR_PTR       pPin      # the normal user's PIN 
+CK_ULONG          ulPinLen  # length in bytes of the PIN 
+
+# C_SetPIN modifies the PIN of the user who is logged in. 
+FUNCTION C_SetPIN
+CK_SESSION_HANDLE hSession  # the session's handle 
+CK_CHAR_PTR       pOldPin   # the old PIN 
+CK_ULONG          ulOldLen  # length of the old PIN 
+CK_CHAR_PTR       pNewPin   # the new PIN 
+CK_ULONG          ulNewLen  # length of the new PIN 
+
+
+# Session management 
+
+# C_OpenSession opens a session between an application and a token. 
+FUNCTION C_OpenSession
+CK_SLOT_ID            slotID        # the slot's ID 
+CK_FLAGS              flags         # from CK_SESSION_INFO 
+CK_VOID_PTR           pApplication  # passed to callback 
+CK_NOTIFY             Notify        # callback function 
+CK_SESSION_HANDLE_PTR phSession     # gets session handle 
+
+# C_CloseSession closes a session between an application and a token. 
+FUNCTION C_CloseSession
+CK_SESSION_HANDLE hSession  # the session's handle 
+
+# C_CloseAllSessions closes all sessions with a token. 
+FUNCTION C_CloseAllSessions
+CK_SLOT_ID slotID   # the token's slot 
+
+# C_GetSessionInfo obtains information about the session. 
+FUNCTION C_GetSessionInfo
+CK_SESSION_HANDLE   hSession    # the session's handle 
+CK_SESSION_INFO_PTR pInfo       # receives session info 
+
+# C_GetOperationState obtains the state of the cryptographic 
+# operation in a session. 
+FUNCTION C_GetOperationState
+CK_SESSION_HANDLE hSession              # session's handle 
+CK_BYTE_PTR       pOperationState       # gets state 
+CK_ULONG_PTR      pulOperationStateLen  # gets state length 
+
+# C_SetOperationState restores the state of the cryptographic 
+# operation in a session. 
+FUNCTION C_SetOperationState
+CK_SESSION_HANDLE hSession              # session's handle 
+CK_BYTE_PTR      pOperationState        # holds state 
+CK_ULONG         ulOperationStateLen    # holds state length 
+CK_OBJECT_HANDLE hEncryptionKey         # en/decryption key 
+CK_OBJECT_HANDLE hAuthenticationKey     # sign/verify key 
+
+# C_Login logs a user into a token. 
+FUNCTION C_Login
+CK_SESSION_HANDLE hSession  # the session's handle 
+CK_USER_TYPE      userType  # the user type 
+CK_CHAR_PTR       pPin      # the user's PIN 
+CK_ULONG          ulPinLen  # the length of the PIN 
+
+# C_Logout logs a user out from a token. 
+FUNCTION C_Logout
+CK_SESSION_HANDLE hSession  # the session's handle 
+
+
+# Object management 
+
+# C_CreateObject creates a new object. 
+FUNCTION C_CreateObject
+CK_SESSION_HANDLE    hSession   # the session's handle 
+CK_ATTRIBUTE_PTR     pTemplate  # the object's template 
+CK_ULONG             ulCount    # attributes in template 
+CK_OBJECT_HANDLE_PTR phObject   # gets new object's handle. 
+
+# C_CopyObject copies an object, creating a new object for the copy.
+FUNCTION C_CopyObject
+CK_SESSION_HANDLE    hSession       # the session's handle 
+CK_OBJECT_HANDLE     hObject        # the object's handle 
+CK_ATTRIBUTE_PTR     pTemplate      # template for new object 
+CK_ULONG             ulCount        # attributes in template 
+CK_OBJECT_HANDLE_PTR phNewObject    # receives handle of copy 
+
+# C_DestroyObject destroys an object. 
+FUNCTION C_DestroyObject
+CK_SESSION_HANDLE hSession  # the session's handle 
+CK_OBJECT_HANDLE  hObject   # the object's handle 
+
+# C_GetObjectSize gets the size of an object in bytes. 
+FUNCTION C_GetObjectSize
+CK_SESSION_HANDLE hSession  # the session's handle 
+CK_OBJECT_HANDLE  hObject   # the object's handle 
+CK_ULONG_PTR      pulSize   # receives size of object 
+
+# C_GetAttributeValue obtains the value of one or more object 
+# attributes. 
+FUNCTION C_GetAttributeValue
+CK_SESSION_HANDLE hSession    # the session's handle 
+CK_OBJECT_HANDLE  hObject     # the object's handle 
+CK_ATTRIBUTE_PTR  pTemplate   # specifies attrs; gets vals 
+CK_ULONG          ulCount     # attributes in template 
+
+# C_SetAttributeValue modifies the value of one or more object 
+# attributes 
+FUNCTION C_SetAttributeValue
+CK_SESSION_HANDLE hSession    # the session's handle 
+CK_OBJECT_HANDLE  hObject     # the object's handle 
+CK_ATTRIBUTE_PTR  pTemplate   # specifies attrs and values 
+CK_ULONG          ulCount     # attributes in template 
+
+# C_FindObjectsInit initializes a search for token and session 
+# objects that match a template. 
+FUNCTION C_FindObjectsInit
+CK_SESSION_HANDLE hSession    # the session's handle 
+CK_ATTRIBUTE_PTR  pTemplate   # attribute values to match 
+CK_ULONG          ulCount     # attrs in search template 
+
+# C_FindObjects continues a search for token and session objects that 
+# match a template, obtaining additional object handles. 
+FUNCTION C_FindObjects
+CK_SESSION_HANDLE    hSession           # session's handle 
+CK_OBJECT_HANDLE_PTR phObject           # gets obj. handles 
+CK_ULONG             ulMaxObjectCount   # max handles to get 
+CK_ULONG_PTR         pulObjectCount     # actual # returned 
+
+# C_FindObjectsFinal finishes a search for token and session objects. 
+FUNCTION C_FindObjectsFinal
+CK_SESSION_HANDLE hSession  # the session's handle 
+
+
+# Encryption and decryption 
+
+# C_EncryptInit initializes an encryption operation. 
+FUNCTION C_EncryptInit
+CK_SESSION_HANDLE hSession    # the session's handle 
+CK_MECHANISM_PTR  pMechanism  # the encryption mechanism 
+CK_OBJECT_HANDLE  hKey        # handle of encryption key 
+
+# C_Encrypt encrypts single-part data. 
+FUNCTION C_Encrypt
+CK_SESSION_HANDLE hSession              # session's handle 
+CK_BYTE_PTR       pData                 # the plaintext data 
+CK_ULONG          ulDataLen             # bytes of plaintext 
+CK_BYTE_PTR       pEncryptedData        # gets ciphertext 
+CK_ULONG_PTR      pulEncryptedDataLen   # gets c-text size 
+
+# C_EncryptUpdate continues a multiple-part encryption operation. 
+FUNCTION C_EncryptUpdate
+CK_SESSION_HANDLE hSession              # session's handle 
+CK_BYTE_PTR       pPart                 # the plaintext data 
+CK_ULONG          ulPartLen             # plaintext data len 
+CK_BYTE_PTR       pEncryptedPart        # gets ciphertext 
+CK_ULONG_PTR      pulEncryptedPartLen   # gets c-text size 
+
+# C_EncryptFinal finishes a multiple-part encryption operation. 
+FUNCTION C_EncryptFinal
+CK_SESSION_HANDLE hSession                  # session handle 
+CK_BYTE_PTR       pLastEncryptedPart        # last c-text 
+CK_ULONG_PTR      pulLastEncryptedPartLen   # gets last size 
+
+# C_DecryptInit initializes a decryption operation. 
+FUNCTION C_DecryptInit
+CK_SESSION_HANDLE hSession      # the session's handle 
+CK_MECHANISM_PTR  pMechanism    # the decryption mechanism 
+CK_OBJECT_HANDLE  hKey          # handle of decryption key 
+
+# C_Decrypt decrypts encrypted data in a single part. 
+FUNCTION C_Decrypt
+CK_SESSION_HANDLE hSession              # session's handle 
+CK_BYTE_PTR       pEncryptedData        # ciphertext 
+CK_ULONG          ulEncryptedDataLen    # ciphertext length 
+CK_BYTE_PTR       pData                 # gets plaintext 
+CK_ULONG_PTR      pulDataLen            # gets p-text size 
+
+# C_DecryptUpdate continues a multiple-part decryption operation. 
+FUNCTION C_DecryptUpdate
+CK_SESSION_HANDLE hSession              # session's handle 
+CK_BYTE_PTR       pEncryptedPart        # encrypted data 
+CK_ULONG          ulEncryptedPartLen    # input length 
+CK_BYTE_PTR       pPart                 # gets plaintext 
+CK_ULONG_PTR      pulPartLen            # p-text size 
+
+# C_DecryptFinal finishes a multiple-part decryption operation. 
+FUNCTION C_DecryptFinal
+CK_SESSION_HANDLE hSession          # the session's handle 
+CK_BYTE_PTR       pLastPart         # gets plaintext 
+CK_ULONG_PTR      pulLastPartLen    # p-text size 
+
+
+# Message digesting 
+
+# C_DigestInit initializes a message-digesting operation. 
+FUNCTION C_DigestInit
+CK_SESSION_HANDLE hSession      # the session's handle 
+CK_MECHANISM_PTR  pMechanism    # the digesting mechanism 
+
+# C_Digest digests data in a single part. 
+FUNCTION C_Digest
+CK_SESSION_HANDLE hSession      # the session's handle 
+CK_BYTE_PTR       pData         # data to be digested 
+CK_ULONG          ulDataLen     # bytes of data to digest 
+CK_BYTE_PTR       pDigest       # gets the message digest 
+CK_ULONG_PTR      pulDigestLen  # gets digest length 
+
+# C_DigestUpdate continues a multiple-part message-digesting operation.
+FUNCTION C_DigestUpdate
+CK_SESSION_HANDLE hSession  # the session's handle 
+CK_BYTE_PTR       pPart     # data to be digested 
+CK_ULONG          ulPartLen # bytes of data to be digested 
+
+# C_DigestKey continues a multi-part message-digesting operation, by 
+# digesting the value of a secret key as part of the data already 
+# digested. 
+FUNCTION C_DigestKey
+CK_SESSION_HANDLE hSession  # the session's handle 
+CK_OBJECT_HANDLE  hKey      # secret key to digest 
+
+# C_DigestFinal finishes a multiple-part message-digesting operation. 
+FUNCTION C_DigestFinal
+CK_SESSION_HANDLE hSession      # the session's handle 
+CK_BYTE_PTR       pDigest       # gets the message digest 
+CK_ULONG_PTR      pulDigestLen  # gets byte count of digest 
+
+
+# Signing and MACing 
+
+# C_SignInit initializes a signature (private key encryption) 
+# operation, where the signature is (will be) an appendix to the 
+# data, and plaintext cannot be recovered from the signature. 
+FUNCTION C_SignInit
+CK_SESSION_HANDLE hSession      # the session's handle 
+CK_MECHANISM_PTR  pMechanism    # the signature mechanism 
+CK_OBJECT_HANDLE  hKey          # handle of signature key 
+
+# C_Sign signs (encrypts with private key) data in a single part, 
+# where the signature is (will be) an appendix to the data, and 
+# plaintext cannot be recovered from the signature. 
+FUNCTION C_Sign
+CK_SESSION_HANDLE hSession          # the session's handle 
+CK_BYTE_PTR       pData             # the data to sign 
+CK_ULONG          ulDataLen         # count of bytes to sign 
+CK_BYTE_PTR       pSignature        # gets the signature 
+CK_ULONG_PTR      pulSignatureLen   # gets signature length 
+
+# C_SignUpdate continues a multiple-part signature operation, where 
+# the signature is (will be) an appendix to the data, and plaintext 
+# cannot be recovered from the signature. 
+FUNCTION C_SignUpdate
+CK_SESSION_HANDLE hSession  # the session's handle 
+CK_BYTE_PTR       pPart     # the data to sign 
+CK_ULONG          ulPartLen # count of bytes to sign 
+
+# C_SignFinal finishes a multiple-part signature operation, returning 
+# the signature. 
+FUNCTION C_SignFinal
+CK_SESSION_HANDLE hSession          # the session's handle 
+CK_BYTE_PTR       pSignature        # gets the signature 
+CK_ULONG_PTR      pulSignatureLen   # gets signature length 
+
+# C_SignRecoverInit initializes a signature operation, where the data 
+# can be recovered from the signature. 
+FUNCTION C_SignRecoverInit
+CK_SESSION_HANDLE hSession      # the session's handle 
+CK_MECHANISM_PTR  pMechanism    # the signature mechanism 
+CK_OBJECT_HANDLE  hKey          # handle of the signature key 
+
+# C_SignRecover signs data in a single operation, where the data can 
+# be recovered from the signature. 
+FUNCTION C_SignRecover
+CK_SESSION_HANDLE hSession          # the session's handle 
+CK_BYTE_PTR       pData             # the data to sign 
+CK_ULONG          ulDataLen         # count of bytes to sign 
+CK_BYTE_PTR       pSignature        # gets the signature 
+CK_ULONG_PTR      pulSignatureLen   # gets signature length 
+
+
+# Verifying signatures and MACs 
+
+# C_VerifyInit initializes a verification operation, where the 
+# signature is an appendix to the data, and plaintext cannot cannot 
+# be recovered from the signature (e.g. DSA). 
+FUNCTION C_VerifyInit
+CK_SESSION_HANDLE hSession      # the session's handle 
+CK_MECHANISM_PTR  pMechanism    # the verification mechanism 
+CK_OBJECT_HANDLE  hKey          # verification key  
+
+# C_Verify verifies a signature in a single-part operation, where the 
+# signature is an appendix to the data, and plaintext cannot be 
+# recovered from the signature. 
+FUNCTION C_Verify
+CK_SESSION_HANDLE hSession          # the session's handle 
+CK_BYTE_PTR       pData             # signed data 
+CK_ULONG          ulDataLen         # length of signed data 
+CK_BYTE_PTR       pSignature        # signature 
+CK_ULONG          ulSignatureLen    # signature length
+
+# C_VerifyUpdate continues a multiple-part verification operation, 
+# where the signature is an appendix to the data, and plaintext cannot be 
+# recovered from the signature. 
+FUNCTION C_VerifyUpdate
+CK_SESSION_HANDLE hSession  # the session's handle 
+CK_BYTE_PTR       pPart     # signed data 
+CK_ULONG          ulPartLen # length of signed data 
+
+# C_VerifyFinal finishes a multiple-part verification operation, 
+# checking the signature. 
+FUNCTION C_VerifyFinal
+CK_SESSION_HANDLE hSession          # the session's handle 
+CK_BYTE_PTR       pSignature        # signature to verify 
+CK_ULONG          ulSignatureLen    # signature length 
+
+# C_VerifyRecoverInit initializes a signature verification operation, 
+# where the data is recovered from the signature. 
+FUNCTION C_VerifyRecoverInit
+CK_SESSION_HANDLE hSession      # the session's handle 
+CK_MECHANISM_PTR  pMechanism    # the verification mechanism 
+CK_OBJECT_HANDLE  hKey          # verification key 
+
+# C_VerifyRecover verifies a signature in a single-part operation, 
+# where the data is recovered from the signature. 
+FUNCTION C_VerifyRecover
+CK_SESSION_HANDLE hSession          # the session's handle 
+CK_BYTE_PTR       pSignature        # signature to verify 
+CK_ULONG          ulSignatureLen    # signature length 
+CK_BYTE_PTR       pData             # gets signed data 
+CK_ULONG_PTR      pulDataLen        # gets signed data len 
+
+
+# Dual-function cryptographic operations 
+
+# C_DigestEncryptUpdate continues a multiple-part digesting and 
+# encryption operation. 
+FUNCTION C_DigestEncryptUpdate
+CK_SESSION_HANDLE hSession              # session's handle 
+CK_BYTE_PTR       pPart                 # the plaintext data 
+CK_ULONG          ulPartLen             # plaintext length 
+CK_BYTE_PTR       pEncryptedPart        # gets ciphertext 
+CK_ULONG_PTR      pulEncryptedPartLen   # gets c-text length 
+
+# C_DecryptDigestUpdate continues a multiple-part decryption and 
+# digesting operation. 
+FUNCTION C_DecryptDigestUpdate
+CK_SESSION_HANDLE hSession              # session's handle 
+CK_BYTE_PTR       pEncryptedPart        # ciphertext 
+CK_ULONG          ulEncryptedPartLen    # ciphertext length 
+CK_BYTE_PTR       pPart                 # gets plaintext 
+CK_ULONG_PTR      pulPartLen            # gets plaintext len 
+
+# C_SignEncryptUpdate continues a multiple-part signing and 
+# encryption operation. 
+FUNCTION C_SignEncryptUpdate
+CK_SESSION_HANDLE hSession              # session's handle 
+CK_BYTE_PTR       pPart                 # the plaintext data 
+CK_ULONG          ulPartLen             # plaintext length 
+CK_BYTE_PTR       pEncryptedPart        # gets ciphertext 
+CK_ULONG_PTR      pulEncryptedPartLen   # gets c-text length 
+
+# C_DecryptVerifyUpdate continues a multiple-part decryption and 
+# verify operation. 
+FUNCTION C_DecryptVerifyUpdate
+CK_SESSION_HANDLE hSession              # session's handle 
+CK_BYTE_PTR       pEncryptedPart        # ciphertext 
+CK_ULONG          ulEncryptedPartLen    # ciphertext length 
+CK_BYTE_PTR       pPart                 # gets plaintext 
+CK_ULONG_PTR      pulPartLen            # gets p-text length 
+
+
+# Key management 
+
+# C_GenerateKey generates a secret key, creating a new key object. 
+FUNCTION C_GenerateKey
+CK_SESSION_HANDLE    hSession   # the session's handle 
+CK_MECHANISM_PTR     pMechanism # key generation mech. 
+CK_ATTRIBUTE_PTR     pTemplate  # template for new key 
+CK_ULONG             ulCount    # # of attrs in template 
+CK_OBJECT_HANDLE_PTR phKey      # gets handle of new key 
+
+# C_GenerateKeyPair generates a public-key/private-key pair, creating 
+# new key objects. 
+FUNCTION C_GenerateKeyPair
+CK_SESSION_HANDLE    hSession                   # session handle
+CK_MECHANISM_PTR     pMechanism                 # key-gen mech.
+CK_ATTRIBUTE_PTR     pPublicKeyTemplate         # template for pub. key
+CK_ULONG             ulPublicKeyAttributeCount  # # pub. attrs.
+CK_ATTRIBUTE_PTR     pPrivateKeyTemplate        # template for priv. key
+CK_ULONG             ulPrivateKeyAttributeCount # # priv. attrs.
+CK_OBJECT_HANDLE_PTR phPublicKey                # gets pub. key handle
+CK_OBJECT_HANDLE_PTR phPrivateKey               # gets priv. key handle
+
+# C_WrapKey wraps (i.e., encrypts) a key. 
+FUNCTION C_WrapKey
+CK_SESSION_HANDLE hSession         # the session's handle 
+CK_MECHANISM_PTR  pMechanism       # the wrapping mechanism 
+CK_OBJECT_HANDLE  hWrappingKey     # wrapping key 
+CK_OBJECT_HANDLE  hKey             # key to be wrapped 
+CK_BYTE_PTR       pWrappedKey      # gets wrapped key 
+CK_ULONG_PTR      pulWrappedKeyLen # gets wrapped key size 
+
+# C_UnwrapKey unwraps (decrypts) a wrapped key, creating a new key 
+# object. 
+FUNCTION C_UnwrapKey
+CK_SESSION_HANDLE    hSession           # session's handle 
+CK_MECHANISM_PTR     pMechanism         # unwrapping mech. 
+CK_OBJECT_HANDLE     hUnwrappingKey     # unwrapping key 
+CK_BYTE_PTR          pWrappedKey        # the wrapped key 
+CK_ULONG             ulWrappedKeyLen    # wrapped key len 
+CK_ATTRIBUTE_PTR     pTemplate          # new key template 
+CK_ULONG             ulAttributeCount   # template length 
+CK_OBJECT_HANDLE_PTR phKey              # gets new handle 
+
+# C_DeriveKey derives a key from a base key, creating a new key object.
+FUNCTION C_DeriveKey
+CK_SESSION_HANDLE    hSession           # session's handle 
+CK_MECHANISM_PTR     pMechanism         # key deriv. mech. 
+CK_OBJECT_HANDLE     hBaseKey           # base key 
+CK_ATTRIBUTE_PTR     pTemplate          # new key template 
+CK_ULONG             ulAttributeCount   # template length 
+CK_OBJECT_HANDLE_PTR phKey              # gets new handle 
+
+
+# Random number generation 
+
+# C_SeedRandom mixes additional seed material into the token's random 
+# number generator. 
+FUNCTION C_SeedRandom
+CK_SESSION_HANDLE hSession  # the session's handle 
+CK_BYTE_PTR       pSeed     # the seed material 
+CK_ULONG          ulSeedLen # length of seed material 
+
+# C_GenerateRandom generates random data. 
+FUNCTION C_GenerateRandom
+CK_SESSION_HANDLE hSession      # the session's handle 
+CK_BYTE_PTR       RandomData    # receives the random data 
+CK_ULONG          ulRandomLen   # # of bytes to generate 
+
+
+# Parallel function management 
+
+# C_GetFunctionStatus is a legacy function; it obtains an updated 
+# status of a function running in parallel with an application.
+FUNCTION C_GetFunctionStatus
+CK_SESSION_HANDLE hSession  # the session's handle 
+
+# C_CancelFunction is a legacy function; it cancels a function running 
+# in parallel. 
+FUNCTION C_CancelFunction
+CK_SESSION_HANDLE hSession  # the session's handle 
+
+
+# Functions added in for Cryptoki Version 2.01 or later 
+
+# C_WaitForSlotEvent waits for a slot event (token insertion, removal, 
+# etc.) to occur. 
+FUNCTION C_WaitForSlotEvent
+CK_FLAGS       flags    # blocking/nonblocking flag 
+CK_SLOT_ID_PTR pSlot    # location that receives the slot ID 
+CK_VOID_PTR    pRserved # reserved.  Should be NULL_PTR 
+
+## C_ConfigureSlot passes an installation-specified bytestring to a 
+## slot. 
+#FUNCTION C_ConfigureSlot
+#CK_SLOT_ID slotID      # the slot to configure 
+#CK_BYTE_PTR pConfig    # the configuration string 
+#CK_ULONG ulConfigLen   # length of the config string 

security/nss/lib/ckfw/ck.h

@@ -0,0 +1,88 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef CK_H
+#define CK_H
+
+/*
+ * ck.h
+ *
+ * This header file consolidates all header files needed by the source
+ * files implementing the NSS Cryptoki Framework.  This makes managing
+ * the source files a bit easier.
+ */
+
+/* Types */
+
+#ifndef NSSBASET_H
+#include "nssbaset.h"
+#endif /* NSSBASET_H */
+
+#ifndef NSSCKT_H
+#include "nssckt.h"
+#endif /* NSSCKT_H */
+
+#ifndef NSSCKFT_H
+#include "nssckft.h"
+#endif /* NSSCKFT_H */
+
+#ifndef NSSCKEPV_H
+#include "nssckepv.h"
+#endif /* NSSCKEPV_H */
+
+#ifndef NSSCKFWT_H
+#include "nssckfwt.h"
+#endif /* NSSCKFWT_H */
+
+#ifndef NSSCKMDT_H
+#include "nssckmdt.h"
+#endif /* NSSCKMDT_H */
+
+#ifndef CKT_H
+#include "ckt.h"
+#endif /* CKT_H */
+
+#ifndef CKFWTM_H
+#include "ckfwtm.h"
+#endif /* CKFWTM_H */
+
+/* Prototypes */
+
+#ifndef NSSBASE_H
+#include "nssbase.h"
+#endif /* NSSBASE_H */
+
+#ifndef NSSCKG_H
+#include "nssckg.h"
+#endif /* NSSCKG_H */
+
+#ifndef NSSCKFW_H
+#include "nssckfw.h"
+#endif /* NSSCKFW_H */
+
+#ifndef NSSCKFWC_H
+#include "nssckfwc.h"
+#endif /* NSSCKFWC_H */
+
+#ifndef CKFW_H
+#include "ckfw.h"
+#endif /* CKFW_H */
+
+#ifndef CKFWM_H
+#include "ckfwm.h"
+#endif /* CKFWM_H */
+
+#ifndef CKMD_H
+#include "ckmd.h"
+#endif /* CKMD_H */
+
+/* NSS-private */
+
+/* nss_ZNEW and the like.  We might want to publish the memory APIs.. */
+
+#ifndef BASE_H
+#include "base.h"
+#endif /* BASE_H */
+
+#endif /* CK_H */

security/nss/lib/ckfw/ckapi.perl

@@ -0,0 +1,434 @@
+#!perl
+# 
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+$copyright = '/* THIS IS A GENERATED FILE */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+';
+
+$count = -1;
+$i = 0;
+
+open(INPUT, "<$ARGV[0]") || die "Can't open $ARGV[0]: $!";
+
+while(<INPUT>) {
+  s/^((?:[^"#]+|"[^"]*")*)(\s*#.*$)/$1/;
+  next if (/^\s*$/);
+
+#  print;
+
+  /^([\S]+)\s+([^"][\S]*|"[^"]*")/;
+  $name = $1;
+  $value = $2;
+
+  if( ($name =~ "FUNCTION") && !($name =~ "CK_FUNCTION") ) {
+    $count++;
+    $x[$count]{name} = $value;
+    $i = 0;
+  } else {
+    if( $count < 0 ) {
+      $value =~ s/"//g;
+      $g{$name} = $value;
+    } else {
+      $x[$count]{args}[$i]{type} = $name;
+      $x[$count]{args}[$i]{name} = $value;
+      $i++;
+      $x[$count]{nargs} = $i; # rewritten each time, oh well
+    }
+  }
+}
+
+close INPUT;
+
+# dodump();
+doprint();
+
+sub dodump {
+  for( $j = 0; $j <= $count; $j++ ) {
+    print "CK_RV CK_ENTRY $x[$j]{name}\n";
+    for( $i = 0; $i < $x[$j]{nargs}; $i++ ) {
+      print "  $x[$j]{args}[$i]{type} $x[$j]{args}[$i]{name}";
+      if( $i == ($x[$j]{nargs} - 1) ) {
+        print "\n";
+      } else {
+        print ",\n";
+      }
+    }
+  }
+}
+
+sub doprint {
+open(PROTOTYPE, ">nssckg.h") || die "Can't open nssckg.h: $!";
+open(TYPEDEF, ">nssckft.h") || die "Can't open nssckft.h: $!";
+open(EPV, ">nssckepv.h") || die "Can't open nssckepv.h: $!";
+open(API, ">nssck.api") || die "Can't open nssck.api: $!";
+
+select PROTOTYPE;
+
+print $copyright;
+print <<EOD
+#ifndef NSSCKG_H
+#define NSSCKG_H
+
+/*
+ * nssckg.h
+ *
+ * This automatically-generated header file prototypes the Cryptoki
+ * functions specified by PKCS#11.
+ */
+
+#ifndef NSSCKT_H
+#include "nssckt.h"
+#endif /* NSSCKT_H */
+
+EOD
+    ;
+
+for( $j = 0; $j <= $count; $j++ ) {
+  print "CK_RV CK_ENTRY $x[$j]{name}\n";
+  print "(\n";
+  for( $i = 0; $i < $x[$j]{nargs}; $i++ ) {
+    print "  $x[$j]{args}[$i]{type} $x[$j]{args}[$i]{name}";
+    if( $i == ($x[$j]{nargs} - 1) ) {
+      print "\n";
+    } else {
+      print ",\n";
+    }
+  }
+  print ");\n\n";
+}
+
+print <<EOD
+#endif /* NSSCKG_H */
+EOD
+    ;
+
+select TYPEDEF;
+
+print $copyright;
+print <<EOD
+#ifndef NSSCKFT_H
+#define NSSCKFT_H
+
+/*
+ * nssckft.h
+ *
+ * The automatically-generated header file declares a typedef
+ * each of the Cryptoki functions specified by PKCS#11.
+ */
+
+#ifndef NSSCKT_H
+#include "nssckt.h"
+#endif /* NSSCKT_H */
+
+EOD
+    ;
+
+for( $j = 0; $j <= $count; $j++ ) {
+#  print "typedef CK_RV (CK_ENTRY *CK_$x[$j]{name})(\n";
+  print "typedef CK_CALLBACK_FUNCTION(CK_RV, CK_$x[$j]{name})(\n";
+  for( $i = 0; $i < $x[$j]{nargs}; $i++ ) {
+    print "  $x[$j]{args}[$i]{type} $x[$j]{args}[$i]{name}";
+    if( $i == ($x[$j]{nargs} - 1) ) {
+      print "\n";
+    } else {
+      print ",\n";
+    }
+  }
+  print ");\n\n";
+}
+
+print <<EOD
+#endif /* NSSCKFT_H */
+EOD
+    ;
+
+select EPV;
+
+print $copyright;
+print <<EOD
+#ifndef NSSCKEPV_H
+#define NSSCKEPV_H
+
+/*
+ * nssckepv.h
+ *
+ * This automatically-generated header file defines the type
+ * CK_FUNCTION_LIST specified by PKCS#11.
+ */
+
+#ifndef NSSCKT_H
+#include "nssckt.h"
+#endif /* NSSCKT_H */
+
+#ifndef NSSCKFT_H
+#include "nssckft.h"
+#endif /* NSSCKFT_H */
+
+#include "nssckp.h"
+
+struct CK_FUNCTION_LIST {
+  CK_VERSION version;
+EOD
+    ;
+
+for( $j = 0; $j <= $count; $j++ ) {
+  print "  CK_$x[$j]{name} $x[$j]{name};\n";
+}
+
+print <<EOD
+};
+
+#include "nsscku.h"
+
+#endif /* NSSCKEPV_H */
+EOD
+    ;
+
+select API;
+
+print $copyright;
+print <<EOD
+
+/*
+ * nssck.api
+ *
+ * This automatically-generated file is used to generate a set of
+ * Cryptoki entry points within the object space of a Module using
+ * the NSS Cryptoki Framework.
+ *
+ * The Module should have a .c file with the following:
+ *
+ *  #define MODULE_NAME name
+ *  #define INSTANCE_NAME instance
+ *  #include "nssck.api"
+ *
+ * where "name" is some module-specific name that can be used to
+ * disambiguate various modules.  This included file will then
+ * define the actual Cryptoki routines which pass through to the
+ * Framework calls.  All routines, except C_GetFunctionList, will
+ * be prefixed with the name; C_GetFunctionList will be generated
+ * to return an entry-point vector with these routines.  The
+ * instance specified should be the basic instance of NSSCKMDInstance.
+ *
+ * If, prior to including nssck.api, the .c file also specifies
+ *
+ *  #define DECLARE_STRICT_CRYTPOKI_NAMES
+ *
+ * Then a set of "stub" routines not prefixed with the name will
+ * be included.  This would allow the combined module and framework
+ * to be used in applications which are hard-coded to use the
+ * PKCS#11 names (instead of going through the EPV).  Please note
+ * that such applications should be careful resolving symbols when
+ * more than one PKCS#11 module is loaded.
+ */
+
+#ifndef MODULE_NAME
+#error "Error: MODULE_NAME must be defined."
+#endif /* MODULE_NAME */
+
+#ifndef INSTANCE_NAME
+#error "Error: INSTANCE_NAME must be defined."
+#endif /* INSTANCE_NAME */
+
+#ifndef NSSCKT_H
+#include "nssckt.h"
+#endif /* NSSCKT_H */
+
+#ifndef NSSCKFWT_H
+#include "nssckfwt.h"
+#endif /* NSSCKFWT_H */
+
+#ifndef NSSCKFWC_H
+#include "nssckfwc.h"
+#endif /* NSSCKFWC_H */
+
+#ifndef NSSCKEPV_H
+#include "nssckepv.h"
+#endif /* NSSCKEPV_H */
+
+#define ADJOIN(x,y) x##y
+
+#define __ADJOIN(x,y) ADJOIN(x,y)
+
+/*
+ * The anchor.  This object is used to store an "anchor" pointer in
+ * the Module's object space, so the wrapper functions can relate
+ * back to this instance.
+ */
+
+static NSSCKFWInstance *fwInstance = (NSSCKFWInstance *)0;
+
+static CK_RV CK_ENTRY
+__ADJOIN(MODULE_NAME,C_Initialize)
+(
+  CK_VOID_PTR pInitArgs
+)
+{
+  return NSSCKFWC_Initialize(&fwInstance, INSTANCE_NAME, pInitArgs);
+}
+
+#ifdef DECLARE_STRICT_CRYPTOKI_NAMES
+CK_RV CK_ENTRY 
+C_Initialize
+(
+  CK_VOID_PTR pInitArgs
+)
+{
+  return __ADJOIN(MODULE_NAME,C_Initialize)(pInitArgs);
+}
+#endif /* DECLARE_STRICT_CRYPTOKI_NAMES */
+
+static CK_RV CK_ENTRY
+__ADJOIN(MODULE_NAME,C_Finalize)
+(
+  CK_VOID_PTR pReserved
+)
+{
+  return NSSCKFWC_Finalize(&fwInstance);
+}
+
+#ifdef DECLARE_STRICT_CRYPTOKI_NAMES
+CK_RV CK_ENTRY
+C_Finalize
+(
+  CK_VOID_PTR pReserved
+)
+{
+  return __ADJOIN(MODULE_NAME,C_Finalize)(pReserved);
+}
+#endif /* DECLARE_STRICT_CRYPTOKI_NAMES */
+
+static CK_RV CK_ENTRY
+__ADJOIN(MODULE_NAME,C_GetInfo)
+(
+  CK_INFO_PTR pInfo
+)
+{
+  return NSSCKFWC_GetInfo(fwInstance, pInfo);
+}
+
+#ifdef DECLARE_STRICT_CRYPTOKI_NAMES
+CK_RV CK_ENTRY
+C_GetInfo
+(
+  CK_INFO_PTR pInfo
+)
+{
+  return __ADJOIN(MODULE_NAME,C_GetInfo)(pInfo);
+}
+#endif /* DECLARE_STRICT_CRYPTOKI_NAMES */
+
+/*
+ * C_GetFunctionList is defined at the end.
+ */
+
+EOD
+    ;
+
+for( $j = 4; $j <= $count; $j++ ) {
+  print "static CK_RV CK_ENTRY\n";
+  print "__ADJOIN(MODULE_NAME,$x[$j]{name})\n";
+  print "(\n";
+  for( $i = 0; $i < $x[$j]{nargs}; $i++ ) {
+    print "  $x[$j]{args}[$i]{type} $x[$j]{args}[$i]{name}";
+    if( $i == ($x[$j]{nargs} - 1) ) {
+      print "\n";
+    } else {
+      print ",\n";
+    }
+  }
+  print ")\n";
+  print "{\n";
+  print "  return NSSCKFW$x[$j]{name}(fwInstance, ";
+  for( $i = 0; $i < $x[$j]{nargs}; $i++ ) {
+    print "$x[$j]{args}[$i]{name}";
+    if( $i == ($x[$j]{nargs} - 1) ) {
+      print ");\n";
+    } else {
+      print ", ";
+    }
+  }
+  print "}\n\n";
+
+  print "#ifdef DECLARE_STRICT_CRYPTOKI_NAMES\n";
+  print "CK_RV CK_ENTRY\n";
+  print "$x[$j]{name}\n";
+  print "(\n";
+  for( $i = 0; $i < $x[$j]{nargs}; $i++ ) {
+    print "  $x[$j]{args}[$i]{type} $x[$j]{args}[$i]{name}";
+    if( $i == ($x[$j]{nargs} - 1) ) {
+      print "\n";
+    } else {
+      print ",\n";
+    }
+  }
+  print ")\n";
+  print "{\n";
+  print "  return __ADJOIN(MODULE_NAME,$x[$j]{name})(";
+  for( $i = 0; $i < $x[$j]{nargs}; $i++ ) {
+    print "$x[$j]{args}[$i]{name}";
+    if( $i == ($x[$j]{nargs} - 1) ) {
+      print ");\n";
+    } else {
+      print ", ";
+    }
+  }
+  print "}\n";
+  print "#endif /* DECLARE_STRICT_CRYPTOKI_NAMES */\n\n";
+}
+
+print <<EOD
+static CK_RV CK_ENTRY
+__ADJOIN(MODULE_NAME,C_GetFunctionList)
+(
+  CK_FUNCTION_LIST_PTR_PTR ppFunctionList
+);
+
+static CK_FUNCTION_LIST FunctionList = {
+  { 2, 1 },
+EOD
+    ;
+
+for( $j = 0; $j <= $count; $j++ ) {
+  print "__ADJOIN(MODULE_NAME,$x[$j]{name})";
+  if( $j < $count ) {
+    print ",\n";
+  } else {
+    print "\n};\n\n";
+  }
+}
+
+print <<EOD
+static CK_RV CK_ENTRY
+__ADJOIN(MODULE_NAME,C_GetFunctionList)
+(
+  CK_FUNCTION_LIST_PTR_PTR ppFunctionList
+)
+{
+  *ppFunctionList = &FunctionList;
+  return CKR_OK;
+}
+
+/* This one is always present */
+CK_RV CK_ENTRY
+C_GetFunctionList
+(
+  CK_FUNCTION_LIST_PTR_PTR ppFunctionList
+)
+{
+  return __ADJOIN(MODULE_NAME,C_GetFunctionList)(ppFunctionList);
+}
+
+#undef __ADJOIN
+
+EOD
+    ;
+
+select STDOUT;
+
+}

security/nss/lib/ckfw/ckfw.gyp

@@ -0,0 +1,34 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'nssckfw',
+      'type': 'static_library',
+      'sources': [
+        'crypto.c',
+        'find.c',
+        'hash.c',
+        'instance.c',
+        'mechanism.c',
+        'mutex.c',
+        'object.c',
+        'session.c',
+        'sessobj.c',
+        'slot.c',
+        'token.c',
+        'wrap.c'
+      ],
+      'dependencies': [
+        '<(DEPTH)/exports.gyp:nss_exports'
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}

security/nss/lib/ckfw/ckfwm.h

@@ -0,0 +1,112 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef CKFWM_H
+#define CKFWM_H
+
+/*
+ * ckfwm.h
+ *
+ * This file prototypes the module-private calls of the NSS Cryptoki Framework.
+ */
+
+#ifndef NSSBASET_H
+#include "nssbaset.h"
+#endif /* NSSBASET_H */
+
+#ifndef NSSCKT_H
+#include "nssckt.h"
+#endif /* NSSCKT_H */
+
+#ifndef NSSCKFWT_H
+#include "nssckfwt.h"
+#endif /* NSSCKFWT_H */
+
+/*
+ * nssCKFWHash
+ *
+ *  nssCKFWHash_Create
+ *  nssCKFWHash_Destroy
+ *  nssCKFWHash_Add
+ *  nssCKFWHash_Remove
+ *  nssCKFWHash_Count
+ *  nssCKFWHash_Exists
+ *  nssCKFWHash_Lookup
+ *  nssCKFWHash_Iterate
+ */
+
+/*
+ * nssCKFWHash_Create
+ *
+ */
+NSS_EXTERN nssCKFWHash *
+nssCKFWHash_Create(
+    NSSCKFWInstance *fwInstance,
+    NSSArena *arena,
+    CK_RV *pError);
+
+/*
+ * nssCKFWHash_Destroy
+ *
+ */
+NSS_EXTERN void
+nssCKFWHash_Destroy(
+    nssCKFWHash *hash);
+
+/*
+ * nssCKFWHash_Add
+ *
+ */
+NSS_EXTERN CK_RV
+nssCKFWHash_Add(
+    nssCKFWHash *hash,
+    const void *key,
+    const void *value);
+
+/*
+ * nssCKFWHash_Remove
+ *
+ */
+NSS_EXTERN void
+nssCKFWHash_Remove(
+    nssCKFWHash *hash,
+    const void *it);
+
+/*
+ * nssCKFWHash_Count
+ *
+ */
+NSS_EXTERN CK_ULONG
+nssCKFWHash_Count(
+    nssCKFWHash *hash);
+
+/*
+ * nssCKFWHash_Exists
+ *
+ */
+NSS_EXTERN CK_BBOOL
+nssCKFWHash_Exists(
+    nssCKFWHash *hash,
+    const void *it);
+
+/*
+ * nssCKFWHash_Lookup
+ *
+ */
+NSS_EXTERN void *
+nssCKFWHash_Lookup(
+    nssCKFWHash *hash,
+    const void *it);
+
+/*
+ * nssCKFWHash_Iterate
+ *
+ */
+NSS_EXTERN void
+nssCKFWHash_Iterate(
+    nssCKFWHash *hash,
+    nssCKFWHashIterator fcn,
+    void *closure);
+
+#endif /* CKFWM_H */

security/nss/lib/ckfw/ckfwtm.h

@@ -0,0 +1,23 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef CKFWTM_H
+#define CKFWTM_H
+
+/*
+ * ckfwtm.h
+ *
+ * This file declares the module-private types of the NSS Cryptoki Framework.
+ */
+
+#ifndef NSSBASET_H
+#include "nssbaset.h"
+#endif /* NSSBASET_H */
+
+struct nssCKFWHashStr;
+typedef struct nssCKFWHashStr nssCKFWHash;
+
+typedef void(PR_CALLBACK *nssCKFWHashIterator)(const void *key, void *value, void *closure);
+
+#endif /* CKFWTM_H */

security/nss/lib/ckfw/ckmd.h

@@ -0,0 +1,28 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef CKMD_H
+#define CKMD_H
+
+/*
+ * ckmd.h
+ *
+ */
+
+NSS_EXTERN NSSCKMDObject *
+nssCKMDSessionObject_Create(
+    NSSCKFWToken *fwToken,
+    NSSArena *arena,
+    CK_ATTRIBUTE_PTR attributes,
+    CK_ULONG ulCount,
+    CK_RV *pError);
+
+NSS_EXTERN NSSCKMDFindObjects *
+nssCKMDFindSessionObjects_Create(
+    NSSCKFWToken *fwToken,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulCount,
+    CK_RV *pError);
+
+#endif /* CKMD_H */

security/nss/lib/ckfw/ckt.h

@@ -0,0 +1,8 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* get back to just one set of PKCS #11 headers. Use the onese that
+ * are easiest to maintain from the RSA website */
+/* this one is the one that defines NSS specific data */
+#include "pkcs11n.h"

security/nss/lib/ckfw/config.mk

@@ -0,0 +1,25 @@
+# 
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+ifdef BUILD_IDG
+DEFINES += -DNSSDEBUG
+endif
+
+#
+# Hack to see if everything still builds
+#
+
+
+#
+#  Override TARGETS variable so that only static libraries
+#  are specifed as dependencies within rules.mk.
+#
+
+TARGETS        = $(LIBRARY)
+SHARED_LIBRARY =
+IMPORT_LIBRARY =
+PROGRAM        =
+
+

security/nss/lib/ckfw/crypto.c

@@ -0,0 +1,318 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * crypto.c
+ *
+ * This file implements the NSSCKFWCryptoOperation type and methods.
+ */
+
+#ifndef CK_T
+#include "ck.h"
+#endif /* CK_T */
+
+/*
+ * NSSCKFWCryptoOperation
+ *
+ *  -- create/destroy --
+ *  nssCKFWCrytoOperation_Create
+ *  nssCKFWCryptoOperation_Destroy
+ *
+ *  -- implement public accessors --
+ *  nssCKFWCryptoOperation_GetMDCryptoOperation
+ *  nssCKFWCryptoOperation_GetType
+ *
+ *  -- private accessors --
+ *
+ *  -- module fronts --
+ * nssCKFWCryptoOperation_GetFinalLength
+ * nssCKFWCryptoOperation_GetOperationLength
+ * nssCKFWCryptoOperation_Final
+ * nssCKFWCryptoOperation_Update
+ * nssCKFWCryptoOperation_DigestUpdate
+ * nssCKFWCryptoOperation_UpdateFinal
+ */
+
+struct NSSCKFWCryptoOperationStr {
+    /* NSSArena *arena; */
+    NSSCKMDCryptoOperation *mdOperation;
+    NSSCKMDSession *mdSession;
+    NSSCKFWSession *fwSession;
+    NSSCKMDToken *mdToken;
+    NSSCKFWToken *fwToken;
+    NSSCKMDInstance *mdInstance;
+    NSSCKFWInstance *fwInstance;
+    NSSCKFWCryptoOperationType type;
+};
+
+/*
+ *  nssCKFWCrytoOperation_Create
+ */
+NSS_EXTERN NSSCKFWCryptoOperation *
+nssCKFWCryptoOperation_Create(
+    NSSCKMDCryptoOperation *mdOperation,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    NSSCKFWCryptoOperationType type,
+    CK_RV *pError)
+{
+    NSSCKFWCryptoOperation *fwOperation;
+    fwOperation = nss_ZNEW(NULL, NSSCKFWCryptoOperation);
+    if (!fwOperation) {
+        *pError = CKR_HOST_MEMORY;
+        return (NSSCKFWCryptoOperation *)NULL;
+    }
+    fwOperation->mdOperation = mdOperation;
+    fwOperation->mdSession = mdSession;
+    fwOperation->fwSession = fwSession;
+    fwOperation->mdToken = mdToken;
+    fwOperation->fwToken = fwToken;
+    fwOperation->mdInstance = mdInstance;
+    fwOperation->fwInstance = fwInstance;
+    fwOperation->type = type;
+    return fwOperation;
+}
+
+/*
+ *  nssCKFWCryptoOperation_Destroy
+ */
+NSS_EXTERN void
+nssCKFWCryptoOperation_Destroy(
+    NSSCKFWCryptoOperation *fwOperation)
+{
+    if ((NSSCKMDCryptoOperation *)NULL != fwOperation->mdOperation) {
+        if (fwOperation->mdOperation->Destroy) {
+            fwOperation->mdOperation->Destroy(
+                fwOperation->mdOperation,
+                fwOperation,
+                fwOperation->mdInstance,
+                fwOperation->fwInstance);
+        }
+    }
+    nss_ZFreeIf(fwOperation);
+}
+
+/*
+ *  nssCKFWCryptoOperation_GetMDCryptoOperation
+ */
+NSS_EXTERN NSSCKMDCryptoOperation *
+nssCKFWCryptoOperation_GetMDCryptoOperation(
+    NSSCKFWCryptoOperation *fwOperation)
+{
+    return fwOperation->mdOperation;
+}
+
+/*
+ *  nssCKFWCryptoOperation_GetType
+ */
+NSS_EXTERN NSSCKFWCryptoOperationType
+nssCKFWCryptoOperation_GetType(
+    NSSCKFWCryptoOperation *fwOperation)
+{
+    return fwOperation->type;
+}
+
+/*
+ * nssCKFWCryptoOperation_GetFinalLength
+ */
+NSS_EXTERN CK_ULONG
+nssCKFWCryptoOperation_GetFinalLength(
+    NSSCKFWCryptoOperation *fwOperation,
+    CK_RV *pError)
+{
+    if (!fwOperation->mdOperation->GetFinalLength) {
+        *pError = CKR_FUNCTION_FAILED;
+        return 0;
+    }
+    return fwOperation->mdOperation->GetFinalLength(
+        fwOperation->mdOperation,
+        fwOperation,
+        fwOperation->mdSession,
+        fwOperation->fwSession,
+        fwOperation->mdToken,
+        fwOperation->fwToken,
+        fwOperation->mdInstance,
+        fwOperation->fwInstance,
+        pError);
+}
+
+/*
+ * nssCKFWCryptoOperation_GetOperationLength
+ */
+NSS_EXTERN CK_ULONG
+nssCKFWCryptoOperation_GetOperationLength(
+    NSSCKFWCryptoOperation *fwOperation,
+    NSSItem *inputBuffer,
+    CK_RV *pError)
+{
+    if (!fwOperation->mdOperation->GetOperationLength) {
+        *pError = CKR_FUNCTION_FAILED;
+        return 0;
+    }
+    return fwOperation->mdOperation->GetOperationLength(
+        fwOperation->mdOperation,
+        fwOperation,
+        fwOperation->mdSession,
+        fwOperation->fwSession,
+        fwOperation->mdToken,
+        fwOperation->fwToken,
+        fwOperation->mdInstance,
+        fwOperation->fwInstance,
+        inputBuffer,
+        pError);
+}
+
+/*
+ * nssCKFWCryptoOperation_Final
+ */
+NSS_EXTERN CK_RV
+nssCKFWCryptoOperation_Final(
+    NSSCKFWCryptoOperation *fwOperation,
+    NSSItem *outputBuffer)
+{
+    if (!fwOperation->mdOperation->Final) {
+        return CKR_FUNCTION_FAILED;
+    }
+    return fwOperation->mdOperation->Final(
+        fwOperation->mdOperation,
+        fwOperation,
+        fwOperation->mdSession,
+        fwOperation->fwSession,
+        fwOperation->mdToken,
+        fwOperation->fwToken,
+        fwOperation->mdInstance,
+        fwOperation->fwInstance,
+        outputBuffer);
+}
+
+/*
+ * nssCKFWCryptoOperation_Update
+ */
+NSS_EXTERN CK_RV
+nssCKFWCryptoOperation_Update(
+    NSSCKFWCryptoOperation *fwOperation,
+    NSSItem *inputBuffer,
+    NSSItem *outputBuffer)
+{
+    if (!fwOperation->mdOperation->Update) {
+        return CKR_FUNCTION_FAILED;
+    }
+    return fwOperation->mdOperation->Update(
+        fwOperation->mdOperation,
+        fwOperation,
+        fwOperation->mdSession,
+        fwOperation->fwSession,
+        fwOperation->mdToken,
+        fwOperation->fwToken,
+        fwOperation->mdInstance,
+        fwOperation->fwInstance,
+        inputBuffer,
+        outputBuffer);
+}
+
+/*
+ * nssCKFWCryptoOperation_DigestUpdate
+ */
+NSS_EXTERN CK_RV
+nssCKFWCryptoOperation_DigestUpdate(
+    NSSCKFWCryptoOperation *fwOperation,
+    NSSItem *inputBuffer)
+{
+    if (!fwOperation->mdOperation->DigestUpdate) {
+        return CKR_FUNCTION_FAILED;
+    }
+    return fwOperation->mdOperation->DigestUpdate(
+        fwOperation->mdOperation,
+        fwOperation,
+        fwOperation->mdSession,
+        fwOperation->fwSession,
+        fwOperation->mdToken,
+        fwOperation->fwToken,
+        fwOperation->mdInstance,
+        fwOperation->fwInstance,
+        inputBuffer);
+}
+
+/*
+ * nssCKFWCryptoOperation_DigestKey
+ */
+NSS_EXTERN CK_RV
+nssCKFWCryptoOperation_DigestKey(
+    NSSCKFWCryptoOperation *fwOperation,
+    NSSCKFWObject *fwObject /* Key */
+    )
+{
+    NSSCKMDObject *mdObject;
+
+    if (!fwOperation->mdOperation->DigestKey) {
+        return CKR_FUNCTION_FAILED;
+    }
+    mdObject = nssCKFWObject_GetMDObject(fwObject);
+    return fwOperation->mdOperation->DigestKey(
+        fwOperation->mdOperation,
+        fwOperation,
+        fwOperation->mdToken,
+        fwOperation->fwToken,
+        fwOperation->mdInstance,
+        fwOperation->fwInstance,
+        mdObject,
+        fwObject);
+}
+
+/*
+ * nssCKFWCryptoOperation_UpdateFinal
+ */
+NSS_EXTERN CK_RV
+nssCKFWCryptoOperation_UpdateFinal(
+    NSSCKFWCryptoOperation *fwOperation,
+    NSSItem *inputBuffer,
+    NSSItem *outputBuffer)
+{
+    if (!fwOperation->mdOperation->UpdateFinal) {
+        return CKR_FUNCTION_FAILED;
+    }
+    return fwOperation->mdOperation->UpdateFinal(
+        fwOperation->mdOperation,
+        fwOperation,
+        fwOperation->mdSession,
+        fwOperation->fwSession,
+        fwOperation->mdToken,
+        fwOperation->fwToken,
+        fwOperation->mdInstance,
+        fwOperation->fwInstance,
+        inputBuffer,
+        outputBuffer);
+}
+
+/*
+ * nssCKFWCryptoOperation_UpdateCombo
+ */
+NSS_EXTERN CK_RV
+nssCKFWCryptoOperation_UpdateCombo(
+    NSSCKFWCryptoOperation *fwOperation,
+    NSSCKFWCryptoOperation *fwPeerOperation,
+    NSSItem *inputBuffer,
+    NSSItem *outputBuffer)
+{
+    if (!fwOperation->mdOperation->UpdateCombo) {
+        return CKR_FUNCTION_FAILED;
+    }
+    return fwOperation->mdOperation->UpdateCombo(
+        fwOperation->mdOperation,
+        fwOperation,
+        fwPeerOperation->mdOperation,
+        fwPeerOperation,
+        fwOperation->mdSession,
+        fwOperation->fwSession,
+        fwOperation->mdToken,
+        fwOperation->fwToken,
+        fwOperation->mdInstance,
+        fwOperation->fwInstance,
+        inputBuffer,
+        outputBuffer);
+}

security/nss/lib/ckfw/dbm/Makefile

@@ -0,0 +1,9 @@
+# 
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+include manifest.mn
+include config.mk
+include $(CORE_DEPTH)/coreconf/config.mk
+include $(CORE_DEPTH)/coreconf/rules.mk

security/nss/lib/ckfw/dbm/anchor.c

@@ -0,0 +1,17 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * dbm/anchor.c
+ *
+ * This file "anchors" the actual cryptoki entry points in this module's
+ * shared library, which is required for dynamic loading.  See the
+ * comments in nssck.api for more information.
+ */
+
+#include "ckdbm.h"
+
+#define MODULE_NAME dbm
+#define INSTANCE_NAME (NSSCKMDInstance *)&nss_dbm_mdInstance
+#include "nssck.api"

security/nss/lib/ckfw/dbm/ckdbm.h

@@ -0,0 +1,210 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef CKDBM_H
+#define CKDBM_H
+
+#include "nssckmdt.h"
+#include "nssckfw.h"
+
+/*
+ * I'm including this for access to the arena functions.
+ * Looks like we should publish that API.
+ */
+#ifndef BASE_H
+#include "base.h"
+#endif /* BASE_H */
+
+/*
+ * This is where the Netscape extensions live, at least for now.
+ */
+#ifndef CKT_H
+#include "ckt.h"
+#endif /* CKT_H */
+
+#include "mcom_db.h"
+
+NSS_EXTERN_DATA NSSCKMDInstance nss_dbm_mdInstance;
+
+typedef struct nss_dbm_db_struct nss_dbm_db_t;
+struct nss_dbm_db_struct {
+    DB *db;
+    NSSCKFWMutex *crustylock;
+};
+
+typedef struct nss_dbm_dbt_struct nss_dbm_dbt_t;
+struct nss_dbm_dbt_struct {
+    DBT dbt;
+    nss_dbm_db_t *my_db;
+};
+
+typedef struct nss_dbm_instance_struct nss_dbm_instance_t;
+struct nss_dbm_instance_struct {
+    NSSArena *arena;
+    CK_ULONG nSlots;
+    char **filenames;
+    int *flags; /* e.g. O_RDONLY, O_RDWR */
+};
+
+typedef struct nss_dbm_slot_struct nss_dbm_slot_t;
+struct nss_dbm_slot_struct {
+    nss_dbm_instance_t *instance;
+    char *filename;
+    int flags;
+    nss_dbm_db_t *token_db;
+};
+
+typedef struct nss_dbm_token_struct nss_dbm_token_t;
+struct nss_dbm_token_struct {
+    NSSArena *arena;
+    nss_dbm_slot_t *slot;
+    nss_dbm_db_t *session_db;
+    NSSUTF8 *label;
+};
+
+struct nss_dbm_dbt_node {
+    struct nss_dbm_dbt_node *next;
+    nss_dbm_dbt_t *dbt;
+};
+
+typedef struct nss_dbm_session_struct nss_dbm_session_t;
+struct nss_dbm_session_struct {
+    NSSArena *arena;
+    nss_dbm_token_t *token;
+    CK_ULONG deviceError;
+    struct nss_dbm_dbt_node *session_objects;
+    NSSCKFWMutex *list_lock;
+};
+
+typedef struct nss_dbm_object_struct nss_dbm_object_t;
+struct nss_dbm_object_struct {
+    NSSArena *arena; /* token or session */
+    nss_dbm_dbt_t *handle;
+};
+
+typedef struct nss_dbm_find_struct nss_dbm_find_t;
+struct nss_dbm_find_struct {
+    NSSArena *arena;
+    struct nss_dbm_dbt_node *found;
+    NSSCKFWMutex *list_lock;
+};
+
+NSS_EXTERN NSSCKMDSlot *
+nss_dbm_mdSlot_factory(
+    nss_dbm_instance_t *instance,
+    char *filename,
+    int flags,
+    CK_RV *pError);
+
+NSS_EXTERN NSSCKMDToken *
+nss_dbm_mdToken_factory(
+    nss_dbm_slot_t *slot,
+    CK_RV *pError);
+
+NSS_EXTERN NSSCKMDSession *
+nss_dbm_mdSession_factory(
+    nss_dbm_token_t *token,
+    NSSCKFWSession *fwSession,
+    NSSCKFWInstance *fwInstance,
+    CK_BBOOL rw,
+    CK_RV *pError);
+
+NSS_EXTERN NSSCKMDObject *
+nss_dbm_mdObject_factory(
+    nss_dbm_object_t *object,
+    CK_RV *pError);
+
+NSS_EXTERN NSSCKMDFindObjects *
+nss_dbm_mdFindObjects_factory(
+    nss_dbm_find_t *find,
+    CK_RV *pError);
+
+NSS_EXTERN nss_dbm_db_t *
+nss_dbm_db_open(
+    NSSArena *arena,
+    NSSCKFWInstance *fwInstance,
+    char *filename,
+    int flags,
+    CK_RV *pError);
+
+NSS_EXTERN void
+nss_dbm_db_close(
+    nss_dbm_db_t *db);
+
+NSS_EXTERN CK_VERSION
+nss_dbm_db_get_format_version(
+    nss_dbm_db_t *db);
+
+NSS_EXTERN CK_RV
+nss_dbm_db_set_label(
+    nss_dbm_db_t *db,
+    NSSUTF8 *label);
+
+NSS_EXTERN NSSUTF8 *
+nss_dbm_db_get_label(
+    nss_dbm_db_t *db,
+    NSSArena *arena,
+    CK_RV *pError);
+
+NSS_EXTERN CK_RV
+nss_dbm_db_delete_object(
+    nss_dbm_dbt_t *dbt);
+
+NSS_EXTERN nss_dbm_dbt_t *
+nss_dbm_db_create_object(
+    NSSArena *arena,
+    nss_dbm_db_t *db,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    CK_RV *pError,
+    CK_ULONG *pdbrv);
+
+NSS_EXTERN CK_RV
+nss_dbm_db_find_objects(
+    nss_dbm_find_t *find,
+    nss_dbm_db_t *db,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    CK_ULONG *pdbrv);
+
+NSS_EXTERN CK_BBOOL
+nss_dbm_db_object_still_exists(
+    nss_dbm_dbt_t *dbt);
+
+NSS_EXTERN CK_ULONG
+nss_dbm_db_get_object_attribute_count(
+    nss_dbm_dbt_t *dbt,
+    CK_RV *pError,
+    CK_ULONG *pdbrv);
+
+NSS_EXTERN CK_RV
+nss_dbm_db_get_object_attribute_types(
+    nss_dbm_dbt_t *dbt,
+    CK_ATTRIBUTE_TYPE_PTR typeArray,
+    CK_ULONG ulCount,
+    CK_ULONG *pdbrv);
+
+NSS_EXTERN CK_ULONG
+nss_dbm_db_get_object_attribute_size(
+    nss_dbm_dbt_t *dbt,
+    CK_ATTRIBUTE_TYPE type,
+    CK_RV *pError,
+    CK_ULONG *pdbrv);
+
+NSS_EXTERN NSSItem *
+nss_dbm_db_get_object_attribute(
+    nss_dbm_dbt_t *dbt,
+    NSSArena *arena,
+    CK_ATTRIBUTE_TYPE type,
+    CK_RV *pError,
+    CK_ULONG *pdbrv);
+
+NSS_EXTERN CK_RV
+nss_dbm_db_set_object_attribute(
+    nss_dbm_dbt_t *dbt,
+    CK_ATTRIBUTE_TYPE type,
+    NSSItem *value,
+    CK_ULONG *pdbrv);
+
+#endif /* CKDBM_H */

security/nss/lib/ckfw/dbm/config.mk

@@ -0,0 +1,8 @@
+# 
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+ifdef BUILD_IDG
+DEFINES += -DNSSDEBUG
+endif

security/nss/lib/ckfw/dbm/find.c

@@ -0,0 +1,126 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ckdbm.h"
+
+static void
+nss_dbm_mdFindObjects_Final(
+    NSSCKMDFindObjects *mdFindObjects,
+    NSSCKFWFindObjects *fwFindObjects,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    nss_dbm_find_t *find = (nss_dbm_find_t *)mdFindObjects->etc;
+
+    /* Locks might have system resources associated */
+    (void)NSSCKFWMutex_Destroy(find->list_lock);
+    (void)NSSArena_Destroy(find->arena);
+}
+
+static NSSCKMDObject *
+nss_dbm_mdFindObjects_Next(
+    NSSCKMDFindObjects *mdFindObjects,
+    NSSCKFWFindObjects *fwFindObjects,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    NSSArena *arena,
+    CK_RV *pError)
+{
+    nss_dbm_find_t *find = (nss_dbm_find_t *)mdFindObjects->etc;
+    struct nss_dbm_dbt_node *node;
+    nss_dbm_object_t *object;
+    NSSCKMDObject *rv;
+
+    while (1) {
+        /* Lock */
+        {
+            *pError = NSSCKFWMutex_Lock(find->list_lock);
+            if (CKR_OK != *pError) {
+                return (NSSCKMDObject *)NULL;
+            }
+
+            node = find->found;
+            if ((struct nss_dbm_dbt_node *)NULL != node) {
+                find->found = node->next;
+            }
+
+            *pError = NSSCKFWMutex_Unlock(find->list_lock);
+            if (CKR_OK != *pError) {
+                /* screwed now */
+                return (NSSCKMDObject *)NULL;
+            }
+        }
+
+        if ((struct nss_dbm_dbt_node *)NULL == node) {
+            break;
+        }
+
+        if (nss_dbm_db_object_still_exists(node->dbt)) {
+            break;
+        }
+    }
+
+    if ((struct nss_dbm_dbt_node *)NULL == node) {
+        *pError = CKR_OK;
+        return (NSSCKMDObject *)NULL;
+    }
+
+    object = nss_ZNEW(arena, nss_dbm_object_t);
+    if ((nss_dbm_object_t *)NULL == object) {
+        *pError = CKR_HOST_MEMORY;
+        return (NSSCKMDObject *)NULL;
+    }
+
+    object->arena = arena;
+    object->handle = nss_ZNEW(arena, nss_dbm_dbt_t);
+    if ((nss_dbm_dbt_t *)NULL == object->handle) {
+        *pError = CKR_HOST_MEMORY;
+        return (NSSCKMDObject *)NULL;
+    }
+
+    object->handle->my_db = node->dbt->my_db;
+    object->handle->dbt.size = node->dbt->dbt.size;
+    object->handle->dbt.data = nss_ZAlloc(arena, node->dbt->dbt.size);
+    if ((void *)NULL == object->handle->dbt.data) {
+        *pError = CKR_HOST_MEMORY;
+        return (NSSCKMDObject *)NULL;
+    }
+
+    (void)memcpy(object->handle->dbt.data, node->dbt->dbt.data, node->dbt->dbt.size);
+
+    rv = nss_dbm_mdObject_factory(object, pError);
+    if ((NSSCKMDObject *)NULL == rv) {
+        return (NSSCKMDObject *)NULL;
+    }
+
+    return rv;
+}
+
+NSS_IMPLEMENT NSSCKMDFindObjects *
+nss_dbm_mdFindObjects_factory(
+    nss_dbm_find_t *find,
+    CK_RV *pError)
+{
+    NSSCKMDFindObjects *rv;
+
+    rv = nss_ZNEW(find->arena, NSSCKMDFindObjects);
+    if ((NSSCKMDFindObjects *)NULL == rv) {
+        *pError = CKR_HOST_MEMORY;
+        return (NSSCKMDFindObjects *)NULL;
+    }
+
+    rv->etc = (void *)find;
+    rv->Final = nss_dbm_mdFindObjects_Final;
+    rv->Next = nss_dbm_mdFindObjects_Next;
+
+    return rv;
+}

security/nss/lib/ckfw/dbm/instance.c

@@ -0,0 +1,147 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ckdbm.h"
+
+static CK_RV
+nss_dbm_mdInstance_Initialize(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    NSSUTF8 *configurationData)
+{
+    CK_RV rv = CKR_OK;
+    NSSArena *arena;
+    nss_dbm_instance_t *instance;
+
+    arena = NSSCKFWInstance_GetArena(fwInstance, &rv);
+    if (((NSSArena *)NULL == arena) && (CKR_OK != rv)) {
+        return rv;
+    }
+
+    instance = nss_ZNEW(arena, nss_dbm_instance_t);
+    if ((nss_dbm_instance_t *)NULL == instance) {
+        return CKR_HOST_MEMORY;
+    }
+
+    instance->arena = arena;
+
+    /*
+     * This should parse the configuration data for information on
+     * number and locations of databases, modes (e.g. readonly), etc.
+     * But for now, we'll have one slot with a creatable read-write
+     * database called "cert8.db."
+     */
+
+    instance->nSlots = 1;
+    instance->filenames = nss_ZNEWARRAY(arena, char *, instance->nSlots);
+    if ((char **)NULL == instance->filenames) {
+        return CKR_HOST_MEMORY;
+    }
+
+    instance->flags = nss_ZNEWARRAY(arena, int, instance->nSlots);
+    if ((int *)NULL == instance->flags) {
+        return CKR_HOST_MEMORY;
+    }
+
+    instance->filenames[0] = "cert8.db";
+    instance->flags[0] = O_RDWR | O_CREAT;
+
+    mdInstance->etc = (void *)instance;
+    return CKR_OK;
+}
+
+/* nss_dbm_mdInstance_Finalize is not required */
+
+static CK_ULONG
+nss_dbm_mdInstance_GetNSlots(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    nss_dbm_instance_t *instance = (nss_dbm_instance_t *)mdInstance->etc;
+    return instance->nSlots;
+}
+
+static CK_VERSION
+nss_dbm_mdInstance_GetCryptokiVersion(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    static CK_VERSION rv = { 2, 1 };
+    return rv;
+}
+
+static NSSUTF8 *
+nss_dbm_mdInstance_GetManufacturerID(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return "Mozilla Foundation";
+}
+
+static NSSUTF8 *
+nss_dbm_mdInstance_GetLibraryDescription(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return "Berkeley Database Module";
+}
+
+static CK_VERSION
+nss_dbm_mdInstance_GetLibraryVersion(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    static CK_VERSION rv = { 1, 0 }; /* My own version number */
+    return rv;
+}
+
+static CK_BBOOL
+nss_dbm_mdInstance_ModuleHandlesSessionObjects(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return CK_TRUE;
+}
+
+static CK_RV
+nss_dbm_mdInstance_GetSlots(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    NSSCKMDSlot *slots[])
+{
+    nss_dbm_instance_t *instance = (nss_dbm_instance_t *)mdInstance->etc;
+    CK_ULONG i;
+    CK_RV rv = CKR_OK;
+
+    for (i = 0; i < instance->nSlots; i++) {
+        slots[i] = nss_dbm_mdSlot_factory(instance, instance->filenames[i],
+                                          instance->flags[i], &rv);
+        if ((NSSCKMDSlot *)NULL == slots[i]) {
+            return rv;
+        }
+    }
+
+    return rv;
+}
+
+/* nss_dbm_mdInstance_WaitForSlotEvent is not relevant */
+
+NSS_IMPLEMENT_DATA NSSCKMDInstance
+    nss_dbm_mdInstance = {
+        NULL, /* etc; filled in later */
+        nss_dbm_mdInstance_Initialize,
+        NULL, /* nss_dbm_mdInstance_Finalize */
+        nss_dbm_mdInstance_GetNSlots,
+        nss_dbm_mdInstance_GetCryptokiVersion,
+        nss_dbm_mdInstance_GetManufacturerID,
+        nss_dbm_mdInstance_GetLibraryDescription,
+        nss_dbm_mdInstance_GetLibraryVersion,
+        nss_dbm_mdInstance_ModuleHandlesSessionObjects,
+        nss_dbm_mdInstance_GetSlots,
+        NULL, /* nss_dbm_mdInstance_WaitForSlotEvent */
+        NULL  /* terminator */
+    };

security/nss/lib/ckfw/dbm/manifest.mn

@@ -0,0 +1,25 @@
+# 
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+CORE_DEPTH = ../../../..
+
+MODULE = nss
+
+CSRCS =		   \
+	anchor.c   \
+	instance.c \
+	slot.c	   \
+	token.c	   \
+	session.c  \
+	object.c   \
+	find.c	   \
+	db.c	   \
+	$(NULL)
+
+REQUIRES = dbm nspr
+
+LIBRARY_NAME = nssckdbm
+
+EXTRA_SHARED_LIBS = -L$(DIST)/lib -lnssckfw -lnssb -ldbm -lnspr4 -lplc4 -lplds4

security/nss/lib/ckfw/dbm/object.c

@@ -0,0 +1,155 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ckdbm.h"
+
+static void
+nss_dbm_mdObject_Finalize(
+    NSSCKMDObject *mdObject,
+    NSSCKFWObject *fwObject,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    ;
+}
+
+static CK_RV
+nss_dbm_mdObject_Destroy(
+    NSSCKMDObject *mdObject,
+    NSSCKFWObject *fwObject,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    nss_dbm_object_t *object = (nss_dbm_object_t *)mdObject->etc;
+    return nss_dbm_db_delete_object(object->handle);
+}
+
+static CK_ULONG
+nss_dbm_mdObject_GetAttributeCount(
+    NSSCKMDObject *mdObject,
+    NSSCKFWObject *fwObject,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    nss_dbm_object_t *object = (nss_dbm_object_t *)mdObject->etc;
+    nss_dbm_session_t *session = (nss_dbm_session_t *)mdSession->etc;
+    return nss_dbm_db_get_object_attribute_count(object->handle, pError,
+                                                 &session->deviceError);
+}
+
+static CK_RV
+nss_dbm_mdObject_GetAttributeTypes(
+    NSSCKMDObject *mdObject,
+    NSSCKFWObject *fwObject,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_ATTRIBUTE_TYPE_PTR typeArray,
+    CK_ULONG ulCount)
+{
+    nss_dbm_object_t *object = (nss_dbm_object_t *)mdObject->etc;
+    nss_dbm_session_t *session = (nss_dbm_session_t *)mdSession->etc;
+    return nss_dbm_db_get_object_attribute_types(object->handle, typeArray,
+                                                 ulCount, &session->deviceError);
+}
+
+static CK_ULONG
+nss_dbm_mdObject_GetAttributeSize(
+    NSSCKMDObject *mdObject,
+    NSSCKFWObject *fwObject,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_ATTRIBUTE_TYPE attribute,
+    CK_RV *pError)
+{
+    nss_dbm_object_t *object = (nss_dbm_object_t *)mdObject->etc;
+    nss_dbm_session_t *session = (nss_dbm_session_t *)mdSession->etc;
+    return nss_dbm_db_get_object_attribute_size(object->handle, attribute, pError,
+                                                &session->deviceError);
+}
+
+static NSSItem *
+nss_dbm_mdObject_GetAttribute(
+    NSSCKMDObject *mdObject,
+    NSSCKFWObject *fwObject,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_ATTRIBUTE_TYPE attribute,
+    CK_RV *pError)
+{
+    nss_dbm_object_t *object = (nss_dbm_object_t *)mdObject->etc;
+    nss_dbm_session_t *session = (nss_dbm_session_t *)mdSession->etc;
+    return nss_dbm_db_get_object_attribute(object->handle, object->arena, attribute,
+                                           pError, &session->deviceError);
+}
+
+static CK_RV
+nss_dbm_mdObject_SetAttribute(
+    NSSCKMDObject *mdObject,
+    NSSCKFWObject *fwObject,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_ATTRIBUTE_TYPE attribute,
+    NSSItem *value)
+{
+    nss_dbm_object_t *object = (nss_dbm_object_t *)mdObject->etc;
+    nss_dbm_session_t *session = (nss_dbm_session_t *)mdSession->etc;
+    return nss_dbm_db_set_object_attribute(object->handle, attribute, value,
+                                           &session->deviceError);
+}
+
+NSS_IMPLEMENT NSSCKMDObject *
+nss_dbm_mdObject_factory(
+    nss_dbm_object_t *object,
+    CK_RV *pError)
+{
+    NSSCKMDObject *rv;
+
+    rv = nss_ZNEW(object->arena, NSSCKMDObject);
+    if ((NSSCKMDObject *)NULL == rv) {
+        *pError = CKR_HOST_MEMORY;
+        return (NSSCKMDObject *)NULL;
+    }
+
+    rv->etc = (void *)object;
+    rv->Finalize = nss_dbm_mdObject_Finalize;
+    rv->Destroy = nss_dbm_mdObject_Destroy;
+    /*  IsTokenObject can be deferred */
+    rv->GetAttributeCount = nss_dbm_mdObject_GetAttributeCount;
+    rv->GetAttributeTypes = nss_dbm_mdObject_GetAttributeTypes;
+    rv->GetAttributeSize = nss_dbm_mdObject_GetAttributeSize;
+    rv->GetAttribute = nss_dbm_mdObject_GetAttribute;
+    rv->SetAttribute = nss_dbm_mdObject_SetAttribute;
+    /*  GetObjectSize can be deferred */
+
+    return rv;
+}

security/nss/lib/ckfw/dbm/session.c

@@ -0,0 +1,255 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ckdbm.h"
+
+static void
+nss_dbm_mdSession_Close(
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    nss_dbm_session_t *session = (nss_dbm_session_t *)mdSession->etc;
+
+    struct nss_dbm_dbt_node *w;
+
+    /* Lock */
+    {
+        if (CKR_OK != NSSCKFWMutex_Lock(session->list_lock)) {
+            return;
+        }
+
+        w = session->session_objects;
+        session->session_objects = (struct nss_dbm_dbt_node *)NULL; /* sanity */
+
+        (void)NSSCKFWMutex_Unlock(session->list_lock);
+    }
+
+    for (; (struct nss_dbm_dbt_node *)NULL != w; w = w->next) {
+        (void)nss_dbm_db_delete_object(w->dbt);
+    }
+}
+
+static CK_ULONG
+nss_dbm_mdSession_GetDeviceError(
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    nss_dbm_session_t *session = (nss_dbm_session_t *)mdSession->etc;
+    return session->deviceError;
+}
+
+/* Login isn't needed */
+/* Logout isn't needed */
+/* InitPIN is irrelevant */
+/* SetPIN is irrelevant */
+/* GetOperationStateLen is irrelevant */
+/* GetOperationState is irrelevant */
+/* SetOperationState is irrelevant */
+
+static NSSCKMDObject *
+nss_dbm_mdSession_CreateObject(
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    NSSArena *handyArenaPointer,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    CK_RV *pError)
+{
+    nss_dbm_session_t *session = (nss_dbm_session_t *)mdSession->etc;
+    nss_dbm_token_t *token = (nss_dbm_token_t *)mdToken->etc;
+    CK_ULONG i;
+    CK_BBOOL isToken = CK_FALSE; /* defaults to false */
+    NSSCKMDObject *rv;
+    struct nss_dbm_dbt_node *node = (struct nss_dbm_dbt_node *)NULL;
+    nss_dbm_object_t *object;
+    nss_dbm_db_t *which_db;
+
+    /* This framework should really pass this to me */
+    for (i = 0; i < ulAttributeCount; i++) {
+        if (CKA_TOKEN == pTemplate[i].type) {
+            isToken = *(CK_BBOOL *)pTemplate[i].pValue;
+            break;
+        }
+    }
+
+    object = nss_ZNEW(handyArenaPointer, nss_dbm_object_t);
+    if ((nss_dbm_object_t *)NULL == object) {
+        *pError = CKR_HOST_MEMORY;
+        return (NSSCKMDObject *)NULL;
+    }
+
+    object->arena = handyArenaPointer;
+    which_db = isToken ? token->slot->token_db : token->session_db;
+
+    /* Do this before the actual database call; it's easier to recover from */
+    rv = nss_dbm_mdObject_factory(object, pError);
+    if ((NSSCKMDObject *)NULL == rv) {
+        return (NSSCKMDObject *)NULL;
+    }
+
+    if (CK_FALSE == isToken) {
+        node = nss_ZNEW(session->arena, struct nss_dbm_dbt_node);
+        if ((struct nss_dbm_dbt_node *)NULL == node) {
+            *pError = CKR_HOST_MEMORY;
+            return (NSSCKMDObject *)NULL;
+        }
+    }
+
+    object->handle = nss_dbm_db_create_object(handyArenaPointer, which_db,
+                                              pTemplate, ulAttributeCount,
+                                              pError, &session->deviceError);
+    if ((nss_dbm_dbt_t *)NULL == object->handle) {
+        return (NSSCKMDObject *)NULL;
+    }
+
+    if (CK_FALSE == isToken) {
+        node->dbt = object->handle;
+        /* Lock */
+        {
+            *pError = NSSCKFWMutex_Lock(session->list_lock);
+            if (CKR_OK != *pError) {
+                (void)nss_dbm_db_delete_object(object->handle);
+                return (NSSCKMDObject *)NULL;
+            }
+
+            node->next = session->session_objects;
+            session->session_objects = node;
+
+            *pError = NSSCKFWMutex_Unlock(session->list_lock);
+        }
+    }
+
+    return rv;
+}
+
+/* CopyObject isn't needed; the framework will use CreateObject */
+
+static NSSCKMDFindObjects *
+nss_dbm_mdSession_FindObjectsInit(
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    CK_RV *pError)
+{
+    nss_dbm_session_t *session = (nss_dbm_session_t *)mdSession->etc;
+    nss_dbm_token_t *token = (nss_dbm_token_t *)mdToken->etc;
+    NSSArena *arena;
+    nss_dbm_find_t *find;
+    NSSCKMDFindObjects *rv;
+
+    arena = NSSArena_Create();
+    if ((NSSArena *)NULL == arena) {
+        *pError = CKR_HOST_MEMORY;
+        goto loser;
+    }
+
+    find = nss_ZNEW(arena, nss_dbm_find_t);
+    if ((nss_dbm_find_t *)NULL == find) {
+        *pError = CKR_HOST_MEMORY;
+        goto loser;
+    }
+
+    find->arena = arena;
+    find->list_lock = NSSCKFWInstance_CreateMutex(fwInstance, arena, pError);
+    if ((NSSCKFWMutex *)NULL == find->list_lock) {
+        goto loser;
+    }
+
+    *pError = nss_dbm_db_find_objects(find, token->slot->token_db, pTemplate,
+                                      ulAttributeCount, &session->deviceError);
+    if (CKR_OK != *pError) {
+        goto loser;
+    }
+
+    *pError = nss_dbm_db_find_objects(find, token->session_db, pTemplate,
+                                      ulAttributeCount, &session->deviceError);
+    if (CKR_OK != *pError) {
+        goto loser;
+    }
+
+    rv = nss_dbm_mdFindObjects_factory(find, pError);
+    if ((NSSCKMDFindObjects *)NULL == rv) {
+        goto loser;
+    }
+
+    return rv;
+
+loser:
+    if ((NSSArena *)NULL != arena) {
+        (void)NSSArena_Destroy(arena);
+    }
+
+    return (NSSCKMDFindObjects *)NULL;
+}
+
+/* SeedRandom is irrelevant */
+/* GetRandom is irrelevant */
+
+NSS_IMPLEMENT NSSCKMDSession *
+nss_dbm_mdSession_factory(
+    nss_dbm_token_t *token,
+    NSSCKFWSession *fwSession,
+    NSSCKFWInstance *fwInstance,
+    CK_BBOOL rw,
+    CK_RV *pError)
+{
+    NSSArena *arena;
+    nss_dbm_session_t *session;
+    NSSCKMDSession *rv;
+
+    arena = NSSCKFWSession_GetArena(fwSession, pError);
+
+    session = nss_ZNEW(arena, nss_dbm_session_t);
+    if ((nss_dbm_session_t *)NULL == session) {
+        *pError = CKR_HOST_MEMORY;
+        return (NSSCKMDSession *)NULL;
+    }
+
+    rv = nss_ZNEW(arena, NSSCKMDSession);
+    if ((NSSCKMDSession *)NULL == rv) {
+        *pError = CKR_HOST_MEMORY;
+        return (NSSCKMDSession *)NULL;
+    }
+
+    session->arena = arena;
+    session->token = token;
+    session->list_lock = NSSCKFWInstance_CreateMutex(fwInstance, arena, pError);
+    if ((NSSCKFWMutex *)NULL == session->list_lock) {
+        return (NSSCKMDSession *)NULL;
+    }
+
+    rv->etc = (void *)session;
+    rv->Close = nss_dbm_mdSession_Close;
+    rv->GetDeviceError = nss_dbm_mdSession_GetDeviceError;
+    /*  Login isn't needed */
+    /*  Logout isn't needed */
+    /*  InitPIN is irrelevant */
+    /*  SetPIN is irrelevant */
+    /*  GetOperationStateLen is irrelevant */
+    /*  GetOperationState is irrelevant */
+    /*  SetOperationState is irrelevant */
+    rv->CreateObject = nss_dbm_mdSession_CreateObject;
+    /*  CopyObject isn't needed; the framework will use CreateObject */
+    rv->FindObjectsInit = nss_dbm_mdSession_FindObjectsInit;
+    rv->null = NULL;
+
+    return rv;
+}

security/nss/lib/ckfw/dbm/slot.c

@@ -0,0 +1,165 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ckdbm.h"
+
+static CK_RV
+nss_dbm_mdSlot_Initialize(
+    NSSCKMDSlot *mdSlot,
+    NSSCKFWSlot *fwSlot,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    nss_dbm_slot_t *slot = (nss_dbm_slot_t *)mdSlot->etc;
+    nss_dbm_instance_t *instance = (nss_dbm_instance_t *)mdInstance->etc;
+    CK_RV rv = CKR_OK;
+
+    slot->token_db = nss_dbm_db_open(instance->arena, fwInstance, slot->filename,
+                                     slot->flags, &rv);
+    if ((nss_dbm_db_t *)NULL == slot->token_db) {
+        if (CKR_TOKEN_NOT_PRESENT == rv) {
+            /* This is not an error-- just means "the token isn't there" */
+            rv = CKR_OK;
+        }
+    }
+
+    return rv;
+}
+
+static void
+nss_dbm_mdSlot_Destroy(
+    NSSCKMDSlot *mdSlot,
+    NSSCKFWSlot *fwSlot,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    nss_dbm_slot_t *slot = (nss_dbm_slot_t *)mdSlot->etc;
+
+    if ((nss_dbm_db_t *)NULL != slot->token_db) {
+        nss_dbm_db_close(slot->token_db);
+        slot->token_db = (nss_dbm_db_t *)NULL;
+    }
+}
+
+static NSSUTF8 *
+nss_dbm_mdSlot_GetSlotDescription(
+    NSSCKMDSlot *mdSlot,
+    NSSCKFWSlot *fwSlot,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return "Database";
+}
+
+static NSSUTF8 *
+nss_dbm_mdSlot_GetManufacturerID(
+    NSSCKMDSlot *mdSlot,
+    NSSCKFWSlot *fwSlot,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return "Berkeley";
+}
+
+static CK_BBOOL
+nss_dbm_mdSlot_GetTokenPresent(
+    NSSCKMDSlot *mdSlot,
+    NSSCKFWSlot *fwSlot,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    nss_dbm_slot_t *slot = (nss_dbm_slot_t *)mdSlot->etc;
+
+    if ((nss_dbm_db_t *)NULL == slot->token_db) {
+        return CK_FALSE;
+    } else {
+        return CK_TRUE;
+    }
+}
+
+static CK_BBOOL
+nss_dbm_mdSlot_GetRemovableDevice(
+    NSSCKMDSlot *mdSlot,
+    NSSCKFWSlot *fwSlot,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    /*
+     * Well, this supports "tokens" (databases) that aren't there, so in
+     * that sense they're removable.  It'd be nice to handle databases
+     * that suddenly disappear (NFS-mounted home directories and network
+     * errors, for instance) but that's a harder problem.  We'll say
+     * we support removable devices, badly.
+     */
+
+    return CK_TRUE;
+}
+
+/* nss_dbm_mdSlot_GetHardwareSlot defaults to CK_FALSE */
+/*
+ * nss_dbm_mdSlot_GetHardwareVersion
+ * nss_dbm_mdSlot_GetFirmwareVersion
+ *
+ * These are kinda fuzzy concepts here.  I suppose we could return the
+ * Berkeley DB version for one of them, if we had an actual number we
+ * were confident in.  But mcom's "dbm" has been hacked enough that I
+ * don't really know from what "real" version it stems..
+ */
+
+static NSSCKMDToken *
+nss_dbm_mdSlot_GetToken(
+    NSSCKMDSlot *mdSlot,
+    NSSCKFWSlot *fwSlot,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    nss_dbm_slot_t *slot = (nss_dbm_slot_t *)mdSlot->etc;
+    return nss_dbm_mdToken_factory(slot, pError);
+}
+
+NSS_IMPLEMENT NSSCKMDSlot *
+nss_dbm_mdSlot_factory(
+    nss_dbm_instance_t *instance,
+    char *filename,
+    int flags,
+    CK_RV *pError)
+{
+    nss_dbm_slot_t *slot;
+    NSSCKMDSlot *rv;
+
+    slot = nss_ZNEW(instance->arena, nss_dbm_slot_t);
+    if ((nss_dbm_slot_t *)NULL == slot) {
+        *pError = CKR_HOST_MEMORY;
+        return (NSSCKMDSlot *)NULL;
+    }
+
+    slot->instance = instance;
+    slot->filename = filename;
+    slot->flags = flags;
+    slot->token_db = (nss_dbm_db_t *)NULL;
+
+    rv = nss_ZNEW(instance->arena, NSSCKMDSlot);
+    if ((NSSCKMDSlot *)NULL == rv) {
+        *pError = CKR_HOST_MEMORY;
+        return (NSSCKMDSlot *)NULL;
+    }
+
+    rv->etc = (void *)slot;
+    rv->Initialize = nss_dbm_mdSlot_Initialize;
+    rv->Destroy = nss_dbm_mdSlot_Destroy;
+    rv->GetSlotDescription = nss_dbm_mdSlot_GetSlotDescription;
+    rv->GetManufacturerID = nss_dbm_mdSlot_GetManufacturerID;
+    rv->GetTokenPresent = nss_dbm_mdSlot_GetTokenPresent;
+    rv->GetRemovableDevice = nss_dbm_mdSlot_GetRemovableDevice;
+    /*  GetHardwareSlot */
+    /*  GetHardwareVersion */
+    /*  GetFirmwareVersion */
+    rv->GetToken = nss_dbm_mdSlot_GetToken;
+    rv->null = (void *)NULL;
+
+    return rv;
+}

security/nss/lib/ckfw/dbm/token.c

@@ -0,0 +1,260 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ckdbm.h"
+
+static CK_RV
+nss_dbm_mdToken_Setup(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    nss_dbm_token_t *token = (nss_dbm_token_t *)mdToken->etc;
+    CK_RV rv = CKR_OK;
+
+    token->arena = NSSCKFWToken_GetArena(fwToken, &rv);
+    token->session_db = nss_dbm_db_open(token->arena, fwInstance, (char *)NULL,
+                                        O_RDWR | O_CREAT, &rv);
+    if ((nss_dbm_db_t *)NULL == token->session_db) {
+        return rv;
+    }
+
+    /* Add a label record if there isn't one? */
+
+    return CKR_OK;
+}
+
+static void
+nss_dbm_mdToken_Invalidate(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    nss_dbm_token_t *token = (nss_dbm_token_t *)mdToken->etc;
+
+    if ((nss_dbm_db_t *)NULL != token->session_db) {
+        nss_dbm_db_close(token->session_db);
+        token->session_db = (nss_dbm_db_t *)NULL;
+    }
+}
+
+static CK_RV
+nss_dbm_mdToken_InitToken(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    NSSItem *pin,
+    NSSUTF8 *label)
+{
+    nss_dbm_token_t *token = (nss_dbm_token_t *)mdToken->etc;
+    nss_dbm_instance_t *instance = (nss_dbm_instance_t *)mdInstance->etc;
+    CK_RV rv;
+
+    /* Wipe the session object data */
+
+    if ((nss_dbm_db_t *)NULL != token->session_db) {
+        nss_dbm_db_close(token->session_db);
+    }
+
+    token->session_db = nss_dbm_db_open(token->arena, fwInstance, (char *)NULL,
+                                        O_RDWR | O_CREAT, &rv);
+    if ((nss_dbm_db_t *)NULL == token->session_db) {
+        return rv;
+    }
+
+    /* Wipe the token object data */
+
+    if (token->slot->flags & O_RDWR) {
+        if ((nss_dbm_db_t *)NULL != token->slot->token_db) {
+            nss_dbm_db_close(token->slot->token_db);
+        }
+
+        token->slot->token_db = nss_dbm_db_open(instance->arena, fwInstance,
+                                                token->slot->filename,
+                                                token->slot->flags | O_CREAT | O_TRUNC,
+                                                &rv);
+        if ((nss_dbm_db_t *)NULL == token->slot->token_db) {
+            return rv;
+        }
+
+        /* PIN is irrelevant */
+
+        rv = nss_dbm_db_set_label(token->slot->token_db, label);
+        if (CKR_OK != rv) {
+            return rv;
+        }
+    }
+
+    return CKR_OK;
+}
+
+static NSSUTF8 *
+nss_dbm_mdToken_GetLabel(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    nss_dbm_token_t *token = (nss_dbm_token_t *)mdToken->etc;
+
+    if ((NSSUTF8 *)NULL == token->label) {
+        token->label = nss_dbm_db_get_label(token->slot->token_db, token->arena, pError);
+    }
+
+    /* If no label has been set, return *something* */
+    if ((NSSUTF8 *)NULL == token->label) {
+        return token->slot->filename;
+    }
+
+    return token->label;
+}
+
+static NSSUTF8 *
+nss_dbm_mdToken_GetManufacturerID(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return "mozilla.org NSS";
+}
+
+static NSSUTF8 *
+nss_dbm_mdToken_GetModel(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return "dbm";
+}
+
+/* GetSerialNumber is irrelevant */
+/* GetHasRNG defaults to CK_FALSE */
+
+static CK_BBOOL
+nss_dbm_mdToken_GetIsWriteProtected(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    nss_dbm_token_t *token = (nss_dbm_token_t *)mdToken->etc;
+
+    if (token->slot->flags & O_RDWR) {
+        return CK_FALSE;
+    } else {
+        return CK_TRUE;
+    }
+}
+
+/* GetLoginRequired defaults to CK_FALSE */
+/* GetUserPinInitialized defaults to CK_FALSE */
+/* GetRestoreKeyNotNeeded is irrelevant */
+/* GetHasClockOnToken defaults to CK_FALSE */
+/* GetHasProtectedAuthenticationPath defaults to CK_FALSE */
+/* GetSupportsDualCryptoOperations is irrelevant */
+
+static CK_ULONG
+nss_dbm_mdToken_effectively_infinite(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return CK_EFFECTIVELY_INFINITE;
+}
+
+static CK_VERSION
+nss_dbm_mdToken_GetHardwareVersion(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    nss_dbm_token_t *token = (nss_dbm_token_t *)mdToken->etc;
+    return nss_dbm_db_get_format_version(token->slot->token_db);
+}
+
+/* GetFirmwareVersion is irrelevant */
+/* GetUTCTime is irrelevant */
+
+static NSSCKMDSession *
+nss_dbm_mdToken_OpenSession(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    NSSCKFWSession *fwSession,
+    CK_BBOOL rw,
+    CK_RV *pError)
+{
+    nss_dbm_token_t *token = (nss_dbm_token_t *)mdToken->etc;
+    return nss_dbm_mdSession_factory(token, fwSession, fwInstance, rw, pError);
+}
+
+/* GetMechanismCount defaults to zero */
+/* GetMechanismTypes is irrelevant */
+/* GetMechanism is irrelevant */
+
+NSS_IMPLEMENT NSSCKMDToken *
+nss_dbm_mdToken_factory(
+    nss_dbm_slot_t *slot,
+    CK_RV *pError)
+{
+    nss_dbm_token_t *token;
+    NSSCKMDToken *rv;
+
+    token = nss_ZNEW(slot->instance->arena, nss_dbm_token_t);
+    if ((nss_dbm_token_t *)NULL == token) {
+        *pError = CKR_HOST_MEMORY;
+        return (NSSCKMDToken *)NULL;
+    }
+
+    rv = nss_ZNEW(slot->instance->arena, NSSCKMDToken);
+    if ((NSSCKMDToken *)NULL == rv) {
+        *pError = CKR_HOST_MEMORY;
+        return (NSSCKMDToken *)NULL;
+    }
+
+    token->slot = slot;
+
+    rv->etc = (void *)token;
+    rv->Setup = nss_dbm_mdToken_Setup;
+    rv->Invalidate = nss_dbm_mdToken_Invalidate;
+    rv->InitToken = nss_dbm_mdToken_InitToken;
+    rv->GetLabel = nss_dbm_mdToken_GetLabel;
+    rv->GetManufacturerID = nss_dbm_mdToken_GetManufacturerID;
+    rv->GetModel = nss_dbm_mdToken_GetModel;
+    /*  GetSerialNumber is irrelevant */
+    /*  GetHasRNG defaults to CK_FALSE */
+    rv->GetIsWriteProtected = nss_dbm_mdToken_GetIsWriteProtected;
+    /*  GetLoginRequired defaults to CK_FALSE */
+    /*  GetUserPinInitialized defaults to CK_FALSE */
+    /*  GetRestoreKeyNotNeeded is irrelevant */
+    /*  GetHasClockOnToken defaults to CK_FALSE */
+    /*  GetHasProtectedAuthenticationPath defaults to CK_FALSE */
+    /*  GetSupportsDualCryptoOperations is irrelevant */
+    rv->GetMaxSessionCount = nss_dbm_mdToken_effectively_infinite;
+    rv->GetMaxRwSessionCount = nss_dbm_mdToken_effectively_infinite;
+    /*  GetMaxPinLen is irrelevant */
+    /*  GetMinPinLen is irrelevant */
+    /*  GetTotalPublicMemory defaults to CK_UNAVAILABLE_INFORMATION */
+    /*  GetFreePublicMemory defaults to CK_UNAVAILABLE_INFORMATION */
+    /*  GetTotalPrivateMemory defaults to CK_UNAVAILABLE_INFORMATION */
+    /*  GetFreePrivateMemory defaults to CK_UNAVAILABLE_INFORMATION */
+    rv->GetHardwareVersion = nss_dbm_mdToken_GetHardwareVersion;
+    /*  GetFirmwareVersion is irrelevant */
+    /*  GetUTCTime is irrelevant */
+    rv->OpenSession = nss_dbm_mdToken_OpenSession;
+    rv->null = NULL;
+
+    return rv;
+}

security/nss/lib/ckfw/exports.gyp

@@ -0,0 +1,44 @@
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+{
+  'includes': [
+    '../../coreconf/config.gypi'
+  ],
+  'targets': [
+    {
+      'target_name': 'lib_ckfw_exports',
+      'type': 'none',
+      'copies': [
+        {
+          'files': [
+            'nssck.api',
+            'nssckepv.h',
+            'nssckft.h',
+            'nssckfw.h',
+            'nssckfwc.h',
+            'nssckfwt.h',
+            'nssckg.h',
+            'nssckmdt.h',
+            'nssckt.h'
+          ],
+          'destination': '<(nss_public_dist_dir)/<(module)'
+        },
+        {
+          'files': [
+            'ck.h',
+            'ckfw.h',
+            'ckfwm.h',
+            'ckfwtm.h',
+            'ckmd.h',
+            'ckt.h'
+          ],
+          'destination': '<(nss_private_dist_dir)/<(module)'
+        }
+      ]
+    }
+  ],
+  'variables': {
+    'module': 'nss'
+  }
+}

security/nss/lib/ckfw/find.c

@@ -0,0 +1,362 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * find.c
+ *
+ * This file implements the nssCKFWFindObjects type and methods.
+ */
+
+#ifndef CK_H
+#include "ck.h"
+#endif /* CK_H */
+
+/*
+ * NSSCKFWFindObjects
+ *
+ *  -- create/destroy --
+ *  nssCKFWFindObjects_Create
+ *  nssCKFWFindObjects_Destroy
+ *
+ *  -- public accessors --
+ *  NSSCKFWFindObjects_GetMDFindObjects
+ *
+ *  -- implement public accessors --
+ *  nssCKFWFindObjects_GetMDFindObjects
+ *
+ *  -- private accessors --
+ *
+ *  -- module fronts --
+ *  nssCKFWFindObjects_Next
+ */
+
+struct NSSCKFWFindObjectsStr {
+    NSSCKFWMutex *mutex; /* merely to serialise the MDObject calls */
+    NSSCKMDFindObjects *mdfo1;
+    NSSCKMDFindObjects *mdfo2;
+    NSSCKFWSession *fwSession;
+    NSSCKMDSession *mdSession;
+    NSSCKFWToken *fwToken;
+    NSSCKMDToken *mdToken;
+    NSSCKFWInstance *fwInstance;
+    NSSCKMDInstance *mdInstance;
+
+    NSSCKMDFindObjects *mdFindObjects; /* varies */
+};
+
+#ifdef DEBUG
+/*
+ * But first, the pointer-tracking stuff.
+ *
+ * NOTE: the pointer-tracking support in NSS/base currently relies
+ * upon NSPR's CallOnce support.  That, however, relies upon NSPR's
+ * locking, which is tied into the runtime.  We need a pointer-tracker
+ * implementation that uses the locks supplied through C_Initialize.
+ * That support, however, can be filled in later.  So for now, I'll
+ * just do these routines as no-ops.
+ */
+
+static CK_RV
+findObjects_add_pointer(
+    const NSSCKFWFindObjects *fwFindObjects)
+{
+    return CKR_OK;
+}
+
+static CK_RV
+findObjects_remove_pointer(
+    const NSSCKFWFindObjects *fwFindObjects)
+{
+    return CKR_OK;
+}
+
+NSS_IMPLEMENT CK_RV
+nssCKFWFindObjects_verifyPointer(
+    const NSSCKFWFindObjects *fwFindObjects)
+{
+    return CKR_OK;
+}
+
+#endif /* DEBUG */
+
+/*
+ * nssCKFWFindObjects_Create
+ *
+ */
+NSS_EXTERN NSSCKFWFindObjects *
+nssCKFWFindObjects_Create(
+    NSSCKFWSession *fwSession,
+    NSSCKFWToken *fwToken,
+    NSSCKFWInstance *fwInstance,
+    NSSCKMDFindObjects *mdFindObjects1,
+    NSSCKMDFindObjects *mdFindObjects2,
+    CK_RV *pError)
+{
+    NSSCKFWFindObjects *fwFindObjects = NULL;
+    NSSCKMDSession *mdSession;
+    NSSCKMDToken *mdToken;
+    NSSCKMDInstance *mdInstance;
+
+    mdSession = nssCKFWSession_GetMDSession(fwSession);
+    mdToken = nssCKFWToken_GetMDToken(fwToken);
+    mdInstance = nssCKFWInstance_GetMDInstance(fwInstance);
+
+    fwFindObjects = nss_ZNEW(NULL, NSSCKFWFindObjects);
+    if (!fwFindObjects) {
+        *pError = CKR_HOST_MEMORY;
+        goto loser;
+    }
+
+    fwFindObjects->mdfo1 = mdFindObjects1;
+    fwFindObjects->mdfo2 = mdFindObjects2;
+    fwFindObjects->fwSession = fwSession;
+    fwFindObjects->mdSession = mdSession;
+    fwFindObjects->fwToken = fwToken;
+    fwFindObjects->mdToken = mdToken;
+    fwFindObjects->fwInstance = fwInstance;
+    fwFindObjects->mdInstance = mdInstance;
+
+    fwFindObjects->mutex = nssCKFWInstance_CreateMutex(fwInstance, NULL, pError);
+    if (!fwFindObjects->mutex) {
+        goto loser;
+    }
+
+#ifdef DEBUG
+    *pError = findObjects_add_pointer(fwFindObjects);
+    if (CKR_OK != *pError) {
+        goto loser;
+    }
+#endif /* DEBUG */
+
+    return fwFindObjects;
+
+loser:
+    if (fwFindObjects) {
+        if (NULL != mdFindObjects1) {
+            if (NULL != mdFindObjects1->Final) {
+                fwFindObjects->mdFindObjects = mdFindObjects1;
+                mdFindObjects1->Final(mdFindObjects1, fwFindObjects, mdSession,
+                                      fwSession, mdToken, fwToken, mdInstance, fwInstance);
+            }
+        }
+
+        if (NULL != mdFindObjects2) {
+            if (NULL != mdFindObjects2->Final) {
+                fwFindObjects->mdFindObjects = mdFindObjects2;
+                mdFindObjects2->Final(mdFindObjects2, fwFindObjects, mdSession,
+                                      fwSession, mdToken, fwToken, mdInstance, fwInstance);
+            }
+        }
+
+        nss_ZFreeIf(fwFindObjects);
+    }
+
+    if (CKR_OK == *pError) {
+        *pError = CKR_GENERAL_ERROR;
+    }
+
+    return (NSSCKFWFindObjects *)NULL;
+}
+
+/*
+ * nssCKFWFindObjects_Destroy
+ *
+ */
+NSS_EXTERN void
+nssCKFWFindObjects_Destroy(
+    NSSCKFWFindObjects *fwFindObjects)
+{
+#ifdef NSSDEBUG
+    if (CKR_OK != nssCKFWFindObjects_verifyPointer(fwFindObjects)) {
+        return;
+    }
+#endif /* NSSDEBUG */
+
+    (void)nssCKFWMutex_Destroy(fwFindObjects->mutex);
+
+    if (fwFindObjects->mdfo1) {
+        if (fwFindObjects->mdfo1->Final) {
+            fwFindObjects->mdFindObjects = fwFindObjects->mdfo1;
+            fwFindObjects->mdfo1->Final(fwFindObjects->mdfo1, fwFindObjects,
+                                        fwFindObjects->mdSession, fwFindObjects->fwSession,
+                                        fwFindObjects->mdToken, fwFindObjects->fwToken,
+                                        fwFindObjects->mdInstance, fwFindObjects->fwInstance);
+        }
+    }
+
+    if (fwFindObjects->mdfo2) {
+        if (fwFindObjects->mdfo2->Final) {
+            fwFindObjects->mdFindObjects = fwFindObjects->mdfo2;
+            fwFindObjects->mdfo2->Final(fwFindObjects->mdfo2, fwFindObjects,
+                                        fwFindObjects->mdSession, fwFindObjects->fwSession,
+                                        fwFindObjects->mdToken, fwFindObjects->fwToken,
+                                        fwFindObjects->mdInstance, fwFindObjects->fwInstance);
+        }
+    }
+
+    nss_ZFreeIf(fwFindObjects);
+
+#ifdef DEBUG
+    (void)findObjects_remove_pointer(fwFindObjects);
+#endif /* DEBUG */
+
+    return;
+}
+
+/*
+ * nssCKFWFindObjects_GetMDFindObjects
+ *
+ */
+NSS_EXTERN NSSCKMDFindObjects *
+nssCKFWFindObjects_GetMDFindObjects(
+    NSSCKFWFindObjects *fwFindObjects)
+{
+#ifdef NSSDEBUG
+    if (CKR_OK != nssCKFWFindObjects_verifyPointer(fwFindObjects)) {
+        return (NSSCKMDFindObjects *)NULL;
+    }
+#endif /* NSSDEBUG */
+
+    return fwFindObjects->mdFindObjects;
+}
+
+/*
+ * nssCKFWFindObjects_Next
+ *
+ */
+NSS_EXTERN NSSCKFWObject *
+nssCKFWFindObjects_Next(
+    NSSCKFWFindObjects *fwFindObjects,
+    NSSArena *arenaOpt,
+    CK_RV *pError)
+{
+    NSSCKMDObject *mdObject;
+    NSSCKFWObject *fwObject = (NSSCKFWObject *)NULL;
+    NSSArena *objArena;
+
+#ifdef NSSDEBUG
+    if (!pError) {
+        return (NSSCKFWObject *)NULL;
+    }
+
+    *pError = nssCKFWFindObjects_verifyPointer(fwFindObjects);
+    if (CKR_OK != *pError) {
+        return (NSSCKFWObject *)NULL;
+    }
+#endif /* NSSDEBUG */
+
+    *pError = nssCKFWMutex_Lock(fwFindObjects->mutex);
+    if (CKR_OK != *pError) {
+        return (NSSCKFWObject *)NULL;
+    }
+
+    if (fwFindObjects->mdfo1) {
+        if (fwFindObjects->mdfo1->Next) {
+            fwFindObjects->mdFindObjects = fwFindObjects->mdfo1;
+            mdObject = fwFindObjects->mdfo1->Next(fwFindObjects->mdfo1,
+                                                  fwFindObjects, fwFindObjects->mdSession, fwFindObjects->fwSession,
+                                                  fwFindObjects->mdToken, fwFindObjects->fwToken,
+                                                  fwFindObjects->mdInstance, fwFindObjects->fwInstance,
+                                                  arenaOpt, pError);
+            if (!mdObject) {
+                if (CKR_OK != *pError) {
+                    goto done;
+                }
+
+                /* All done. */
+                fwFindObjects->mdfo1->Final(fwFindObjects->mdfo1, fwFindObjects,
+                                            fwFindObjects->mdSession, fwFindObjects->fwSession,
+                                            fwFindObjects->mdToken, fwFindObjects->fwToken,
+                                            fwFindObjects->mdInstance, fwFindObjects->fwInstance);
+                fwFindObjects->mdfo1 = (NSSCKMDFindObjects *)NULL;
+            } else {
+                goto wrap;
+            }
+        }
+    }
+
+    if (fwFindObjects->mdfo2) {
+        if (fwFindObjects->mdfo2->Next) {
+            fwFindObjects->mdFindObjects = fwFindObjects->mdfo2;
+            mdObject = fwFindObjects->mdfo2->Next(fwFindObjects->mdfo2,
+                                                  fwFindObjects, fwFindObjects->mdSession, fwFindObjects->fwSession,
+                                                  fwFindObjects->mdToken, fwFindObjects->fwToken,
+                                                  fwFindObjects->mdInstance, fwFindObjects->fwInstance,
+                                                  arenaOpt, pError);
+            if (!mdObject) {
+                if (CKR_OK != *pError) {
+                    goto done;
+                }
+
+                /* All done. */
+                fwFindObjects->mdfo2->Final(fwFindObjects->mdfo2, fwFindObjects,
+                                            fwFindObjects->mdSession, fwFindObjects->fwSession,
+                                            fwFindObjects->mdToken, fwFindObjects->fwToken,
+                                            fwFindObjects->mdInstance, fwFindObjects->fwInstance);
+                fwFindObjects->mdfo2 = (NSSCKMDFindObjects *)NULL;
+            } else {
+                goto wrap;
+            }
+        }
+    }
+
+    /* No more objects */
+    *pError = CKR_OK;
+    goto done;
+
+wrap:
+    /*
+   * This seems is less than ideal-- we should determine if it's a token
+   * object or a session object, and use the appropriate arena.
+   * But that duplicates logic in nssCKFWObject_IsTokenObject.
+   * Also we should lookup the real session the object was created on
+   * if the object was a session object... however this code is actually
+   * correct because nssCKFWObject_Create will return a cached version of
+   * the object from it's hash. This is necessary because 1) we don't want
+   * to create an arena style leak (where our arena grows with every search),
+   * and 2) we want the same object to always have the same ID. This means
+   * the only case the nssCKFWObject_Create() will need the objArena and the
+   * Session is in the case of token objects (session objects should already
+   * exist in the cache from their initial creation). So this code is correct,
+   * but it depends on nssCKFWObject_Create caching all objects.
+   */
+    objArena = nssCKFWToken_GetArena(fwFindObjects->fwToken, pError);
+    if (!objArena) {
+        if (CKR_OK == *pError) {
+            *pError = CKR_HOST_MEMORY;
+        }
+        goto done;
+    }
+
+    fwObject = nssCKFWObject_Create(objArena, mdObject,
+                                    NULL, fwFindObjects->fwToken,
+                                    fwFindObjects->fwInstance, pError);
+    if (!fwObject) {
+        if (CKR_OK == *pError) {
+            *pError = CKR_GENERAL_ERROR;
+        }
+    }
+
+done:
+    (void)nssCKFWMutex_Unlock(fwFindObjects->mutex);
+    return fwObject;
+}
+
+/*
+ * NSSCKFWFindObjects_GetMDFindObjects
+ *
+ */
+
+NSS_EXTERN NSSCKMDFindObjects *
+NSSCKFWFindObjects_GetMDFindObjects(
+    NSSCKFWFindObjects *fwFindObjects)
+{
+#ifdef DEBUG
+    if (CKR_OK != nssCKFWFindObjects_verifyPointer(fwFindObjects)) {
+        return (NSSCKMDFindObjects *)NULL;
+    }
+#endif /* DEBUG */
+
+    return nssCKFWFindObjects_GetMDFindObjects(fwFindObjects);
+}

security/nss/lib/ckfw/hash.c

@@ -0,0 +1,280 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * hash.c
+ *
+ * This is merely a couple wrappers around NSPR's PLHashTable, using
+ * the identity hash and arena-aware allocators.  The reason I did
+ * this is that hash tables are used in a few places throughout the
+ * NSS Cryptoki Framework in a fairly stereotyped way, and this allows
+ * me to pull the commonalities into one place.  Should we ever want
+ * to change the implementation, it's all right here.
+ */
+
+#ifndef CK_T
+#include "ck.h"
+#endif /* CK_T */
+
+/*
+ * nssCKFWHash
+ *
+ *  nssCKFWHash_Create
+ *  nssCKFWHash_Destroy
+ *  nssCKFWHash_Add
+ *  nssCKFWHash_Remove
+ *  nssCKFWHash_Count
+ *  nssCKFWHash_Exists
+ *  nssCKFWHash_Lookup
+ *  nssCKFWHash_Iterate
+ */
+
+struct nssCKFWHashStr {
+    NSSCKFWMutex *mutex;
+
+    /*
+     * The invariant that mutex protects is:
+     *   The count accurately reflects the hashtable state.
+     */
+
+    PLHashTable *plHashTable;
+    CK_ULONG count;
+};
+
+static PLHashNumber
+nss_ckfw_identity_hash(
+    const void *key)
+{
+    return (PLHashNumber)((char *)key - (char *)NULL);
+}
+
+/*
+ * nssCKFWHash_Create
+ *
+ */
+NSS_IMPLEMENT nssCKFWHash *
+nssCKFWHash_Create(
+    NSSCKFWInstance *fwInstance,
+    NSSArena *arena,
+    CK_RV *pError)
+{
+    nssCKFWHash *rv;
+
+#ifdef NSSDEBUG
+    if (!pError) {
+        return (nssCKFWHash *)NULL;
+    }
+
+    if (PR_SUCCESS != nssArena_verifyPointer(arena)) {
+        *pError = CKR_ARGUMENTS_BAD;
+        return (nssCKFWHash *)NULL;
+    }
+#endif /* NSSDEBUG */
+
+    rv = nss_ZNEW(arena, nssCKFWHash);
+    if (!rv) {
+        *pError = CKR_HOST_MEMORY;
+        return (nssCKFWHash *)NULL;
+    }
+
+    rv->mutex = nssCKFWInstance_CreateMutex(fwInstance, arena, pError);
+    if (!rv->mutex) {
+        if (CKR_OK == *pError) {
+            *pError = CKR_GENERAL_ERROR;
+        }
+        (void)nss_ZFreeIf(rv);
+        return (nssCKFWHash *)NULL;
+    }
+
+    rv->plHashTable = PL_NewHashTable(0, nss_ckfw_identity_hash,
+                                      PL_CompareValues, PL_CompareValues, &nssArenaHashAllocOps, arena);
+    if (!rv->plHashTable) {
+        (void)nssCKFWMutex_Destroy(rv->mutex);
+        (void)nss_ZFreeIf(rv);
+        *pError = CKR_HOST_MEMORY;
+        return (nssCKFWHash *)NULL;
+    }
+
+    rv->count = 0;
+
+    return rv;
+}
+
+/*
+ * nssCKFWHash_Destroy
+ *
+ */
+NSS_IMPLEMENT void
+nssCKFWHash_Destroy(
+    nssCKFWHash *hash)
+{
+    (void)nssCKFWMutex_Destroy(hash->mutex);
+    PL_HashTableDestroy(hash->plHashTable);
+    (void)nss_ZFreeIf(hash);
+}
+
+/*
+ * nssCKFWHash_Add
+ *
+ */
+NSS_IMPLEMENT CK_RV
+nssCKFWHash_Add(
+    nssCKFWHash *hash,
+    const void *key,
+    const void *value)
+{
+    CK_RV error = CKR_OK;
+    PLHashEntry *he;
+
+    error = nssCKFWMutex_Lock(hash->mutex);
+    if (CKR_OK != error) {
+        return error;
+    }
+
+    he = PL_HashTableAdd(hash->plHashTable, key, (void *)value);
+    if (!he) {
+        error = CKR_HOST_MEMORY;
+    } else {
+        hash->count++;
+    }
+
+    (void)nssCKFWMutex_Unlock(hash->mutex);
+
+    return error;
+}
+
+/*
+ * nssCKFWHash_Remove
+ *
+ */
+NSS_IMPLEMENT void
+nssCKFWHash_Remove(
+    nssCKFWHash *hash,
+    const void *it)
+{
+    PRBool found;
+
+    if (CKR_OK != nssCKFWMutex_Lock(hash->mutex)) {
+        return;
+    }
+
+    found = PL_HashTableRemove(hash->plHashTable, it);
+    if (found) {
+        hash->count--;
+    }
+
+    (void)nssCKFWMutex_Unlock(hash->mutex);
+    return;
+}
+
+/*
+ * nssCKFWHash_Count
+ *
+ */
+NSS_IMPLEMENT CK_ULONG
+nssCKFWHash_Count(
+    nssCKFWHash *hash)
+{
+    CK_ULONG count;
+
+    if (CKR_OK != nssCKFWMutex_Lock(hash->mutex)) {
+        return (CK_ULONG)0;
+    }
+
+    count = hash->count;
+
+    (void)nssCKFWMutex_Unlock(hash->mutex);
+
+    return count;
+}
+
+/*
+ * nssCKFWHash_Exists
+ *
+ */
+NSS_IMPLEMENT CK_BBOOL
+nssCKFWHash_Exists(
+    nssCKFWHash *hash,
+    const void *it)
+{
+    void *value;
+
+    if (CKR_OK != nssCKFWMutex_Lock(hash->mutex)) {
+        return CK_FALSE;
+    }
+
+    value = PL_HashTableLookup(hash->plHashTable, it);
+
+    (void)nssCKFWMutex_Unlock(hash->mutex);
+
+    if (!value) {
+        return CK_FALSE;
+    } else {
+        return CK_TRUE;
+    }
+}
+
+/*
+ * nssCKFWHash_Lookup
+ *
+ */
+NSS_IMPLEMENT void *
+nssCKFWHash_Lookup(
+    nssCKFWHash *hash,
+    const void *it)
+{
+    void *rv;
+
+    if (CKR_OK != nssCKFWMutex_Lock(hash->mutex)) {
+        return (void *)NULL;
+    }
+
+    rv = PL_HashTableLookup(hash->plHashTable, it);
+
+    (void)nssCKFWMutex_Unlock(hash->mutex);
+
+    return rv;
+}
+
+struct arg_str {
+    nssCKFWHashIterator fcn;
+    void *closure;
+};
+
+static PRIntn
+nss_ckfwhash_enumerator(
+    PLHashEntry *he,
+    PRIntn index,
+    void *arg)
+{
+    struct arg_str *as = (struct arg_str *)arg;
+    as->fcn(he->key, he->value, as->closure);
+    return HT_ENUMERATE_NEXT;
+}
+
+/*
+ * nssCKFWHash_Iterate
+ *
+ * NOTE that the iteration function will be called with the hashtable locked.
+ */
+NSS_IMPLEMENT void
+nssCKFWHash_Iterate(
+    nssCKFWHash *hash,
+    nssCKFWHashIterator fcn,
+    void *closure)
+{
+    struct arg_str as;
+    as.fcn = fcn;
+    as.closure = closure;
+
+    if (CKR_OK != nssCKFWMutex_Lock(hash->mutex)) {
+        return;
+    }
+
+    PL_HashTableEnumerateEntries(hash->plHashTable, nss_ckfwhash_enumerator, &as);
+
+    (void)nssCKFWMutex_Unlock(hash->mutex);
+
+    return;
+}

security/nss/lib/ckfw/manifest.mn

@@ -0,0 +1,53 @@
+# 
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+CORE_DEPTH = ../..
+
+DIRS = builtins 
+
+PRIVATE_EXPORTS = \
+	ck.h		  \
+	ckfw.h		  \
+	ckfwm.h		  \
+	ckfwtm.h	  \
+	ckmd.h		  \
+	ckt.h		  \
+	$(NULL)
+
+EXPORTS =	   \
+	nssck.api  \
+	nssckepv.h \
+	nssckft.h  \
+	nssckfw.h  \
+	nssckfwc.h \
+	nssckfwt.h \
+	nssckg.h   \
+	nssckmdt.h \
+	nssckt.h   \
+	$(NULL)
+
+MODULE = nss
+
+CSRCS =		   \
+	crypto.c   \
+	find.c	   \
+	hash.c	   \
+	instance.c \
+	mutex.c	   \
+	object.c   \
+	session.c  \
+	sessobj.c  \
+	slot.c	   \
+	token.c	   \
+	wrap.c	   \
+	mechanism.c \
+	$(NULL)
+
+REQUIRES = nspr
+
+LIBRARY_NAME = nssckfw
+
+# This part of the code, including all sub-dirs, can be optimized for size
+export ALLOW_OPT_CODE_SIZE = 1

security/nss/lib/ckfw/mutex.c

@@ -0,0 +1,248 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * mutex.c
+ *
+ * This file implements a mutual-exclusion locking facility for Modules
+ * using the NSS Cryptoki Framework.
+ */
+
+#ifndef CK_T
+#include "ck.h"
+#endif /* CK_T */
+
+/*
+ * NSSCKFWMutex
+ *
+ *  NSSCKFWMutex_Destroy
+ *  NSSCKFWMutex_Lock
+ *  NSSCKFWMutex_Unlock
+ *
+ *  nssCKFWMutex_Create
+ *  nssCKFWMutex_Destroy
+ *  nssCKFWMutex_Lock
+ *  nssCKFWMutex_Unlock
+ *
+ *  -- debugging versions only --
+ *  nssCKFWMutex_verifyPointer
+ *
+ */
+
+struct NSSCKFWMutexStr {
+    PRLock *lock;
+};
+
+#ifdef DEBUG
+/*
+ * But first, the pointer-tracking stuff.
+ *
+ * NOTE: the pointer-tracking support in NSS/base currently relies
+ * upon NSPR's CallOnce support.  That, however, relies upon NSPR's
+ * locking, which is tied into the runtime.  We need a pointer-tracker
+ * implementation that uses the locks supplied through C_Initialize.
+ * That support, however, can be filled in later.  So for now, I'll
+ * just do this routines as no-ops.
+ */
+
+static CK_RV
+mutex_add_pointer(
+    const NSSCKFWMutex *fwMutex)
+{
+    return CKR_OK;
+}
+
+static CK_RV
+mutex_remove_pointer(
+    const NSSCKFWMutex *fwMutex)
+{
+    return CKR_OK;
+}
+
+NSS_IMPLEMENT CK_RV
+nssCKFWMutex_verifyPointer(
+    const NSSCKFWMutex *fwMutex)
+{
+    return CKR_OK;
+}
+
+#endif /* DEBUG */
+
+/*
+ * nssCKFWMutex_Create
+ *
+ */
+NSS_EXTERN NSSCKFWMutex *
+nssCKFWMutex_Create(
+    CK_C_INITIALIZE_ARGS_PTR pInitArgs,
+    CryptokiLockingState LockingState,
+    NSSArena *arena,
+    CK_RV *pError)
+{
+    NSSCKFWMutex *mutex;
+
+    mutex = nss_ZNEW(arena, NSSCKFWMutex);
+    if (!mutex) {
+        *pError = CKR_HOST_MEMORY;
+        return (NSSCKFWMutex *)NULL;
+    }
+    *pError = CKR_OK;
+    mutex->lock = NULL;
+    if (LockingState == MultiThreaded) {
+        mutex->lock = PR_NewLock();
+        if (!mutex->lock) {
+            *pError = CKR_HOST_MEMORY; /* we couldn't get the resource */
+        }
+    }
+
+    if (CKR_OK != *pError) {
+        (void)nss_ZFreeIf(mutex);
+        return (NSSCKFWMutex *)NULL;
+    }
+
+#ifdef DEBUG
+    *pError = mutex_add_pointer(mutex);
+    if (CKR_OK != *pError) {
+        if (mutex->lock) {
+            PR_DestroyLock(mutex->lock);
+        }
+        (void)nss_ZFreeIf(mutex);
+        return (NSSCKFWMutex *)NULL;
+    }
+#endif /* DEBUG */
+
+    return mutex;
+}
+
+/*
+ * nssCKFWMutex_Destroy
+ *
+ */
+NSS_EXTERN CK_RV
+nssCKFWMutex_Destroy(
+    NSSCKFWMutex *mutex)
+{
+    CK_RV rv = CKR_OK;
+
+#ifdef NSSDEBUG
+    rv = nssCKFWMutex_verifyPointer(mutex);
+    if (CKR_OK != rv) {
+        return rv;
+    }
+#endif /* NSSDEBUG */
+
+    if (mutex->lock) {
+        PR_DestroyLock(mutex->lock);
+    }
+
+#ifdef DEBUG
+    (void)mutex_remove_pointer(mutex);
+#endif /* DEBUG */
+
+    (void)nss_ZFreeIf(mutex);
+    return rv;
+}
+
+/*
+ * nssCKFWMutex_Lock
+ *
+ */
+NSS_EXTERN CK_RV
+nssCKFWMutex_Lock(
+    NSSCKFWMutex *mutex)
+{
+#ifdef NSSDEBUG
+    CK_RV rv = nssCKFWMutex_verifyPointer(mutex);
+    if (CKR_OK != rv) {
+        return rv;
+    }
+#endif /* NSSDEBUG */
+    if (mutex->lock) {
+        PR_Lock(mutex->lock);
+    }
+
+    return CKR_OK;
+}
+
+/*
+ * nssCKFWMutex_Unlock
+ *
+ */
+NSS_EXTERN CK_RV
+nssCKFWMutex_Unlock(
+    NSSCKFWMutex *mutex)
+{
+    PRStatus nrv;
+#ifdef NSSDEBUG
+    CK_RV rv = nssCKFWMutex_verifyPointer(mutex);
+
+    if (CKR_OK != rv) {
+        return rv;
+    }
+#endif /* NSSDEBUG */
+
+    if (!mutex->lock)
+        return CKR_OK;
+
+    nrv = PR_Unlock(mutex->lock);
+
+    /* if unlock fails, either we have a programming error, or we have
+     * some sort of hardware failure... in either case return CKR_DEVICE_ERROR.
+     */
+    return nrv == PR_SUCCESS ? CKR_OK : CKR_DEVICE_ERROR;
+}
+
+/*
+ * NSSCKFWMutex_Destroy
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWMutex_Destroy(
+    NSSCKFWMutex *mutex)
+{
+#ifdef DEBUG
+    CK_RV rv = nssCKFWMutex_verifyPointer(mutex);
+    if (CKR_OK != rv) {
+        return rv;
+    }
+#endif /* DEBUG */
+
+    return nssCKFWMutex_Destroy(mutex);
+}
+
+/*
+ * NSSCKFWMutex_Lock
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWMutex_Lock(
+    NSSCKFWMutex *mutex)
+{
+#ifdef DEBUG
+    CK_RV rv = nssCKFWMutex_verifyPointer(mutex);
+    if (CKR_OK != rv) {
+        return rv;
+    }
+#endif /* DEBUG */
+
+    return nssCKFWMutex_Lock(mutex);
+}
+
+/*
+ * NSSCKFWMutex_Unlock
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWMutex_Unlock(
+    NSSCKFWMutex *mutex)
+{
+#ifdef DEBUG
+    CK_RV rv = nssCKFWMutex_verifyPointer(mutex);
+    if (CKR_OK != rv) {
+        return rv;
+    }
+#endif /* DEBUG */
+
+    return nssCKFWMutex_Unlock(mutex);
+}

security/nss/lib/ckfw/nssckepv.h

@@ -0,0 +1,10 @@
+/* THIS IS A GENERATED FILE */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef NSSCKEPV_H
+#define NSSCKEPV_H
+
+#include "pkcs11.h"
+
+#endif /* NSSCKEPV_H */

security/nss/lib/ckfw/nssckft.h

@@ -0,0 +1,11 @@
+/* THIS IS A GENERATED FILE */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef _NSSCKFT_H_
+#define _NSSCKFT_H_ 1
+
+#include "pkcs11t.h"
+
+#endif /* _NSSCKFT_H_ */

security/nss/lib/ckfw/nssckfw.h

@@ -0,0 +1,462 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef NSSCKFW_H
+#define NSSCKFW_H
+
+/*
+ * nssckfw.h
+ *
+ * This file prototypes the publicly available calls of the
+ * NSS Cryptoki Framework.
+ */
+
+#ifndef NSSBASET_H
+#include "nssbaset.h"
+#endif /* NSSBASET_H */
+
+#ifndef NSSCKT_H
+#include "nssckt.h"
+#endif /* NSSCKT_H */
+
+#ifndef NSSCKFWT_H
+#include "nssckfwt.h"
+#endif /* NSSCKFWT_H */
+
+/*
+ * NSSCKFWInstance
+ *
+ *  NSSCKFWInstance_GetMDInstance
+ *  NSSCKFWInstance_GetArena
+ *  NSSCKFWInstance_MayCreatePthreads
+ *  NSSCKFWInstance_CreateMutex
+ *  NSSCKFWInstance_GetConfigurationData
+ *  NSSCKFWInstance_GetInitArgs
+ *  NSSCKFWInstance_DestroySessionHandle
+ *  NSSCKFWInstance_FindSessionHandle
+ */
+
+/*
+ * NSSCKFWInstance_GetMDInstance
+ *
+ */
+
+NSS_EXTERN NSSCKMDInstance *
+NSSCKFWInstance_GetMDInstance(
+    NSSCKFWInstance *fwInstance);
+
+/*
+ * NSSCKFWInstance_GetArena
+ *
+ */
+
+NSS_EXTERN NSSArena *
+NSSCKFWInstance_GetArena(
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError);
+
+/*
+ * NSSCKFWInstance_MayCreatePthreads
+ *
+ */
+
+NSS_EXTERN CK_BBOOL
+NSSCKFWInstance_MayCreatePthreads(
+    NSSCKFWInstance *fwInstance);
+
+/*
+ * NSSCKFWInstance_CreateMutex
+ *
+ */
+
+NSS_EXTERN NSSCKFWMutex *
+NSSCKFWInstance_CreateMutex(
+    NSSCKFWInstance *fwInstance,
+    NSSArena *arena,
+    CK_RV *pError);
+
+/*
+ * NSSCKFWInstance_GetConfigurationData
+ *
+ */
+
+NSS_EXTERN NSSUTF8 *
+NSSCKFWInstance_GetConfigurationData(
+    NSSCKFWInstance *fwInstance);
+
+/*
+ * NSSCKFWInstance_GetInitArgs
+ *
+ */
+
+NSS_EXTERN CK_C_INITIALIZE_ARGS_PTR
+NSSCKFWInstance_GetInitArgs(
+    NSSCKFWInstance *fwInstance);
+
+/*
+ * nssCKFWInstance_DestroySessionHandle
+ *
+ */
+NSS_EXTERN void
+NSSCKFWInstance_DestroySessionHandle(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession);
+
+/*
+ * nssCKFWInstance_FindSessionHandle
+ *
+ */
+NSS_EXTERN CK_SESSION_HANDLE
+NSSCKFWInstance_FindSessionHandle(
+    NSSCKFWInstance *fwInstance,
+    NSSCKFWSession *fwSession);
+
+/*
+ * NSSCKFWSlot
+ *
+ *  NSSCKFWSlot_GetMDSlot
+ *  NSSCKFWSlot_GetFWInstance
+ *  NSSCKFWSlot_GetMDInstance
+ *  NSSCKFWSlot_GetSlotID
+ *
+ */
+
+/*
+ * NSSCKFWSlot_GetMDSlot
+ *
+ */
+
+NSS_EXTERN NSSCKMDSlot *
+NSSCKFWSlot_GetMDSlot(
+    NSSCKFWSlot *fwSlot);
+
+/*
+ * NSSCKFWSlot_GetFWInstance
+ *
+ */
+
+NSS_EXTERN NSSCKFWInstance *
+NSSCKFWSlot_GetFWInstance(
+    NSSCKFWSlot *fwSlot);
+
+/*
+ * NSSCKFWSlot_GetMDInstance
+ *
+ */
+
+NSS_EXTERN NSSCKMDInstance *
+NSSCKFWSlot_GetMDInstance(
+    NSSCKFWSlot *fwSlot);
+
+/*
+ * NSSCKFWSlot_GetSlotID
+ *
+ */
+
+NSS_EXTERN CK_SLOT_ID
+NSSCKFWSlot_GetSlotID(
+    NSSCKFWSlot *fwSlot);
+
+/*
+ * NSSCKFWToken
+ *
+ *  NSSCKFWToken_GetMDToken
+ *  NSSCKFWToken_GetFWSlot
+ *  NSSCKFWToken_GetMDSlot
+ *  NSSCKFWToken_GetSessionState
+ *
+ */
+
+/*
+ * NSSCKFWToken_GetMDToken
+ *
+ */
+
+NSS_EXTERN NSSCKMDToken *
+NSSCKFWToken_GetMDToken(
+    NSSCKFWToken *fwToken);
+
+/*
+ * NSSCKFWToken_GetArena
+ *
+ */
+
+NSS_EXTERN NSSArena *
+NSSCKFWToken_GetArena(
+    NSSCKFWToken *fwToken,
+    CK_RV *pError);
+
+/*
+ * NSSCKFWToken_GetFWSlot
+ *
+ */
+
+NSS_EXTERN NSSCKFWSlot *
+NSSCKFWToken_GetFWSlot(
+    NSSCKFWToken *fwToken);
+
+/*
+ * NSSCKFWToken_GetMDSlot
+ *
+ */
+
+NSS_EXTERN NSSCKMDSlot *
+NSSCKFWToken_GetMDSlot(
+    NSSCKFWToken *fwToken);
+
+/*
+ * NSSCKFWToken_GetSessionState
+ *
+ */
+
+NSS_EXTERN CK_STATE
+NSSCKFWToken_GetSessionState(
+    NSSCKFWToken *fwToken);
+
+/*
+ * NSSCKFWMechanism
+ *
+ *  NSSKCFWMechanism_GetMDMechanism
+ *  NSSCKFWMechanism_GetParameter
+ *
+ */
+
+/*
+ * NSSKCFWMechanism_GetMDMechanism
+ *
+ */
+
+NSS_EXTERN NSSCKMDMechanism *
+NSSCKFWMechanism_GetMDMechanism(
+    NSSCKFWMechanism *fwMechanism);
+
+/*
+ * NSSCKFWMechanism_GetParameter
+ *
+ */
+
+NSS_EXTERN NSSItem *
+NSSCKFWMechanism_GetParameter(
+    NSSCKFWMechanism *fwMechanism);
+
+/*
+ * NSSCKFWSession
+ *
+ *  NSSCKFWSession_GetMDSession
+ *  NSSCKFWSession_GetArena
+ *  NSSCKFWSession_CallNotification
+ *  NSSCKFWSession_IsRWSession
+ *  NSSCKFWSession_IsSO
+ *  NSSCKFWSession_GetCurrentCryptoOperation
+ *  NSSCKFWSession_GetFWSlot
+ *
+ */
+
+/*
+ * NSSCKFWSession_GetMDSession
+ *
+ */
+
+NSS_EXTERN NSSCKMDSession *
+NSSCKFWSession_GetMDSession(
+    NSSCKFWSession *fwSession);
+
+/*
+ * NSSCKFWSession_GetArena
+ *
+ */
+
+NSS_EXTERN NSSArena *
+NSSCKFWSession_GetArena(
+    NSSCKFWSession *fwSession,
+    CK_RV *pError);
+
+/*
+ * NSSCKFWSession_CallNotification
+ *
+ */
+
+NSS_EXTERN CK_RV
+NSSCKFWSession_CallNotification(
+    NSSCKFWSession *fwSession,
+    CK_NOTIFICATION event);
+
+/*
+ * NSSCKFWSession_IsRWSession
+ *
+ */
+
+NSS_EXTERN CK_BBOOL
+NSSCKFWSession_IsRWSession(
+    NSSCKFWSession *fwSession);
+
+/*
+ * NSSCKFWSession_IsSO
+ *
+ */
+
+NSS_EXTERN CK_BBOOL
+NSSCKFWSession_IsSO(
+    NSSCKFWSession *fwSession);
+
+/*
+ * NSSCKFWSession_GetCurrentCryptoOperation
+ *
+ */
+
+NSS_EXTERN NSSCKFWCryptoOperation *
+NSSCKFWSession_GetCurrentCryptoOperation(
+    NSSCKFWSession *fwSession,
+    NSSCKFWCryptoOperationState state);
+
+/*
+ * NSSCKFWSession_GetFWSlot
+ *
+ */
+
+NSS_EXTERN NSSCKFWSlot *
+NSSCKFWSession_GetFWSlot(
+    NSSCKFWSession *fwSession);
+
+/*
+ * NSSCKFWObject
+ *
+ *  NSSCKFWObject_GetMDObject
+ *  NSSCKFWObject_GetArena
+ *  NSSCKFWObject_IsTokenObject
+ *  NSSCKFWObject_GetAttributeCount
+ *  NSSCKFWObject_GetAttributeTypes
+ *  NSSCKFWObject_GetAttributeSize
+ *  NSSCKFWObject_GetAttribute
+ *  NSSCKFWObject_GetObjectSize
+ */
+
+/*
+ * NSSCKFWObject_GetMDObject
+ *
+ */
+NSS_EXTERN NSSCKMDObject *
+NSSCKFWObject_GetMDObject(
+    NSSCKFWObject *fwObject);
+
+/*
+ * NSSCKFWObject_GetArena
+ *
+ */
+NSS_EXTERN NSSArena *
+NSSCKFWObject_GetArena(
+    NSSCKFWObject *fwObject,
+    CK_RV *pError);
+
+/*
+ * NSSCKFWObject_IsTokenObject
+ *
+ */
+NSS_EXTERN CK_BBOOL
+NSSCKFWObject_IsTokenObject(
+    NSSCKFWObject *fwObject);
+
+/*
+ * NSSCKFWObject_GetAttributeCount
+ *
+ */
+NSS_EXTERN CK_ULONG
+NSSCKFWObject_GetAttributeCount(
+    NSSCKFWObject *fwObject,
+    CK_RV *pError);
+
+/*
+ * NSSCKFWObject_GetAttributeTypes
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWObject_GetAttributeTypes(
+    NSSCKFWObject *fwObject,
+    CK_ATTRIBUTE_TYPE_PTR typeArray,
+    CK_ULONG ulCount);
+
+/*
+ * NSSCKFWObject_GetAttributeSize
+ *
+ */
+NSS_EXTERN CK_ULONG
+NSSCKFWObject_GetAttributeSize(
+    NSSCKFWObject *fwObject,
+    CK_ATTRIBUTE_TYPE attribute,
+    CK_RV *pError);
+
+/*
+ * NSSCKFWObject_GetAttribute
+ *
+ */
+NSS_EXTERN NSSItem *
+NSSCKFWObject_GetAttribute(
+    NSSCKFWObject *fwObject,
+    CK_ATTRIBUTE_TYPE attribute,
+    NSSItem *itemOpt,
+    NSSArena *arenaOpt,
+    CK_RV *pError);
+
+/*
+ * NSSCKFWObject_GetObjectSize
+ *
+ */
+NSS_EXTERN CK_ULONG
+NSSCKFWObject_GetObjectSize(
+    NSSCKFWObject *fwObject,
+    CK_RV *pError);
+
+/*
+ * NSSCKFWFindObjects
+ *
+ *  NSSCKFWFindObjects_GetMDFindObjects
+ *
+ */
+
+/*
+ * NSSCKFWFindObjects_GetMDFindObjects
+ *
+ */
+
+NSS_EXTERN NSSCKMDFindObjects *
+NSSCKFWFindObjects_GetMDFindObjects(
+    NSSCKFWFindObjects *);
+
+/*
+ * NSSCKFWMutex
+ *
+ *  NSSCKFWMutex_Destroy
+ *  NSSCKFWMutex_Lock
+ *  NSSCKFWMutex_Unlock
+ *
+ */
+
+/*
+ * NSSCKFWMutex_Destroy
+ *
+ */
+
+NSS_EXTERN CK_RV
+NSSCKFWMutex_Destroy(
+    NSSCKFWMutex *mutex);
+
+/*
+ * NSSCKFWMutex_Lock
+ *
+ */
+
+NSS_EXTERN CK_RV
+NSSCKFWMutex_Lock(
+    NSSCKFWMutex *mutex);
+
+/*
+ * NSSCKFWMutex_Unlock
+ *
+ */
+
+NSS_EXTERN CK_RV
+NSSCKFWMutex_Unlock(
+    NSSCKFWMutex *mutex);
+
+#endif /* NSSCKFW_H */

security/nss/lib/ckfw/nssckfwc.h

@@ -0,0 +1,879 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef NSSCKFWC_H
+#define NSSCKFWC_H
+
+/*
+ * nssckfwc.h
+ *
+ * This file prototypes all of the NSS Cryptoki Framework "wrapper"
+ * which implement the PKCS#11 API.  Technically, these are public
+ * routines (with capital "NSS" prefixes), since they are called
+ * from (generated) code within a Module using the Framework.
+ * However, they should not be called except from those generated
+ * calls.  Hence, the prototypes have been split out into this file.
+ */
+
+#ifndef NSSCKT_H
+#include "nssckt.h"
+#endif /* NSSCKT_H */
+
+#ifndef NSSCKFWT_H
+#include "nssckfwt.h"
+#endif /* NSSCKFWT_H */
+
+#ifndef NSSCKMDT_H
+#include "nssckmdt.h"
+#endif /* NSSCKMDT_H */
+
+/*
+ * NSSCKFWC_Initialize
+ * NSSCKFWC_Finalize
+ * NSSCKFWC_GetInfo
+ * -- NSSCKFWC_GetFunctionList -- see the API insert file
+ * NSSCKFWC_GetSlotList
+ * NSSCKFWC_GetSlotInfo
+ * NSSCKFWC_GetTokenInfo
+ * NSSCKFWC_WaitForSlotEvent
+ * NSSCKFWC_GetMechanismList
+ * NSSCKFWC_GetMechanismInfo
+ * NSSCKFWC_InitToken
+ * NSSCKFWC_InitPIN
+ * NSSCKFWC_SetPIN
+ * NSSCKFWC_OpenSession
+ * NSSCKFWC_CloseSession
+ * NSSCKFWC_CloseAllSessions
+ * NSSCKFWC_GetSessionInfo
+ * NSSCKFWC_GetOperationState
+ * NSSCKFWC_SetOperationState
+ * NSSCKFWC_Login
+ * NSSCKFWC_Logout
+ * NSSCKFWC_CreateObject
+ * NSSCKFWC_CopyObject
+ * NSSCKFWC_DestroyObject
+ * NSSCKFWC_GetObjectSize
+ * NSSCKFWC_GetAttributeValue
+ * NSSCKFWC_SetAttributeValue
+ * NSSCKFWC_FindObjectsInit
+ * NSSCKFWC_FindObjects
+ * NSSCKFWC_FindObjectsFinal
+ * NSSCKFWC_EncryptInit
+ * NSSCKFWC_Encrypt
+ * NSSCKFWC_EncryptUpdate
+ * NSSCKFWC_EncryptFinal
+ * NSSCKFWC_DecryptInit
+ * NSSCKFWC_Decrypt
+ * NSSCKFWC_DecryptUpdate
+ * NSSCKFWC_DecryptFinal
+ * NSSCKFWC_DigestInit
+ * NSSCKFWC_Digest
+ * NSSCKFWC_DigestUpdate
+ * NSSCKFWC_DigestKey
+ * NSSCKFWC_DigestFinal
+ * NSSCKFWC_SignInit
+ * NSSCKFWC_Sign
+ * NSSCKFWC_SignUpdate
+ * NSSCKFWC_SignFinal
+ * NSSCKFWC_SignRecoverInit
+ * NSSCKFWC_SignRecover
+ * NSSCKFWC_VerifyInit
+ * NSSCKFWC_Verify
+ * NSSCKFWC_VerifyUpdate
+ * NSSCKFWC_VerifyFinal
+ * NSSCKFWC_VerifyRecoverInit
+ * NSSCKFWC_VerifyRecover
+ * NSSCKFWC_DigestEncryptUpdate
+ * NSSCKFWC_DecryptDigestUpdate
+ * NSSCKFWC_SignEncryptUpdate
+ * NSSCKFWC_DecryptVerifyUpdate
+ * NSSCKFWC_GenerateKey
+ * NSSCKFWC_GenerateKeyPair
+ * NSSCKFWC_WrapKey
+ * NSSCKFWC_UnwrapKey
+ * NSSCKFWC_DeriveKey
+ * NSSCKFWC_SeedRandom
+ * NSSCKFWC_GenerateRandom
+ * NSSCKFWC_GetFunctionStatus
+ * NSSCKFWC_CancelFunction
+ */
+
+/*
+ * NSSCKFWC_Initialize
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_Initialize(
+    NSSCKFWInstance **pFwInstance,
+    NSSCKMDInstance *mdInstance,
+    CK_VOID_PTR pInitArgs);
+
+/*
+ * NSSCKFWC_Finalize
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_Finalize(
+    NSSCKFWInstance **pFwInstance);
+
+/*
+ * NSSCKFWC_GetInfo
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_GetInfo(
+    NSSCKFWInstance *fwInstance,
+    CK_INFO_PTR pInfo);
+
+/*
+ * C_GetFunctionList is implemented entirely in the Module's file which
+ * includes the Framework API insert file.  It requires no "actual"
+ * NSSCKFW routine.
+ */
+
+/*
+ * NSSCKFWC_GetSlotList
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_GetSlotList(
+    NSSCKFWInstance *fwInstance,
+    CK_BBOOL tokenPresent,
+    CK_SLOT_ID_PTR pSlotList,
+    CK_ULONG_PTR pulCount);
+
+/*
+ * NSSCKFWC_GetSlotInfo
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_GetSlotInfo(
+    NSSCKFWInstance *fwInstance,
+    CK_SLOT_ID slotID,
+    CK_SLOT_INFO_PTR pInfo);
+
+/*
+ * NSSCKFWC_GetTokenInfo
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_GetTokenInfo(
+    NSSCKFWInstance *fwInstance,
+    CK_SLOT_ID slotID,
+    CK_TOKEN_INFO_PTR pInfo);
+
+/*
+ * NSSCKFWC_WaitForSlotEvent
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_WaitForSlotEvent(
+    NSSCKFWInstance *fwInstance,
+    CK_FLAGS flags,
+    CK_SLOT_ID_PTR pSlot,
+    CK_VOID_PTR pReserved);
+
+/*
+ * NSSCKFWC_GetMechanismList
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_GetMechanismList(
+    NSSCKFWInstance *fwInstance,
+    CK_SLOT_ID slotID,
+    CK_MECHANISM_TYPE_PTR pMechanismList,
+    CK_ULONG_PTR pulCount);
+
+/*
+ * NSSCKFWC_GetMechanismInfo
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_GetMechanismInfo(
+    NSSCKFWInstance *fwInstance,
+    CK_SLOT_ID slotID,
+    CK_MECHANISM_TYPE type,
+    CK_MECHANISM_INFO_PTR pInfo);
+
+/*
+ * NSSCKFWC_InitToken
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_InitToken(
+    NSSCKFWInstance *fwInstance,
+    CK_SLOT_ID slotID,
+    CK_CHAR_PTR pPin,
+    CK_ULONG ulPinLen,
+    CK_CHAR_PTR pLabel);
+
+/*
+ * NSSCKFWC_InitPIN
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_InitPIN(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_CHAR_PTR pPin,
+    CK_ULONG ulPinLen);
+
+/*
+ * NSSCKFWC_SetPIN
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_SetPIN(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_CHAR_PTR pOldPin,
+    CK_ULONG ulOldLen,
+    CK_CHAR_PTR pNewPin,
+    CK_ULONG ulNewLen);
+
+/*
+ * NSSCKFWC_OpenSession
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_OpenSession(
+    NSSCKFWInstance *fwInstance,
+    CK_SLOT_ID slotID,
+    CK_FLAGS flags,
+    CK_VOID_PTR pApplication,
+    CK_NOTIFY Notify,
+    CK_SESSION_HANDLE_PTR phSession);
+
+/*
+ * NSSCKFWC_CloseSession
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_CloseSession(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession);
+
+/*
+ * NSSCKFWC_CloseAllSessions
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_CloseAllSessions(
+    NSSCKFWInstance *fwInstance,
+    CK_SLOT_ID slotID);
+
+/*
+ * NSSCKFWC_GetSessionInfo
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_GetSessionInfo(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_SESSION_INFO_PTR pInfo);
+
+/*
+ * NSSCKFWC_GetOperationState
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_GetOperationState(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pOperationState,
+    CK_ULONG_PTR pulOperationStateLen);
+
+/*
+ * NSSCKFWC_SetOperationState
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_SetOperationState(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pOperationState,
+    CK_ULONG ulOperationStateLen,
+    CK_OBJECT_HANDLE hEncryptionKey,
+    CK_OBJECT_HANDLE hAuthenticationKey);
+
+/*
+ * NSSCKFWC_Login
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_Login(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_USER_TYPE userType,
+    CK_CHAR_PTR pPin,
+    CK_ULONG ulPinLen);
+
+/*
+ * NSSCKFWC_Logout
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_Logout(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession);
+
+/*
+ * NSSCKFWC_CreateObject
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_CreateObject(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulCount,
+    CK_OBJECT_HANDLE_PTR phObject);
+
+/*
+ * NSSCKFWC_CopyObject
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_CopyObject(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_OBJECT_HANDLE hObject,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulCount,
+    CK_OBJECT_HANDLE_PTR phNewObject);
+
+/*
+ * NSSCKFWC_DestroyObject
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_DestroyObject(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_OBJECT_HANDLE hObject);
+
+/*
+ * NSSCKFWC_GetObjectSize
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_GetObjectSize(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_OBJECT_HANDLE hObject,
+    CK_ULONG_PTR pulSize);
+
+/*
+ * NSSCKFWC_GetAttributeValue
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_GetAttributeValue(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_OBJECT_HANDLE hObject,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulCount);
+
+/*
+ * NSSCKFWC_SetAttributeValue
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_SetAttributeValue(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_OBJECT_HANDLE hObject,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulCount);
+
+/*
+ * NSSCKFWC_FindObjectsInit
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_FindObjectsInit(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulCount);
+
+/*
+ * NSSCKFWC_FindObjects
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_FindObjects(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_OBJECT_HANDLE_PTR phObject,
+    CK_ULONG ulMaxObjectCount,
+    CK_ULONG_PTR pulObjectCount);
+
+/*
+ * NSSCKFWC_FindObjectsFinal
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_FindObjectsFinal(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession);
+
+/*
+ * NSSCKFWC_EncryptInit
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_EncryptInit(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_MECHANISM_PTR pMechanism,
+    CK_OBJECT_HANDLE hKey);
+
+/*
+ * NSSCKFWC_Encrypt
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_Encrypt(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pData,
+    CK_ULONG ulDataLen,
+    CK_BYTE_PTR pEncryptedData,
+    CK_ULONG_PTR pulEncryptedDataLen);
+
+/*
+ * NSSCKFWC_EncryptUpdate
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_EncryptUpdate(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pPart,
+    CK_ULONG ulPartLen,
+    CK_BYTE_PTR pEncryptedPart,
+    CK_ULONG_PTR pulEncryptedPartLen);
+
+/*
+ * NSSCKFWC_EncryptFinal
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_EncryptFinal(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pLastEncryptedPart,
+    CK_ULONG_PTR pulLastEncryptedPartLen);
+
+/*
+ * NSSCKFWC_DecryptInit
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_DecryptInit(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_MECHANISM_PTR pMechanism,
+    CK_OBJECT_HANDLE hKey);
+
+/*
+ * NSSCKFWC_Decrypt
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_Decrypt(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pEncryptedData,
+    CK_ULONG ulEncryptedDataLen,
+    CK_BYTE_PTR pData,
+    CK_ULONG_PTR pulDataLen);
+
+/*
+ * NSSCKFWC_DecryptUpdate
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_DecryptUpdate(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pEncryptedPart,
+    CK_ULONG ulEncryptedPartLen,
+    CK_BYTE_PTR pPart,
+    CK_ULONG_PTR pulPartLen);
+
+/*
+ * NSSCKFWC_DecryptFinal
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_DecryptFinal(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pLastPart,
+    CK_ULONG_PTR pulLastPartLen);
+
+/*
+ * NSSCKFWC_DigestInit
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_DigestInit(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_MECHANISM_PTR pMechanism);
+
+/*
+ * NSSCKFWC_Digest
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_Digest(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pData,
+    CK_ULONG ulDataLen,
+    CK_BYTE_PTR pDigest,
+    CK_ULONG_PTR pulDigestLen);
+
+/*
+ * NSSCKFWC_DigestUpdate
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_DigestUpdate(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pData,
+    CK_ULONG ulDataLen);
+
+/*
+ * NSSCKFWC_DigestKey
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_DigestKey(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_OBJECT_HANDLE hKey);
+
+/*
+ * NSSCKFWC_DigestFinal
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_DigestFinal(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pDigest,
+    CK_ULONG_PTR pulDigestLen);
+
+/*
+ * NSSCKFWC_SignInit
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_SignInit(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_MECHANISM_PTR pMechanism,
+    CK_OBJECT_HANDLE hKey);
+
+/*
+ * NSSCKFWC_Sign
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_Sign(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pData,
+    CK_ULONG ulDataLen,
+    CK_BYTE_PTR pSignature,
+    CK_ULONG_PTR pulSignatureLen);
+
+/*
+ * NSSCKFWC_SignUpdate
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_SignUpdate(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pPart,
+    CK_ULONG ulPartLen);
+
+/*
+ * NSSCKFWC_SignFinal
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_SignFinal(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pSignature,
+    CK_ULONG_PTR pulSignatureLen);
+
+/*
+ * NSSCKFWC_SignRecoverInit
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_SignRecoverInit(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_MECHANISM_PTR pMechanism,
+    CK_OBJECT_HANDLE hKey);
+
+/*
+ * NSSCKFWC_SignRecover
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_SignRecover(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pData,
+    CK_ULONG ulDataLen,
+    CK_BYTE_PTR pSignature,
+    CK_ULONG_PTR pulSignatureLen);
+
+/*
+ * NSSCKFWC_VerifyInit
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_VerifyInit(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_MECHANISM_PTR pMechanism,
+    CK_OBJECT_HANDLE hKey);
+
+/*
+ * NSSCKFWC_Verify
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_Verify(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pData,
+    CK_ULONG ulDataLen,
+    CK_BYTE_PTR pSignature,
+    CK_ULONG ulSignatureLen);
+
+/*
+ * NSSCKFWC_VerifyUpdate
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_VerifyUpdate(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pPart,
+    CK_ULONG ulPartLen);
+
+/*
+ * NSSCKFWC_VerifyFinal
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_VerifyFinal(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pSignature,
+    CK_ULONG ulSignatureLen);
+
+/*
+ * NSSCKFWC_VerifyRecoverInit
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_VerifyRecoverInit(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_MECHANISM_PTR pMechanism,
+    CK_OBJECT_HANDLE hKey);
+
+/*
+ * NSSCKFWC_VerifyRecover
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_VerifyRecover(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pSignature,
+    CK_ULONG ulSignatureLen,
+    CK_BYTE_PTR pData,
+    CK_ULONG_PTR pulDataLen);
+
+/*
+ * NSSCKFWC_DigestEncryptUpdate
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_DigestEncryptUpdate(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pPart,
+    CK_ULONG ulPartLen,
+    CK_BYTE_PTR pEncryptedPart,
+    CK_ULONG_PTR pulEncryptedPartLen);
+
+/*
+ * NSSCKFWC_DecryptDigestUpdate
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_DecryptDigestUpdate(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pEncryptedPart,
+    CK_ULONG ulEncryptedPartLen,
+    CK_BYTE_PTR pPart,
+    CK_ULONG_PTR pulPartLen);
+
+/*
+ * NSSCKFWC_SignEncryptUpdate
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_SignEncryptUpdate(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pPart,
+    CK_ULONG ulPartLen,
+    CK_BYTE_PTR pEncryptedPart,
+    CK_ULONG_PTR pulEncryptedPartLen);
+
+/*
+ * NSSCKFWC_DecryptVerifyUpdate
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_DecryptVerifyUpdate(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pEncryptedPart,
+    CK_ULONG ulEncryptedPartLen,
+    CK_BYTE_PTR pPart,
+    CK_ULONG_PTR pulPartLen);
+
+/*
+ * NSSCKFWC_GenerateKey
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_GenerateKey(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_MECHANISM_PTR pMechanism,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulCount,
+    CK_OBJECT_HANDLE_PTR phKey);
+
+/*
+ * NSSCKFWC_GenerateKeyPair
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_GenerateKeyPair(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_MECHANISM_PTR pMechanism,
+    CK_ATTRIBUTE_PTR pPublicKeyTemplate,
+    CK_ULONG ulPublicKeyAttributeCount,
+    CK_ATTRIBUTE_PTR pPrivateKeyTemplate,
+    CK_ULONG ulPrivateKeyAttributeCount,
+    CK_OBJECT_HANDLE_PTR phPublicKey,
+    CK_OBJECT_HANDLE_PTR phPrivateKey);
+
+/*
+ * NSSCKFWC_WrapKey
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_WrapKey(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_MECHANISM_PTR pMechanism,
+    CK_OBJECT_HANDLE hWrappingKey,
+    CK_OBJECT_HANDLE hKey,
+    CK_BYTE_PTR pWrappedKey,
+    CK_ULONG_PTR pulWrappedKeyLen);
+
+/*
+ * NSSCKFWC_UnwrapKey
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_UnwrapKey(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_MECHANISM_PTR pMechanism,
+    CK_OBJECT_HANDLE hUnwrappingKey,
+    CK_BYTE_PTR pWrappedKey,
+    CK_ULONG ulWrappedKeyLen,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    CK_OBJECT_HANDLE_PTR phKey);
+
+/*
+ * NSSCKFWC_DeriveKey
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_DeriveKey(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_MECHANISM_PTR pMechanism,
+    CK_OBJECT_HANDLE hBaseKey,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    CK_OBJECT_HANDLE_PTR phKey);
+
+/*
+ * NSSCKFWC_SeedRandom
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_SeedRandom(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pSeed,
+    CK_ULONG ulSeedLen);
+
+/*
+ * NSSCKFWC_GenerateRandom
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_GenerateRandom(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession,
+    CK_BYTE_PTR pRandomData,
+    CK_ULONG ulRandomLen);
+
+/*
+ * NSSCKFWC_GetFunctionStatus
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_GetFunctionStatus(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession);
+
+/*
+ * NSSCKFWC_CancelFunction
+ *
+ */
+NSS_EXTERN CK_RV
+NSSCKFWC_CancelFunction(
+    NSSCKFWInstance *fwInstance,
+    CK_SESSION_HANDLE hSession);
+
+#endif /* NSSCKFWC_H */

security/nss/lib/ckfw/nssckfwt.h

@@ -0,0 +1,109 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef NSSCKFWT_H
+#define NSSCKFWT_H
+
+/*
+ * nssckfwt.h
+ *
+ * This file declares the public types used by the NSS Cryptoki Framework.
+ */
+
+/*
+ * NSSCKFWInstance
+ *
+ */
+
+struct NSSCKFWInstanceStr;
+typedef struct NSSCKFWInstanceStr NSSCKFWInstance;
+
+/*
+ * NSSCKFWSlot
+ *
+ */
+
+struct NSSCKFWSlotStr;
+typedef struct NSSCKFWSlotStr NSSCKFWSlot;
+
+/*
+ * NSSCKFWToken
+ *
+ */
+
+struct NSSCKFWTokenStr;
+typedef struct NSSCKFWTokenStr NSSCKFWToken;
+
+/*
+ * NSSCKFWMechanism
+ *
+ */
+
+struct NSSCKFWMechanismStr;
+typedef struct NSSCKFWMechanismStr NSSCKFWMechanism;
+
+/*
+ * NSSCKFWCryptoOperation
+ *
+ */
+
+struct NSSCKFWCryptoOperationStr;
+typedef struct NSSCKFWCryptoOperationStr NSSCKFWCryptoOperation;
+
+/*
+ * NSSCKFWSession
+ *
+ */
+
+struct NSSCKFWSessionStr;
+typedef struct NSSCKFWSessionStr NSSCKFWSession;
+
+/*
+ * NSSCKFWObject
+ *
+ */
+
+struct NSSCKFWObjectStr;
+typedef struct NSSCKFWObjectStr NSSCKFWObject;
+
+/*
+ * NSSCKFWFindObjects
+ *
+ */
+
+struct NSSCKFWFindObjectsStr;
+typedef struct NSSCKFWFindObjectsStr NSSCKFWFindObjects;
+
+/*
+ * NSSCKFWMutex
+ *
+ */
+
+struct NSSCKFWMutexStr;
+typedef struct NSSCKFWMutexStr NSSCKFWMutex;
+
+typedef enum {
+    SingleThreaded,
+    MultiThreaded
+} CryptokiLockingState;
+
+/* used as an index into an array, make sure it starts at '0' */
+typedef enum {
+    NSSCKFWCryptoOperationState_EncryptDecrypt = 0,
+    NSSCKFWCryptoOperationState_SignVerify,
+    NSSCKFWCryptoOperationState_Digest,
+    NSSCKFWCryptoOperationState_Max
+} NSSCKFWCryptoOperationState;
+
+typedef enum {
+    NSSCKFWCryptoOperationType_Encrypt,
+    NSSCKFWCryptoOperationType_Decrypt,
+    NSSCKFWCryptoOperationType_Digest,
+    NSSCKFWCryptoOperationType_Sign,
+    NSSCKFWCryptoOperationType_Verify,
+    NSSCKFWCryptoOperationType_SignRecover,
+    NSSCKFWCryptoOperationType_VerifyRecover
+} NSSCKFWCryptoOperationType;
+
+#endif /* NSSCKFWT_H */

security/nss/lib/ckfw/nssckg.h

@@ -0,0 +1,10 @@
+/* THIS IS A GENERATED FILE */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef NSSCKG_H
+#define NSSCKG_H
+
+#include "pkcs11.h"
+
+#endif /* NSSCKG_H */

security/nss/lib/ckfw/nssckt.h

@@ -0,0 +1,12 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+#ifndef _NSSCKT_H_
+#define _NSSCKT_H_ 1
+
+#include "pkcs11t.h"
+
+typedef CK_ATTRIBUTE_TYPE CK_PTR CK_ATTRIBUTE_TYPE_PTR;
+#define CK_ENTRY
+
+#endif /* _NSSCKT_H_ */

security/nss/lib/ckfw/nssmkey/Makefile

@@ -0,0 +1,72 @@
+# 
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+include manifest.mn
+include $(CORE_DEPTH)/coreconf/config.mk
+include config.mk
+
+EXTRA_LIBS = \
+	$(DIST)/lib/$(LIB_PREFIX)nssckfw.$(LIB_SUFFIX) \
+	$(DIST)/lib/$(LIB_PREFIX)secutil.$(LIB_SUFFIX) \
+	$(DIST)/lib/$(LIB_PREFIX)nssb.$(LIB_SUFFIX) \
+	$(NULL)
+
+# can't do this in manifest.mn because OS_TARGET isn't defined there.
+ifeq (,$(filter-out WIN%,$(OS_TARGET)))
+
+ifdef NS_USE_GCC
+EXTRA_LIBS += \
+	-L$(NSPR_LIB_DIR) \
+	-lplc4 \
+	-lplds4 \
+	-lnspr4 \
+	$(NULL)
+else 
+EXTRA_SHARED_LIBS += \
+        $(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plc4.lib \
+        $(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)plds4.lib \
+        $(NSPR_LIB_DIR)/$(NSPR31_LIB_PREFIX)nspr4.lib \
+        $(NULL)
+endif # NS_USE_GCC
+else
+
+EXTRA_LIBS += \
+	-L$(NSPR_LIB_DIR) \
+	-lplc4 \
+	-lplds4 \
+	-lnspr4 \
+	-framework Security \
+	-framework CoreServices \
+	$(NULL)
+endif
+
+
+include $(CORE_DEPTH)/coreconf/rules.mk
+
+# Generate certdata.c.
+generate:
+	perl certdata.perl < certdata.txt
+
+# This'll need some help from a build person.
+
+
+ifeq ($(OS_TARGET)$(OS_RELEASE), AIX4.1)
+DSO_LDOPTS              = -bM:SRE -bh:4 -bnoentry
+EXTRA_DSO_LDOPTS        = -lc
+MKSHLIB                 = xlC $(DSO_LDOPTS)
+
+$(SHARED_LIBRARY): $(OBJS)
+	@$(MAKE_OBJDIR)
+	rm -f $@
+	$(MKSHLIB) -o $@ $(OBJS) $(EXTRA_LIBS) $(EXTRA_DSO_LDOPTS)
+	chmod +x $@
+
+endif
+
+ifeq ($(OS_TARGET)$(OS_RELEASE), AIX4.2)
+LD      += -G
+endif 
+
+

security/nss/lib/ckfw/nssmkey/README

@@ -0,0 +1,21 @@
+This Cryptoki module provides acces to certs and keys stored in
+Macintosh key Ring.
+
+- It does not yet export PKCS #12 keys. To get this to work should be 
+  implemented using exporting the key object in PKCS #8 wrapped format.
+  PSM work needs to happen before this can be completed.
+- It does not import or export CA Root trust from the mac keychain.
+- It does not handle S/MIME objects (pkcs #7 in mac keychain terms?).
+- The AuthRoots don't show up on the default list.
+- Only RSA keys are supported currently.
+
+There are a number of things that have not been tested that other PKCS #11
+apps may need:
+- reading Modulus and Public Exponents from private keys and public keys.
+- storing public keys.
+- setting attributes other than CKA_ID and CKA_LABEL.
+
+Other TODOs:
+- Check for and plug memory leaks.
+- Need to map mac errors into something more intellegible than 
+  CKR_GENERAL_ERROR.

security/nss/lib/ckfw/nssmkey/ckmk.h

@@ -0,0 +1,182 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef CKMK_H
+#define CKMK_H 1
+
+#include <Security/SecKeychainSearch.h>
+#include <Security/SecKeychainItem.h>
+#include <Security/SecKeychain.h>
+#include <Security/cssmtype.h>
+#include <Security/cssmapi.h>
+#include <Security/SecKey.h>
+#include <Security/SecCertificate.h>
+
+#define NTO
+
+#include "nssckmdt.h"
+#include "nssckfw.h"
+/*
+ * I'm including this for access to the arena functions.
+ * Looks like we should publish that API.
+ */
+#ifndef BASE_H
+#include "base.h"
+#endif /* BASE_H */
+/*
+ * This is where the Netscape extensions live, at least for now.
+ */
+#ifndef CKT_H
+#include "ckt.h"
+#endif /* CKT_H */
+
+/*
+ * statically defined raw objects. Allows us to data description objects
+ * to this PKCS #11 module.
+ */
+struct ckmkRawObjectStr {
+    CK_ULONG n;
+    const CK_ATTRIBUTE_TYPE *types;
+    const NSSItem *items;
+};
+typedef struct ckmkRawObjectStr ckmkRawObject;
+
+/*
+ * Key/Cert Items
+ */
+struct ckmkItemObjectStr {
+    SecKeychainItemRef itemRef;
+    SecItemClass itemClass;
+    PRBool hasID;
+    NSSItem modify;
+    NSSItem private;
+    NSSItem encrypt;
+    NSSItem decrypt;
+    NSSItem derive;
+    NSSItem sign;
+    NSSItem signRecover;
+    NSSItem verify;
+    NSSItem verifyRecover;
+    NSSItem wrap;
+    NSSItem unwrap;
+    NSSItem label;
+    NSSItem subject;
+    NSSItem issuer;
+    NSSItem serial;
+    NSSItem derCert;
+    NSSItem id;
+    NSSItem modulus;
+    NSSItem exponent;
+    NSSItem privateExponent;
+    NSSItem prime1;
+    NSSItem prime2;
+    NSSItem exponent1;
+    NSSItem exponent2;
+    NSSItem coefficient;
+};
+typedef struct ckmkItemObjectStr ckmkItemObject;
+
+typedef enum {
+    ckmkRaw,
+    ckmkItem,
+} ckmkObjectType;
+
+/*
+ * all the various types of objects are abstracted away in cobject and
+ * cfind as ckmkInternalObjects.
+ */
+struct ckmkInternalObjectStr {
+    ckmkObjectType type;
+    union {
+        ckmkRawObject raw;
+        ckmkItemObject item;
+    } u;
+    CK_OBJECT_CLASS objClass;
+    NSSItem hashKey;
+    unsigned char hashKeyData[128];
+    NSSCKMDObject mdObject;
+};
+typedef struct ckmkInternalObjectStr ckmkInternalObject;
+
+/* our raw object data array */
+NSS_EXTERN_DATA ckmkInternalObject nss_ckmk_data[];
+NSS_EXTERN_DATA const PRUint32 nss_ckmk_nObjects;
+
+NSS_EXTERN_DATA const CK_VERSION nss_ckmk_CryptokiVersion;
+NSS_EXTERN_DATA const NSSUTF8 *nss_ckmk_ManufacturerID;
+NSS_EXTERN_DATA const NSSUTF8 *nss_ckmk_LibraryDescription;
+NSS_EXTERN_DATA const CK_VERSION nss_ckmk_LibraryVersion;
+NSS_EXTERN_DATA const NSSUTF8 *nss_ckmk_SlotDescription;
+NSS_EXTERN_DATA const CK_VERSION nss_ckmk_HardwareVersion;
+NSS_EXTERN_DATA const CK_VERSION nss_ckmk_FirmwareVersion;
+NSS_EXTERN_DATA const NSSUTF8 *nss_ckmk_TokenLabel;
+NSS_EXTERN_DATA const NSSUTF8 *nss_ckmk_TokenModel;
+NSS_EXTERN_DATA const NSSUTF8 *nss_ckmk_TokenSerialNumber;
+
+NSS_EXTERN_DATA const NSSCKMDInstance nss_ckmk_mdInstance;
+NSS_EXTERN_DATA const NSSCKMDSlot nss_ckmk_mdSlot;
+NSS_EXTERN_DATA const NSSCKMDToken nss_ckmk_mdToken;
+NSS_EXTERN_DATA const NSSCKMDMechanism nss_ckmk_mdMechanismRSA;
+
+NSS_EXTERN NSSCKMDSession *
+nss_ckmk_CreateSession(
+    NSSCKFWSession *fwSession,
+    CK_RV *pError);
+
+NSS_EXTERN NSSCKMDFindObjects *
+nss_ckmk_FindObjectsInit(
+    NSSCKFWSession *fwSession,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    CK_RV *pError);
+
+/*
+ * Object Utilities
+ */
+NSS_EXTERN NSSCKMDObject *
+nss_ckmk_CreateMDObject(
+    NSSArena *arena,
+    ckmkInternalObject *io,
+    CK_RV *pError);
+
+NSS_EXTERN NSSCKMDObject *
+nss_ckmk_CreateObject(
+    NSSCKFWSession *fwSession,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    CK_RV *pError);
+
+NSS_EXTERN const NSSItem *
+nss_ckmk_FetchAttribute(
+    ckmkInternalObject *io,
+    CK_ATTRIBUTE_TYPE type,
+    CK_RV *pError);
+
+NSS_EXTERN void
+nss_ckmk_DestroyInternalObject(
+    ckmkInternalObject *io);
+
+unsigned char *
+nss_ckmk_DERUnwrap(
+    unsigned char *src,
+    int size,
+    int *outSize,
+    unsigned char **next);
+
+CK_ULONG
+nss_ckmk_GetULongAttribute(
+    CK_ATTRIBUTE_TYPE type,
+    CK_ATTRIBUTE *template,
+    CK_ULONG templateSize,
+    CK_RV *pError);
+
+#define NSS_CKMK_ARRAY_SIZE(x) ((sizeof(x)) / (sizeof((x)[0])))
+
+#ifdef DEBUG
+#define CKMK_MACERR(str, err) cssmPerror(str, err)
+#else
+#define CKMK_MACERR(str, err)
+#endif
+
+#endif

security/nss/lib/ckfw/nssmkey/ckmkver.c

@@ -0,0 +1,17 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+/* Library identity and versioning */
+
+#include "nssmkey.h"
+
+#if defined(DEBUG)
+#define _DEBUG_STRING " (debug)"
+#else
+#define _DEBUG_STRING ""
+#endif
+
+/*
+ * Version information
+ */
+const char __nss_ckmk_version[] = "Version: NSS Access to the MAC OS X Key Ring " NSS_CKMK_LIBRARY_VERSION _DEBUG_STRING;

security/nss/lib/ckfw/nssmkey/config.mk

@@ -0,0 +1,24 @@
+# 
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+ifdef BUILD_IDG
+DEFINES += -DNSSDEBUG
+endif
+
+ifdef NS_USE_CKFW_TRACE
+DEFINES += -DTRACE
+endif
+
+#
+#  Override TARGETS variable so that only static libraries
+#  are specifed as dependencies within rules.mk.
+#
+
+TARGETS        = $(LIBRARY)
+SHARED_LIBRARY =
+IMPORT_LIBRARY =
+PROGRAM        =
+
+

security/nss/lib/ckfw/nssmkey/manchor.c

@@ -0,0 +1,17 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * nssmkey/manchor.c
+ *
+ * This file "anchors" the actual cryptoki entry points in this module's
+ * shared library, which is required for dynamic loading.  See the
+ * comments in nssck.api for more information.
+ */
+
+#include "ckmk.h"
+
+#define MODULE_NAME ckmk
+#define INSTANCE_NAME (NSSCKMDInstance *)&nss_ckmk_mdInstance
+#include "nssck.api"

security/nss/lib/ckfw/nssmkey/manifest.mn

@@ -0,0 +1,33 @@
+# 
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+CORE_DEPTH = ../../../..
+
+MODULE = nss
+MAPFILE = $(OBJDIR)/nssmkey.def
+
+EXPORTS =		\
+	nssmkey.h	\
+	$(NULL)
+
+CSRCS =			\
+	manchor.c	\
+	mconstants.c	\
+	mfind.c		\
+	minst.c 	\
+	mobject.c	\
+	mrsa.c		\
+	msession.c	\
+	mslot.c		\
+	mtoken.c	\
+	ckmkver.c	\
+	staticobj.c	\
+	$(NULL)
+
+REQUIRES = nspr
+
+LIBRARY_NAME = nssmkey
+
+#EXTRA_SHARED_LIBS = -L$(DIST)/lib -lnssckfw -lnssb -lplc4 -lplds4

security/nss/lib/ckfw/nssmkey/mconstants.c

@@ -0,0 +1,61 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * nssmkey/constants.c
+ *
+ * Identification and other constants, all collected here in one place.
+ */
+
+#ifndef NSSBASET_H
+#include "nssbaset.h"
+#endif /* NSSBASET_H */
+
+#ifndef NSSCKT_H
+#include "nssckt.h"
+#endif /* NSSCKT_H */
+
+#include "nssmkey.h"
+
+NSS_IMPLEMENT_DATA const CK_VERSION
+    nss_ckmk_CryptokiVersion = {
+        NSS_CKMK_CRYPTOKI_VERSION_MAJOR,
+        NSS_CKMK_CRYPTOKI_VERSION_MINOR
+    };
+
+NSS_IMPLEMENT_DATA const NSSUTF8 *
+    nss_ckmk_ManufacturerID = (NSSUTF8 *)"Mozilla Foundation";
+
+NSS_IMPLEMENT_DATA const NSSUTF8 *
+    nss_ckmk_LibraryDescription = (NSSUTF8 *)"NSS Access to Mac OS X Key Ring";
+
+NSS_IMPLEMENT_DATA const CK_VERSION
+    nss_ckmk_LibraryVersion = {
+        NSS_CKMK_LIBRARY_VERSION_MAJOR,
+        NSS_CKMK_LIBRARY_VERSION_MINOR
+    };
+
+NSS_IMPLEMENT_DATA const NSSUTF8 *
+    nss_ckmk_SlotDescription = (NSSUTF8 *)"Mac OS X Key Ring";
+
+NSS_IMPLEMENT_DATA const CK_VERSION
+    nss_ckmk_HardwareVersion = {
+        NSS_CKMK_HARDWARE_VERSION_MAJOR,
+        NSS_CKMK_HARDWARE_VERSION_MINOR
+    };
+
+NSS_IMPLEMENT_DATA const CK_VERSION
+    nss_ckmk_FirmwareVersion = {
+        NSS_CKMK_FIRMWARE_VERSION_MAJOR,
+        NSS_CKMK_FIRMWARE_VERSION_MINOR
+    };
+
+NSS_IMPLEMENT_DATA const NSSUTF8 *
+    nss_ckmk_TokenLabel = (NSSUTF8 *)"Mac OS X Key Ring";
+
+NSS_IMPLEMENT_DATA const NSSUTF8 *
+    nss_ckmk_TokenModel = (NSSUTF8 *)"1";
+
+NSS_IMPLEMENT_DATA const NSSUTF8 *
+    nss_ckmk_TokenSerialNumber = (NSSUTF8 *)"1";

security/nss/lib/ckfw/nssmkey/mfind.c

@@ -0,0 +1,352 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef CKMK_H
+#include "ckmk.h"
+#endif /* CKMK_H */
+
+/*
+ * nssmkey/mfind.c
+ *
+ * This file implements the NSSCKMDFindObjects object for the
+ * "nssmkey" cryptoki module.
+ */
+
+struct ckmkFOStr {
+    NSSArena *arena;
+    CK_ULONG n;
+    CK_ULONG i;
+    ckmkInternalObject **objs;
+};
+
+static void
+ckmk_mdFindObjects_Final(
+    NSSCKMDFindObjects *mdFindObjects,
+    NSSCKFWFindObjects *fwFindObjects,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    struct ckmkFOStr *fo = (struct ckmkFOStr *)mdFindObjects->etc;
+    NSSArena *arena = fo->arena;
+    PRUint32 i;
+
+    /* walk down an free the unused 'objs' */
+    for (i = fo->i; i < fo->n; i++) {
+        nss_ckmk_DestroyInternalObject(fo->objs[i]);
+    }
+
+    nss_ZFreeIf(fo->objs);
+    nss_ZFreeIf(fo);
+    nss_ZFreeIf(mdFindObjects);
+    if ((NSSArena *)NULL != arena) {
+        NSSArena_Destroy(arena);
+    }
+
+    return;
+}
+
+static NSSCKMDObject *
+ckmk_mdFindObjects_Next(
+    NSSCKMDFindObjects *mdFindObjects,
+    NSSCKFWFindObjects *fwFindObjects,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    NSSArena *arena,
+    CK_RV *pError)
+{
+    struct ckmkFOStr *fo = (struct ckmkFOStr *)mdFindObjects->etc;
+    ckmkInternalObject *io;
+
+    if (fo->i == fo->n) {
+        *pError = CKR_OK;
+        return (NSSCKMDObject *)NULL;
+    }
+
+    io = fo->objs[fo->i];
+    fo->i++;
+
+    return nss_ckmk_CreateMDObject(arena, io, pError);
+}
+
+static CK_BBOOL
+ckmk_attrmatch(
+    CK_ATTRIBUTE_PTR a,
+    ckmkInternalObject *o)
+{
+    PRBool prb;
+    const NSSItem *b;
+    CK_RV error;
+
+    b = nss_ckmk_FetchAttribute(o, a->type, &error);
+    if (b == NULL) {
+        return CK_FALSE;
+    }
+
+    if (a->ulValueLen != b->size) {
+        /* match a decoded serial number */
+        if ((a->type == CKA_SERIAL_NUMBER) && (a->ulValueLen < b->size)) {
+            int len;
+            unsigned char *data;
+
+            data = nss_ckmk_DERUnwrap(b->data, b->size, &len, NULL);
+            if ((len == a->ulValueLen) &&
+                nsslibc_memequal(a->pValue, data, len, (PRStatus *)NULL)) {
+                return CK_TRUE;
+            }
+        }
+        return CK_FALSE;
+    }
+
+    prb = nsslibc_memequal(a->pValue, b->data, b->size, (PRStatus *)NULL);
+
+    if (PR_TRUE == prb) {
+        return CK_TRUE;
+    } else {
+        return CK_FALSE;
+    }
+}
+
+static CK_BBOOL
+ckmk_match(
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    ckmkInternalObject *o)
+{
+    CK_ULONG i;
+
+    for (i = 0; i < ulAttributeCount; i++) {
+        if (CK_FALSE == ckmk_attrmatch(&pTemplate[i], o)) {
+            return CK_FALSE;
+        }
+    }
+
+    /* Every attribute passed */
+    return CK_TRUE;
+}
+
+#define CKMK_ITEM_CHUNK 20
+
+#define PUT_OBJECT(obj, err, size, count, list)                             \
+    {                                                                       \
+        if (count >= size) {                                                \
+            (list) = (list) ? nss_ZREALLOCARRAY(list, ckmkInternalObject *, \
+                                                ((size) +                   \
+                                                 CKMK_ITEM_CHUNK))          \
+                            : nss_ZNEWARRAY(NULL, ckmkInternalObject *,     \
+                                            ((size) +                       \
+                                             CKMK_ITEM_CHUNK));             \
+            if ((ckmkInternalObject **)NULL == list) {                      \
+                err = CKR_HOST_MEMORY;                                      \
+                goto loser;                                                 \
+            }                                                               \
+            (size) += CKMK_ITEM_CHUNK;                                      \
+        }                                                                   \
+        (list)[count] = (obj);                                              \
+        count++;                                                            \
+    }
+
+/* find all the certs that represent the appropriate object (cert, priv key, or
+ *  pub key) in the cert store.
+ */
+static PRUint32
+collect_class(
+    CK_OBJECT_CLASS objClass,
+    SecItemClass itemClass,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    ckmkInternalObject ***listp,
+    PRUint32 *sizep,
+    PRUint32 count,
+    CK_RV *pError)
+{
+    ckmkInternalObject *next = NULL;
+    SecKeychainSearchRef searchRef = 0;
+    SecKeychainItemRef itemRef = 0;
+    OSStatus error;
+
+    /* future, build the attribute list based on the template
+     * so we can refine the search */
+    error = SecKeychainSearchCreateFromAttributes(
+        NULL, itemClass, NULL, &searchRef);
+
+    while (noErr == SecKeychainSearchCopyNext(searchRef, &itemRef)) {
+        /* if we don't have an internal object structure, get one */
+        if ((ckmkInternalObject *)NULL == next) {
+            next = nss_ZNEW(NULL, ckmkInternalObject);
+            if ((ckmkInternalObject *)NULL == next) {
+                *pError = CKR_HOST_MEMORY;
+                goto loser;
+            }
+        }
+        /* fill in the relevant object data */
+        next->type = ckmkItem;
+        next->objClass = objClass;
+        next->u.item.itemRef = itemRef;
+        next->u.item.itemClass = itemClass;
+
+        /* see if this is one of the objects we are looking for */
+        if (CK_TRUE == ckmk_match(pTemplate, ulAttributeCount, next)) {
+            /* yes, put it on the list */
+            PUT_OBJECT(next, *pError, *sizep, count, *listp);
+            next = NULL; /* this one is on the list, need to allocate a new one now */
+        } else {
+            /* no , release the current item and clear out the structure for reuse */
+            CFRelease(itemRef);
+            /* don't cache the values we just loaded */
+            nsslibc_memset(next, 0, sizeof(*next));
+        }
+    }
+loser:
+    if (searchRef) {
+        CFRelease(searchRef);
+    }
+    nss_ZFreeIf(next);
+    return count;
+}
+
+static PRUint32
+collect_objects(
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    ckmkInternalObject ***listp,
+    CK_RV *pError)
+{
+    PRUint32 i;
+    PRUint32 count = 0;
+    PRUint32 size = 0;
+    CK_OBJECT_CLASS objClass;
+
+    /*
+     * first handle the static build in objects (if any)
+     */
+    for (i = 0; i < nss_ckmk_nObjects; i++) {
+        ckmkInternalObject *o = (ckmkInternalObject *)&nss_ckmk_data[i];
+
+        if (CK_TRUE == ckmk_match(pTemplate, ulAttributeCount, o)) {
+            PUT_OBJECT(o, *pError, size, count, *listp);
+        }
+    }
+
+    /*
+     * now handle the various object types
+     */
+    objClass = nss_ckmk_GetULongAttribute(CKA_CLASS,
+                                          pTemplate, ulAttributeCount, pError);
+    if (CKR_OK != *pError) {
+        objClass = CK_INVALID_HANDLE;
+    }
+    *pError = CKR_OK;
+    switch (objClass) {
+        case CKO_CERTIFICATE:
+            count = collect_class(objClass, kSecCertificateItemClass,
+                                  pTemplate, ulAttributeCount, listp,
+                                  &size, count, pError);
+            break;
+        case CKO_PUBLIC_KEY:
+            count = collect_class(objClass, CSSM_DL_DB_RECORD_PUBLIC_KEY,
+                                  pTemplate, ulAttributeCount, listp,
+                                  &size, count, pError);
+            break;
+        case CKO_PRIVATE_KEY:
+            count = collect_class(objClass, CSSM_DL_DB_RECORD_PRIVATE_KEY,
+                                  pTemplate, ulAttributeCount, listp,
+                                  &size, count, pError);
+            break;
+        /* all of them */
+        case CK_INVALID_HANDLE:
+            count = collect_class(CKO_CERTIFICATE, kSecCertificateItemClass,
+                                  pTemplate, ulAttributeCount, listp,
+                                  &size, count, pError);
+            count = collect_class(CKO_PUBLIC_KEY, CSSM_DL_DB_RECORD_PUBLIC_KEY,
+                                  pTemplate, ulAttributeCount, listp,
+                                  &size, count, pError);
+            count = collect_class(CKO_PUBLIC_KEY, CSSM_DL_DB_RECORD_PRIVATE_KEY,
+                                  pTemplate, ulAttributeCount, listp,
+                                  &size, count, pError);
+            break;
+        default:
+            break;
+    }
+    if (CKR_OK != *pError) {
+        goto loser;
+    }
+
+    return count;
+loser:
+    nss_ZFreeIf(*listp);
+    return 0;
+}
+
+NSS_IMPLEMENT NSSCKMDFindObjects *
+nss_ckmk_FindObjectsInit(
+    NSSCKFWSession *fwSession,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    CK_RV *pError)
+{
+    /* This could be made more efficient.  I'm rather rushed. */
+    NSSArena *arena;
+    NSSCKMDFindObjects *rv = (NSSCKMDFindObjects *)NULL;
+    struct ckmkFOStr *fo = (struct ckmkFOStr *)NULL;
+    ckmkInternalObject **temp = (ckmkInternalObject **)NULL;
+
+    arena = NSSArena_Create();
+    if ((NSSArena *)NULL == arena) {
+        goto loser;
+    }
+
+    rv = nss_ZNEW(arena, NSSCKMDFindObjects);
+    if ((NSSCKMDFindObjects *)NULL == rv) {
+        *pError = CKR_HOST_MEMORY;
+        goto loser;
+    }
+
+    fo = nss_ZNEW(arena, struct ckmkFOStr);
+    if ((struct ckmkFOStr *)NULL == fo) {
+        *pError = CKR_HOST_MEMORY;
+        goto loser;
+    }
+
+    fo->arena = arena;
+    /* fo->n and fo->i are already zero */
+
+    rv->etc = (void *)fo;
+    rv->Final = ckmk_mdFindObjects_Final;
+    rv->Next = ckmk_mdFindObjects_Next;
+    rv->null = (void *)NULL;
+
+    fo->n = collect_objects(pTemplate, ulAttributeCount, &temp, pError);
+    if (*pError != CKR_OK) {
+        goto loser;
+    }
+
+    fo->objs = nss_ZNEWARRAY(arena, ckmkInternalObject *, fo->n);
+    if ((ckmkInternalObject **)NULL == fo->objs) {
+        *pError = CKR_HOST_MEMORY;
+        goto loser;
+    }
+
+    (void)nsslibc_memcpy(fo->objs, temp, sizeof(ckmkInternalObject *) * fo->n);
+    nss_ZFreeIf(temp);
+    temp = (ckmkInternalObject **)NULL;
+
+    return rv;
+
+loser:
+    nss_ZFreeIf(temp);
+    nss_ZFreeIf(fo);
+    nss_ZFreeIf(rv);
+    if ((NSSArena *)NULL != arena) {
+        NSSArena_Destroy(arena);
+    }
+    return (NSSCKMDFindObjects *)NULL;
+}

security/nss/lib/ckfw/nssmkey/minst.c

@@ -0,0 +1,97 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ckmk.h"
+
+/*
+ * nssmkey/minstance.c
+ *
+ * This file implements the NSSCKMDInstance object for the
+ * "nssmkey" cryptoki module.
+ */
+
+/*
+ * NSSCKMDInstance methods
+ */
+
+static CK_ULONG
+ckmk_mdInstance_GetNSlots(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (CK_ULONG)1;
+}
+
+static CK_VERSION
+ckmk_mdInstance_GetCryptokiVersion(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return nss_ckmk_CryptokiVersion;
+}
+
+static NSSUTF8 *
+ckmk_mdInstance_GetManufacturerID(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_ckmk_ManufacturerID;
+}
+
+static NSSUTF8 *
+ckmk_mdInstance_GetLibraryDescription(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_ckmk_LibraryDescription;
+}
+
+static CK_VERSION
+ckmk_mdInstance_GetLibraryVersion(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return nss_ckmk_LibraryVersion;
+}
+
+static CK_RV
+ckmk_mdInstance_GetSlots(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    NSSCKMDSlot *slots[])
+{
+    slots[0] = (NSSCKMDSlot *)&nss_ckmk_mdSlot;
+    return CKR_OK;
+}
+
+static CK_BBOOL
+ckmk_mdInstance_ModuleHandlesSessionObjects(
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    /* we don't want to allow any session object creation, at least
+     * until we can investigate whether or not we can use those objects
+     */
+    return CK_TRUE;
+}
+
+NSS_IMPLEMENT_DATA const NSSCKMDInstance
+    nss_ckmk_mdInstance = {
+        (void *)NULL, /* etc */
+        NULL,         /* Initialize */
+        NULL,         /* Finalize */
+        ckmk_mdInstance_GetNSlots,
+        ckmk_mdInstance_GetCryptokiVersion,
+        ckmk_mdInstance_GetManufacturerID,
+        ckmk_mdInstance_GetLibraryDescription,
+        ckmk_mdInstance_GetLibraryVersion,
+        ckmk_mdInstance_ModuleHandlesSessionObjects,
+        /*NULL, /* HandleSessionObjects */
+        ckmk_mdInstance_GetSlots,
+        NULL,        /* WaitForSlotEvent */
+        (void *)NULL /* null terminator */
+    };

security/nss/lib/ckfw/nssmkey/mrsa.c

@@ -0,0 +1,479 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ckmk.h"
+
+/* Sigh, For all the talk about 'ease of use', apple has hidden the interfaces
+ * needed to be able to truly use CSSM. These came from their modification
+ * to NSS's S/MIME code. The following two functions currently are not
+ * part of the SecKey.h interface.
+ */
+OSStatus
+SecKeyGetCredentials(
+    SecKeyRef keyRef,
+    CSSM_ACL_AUTHORIZATION_TAG authTag,
+    int type,
+    const CSSM_ACCESS_CREDENTIALS **creds);
+
+/* this function could be implemented using 'SecKeychainItemCopyKeychain' and
+ * 'SecKeychainGetCSPHandle' */
+OSStatus
+SecKeyGetCSPHandle(
+    SecKeyRef keyRef,
+    CSSM_CSP_HANDLE *cspHandle);
+
+typedef struct ckmkInternalCryptoOperationRSAPrivStr
+    ckmkInternalCryptoOperationRSAPriv;
+struct ckmkInternalCryptoOperationRSAPrivStr {
+    NSSCKMDCryptoOperation mdOperation;
+    NSSCKMDMechanism *mdMechanism;
+    ckmkInternalObject *iKey;
+    NSSItem *buffer;
+    CSSM_CC_HANDLE cssmContext;
+};
+
+typedef enum {
+    CKMK_DECRYPT,
+    CKMK_SIGN
+} ckmkRSAOpType;
+
+/*
+ * ckmk_mdCryptoOperationRSAPriv_Create
+ */
+static NSSCKMDCryptoOperation *
+ckmk_mdCryptoOperationRSAPriv_Create(
+    const NSSCKMDCryptoOperation *proto,
+    NSSCKMDMechanism *mdMechanism,
+    NSSCKMDObject *mdKey,
+    ckmkRSAOpType type,
+    CK_RV *pError)
+{
+    ckmkInternalObject *iKey = (ckmkInternalObject *)mdKey->etc;
+    const NSSItem *classItem = nss_ckmk_FetchAttribute(iKey, CKA_CLASS, pError);
+    const NSSItem *keyType = nss_ckmk_FetchAttribute(iKey, CKA_KEY_TYPE, pError);
+    ckmkInternalCryptoOperationRSAPriv *iOperation;
+    SecKeyRef privateKey;
+    OSStatus macErr;
+    CSSM_RETURN cssmErr;
+    const CSSM_KEY *cssmKey;
+    CSSM_CSP_HANDLE cspHandle;
+    const CSSM_ACCESS_CREDENTIALS *creds = NULL;
+    CSSM_CC_HANDLE cssmContext;
+    CSSM_ACL_AUTHORIZATION_TAG authType;
+
+    /* make sure we have the right objects */
+    if (((const NSSItem *)NULL == classItem) ||
+        (sizeof(CK_OBJECT_CLASS) != classItem->size) ||
+        (CKO_PRIVATE_KEY != *(CK_OBJECT_CLASS *)classItem->data) ||
+        ((const NSSItem *)NULL == keyType) ||
+        (sizeof(CK_KEY_TYPE) != keyType->size) ||
+        (CKK_RSA != *(CK_KEY_TYPE *)keyType->data)) {
+        *pError = CKR_KEY_TYPE_INCONSISTENT;
+        return (NSSCKMDCryptoOperation *)NULL;
+    }
+
+    privateKey = (SecKeyRef)iKey->u.item.itemRef;
+    macErr = SecKeyGetCSSMKey(privateKey, &cssmKey);
+    if (noErr != macErr) {
+        CKMK_MACERR("Getting CSSM Key", macErr);
+        *pError = CKR_KEY_HANDLE_INVALID;
+        return (NSSCKMDCryptoOperation *)NULL;
+    }
+    macErr = SecKeyGetCSPHandle(privateKey, &cspHandle);
+    if (noErr != macErr) {
+        CKMK_MACERR("Getting CSP for Key", macErr);
+        *pError = CKR_KEY_HANDLE_INVALID;
+        return (NSSCKMDCryptoOperation *)NULL;
+    }
+    switch (type) {
+        case CKMK_DECRYPT:
+            authType = CSSM_ACL_AUTHORIZATION_DECRYPT;
+            break;
+        case CKMK_SIGN:
+            authType = CSSM_ACL_AUTHORIZATION_SIGN;
+            break;
+        default:
+            *pError = CKR_GENERAL_ERROR;
+#ifdef DEBUG
+            fprintf(stderr, "RSAPriv_Create: bad type = %d\n", type);
+#endif
+            return (NSSCKMDCryptoOperation *)NULL;
+    }
+
+    macErr = SecKeyGetCredentials(privateKey, authType, 0, &creds);
+    if (noErr != macErr) {
+        CKMK_MACERR("Getting Credentials for Key", macErr);
+        *pError = CKR_KEY_HANDLE_INVALID;
+        return (NSSCKMDCryptoOperation *)NULL;
+    }
+
+    switch (type) {
+        case CKMK_DECRYPT:
+            cssmErr = CSSM_CSP_CreateAsymmetricContext(cspHandle, CSSM_ALGID_RSA,
+                                                       creds, cssmKey, CSSM_PADDING_PKCS1, &cssmContext);
+            break;
+        case CKMK_SIGN:
+            cssmErr = CSSM_CSP_CreateSignatureContext(cspHandle, CSSM_ALGID_RSA,
+                                                      creds, cssmKey, &cssmContext);
+            break;
+        default:
+            *pError = CKR_GENERAL_ERROR;
+#ifdef DEBUG
+            fprintf(stderr, "RSAPriv_Create: bad type = %d\n", type);
+#endif
+            return (NSSCKMDCryptoOperation *)NULL;
+    }
+    if (noErr != cssmErr) {
+        CKMK_MACERR("Getting Context for Key", cssmErr);
+        *pError = CKR_GENERAL_ERROR;
+        return (NSSCKMDCryptoOperation *)NULL;
+    }
+
+    iOperation = nss_ZNEW(NULL, ckmkInternalCryptoOperationRSAPriv);
+    if ((ckmkInternalCryptoOperationRSAPriv *)NULL == iOperation) {
+        *pError = CKR_HOST_MEMORY;
+        return (NSSCKMDCryptoOperation *)NULL;
+    }
+    iOperation->mdMechanism = mdMechanism;
+    iOperation->iKey = iKey;
+    iOperation->cssmContext = cssmContext;
+
+    nsslibc_memcpy(&iOperation->mdOperation,
+                   proto, sizeof(NSSCKMDCryptoOperation));
+    iOperation->mdOperation.etc = iOperation;
+
+    return &iOperation->mdOperation;
+}
+
+static void
+ckmk_mdCryptoOperationRSAPriv_Destroy(
+    NSSCKMDCryptoOperation *mdOperation,
+    NSSCKFWCryptoOperation *fwOperation,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    ckmkInternalCryptoOperationRSAPriv *iOperation =
+        (ckmkInternalCryptoOperationRSAPriv *)mdOperation->etc;
+
+    if (iOperation->buffer) {
+        nssItem_Destroy(iOperation->buffer);
+    }
+    if (iOperation->cssmContext) {
+        CSSM_DeleteContext(iOperation->cssmContext);
+    }
+    nss_ZFreeIf(iOperation);
+    return;
+}
+
+static CK_ULONG
+ckmk_mdCryptoOperationRSA_GetFinalLength(
+    NSSCKMDCryptoOperation *mdOperation,
+    NSSCKFWCryptoOperation *fwOperation,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    ckmkInternalCryptoOperationRSAPriv *iOperation =
+        (ckmkInternalCryptoOperationRSAPriv *)mdOperation->etc;
+    const NSSItem *modulus =
+        nss_ckmk_FetchAttribute(iOperation->iKey, CKA_MODULUS, pError);
+
+    return modulus->size;
+}
+
+/*
+ * ckmk_mdCryptoOperationRSADecrypt_GetOperationLength
+ * we won't know the length until we actually decrypt the
+ * input block. Since we go to all the work to decrypt the
+ * the block, we'll save if for when the block is asked for
+ */
+static CK_ULONG
+ckmk_mdCryptoOperationRSADecrypt_GetOperationLength(
+    NSSCKMDCryptoOperation *mdOperation,
+    NSSCKFWCryptoOperation *fwOperation,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    const NSSItem *input,
+    CK_RV *pError)
+{
+    ckmkInternalCryptoOperationRSAPriv *iOperation =
+        (ckmkInternalCryptoOperationRSAPriv *)mdOperation->etc;
+    CSSM_DATA cssmInput;
+    CSSM_DATA cssmOutput = { 0, NULL };
+    PRUint32 bytesDecrypted;
+    CSSM_DATA remainder = { 0, NULL };
+    NSSItem output;
+    CSSM_RETURN cssmErr;
+
+    if (iOperation->buffer) {
+        return iOperation->buffer->size;
+    }
+
+    cssmInput.Data = input->data;
+    cssmInput.Length = input->size;
+
+    cssmErr = CSSM_DecryptData(iOperation->cssmContext,
+                               &cssmInput, 1, &cssmOutput, 1,
+                               &bytesDecrypted, &remainder);
+    if (CSSM_OK != cssmErr) {
+        CKMK_MACERR("Decrypt Failed", cssmErr);
+        *pError = CKR_DATA_INVALID;
+        return 0;
+    }
+    /* we didn't suppy any buffers, so it should all be in remainder */
+    output.data = nss_ZNEWARRAY(NULL, char, bytesDecrypted + remainder.Length);
+    if (NULL == output.data) {
+        free(cssmOutput.Data);
+        free(remainder.Data);
+        *pError = CKR_HOST_MEMORY;
+        return 0;
+    }
+    output.size = bytesDecrypted + remainder.Length;
+
+    if (0 != bytesDecrypted) {
+        nsslibc_memcpy(output.data, cssmOutput.Data, bytesDecrypted);
+        free(cssmOutput.Data);
+    }
+    if (0 != remainder.Length) {
+        nsslibc_memcpy(((char *)output.data) + bytesDecrypted,
+                       remainder.Data, remainder.Length);
+        free(remainder.Data);
+    }
+
+    iOperation->buffer = nssItem_Duplicate(&output, NULL, NULL);
+    nss_ZFreeIf(output.data);
+    if ((NSSItem *)NULL == iOperation->buffer) {
+        *pError = CKR_HOST_MEMORY;
+        return 0;
+    }
+
+    return iOperation->buffer->size;
+}
+
+/*
+ * ckmk_mdCryptoOperationRSADecrypt_UpdateFinal
+ *
+ * NOTE: ckmk_mdCryptoOperationRSADecrypt_GetOperationLength is presumed to
+ * have been called previously.
+ */
+static CK_RV
+ckmk_mdCryptoOperationRSADecrypt_UpdateFinal(
+    NSSCKMDCryptoOperation *mdOperation,
+    NSSCKFWCryptoOperation *fwOperation,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    const NSSItem *input,
+    NSSItem *output)
+{
+    ckmkInternalCryptoOperationRSAPriv *iOperation =
+        (ckmkInternalCryptoOperationRSAPriv *)mdOperation->etc;
+    NSSItem *buffer = iOperation->buffer;
+
+    if ((NSSItem *)NULL == buffer) {
+        return CKR_GENERAL_ERROR;
+    }
+    nsslibc_memcpy(output->data, buffer->data, buffer->size);
+    output->size = buffer->size;
+    return CKR_OK;
+}
+
+/*
+ * ckmk_mdCryptoOperationRSASign_UpdateFinal
+ *
+ */
+static CK_RV
+ckmk_mdCryptoOperationRSASign_UpdateFinal(
+    NSSCKMDCryptoOperation *mdOperation,
+    NSSCKFWCryptoOperation *fwOperation,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    const NSSItem *input,
+    NSSItem *output)
+{
+    ckmkInternalCryptoOperationRSAPriv *iOperation =
+        (ckmkInternalCryptoOperationRSAPriv *)mdOperation->etc;
+    CSSM_DATA cssmInput;
+    CSSM_DATA cssmOutput = { 0, NULL };
+    CSSM_RETURN cssmErr;
+
+    cssmInput.Data = input->data;
+    cssmInput.Length = input->size;
+
+    cssmErr = CSSM_SignData(iOperation->cssmContext, &cssmInput, 1,
+                            CSSM_ALGID_NONE, &cssmOutput);
+    if (CSSM_OK != cssmErr) {
+        CKMK_MACERR("Signed Failed", cssmErr);
+        return CKR_FUNCTION_FAILED;
+    }
+    if (cssmOutput.Length > output->size) {
+        free(cssmOutput.Data);
+        return CKR_BUFFER_TOO_SMALL;
+    }
+    nsslibc_memcpy(output->data, cssmOutput.Data, cssmOutput.Length);
+    free(cssmOutput.Data);
+    output->size = cssmOutput.Length;
+
+    return CKR_OK;
+}
+
+NSS_IMPLEMENT_DATA const NSSCKMDCryptoOperation
+    ckmk_mdCryptoOperationRSADecrypt_proto = {
+        NULL, /* etc */
+        ckmk_mdCryptoOperationRSAPriv_Destroy,
+        NULL, /* GetFinalLengh - not needed for one shot Decrypt/Encrypt */
+        ckmk_mdCryptoOperationRSADecrypt_GetOperationLength,
+        NULL, /* Final - not needed for one shot operation */
+        NULL, /* Update - not needed for one shot operation */
+        NULL, /* DigetUpdate - not needed for one shot operation */
+        ckmk_mdCryptoOperationRSADecrypt_UpdateFinal,
+        NULL,        /* UpdateCombo - not needed for one shot operation */
+        NULL,        /* DigetKey - not needed for one shot operation */
+        (void *)NULL /* null terminator */
+    };
+
+NSS_IMPLEMENT_DATA const NSSCKMDCryptoOperation
+    ckmk_mdCryptoOperationRSASign_proto = {
+        NULL, /* etc */
+        ckmk_mdCryptoOperationRSAPriv_Destroy,
+        ckmk_mdCryptoOperationRSA_GetFinalLength,
+        NULL, /* GetOperationLengh - not needed for one shot Sign/Verify */
+        NULL, /* Final - not needed for one shot operation */
+        NULL, /* Update - not needed for one shot operation */
+        NULL, /* DigetUpdate - not needed for one shot operation */
+        ckmk_mdCryptoOperationRSASign_UpdateFinal,
+        NULL,        /* UpdateCombo - not needed for one shot operation */
+        NULL,        /* DigetKey - not needed for one shot operation */
+        (void *)NULL /* null terminator */
+    };
+
+/********** NSSCKMDMechansim functions ***********************/
+/*
+ * ckmk_mdMechanismRSA_Destroy
+ */
+static void
+ckmk_mdMechanismRSA_Destroy(
+    NSSCKMDMechanism *mdMechanism,
+    NSSCKFWMechanism *fwMechanism,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    nss_ZFreeIf(fwMechanism);
+}
+
+/*
+ * ckmk_mdMechanismRSA_GetMinKeySize
+ */
+static CK_ULONG
+ckmk_mdMechanismRSA_GetMinKeySize(
+    NSSCKMDMechanism *mdMechanism,
+    NSSCKFWMechanism *fwMechanism,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return 384;
+}
+
+/*
+ * ckmk_mdMechanismRSA_GetMaxKeySize
+ */
+static CK_ULONG
+ckmk_mdMechanismRSA_GetMaxKeySize(
+    NSSCKMDMechanism *mdMechanism,
+    NSSCKFWMechanism *fwMechanism,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return 16384;
+}
+
+/*
+ * ckmk_mdMechanismRSA_DecryptInit
+ */
+static NSSCKMDCryptoOperation *
+ckmk_mdMechanismRSA_DecryptInit(
+    NSSCKMDMechanism *mdMechanism,
+    NSSCKFWMechanism *fwMechanism,
+    CK_MECHANISM *pMechanism,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    NSSCKMDObject *mdKey,
+    NSSCKFWObject *fwKey,
+    CK_RV *pError)
+{
+    return ckmk_mdCryptoOperationRSAPriv_Create(
+        &ckmk_mdCryptoOperationRSADecrypt_proto,
+        mdMechanism, mdKey, CKMK_DECRYPT, pError);
+}
+
+/*
+ * ckmk_mdMechanismRSA_SignInit
+ */
+static NSSCKMDCryptoOperation *
+ckmk_mdMechanismRSA_SignInit(
+    NSSCKMDMechanism *mdMechanism,
+    NSSCKFWMechanism *fwMechanism,
+    CK_MECHANISM *pMechanism,
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    NSSCKMDObject *mdKey,
+    NSSCKFWObject *fwKey,
+    CK_RV *pError)
+{
+    return ckmk_mdCryptoOperationRSAPriv_Create(
+        &ckmk_mdCryptoOperationRSASign_proto,
+        mdMechanism, mdKey, CKMK_SIGN, pError);
+}
+
+NSS_IMPLEMENT_DATA const NSSCKMDMechanism
+    nss_ckmk_mdMechanismRSA = {
+        (void *)NULL, /* etc */
+        ckmk_mdMechanismRSA_Destroy,
+        ckmk_mdMechanismRSA_GetMinKeySize,
+        ckmk_mdMechanismRSA_GetMaxKeySize,
+        NULL, /* GetInHardware - default false */
+        NULL, /* EncryptInit - default errs */
+        ckmk_mdMechanismRSA_DecryptInit,
+        NULL, /* DigestInit - default errs*/
+        ckmk_mdMechanismRSA_SignInit,
+        NULL,                         /* VerifyInit - default errs */
+        ckmk_mdMechanismRSA_SignInit, /* SignRecoverInit */
+        NULL,                         /* VerifyRecoverInit - default errs */
+        NULL,                         /* GenerateKey - default errs */
+        NULL,                         /* GenerateKeyPair - default errs */
+        NULL,                         /* GetWrapKeyLength - default errs */
+        NULL,                         /* WrapKey - default errs */
+        NULL,                         /* UnwrapKey - default errs */
+        NULL,                         /* DeriveKey - default errs */
+        (void *)NULL                  /* null terminator */
+    };

security/nss/lib/ckfw/nssmkey/msession.c

@@ -0,0 +1,87 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ckmk.h"
+
+/*
+ * nssmkey/msession.c
+ *
+ * This file implements the NSSCKMDSession object for the
+ * "nssmkey" cryptoki module.
+ */
+
+static NSSCKMDFindObjects *
+ckmk_mdSession_FindObjectsInit(
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    CK_RV *pError)
+{
+    return nss_ckmk_FindObjectsInit(fwSession, pTemplate, ulAttributeCount, pError);
+}
+
+static NSSCKMDObject *
+ckmk_mdSession_CreateObject(
+    NSSCKMDSession *mdSession,
+    NSSCKFWSession *fwSession,
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    NSSArena *arena,
+    CK_ATTRIBUTE_PTR pTemplate,
+    CK_ULONG ulAttributeCount,
+    CK_RV *pError)
+{
+    return nss_ckmk_CreateObject(fwSession, pTemplate, ulAttributeCount, pError);
+}
+
+NSS_IMPLEMENT NSSCKMDSession *
+nss_ckmk_CreateSession(
+    NSSCKFWSession *fwSession,
+    CK_RV *pError)
+{
+    NSSArena *arena;
+    NSSCKMDSession *rv;
+
+    arena = NSSCKFWSession_GetArena(fwSession, pError);
+    if ((NSSArena *)NULL == arena) {
+        return (NSSCKMDSession *)NULL;
+    }
+
+    rv = nss_ZNEW(arena, NSSCKMDSession);
+    if ((NSSCKMDSession *)NULL == rv) {
+        *pError = CKR_HOST_MEMORY;
+        return (NSSCKMDSession *)NULL;
+    }
+
+    /*
+     * rv was zeroed when allocated, so we only
+     * need to set the non-zero members.
+     */
+
+    rv->etc = (void *)fwSession;
+    /* rv->Close */
+    /* rv->GetDeviceError */
+    /* rv->Login */
+    /* rv->Logout */
+    /* rv->InitPIN */
+    /* rv->SetPIN */
+    /* rv->GetOperationStateLen */
+    /* rv->GetOperationState */
+    /* rv->SetOperationState */
+    rv->CreateObject = ckmk_mdSession_CreateObject;
+    /* rv->CopyObject */
+    rv->FindObjectsInit = ckmk_mdSession_FindObjectsInit;
+    /* rv->SeedRandom */
+    /* rv->GetRandom */
+    /* rv->null */
+
+    return rv;
+}

security/nss/lib/ckfw/nssmkey/mslot.c

@@ -0,0 +1,81 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ckmk.h"
+
+/*
+ * nssmkey/mslot.c
+ *
+ * This file implements the NSSCKMDSlot object for the
+ * "nssmkey" cryptoki module.
+ */
+
+static NSSUTF8 *
+ckmk_mdSlot_GetSlotDescription(
+    NSSCKMDSlot *mdSlot,
+    NSSCKFWSlot *fwSlot,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_ckmk_SlotDescription;
+}
+
+static NSSUTF8 *
+ckmk_mdSlot_GetManufacturerID(
+    NSSCKMDSlot *mdSlot,
+    NSSCKFWSlot *fwSlot,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_ckmk_ManufacturerID;
+}
+
+static CK_VERSION
+ckmk_mdSlot_GetHardwareVersion(
+    NSSCKMDSlot *mdSlot,
+    NSSCKFWSlot *fwSlot,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return nss_ckmk_HardwareVersion;
+}
+
+static CK_VERSION
+ckmk_mdSlot_GetFirmwareVersion(
+    NSSCKMDSlot *mdSlot,
+    NSSCKFWSlot *fwSlot,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return nss_ckmk_FirmwareVersion;
+}
+
+static NSSCKMDToken *
+ckmk_mdSlot_GetToken(
+    NSSCKMDSlot *mdSlot,
+    NSSCKFWSlot *fwSlot,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSCKMDToken *)&nss_ckmk_mdToken;
+}
+
+NSS_IMPLEMENT_DATA const NSSCKMDSlot
+    nss_ckmk_mdSlot = {
+        (void *)NULL, /* etc */
+        NULL,         /* Initialize */
+        NULL,         /* Destroy */
+        ckmk_mdSlot_GetSlotDescription,
+        ckmk_mdSlot_GetManufacturerID,
+        NULL, /* GetTokenPresent -- defaults to true */
+        NULL, /* GetRemovableDevice -- defaults to false */
+        NULL, /* GetHardwareSlot -- defaults to false */
+        ckmk_mdSlot_GetHardwareVersion,
+        ckmk_mdSlot_GetFirmwareVersion,
+        ckmk_mdSlot_GetToken,
+        (void *)NULL /* null terminator */
+    };

security/nss/lib/ckfw/nssmkey/mtoken.c

@@ -0,0 +1,184 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include "ckmk.h"
+
+/*
+ * nssmkey/mtoken.c
+ *
+ * This file implements the NSSCKMDToken object for the
+ * "nssmkey" cryptoki module.
+ */
+
+static NSSUTF8 *
+ckmk_mdToken_GetLabel(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_ckmk_TokenLabel;
+}
+
+static NSSUTF8 *
+ckmk_mdToken_GetManufacturerID(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_ckmk_ManufacturerID;
+}
+
+static NSSUTF8 *
+ckmk_mdToken_GetModel(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_ckmk_TokenModel;
+}
+
+static NSSUTF8 *
+ckmk_mdToken_GetSerialNumber(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    return (NSSUTF8 *)nss_ckmk_TokenSerialNumber;
+}
+
+static CK_BBOOL
+ckmk_mdToken_GetIsWriteProtected(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return CK_FALSE;
+}
+
+/* fake out Mozilla so we don't try to initialize the token */
+static CK_BBOOL
+ckmk_mdToken_GetUserPinInitialized(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return CK_TRUE;
+}
+
+static CK_VERSION
+ckmk_mdToken_GetHardwareVersion(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return nss_ckmk_HardwareVersion;
+}
+
+static CK_VERSION
+ckmk_mdToken_GetFirmwareVersion(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return nss_ckmk_FirmwareVersion;
+}
+
+static NSSCKMDSession *
+ckmk_mdToken_OpenSession(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    NSSCKFWSession *fwSession,
+    CK_BBOOL rw,
+    CK_RV *pError)
+{
+    return nss_ckmk_CreateSession(fwSession, pError);
+}
+
+static CK_ULONG
+ckmk_mdToken_GetMechanismCount(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance)
+{
+    return (CK_ULONG)1;
+}
+
+static CK_RV
+ckmk_mdToken_GetMechanismTypes(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_MECHANISM_TYPE types[])
+{
+    types[0] = CKM_RSA_PKCS;
+    return CKR_OK;
+}
+
+static NSSCKMDMechanism *
+ckmk_mdToken_GetMechanism(
+    NSSCKMDToken *mdToken,
+    NSSCKFWToken *fwToken,
+    NSSCKMDInstance *mdInstance,
+    NSSCKFWInstance *fwInstance,
+    CK_MECHANISM_TYPE which,
+    CK_RV *pError)
+{
+    if (which != CKM_RSA_PKCS) {
+        *pError = CKR_MECHANISM_INVALID;
+        return (NSSCKMDMechanism *)NULL;
+    }
+    return (NSSCKMDMechanism *)&nss_ckmk_mdMechanismRSA;
+}
+
+NSS_IMPLEMENT_DATA const NSSCKMDToken
+    nss_ckmk_mdToken = {
+        (void *)NULL, /* etc */
+        NULL,         /* Setup */
+        NULL,         /* Invalidate */
+        NULL,         /* InitToken -- default errs */
+        ckmk_mdToken_GetLabel,
+        ckmk_mdToken_GetManufacturerID,
+        ckmk_mdToken_GetModel,
+        ckmk_mdToken_GetSerialNumber,
+        NULL, /* GetHasRNG -- default is false */
+        ckmk_mdToken_GetIsWriteProtected,
+        NULL, /* GetLoginRequired -- default is false */
+        ckmk_mdToken_GetUserPinInitialized,
+        NULL, /* GetRestoreKeyNotNeeded -- irrelevant */
+        NULL, /* GetHasClockOnToken -- default is false */
+        NULL, /* GetHasProtectedAuthenticationPath -- default is false */
+        NULL, /* GetSupportsDualCryptoOperations -- default is false */
+        NULL, /* GetMaxSessionCount -- default is CK_UNAVAILABLE_INFORMATION */
+        NULL, /* GetMaxRwSessionCount -- default is CK_UNAVAILABLE_INFORMATION */
+        NULL, /* GetMaxPinLen -- irrelevant */
+        NULL, /* GetMinPinLen -- irrelevant */
+        NULL, /* GetTotalPublicMemory -- default is CK_UNAVAILABLE_INFORMATION */
+        NULL, /* GetFreePublicMemory -- default is CK_UNAVAILABLE_INFORMATION */
+        NULL, /* GetTotalPrivateMemory -- default is CK_UNAVAILABLE_INFORMATION */
+        NULL, /* GetFreePrivateMemory -- default is CK_UNAVAILABLE_INFORMATION */
+        ckmk_mdToken_GetHardwareVersion,
+        ckmk_mdToken_GetFirmwareVersion,
+        NULL, /* GetUTCTime -- no clock */
+        ckmk_mdToken_OpenSession,
+        ckmk_mdToken_GetMechanismCount,
+        ckmk_mdToken_GetMechanismTypes,
+        ckmk_mdToken_GetMechanism,
+        (void *)NULL /* null terminator */
+    };

security/nss/lib/ckfw/nssmkey/nssmkey.def

@@ -0,0 +1,26 @@
+;+#
+;+# This Source Code Form is subject to the terms of the Mozilla Public
+;+# License, v. 2.0. If a copy of the MPL was not distributed with this
+;+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+;+#
+;+# OK, this file is meant to support SUN, LINUX, AIX and WINDOWS
+;+#   1. For all unix platforms, the string ";-"  means "remove this line"
+;+#   2. For all unix platforms, the string " DATA " will be removed from any 
+;+#     line on which it occurs.
+;+#   3. Lines containing ";+" will have ";+" removed on SUN and LINUX.
+;+#      On AIX, lines containing ";+" will be removed.
+;+#   4. For all unix platforms, the string ";;" will thave the ";;" removed.
+;+#   5. For all unix platforms, after the above processing has taken place,
+;+#    all characters after the first ";" on the line will be removed.
+;+#    And for AIX, the first ";" will also be removed.
+;+#  This file is passed directly to windows. Since ';' is a comment, all UNIX
+;+#   directives are hidden behind ";", ";+", and ";-"
+;+
+;+NSSMKEY_3.0 {       # First release of nssmkey
+;+    global:
+LIBRARY nssmkey ;-
+EXPORTS ;-
+C_GetFunctionList;
+;+    local:
+;+*;
+;+};

security/nss/lib/ckfw/nssmkey/nssmkey.h

@@ -0,0 +1,41 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef NSSMKEY_H
+#define NSSMKEY_H
+
+/*
+ * NSS CKMK Version numbers.
+ *
+ * These are the version numbers for the nssmkey module packaged with
+ * this release on NSS. To determine the version numbers of the builtin
+ * module you are using, use the appropriate PKCS #11 calls.
+ *
+ * These version numbers detail changes to the PKCS #11 interface. They map
+ * to the PKCS #11 spec versions.
+ */
+#define NSS_CKMK_CRYPTOKI_VERSION_MAJOR 2
+#define NSS_CKMK_CRYPTOKI_VERSION_MINOR 20
+
+/* These version numbers detail the changes
+ * to the list of trusted certificates.
+ *
+ * NSS_CKMK_LIBRARY_VERSION_MINOR is a CK_BYTE.  It's not clear
+ * whether we may use its full range (0-255) or only 0-99 because
+ * of the comment in the CK_VERSION type definition.
+ */
+#define NSS_CKMK_LIBRARY_VERSION_MAJOR 1
+#define NSS_CKMK_LIBRARY_VERSION_MINOR 1
+#define NSS_CKMK_LIBRARY_VERSION "1.1"
+
+/* These version numbers detail the semantic changes to the ckfw engine. */
+#define NSS_CKMK_HARDWARE_VERSION_MAJOR 1
+#define NSS_CKMK_HARDWARE_VERSION_MINOR 0
+
+/* These version numbers detail the semantic changes to ckbi itself
+ * (new PKCS #11 objects), etc. */
+#define NSS_CKMK_FIRMWARE_VERSION_MAJOR 1
+#define NSS_CKMK_FIRMWARE_VERSION_MINOR 0
+
+#endif /* NSSMKEY_H */

security/nss/lib/ckfw/nssmkey/staticobj.c

@@ -0,0 +1,36 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#ifndef CKMK_H
+#include "ckmk.h"
+#endif /* CKMK_H */
+
+static const CK_TRUST ckt_netscape_valid = CKT_NETSCAPE_VALID;
+static const CK_OBJECT_CLASS cko_certificate = CKO_CERTIFICATE;
+static const CK_TRUST ckt_netscape_trusted_delegator = CKT_NETSCAPE_TRUSTED_DELEGATOR;
+static const CK_OBJECT_CLASS cko_netscape_trust = CKO_NETSCAPE_TRUST;
+static const CK_BBOOL ck_true = CK_TRUE;
+static const CK_OBJECT_CLASS cko_data = CKO_DATA;
+static const CK_CERTIFICATE_TYPE ckc_x_509 = CKC_X_509;
+static const CK_BBOOL ck_false = CK_FALSE;
+static const CK_OBJECT_CLASS cko_netscape_builtin_root_list = CKO_NETSCAPE_BUILTIN_ROOT_LIST;
+
+/* example of a static object */
+static const CK_ATTRIBUTE_TYPE nss_ckmk_types_1[] = {
+    CKA_CLASS, CKA_TOKEN, CKA_PRIVATE, CKA_MODIFIABLE, CKA_LABEL
+};
+
+static const NSSItem nss_ckmk_items_1[] = {
+    { (void *)&cko_data, (PRUint32)sizeof(CK_OBJECT_CLASS) },
+    { (void *)&ck_true, (PRUint32)sizeof(CK_BBOOL) },
+    { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
+    { (void *)&ck_false, (PRUint32)sizeof(CK_BBOOL) },
+    { (void *)"Mozilla Mac Key Ring Access", (PRUint32)28 }
+};
+
+ckmkInternalObject nss_ckmk_data[] = {
+    { ckmkRaw, { { 5, nss_ckmk_types_1, nss_ckmk_items_1 } }, CKO_DATA, { NULL } },
+};
+
+const PRUint32 nss_ckmk_nObjects = 1;

security/nss/lib/ckfw/object.c

@@ -0,0 +1,973 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/*
+ * object.c
+ *
+ * This file implements the NSSCKFWObject type and methods.
+ */
+
+#ifndef CK_T
+#include "ck.h"
+#endif /* CK_T */
+
+/*
+ * NSSCKFWObject
+ *
+ * -- create/destroy --
+ *  nssCKFWObject_Create
+ *  nssCKFWObject_Finalize
+ *  nssCKFWObject_Destroy
+ *
+ * -- public accessors --
+ *  NSSCKFWObject_GetMDObject
+ *  NSSCKFWObject_GetArena
+ *  NSSCKFWObject_IsTokenObject
+ *  NSSCKFWObject_GetAttributeCount
+ *  NSSCKFWObject_GetAttributeTypes
+ *  NSSCKFWObject_GetAttributeSize
+ *  NSSCKFWObject_GetAttribute
+ *  NSSCKFWObject_SetAttribute
+ *  NSSCKFWObject_GetObjectSize
+ *
+ * -- implement public accessors --
+ *  nssCKFWObject_GetMDObject
+ *  nssCKFWObject_GetArena
+ *
+ * -- private accessors --
+ *  nssCKFWObject_SetHandle
+ *  nssCKFWObject_GetHandle
+ *
+ * -- module fronts --
+ *  nssCKFWObject_IsTokenObject
+ *  nssCKFWObject_GetAttributeCount
+ *  nssCKFWObject_GetAttributeTypes
+ *  nssCKFWObject_GetAttributeSize
+ *  nssCKFWObject_GetAttribute
+ *  nssCKFWObject_SetAttribute
+ *  nssCKFWObject_GetObjectSize
+ */
+
+struct NSSCKFWObjectStr {
+    NSSCKFWMutex *mutex; /* merely to serialise the MDObject calls */
+    NSSArena *arena;
+    NSSCKMDObject *mdObject;
+    NSSCKMDSession *mdSession;
+    NSSCKFWSession *fwSession;
+    NSSCKMDToken *mdToken;
+    NSSCKFWToken *fwToken;
+    NSSCKMDInstance *mdInstance;
+    NSSCKFWInstance *fwInstance;
+    CK_OBJECT_HANDLE hObject;
+};
+
+#ifdef DEBUG
+/*
+ * But first, the pointer-tracking stuff.
+ *
+ * NOTE: the pointer-tracking support in NSS/base currently relies
+ * upon NSPR's CallOnce support.  That, however, relies upon NSPR's
+ * locking, which is tied into the runtime.  We need a pointer-tracker
+ * implementation that uses the locks supplied through C_Initialize.
+ * That support, however, can be filled in later.  So for now, I'll
+ * just do this routines as no-ops.
+ */
+
+static CK_RV
+object_add_pointer(
+    const NSSCKFWObject *fwObject)
+{
+    return CKR_OK;
+}
+
+static CK_RV
+object_remove_pointer(
+    const NSSCKFWObject *fwObject)
+{
+    return CKR_OK;
+}
+
+NSS_IMPLEMENT CK_RV
+nssCKFWObject_verifyPointer(
+    const NSSCKFWObject *fwObject)
+{
+    return CKR_OK;
+}
+
+#endif /* DEBUG */
+
+/*
+ * nssCKFWObject_Create
+ *
+ */
+NSS_IMPLEMENT NSSCKFWObject *
+nssCKFWObject_Create(
+    NSSArena *arena,
+    NSSCKMDObject *mdObject,
+    NSSCKFWSession *fwSession,
+    NSSCKFWToken *fwToken,
+    NSSCKFWInstance *fwInstance,
+    CK_RV *pError)
+{
+    NSSCKFWObject *fwObject;
+    nssCKFWHash *mdObjectHash;
+
+#ifdef NSSDEBUG
+    if (!pError) {
+        return (NSSCKFWObject *)NULL;
+    }
+
+    if (PR_SUCCESS != nssArena_verifyPointer(arena)) {
+        *pError = CKR_ARGUMENTS_BAD;
+        return (NSSCKFWObject *)NULL;
+    }
+#endif /* NSSDEBUG */
+
+    if (!fwToken) {
+        *pError = CKR_ARGUMENTS_BAD;
+        return (NSSCKFWObject *)NULL;
+    }
+    mdObjectHash = nssCKFWToken_GetMDObjectHash(fwToken);
+    if (!mdObjectHash) {
+        *pError = CKR_GENERAL_ERROR;
+        return (NSSCKFWObject *)NULL;
+    }
+
+    if (nssCKFWHash_Exists(mdObjectHash, mdObject)) {
+        fwObject = nssCKFWHash_Lookup(mdObjectHash, mdObject);
+        return fwObject;
+    }
+
+    fwObject = nss_ZNEW(arena, NSSCKFWObject);
+    if (!fwObject) {
+        *pError = CKR_HOST_MEMORY;
+        return (NSSCKFWObject *)NULL;
+    }
+
+    fwObject->arena = arena;
+    fwObject->mdObject = mdObject;
+    fwObject->fwSession = fwSession;
+
+    if (fwSession) {
+        fwObject->mdSession = nssCKFWSession_GetMDSession(fwSession);
+    }
+
+    fwObject->fwToken = fwToken;
+    fwObject->mdToken = nssCKFWToken_GetMDToken(fwToken);
+    fwObject->fwInstance = fwInstance;
+    fwObject->mdInstance = nssCKFWInstance_GetMDInstance(fwInstance);
+    fwObject->mutex = nssCKFWInstance_CreateMutex(fwInstance, arena, pError);
+    if (!fwObject->mutex) {
+        if (CKR_OK == *pError) {
+            *pError = CKR_GENERAL_ERROR;
+        }
+        nss_ZFreeIf(fwObject);
+        return (NSSCKFWObject *)NULL;
+    }
+
+    *pError = nssCKFWHash_Add(mdObjectHash, mdObject, fwObject);
+    if (CKR_OK != *pError) {
+        nss_ZFreeIf(fwObject);
+        return (NSSCKFWObject *)NULL;
+    }
+
+#ifdef DEBUG
+    *pError = object_add_pointer(fwObject);
+    if (CKR_OK != *pError) {
+        nssCKFWHash_Remove(mdObjectHash, mdObject);
+        nss_ZFreeIf(fwObject);
+        return (NSSCKFWObject *)NULL;
+    }
+#endif /* DEBUG */
+
+    *pError = CKR_OK;
+    return fwObject;
+}
+
+/*
+ * nssCKFWObject_Finalize
+ *
+ */
+NSS_IMPLEMENT void
+nssCKFWObject_Finalize(
+    NSSCKFWObject *fwObject,
+    PRBool removeFromHash)
+{
+    nssCKFWHash *mdObjectHash;
+
+#ifdef NSSDEBUG
+    if (CKR_OK != nssCKFWObject_verifyPointer(fwObject)) {
+        return;
+    }
+#endif /* NSSDEBUG */
+
+    (void)nssCKFWMutex_Destroy(fwObject->mutex);
+
+    if (fwObject->mdObject->Finalize) {
+        fwObject->mdObject->Finalize(fwObject->mdObject, fwObject,
+                                     fwObject->mdSession, fwObject->fwSession, fwObject->mdToken,
+                                     fwObject->fwToken, fwObject->mdInstance, fwObject->fwInstance);
+    }
+
+    if (removeFromHash) {
+        mdObjectHash = nssCKFWToken_GetMDObjectHash(fwObject->fwToken);
+        if (mdObjectHash) {
+            nssCKFWHash_Remove(mdObjectHash, fwObject->mdObject);
+        }
+    }
+
+    if (fwObject->fwSession) {
+        nssCKFWSession_DeregisterSessionObject(fwObject->fwSession, fwObject);
+    }
+    nss_ZFreeIf(fwObject);
+
+#ifdef DEBUG
+    (void)object_remove_pointer(fwObject);
+#endif /* DEBUG */
+
+    return;
+}
+
+/*
+ * nssCKFWObject_Destroy
+ *
+ */
+NSS_IMPLEMENT void
+nssCKFWObject_Destroy(
+    NSSCKFWObject *fwObject)
+{
+    nssCKFWHash *mdObjectHash;
+
+#ifdef NSSDEBUG
+    if (CKR_OK != nssCKFWObject_verifyPointer(fwObject)) {
+        return;
+    }
+#endif /* NSSDEBUG */
+
+    (void)nssCKFWMutex_Destroy(fwObject->mutex);
+
+    if (fwObject->mdObject->Destroy) {
+        fwObject->mdObject->Destroy(fwObject->mdObject, fwObject,
+                                    fwObject->mdSession, fwObject->fwSession, fwObject->mdToken,
+                                    fwObject->fwToken, fwObject->mdInstance, fwObject->fwInstance);
+    }
+
+    mdObjectHash = nssCKFWToken_GetMDObjectHash(fwObject->fwToken);
+    if (mdObjectHash) {
+        nssCKFWHash_Remove(mdObjectHash, fwObject->mdObject);
+    }
+
+    if (fwObject->fwSession) {
+        nssCKFWSession_DeregisterSessionObject(fwObject->fwSession, fwObject);
+    }
+    nss_ZFreeIf(fwObject);
+
+#ifdef DEBUG
+    (void)object_remove_pointer(fwObject);
+#endif /* DEBUG */
+
+    return;
+}
+
+/*
+ * nssCKFWObject_GetMDObject
+ *
+ */
+NSS_IMPLEMENT NSSCKMDObject *
+nssCKFWObject_GetMDObject(
+    NSSCKFWObject *fwObject)
+{
+#ifdef NSSDEBUG
+    if (CKR_OK != nssCKFWObject_verifyPointer(fwObject)) {
+        return (NSSCKMDObject *)NULL;
+    }
+#endif /* NSSDEBUG */
+
+    return fwObject->mdObject;
+}
+
+/*
+ * nssCKFWObject_GetArena
+ *
+ */
+NSS_IMPLEMENT NSSArena *
+nssCKFWObject_GetArena(
+    NSSCKFWObject *fwObject,
+    CK_RV *pError)
+{
+#ifdef NSSDEBUG
+    if (!pError) {
+        return (NSSArena *)NULL;
+    }
+
+    *pError = nssCKFWObject_verifyPointer(fwObject);
+    if (CKR_OK != *pError) {
+        return (NSSArena *)NULL;
+    }
+#endif /* NSSDEBUG */
+
+    return fwObject->arena;
+}
+
+/*
+ * nssCKFWObject_SetHandle
+ *
+ */
+NSS_IMPLEMENT CK_RV
+nssCKFWObject_SetHandle(
+    NSSCKFWObject *fwObject,
+    CK_OBJECT_HANDLE hObject)
+{
+#ifdef NSSDEBUG
+    CK_RV error = CKR_OK;
+#endif /* NSSDEBUG */
+
+#ifdef NSSDEBUG
+    error = nssCKFWObject_verifyPointer(fwObject);
+    if (CKR_OK != error) {
+        return error;
+    }
+#endif /* NSSDEBUG */
+
+    if ((CK_OBJECT_HANDLE)0 != fwObject->hObject) {
+        return CKR_GENERAL_ERROR;
+    }
+
+    fwObject->hObject = hObject;
+
+    return CKR_OK;
+}
+
+/*
+ * nssCKFWObject_GetHandle
+ *
+ */
+NSS_IMPLEMENT CK_OBJECT_HANDLE
+nssCKFWObject_GetHandle(
+    NSSCKFWObject *fwObject)
+{
+#ifdef NSSDEBUG
+    if (CKR_OK != nssCKFWObject_verifyPointer(fwObject)) {
+        return (CK_OBJECT_HANDLE)0;
+    }
+#endif /* NSSDEBUG */
+
+    return fwObject->hObject;
+}
+
+/*
+ * nssCKFWObject_IsTokenObject
+ *
+ */
+NSS_IMPLEMENT CK_BBOOL
+nssCKFWObject_IsTokenObject(
+    NSSCKFWObject *fwObject)
+{
+    CK_BBOOL b = CK_FALSE;
+
+#ifdef NSSDEBUG
+    if (CKR_OK != nssCKFWObject_verifyPointer(fwObject)) {
+        return CK_FALSE;
+    }
+#endif /* NSSDEBUG */
+
+    if (!fwObject->mdObject->IsTokenObject) {
+        NSSItem item;
+        NSSItem *pItem;
+        CK_RV rv = CKR_OK;
+
+        item.data = (void *)&b;
+        item.size = sizeof(b);
+
+        pItem = nssCKFWObject_GetAttribute(fwObject, CKA_TOKEN, &item,
+                                           (NSSArena *)NULL, &rv);
+        if (!pItem) {
+            /* Error of some type */
+            b = CK_FALSE;
+            goto done;
+        }
+
+        goto done;
+    }
+
+    b = fwObject->mdObject->IsTokenObject(fwObject->mdObject, fwObject,
+                                          fwObject->mdSession, fwObject->fwSession, fwObject->mdToken,
+                                          fwObject->fwToken, fwObject->mdInstance, fwObject->fwInstance);
+
+done:
+    return b;
+}
+
+/*
+ * nssCKFWObject_GetAttributeCount
+ *
+ */
+NSS_IMPLEMENT CK_ULONG
+nssCKFWObject_GetAttributeCount(
+    NSSCKFWObject *fwObject,
+    CK_RV *pError)
+{
+    CK_ULONG rv;
+
+#ifdef NSSDEBUG
+    if (!pError) {
+        return (CK_ULONG)0;
+    }
+
+    *pError = nssCKFWObject_verifyPointer(fwObject);
+    if (CKR_OK != *pError) {
+        return (CK_ULONG)0;
+    }
+#endif /* NSSDEBUG */
+
+    if (!fwObject->mdObject->GetAttributeCount) {
+        *pError = CKR_GENERAL_ERROR;
+        return (CK_ULONG)0;
+    }
+
+    *pError = nssCKFWMutex_Lock(fwObject->mutex);
+    if (CKR_OK != *pError) {
+        return (CK_ULONG)0;
+    }
+
+    rv = fwObject->mdObject->GetAttributeCount(fwObject->mdObject, fwObject,
+                                               fwObject->mdSession, fwObject->fwSession, fwObject->mdToken,
+                                               fwObject->fwToken, fwObject->mdInstance, fwObject->fwInstance,
+                                               pError);
+
+    (void)nssCKFWMutex_Unlock(fwObject->mutex);
+    return rv;
+}
+
+/*
+ * nssCKFWObject_GetAttributeTypes
+ *
+ */
+NSS_IMPLEMENT CK_RV
+nssCKFWObject_GetAttributeTypes(
+    NSSCKFWObject *fwObject,
+    CK_ATTRIBUTE_TYPE_PTR typeArray,
+    CK_ULONG ulCount)
+{
+    CK_RV error = CKR_OK;
+
+#ifdef NSSDEBUG
+    error = nssCKFWObject_verifyPointer(fwObject);
+    if (CKR_OK != error) {
+        return error;
+    }
+
+    if ((CK_ATTRIBUTE_TYPE_PTR)NULL == typeArray) {
+        return CKR_ARGUMENTS_BAD;
+    }
+#endif /* NSSDEBUG */
+
+    if (!fwObject->mdObject->GetAttributeTypes) {
+        return CKR_GENERAL_ERROR;
+    }
+
+    error = nssCKFWMutex_Lock(fwObject->mutex);
+    if (CKR_OK != error) {
+        return error;
+    }
+
+    error = fwObject->mdObject->GetAttributeTypes(fwObject->mdObject, fwObject,
+                                                  fwObject->mdSession, fwObject->fwSession, fwObject->mdToken,
+                                                  fwObject->fwToken, fwObject->mdInstance, fwObject->fwInstance,
+                                                  typeArray, ulCount);
+
+    (void)nssCKFWMutex_Unlock(fwObject->mutex);
+    return error;
+}
+
+/*
+ * nssCKFWObject_GetAttributeSize
+ *
+ */
+NSS_IMPLEMENT CK_ULONG
+nssCKFWObject_GetAttributeSize(
+    NSSCKFWObject *fwObject,
+    CK_ATTRIBUTE_TYPE attribute,
+    CK_RV *pError)
+{
+    CK_ULONG rv;
+
+#ifdef NSSDEBUG
+    if (!pError) {
+        return (CK_ULONG)0;
+    }
+
+    *pError = nssCKFWObject_verifyPointer(fwObject);
+    if (CKR_OK != *pError) {
+        return (CK_ULONG)0;
+    }
+#endif /* NSSDEBUG */
+
+    if (!fwObject->mdObject->GetAttributeSize) {
+        *pError = CKR_GENERAL_ERROR;
+        return (CK_ULONG)0;
+    }
+
+    *pError = nssCKFWMutex_Lock(fwObject->mutex);
+    if (CKR_OK != *pError) {
+        return (CK_ULONG)0;
+    }
+
+    rv = fwObject->mdObject->GetAttributeSize(fwObject->mdObject, fwObject,
+                                              fwObject->mdSession, fwObject->fwSession, fwObject->mdToken,
+                                              fwObject->fwToken, fwObject->mdInstance, fwObject->fwInstance,
+                                              attribute, pError);
+
+    (void)nssCKFWMutex_Unlock(fwObject->mutex);
+    return rv;
+}
+
+/*
+ * nssCKFWObject_GetAttribute
+ *
+ * Usual NSS allocation rules:
+ * If itemOpt is not NULL, it will be returned; otherwise an NSSItem
+ * will be allocated.  If itemOpt is not NULL but itemOpt->data is,
+ * the buffer will be allocated; otherwise, the buffer will be used.
+ * Any allocations will come from the optional arena, if one is
+ * specified.
+ */
+NSS_IMPLEMENT NSSItem *
+nssCKFWObject_GetAttribute(
+    NSSCKFWObject *fwObject,
+    CK_ATTRIBUTE_TYPE attribute,
+    NSSItem *itemOpt,
+    NSSArena *arenaOpt,
+    CK_RV *pError)
+{
+    NSSItem *rv = (NSSItem *)NULL;
+    NSSCKFWItem mdItem;
+
+#ifdef NSSDEBUG
+    if (!pError) {
+        return (NSSItem *)NULL;
+    }
+
+    *pError = nssCKFWObject_verifyPointer(fwObject);
+    if (CKR_OK != *pError) {
+        return (NSSItem *)NULL;
+    }
+#endif /* NSSDEBUG */
+
+    if (!fwObject->mdObject->GetAttribute) {
+        *pError = CKR_GENERAL_ERROR;
+        return (NSSItem *)NULL;
+    }
+
+    *pError = nssCKFWMutex_Lock(fwObject->mutex);
+    if (CKR_OK != *pError) {
+        return (NSSItem *)NULL;
+    }
+
+    mdItem = fwObject->mdObject->GetAttribute(fwObject->mdObject, fwObject,
+                                              fwObject->mdSession, fwObject->fwSession, fwObject->mdToken,
+                                              fwObject->fwToken, fwObject->mdInstance, fwObject->fwInstance,
+                                              attribute, pError);
+
+    if (!mdItem.item) {
+        if (CKR_OK == *pError) {
+            *pError = CKR_GENERAL_ERROR;
+        }
+
+        goto done;
+    }
+
+    if (!itemOpt) {
+        rv = nss_ZNEW(arenaOpt, NSSItem);
+        if (!rv) {
+            *pError = CKR_HOST_MEMORY;
+            goto done;
+        }
+    } else {
+        rv = itemOpt;
+    }
+
+    if (!rv->data) {
+        rv->size = mdItem.item->size;
+        rv->data = nss_ZAlloc(arenaOpt, rv->size);
+        if (!rv->data) {
+            *pError = CKR_HOST_MEMORY;
+            if (!itemOpt) {
+                nss_ZFreeIf(rv);
+            }
+            rv = (NSSItem *)NULL;
+            goto done;
+        }
+    } else {
+        if (rv->size >= mdItem.item->size) {
+            rv->size = mdItem.item->size;
+        } else {
+            *pError = CKR_BUFFER_TOO_SMALL;
+            /* Should we set rv->size to mdItem->size? */
+            /* rv can't have been allocated */
+            rv = (NSSItem *)NULL;
+            goto done;
+        }
+    }
+
+    (void)nsslibc_memcpy(rv->data, mdItem.item->data, rv->size);
+
+    if (PR_TRUE == mdItem.needsFreeing) {
+        PR_ASSERT(fwObject->mdObject->FreeAttribute);
+        if (fwObject->mdObject->FreeAttribute) {
+            *pError = fwObject->mdObject->FreeAttribute(&mdItem);
+        }
+    }
+
+done:
+    (void)nssCKFWMutex_Unlock(fwObject->mutex);
+    return rv;
+}
+
+/*
+ * nssCKFWObject_SetAttribute
+ *
+ */
+NSS_IMPLEMENT CK_RV
+nssCKFWObject_SetAttribute(
+    NSSCKFWObject *fwObject,
+    NSSCKFWSession *fwSession,
+    CK_ATTRIBUTE_TYPE attribute,
+    NSSItem *value)
+{
+    CK_RV error = CKR_OK;
+
+#ifdef NSSDEBUG
+    error = nssCKFWObject_verifyPointer(fwObject);
+    if (CKR_OK != error) {
+        return error;
+    }
+#endif /* NSSDEBUG */
+
+    if (CKA_TOKEN == attribute) {
+        /*
+         * We're changing from a session object to a token object or
+         * vice-versa.
+         */
+
+        CK_ATTRIBUTE a;
+        NSSCKFWObject *newFwObject;
+        NSSCKFWObject swab;
+
+        a.type = CKA_TOKEN;
+        a.pValue = value->data;
+        a.ulValueLen = value->size;
+
+        newFwObject = nssCKFWSession_CopyObject(fwSession, fwObject,
+                                                &a, 1, &error);
+        if (!newFwObject) {
+            if (CKR_OK == error) {
+                error = CKR_GENERAL_ERROR;
+            }
+            return error;
+        }
+
+        /*
+         * Actually, I bet the locking is worse than this.. this part of
+         * the code could probably use some scrutiny and reworking.
+         */
+        error = nssCKFWMutex_Lock(fwObject->mutex);
+        if (CKR_OK != error) {
+            nssCKFWObject_Destroy(newFwObject);
+            return error;
+        }
+
+        error = nssCKFWMutex_Lock(newFwObject->mutex);
+        if (CKR_OK != error) {
+            nssCKFWMutex_Unlock(fwObject->mutex);
+            nssCKFWObject_Destroy(newFwObject);
+            return error;
+        }
+
+        /*
+         * Now, we have our new object, but it has a new fwObject pointer,
+         * while we have to keep the existing one.  So quick swap the contents.
+         */
+        swab = *fwObject;
+        *fwObject = *newFwObject;
+        *newFwObject = swab;
+
+        /* But keep the mutexes the same */
+        swab.mutex = fwObject->mutex;
+        fwObject->mutex = newFwObject->mutex;
+        newFwObject->mutex = swab.mutex;
+
+        (void)nssCKFWMutex_Unlock(newFwObject->mutex);
+        (void)nssCKFWMutex_Unlock(fwObject->mutex);
+
+        /*
+         * Either remove or add this to the list of session objects
+         */
+
+        if (CK_FALSE == *(CK_BBOOL *)value->data) {
+            /*
+             * New one is a session object, except since we "stole" the fwObject, it's
+             * not in the list.  Add it.
+             */
+            nssCKFWSession_RegisterSessionObject(fwSession, fwObject);
+        } else {
+            /*
+             * New one is a token object, except since we "stole" the fwObject, it's
+             * in the list.  Remove it.
+             */
+            if (fwObject->fwSession) {
+                nssCKFWSession_DeregisterSessionObject(fwObject->fwSession, fwObject);
+            }
+        }
+
+        /*
+         * Now delete the old object.  Remember the names have changed.
+         */
+        nssCKFWObject_Destroy(newFwObject);
+
+        return CKR_OK;
+    } else {
+        /*
+         * An "ordinary" change.
+         */
+        if (!fwObject->mdObject->SetAttribute) {
+            /* We could fake it with copying, like above.. later */
+            return CKR_ATTRIBUTE_READ_ONLY;
+        }
+
+        error = nssCKFWMutex_Lock(fwObject->mutex);
+        if (CKR_OK != error) {
+            return error;
+        }
+
+        error = fwObject->mdObject->SetAttribute(fwObject->mdObject, fwObject,
+                                                 fwObject->mdSession, fwObject->fwSession, fwObject->mdToken,
+                                                 fwObject->fwToken, fwObject->mdInstance, fwObject->fwInstance,
+                                                 attribute, value);
+
+        (void)nssCKFWMutex_Unlock(fwObject->mutex);
+
+        return error;
+    }
+}
+
+/*
+ * nssCKFWObject_GetObjectSize
+ *
+ */
+NSS_IMPLEMENT CK_ULONG
+nssCKFWObject_GetObjectSize(
+    NSSCKFWObject *fwObject,
+    CK_RV *pError)
+{
+    CK_ULONG rv;
+
+#ifdef NSSDEBUG
+    if (!pError) {
+        return (CK_ULONG)0;
+    }
+
+    *pError = nssCKFWObject_verifyPointer(fwObject);
+    if (CKR_OK != *pError) {
+        return (CK_ULONG)0;
+    }
+#endif /* NSSDEBUG */
+
+    if (!fwObject->mdObject->GetObjectSize) {
+        *pError = CKR_INFORMATION_SENSITIVE;
+        return (CK_ULONG)0;
+    }
+
+    *pError = nssCKFWMutex_Lock(fwObject->mutex);
+    if (CKR_OK != *pError) {
+        return (CK_ULONG)0;
+    }
+
+    rv = fwObject->mdObject->GetObjectSize(fwObject->mdObject, fwObject,
+                                           fwObject->mdSession, fwObject->fwSession, fwObject->mdToken,
+                                           fwObject->fwToken, fwObject->mdInstance, fwObject->fwInstance,
+                                           pError);
+
+    (void)nssCKFWMutex_Unlock(fwObject->mutex);
+    return rv;
+}
+
+/*
+ * NSSCKFWObject_GetMDObject
+ *
+ */
+NSS_IMPLEMENT NSSCKMDObject *
+NSSCKFWObject_GetMDObject(
+    NSSCKFWObject *fwObject)
+{
+#ifdef DEBUG
+    if (CKR_OK != nssCKFWObject_verifyPointer(fwObject)) {
+        return (NSSCKMDObject *)NULL;
+    }
+#endif /* DEBUG */
+
+    return nssCKFWObject_GetMDObject(fwObject);
+}
+
+/*
+ * NSSCKFWObject_GetArena
+ *
+ */
+NSS_IMPLEMENT NSSArena *
+NSSCKFWObject_GetArena(
+    NSSCKFWObject *fwObject,
+    CK_RV *pError)
+{
+#ifdef DEBUG
+    if (!pError) {
+        return (NSSArena *)NULL;
+    }
+
+    *pError = nssCKFWObject_verifyPointer(fwObject);
+    if (CKR_OK != *pError) {
+        return (NSSArena *)NULL;
+    }
+#endif /* DEBUG */
+
+    return nssCKFWObject_GetArena(fwObject, pError);
+}
+
+/*
+ * NSSCKFWObject_IsTokenObject
+ *
+ */
+NSS_IMPLEMENT CK_BBOOL
+NSSCKFWObject_IsTokenObject(
+    NSSCKFWObject *fwObject)
+{
+#ifdef DEBUG
+    if (CKR_OK != nssCKFWObject_verifyPointer(fwObject)) {
+        return CK_FALSE;
+    }
+#endif /* DEBUG */
+
+    return nssCKFWObject_IsTokenObject(fwObject);
+}
+
+/*
+ * NSSCKFWObject_GetAttributeCount
+ *
+ */
+NSS_IMPLEMENT CK_ULONG
+NSSCKFWObject_GetAttributeCount(
+    NSSCKFWObject *fwObject,
+    CK_RV *pError)
+{
+#ifdef DEBUG
+    if (!pError) {
+        return (CK_ULONG)0;
+    }
+
+    *pError = nssCKFWObject_verifyPointer(fwObject);
+    if (CKR_OK != *pError) {
+        return (CK_ULONG)0;
+    }
+#endif /* DEBUG */
+
+    return nssCKFWObject_GetAttributeCount(fwObject, pError);
+}
+
+/*
+ * NSSCKFWObject_GetAttributeTypes
+ *
+ */
+NSS_IMPLEMENT CK_RV
+NSSCKFWObject_GetAttributeTypes(
+    NSSCKFWObject *fwObject,
+    CK_ATTRIBUTE_TYPE_PTR typeArray,
+    CK_ULONG ulCount)
+{
+#ifdef DEBUG
+    CK_RV error = CKR_OK;
+
+    error = nssCKFWObject_verifyPointer(fwObject);
+    if (CKR_OK != error) {
+        return error;
+    }
+
+    if ((CK_ATTRIBUTE_TYPE_PTR)NULL == typeArray) {
+        return CKR_ARGUMENTS_BAD;
+    }
+#endif /* DEBUG */
+
+    return nssCKFWObject_GetAttributeTypes(fwObject, typeArray, ulCount);
+}
+
+/*
+ * NSSCKFWObject_GetAttributeSize
+ *
+ */
+NSS_IMPLEMENT CK_ULONG
+NSSCKFWObject_GetAttributeSize(
+    NSSCKFWObject *fwObject,
+    CK_ATTRIBUTE_TYPE attribute,
+    CK_RV *pError)
+{
+#ifdef DEBUG
+    if (!pError) {
+        return (CK_ULONG)0;
+    }
+
+    *pError = nssCKFWObject_verifyPointer(fwObject);
+    if (CKR_OK != *pError) {
+        return (CK_ULONG)0;
+    }
+#endif /* DEBUG */
+
+    return nssCKFWObject_GetAttributeSize(fwObject, attribute, pError);
+}
+
+/*
+ * NSSCKFWObject_GetAttribute
+ *
+ */
+NSS_IMPLEMENT NSSItem *
+NSSCKFWObject_GetAttribute(
+    NSSCKFWObject *fwObject,
+    CK_ATTRIBUTE_TYPE attribute,
+    NSSItem *itemOpt,
+    NSSArena *arenaOpt,
+    CK_RV *pError)
+{
+#ifdef DEBUG
+    if (!pError) {
+        return (NSSItem *)NULL;
+    }
+
+    *pError = nssCKFWObject_verifyPointer(fwObject);
+    if (CKR_OK != *pError) {
+        return (NSSItem *)NULL;
+    }
+#endif /* DEBUG */
+
+    return nssCKFWObject_GetAttribute(fwObject, attribute, itemOpt, arenaOpt, pError);
+}
+
+/*
+ * NSSCKFWObject_GetObjectSize
+ *
+ */
+NSS_IMPLEMENT CK_ULONG
+NSSCKFWObject_GetObjectSize(
+    NSSCKFWObject *fwObject,
+    CK_RV *pError)
+{
+#ifdef DEBUG
+    if (!pError) {
+        return (CK_ULONG)0;
+    }
+
+    *pError = nssCKFWObject_verifyPointer(fwObject);
+    if (CKR_OK != *pError) {
+        return (CK_ULONG)0;
+    }
+#endif /* DEBUG */
+
+    return nssCKFWObject_GetObjectSize(fwObject, pError);
+}