| --- misc/xmlsec1-1.2.14/include/xmlsec/mscrypto/Makefile.am 2009-06-25 22:53:18.000000000 +0200 |
| +++ misc/build/xmlsec1-1.2.14/include/xmlsec/mscrypto/Makefile.am 2009-09-21 14:02:48.563253008 +0200 |
| @@ -3,6 +3,7 @@ |
| xmlsecmscryptoincdir = $(includedir)/xmlsec1/xmlsec/mscrypto |
| |
| xmlsecmscryptoinc_HEADERS = \ |
| +akmngr.h \ |
| app.h \ |
| certkeys.h \ |
| crypto.h \ |
| --- misc/xmlsec1-1.2.14/include/xmlsec/mscrypto/Makefile.in 2009-06-25 22:53:30.000000000 +0200 |
| +++ misc/build/xmlsec1-1.2.14/include/xmlsec/mscrypto/Makefile.in 2009-09-21 14:02:48.571021349 +0200 |
| @@ -281,6 +281,7 @@ |
| NULL = |
| xmlsecmscryptoincdir = $(includedir)/xmlsec1/xmlsec/mscrypto |
| xmlsecmscryptoinc_HEADERS = \ |
| +akmngr.h \ |
| app.h \ |
| certkeys.h \ |
| crypto.h \ |
| --- misc/xmlsec1-1.2.14/include/xmlsec/mscrypto/akmngr.h 2009-09-21 14:07:19.052318336 +0200 |
| +++ misc/build/xmlsec1-1.2.14/include/xmlsec/mscrypto/akmngr.h 2009-09-21 14:02:48.504966762 +0200 |
| @@ -1 +1,71 @@ |
| -dummy |
| +/** |
| + * XMLSec library |
| + * |
| + * This is free software; see Copyright file in the source |
| + * distribution for preciese wording. |
| + * |
| + * Copyright .......................... |
| + */ |
| +#ifndef __XMLSEC_MSCRYPTO_AKMNGR_H__ |
| +#define __XMLSEC_MSCRYPTO_AKMNGR_H__ |
| + |
| +#include <windows.h> |
| +#include <wincrypt.h> |
| + |
| +#include <xmlsec/xmlsec.h> |
| +#include <xmlsec/keys.h> |
| +#include <xmlsec/transforms.h> |
| + |
| +#ifdef __cplusplus |
| +extern "C" { |
| +#endif /* __cplusplus */ |
| + |
| +XMLSEC_CRYPTO_EXPORT xmlSecKeysMngrPtr |
| +xmlSecMSCryptoAppliedKeysMngrCreate( |
| + HCERTSTORE keyStore , |
| + HCERTSTORE certStore |
| +) ; |
| + |
| +XMLSEC_CRYPTO_EXPORT int |
| +xmlSecMSCryptoAppliedKeysMngrSymKeyLoad( |
| + xmlSecKeysMngrPtr mngr , |
| + HCRYPTKEY symKey |
| +) ; |
| + |
| +XMLSEC_CRYPTO_EXPORT int |
| +xmlSecMSCryptoAppliedKeysMngrPubKeyLoad( |
| + xmlSecKeysMngrPtr mngr , |
| + HCRYPTKEY pubKey |
| +) ; |
| + |
| +XMLSEC_CRYPTO_EXPORT int |
| +xmlSecMSCryptoAppliedKeysMngrPriKeyLoad( |
| + xmlSecKeysMngrPtr mngr , |
| + HCRYPTKEY priKey |
| +) ; |
| + |
| +XMLSEC_CRYPTO_EXPORT int |
| +xmlSecMSCryptoAppliedKeysMngrAdoptKeyStore ( |
| + xmlSecKeysMngrPtr mngr , |
| + HCERTSTORE keyStore |
| +) ; |
| + |
| +XMLSEC_CRYPTO_EXPORT int |
| +xmlSecMSCryptoAppliedKeysMngrAdoptTrustedStore ( |
| + xmlSecKeysMngrPtr mngr , |
| + HCERTSTORE trustedStore |
| +) ; |
| + |
| +XMLSEC_CRYPTO_EXPORT int |
| +xmlSecMSCryptoAppliedKeysMngrAdoptUntrustedStore ( |
| + xmlSecKeysMngrPtr mngr , |
| + HCERTSTORE untrustedStore |
| +) ; |
| + |
| +#ifdef __cplusplus |
| +} |
| +#endif /* __cplusplus */ |
| + |
| +#endif /* __XMLSEC_MSCRYPTO_AKMNGR_H__ */ |
| + |
| + |
| --- misc/xmlsec1-1.2.14/include/xmlsec/nss/Makefile.am 2009-06-25 22:53:18.000000000 +0200 |
| +++ misc/build/xmlsec1-1.2.14/include/xmlsec/nss/Makefile.am 2009-09-21 14:02:48.577933031 +0200 |
| @@ -10,6 +10,9 @@ |
| keysstore.h \ |
| pkikeys.h \ |
| x509.h \ |
| +akmngr.h \ |
| +tokens.h \ |
| +ciphers.h \ |
| $(NULL) |
| |
| install-exec-hook: |
| --- misc/xmlsec1-1.2.14/include/xmlsec/nss/Makefile.in 2009-06-25 22:53:31.000000000 +0200 |
| +++ misc/build/xmlsec1-1.2.14/include/xmlsec/nss/Makefile.in 2009-09-21 14:02:48.585376325 +0200 |
| @@ -288,6 +288,9 @@ |
| keysstore.h \ |
| pkikeys.h \ |
| x509.h \ |
| +akmngr.h \ |
| +tokens.h \ |
| +ciphers.h \ |
| $(NULL) |
| |
| all: all-am |
| --- misc/xmlsec1-1.2.14/include/xmlsec/nss/akmngr.h 2009-09-21 14:07:19.105517659 +0200 |
| +++ misc/build/xmlsec1-1.2.14/include/xmlsec/nss/akmngr.h 2009-09-21 14:02:48.510978278 +0200 |
| @@ -1 +1,56 @@ |
| -dummy |
| +/** |
| + * XMLSec library |
| + * |
| + * This is free software; see Copyright file in the source |
| + * distribution for preciese wording. |
| + * |
| + * Copyright .......................... |
| + */ |
| +#ifndef __XMLSEC_NSS_AKMNGR_H__ |
| +#define __XMLSEC_NSS_AKMNGR_H__ |
| + |
| +#include <nss.h> |
| +#include <nspr.h> |
| +#include <pk11func.h> |
| +#include <cert.h> |
| + |
| +#include <xmlsec/xmlsec.h> |
| +#include <xmlsec/keys.h> |
| +#include <xmlsec/transforms.h> |
| + |
| +#ifdef __cplusplus |
| +extern "C" { |
| +#endif /* __cplusplus */ |
| + |
| +XMLSEC_CRYPTO_EXPORT xmlSecKeysMngrPtr |
| +xmlSecNssAppliedKeysMngrCreate( |
| + PK11SlotInfo** slots, |
| + int cSlots, |
| + CERTCertDBHandle* handler |
| +) ; |
| + |
| +XMLSEC_CRYPTO_EXPORT int |
| +xmlSecNssAppliedKeysMngrSymKeyLoad( |
| + xmlSecKeysMngrPtr mngr , |
| + PK11SymKey* symKey |
| +) ; |
| + |
| +XMLSEC_CRYPTO_EXPORT int |
| +xmlSecNssAppliedKeysMngrPubKeyLoad( |
| + xmlSecKeysMngrPtr mngr , |
| + SECKEYPublicKey* pubKey |
| +) ; |
| + |
| +XMLSEC_CRYPTO_EXPORT int |
| +xmlSecNssAppliedKeysMngrPriKeyLoad( |
| + xmlSecKeysMngrPtr mngr , |
| + SECKEYPrivateKey* priKey |
| +) ; |
| + |
| +#ifdef __cplusplus |
| +} |
| +#endif /* __cplusplus */ |
| + |
| +#endif /* __XMLSEC_NSS_AKMNGR_H__ */ |
| + |
| + |
| --- misc/xmlsec1-1.2.14/include/xmlsec/nss/app.h 2009-06-25 22:53:18.000000000 +0200 |
| +++ misc/build/xmlsec1-1.2.14/include/xmlsec/nss/app.h 2009-09-21 14:02:48.612847068 +0200 |
| @@ -22,6 +22,9 @@ |
| #include <xmlsec/keysmngr.h> |
| #include <xmlsec/transforms.h> |
| |
| +#include <xmlsec/nss/tokens.h> |
| +#include <xmlsec/nss/akmngr.h> |
| + |
| /** |
| * Init/shutdown |
| */ |
| @@ -36,6 +39,8 @@ |
| xmlSecKeyPtr key); |
| XMLSEC_CRYPTO_EXPORT int xmlSecNssAppDefaultKeysMngrLoad (xmlSecKeysMngrPtr mngr, |
| const char* uri); |
| +XMLSEC_CRYPTO_EXPORT int xmlSecNssAppDefaultKeysMngrAdoptKeySlot(xmlSecKeysMngrPtr mngr, |
| + xmlSecNssKeySlotPtr keySlot); |
| XMLSEC_CRYPTO_EXPORT int xmlSecNssAppDefaultKeysMngrSave (xmlSecKeysMngrPtr mngr, |
| const char* filename, |
| xmlSecKeyDataType type); |
| --- misc/xmlsec1-1.2.14/include/xmlsec/nss/ciphers.h 2009-09-21 14:07:19.146496548 +0200 |
| +++ misc/build/xmlsec1-1.2.14/include/xmlsec/nss/ciphers.h 2009-09-21 14:02:48.516689712 +0200 |
| @@ -1 +1,35 @@ |
| -dummy |
| +/** |
| + * XMLSec library |
| + * |
| + * This is free software; see Copyright file in the source |
| + * distribution for preciese wording. |
| + * |
| + * Copyright .......................... |
| + */ |
| +#ifndef __XMLSEC_NSS_CIPHERS_H__ |
| +#define __XMLSEC_NSS_CIPHERS_H__ |
| + |
| +#ifdef __cplusplus |
| +extern "C" { |
| +#endif /* __cplusplus */ |
| + |
| +#include <xmlsec/xmlsec.h> |
| +#include <xmlsec/keys.h> |
| +#include <xmlsec/transforms.h> |
| + |
| + |
| +XMLSEC_CRYPTO_EXPORT int xmlSecNssSymKeyDataAdoptKey( xmlSecKeyDataPtr data, |
| + PK11SymKey* symkey ) ; |
| + |
| +XMLSEC_CRYPTO_EXPORT xmlSecKeyDataPtr xmlSecNssSymKeyDataKeyAdopt( PK11SymKey* symKey ) ; |
| + |
| +XMLSEC_CRYPTO_EXPORT PK11SymKey* xmlSecNssSymKeyDataGetKey(xmlSecKeyDataPtr data); |
| + |
| + |
| +#ifdef __cplusplus |
| +} |
| +#endif /* __cplusplus */ |
| + |
| +#endif /* __XMLSEC_NSS_CIPHERS_H__ */ |
| + |
| + |
| --- misc/xmlsec1-1.2.14/include/xmlsec/nss/keysstore.h 2009-06-25 22:53:18.000000000 +0200 |
| +++ misc/build/xmlsec1-1.2.14/include/xmlsec/nss/keysstore.h 2009-09-21 14:02:48.626261748 +0200 |
| @@ -16,6 +16,8 @@ |
| #endif /* __cplusplus */ |
| |
| #include <xmlsec/xmlsec.h> |
| +#include <xmlsec/keysmngr.h> |
| +#include <xmlsec/nss/tokens.h> |
| |
| /**************************************************************************** |
| * |
| @@ -31,6 +33,8 @@ |
| XMLSEC_CRYPTO_EXPORT xmlSecKeyStoreId xmlSecNssKeysStoreGetKlass (void); |
| XMLSEC_CRYPTO_EXPORT int xmlSecNssKeysStoreAdoptKey (xmlSecKeyStorePtr store, |
| xmlSecKeyPtr key); |
| +XMLSEC_CRYPTO_EXPORT int xmlSecNssKeysStoreAdoptKeySlot(xmlSecKeyStorePtr store, |
| + xmlSecNssKeySlotPtr keySlot); |
| XMLSEC_CRYPTO_EXPORT int xmlSecNssKeysStoreLoad (xmlSecKeyStorePtr store, |
| const char *uri, |
| xmlSecKeysMngrPtr keysMngr); |
| --- misc/xmlsec1-1.2.14/include/xmlsec/nss/tokens.h 2009-09-21 14:07:19.172421448 +0200 |
| +++ misc/build/xmlsec1-1.2.14/include/xmlsec/nss/tokens.h 2009-09-21 14:02:48.522913605 +0200 |
| @@ -1 +1,182 @@ |
| -dummy |
| +/** |
| + * XMLSec library |
| + * |
| + * This is free software; see Copyright file in the source |
| + * distribution for preciese wording. |
| + * |
| + * Copyright (c) 2003 Sun Microsystems, Inc. All rights reserved. |
| + * |
| + * Contributor(s): _____________________________ |
| + * |
| + */ |
| +#ifndef __XMLSEC_NSS_TOKENS_H__ |
| +#define __XMLSEC_NSS_TOKENS_H__ |
| + |
| +#include <string.h> |
| + |
| +#include <nss.h> |
| +#include <pk11func.h> |
| + |
| +#include <xmlsec/xmlsec.h> |
| +#include <xmlsec/list.h> |
| + |
| +#ifdef __cplusplus |
| +extern "C" { |
| +#endif /* __cplusplus */ |
| + |
| +/** |
| + * xmlSecNssKeySlotListId |
| + * |
| + * The crypto mechanism list klass |
| + */ |
| +#define xmlSecNssKeySlotListId xmlSecNssKeySlotListGetKlass() |
| +XMLSEC_CRYPTO_EXPORT xmlSecPtrListId xmlSecNssKeySlotListGetKlass( void ) ; |
| + |
| +/******************************************* |
| + * KeySlot interfaces |
| + *******************************************/ |
| +/** |
| + * Internal NSS key slot data |
| + * @mechanismList: the mechanisms that the slot bound with. |
| + * @slot: the pkcs slot |
| + * |
| + * This context is located after xmlSecPtrList |
| + */ |
| +typedef struct _xmlSecNssKeySlot xmlSecNssKeySlot ; |
| +typedef struct _xmlSecNssKeySlot* xmlSecNssKeySlotPtr ; |
| + |
| +struct _xmlSecNssKeySlot { |
| + CK_MECHANISM_TYPE_PTR mechanismList ; /* mech. array, NULL ternimated */ |
| + PK11SlotInfo* slot ; |
| +} ; |
| + |
| +XMLSEC_CRYPTO_EXPORT int |
| +xmlSecNssKeySlotSetMechList( |
| + xmlSecNssKeySlotPtr keySlot , |
| + CK_MECHANISM_TYPE_PTR mechanismList |
| +) ; |
| + |
| +XMLSEC_CRYPTO_EXPORT int |
| +xmlSecNssKeySlotEnableMech( |
| + xmlSecNssKeySlotPtr keySlot , |
| + CK_MECHANISM_TYPE mechanism |
| +) ; |
| + |
| +XMLSEC_CRYPTO_EXPORT int |
| +xmlSecNssKeySlotDisableMech( |
| + xmlSecNssKeySlotPtr keySlot , |
| + CK_MECHANISM_TYPE mechanism |
| +) ; |
| + |
| +XMLSEC_CRYPTO_EXPORT CK_MECHANISM_TYPE_PTR |
| +xmlSecNssKeySlotGetMechList( |
| + xmlSecNssKeySlotPtr keySlot |
| +) ; |
| + |
| +XMLSEC_CRYPTO_EXPORT int |
| +xmlSecNssKeySlotSetSlot( |
| + xmlSecNssKeySlotPtr keySlot , |
| + PK11SlotInfo* slot |
| +) ; |
| + |
| +XMLSEC_CRYPTO_EXPORT int |
| +xmlSecNssKeySlotInitialize( |
| + xmlSecNssKeySlotPtr keySlot , |
| + PK11SlotInfo* slot |
| +) ; |
| + |
| +XMLSEC_CRYPTO_EXPORT void |
| +xmlSecNssKeySlotFinalize( |
| + xmlSecNssKeySlotPtr keySlot |
| +) ; |
| + |
| +XMLSEC_CRYPTO_EXPORT PK11SlotInfo* |
| +xmlSecNssKeySlotGetSlot( |
| + xmlSecNssKeySlotPtr keySlot |
| +) ; |
| + |
| +XMLSEC_CRYPTO_EXPORT xmlSecNssKeySlotPtr |
| +xmlSecNssKeySlotCreate() ; |
| + |
| +XMLSEC_CRYPTO_EXPORT int |
| +xmlSecNssKeySlotCopy( |
| + xmlSecNssKeySlotPtr newKeySlot , |
| + xmlSecNssKeySlotPtr keySlot |
| +) ; |
| + |
| +XMLSEC_CRYPTO_EXPORT xmlSecNssKeySlotPtr |
| +xmlSecNssKeySlotDuplicate( |
| + xmlSecNssKeySlotPtr keySlot |
| +) ; |
| + |
| +XMLSEC_CRYPTO_EXPORT void |
| +xmlSecNssKeySlotDestroy( |
| + xmlSecNssKeySlotPtr keySlot |
| +) ; |
| + |
| +XMLSEC_CRYPTO_EXPORT int |
| +xmlSecNssKeySlotBindMech( |
| + xmlSecNssKeySlotPtr keySlot , |
| + CK_MECHANISM_TYPE type |
| +) ; |
| + |
| +XMLSEC_CRYPTO_EXPORT int |
| +xmlSecNssKeySlotSupportMech( |
| + xmlSecNssKeySlotPtr keySlot , |
| + CK_MECHANISM_TYPE type |
| +) ; |
| + |
| + |
| +/************************************************************************ |
| + * PKCS#11 crypto token interfaces |
| + * |
| + * A PKCS#11 slot repository will be defined internally. From the |
| + * repository, a user can specify a particular slot for a certain crypto |
| + * mechanism. |
| + * |
| + * In some situation, some cryptographic operation should act in a user |
| + * designated devices. The interfaces defined here provide the way. If |
| + * the user do not initialize the repository distinctly, the interfaces |
| + * use the default functions provided by NSS itself. |
| + * |
| + ************************************************************************/ |
| +/** |
| + * Initialize NSS pkcs#11 slot repository |
| + * |
| + * Returns 0 if success or -1 if an error occurs. |
| + */ |
| +XMLSEC_CRYPTO_EXPORT int xmlSecNssSlotInitialize( void ) ; |
| + |
| +/** |
| + * Shutdown and destroy NSS pkcs#11 slot repository |
| + */ |
| +XMLSEC_CRYPTO_EXPORT void xmlSecNssSlotShutdown() ; |
| + |
| +/** |
| + * Get PKCS#11 slot handler |
| + * @type the mechanism that the slot must support. |
| + * |
| + * Returns a pointer to PKCS#11 slot or NULL if an error occurs. |
| + * |
| + * Notes: The returned handler must be destroied distinctly. |
| + */ |
| +XMLSEC_CRYPTO_EXPORT PK11SlotInfo* xmlSecNssSlotGet( CK_MECHANISM_TYPE type ) ; |
| + |
| +/** |
| + * Adopt a pkcs#11 slot with a mechanism into the repository |
| + * @slot: the pkcs#11 slot. |
| + * @mech: the mechanism. |
| + * |
| + * If @mech is available( @mech != CKM_INVALID_MECHANISM ), every operation with |
| + * this mechanism only can perform on the @slot. |
| + * |
| + * Returns 0 if success or -1 if an error occurs. |
| + */ |
| +XMLSEC_CRYPTO_EXPORT int xmlSecNssSlotAdopt( PK11SlotInfo* slot, CK_MECHANISM_TYPE mech ) ; |
| + |
| +#ifdef __cplusplus |
| +} |
| +#endif /* __cplusplus */ |
| + |
| +#endif /* __XMLSEC_NSS_TOKENS_H__ */ |
| + |
| --- misc/xmlsec1-1.2.14/src/mscrypto/akmngr.c 2009-09-21 14:07:19.078910929 +0200 |
| +++ misc/build/xmlsec1-1.2.14/src/mscrypto/akmngr.c 2009-09-21 14:02:48.531281225 +0200 |
| @@ -1 +1,236 @@ |
| -dummy |
| +/** |
| + * XMLSec library |
| + * |
| + * This is free software; see Copyright file in the source |
| + * distribution for preciese wording. |
| + * |
| + * Copyright......................... |
| + */ |
| +#include "globals.h" |
| + |
| +#include <xmlsec/xmlsec.h> |
| +#include <xmlsec/keys.h> |
| +#include <xmlsec/keysmngr.h> |
| +#include <xmlsec/transforms.h> |
| +#include <xmlsec/errors.h> |
| + |
| +#include <xmlsec/mscrypto/crypto.h> |
| +#include <xmlsec/mscrypto/keysstore.h> |
| +#include <xmlsec/mscrypto/akmngr.h> |
| +#include <xmlsec/mscrypto/x509.h> |
| + |
| +/** |
| + * xmlSecMSCryptoAppliedKeysMngrCreate: |
| + * @hKeyStore: the pointer to key store. |
| + * @hCertStore: the pointer to certificate database. |
| + * |
| + * Create and load key store and certificate database into keys manager |
| + * |
| + * Returns keys manager pointer on success or NULL otherwise. |
| + */ |
| +xmlSecKeysMngrPtr |
| +xmlSecMSCryptoAppliedKeysMngrCreate( |
| + HCERTSTORE hKeyStore , |
| + HCERTSTORE hCertStore |
| +) { |
| + xmlSecKeyDataStorePtr certStore = NULL ; |
| + xmlSecKeysMngrPtr keyMngr = NULL ; |
| + xmlSecKeyStorePtr keyStore = NULL ; |
| + |
| + keyStore = xmlSecKeyStoreCreate( xmlSecMSCryptoKeysStoreId ) ; |
| + if( keyStore == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecKeyStoreCreate" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return NULL ; |
| + } |
| + |
| + /*- |
| + * At present, MS Crypto engine do not provide a way to setup a key store. |
| + */ |
| + if( keyStore != NULL ) { |
| + /*TODO: binding key store.*/ |
| + } |
| + |
| + keyMngr = xmlSecKeysMngrCreate() ; |
| + if( keyMngr == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecKeysMngrCreate" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + |
| + xmlSecKeyStoreDestroy( keyStore ) ; |
| + return NULL ; |
| + } |
| + |
| + /*- |
| + * Add key store to manager, from now on keys manager destroys the store if |
| + * needed |
| + */ |
| + if( xmlSecKeysMngrAdoptKeysStore( keyMngr, keyStore ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyStoreGetName( keyStore ) ) , |
| + "xmlSecKeysMngrAdoptKeyStore" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + |
| + xmlSecKeyStoreDestroy( keyStore ) ; |
| + xmlSecKeysMngrDestroy( keyMngr ) ; |
| + return NULL ; |
| + } |
| + |
| + /*- |
| + * Initialize crypto library specific data in keys manager |
| + */ |
| + if( xmlSecMSCryptoKeysMngrInit( keyMngr ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecMSCryptoKeysMngrInit" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + |
| + xmlSecKeysMngrDestroy( keyMngr ) ; |
| + return NULL ; |
| + } |
| + |
| + /*- |
| + * Set certificate databse to X509 key data store |
| + */ |
| + /*- |
| + * At present, MS Crypto engine do not provide a way to setup a cert store. |
| + */ |
| + |
| + /*- |
| + * Set the getKey callback |
| + */ |
| + keyMngr->getKey = xmlSecKeysMngrGetKey ; |
| + |
| + return keyMngr ; |
| +} |
| + |
| +int |
| +xmlSecMSCryptoAppliedKeysMngrSymKeyLoad( |
| + xmlSecKeysMngrPtr mngr , |
| + HCRYPTKEY symKey |
| +) { |
| + /*TODO: import the key into keys manager.*/ |
| + return(0) ; |
| +} |
| + |
| +int |
| +xmlSecMSCryptoAppliedKeysMngrPubKeyLoad( |
| + xmlSecKeysMngrPtr mngr , |
| + HCRYPTKEY pubKey |
| +) { |
| + /*TODO: import the key into keys manager.*/ |
| + return(0) ; |
| +} |
| + |
| +int |
| +xmlSecMSCryptoAppliedKeysMngrPriKeyLoad( |
| + xmlSecKeysMngrPtr mngr , |
| + HCRYPTKEY priKey |
| +) { |
| + /*TODO: import the key into keys manager.*/ |
| + return(0) ; |
| +} |
| + |
| +int |
| +xmlSecMSCryptoAppliedKeysMngrAdoptKeyStore ( |
| + xmlSecKeysMngrPtr mngr , |
| + HCERTSTORE keyStore |
| +) { |
| + xmlSecKeyDataStorePtr x509Store ; |
| + |
| + xmlSecAssert2( mngr != NULL, -1 ) ; |
| + xmlSecAssert2( keyStore != NULL, -1 ) ; |
| + |
| + x509Store = xmlSecKeysMngrGetDataStore( mngr, xmlSecMSCryptoX509StoreId ) ; |
| + if( x509Store == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecKeysMngrGetDataStore" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return( -1 ) ; |
| + } |
| + |
| + if( xmlSecMSCryptoX509StoreAdoptKeyStore( x509Store, keyStore ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyDataStoreGetName( x509Store ) ) , |
| + "xmlSecMSCryptoX509StoreAdoptKeyStore" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return( -1 ) ; |
| + } |
| + |
| + return( 0 ) ; |
| +} |
| + |
| +int |
| +xmlSecMSCryptoAppliedKeysMngrAdoptTrustedStore ( |
| + xmlSecKeysMngrPtr mngr , |
| + HCERTSTORE trustedStore |
| +) { |
| + xmlSecKeyDataStorePtr x509Store ; |
| + |
| + xmlSecAssert2( mngr != NULL, -1 ) ; |
| + xmlSecAssert2( trustedStore != NULL, -1 ) ; |
| + |
| + x509Store = xmlSecKeysMngrGetDataStore( mngr, xmlSecMSCryptoX509StoreId ) ; |
| + if( x509Store == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecKeysMngrGetDataStore" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return( -1 ) ; |
| + } |
| + |
| + if( xmlSecMSCryptoX509StoreAdoptTrustedStore( x509Store, trustedStore ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyDataStoreGetName( x509Store ) ) , |
| + "xmlSecMSCryptoX509StoreAdoptKeyStore" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return( -1 ) ; |
| + } |
| + |
| + return( 0 ) ; |
| +} |
| + |
| +int |
| +xmlSecMSCryptoAppliedKeysMngrAdoptUntrustedStore ( |
| + xmlSecKeysMngrPtr mngr , |
| + HCERTSTORE untrustedStore |
| +) { |
| + xmlSecKeyDataStorePtr x509Store ; |
| + |
| + xmlSecAssert2( mngr != NULL, -1 ) ; |
| + xmlSecAssert2( untrustedStore != NULL, -1 ) ; |
| + |
| + x509Store = xmlSecKeysMngrGetDataStore( mngr, xmlSecMSCryptoX509StoreId ) ; |
| + if( x509Store == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecKeysMngrGetDataStore" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return( -1 ) ; |
| + } |
| + |
| + if( xmlSecMSCryptoX509StoreAdoptUntrustedStore( x509Store, untrustedStore ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyDataStoreGetName( x509Store ) ) , |
| + "xmlSecMSCryptoX509StoreAdoptKeyStore" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return( -1 ) ; |
| + } |
| + |
| + return( 0 ) ; |
| +} |
| + |
| --- misc/xmlsec1-1.2.14/src/nss/Makefile.am 2009-06-25 22:53:18.000000000 +0200 |
| +++ misc/build/xmlsec1-1.2.14/src/nss/Makefile.am 2009-09-21 14:02:48.591560472 +0200 |
| @@ -35,6 +35,9 @@ |
| kw_des.c \ |
| kw_aes.c \ |
| globals.h \ |
| + akmngr.c \ |
| + keywrapers.c \ |
| + tokens.c \ |
| $(NULL) |
| |
| if SHAREDLIB_HACK |
| --- misc/xmlsec1-1.2.14/src/nss/Makefile.in 2009-06-25 22:53:33.000000000 +0200 |
| +++ misc/build/xmlsec1-1.2.14/src/nss/Makefile.in 2009-09-21 14:02:48.599339718 +0200 |
| @@ -72,7 +72,8 @@ |
| am__libxmlsec1_nss_la_SOURCES_DIST = app.c bignum.c ciphers.c crypto.c \ |
| digests.c hmac.c pkikeys.c signatures.c symkeys.c x509.c \ |
| x509vfy.c keysstore.c keytrans.c kw_des.c kw_aes.c globals.h \ |
| - ../strings.c |
| + ../strings.c \ |
| + akmngr.c keywrapers.c tokens.c |
| am__objects_1 = |
| @SHAREDLIB_HACK_TRUE@am__objects_2 = libxmlsec1_nss_la-strings.lo |
| am_libxmlsec1_nss_la_OBJECTS = libxmlsec1_nss_la-app.lo \ |
| @@ -83,6 +84,8 @@ |
| libxmlsec1_nss_la-x509.lo libxmlsec1_nss_la-x509vfy.lo \ |
| libxmlsec1_nss_la-keysstore.lo libxmlsec1_nss_la-keytrans.lo \ |
| libxmlsec1_nss_la-kw_des.lo libxmlsec1_nss_la-kw_aes.lo \ |
| + libxmlsec1_nss_la-akmngr.lo libxmlsec1_nss_la-keywrapers.lo \ |
| + libxmlsec1_nss_la-tokens.lo \ |
| $(am__objects_1) $(am__objects_2) |
| libxmlsec1_nss_la_OBJECTS = $(am_libxmlsec1_nss_la_OBJECTS) |
| libxmlsec1_nss_la_LINK = $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) \ |
| @@ -333,6 +336,7 @@ |
| libxmlsec1_nss_la_SOURCES = app.c bignum.c ciphers.c crypto.c \ |
| digests.c hmac.c pkikeys.c signatures.c symkeys.c x509.c \ |
| x509vfy.c keysstore.c keytrans.c kw_des.c kw_aes.c globals.h \ |
| + akmngr.c keywrapers.c tokens.c \ |
| $(NULL) $(am__append_1) |
| libxmlsec1_nss_la_LIBADD = \ |
| ../libxmlsec1.la \ |
| @@ -439,6 +443,9 @@ |
| @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libxmlsec1_nss_la-symkeys.Plo@am__quote@ |
| @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libxmlsec1_nss_la-x509.Plo@am__quote@ |
| @AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libxmlsec1_nss_la-x509vfy.Plo@am__quote@ |
| +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libxmlsec1_nss_la-akmngr.Plo@am__quote@ |
| +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libxmlsec1_nss_la-keywrapers.Plo@am__quote@ |
| +@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/libxmlsec1_nss_la-tokens.Plo@am__quote@ |
| |
| .c.o: |
| @am__fastdepCC_TRUE@ $(COMPILE) -MT $@ -MD -MP -MF $(DEPDIR)/$*.Tpo -c -o $@ $< |
| @@ -468,6 +475,27 @@ |
| @AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ |
| @am__fastdepCC_FALSE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libxmlsec1_nss_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o libxmlsec1_nss_la-app.lo `test -f 'app.c' || echo '$(srcdir)/'`app.c |
| |
| +libxmlsec1_nss_la-akmngr.lo: akmngr.c |
| +@am__fastdepCC_TRUE@ if $(LIBTOOL) --mode=compile --tag=CC $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libxmlsec1_nss_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT libxmlsec1_nss_la-akmngr.lo -MD -MP -MF "$(DEPDIR)/libxmlsec1_nss_la-akmngr.Tpo" -c -o libxmlsec1_nss_la-akmngr.lo `test -f 'akmngr.c' || echo '$(srcdir)/'`akmngr.c; \ |
| +@am__fastdepCC_TRUE@ then mv -f "$(DEPDIR)/libxmlsec1_nss_la-akmngr.Tpo" "$(DEPDIR)/libxmlsec1_nss_la-akmngr.Plo"; else rm -f "$(DEPDIR)/libxmlsec1_nss_la-akmngr.Tpo"; exit 1; fi |
| +@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='akmngr.c' object='libxmlsec1_nss_la-akmngr.lo' libtool=yes @AMDEPBACKSLASH@ |
| +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ |
| +@am__fastdepCC_FALSE@ $(LIBTOOL) --mode=compile --tag=CC $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libxmlsec1_nss_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o libxmlsec1_nss_la-akmngr.lo `test -f 'akmngr.c' || echo '$(srcdir)/'`akmngr.c |
| + |
| +libxmlsec1_nss_la-keywrapers.lo: keywrapers.c |
| +@am__fastdepCC_TRUE@ if $(LIBTOOL) --mode=compile --tag=CC $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libxmlsec1_nss_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT libxmlsec1_nss_la-keywrapers.lo -MD -MP -MF "$(DEPDIR)/libxmlsec1_nss_la-keywrapers.Tpo" -c -o libxmlsec1_nss_la-keywrapers.lo `test -f 'keywrapers.c' || echo '$(srcdir)/'`keywrapers.c; \ |
| +@am__fastdepCC_TRUE@ then mv -f "$(DEPDIR)/libxmlsec1_nss_la-keywrapers.Tpo" "$(DEPDIR)/libxmlsec1_nss_la-keywrapers.Plo"; else rm -f "$(DEPDIR)/libxmlsec1_nss_la-keywrapers.Tpo"; exit 1; fi |
| +@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='keywrapers.c' object='libxmlsec1_nss_la-keywrapers.lo' libtool=yes @AMDEPBACKSLASH@ |
| +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ |
| +@am__fastdepCC_FALSE@ $(LIBTOOL) --mode=compile --tag=CC $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libxmlsec1_nss_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o libxmlsec1_nss_la-keywrapers.lo `test -f 'keywrapers.c' || echo '$(srcdir)/'`keywrapers.c |
| + |
| +libxmlsec1_nss_la-tokens.lo: tokens.c |
| +@am__fastdepCC_TRUE@ if $(LIBTOOL) --mode=compile --tag=CC $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libxmlsec1_nss_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT libxmlsec1_nss_la-tokens.lo -MD -MP -MF "$(DEPDIR)/libxmlsec1_nss_la-tokens.Tpo" -c -o libxmlsec1_nss_la-tokens.lo `test -f 'tokens.c' || echo '$(srcdir)/'`tokens.c; \ |
| +@am__fastdepCC_TRUE@ then mv -f "$(DEPDIR)/libxmlsec1_nss_la-tokens.Tpo" "$(DEPDIR)/libxmlsec1_nss_la-tokens.Plo"; else rm -f "$(DEPDIR)/libxmlsec1_nss_la-tokens.Tpo"; exit 1; fi |
| +@AMDEP_TRUE@@am__fastdepCC_FALSE@ source='tokens.c' object='libxmlsec1_nss_la-tokens.lo' libtool=yes @AMDEPBACKSLASH@ |
| +@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@ |
| +@am__fastdepCC_FALSE@ $(LIBTOOL) --mode=compile --tag=CC $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libxmlsec1_nss_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o libxmlsec1_nss_la-tokens.lo `test -f 'tokens.c' || echo '$(srcdir)/'`tokens.c |
| + |
| libxmlsec1_nss_la-bignum.lo: bignum.c |
| @am__fastdepCC_TRUE@ $(LIBTOOL) --tag=CC $(AM_LIBTOOLFLAGS) $(LIBTOOLFLAGS) --mode=compile $(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(libxmlsec1_nss_la_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT libxmlsec1_nss_la-bignum.lo -MD -MP -MF $(DEPDIR)/libxmlsec1_nss_la-bignum.Tpo -c -o libxmlsec1_nss_la-bignum.lo `test -f 'bignum.c' || echo '$(srcdir)/'`bignum.c |
| @am__fastdepCC_TRUE@ $(am__mv) $(DEPDIR)/libxmlsec1_nss_la-bignum.Tpo $(DEPDIR)/libxmlsec1_nss_la-bignum.Plo |
| --- misc/xmlsec1-1.2.14/src/nss/akmngr.c 2009-09-21 14:07:19.197249962 +0200 |
| +++ misc/build/xmlsec1-1.2.14/src/nss/akmngr.c 2009-09-21 14:02:48.539616129 +0200 |
| @@ -1 +1,384 @@ |
| -dummy |
| +/** |
| + * XMLSec library |
| + * |
| + * This is free software; see Copyright file in the source |
| + * distribution for preciese wording. |
| + * |
| + * Copyright......................... |
| + */ |
| +#include "globals.h" |
| + |
| +#include <nspr.h> |
| +#include <nss.h> |
| +#include <pk11func.h> |
| +#include <cert.h> |
| +#include <keyhi.h> |
| + |
| +#include <xmlsec/xmlsec.h> |
| +#include <xmlsec/keys.h> |
| +#include <xmlsec/transforms.h> |
| +#include <xmlsec/errors.h> |
| + |
| +#include <xmlsec/nss/crypto.h> |
| +#include <xmlsec/nss/tokens.h> |
| +#include <xmlsec/nss/akmngr.h> |
| +#include <xmlsec/nss/pkikeys.h> |
| +#include <xmlsec/nss/ciphers.h> |
| +#include <xmlsec/nss/keysstore.h> |
| + |
| +/** |
| + * xmlSecNssAppliedKeysMngrCreate: |
| + * @slot: array of pointers to NSS PKCS#11 slot infomation. |
| + * @cSlots: number of slots in the array |
| + * @handler: the pointer to NSS certificate database. |
| + * |
| + * Create and load NSS crypto slot and certificate database into keys manager |
| + * |
| + * Returns keys manager pointer on success or NULL otherwise. |
| + */ |
| +xmlSecKeysMngrPtr |
| +xmlSecNssAppliedKeysMngrCreate( |
| + PK11SlotInfo** slots, |
| + int cSlots, |
| + CERTCertDBHandle* handler |
| +) { |
| + xmlSecKeyDataStorePtr certStore = NULL ; |
| + xmlSecKeysMngrPtr keyMngr = NULL ; |
| + xmlSecKeyStorePtr keyStore = NULL ; |
| + int islot = 0; |
| + keyStore = xmlSecKeyStoreCreate( xmlSecNssKeysStoreId ) ; |
| + if( keyStore == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecKeyStoreCreate" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return NULL ; |
| + } |
| + |
| + for (islot = 0; islot < cSlots; islot++) |
| + { |
| + xmlSecNssKeySlotPtr keySlot ; |
| + |
| + /* Create a key slot */ |
| + keySlot = xmlSecNssKeySlotCreate() ; |
| + if( keySlot == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyStoreGetName( keyStore ) ) , |
| + "xmlSecNssKeySlotCreate" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + |
| + xmlSecKeyStoreDestroy( keyStore ) ; |
| + return NULL ; |
| + } |
| + |
| + /* Set slot */ |
| + if( xmlSecNssKeySlotSetSlot( keySlot , slots[islot] ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyStoreGetName( keyStore ) ) , |
| + "xmlSecNssKeySlotSetSlot" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + |
| + xmlSecKeyStoreDestroy( keyStore ) ; |
| + xmlSecNssKeySlotDestroy( keySlot ) ; |
| + return NULL ; |
| + } |
| + |
| + /* Adopt keySlot */ |
| + if( xmlSecNssKeysStoreAdoptKeySlot( keyStore , keySlot ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyStoreGetName( keyStore ) ) , |
| + "xmlSecNssKeysStoreAdoptKeySlot" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + |
| + xmlSecKeyStoreDestroy( keyStore ) ; |
| + xmlSecNssKeySlotDestroy( keySlot ) ; |
| + return NULL ; |
| + } |
| + } |
| + |
| + keyMngr = xmlSecKeysMngrCreate() ; |
| + if( keyMngr == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecKeysMngrCreate" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + |
| + xmlSecKeyStoreDestroy( keyStore ) ; |
| + return NULL ; |
| + } |
| + |
| + /*- |
| + * Add key store to manager, from now on keys manager destroys the store if |
| + * needed |
| + */ |
| + if( xmlSecKeysMngrAdoptKeysStore( keyMngr, keyStore ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyStoreGetName( keyStore ) ) , |
| + "xmlSecKeysMngrAdoptKeyStore" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + |
| + xmlSecKeyStoreDestroy( keyStore ) ; |
| + xmlSecKeysMngrDestroy( keyMngr ) ; |
| + return NULL ; |
| + } |
| + |
| + /*- |
| + * Initialize crypto library specific data in keys manager |
| + */ |
| + if( xmlSecNssKeysMngrInit( keyMngr ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecKeysMngrCreate" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + |
| + xmlSecKeysMngrDestroy( keyMngr ) ; |
| + return NULL ; |
| + } |
| + |
| + /*- |
| + * Set certificate databse to X509 key data store |
| + */ |
| + /** |
| + * Because Tej's implementation of certDB use the default DB, so I ignore |
| + * the certDB handler at present. I'll modify the cert store sources to |
| + * accept particular certDB instead of default ones. |
| + certStore = xmlSecKeysMngrGetDataStore( keyMngr , xmlSecNssKeyDataStoreX509Id ) ; |
| + if( certStore == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyStoreGetName( keyStore ) ) , |
| + "xmlSecKeysMngrGetDataStore" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + |
| + xmlSecKeysMngrDestroy( keyMngr ) ; |
| + return NULL ; |
| + } |
| + |
| + if( xmlSecNssKeyDataStoreX509SetCertDb( certStore , handler ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyStoreGetName( keyStore ) ) , |
| + "xmlSecNssKeyDataStoreX509SetCertDb" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + |
| + xmlSecKeysMngrDestroy( keyMngr ) ; |
| + return NULL ; |
| + } |
| + */ |
| + |
| + /*- |
| + * Set the getKey callback |
| + */ |
| + keyMngr->getKey = xmlSecKeysMngrGetKey ; |
| + |
| + return keyMngr ; |
| +} |
| + |
| +int |
| +xmlSecNssAppliedKeysMngrSymKeyLoad( |
| + xmlSecKeysMngrPtr mngr , |
| + PK11SymKey* symKey |
| +) { |
| + xmlSecKeyPtr key ; |
| + xmlSecKeyDataPtr data ; |
| + xmlSecKeyStorePtr keyStore ; |
| + |
| + xmlSecAssert2( mngr != NULL , -1 ) ; |
| + xmlSecAssert2( symKey != NULL , -1 ) ; |
| + |
| + keyStore = xmlSecKeysMngrGetKeysStore( mngr ) ; |
| + if( keyStore == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecKeysMngrGetKeysStore" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1) ; |
| + } |
| + xmlSecAssert2( xmlSecKeyStoreCheckId( keyStore , xmlSecNssKeysStoreId ) , -1 ) ; |
| + |
| + data = xmlSecNssSymKeyDataKeyAdopt( symKey ) ; |
| + if( data == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecNssSymKeyDataKeyAdopt" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1) ; |
| + } |
| + |
| + key = xmlSecKeyCreate() ; |
| + if( key == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecNssSymKeyDataKeyAdopt" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + xmlSecKeyDataDestroy( data ) ; |
| + return(-1) ; |
| + } |
| + |
| + if( xmlSecKeySetValue( key , data ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecNssSymKeyDataKeyAdopt" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + xmlSecKeyDataDestroy( data ) ; |
| + return(-1) ; |
| + } |
| + |
| + if( xmlSecNssKeysStoreAdoptKey( keyStore, key ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecNssSymKeyDataKeyAdopt" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + xmlSecKeyDestroy( key ) ; |
| + return(-1) ; |
| + } |
| + |
| + return(0) ; |
| +} |
| + |
| +int |
| +xmlSecNssAppliedKeysMngrPubKeyLoad( |
| + xmlSecKeysMngrPtr mngr , |
| + SECKEYPublicKey* pubKey |
| +) { |
| + xmlSecKeyPtr key ; |
| + xmlSecKeyDataPtr data ; |
| + xmlSecKeyStorePtr keyStore ; |
| + |
| + xmlSecAssert2( mngr != NULL , -1 ) ; |
| + xmlSecAssert2( pubKey != NULL , -1 ) ; |
| + |
| + keyStore = xmlSecKeysMngrGetKeysStore( mngr ) ; |
| + if( keyStore == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecKeysMngrGetKeysStore" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1) ; |
| + } |
| + xmlSecAssert2( xmlSecKeyStoreCheckId( keyStore , xmlSecNssKeysStoreId ) , -1 ) ; |
| + |
| + data = xmlSecNssPKIAdoptKey( NULL, pubKey ) ; |
| + if( data == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecNssPKIAdoptKey" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1) ; |
| + } |
| + |
| + key = xmlSecKeyCreate() ; |
| + if( key == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecNssSymKeyDataKeyAdopt" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + xmlSecKeyDataDestroy( data ) ; |
| + return(-1) ; |
| + } |
| + |
| + if( xmlSecKeySetValue( key , data ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecNssSymKeyDataKeyAdopt" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + xmlSecKeyDataDestroy( data ) ; |
| + return(-1) ; |
| + } |
| + |
| + if( xmlSecNssKeysStoreAdoptKey( keyStore, key ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecNssSymKeyDataKeyAdopt" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + xmlSecKeyDestroy( key ) ; |
| + return(-1) ; |
| + } |
| + |
| + return(0) ; |
| +} |
| + |
| +int |
| +xmlSecNssAppliedKeysMngrPriKeyLoad( |
| + xmlSecKeysMngrPtr mngr , |
| + SECKEYPrivateKey* priKey |
| +) { |
| + xmlSecKeyPtr key ; |
| + xmlSecKeyDataPtr data ; |
| + xmlSecKeyStorePtr keyStore ; |
| + |
| + xmlSecAssert2( mngr != NULL , -1 ) ; |
| + xmlSecAssert2( priKey != NULL , -1 ) ; |
| + |
| + keyStore = xmlSecKeysMngrGetKeysStore( mngr ) ; |
| + if( keyStore == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecKeysMngrGetKeysStore" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1) ; |
| + } |
| + xmlSecAssert2( xmlSecKeyStoreCheckId( keyStore , xmlSecNssKeysStoreId ) , -1 ) ; |
| + |
| + data = xmlSecNssPKIAdoptKey( priKey, NULL ) ; |
| + if( data == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecNssPKIAdoptKey" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1) ; |
| + } |
| + |
| + key = xmlSecKeyCreate() ; |
| + if( key == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecNssSymKeyDataKeyAdopt" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + xmlSecKeyDataDestroy( data ) ; |
| + return(-1) ; |
| + } |
| + |
| + if( xmlSecKeySetValue( key , data ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecNssSymKeyDataKeyAdopt" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + xmlSecKeyDataDestroy( data ) ; |
| + return(-1) ; |
| + } |
| + |
| + if( xmlSecNssKeysStoreAdoptKey( keyStore, key ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecNssSymKeyDataKeyAdopt" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + xmlSecKeyDestroy( key ) ; |
| + return(-1) ; |
| + } |
| + |
| + return(0) ; |
| +} |
| + |
| --- misc/xmlsec1-1.2.14/src/nss/hmac.c 2009-06-26 06:18:13.000000000 +0200 |
| +++ misc/build/xmlsec1-1.2.14/src/nss/hmac.c 2009-09-21 14:02:48.649065288 +0200 |
| @@ -23,8 +23,8 @@ |
| #include <xmlsec/transforms.h> |
| #include <xmlsec/errors.h> |
| |
| -#include <xmlsec/nss/app.h> |
| #include <xmlsec/nss/crypto.h> |
| +#include <xmlsec/nss/tokens.h> |
| |
| /* sizes in bits */ |
| #define XMLSEC_NSS_MIN_HMAC_SIZE 80 |
| @@ -286,13 +286,13 @@ |
| keyItem.data = xmlSecBufferGetData(buffer); |
| keyItem.len = xmlSecBufferGetSize(buffer); |
| |
| - slot = PK11_GetBestSlot(ctx->digestType, NULL); |
| + slot = xmlSecNssSlotGet(ctx->digestType); |
| if(slot == NULL) { |
| xmlSecError(XMLSEC_ERRORS_HERE, |
| xmlSecErrorsSafeString(xmlSecTransformGetName(transform)), |
| - "PK11_GetBestSlot", |
| + "xmlSecNssSlotGet", |
| XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| + "error code=%d", PORT_GetError()); |
| return(-1); |
| } |
| |
| --- misc/xmlsec1-1.2.14/src/nss/keysstore.c 2009-06-25 22:53:18.000000000 +0200 |
| +++ misc/build/xmlsec1-1.2.14/src/nss/keysstore.c 2009-09-21 14:02:48.633533885 +0200 |
| @@ -1,36 +1,56 @@ |
| /** |
| * XMLSec library |
| * |
| - * Nss keys store that uses Simple Keys Store under the hood. Uses the |
| - * Nss DB as a backing store for the finding keys, but the NSS DB is |
| - * not written to by the keys store. |
| - * So, if store->findkey is done and the key is not found in the simple |
| - * keys store, the NSS DB is looked up. |
| - * If store is called to adopt a key, that key is not written to the NSS |
| - * DB. |
| - * Thus, the NSS DB can be used to pre-load keys and becomes an alternate |
| - * source of keys for xmlsec |
| - * |
| * This is free software; see Copyright file in the source |
| * distribution for precise wording. |
| * |
| * Copyright (c) 2003 America Online, Inc. All rights reserved. |
| */ |
| + |
| +/** |
| + * NSS key store uses a key list and a slot list as the key repository. NSS slot |
| + * list is a backup repository for the finding keys. If a key is not found from |
| + * the key list, the NSS slot list is looked up. |
| + * |
| + * Any key in the key list will not save to pkcs11 slot. When a store to called |
| + * to adopt a key, the key is resident in the key list; While a store to called |
| + * to set a is resident in the key list; While a store to called to set a slot |
| + * list, which means that the keys in the listed slot can be used for xml sign- |
| + * nature or encryption. |
| + * |
| + * Then, a user can adjust slot list to effect the crypto behaviors of xmlSec. |
| + * |
| + * The framework will decrease the user interfaces to administrate xmlSec crypto |
| + * engine. He can only focus on NSS layer functions. For examples, after the |
| + * user set up a slot list handler to the keys store, he do not need to do any |
| + * other work atop xmlSec interfaces, his action on the slot list handler, such |
| + * as add a token to, delete a token from the list, will directly effect the key |
| + * store behaviors. |
| + * |
| + * For example, a scenariio: |
| + * 0. Create a slot list;( NSS interfaces ) |
| + * 1. Create a keys store;( xmlSec interfaces ) |
| + * 2. Set slot list with the keys store;( xmlSec Interfaces ) |
| + * 3. Add a slot to the slot list;( NSS interfaces ) |
| + * 4. Perform xml signature; ( xmlSec Interfaces ) |
| + * 5. Deleter a slot from the slot list;( NSS interfaces ) |
| + * 6. Perform xml encryption; ( xmlSec Interfaces ) |
| + * 7. Perform xml signature;( xmlSec Interfaces ) |
| + * 8. Destroy the keys store;( xmlSec Interfaces ) |
| + * 8. Destroy the slot list.( NSS Interfaces ) |
| + */ |
| #include "globals.h" |
| |
| #include <stdlib.h> |
| #include <string.h> |
| |
| #include <nss.h> |
| -#include <cert.h> |
| #include <pk11func.h> |
| +#include <prinit.h> |
| #include <keyhi.h> |
| |
| -#include <libxml/tree.h> |
| - |
| #include <xmlsec/xmlsec.h> |
| -#include <xmlsec/buffer.h> |
| -#include <xmlsec/base64.h> |
| +#include <xmlsec/keys.h> |
| #include <xmlsec/errors.h> |
| #include <xmlsec/xmltree.h> |
| |
| @@ -38,82 +58,461 @@ |
| |
| #include <xmlsec/nss/crypto.h> |
| #include <xmlsec/nss/keysstore.h> |
| -#include <xmlsec/nss/x509.h> |
| +#include <xmlsec/nss/tokens.h> |
| +#include <xmlsec/nss/ciphers.h> |
| #include <xmlsec/nss/pkikeys.h> |
| |
| /**************************************************************************** |
| * |
| - * Nss Keys Store. Uses Simple Keys Store under the hood |
| + * Internal NSS key store context |
| * |
| - * Simple Keys Store ptr is located after xmlSecKeyStore |
| + * This context is located after xmlSecKeyStore |
| * |
| ***************************************************************************/ |
| +typedef struct _xmlSecNssKeysStoreCtx xmlSecNssKeysStoreCtx ; |
| +typedef struct _xmlSecNssKeysStoreCtx* xmlSecNssKeysStoreCtxPtr ; |
| + |
| +struct _xmlSecNssKeysStoreCtx { |
| + xmlSecPtrListPtr keyList ; |
| + xmlSecPtrListPtr slotList ; |
| +} ; |
| + |
| #define xmlSecNssKeysStoreSize \ |
| - (sizeof(xmlSecKeyStore) + sizeof(xmlSecKeyStorePtr)) |
| + ( sizeof( xmlSecKeyStore ) + sizeof( xmlSecNssKeysStoreCtx ) ) |
| |
| -#define xmlSecNssKeysStoreGetSS(store) \ |
| - ((xmlSecKeyStoreCheckSize((store), xmlSecNssKeysStoreSize)) ? \ |
| - (xmlSecKeyStorePtr*)(((xmlSecByte*)(store)) + sizeof(xmlSecKeyStore)) : \ |
| - (xmlSecKeyStorePtr*)NULL) |
| - |
| -static int xmlSecNssKeysStoreInitialize (xmlSecKeyStorePtr store); |
| -static void xmlSecNssKeysStoreFinalize (xmlSecKeyStorePtr store); |
| -static xmlSecKeyPtr xmlSecNssKeysStoreFindKey (xmlSecKeyStorePtr store, |
| - const xmlChar* name, |
| - xmlSecKeyInfoCtxPtr keyInfoCtx); |
| +#define xmlSecNssKeysStoreGetCtx( data ) \ |
| + ( ( xmlSecNssKeysStoreCtxPtr )( ( ( xmlSecByte* )( data ) ) + sizeof( xmlSecKeyStore ) ) ) |
| |
| -static xmlSecKeyStoreKlass xmlSecNssKeysStoreKlass = { |
| - sizeof(xmlSecKeyStoreKlass), |
| - xmlSecNssKeysStoreSize, |
| +int xmlSecNssKeysStoreAdoptKeySlot( |
| + xmlSecKeyStorePtr store , |
| + xmlSecNssKeySlotPtr keySlot |
| +) { |
| + xmlSecNssKeysStoreCtxPtr context = NULL ; |
| + |
| + xmlSecAssert2( xmlSecKeyStoreCheckId( store , xmlSecNssKeysStoreId ) , -1 ) ; |
| + xmlSecAssert2( xmlSecKeyStoreCheckSize( store , xmlSecNssKeysStoreSize ) , -1 ) ; |
| + context = xmlSecNssKeysStoreGetCtx( store ) ; |
| + if( context == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) , |
| + "xmlSecNssKeysStoreGetCtx" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return -1 ; |
| + } |
| + |
| + if( context->slotList == NULL ) { |
| + if( ( context->slotList = xmlSecPtrListCreate( xmlSecNssKeySlotListId ) ) == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) , |
| + "xmlSecPtrListCreate" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return -1 ; |
| + } |
| + } |
| + |
| + if( !xmlSecPtrListCheckId( context->slotList , xmlSecNssKeySlotListId ) ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) , |
| + "xmlSecPtrListCheckId" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return -1 ; |
| + } |
| + |
| + if( xmlSecPtrListAdd( context->slotList , keySlot ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) , |
| + "xmlSecPtrListAdd" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return -1 ; |
| + } |
| + return 0 ; |
| +} |
| |
| - /* data */ |
| - BAD_CAST "NSS-keys-store", /* const xmlChar* name; */ |
| - |
| - /* constructors/destructor */ |
| - xmlSecNssKeysStoreInitialize, /* xmlSecKeyStoreInitializeMethod initialize; */ |
| - xmlSecNssKeysStoreFinalize, /* xmlSecKeyStoreFinalizeMethod finalize; */ |
| - xmlSecNssKeysStoreFindKey, /* xmlSecKeyStoreFindKeyMethod findKey; */ |
| - |
| - /* reserved for the future */ |
| - NULL, /* void* reserved0; */ |
| - NULL, /* void* reserved1; */ |
| -}; |
| +int xmlSecNssKeysStoreAdoptKey( |
| + xmlSecKeyStorePtr store , |
| + xmlSecKeyPtr key |
| +) { |
| + xmlSecNssKeysStoreCtxPtr context = NULL ; |
| + |
| + xmlSecAssert2( xmlSecKeyStoreCheckId( store , xmlSecNssKeysStoreId ) , -1 ) ; |
| + xmlSecAssert2( xmlSecKeyStoreCheckSize( store , xmlSecNssKeysStoreSize ) , -1 ) ; |
| + |
| + context = xmlSecNssKeysStoreGetCtx( store ) ; |
| + if( context == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) , |
| + "xmlSecNssKeysStoreGetCtx" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return -1 ; |
| + } |
| + |
| + if( context->keyList == NULL ) { |
| + if( ( context->keyList = xmlSecPtrListCreate( xmlSecKeyPtrListId ) ) == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) , |
| + "xmlSecPtrListCreate" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return -1 ; |
| + } |
| + } |
| + |
| + if( !xmlSecPtrListCheckId( context->keyList , xmlSecKeyPtrListId ) ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) , |
| + "xmlSecPtrListCheckId" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return -1 ; |
| + } |
| + |
| + if( xmlSecPtrListAdd( context->keyList , key ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) , |
| + "xmlSecPtrListAdd" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return -1 ; |
| + } |
| |
| -/** |
| - * xmlSecNssKeysStoreGetKlass: |
| - * |
| - * The Nss list based keys store klass. |
| + return 0 ; |
| +} |
| + |
| +/* |
| + * xmlSecKeyStoreInitializeMethod: |
| + * @store: the store. |
| + * |
| + * Keys store specific initialization method. |
| * |
| - * Returns: Nss list based keys store klass. |
| + * Returns 0 on success or a negative value if an error occurs. |
| */ |
| -xmlSecKeyStoreId |
| -xmlSecNssKeysStoreGetKlass(void) { |
| - return(&xmlSecNssKeysStoreKlass); |
| +static int |
| +xmlSecNssKeysStoreInitialize( |
| + xmlSecKeyStorePtr store |
| +) { |
| + xmlSecNssKeysStoreCtxPtr context = NULL ; |
| + |
| + xmlSecAssert2( xmlSecKeyStoreCheckId( store , xmlSecNssKeysStoreId ) , -1 ) ; |
| + xmlSecAssert2( xmlSecKeyStoreCheckSize( store , xmlSecNssKeysStoreSize ) , -1 ) ; |
| + |
| + context = xmlSecNssKeysStoreGetCtx( store ) ; |
| + if( context == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) , |
| + "xmlSecNssKeysStoreGetCtx" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return -1 ; |
| + } |
| + |
| + context->keyList = NULL ; |
| + context->slotList = NULL ; |
| + |
| + return 0 ; |
| } |
| |
| /** |
| - * xmlSecNssKeysStoreAdoptKey: |
| - * @store: the pointer to Nss keys store. |
| - * @key: the pointer to key. |
| - * |
| - * Adds @key to the @store. |
| * |
| - * Returns: 0 on success or a negative value if an error occurs. |
| + * xmlSecKeyStoreFinalizeMethod: |
| + * @store: the store. |
| + * |
| + * Keys store specific finalization (destroy) method. |
| */ |
| -int |
| -xmlSecNssKeysStoreAdoptKey(xmlSecKeyStorePtr store, xmlSecKeyPtr key) { |
| - xmlSecKeyStorePtr *ss; |
| - |
| - xmlSecAssert2(xmlSecKeyStoreCheckId(store, xmlSecNssKeysStoreId), -1); |
| - xmlSecAssert2((key != NULL), -1); |
| +void |
| +xmlSecNssKeysStoreFinalize( |
| + xmlSecKeyStorePtr store |
| +) { |
| + xmlSecNssKeysStoreCtxPtr context = NULL ; |
| + |
| + xmlSecAssert( xmlSecKeyStoreCheckId( store , xmlSecNssKeysStoreId ) ) ; |
| + xmlSecAssert( xmlSecKeyStoreCheckSize( store , xmlSecNssKeysStoreSize ) ) ; |
| + |
| + context = xmlSecNssKeysStoreGetCtx( store ) ; |
| + if( context == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) , |
| + "xmlSecNssKeysStoreGetCtx" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return ; |
| + } |
| + |
| + if( context->keyList != NULL ) { |
| + xmlSecPtrListDestroy( context->keyList ) ; |
| + context->keyList = NULL ; |
| + } |
| + |
| + if( context->slotList != NULL ) { |
| + xmlSecPtrListDestroy( context->slotList ) ; |
| + context->slotList = NULL ; |
| + } |
| +} |
| + |
| +xmlSecKeyPtr |
| +xmlSecNssKeysStoreFindKeyFromSlot( |
| + PK11SlotInfo* slot, |
| + const xmlChar* name, |
| + xmlSecKeyInfoCtxPtr keyInfoCtx |
| +) { |
| + xmlSecKeyPtr key = NULL ; |
| + xmlSecKeyDataPtr data = NULL ; |
| + int length ; |
| + |
| + xmlSecAssert2( slot != NULL , NULL ) ; |
| + xmlSecAssert2( name != NULL , NULL ) ; |
| + xmlSecAssert2( keyInfoCtx != NULL , NULL ) ; |
| + |
| + if( ( keyInfoCtx->keyReq.keyType & xmlSecKeyDataTypeSymmetric ) == xmlSecKeyDataTypeSymmetric ) { |
| + PK11SymKey* symKey ; |
| + PK11SymKey* curKey ; |
| + |
| + /* Find symmetric key from the slot by name */ |
| + symKey = PK11_ListFixedKeysInSlot( slot , ( char* )name , NULL ) ; |
| + for( curKey = symKey ; curKey != NULL ; curKey = PK11_GetNextSymKey( curKey ) ) { |
| + /* Check the key request */ |
| + length = PK11_GetKeyLength( curKey ) ; |
| + length *= 8 ; |
| + if( ( keyInfoCtx->keyReq.keyBitsSize > 0 ) && |
| + ( length > 0 ) && |
| + ( length < keyInfoCtx->keyReq.keyBitsSize ) ) |
| + continue ; |
| + |
| + /* We find a eligible key */ |
| + data = xmlSecNssSymKeyDataKeyAdopt( curKey ) ; |
| + if( data == NULL ) { |
| + /* Do nothing */ |
| + } |
| + break ; |
| + } |
| + |
| + /* Destroy the sym key list */ |
| + for( curKey = symKey ; curKey != NULL ; ) { |
| + symKey = curKey ; |
| + curKey = PK11_GetNextSymKey( symKey ) ; |
| + PK11_FreeSymKey( symKey ) ; |
| + } |
| + } else if( ( keyInfoCtx->keyReq.keyType & xmlSecKeyDataTypePublic ) == xmlSecKeyDataTypePublic ) { |
| + SECKEYPublicKeyList* pubKeyList ; |
| + SECKEYPublicKey* pubKey ; |
| + SECKEYPublicKeyListNode* curPub ; |
| + |
| + /* Find asymmetric key from the slot by name */ |
| + pubKeyList = PK11_ListPublicKeysInSlot( slot , ( char* )name ) ; |
| + pubKey = NULL ; |
| + curPub = PUBKEY_LIST_HEAD(pubKeyList); |
| + for( ; !PUBKEY_LIST_END(curPub, pubKeyList) ; curPub = PUBKEY_LIST_NEXT( curPub ) ) { |
| + /* Check the key request */ |
| + length = SECKEY_PublicKeyStrength( curPub->key ) ; |
| + length *= 8 ; |
| + if( ( keyInfoCtx->keyReq.keyBitsSize > 0 ) && |
| + ( length > 0 ) && |
| + ( length < keyInfoCtx->keyReq.keyBitsSize ) ) |
| + continue ; |
| + |
| + /* We find a eligible key */ |
| + pubKey = curPub->key ; |
| + break ; |
| + } |
| + |
| + if( pubKey != NULL ) { |
| + data = xmlSecNssPKIAdoptKey( NULL, pubKey ) ; |
| + if( data == NULL ) { |
| + /* Do nothing */ |
| + } |
| + } |
| + |
| + /* Destroy the public key list */ |
| + SECKEY_DestroyPublicKeyList( pubKeyList ) ; |
| + } else if( ( keyInfoCtx->keyReq.keyType & xmlSecKeyDataTypePrivate ) == xmlSecKeyDataTypePrivate ) { |
| + SECKEYPrivateKeyList* priKeyList = NULL ; |
| + SECKEYPrivateKey* priKey = NULL ; |
| + SECKEYPrivateKeyListNode* curPri ; |
| + |
| + /* Find asymmetric key from the slot by name */ |
| + priKeyList = PK11_ListPrivKeysInSlot( slot , ( char* )name , NULL ) ; |
| + priKey = NULL ; |
| + curPri = PRIVKEY_LIST_HEAD(priKeyList); |
| + for( ; !PRIVKEY_LIST_END(curPri, priKeyList) ; curPri = PRIVKEY_LIST_NEXT( curPri ) ) { |
| + /* Check the key request */ |
| + length = PK11_SignatureLen( curPri->key ) ; |
| + length *= 8 ; |
| + if( ( keyInfoCtx->keyReq.keyBitsSize > 0 ) && |
| + ( length > 0 ) && |
| + ( length < keyInfoCtx->keyReq.keyBitsSize ) ) |
| + continue ; |
| + |
| + /* We find a eligible key */ |
| + priKey = curPri->key ; |
| + break ; |
| + } |
| + |
| + if( priKey != NULL ) { |
| + data = xmlSecNssPKIAdoptKey( priKey, NULL ) ; |
| + if( data == NULL ) { |
| + /* Do nothing */ |
| + } |
| + } |
| + |
| + /* Destroy the private key list */ |
| + SECKEY_DestroyPrivateKeyList( priKeyList ) ; |
| + } |
| + |
| + /* If we have gotten the key value */ |
| + if( data != NULL ) { |
| + if( ( key = xmlSecKeyCreate() ) == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecKeyCreate" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + |
| + xmlSecKeyDataDestroy( data ) ; |
| + return NULL ; |
| + } |
| + |
| + if( xmlSecKeySetValue( key , data ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecKeySetValue" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + |
| + xmlSecKeyDestroy( key ) ; |
| + xmlSecKeyDataDestroy( data ) ; |
| + return NULL ; |
| + } |
| + } |
| |
| - ss = xmlSecNssKeysStoreGetSS(store); |
| - xmlSecAssert2(((ss != NULL) && (*ss != NULL) && |
| - (xmlSecKeyStoreCheckId(*ss, xmlSecSimpleKeysStoreId))), -1); |
| + return(key); |
| +} |
| + |
| +/** |
| + * xmlSecKeyStoreFindKeyMethod: |
| + * @store: the store. |
| + * @name: the desired key name. |
| + * @keyInfoCtx: the pointer to key info context. |
| + * |
| + * Keys store specific find method. The caller is responsible for destroying |
| + * the returned key using #xmlSecKeyDestroy method. |
| + * |
| + * Returns the pointer to a key or NULL if key is not found or an error occurs. |
| + */ |
| +static xmlSecKeyPtr |
| +xmlSecNssKeysStoreFindKey( |
| + xmlSecKeyStorePtr store , |
| + const xmlChar* name , |
| + xmlSecKeyInfoCtxPtr keyInfoCtx |
| +) { |
| + xmlSecNssKeysStoreCtxPtr context = NULL ; |
| + xmlSecKeyPtr key = NULL ; |
| + xmlSecNssKeySlotPtr keySlot = NULL ; |
| + xmlSecSize pos ; |
| + xmlSecSize size ; |
| + |
| + xmlSecAssert2( xmlSecKeyStoreCheckId( store , xmlSecNssKeysStoreId ) , NULL ) ; |
| + xmlSecAssert2( xmlSecKeyStoreCheckSize( store , xmlSecNssKeysStoreSize ) , NULL ) ; |
| + xmlSecAssert2( keyInfoCtx != NULL , NULL ) ; |
| + |
| + context = xmlSecNssKeysStoreGetCtx( store ) ; |
| + if( context == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) , |
| + "xmlSecNssKeysStoreGetCtx" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return NULL ; |
| + } |
| + |
| + /*- |
| + * Look for key at keyList at first. |
| + */ |
| + if( context->keyList != NULL ) { |
| + size = xmlSecPtrListGetSize( context->keyList ) ; |
| + for( pos = 0 ; pos < size ; pos ++ ) { |
| + key = ( xmlSecKeyPtr )xmlSecPtrListGetItem( context->keyList , pos ) ; |
| + if( key != NULL && xmlSecKeyMatch( key , name , &( keyInfoCtx->keyReq ) ) ) { |
| + return xmlSecKeyDuplicate( key ) ; |
| + } |
| + } |
| + } |
| + |
| + /*- |
| + * Find the key from slotList |
| + */ |
| + if( context->slotList != NULL ) { |
| + PK11SlotInfo* slot = NULL ; |
| + |
| + size = xmlSecPtrListGetSize( context->slotList ) ; |
| + for( pos = 0 ; pos < size ; pos ++ ) { |
| + keySlot = ( xmlSecNssKeySlotPtr )xmlSecPtrListGetItem( context->slotList , pos ) ; |
| + slot = xmlSecNssKeySlotGetSlot( keySlot ) ; |
| + if( slot == NULL ) { |
| + continue ; |
| + } else { |
| + key = xmlSecNssKeysStoreFindKeyFromSlot( slot, name, keyInfoCtx ) ; |
| + if( key == NULL ) { |
| + continue ; |
| + } else { |
| + return( key ) ; |
| + } |
| + } |
| + } |
| + } |
| + |
| + /*- |
| + * Create a session key if we can not find the key from keyList and slotList |
| + */ |
| + if( ( keyInfoCtx->keyReq.keyType & xmlSecKeyDataTypeSession ) == xmlSecKeyDataTypeSession ) { |
| + key = xmlSecKeyGenerate( keyInfoCtx->keyReq.keyId , keyInfoCtx->keyReq.keyBitsSize , xmlSecKeyDataTypeSession ) ; |
| + if( key == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyStoreGetName( store ) ) , |
| + "xmlSecKeySetValue" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return NULL ; |
| + } |
| + |
| + return key ; |
| + } |
| + |
| + /** |
| + * We have no way to find the key any more. |
| + */ |
| + return NULL ; |
| +} |
| + |
| +static xmlSecKeyStoreKlass xmlSecNssKeysStoreKlass = { |
| + sizeof( xmlSecKeyStoreKlass ) , |
| + xmlSecNssKeysStoreSize , |
| + BAD_CAST "implicit_nss_keys_store" , |
| + xmlSecNssKeysStoreInitialize , |
| + xmlSecNssKeysStoreFinalize , |
| + xmlSecNssKeysStoreFindKey , |
| + NULL , |
| + NULL |
| +} ; |
| |
| - return (xmlSecSimpleKeysStoreAdoptKey(*ss, key)); |
| +/** |
| + * xmlSecNssKeysStoreGetKlass: |
| + * |
| + * The simple list based keys store klass. |
| + * |
| + */ |
| +xmlSecKeyStoreId |
| +xmlSecNssKeysStoreGetKlass( void ) { |
| + return &xmlSecNssKeysStoreKlass ; |
| } |
| |
| +/************************** |
| + * Application routines |
| + */ |
| + |
| /** |
| * xmlSecNssKeysStoreLoad: |
| * @store: the pointer to Nss keys store. |
| @@ -252,234 +651,147 @@ |
| */ |
| int |
| xmlSecNssKeysStoreSave(xmlSecKeyStorePtr store, const char *filename, xmlSecKeyDataType type) { |
| - xmlSecKeyStorePtr *ss; |
| + xmlSecKeyInfoCtx keyInfoCtx; |
| + xmlSecNssKeysStoreCtxPtr context ; |
| + xmlSecPtrListPtr list; |
| + xmlSecKeyPtr key; |
| + xmlSecSize i, keysSize; |
| + xmlDocPtr doc; |
| + xmlNodePtr cur; |
| + xmlSecKeyDataPtr data; |
| + xmlSecPtrListPtr idsList; |
| + xmlSecKeyDataId dataId; |
| + xmlSecSize idsSize, j; |
| + int ret; |
| |
| xmlSecAssert2(xmlSecKeyStoreCheckId(store, xmlSecNssKeysStoreId), -1); |
| - xmlSecAssert2((filename != NULL), -1); |
| - |
| - ss = xmlSecNssKeysStoreGetSS(store); |
| - xmlSecAssert2(((ss != NULL) && (*ss != NULL) && |
| - (xmlSecKeyStoreCheckId(*ss, xmlSecSimpleKeysStoreId))), -1); |
| - |
| - return (xmlSecSimpleKeysStoreSave(*ss, filename, type)); |
| -} |
| - |
| -static int |
| -xmlSecNssKeysStoreInitialize(xmlSecKeyStorePtr store) { |
| - xmlSecKeyStorePtr *ss; |
| + xmlSecAssert2( xmlSecKeyStoreCheckSize( store , xmlSecNssKeysStoreSize ), -1 ) ; |
| + xmlSecAssert2(filename != NULL, -1); |
| |
| - xmlSecAssert2(xmlSecKeyStoreCheckId(store, xmlSecNssKeysStoreId), -1); |
| + context = xmlSecNssKeysStoreGetCtx( store ) ; |
| + xmlSecAssert2( context != NULL, -1 ); |
| |
| - ss = xmlSecNssKeysStoreGetSS(store); |
| - xmlSecAssert2((*ss == NULL), -1); |
| + list = context->keyList ; |
| + xmlSecAssert2( list != NULL, -1 ); |
| + xmlSecAssert2(xmlSecPtrListCheckId(list, xmlSecKeyPtrListId), -1); |
| |
| - *ss = xmlSecKeyStoreCreate(xmlSecSimpleKeysStoreId); |
| - if(*ss == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| + /* create doc */ |
| + doc = xmlSecCreateTree(BAD_CAST "Keys", xmlSecNs); |
| + if(doc == NULL) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| xmlSecErrorsSafeString(xmlSecKeyStoreGetName(store)), |
| - "xmlSecKeyStoreCreate", |
| + "xmlSecCreateTree", |
| XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - "xmlSecSimpleKeysStoreId"); |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| return(-1); |
| } |
| |
| - return(0); |
| -} |
| - |
| -static void |
| -xmlSecNssKeysStoreFinalize(xmlSecKeyStorePtr store) { |
| - xmlSecKeyStorePtr *ss; |
| - |
| - xmlSecAssert(xmlSecKeyStoreCheckId(store, xmlSecNssKeysStoreId)); |
| - |
| - ss = xmlSecNssKeysStoreGetSS(store); |
| - xmlSecAssert((ss != NULL) && (*ss != NULL)); |
| - |
| - xmlSecKeyStoreDestroy(*ss); |
| -} |
| - |
| -static xmlSecKeyPtr |
| -xmlSecNssKeysStoreFindKey(xmlSecKeyStorePtr store, const xmlChar* name, |
| - xmlSecKeyInfoCtxPtr keyInfoCtx) { |
| - xmlSecKeyStorePtr* ss; |
| - xmlSecKeyPtr key = NULL; |
| - xmlSecKeyPtr retval = NULL; |
| - xmlSecKeyReqPtr keyReq = NULL; |
| - CERTCertificate *cert = NULL; |
| - SECKEYPublicKey *pubkey = NULL; |
| - SECKEYPrivateKey *privkey = NULL; |
| - xmlSecKeyDataPtr data = NULL; |
| - xmlSecKeyDataPtr x509Data = NULL; |
| - int ret; |
| - |
| - xmlSecAssert2(xmlSecKeyStoreCheckId(store, xmlSecNssKeysStoreId), NULL); |
| - xmlSecAssert2(keyInfoCtx != NULL, NULL); |
| - |
| - ss = xmlSecNssKeysStoreGetSS(store); |
| - xmlSecAssert2(((ss != NULL) && (*ss != NULL)), NULL); |
| - |
| - key = xmlSecKeyStoreFindKey(*ss, name, keyInfoCtx); |
| - if (key != NULL) { |
| - return (key); |
| - } |
| - |
| - /* Try to find the key in the NSS DB, and construct an xmlSecKey. |
| - * we must have a name to lookup keys in NSS DB. |
| - */ |
| - if (name == NULL) { |
| - goto done; |
| - } |
| + idsList = xmlSecKeyDataIdsGet(); |
| + xmlSecAssert2(idsList != NULL, -1); |
| |
| - /* what type of key are we looking for? |
| - * TBD: For now, we'll look only for public/private keys using the |
| - * name as a cert nickname. Later on, we can attempt to find |
| - * symmetric keys using PK11_FindFixedKey |
| - */ |
| - keyReq = &(keyInfoCtx->keyReq); |
| - if (keyReq->keyType & |
| - (xmlSecKeyDataTypePublic | xmlSecKeyDataTypePrivate)) { |
| - cert = CERT_FindCertByNickname (CERT_GetDefaultCertDB(), (char *)name); |
| - if (cert == NULL) { |
| - goto done; |
| - } |
| + keysSize = xmlSecPtrListGetSize(list); |
| + idsSize = xmlSecPtrListGetSize(idsList); |
| + for(i = 0; i < keysSize; ++i) { |
| + key = (xmlSecKeyPtr)xmlSecPtrListGetItem(list, i); |
| + xmlSecAssert2(key != NULL, -1); |
| |
| - if (keyReq->keyType & xmlSecKeyDataTypePublic) { |
| - pubkey = CERT_ExtractPublicKey(cert); |
| - if (pubkey == NULL) { |
| + cur = xmlSecAddChild(xmlDocGetRootElement(doc), xmlSecNodeKeyInfo, xmlSecDSigNs); |
| + if(cur == NULL) { |
| xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "CERT_ExtractPublicKey", |
| - XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| - goto done; |
| - } |
| + xmlSecErrorsSafeString(xmlSecKeyStoreGetName(store)), |
| + "xmlSecAddChild", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + "node=%s", |
| + xmlSecErrorsSafeString(xmlSecNodeKeyInfo)); |
| + xmlFreeDoc(doc); |
| + return(-1); |
| } |
| |
| - if (keyReq->keyType & xmlSecKeyDataTypePrivate) { |
| - privkey = PK11_FindKeyByAnyCert(cert, NULL); |
| - if (privkey == NULL) { |
| + /* special data key name */ |
| + if(xmlSecKeyGetName(key) != NULL) { |
| + if(xmlSecAddChild(cur, xmlSecNodeKeyName, xmlSecDSigNs) == NULL) { |
| xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "PK11_FindKeyByAnyCert", |
| - XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| - goto done; |
| + xmlSecErrorsSafeString(xmlSecKeyStoreGetName(store)), |
| + "xmlSecAddChild", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + "node=%s", |
| + xmlSecErrorsSafeString(xmlSecNodeKeyName)); |
| + xmlFreeDoc(doc); |
| + return(-1); |
| } |
| } |
| |
| - data = xmlSecNssPKIAdoptKey(privkey, pubkey); |
| - if(data == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecNssPKIAdoptKey", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| - goto done; |
| - } |
| - privkey = NULL; |
| - pubkey = NULL; |
| - |
| - key = xmlSecKeyCreate(); |
| - if (key == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecKeyCreate", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| - return (NULL); |
| - } |
| - |
| - x509Data = xmlSecKeyDataCreate(xmlSecNssKeyDataX509Id); |
| - if(x509Data == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecKeyDataCreate", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - "transform=%s", |
| - xmlSecErrorsSafeString(xmlSecTransformKlassGetName(xmlSecNssKeyDataX509Id))); |
| - goto done; |
| - } |
| + /* create nodes for other keys data */ |
| + for(j = 0; j < idsSize; ++j) { |
| + dataId = (xmlSecKeyDataId)xmlSecPtrListGetItem(idsList, j); |
| + xmlSecAssert2(dataId != xmlSecKeyDataIdUnknown, -1); |
| + |
| + if(dataId->dataNodeName == NULL) { |
| + continue; |
| + } |
| + |
| + data = xmlSecKeyGetData(key, dataId); |
| + if(data == NULL) { |
| + continue; |
| + } |
| |
| - ret = xmlSecNssKeyDataX509AdoptKeyCert(x509Data, cert); |
| - if (ret < 0) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecNssKeyDataX509AdoptKeyCert", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - "data=%s", |
| - xmlSecErrorsSafeString(xmlSecKeyDataGetName(x509Data))); |
| - goto done; |
| - } |
| - cert = CERT_DupCertificate(cert); |
| - if (cert == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "CERT_DupCertificate", |
| - XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| - "data=%s", |
| - xmlSecErrorsSafeString(xmlSecKeyDataGetName(x509Data))); |
| - goto done; |
| + if(xmlSecAddChild(cur, dataId->dataNodeName, dataId->dataNodeNs) == NULL) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + xmlSecErrorsSafeString(xmlSecKeyStoreGetName(store)), |
| + "xmlSecAddChild", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + "node=%s", |
| + xmlSecErrorsSafeString(dataId->dataNodeName)); |
| + xmlFreeDoc(doc); |
| + return(-1); |
| + } |
| } |
| |
| - ret = xmlSecNssKeyDataX509AdoptCert(x509Data, cert); |
| + ret = xmlSecKeyInfoCtxInitialize(&keyInfoCtx, NULL); |
| if (ret < 0) { |
| xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecNssKeyDataX509AdoptCert", |
| + xmlSecErrorsSafeString(xmlSecKeyStoreGetName(store)), |
| + "xmlSecKeyInfoCtxInitialize", |
| XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - "data=%s", |
| - xmlSecErrorsSafeString(xmlSecKeyDataGetName(x509Data))); |
| - goto done; |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + xmlFreeDoc(doc); |
| + return(-1); |
| } |
| - cert = NULL; |
| |
| - ret = xmlSecKeySetValue(key, data); |
| - if (ret < 0) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecKeySetValue", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - "data=%s", |
| - xmlSecErrorsSafeString(xmlSecKeyDataGetName(data))); |
| - goto done; |
| - } |
| - data = NULL; |
| + keyInfoCtx.mode = xmlSecKeyInfoModeWrite; |
| + keyInfoCtx.keyReq.keyId = xmlSecKeyDataIdUnknown; |
| + keyInfoCtx.keyReq.keyType = type; |
| + keyInfoCtx.keyReq.keyUsage = xmlSecKeyDataUsageAny; |
| |
| - ret = xmlSecKeyAdoptData(key, x509Data); |
| + /* finally write key in the node */ |
| + ret = xmlSecKeyInfoNodeWrite(cur, key, &keyInfoCtx); |
| if (ret < 0) { |
| xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecKeyAdoptData", |
| + xmlSecErrorsSafeString(xmlSecKeyStoreGetName(store)), |
| + "xmlSecKeyInfoNodeWrite", |
| XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - "data=%s", |
| - xmlSecErrorsSafeString(xmlSecKeyDataGetName(x509Data))); |
| - goto done; |
| - } |
| - x509Data = NULL; |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + xmlSecKeyInfoCtxFinalize(&keyInfoCtx); |
| + xmlFreeDoc(doc); |
| + return(-1); |
| + } |
| |
| - retval = key; |
| - key = NULL; |
| + xmlSecKeyInfoCtxFinalize(&keyInfoCtx); |
| } |
| |
| -done: |
| - if (cert != NULL) { |
| - CERT_DestroyCertificate(cert); |
| - } |
| - if (pubkey != NULL) { |
| - SECKEY_DestroyPublicKey(pubkey); |
| - } |
| - if (privkey != NULL) { |
| - SECKEY_DestroyPrivateKey(privkey); |
| - } |
| - if (data != NULL) { |
| - xmlSecKeyDataDestroy(data); |
| - } |
| - if (x509Data != NULL) { |
| - xmlSecKeyDataDestroy(x509Data); |
| - } |
| - if (key != NULL) { |
| - xmlSecKeyDestroy(key); |
| + /* now write result */ |
| + ret = xmlSaveFormatFile(filename, doc, 1); |
| + if (ret < 0) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + xmlSecErrorsSafeString(xmlSecKeyStoreGetName(store)), |
| + "xmlSaveFormatFile", |
| + XMLSEC_ERRORS_R_XML_FAILED, |
| + "filename=%s", |
| + xmlSecErrorsSafeString(filename)); |
| + xmlFreeDoc(doc); |
| + return(-1); |
| } |
| |
| - return (retval); |
| + xmlFreeDoc(doc); |
| + return(0); |
| } |
| --- misc/xmlsec1-1.2.14/src/nss/keywrapers.c 2009-09-21 14:07:19.223802688 +0200 |
| +++ misc/build/xmlsec1-1.2.14/src/nss/keywrapers.c 2009-09-21 14:02:48.548869372 +0200 |
| @@ -1 +1,1213 @@ |
| -dummy |
| +/** |
| + * |
| + * XMLSec library |
| + * |
| + * AES Algorithm support |
| + * |
| + * This is free software; see Copyright file in the source |
| + * distribution for preciese wording. |
| + * |
| + * Copyright ................................. |
| + */ |
| +#include "globals.h" |
| + |
| +#include <stdlib.h> |
| +#include <stdio.h> |
| +#include <string.h> |
| + |
| +#include <nss.h> |
| +#include <pk11func.h> |
| +#include <hasht.h> |
| + |
| +#include <xmlsec/xmlsec.h> |
| +#include <xmlsec/xmltree.h> |
| +#include <xmlsec/keys.h> |
| +#include <xmlsec/transforms.h> |
| +#include <xmlsec/errors.h> |
| + |
| +#include <xmlsec/nss/crypto.h> |
| +#include <xmlsec/nss/ciphers.h> |
| + |
| +#define XMLSEC_NSS_AES128_KEY_SIZE 16 |
| +#define XMLSEC_NSS_AES192_KEY_SIZE 24 |
| +#define XMLSEC_NSS_AES256_KEY_SIZE 32 |
| +#define XMLSEC_NSS_DES3_KEY_SIZE 24 |
| +#define XMLSEC_NSS_DES3_KEY_LENGTH 24 |
| +#define XMLSEC_NSS_DES3_IV_LENGTH 8 |
| +#define XMLSEC_NSS_DES3_BLOCK_LENGTH 8 |
| + |
| +static xmlSecByte xmlSecNssKWDes3Iv[XMLSEC_NSS_DES3_IV_LENGTH] = { |
| + 0x4a, 0xdd, 0xa2, 0x2c, 0x79, 0xe8, 0x21, 0x05 |
| +}; |
| + |
| +/********************************************************************* |
| + * |
| + * key wrap transforms |
| + * |
| + ********************************************************************/ |
| +typedef struct _xmlSecNssKeyWrapCtx xmlSecNssKeyWrapCtx ; |
| +typedef struct _xmlSecNssKeyWrapCtx* xmlSecNssKeyWrapCtxPtr ; |
| + |
| +#define xmlSecNssKeyWrapSize \ |
| + ( sizeof( xmlSecTransform ) + sizeof( xmlSecNssKeyWrapCtx ) ) |
| + |
| +#define xmlSecNssKeyWrapGetCtx( transform ) \ |
| + ( ( xmlSecNssKeyWrapCtxPtr )( ( ( xmlSecByte* )( transform ) ) + sizeof( xmlSecTransform ) ) ) |
| + |
| +struct _xmlSecNssKeyWrapCtx { |
| + CK_MECHANISM_TYPE cipher ; |
| + PK11SymKey* symkey ; |
| + xmlSecKeyDataId keyId ; |
| + xmlSecBufferPtr material ; /* to be encrypted/decrypted key material */ |
| +} ; |
| + |
| +static int xmlSecNssKeyWrapInitialize(xmlSecTransformPtr transform); |
| +static void xmlSecNssKeyWrapFinalize(xmlSecTransformPtr transform); |
| +static int xmlSecNssKeyWrapSetKeyReq(xmlSecTransformPtr transform, |
| + xmlSecKeyReqPtr keyReq); |
| +static int xmlSecNssKeyWrapSetKey(xmlSecTransformPtr transform, |
| + xmlSecKeyPtr key); |
| +static int xmlSecNssKeyWrapExecute(xmlSecTransformPtr transform, |
| + int last, |
| + xmlSecTransformCtxPtr transformCtx); |
| +static xmlSecSize xmlSecNssKeyWrapGetKeySize(xmlSecTransformPtr transform); |
| + |
| +static int |
| +xmlSecNssKeyWrapCheckId( |
| + xmlSecTransformPtr transform |
| +) { |
| + #ifndef XMLSEC_NO_DES |
| + if( xmlSecTransformCheckId( transform, xmlSecNssTransformKWDes3Id ) ) { |
| + return(1); |
| + } |
| + #endif /* XMLSEC_NO_DES */ |
| + |
| + #ifndef XMLSEC_NO_AES |
| + if( xmlSecTransformCheckId( transform, xmlSecNssTransformKWAes128Id ) || |
| + xmlSecTransformCheckId( transform, xmlSecNssTransformKWAes192Id ) || |
| + xmlSecTransformCheckId( transform, xmlSecNssTransformKWAes256Id ) ) { |
| + |
| + return(1); |
| + } |
| + #endif /* XMLSEC_NO_AES */ |
| + |
| + return(0); |
| +} |
| + |
| +static xmlSecSize |
| +xmlSecNssKeyWrapGetKeySize(xmlSecTransformPtr transform) { |
| +#ifndef XMLSEC_NO_DES |
| + if( xmlSecTransformCheckId( transform, xmlSecNssTransformKWDes3Id ) ) { |
| + return(XMLSEC_NSS_DES3_KEY_SIZE); |
| + } else |
| +#endif /* XMLSEC_NO_DES */ |
| + |
| +#ifndef XMLSEC_NO_AES |
| + if(xmlSecTransformCheckId(transform, xmlSecNssTransformKWAes128Id)) { |
| + return(XMLSEC_NSS_AES128_KEY_SIZE); |
| + } else if(xmlSecTransformCheckId(transform, xmlSecNssTransformKWAes192Id)) { |
| + return(XMLSEC_NSS_AES192_KEY_SIZE); |
| + } else if(xmlSecTransformCheckId(transform, xmlSecNssTransformKWAes256Id)) { |
| + return(XMLSEC_NSS_AES256_KEY_SIZE); |
| + } else if(xmlSecTransformCheckId(transform, xmlSecNssTransformKWAes256Id)) { |
| + return(XMLSEC_NSS_AES256_KEY_SIZE); |
| + } else |
| +#endif /* XMLSEC_NO_AES */ |
| + |
| + if(1) |
| + return(0); |
| +} |
| + |
| + |
| +static int |
| +xmlSecNssKeyWrapInitialize(xmlSecTransformPtr transform) { |
| + xmlSecNssKeyWrapCtxPtr context ; |
| + int ret; |
| + |
| + xmlSecAssert2(xmlSecNssKeyWrapCheckId(transform), -1); |
| + xmlSecAssert2(xmlSecTransformCheckSize(transform, xmlSecNssKeyWrapSize), -1); |
| + |
| + context = xmlSecNssKeyWrapGetCtx( transform ) ; |
| + xmlSecAssert2( context != NULL , -1 ) ; |
| + |
| + #ifndef XMLSEC_NO_DES |
| + if( transform->id == xmlSecNssTransformKWDes3Id ) { |
| + context->cipher = CKM_DES3_CBC ; |
| + context->keyId = xmlSecNssKeyDataDesId ; |
| + } else |
| + #endif /* XMLSEC_NO_DES */ |
| + |
| + #ifndef XMLSEC_NO_AES |
| + if( transform->id == xmlSecNssTransformKWAes128Id ) { |
| + /* context->cipher = CKM_NETSCAPE_AES_KEY_WRAP ;*/ |
| + context->cipher = CKM_AES_CBC ; |
| + context->keyId = xmlSecNssKeyDataAesId ; |
| + } else |
| + if( transform->id == xmlSecNssTransformKWAes192Id ) { |
| + /* context->cipher = CKM_NETSCAPE_AES_KEY_WRAP ;*/ |
| + context->cipher = CKM_AES_CBC ; |
| + context->keyId = xmlSecNssKeyDataAesId ; |
| + } else |
| + if( transform->id == xmlSecNssTransformKWAes256Id ) { |
| + /* context->cipher = CKM_NETSCAPE_AES_KEY_WRAP ;*/ |
| + context->cipher = CKM_AES_CBC ; |
| + context->keyId = xmlSecNssKeyDataAesId ; |
| + } else |
| + #endif /* XMLSEC_NO_AES */ |
| + |
| + |
| + if( 1 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString(xmlSecTransformGetName(transform)), |
| + NULL , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + |
| + context->symkey = NULL ; |
| + context->material = NULL ; |
| + |
| + return(0); |
| +} |
| + |
| +static void |
| +xmlSecNssKeyWrapFinalize(xmlSecTransformPtr transform) { |
| + xmlSecNssKeyWrapCtxPtr context ; |
| + |
| + xmlSecAssert(xmlSecNssKeyWrapCheckId(transform)); |
| + xmlSecAssert(xmlSecTransformCheckSize(transform, xmlSecNssKeyWrapSize)); |
| + |
| + context = xmlSecNssKeyWrapGetCtx( transform ) ; |
| + xmlSecAssert( context != NULL ) ; |
| + |
| + if( context->symkey != NULL ) { |
| + PK11_FreeSymKey( context->symkey ) ; |
| + context->symkey = NULL ; |
| + } |
| + |
| + if( context->material != NULL ) { |
| + xmlSecBufferDestroy(context->material); |
| + context->material = NULL ; |
| + } |
| +} |
| + |
| +static int |
| +xmlSecNssKeyWrapSetKeyReq(xmlSecTransformPtr transform, xmlSecKeyReqPtr keyReq) { |
| + xmlSecNssKeyWrapCtxPtr context ; |
| + xmlSecSize cipherSize = 0 ; |
| + |
| + |
| + xmlSecAssert2(xmlSecNssKeyWrapCheckId(transform), -1); |
| + xmlSecAssert2(xmlSecTransformCheckSize(transform, xmlSecNssKeyWrapSize), -1); |
| + xmlSecAssert2((transform->operation == xmlSecTransformOperationEncrypt) || (transform->operation == xmlSecTransformOperationDecrypt), -1); |
| + xmlSecAssert2(keyReq != NULL, -1); |
| + |
| + context = xmlSecNssKeyWrapGetCtx( transform ) ; |
| + xmlSecAssert2( context != NULL , -1 ) ; |
| + |
| + keyReq->keyId = context->keyId; |
| + keyReq->keyType = xmlSecKeyDataTypeSymmetric; |
| + if(transform->operation == xmlSecTransformOperationEncrypt) { |
| + keyReq->keyUsage = xmlSecKeyUsageEncrypt; |
| + } else { |
| + keyReq->keyUsage = xmlSecKeyUsageDecrypt; |
| + } |
| + |
| + keyReq->keyBitsSize = xmlSecNssKeyWrapGetKeySize( transform ) ; |
| + |
| + return(0); |
| +} |
| + |
| +static int |
| +xmlSecNssKeyWrapSetKey(xmlSecTransformPtr transform, xmlSecKeyPtr key) { |
| + xmlSecNssKeyWrapCtxPtr context = NULL ; |
| + xmlSecKeyDataPtr keyData = NULL ; |
| + PK11SymKey* symkey = NULL ; |
| + |
| + xmlSecAssert2(xmlSecNssKeyWrapCheckId(transform), -1); |
| + xmlSecAssert2(xmlSecTransformCheckSize(transform, xmlSecNssKeyWrapSize), -1); |
| + xmlSecAssert2((transform->operation == xmlSecTransformOperationEncrypt) || (transform->operation == xmlSecTransformOperationDecrypt), -1); |
| + xmlSecAssert2(key != NULL, -1); |
| + |
| + context = xmlSecNssKeyWrapGetCtx( transform ) ; |
| + if( context == NULL || context->keyId == NULL || context->symkey != NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecTransformGetName( transform ) ) , |
| + "xmlSecNssKeyWrapGetCtx" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + xmlSecAssert2( xmlSecKeyCheckId( key, context->keyId ), -1 ) ; |
| + |
| + keyData = xmlSecKeyGetValue( key ) ; |
| + if( keyData == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyGetName( key ) ) , |
| + "xmlSecKeyGetValue" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + |
| + if( ( symkey = xmlSecNssSymKeyDataGetKey( keyData ) ) == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyDataGetName( keyData ) ) , |
| + "xmlSecNssSymKeyDataGetKey" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + |
| + context->symkey = symkey ; |
| + |
| + return(0) ; |
| +} |
| + |
| +/** |
| + * key wrap transform |
| + */ |
| +static int |
| +xmlSecNssKeyWrapCtxInit( |
| + xmlSecNssKeyWrapCtxPtr ctx , |
| + xmlSecBufferPtr in , |
| + xmlSecBufferPtr out , |
| + int encrypt , |
| + xmlSecTransformCtxPtr transformCtx |
| +) { |
| + xmlSecSize blockSize ; |
| + |
| + xmlSecAssert2( ctx != NULL , -1 ) ; |
| + xmlSecAssert2( ctx->cipher != CKM_INVALID_MECHANISM , -1 ) ; |
| + xmlSecAssert2( ctx->symkey != NULL , -1 ) ; |
| + xmlSecAssert2( ctx->keyId != NULL , -1 ) ; |
| + xmlSecAssert2( in != NULL , -1 ) ; |
| + xmlSecAssert2( out != NULL , -1 ) ; |
| + xmlSecAssert2( transformCtx != NULL , -1 ) ; |
| + |
| + if( ctx->material != NULL ) { |
| + xmlSecBufferDestroy( ctx->material ) ; |
| + ctx->material = NULL ; |
| + } |
| + |
| + if( ( blockSize = PK11_GetBlockSize( ctx->cipher , NULL ) ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "PK11_GetBlockSize" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + |
| + ctx->material = xmlSecBufferCreate( blockSize ) ; |
| + if( ctx->material == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecBufferCreate" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + |
| + /* read raw key material into context */ |
| + if( xmlSecBufferSetData( ctx->material, xmlSecBufferGetData(in), xmlSecBufferGetSize(in) ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecBufferSetData" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + |
| + if( xmlSecBufferRemoveHead( in , xmlSecBufferGetSize(in) ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecBufferRemoveHead" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + |
| + return(0); |
| +} |
| + |
| +/** |
| + * key wrap transform update |
| + */ |
| +static int |
| +xmlSecNssKeyWrapCtxUpdate( |
| + xmlSecNssKeyWrapCtxPtr ctx , |
| + xmlSecBufferPtr in , |
| + xmlSecBufferPtr out , |
| + int encrypt , |
| + xmlSecTransformCtxPtr transformCtx |
| +) { |
| + xmlSecAssert2( ctx != NULL , -1 ) ; |
| + xmlSecAssert2( ctx->cipher != CKM_INVALID_MECHANISM , -1 ) ; |
| + xmlSecAssert2( ctx->symkey != NULL , -1 ) ; |
| + xmlSecAssert2( ctx->keyId != NULL , -1 ) ; |
| + xmlSecAssert2( ctx->material != NULL , -1 ) ; |
| + xmlSecAssert2( in != NULL , -1 ) ; |
| + xmlSecAssert2( out != NULL , -1 ) ; |
| + xmlSecAssert2( transformCtx != NULL , -1 ) ; |
| + |
| + /* read raw key material and append into context */ |
| + if( xmlSecBufferAppend( ctx->material, xmlSecBufferGetData(in), xmlSecBufferGetSize(in) ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecBufferAppend" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + |
| + if( xmlSecBufferRemoveHead( in , xmlSecBufferGetSize(in) ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecBufferRemoveHead" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + |
| + return(0); |
| +} |
| + |
| +static int |
| +xmlSecNssKWDes3BufferReverse(xmlSecByte *buf, xmlSecSize size) { |
| + xmlSecSize s; |
| + xmlSecSize i; |
| + xmlSecByte c; |
| + |
| + xmlSecAssert2(buf != NULL, -1); |
| + |
| + s = size / 2; |
| + --size; |
| + for(i = 0; i < s; ++i) { |
| + c = buf[i]; |
| + buf[i] = buf[size - i]; |
| + buf[size - i] = c; |
| + } |
| + return(0); |
| +} |
| + |
| +static xmlSecByte * |
| +xmlSecNssComputeSHA1(const xmlSecByte *in, xmlSecSize inSize, |
| + xmlSecByte *out, xmlSecSize outSize) |
| +{ |
| + PK11Context *context = NULL; |
| + SECStatus s; |
| + xmlSecByte *digest = NULL; |
| + unsigned int len; |
| + |
| + xmlSecAssert2(in != NULL, NULL); |
| + xmlSecAssert2(out != NULL, NULL); |
| + xmlSecAssert2(outSize >= SHA1_LENGTH, NULL); |
| + |
| + /* Create a context for hashing (digesting) */ |
| + context = PK11_CreateDigestContext(SEC_OID_SHA1); |
| + if (context == NULL) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "PK11_CreateDigestContext", |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| + "error code = %d", PORT_GetError()); |
| + goto done; |
| + } |
| + |
| + s = PK11_DigestBegin(context); |
| + if (s != SECSuccess) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "PK11_DigestBegin", |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| + "error code = %d", PORT_GetError()); |
| + goto done; |
| + } |
| + |
| + s = PK11_DigestOp(context, in, inSize); |
| + if (s != SECSuccess) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "PK11_DigestOp", |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| + "error code = %d", PORT_GetError()); |
| + goto done; |
| + } |
| + |
| + s = PK11_DigestFinal(context, out, &len, outSize); |
| + if (s != SECSuccess) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "PK11_DigestFinal", |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| + "error code = %d", PORT_GetError()); |
| + goto done; |
| + } |
| + xmlSecAssert2(len == SHA1_LENGTH, NULL); |
| + |
| + digest = out; |
| + |
| +done: |
| + if (context != NULL) { |
| + PK11_DestroyContext(context, PR_TRUE); |
| + } |
| + return (digest); |
| +} |
| + |
| +static int |
| +xmlSecNssKWDes3Encrypt( |
| + PK11SymKey* symKey , |
| + CK_MECHANISM_TYPE cipherMech , |
| + const xmlSecByte* iv , |
| + xmlSecSize ivSize , |
| + const xmlSecByte* in , |
| + xmlSecSize inSize , |
| + xmlSecByte* out , |
| + xmlSecSize outSize , |
| + int enc |
| +) { |
| + PK11Context* EncContext = NULL; |
| + SECItem ivItem ; |
| + SECItem* secParam = NULL ; |
| + int tmp1_outlen; |
| + unsigned int tmp2_outlen; |
| + int result_len = -1; |
| + SECStatus rv; |
| + |
| + xmlSecAssert2( cipherMech != CKM_INVALID_MECHANISM , -1 ) ; |
| + xmlSecAssert2( symKey != NULL , -1 ) ; |
| + xmlSecAssert2(iv != NULL, -1); |
| + xmlSecAssert2(ivSize == XMLSEC_NSS_DES3_IV_LENGTH, -1); |
| + xmlSecAssert2(in != NULL, -1); |
| + xmlSecAssert2(inSize > 0, -1); |
| + xmlSecAssert2(out != NULL, -1); |
| + xmlSecAssert2(outSize >= inSize, -1); |
| + |
| + /* Prepare IV */ |
| + ivItem.data = ( unsigned char* )iv ; |
| + ivItem.len = ivSize ; |
| + |
| + secParam = PK11_ParamFromIV(cipherMech, &ivItem); |
| + if (secParam == NULL) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "PK11_ParamFromIV", |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| + "Error code = %d", PORT_GetError()); |
| + goto done; |
| + } |
| + |
| + EncContext = PK11_CreateContextBySymKey(cipherMech, |
| + enc ? CKA_ENCRYPT : CKA_DECRYPT, |
| + symKey, secParam); |
| + if (EncContext == NULL) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "PK11_CreateContextBySymKey", |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| + "Error code = %d", PORT_GetError()); |
| + goto done; |
| + } |
| + |
| + tmp1_outlen = tmp2_outlen = 0; |
| + rv = PK11_CipherOp(EncContext, out, &tmp1_outlen, outSize, |
| + (unsigned char *)in, inSize); |
| + if (rv != SECSuccess) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "PK11_CipherOp", |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| + "Error code = %d", PORT_GetError()); |
| + goto done; |
| + } |
| + |
| + rv = PK11_DigestFinal(EncContext, out+tmp1_outlen, |
| + &tmp2_outlen, outSize-tmp1_outlen); |
| + if (rv != SECSuccess) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "PK11_DigestFinal", |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| + "Error code = %d", PORT_GetError()); |
| + goto done; |
| + } |
| + |
| + result_len = tmp1_outlen + tmp2_outlen; |
| + |
| +done: |
| + if (secParam) { |
| + SECITEM_FreeItem(secParam, PR_TRUE); |
| + } |
| + if (EncContext) { |
| + PK11_DestroyContext(EncContext, PR_TRUE); |
| + } |
| + |
| + return(result_len); |
| +} |
| + |
| +static int |
| +xmlSecNssKeyWrapDesOp( |
| + xmlSecNssKeyWrapCtxPtr ctx , |
| + int encrypt , |
| + xmlSecBufferPtr result |
| +) { |
| + xmlSecByte sha1[SHA1_LENGTH]; |
| + xmlSecByte iv[XMLSEC_NSS_DES3_IV_LENGTH]; |
| + xmlSecByte* in; |
| + xmlSecSize inSize; |
| + xmlSecByte* out; |
| + xmlSecSize outSize; |
| + xmlSecSize s; |
| + int ret; |
| + SECStatus status; |
| + |
| + xmlSecAssert2( ctx != NULL , -1 ) ; |
| + xmlSecAssert2( ctx->cipher != CKM_INVALID_MECHANISM , -1 ) ; |
| + xmlSecAssert2( ctx->symkey != NULL , -1 ) ; |
| + xmlSecAssert2( ctx->keyId != NULL , -1 ) ; |
| + xmlSecAssert2( ctx->material != NULL , -1 ) ; |
| + xmlSecAssert2( result != NULL , -1 ) ; |
| + |
| + in = xmlSecBufferGetData(ctx->material); |
| + inSize = xmlSecBufferGetSize(ctx->material) ; |
| + out = xmlSecBufferGetData(result); |
| + outSize = xmlSecBufferGetMaxSize(result) ; |
| + if( encrypt ) { |
| + /* step 2: calculate sha1 and CMS */ |
| + if(xmlSecNssComputeSHA1(in, inSize, sha1, SHA1_LENGTH) == NULL) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "xmlSecNssComputeSHA1", |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + return(-1); |
| + } |
| + |
| + /* step 3: construct WKCKS */ |
| + memcpy(out, in, inSize); |
| + memcpy(out + inSize, sha1, XMLSEC_NSS_DES3_BLOCK_LENGTH); |
| + |
| + /* step 4: generate random iv */ |
| + status = PK11_GenerateRandom(iv, XMLSEC_NSS_DES3_IV_LENGTH); |
| + if(status != SECSuccess) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "PK11_GenerateRandom", |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| + "error code = %d", PORT_GetError()); |
| + return(-1); |
| + } |
| + |
| + /* step 5: first encryption, result is TEMP1 */ |
| + ret = xmlSecNssKWDes3Encrypt( ctx->symkey, ctx->cipher, |
| + iv, XMLSEC_NSS_DES3_IV_LENGTH, |
| + out, inSize + XMLSEC_NSS_DES3_IV_LENGTH, |
| + out, outSize, 1); |
| + if(ret < 0) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "xmlSecNssKWDes3Encrypt", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + return(-1); |
| + } |
| + |
| + /* step 6: construct TEMP2=IV || TEMP1 */ |
| + memmove(out + XMLSEC_NSS_DES3_IV_LENGTH, out, |
| + inSize + XMLSEC_NSS_DES3_IV_LENGTH); |
| + memcpy(out, iv, XMLSEC_NSS_DES3_IV_LENGTH); |
| + s = ret + XMLSEC_NSS_DES3_IV_LENGTH; |
| + |
| + /* step 7: reverse octets order, result is TEMP3 */ |
| + ret = xmlSecNssKWDes3BufferReverse(out, s); |
| + if(ret < 0) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "xmlSecNssKWDes3BufferReverse", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + return(-1); |
| + } |
| + |
| + /* step 8: second encryption with static IV */ |
| + ret = xmlSecNssKWDes3Encrypt( ctx->symkey, ctx->cipher, |
| + xmlSecNssKWDes3Iv, XMLSEC_NSS_DES3_IV_LENGTH, |
| + out, s, |
| + out, outSize, 1); |
| + if(ret < 0) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "xmlSecNssKWDes3Encrypt", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + return(-1); |
| + } |
| + s = ret; |
| + |
| + if( xmlSecBufferSetSize( result , s ) < 0 ) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "xmlSecBufferSetSize", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + return(-1); |
| + } |
| + } else { |
| + /* step 2: first decryption with static IV, result is TEMP3 */ |
| + ret = xmlSecNssKWDes3Encrypt( ctx->symkey, ctx->cipher, |
| + xmlSecNssKWDes3Iv, XMLSEC_NSS_DES3_IV_LENGTH, |
| + in, inSize, |
| + out, outSize, 0); |
| + if((ret < 0) || (ret < XMLSEC_NSS_DES3_IV_LENGTH)) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "xmlSecNssKWDes3Encrypt", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + return(-1); |
| + } |
| + s = ret; |
| + |
| + /* step 3: reverse octets order in TEMP3, result is TEMP2 */ |
| + ret = xmlSecNssKWDes3BufferReverse(out, s); |
| + if(ret < 0) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "xmlSecNssKWDes3BufferReverse", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + return(-1); |
| + } |
| + |
| + /* steps 4 and 5: get IV and decrypt second time, result is WKCKS */ |
| + ret = xmlSecNssKWDes3Encrypt( ctx->symkey, ctx->cipher, |
| + out, XMLSEC_NSS_DES3_IV_LENGTH, |
| + out+XMLSEC_NSS_DES3_IV_LENGTH, s-XMLSEC_NSS_DES3_IV_LENGTH, |
| + out, outSize, 0); |
| + if((ret < 0) || (ret < XMLSEC_NSS_DES3_BLOCK_LENGTH)) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "xmlSecNssKWDes3Encrypt", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + return(-1); |
| + } |
| + s = ret - XMLSEC_NSS_DES3_IV_LENGTH; |
| + |
| + /* steps 6 and 7: calculate SHA1 and validate it */ |
| + if(xmlSecNssComputeSHA1(out, s, sha1, SHA1_LENGTH) == NULL) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "xmlSecNssComputeSHA1", |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + return(-1); |
| + } |
| + |
| + if(memcmp(sha1, out + s, XMLSEC_NSS_DES3_BLOCK_LENGTH) != 0) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + NULL, |
| + XMLSEC_ERRORS_R_INVALID_DATA, |
| + "SHA1 does not match"); |
| + return(-1); |
| + } |
| + |
| + if( xmlSecBufferSetSize( result , s ) < 0 ) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "xmlSecBufferSetSize", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + return(-1); |
| + } |
| + } |
| + |
| + return(0); |
| +} |
| + |
| +static int |
| +xmlSecNssKeyWrapAesOp( |
| + xmlSecNssKeyWrapCtxPtr ctx , |
| + int encrypt , |
| + xmlSecBufferPtr result |
| +) { |
| + PK11Context* cipherCtx = NULL; |
| + SECItem ivItem ; |
| + SECItem* secParam = NULL ; |
| + xmlSecSize inSize ; |
| + xmlSecSize inBlocks ; |
| + int blockSize ; |
| + int midSize ; |
| + int finSize ; |
| + xmlSecByte* out ; |
| + xmlSecSize outSize; |
| + |
| + xmlSecAssert2( ctx != NULL , -1 ) ; |
| + xmlSecAssert2( ctx->cipher != CKM_INVALID_MECHANISM , -1 ) ; |
| + xmlSecAssert2( ctx->symkey != NULL , -1 ) ; |
| + xmlSecAssert2( ctx->keyId != NULL , -1 ) ; |
| + xmlSecAssert2( ctx->material != NULL , -1 ) ; |
| + xmlSecAssert2( result != NULL , -1 ) ; |
| + |
| + /* Do not set any IV */ |
| + memset(&ivItem, 0, sizeof(ivItem)); |
| + |
| + /* Get block size */ |
| + if( ( blockSize = PK11_GetBlockSize( ctx->cipher , NULL ) ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "PK11_GetBlockSize" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + |
| + inSize = xmlSecBufferGetSize( ctx->material ) ; |
| + if( xmlSecBufferSetMaxSize( result , inSize + blockSize ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecBufferSetMaxSize" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + |
| + /* Get Param for context initialization */ |
| + if( ( secParam = PK11_ParamFromIV( ctx->cipher , &ivItem ) ) == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "PK11_ParamFromIV" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + |
| + cipherCtx = PK11_CreateContextBySymKey( ctx->cipher , encrypt ? CKA_ENCRYPT : CKA_DECRYPT , ctx->symkey , secParam ) ; |
| + if( cipherCtx == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "PK11_CreateContextBySymKey" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + SECITEM_FreeItem( secParam , PR_TRUE ) ; |
| + return(-1); |
| + } |
| + |
| + out = xmlSecBufferGetData(result) ; |
| + outSize = xmlSecBufferGetMaxSize(result) ; |
| + if( PK11_CipherOp( cipherCtx , out, &midSize , outSize , xmlSecBufferGetData( ctx->material ) , inSize ) != SECSuccess ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "PK11_CipherOp" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + |
| + if( PK11_DigestFinal( cipherCtx , out + midSize , &finSize , outSize - midSize ) != SECSuccess ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "PK11_DigestFinal" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + |
| + if( xmlSecBufferSetSize( result , midSize + finSize ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecBufferSetSize" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + |
| + return 0 ; |
| +} |
| + |
| +/** |
| + * Block cipher transform final |
| + */ |
| +static int |
| +xmlSecNssKeyWrapCtxFinal( |
| + xmlSecNssKeyWrapCtxPtr ctx , |
| + xmlSecBufferPtr in , |
| + xmlSecBufferPtr out , |
| + int encrypt , |
| + xmlSecTransformCtxPtr transformCtx |
| +) { |
| + PK11SymKey* targetKey ; |
| + xmlSecSize blockSize ; |
| + xmlSecBufferPtr result ; |
| + |
| + xmlSecAssert2( ctx != NULL , -1 ) ; |
| + xmlSecAssert2( ctx->cipher != CKM_INVALID_MECHANISM , -1 ) ; |
| + xmlSecAssert2( ctx->symkey != NULL , -1 ) ; |
| + xmlSecAssert2( ctx->keyId != NULL , -1 ) ; |
| + xmlSecAssert2( ctx->material != NULL , -1 ) ; |
| + xmlSecAssert2( in != NULL , -1 ) ; |
| + xmlSecAssert2( out != NULL , -1 ) ; |
| + xmlSecAssert2( transformCtx != NULL , -1 ) ; |
| + |
| + /* read raw key material and append into context */ |
| + if( xmlSecBufferAppend( ctx->material, xmlSecBufferGetData(in), xmlSecBufferGetSize(in) ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecBufferAppend" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + |
| + if( xmlSecBufferRemoveHead( in , xmlSecBufferGetSize(in) ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecBufferRemoveHead" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + |
| + /* Now we get all of the key materail */ |
| + /* from now on we will wrap or unwrap the key */ |
| + if( ( blockSize = PK11_GetBlockSize( ctx->cipher , NULL ) ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "PK11_GetBlockSize" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + |
| + result = xmlSecBufferCreate( blockSize ) ; |
| + if( result == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecBufferCreate" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + |
| + switch( ctx->cipher ) { |
| + case CKM_DES3_CBC : |
| + if( xmlSecNssKeyWrapDesOp(ctx, encrypt, result) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecNssKeyWrapDesOp" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + xmlSecBufferDestroy(result); |
| + return(-1); |
| + } |
| + break ; |
| + /* case CKM_NETSCAPE_AES_KEY_WRAP :*/ |
| + case CKM_AES_CBC : |
| + if( xmlSecNssKeyWrapAesOp(ctx, encrypt, result) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecNssKeyWrapAesOp" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + xmlSecBufferDestroy(result); |
| + return(-1); |
| + } |
| + break ; |
| + } |
| + |
| + /* Write output */ |
| + if( xmlSecBufferAppend( out, xmlSecBufferGetData(result), xmlSecBufferGetSize(result) ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecBufferAppend" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + xmlSecBufferDestroy(result); |
| + return(-1); |
| + } |
| + xmlSecBufferDestroy(result); |
| + |
| + return(0); |
| +} |
| + |
| +static int |
| +xmlSecNssKeyWrapExecute(xmlSecTransformPtr transform, int last, xmlSecTransformCtxPtr transformCtx) { |
| + xmlSecNssKeyWrapCtxPtr context = NULL ; |
| + xmlSecBufferPtr inBuf, outBuf ; |
| + int operation ; |
| + int rtv ; |
| + |
| + xmlSecAssert2( xmlSecNssKeyWrapCheckId( transform ), -1 ) ; |
| + xmlSecAssert2( xmlSecTransformCheckSize( transform, xmlSecNssKeyWrapSize ), -1 ) ; |
| + xmlSecAssert2( ( transform->operation == xmlSecTransformOperationEncrypt ) || ( transform->operation == xmlSecTransformOperationDecrypt ), -1 ) ; |
| + xmlSecAssert2( transformCtx != NULL , -1 ) ; |
| + |
| + context = xmlSecNssKeyWrapGetCtx( transform ) ; |
| + if( context == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecTransformGetName( transform ) ) , |
| + "xmlSecNssKeyWrapGetCtx" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + |
| + inBuf = &( transform->inBuf ) ; |
| + outBuf = &( transform->outBuf ) ; |
| + |
| + if( transform->status == xmlSecTransformStatusNone ) { |
| + transform->status = xmlSecTransformStatusWorking ; |
| + } |
| + |
| + operation = ( transform->operation == xmlSecTransformOperationEncrypt ) ? 1 : 0 ; |
| + if( transform->status == xmlSecTransformStatusWorking ) { |
| + if( context->material == NULL ) { |
| + rtv = xmlSecNssKeyWrapCtxInit( context, inBuf , outBuf , operation , transformCtx ) ; |
| + if( rtv < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecTransformGetName( transform ) ) , |
| + "xmlSecNssKeyWrapCtxInit" , |
| + XMLSEC_ERRORS_R_INVALID_STATUS , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + } |
| + |
| + if( context->material == NULL && last != 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecTransformGetName( transform ) ) , |
| + NULL , |
| + XMLSEC_ERRORS_R_INVALID_STATUS , |
| + "No enough data to intialize transform" ) ; |
| + return(-1); |
| + } |
| + |
| + if( context->material != NULL ) { |
| + rtv = xmlSecNssKeyWrapCtxUpdate( context, inBuf , outBuf , operation , transformCtx ) ; |
| + if( rtv < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecTransformGetName( transform ) ) , |
| + "xmlSecNssKeyWrapCtxUpdate" , |
| + XMLSEC_ERRORS_R_INVALID_STATUS , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + } |
| + |
| + if( last ) { |
| + rtv = xmlSecNssKeyWrapCtxFinal( context, inBuf , outBuf , operation , transformCtx ) ; |
| + if( rtv < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecTransformGetName( transform ) ) , |
| + "xmlSecNssKeyWrapCtxFinal" , |
| + XMLSEC_ERRORS_R_INVALID_STATUS , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + transform->status = xmlSecTransformStatusFinished ; |
| + } |
| + } else if( transform->status == xmlSecTransformStatusFinished ) { |
| + if( xmlSecBufferGetSize( inBuf ) != 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecTransformGetName( transform ) ) , |
| + NULL , |
| + XMLSEC_ERRORS_R_INVALID_STATUS , |
| + "status=%d", transform->status ) ; |
| + return(-1); |
| + } |
| + } else { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecTransformGetName( transform ) ) , |
| + NULL , |
| + XMLSEC_ERRORS_R_INVALID_STATUS , |
| + "status=%d", transform->status ) ; |
| + return(-1); |
| + } |
| + |
| + return(0); |
| +} |
| + |
| +#ifndef XMLSEC_NO_AES |
| + |
| + |
| +#ifdef __MINGW32__ // for runtime-pseudo-reloc |
| +static struct _xmlSecTransformKlass xmlSecNssKWAes128Klass = { |
| +#else |
| +static xmlSecTransformKlass xmlSecNssKWAes128Klass = { |
| +#endif |
| + /* klass/object sizes */ |
| + sizeof(xmlSecTransformKlass), /* xmlSecSize klassSize */ |
| + xmlSecNssKeyWrapSize, /* xmlSecSize objSize */ |
| + |
| + xmlSecNameKWAes128, /* const xmlChar* name; */ |
| + xmlSecHrefKWAes128, /* const xmlChar* href; */ |
| + xmlSecTransformUsageEncryptionMethod, /* xmlSecAlgorithmUsage usage; */ |
| + |
| + xmlSecNssKeyWrapInitialize, /* xmlSecTransformInitializeMethod initialize; */ |
| + xmlSecNssKeyWrapFinalize, /* xmlSecTransformFinalizeMethod finalize; */ |
| + NULL, /* xmlSecTransformNodeReadMethod readNode; */ |
| + NULL, /* xmlSecTransformNodeWriteMethod writeNode; */ |
| + xmlSecNssKeyWrapSetKeyReq, /* xmlSecTransformSetKeyMethod setKeyReq; */ |
| + xmlSecNssKeyWrapSetKey, /* xmlSecTransformSetKeyMethod setKey; */ |
| + NULL, /* xmlSecTransformValidateMethod validate; */ |
| + xmlSecTransformDefaultGetDataType, /* xmlSecTransformGetDataTypeMethod getDataType; */ |
| + xmlSecTransformDefaultPushBin, /* xmlSecTransformPushBinMethod pushBin; */ |
| + xmlSecTransformDefaultPopBin, /* xmlSecTransformPopBinMethod popBin; */ |
| + NULL, /* xmlSecTransformPushXmlMethod pushXml; */ |
| + NULL, /* xmlSecTransformPopXmlMethod popXml; */ |
| + xmlSecNssKeyWrapExecute, /* xmlSecTransformExecuteMethod execute; */ |
| + |
| + NULL, /* void* reserved0; */ |
| + NULL, /* void* reserved1; */ |
| +}; |
| + |
| +#ifdef __MINGW32__ // for runtime-pseudo-reloc |
| +static struct _xmlSecTransformKlass xmlSecNssKWAes192Klass = { |
| +#else |
| +static xmlSecTransformKlass xmlSecNssKWAes192Klass = { |
| +#endif |
| + /* klass/object sizes */ |
| + sizeof(xmlSecTransformKlass), /* xmlSecSize klassSize */ |
| + xmlSecNssKeyWrapSize, /* xmlSecSize objSize */ |
| + |
| + xmlSecNameKWAes192, /* const xmlChar* name; */ |
| + xmlSecHrefKWAes192, /* const xmlChar* href; */ |
| + xmlSecTransformUsageEncryptionMethod, /* xmlSecAlgorithmUsage usage; */ |
| + |
| + xmlSecNssKeyWrapInitialize, /* xmlSecTransformInitializeMethod initialize; */ |
| + xmlSecNssKeyWrapFinalize, /* xmlSecTransformFinalizeMethod finalize; */ |
| + NULL, /* xmlSecTransformNodeReadMethod readNode; */ |
| + NULL, /* xmlSecTransformNodeWriteMethod writeNode; */ |
| + xmlSecNssKeyWrapSetKeyReq, /* xmlSecTransformSetKeyMethod setKeyReq; */ |
| + xmlSecNssKeyWrapSetKey, /* xmlSecTransformSetKeyMethod setKey; */ |
| + NULL, /* xmlSecTransformValidateMethod validate; */ |
| + xmlSecTransformDefaultGetDataType, /* xmlSecTransformGetDataTypeMethod getDataType; */ |
| + xmlSecTransformDefaultPushBin, /* xmlSecTransformPushBinMethod pushBin; */ |
| + xmlSecTransformDefaultPopBin, /* xmlSecTransformPopBinMethod popBin; */ |
| + NULL, /* xmlSecTransformPushXmlMethod pushXml; */ |
| + NULL, /* xmlSecTransformPopXmlMethod popXml; */ |
| + xmlSecNssKeyWrapExecute, /* xmlSecTransformExecuteMethod execute; */ |
| + |
| + NULL, /* void* reserved0; */ |
| + NULL, /* void* reserved1; */ |
| +}; |
| + |
| +#ifdef __MINGW32__ // for runtime-pseudo-reloc |
| +static struct _xmlSecTransformKlass xmlSecNssKWAes256Klass = { |
| +#else |
| +static xmlSecTransformKlass xmlSecNssKWAes256Klass = { |
| +#endif |
| + /* klass/object sizes */ |
| + sizeof(xmlSecTransformKlass), /* xmlSecSize klassSize */ |
| + xmlSecNssKeyWrapSize, /* xmlSecSize objSize */ |
| + |
| + xmlSecNameKWAes256, /* const xmlChar* name; */ |
| + xmlSecHrefKWAes256, /* const xmlChar* href; */ |
| + xmlSecTransformUsageEncryptionMethod, /* xmlSecAlgorithmUsage usage; */ |
| + |
| + xmlSecNssKeyWrapInitialize, /* xmlSecTransformInitializeMethod initialize; */ |
| + xmlSecNssKeyWrapFinalize, /* xmlSecTransformFinalizeMethod finalize; */ |
| + NULL, /* xmlSecTransformNodeReadMethod readNode; */ |
| + NULL, /* xmlSecTransformNodeWriteMethod writeNode; */ |
| + xmlSecNssKeyWrapSetKeyReq, /* xmlSecTransformSetKeyMethod setKeyReq; */ |
| + xmlSecNssKeyWrapSetKey, /* xmlSecTransformSetKeyMethod setKey; */ |
| + NULL, /* xmlSecTransformValidateMethod validate; */ |
| + xmlSecTransformDefaultGetDataType, /* xmlSecTransformGetDataTypeMethod getDataType; */ |
| + xmlSecTransformDefaultPushBin, /* xmlSecTransformPushBinMethod pushBin; */ |
| + xmlSecTransformDefaultPopBin, /* xmlSecTransformPopBinMethod popBin; */ |
| + NULL, /* xmlSecTransformPushXmlMethod pushXml; */ |
| + NULL, /* xmlSecTransformPopXmlMethod popXml; */ |
| + xmlSecNssKeyWrapExecute, /* xmlSecTransformExecuteMethod execute; */ |
| + |
| + NULL, /* void* reserved0; */ |
| + NULL, /* void* reserved1; */ |
| +}; |
| + |
| +/** |
| + * xmlSecNssTransformKWAes128GetKlass: |
| + * |
| + * The AES-128 key wrapper transform klass. |
| + * |
| + * Returns AES-128 key wrapper transform klass. |
| + */ |
| +xmlSecTransformId |
| +xmlSecNssTransformKWAes128GetKlass(void) { |
| + return(&xmlSecNssKWAes128Klass); |
| +} |
| + |
| +/** |
| + * xmlSecNssTransformKWAes192GetKlass: |
| + * |
| + * The AES-192 key wrapper transform klass. |
| + * |
| + * Returns AES-192 key wrapper transform klass. |
| + */ |
| +xmlSecTransformId |
| +xmlSecNssTransformKWAes192GetKlass(void) { |
| + return(&xmlSecNssKWAes192Klass); |
| +} |
| + |
| +/** |
| + * |
| + * The AES-256 key wrapper transform klass. |
| + * |
| + * Returns AES-256 key wrapper transform klass. |
| + */ |
| +xmlSecTransformId |
| +xmlSecNssTransformKWAes256GetKlass(void) { |
| + return(&xmlSecNssKWAes256Klass); |
| +} |
| + |
| +#endif /* XMLSEC_NO_AES */ |
| + |
| + |
| +#ifndef XMLSEC_NO_DES |
| + |
| +#ifdef __MINGW32__ // for runtime-pseudo-reloc |
| +static struct _xmlSecTransformKlass xmlSecNssKWDes3Klass = { |
| +#else |
| +static xmlSecTransformKlass xmlSecNssKWDes3Klass = { |
| +#endif |
| + /* klass/object sizes */ |
| + sizeof(xmlSecTransformKlass), /* xmlSecSize klassSize */ |
| + xmlSecNssKeyWrapSize, /* xmlSecSize objSize */ |
| + |
| + xmlSecNameKWDes3, /* const xmlChar* name; */ |
| + xmlSecHrefKWDes3, /* const xmlChar* href; */ |
| + xmlSecTransformUsageEncryptionMethod, /* xmlSecAlgorithmUsage usage; */ |
| + |
| + xmlSecNssKeyWrapInitialize, /* xmlSecTransformInitializeMethod initialize; */ |
| + xmlSecNssKeyWrapFinalize, /* xmlSecTransformFinalizeMethod finalize; */ |
| + NULL, /* xmlSecTransformNodeReadMethod readNode; */ |
| + NULL, /* xmlSecTransformNodeWriteMethod writeNode; */ |
| + xmlSecNssKeyWrapSetKeyReq, /* xmlSecTransformSetKeyMethod setKeyReq; */ |
| + xmlSecNssKeyWrapSetKey, /* xmlSecTransformSetKeyMethod setKey; */ |
| + NULL, /* xmlSecTransformValidateMethod validate; */ |
| + xmlSecTransformDefaultGetDataType, /* xmlSecTransformGetDataTypeMethod getDataType; */ |
| + xmlSecTransformDefaultPushBin, /* xmlSecTransformPushBinMethod pushBin; */ |
| + xmlSecTransformDefaultPopBin, /* xmlSecTransformPopBinMethod popBin; */ |
| + NULL, /* xmlSecTransformPushXmlMethod pushXml; */ |
| + NULL, /* xmlSecTransformPopXmlMethod popXml; */ |
| + xmlSecNssKeyWrapExecute, /* xmlSecTransformExecuteMethod execute; */ |
| + |
| + NULL, /* void* reserved0; */ |
| + NULL, /* void* reserved1; */ |
| +}; |
| + |
| +/** |
| + * xmlSecNssTransformKWDes3GetKlass: |
| + * |
| + * The Triple DES key wrapper transform klass. |
| + * |
| + * Returns Triple DES key wrapper transform klass. |
| + */ |
| +xmlSecTransformId |
| +xmlSecNssTransformKWDes3GetKlass(void) { |
| + return(&xmlSecNssKWDes3Klass); |
| +} |
| + |
| +#endif /* XMLSEC_NO_DES */ |
| + |
| --- misc/xmlsec1-1.2.14/src/nss/pkikeys.c 2009-06-25 22:53:18.000000000 +0200 |
| +++ misc/build/xmlsec1-1.2.14/src/nss/pkikeys.c 2009-09-21 14:02:48.657352624 +0200 |
| @@ -24,6 +24,7 @@ |
| #include <xmlsec/nss/crypto.h> |
| #include <xmlsec/nss/bignum.h> |
| #include <xmlsec/nss/pkikeys.h> |
| +#include <xmlsec/nss/tokens.h> |
| |
| /************************************************************************** |
| * |
| @@ -115,6 +116,8 @@ |
| xmlSecNssPKIKeyDataCtxPtr ctxSrc) |
| { |
| xmlSecNSSPKIKeyDataCtxFree(ctxDst); |
| + ctxDst->privkey = NULL ; |
| + ctxDst->pubkey = NULL ; |
| if (ctxSrc->privkey != NULL) { |
| ctxDst->privkey = SECKEY_CopyPrivateKey(ctxSrc->privkey); |
| if(ctxDst->privkey == NULL) { |
| @@ -588,13 +591,13 @@ |
| goto done; |
| } |
| |
| - slot = PK11_GetBestSlot(CKM_DSA, NULL); |
| + slot = xmlSecNssSlotGet(CKM_DSA); |
| if(slot == NULL) { |
| xmlSecError(XMLSEC_ERRORS_HERE, |
| xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| - "PK11_GetBestSlot", |
| + "xmlSecNssSlotGet", |
| XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| + "error code=%d", PORT_GetError()); |
| ret = -1; |
| goto done; |
| } |
| @@ -792,14 +795,14 @@ |
| if (slot != NULL) { |
| PK11_FreeSlot(slot); |
| } |
| - if (ret != 0) { |
| + |
| if (pubkey != NULL) { |
| SECKEY_DestroyPublicKey(pubkey); |
| } |
| if (data != NULL) { |
| xmlSecKeyDataDestroy(data); |
| } |
| - } |
| + |
| return(ret); |
| } |
| |
| @@ -818,7 +821,7 @@ |
| |
| ctx = xmlSecNssPKIKeyDataGetCtx(xmlSecKeyGetValue(key)); |
| xmlSecAssert2(ctx != NULL, -1); |
| - xmlSecAssert2(SECKEY_GetPublicKeyType(ctx->pubkey) == dsaKey, -1); |
| +/* xmlSecAssert2(SECKEY_GetPublicKeyType(ctx->pubkey) == dsaKey, -1);*/ |
| |
| if(((xmlSecKeyDataTypePublic | xmlSecKeyDataTypePrivate) & keyInfoCtx->keyReq.keyType) == 0) { |
| /* we can have only private key or public key */ |
| @@ -940,7 +943,8 @@ |
| xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)), |
| "PK11_PQG_ParamGen", |
| XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| - "size=%d", sizeBits); |
| + "size=%d, error code=%d", sizeBits, PORT_GetError()); |
| + ret = -1; |
| goto done; |
| } |
| |
| @@ -950,11 +954,12 @@ |
| xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)), |
| "PK11_PQG_VerifyParams", |
| XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| - "size=%d", sizeBits); |
| + "size=%d, error code=%d", sizeBits, PORT_GetError()); |
| + ret = -1; |
| goto done; |
| } |
| |
| - slot = PK11_GetBestSlot(CKM_DSA_KEY_PAIR_GEN, NULL); |
| + slot = xmlSecNssSlotGet(CKM_DSA_KEY_PAIR_GEN); |
| PK11_Authenticate(slot, PR_TRUE, NULL /* default pwd callback */); |
| privkey = PK11_GenerateKeyPair(slot, CKM_DSA_KEY_PAIR_GEN, pqgParams, |
| &pubkey, PR_FALSE, PR_TRUE, NULL); |
| @@ -964,8 +969,9 @@ |
| xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)), |
| "PK11_GenerateKeyPair", |
| XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| + "error code=%d", PORT_GetError()); |
| |
| + ret = -1; |
| goto done; |
| } |
| |
| @@ -979,6 +985,8 @@ |
| goto done; |
| } |
| |
| + privkey = NULL ; |
| + pubkey = NULL ; |
| ret = 0; |
| |
| done: |
| @@ -991,16 +999,13 @@ |
| if (pqgVerify != NULL) { |
| PK11_PQG_DestroyVerify(pqgVerify); |
| } |
| - if (ret == 0) { |
| - return (0); |
| - } |
| if (pubkey != NULL) { |
| SECKEY_DestroyPublicKey(pubkey); |
| } |
| if (privkey != NULL) { |
| SECKEY_DestroyPrivateKey(privkey); |
| } |
| - return(-1); |
| + return(ret); |
| } |
| |
| static xmlSecKeyDataType |
| @@ -1010,10 +1015,10 @@ |
| xmlSecAssert2(xmlSecKeyDataCheckId(data, xmlSecNssKeyDataDsaId), xmlSecKeyDataTypeUnknown); |
| ctx = xmlSecNssPKIKeyDataGetCtx(data); |
| xmlSecAssert2(ctx != NULL, -1); |
| - xmlSecAssert2(SECKEY_GetPublicKeyType(ctx->pubkey) == dsaKey, -1); |
| +/* xmlSecAssert2(SECKEY_GetPublicKeyType(ctx->pubkey) == dsaKey, -1);*/ |
| if (ctx->privkey != NULL) { |
| return(xmlSecKeyDataTypePrivate | xmlSecKeyDataTypePublic); |
| - } else { |
| + } else if( ctx->pubkey != NULL ) { |
| return(xmlSecKeyDataTypePublic); |
| } |
| |
| @@ -1027,7 +1032,7 @@ |
| xmlSecAssert2(xmlSecKeyDataCheckId(data, xmlSecNssKeyDataDsaId), 0); |
| ctx = xmlSecNssPKIKeyDataGetCtx(data); |
| xmlSecAssert2(ctx != NULL, -1); |
| - xmlSecAssert2(SECKEY_GetPublicKeyType(ctx->pubkey) == dsaKey, -1); |
| +/* xmlSecAssert2(SECKEY_GetPublicKeyType(ctx->pubkey) == dsaKey, -1);*/ |
| |
| return(8 * SECKEY_PublicKeyStrength(ctx->pubkey)); |
| } |
| @@ -1216,13 +1221,13 @@ |
| goto done; |
| } |
| |
| - slot = PK11_GetBestSlot(CKM_RSA_PKCS, NULL); |
| + slot = xmlSecNssSlotGet(CKM_RSA_PKCS); |
| if(slot == NULL) { |
| xmlSecError(XMLSEC_ERRORS_HERE, |
| xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| - "PK11_GetBestSlot", |
| + "xmlSecNssSlotGet", |
| XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| + "error code=%d", PORT_GetError()); |
| ret = -1; |
| goto done; |
| } |
| @@ -1384,7 +1389,7 @@ |
| |
| ctx = xmlSecNssPKIKeyDataGetCtx(xmlSecKeyGetValue(key)); |
| xmlSecAssert2(ctx != NULL, -1); |
| - xmlSecAssert2(SECKEY_GetPublicKeyType(ctx->pubkey) == rsaKey, -1); |
| +/* xmlSecAssert2(SECKEY_GetPublicKeyType(ctx->pubkey) == rsaKey, -1);*/ |
| |
| |
| if(((xmlSecKeyDataTypePublic | xmlSecKeyDataTypePrivate) & keyInfoCtx->keyReq.keyType) == 0) { |
| @@ -1455,7 +1460,7 @@ |
| params.keySizeInBits = sizeBits; |
| params.pe = 65537; |
| |
| - slot = PK11_GetBestSlot(CKM_RSA_PKCS_KEY_PAIR_GEN, NULL); |
| + slot = xmlSecNssSlotGet(CKM_RSA_PKCS_KEY_PAIR_GEN); |
| PK11_Authenticate(slot, PR_TRUE, NULL /* default pwd callback */); |
| privkey = PK11_GenerateKeyPair(slot, CKM_RSA_PKCS_KEY_PAIR_GEN, ¶ms, |
| &pubkey, PR_FALSE, PR_TRUE, NULL); |
| @@ -1525,7 +1530,7 @@ |
| |
| ctx = xmlSecNssPKIKeyDataGetCtx(data); |
| xmlSecAssert2(ctx != NULL, -1); |
| - xmlSecAssert2(SECKEY_GetPublicKeyType(ctx->pubkey) == rsaKey, -1); |
| +/* xmlSecAssert2(SECKEY_GetPublicKeyType(ctx->pubkey) == rsaKey, -1);*/ |
| |
| return(8 * SECKEY_PublicKeyStrength(ctx->pubkey)); |
| } |
| --- misc/xmlsec1-1.2.14/src/nss/symkeys.c 2009-06-25 22:53:18.000000000 +0200 |
| +++ misc/build/xmlsec1-1.2.14/src/nss/symkeys.c 2009-09-21 14:02:48.620574832 +0200 |
| @@ -15,20 +15,41 @@ |
| #include <stdio.h> |
| #include <string.h> |
| |
| +#include <pk11func.h> |
| +#include <nss.h> |
| + |
| #include <xmlsec/xmlsec.h> |
| #include <xmlsec/xmltree.h> |
| +#include <xmlsec/base64.h> |
| #include <xmlsec/keys.h> |
| #include <xmlsec/keyinfo.h> |
| #include <xmlsec/transforms.h> |
| #include <xmlsec/errors.h> |
| |
| #include <xmlsec/nss/crypto.h> |
| +#include <xmlsec/nss/ciphers.h> |
| +#include <xmlsec/nss/tokens.h> |
| |
| /***************************************************************************** |
| * |
| - * Symmetic (binary) keys - just a wrapper for xmlSecKeyDataBinary |
| + * Symmetic (binary) keys - a wrapper over slot information and PK11SymKey |
| * |
| ****************************************************************************/ |
| +typedef struct _xmlSecNssSymKeyDataCtx xmlSecNssSymKeyDataCtx ; |
| +typedef struct _xmlSecNssSymKeyDataCtx* xmlSecNssSymKeyDataCtxPtr ; |
| + |
| +struct _xmlSecNssSymKeyDataCtx { |
| + CK_MECHANISM_TYPE cipher ; /* the symmetic key mechanism */ |
| + PK11SlotInfo* slot ; /* the key resident slot */ |
| + PK11SymKey* symkey ; /* the symmetic key */ |
| +} ; |
| + |
| +#define xmlSecNssSymKeyDataSize \ |
| + ( sizeof( xmlSecKeyData ) + sizeof( xmlSecNssSymKeyDataCtx ) ) |
| + |
| +#define xmlSecNssSymKeyDataGetCtx( data ) \ |
| + ( ( xmlSecNssSymKeyDataCtxPtr )( ( ( xmlSecByte* )( data ) ) + sizeof( xmlSecKeyData ) ) ) |
| + |
| static int xmlSecNssSymKeyDataInitialize (xmlSecKeyDataPtr data); |
| static int xmlSecNssSymKeyDataDuplicate (xmlSecKeyDataPtr dst, |
| xmlSecKeyDataPtr src); |
| @@ -67,107 +88,743 @@ |
| (xmlSecKeyDataIsValid((data)) && \ |
| xmlSecNssSymKeyDataKlassCheck((data)->id)) |
| |
| +/** |
| + * xmlSecNssSymKeyDataAdoptKey: |
| + * @data: the pointer to symmetric key data. |
| + * @symkey: the symmetric key |
| + * |
| + * Set the value of symmetric key data. |
| + * |
| + * Returns 0 on success or a negative value if an error occurs. |
| + */ |
| +int |
| +xmlSecNssSymKeyDataAdoptKey( |
| + xmlSecKeyDataPtr data , |
| + PK11SymKey* symkey |
| +) { |
| + xmlSecNssSymKeyDataCtxPtr context = NULL ; |
| + |
| + xmlSecAssert2( xmlSecNssSymKeyDataCheckId( data ), -1 ) ; |
| + xmlSecAssert2( xmlSecKeyDataCheckSize( data, xmlSecNssSymKeyDataSize ), -1 ) ; |
| + xmlSecAssert2( symkey != NULL, -1 ) ; |
| + |
| + context = xmlSecNssSymKeyDataGetCtx( data ) ; |
| + xmlSecAssert2(context != NULL, -1); |
| + |
| + context->cipher = PK11_GetMechanism( symkey ) ; |
| + |
| + if( context->slot != NULL ) { |
| + PK11_FreeSlot( context->slot ) ; |
| + context->slot = NULL ; |
| + } |
| + context->slot = PK11_GetSlotFromKey( symkey ) ; |
| + |
| + if( context->symkey != NULL ) { |
| + PK11_FreeSymKey( context->symkey ) ; |
| + context->symkey = NULL ; |
| + } |
| + context->symkey = PK11_ReferenceSymKey( symkey ) ; |
| + |
| + return 0 ; |
| +} |
| + |
| +xmlSecKeyDataPtr xmlSecNssSymKeyDataKeyAdopt( |
| + PK11SymKey* symKey |
| +) { |
| + xmlSecKeyDataPtr data = NULL ; |
| + CK_MECHANISM_TYPE mechanism = CKM_INVALID_MECHANISM ; |
| + |
| + xmlSecAssert2( symKey != NULL , NULL ) ; |
| + |
| + mechanism = PK11_GetMechanism( symKey ) ; |
| + switch( mechanism ) { |
| + case CKM_DES3_KEY_GEN : |
| + case CKM_DES3_CBC : |
| + case CKM_DES3_MAC : |
| + data = xmlSecKeyDataCreate( xmlSecNssKeyDataDesId ) ; |
| + if( data == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecKeyDataCreate" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + "xmlSecNssKeyDataDesId" ) ; |
| + return NULL ; |
| + } |
| + break ; |
| + case CKM_AES_KEY_GEN : |
| + case CKM_AES_CBC : |
| + case CKM_AES_MAC : |
| + data = xmlSecKeyDataCreate( xmlSecNssKeyDataAesId ) ; |
| + if( data == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecKeyDataCreate" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + "xmlSecNssKeyDataDesId" ) ; |
| + return NULL ; |
| + } |
| + break ; |
| + default : |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + NULL , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + "Unsupported mechanism" ) ; |
| + return NULL ; |
| + } |
| + |
| + if( xmlSecNssSymKeyDataAdoptKey( data , symKey ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + "xmlSecNssSymKeyDataAdoptKey" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + |
| + xmlSecKeyDataDestroy( data ) ; |
| + return NULL ; |
| + } |
| + |
| + return data ; |
| +} |
| + |
| + |
| +PK11SymKey* |
| +xmlSecNssSymKeyDataGetKey( |
| + xmlSecKeyDataPtr data |
| +) { |
| + xmlSecNssSymKeyDataCtxPtr ctx; |
| + PK11SymKey* symkey ; |
| + |
| + xmlSecAssert2(xmlSecNssSymKeyDataCheckId(data), NULL); |
| + xmlSecAssert2(xmlSecKeyDataCheckSize(data, xmlSecNssSymKeyDataSize), NULL); |
| + |
| + ctx = xmlSecNssSymKeyDataGetCtx(data); |
| + xmlSecAssert2(ctx != NULL, NULL); |
| + |
| + if( ctx->symkey != NULL ) { |
| + symkey = PK11_ReferenceSymKey( ctx->symkey ) ; |
| + } else { |
| + symkey = NULL ; |
| + } |
| + |
| + return(symkey); |
| +} |
| + |
| static int |
| xmlSecNssSymKeyDataInitialize(xmlSecKeyDataPtr data) { |
| + xmlSecNssSymKeyDataCtxPtr ctx; |
| + |
| xmlSecAssert2(xmlSecNssSymKeyDataCheckId(data), -1); |
| - |
| - return(xmlSecKeyDataBinaryValueInitialize(data)); |
| + xmlSecAssert2(xmlSecKeyDataCheckSize(data, xmlSecNssSymKeyDataSize), -1); |
| + |
| + ctx = xmlSecNssSymKeyDataGetCtx(data); |
| + xmlSecAssert2(ctx != NULL, -1); |
| + |
| + memset( ctx, 0, sizeof(xmlSecNssSymKeyDataCtx)); |
| + |
| + /* Set the block cipher mechanism */ |
| +#ifndef XMLSEC_NO_DES |
| + if(xmlSecKeyDataCheckId(data, xmlSecNssKeyDataDesId)) { |
| + ctx->cipher = CKM_DES3_KEY_GEN; |
| + } else |
| +#endif /* XMLSEC_NO_DES */ |
| + |
| +#ifndef XMLSEC_NO_AES |
| + if(xmlSecKeyDataCheckId(data, xmlSecNssKeyDataDesId)) { |
| + ctx->cipher = CKM_AES_KEY_GEN; |
| + } else |
| +#endif /* XMLSEC_NO_AES */ |
| + |
| + if(1) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)), |
| + NULL , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + "Unsupported block cipher" ) ; |
| + return(-1) ; |
| + } |
| + |
| + return(0); |
| } |
| |
| static int |
| xmlSecNssSymKeyDataDuplicate(xmlSecKeyDataPtr dst, xmlSecKeyDataPtr src) { |
| + xmlSecNssSymKeyDataCtxPtr ctxDst; |
| + xmlSecNssSymKeyDataCtxPtr ctxSrc; |
| + |
| xmlSecAssert2(xmlSecNssSymKeyDataCheckId(dst), -1); |
| + xmlSecAssert2(xmlSecKeyDataCheckSize(dst, xmlSecNssSymKeyDataSize), -1); |
| xmlSecAssert2(xmlSecNssSymKeyDataCheckId(src), -1); |
| + xmlSecAssert2(xmlSecKeyDataCheckSize(src, xmlSecNssSymKeyDataSize), -1); |
| xmlSecAssert2(dst->id == src->id, -1); |
| - |
| - return(xmlSecKeyDataBinaryValueDuplicate(dst, src)); |
| + |
| + ctxDst = xmlSecNssSymKeyDataGetCtx(dst); |
| + xmlSecAssert2(ctxDst != NULL, -1); |
| + |
| + ctxSrc = xmlSecNssSymKeyDataGetCtx(src); |
| + xmlSecAssert2(ctxSrc != NULL, -1); |
| + |
| + ctxDst->cipher = ctxSrc->cipher ; |
| + |
| + if( ctxSrc->slot != NULL ) { |
| + if( ctxDst->slot != NULL && ctxDst->slot != ctxSrc->slot ) { |
| + PK11_FreeSlot( ctxDst->slot ) ; |
| + ctxDst->slot = NULL ; |
| + } |
| + |
| + if( ctxDst->slot == NULL && ctxSrc->slot != NULL ) |
| + ctxDst->slot = PK11_ReferenceSlot( ctxSrc->slot ) ; |
| + } else { |
| + if( ctxDst->slot != NULL ) { |
| + PK11_FreeSlot( ctxDst->slot ) ; |
| + ctxDst->slot = NULL ; |
| + } |
| + } |
| + |
| + if( ctxSrc->symkey != NULL ) { |
| + if( ctxDst->symkey != NULL && ctxDst->symkey != ctxSrc->symkey ) { |
| + PK11_FreeSymKey( ctxDst->symkey ) ; |
| + ctxDst->symkey = NULL ; |
| + } |
| + |
| + if( ctxDst->symkey == NULL && ctxSrc->symkey != NULL ) |
| + ctxDst->symkey = PK11_ReferenceSymKey( ctxSrc->symkey ) ; |
| + } else { |
| + if( ctxDst->symkey != NULL ) { |
| + PK11_FreeSymKey( ctxDst->symkey ) ; |
| + ctxDst->symkey = NULL ; |
| + } |
| + } |
| + |
| + return(0); |
| } |
| |
| static void |
| xmlSecNssSymKeyDataFinalize(xmlSecKeyDataPtr data) { |
| + xmlSecNssSymKeyDataCtxPtr ctx; |
| + |
| xmlSecAssert(xmlSecNssSymKeyDataCheckId(data)); |
| - |
| - xmlSecKeyDataBinaryValueFinalize(data); |
| + xmlSecAssert(xmlSecKeyDataCheckSize(data, xmlSecNssSymKeyDataSize)); |
| + |
| + ctx = xmlSecNssSymKeyDataGetCtx(data); |
| + xmlSecAssert(ctx != NULL); |
| + |
| + if( ctx->slot != NULL ) { |
| + PK11_FreeSlot( ctx->slot ) ; |
| + ctx->slot = NULL ; |
| + } |
| + |
| + if( ctx->symkey != NULL ) { |
| + PK11_FreeSymKey( ctx->symkey ) ; |
| + ctx->symkey = NULL ; |
| + } |
| + |
| + ctx->cipher = CKM_INVALID_MECHANISM ; |
| } |
| |
| static int |
| xmlSecNssSymKeyDataXmlRead(xmlSecKeyDataId id, xmlSecKeyPtr key, |
| xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx) { |
| - xmlSecAssert2(xmlSecNssSymKeyDataKlassCheck(id), -1); |
| + PK11SymKey* symKey ; |
| + PK11SlotInfo* slot ; |
| + xmlSecBufferPtr keyBuf; |
| + xmlSecSize len; |
| + xmlSecKeyDataPtr data; |
| + xmlSecNssSymKeyDataCtxPtr ctx; |
| + SECItem keyItem ; |
| + int ret; |
| + |
| + xmlSecAssert2(id != xmlSecKeyDataIdUnknown, -1); |
| + xmlSecAssert2(key != NULL, -1); |
| + xmlSecAssert2(node != NULL, -1); |
| + xmlSecAssert2(keyInfoCtx != NULL, -1); |
| + |
| + /* Create a new KeyData from a id */ |
| + data = xmlSecKeyDataCreate(id); |
| + if(data == NULL ) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + "xmlSecKeyDataCreate", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + return(-1); |
| + } |
| + |
| + ctx = xmlSecNssSymKeyDataGetCtx(data); |
| + xmlSecAssert2(ctx != NULL, -1); |
| + |
| + /* Create a buffer for raw symmetric key value */ |
| + if( ( keyBuf = xmlSecBufferCreate( 128 ) ) == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + "xmlSecBufferCreate" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + xmlSecKeyDataDestroy( data ) ; |
| + return(-1) ; |
| + } |
| + |
| + /* Read the raw key value */ |
| + if( xmlSecBufferBase64NodeContentRead( keyBuf , node ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + xmlSecErrorsSafeString(xmlSecNodeGetName(node)), |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + |
| + xmlSecBufferDestroy( keyBuf ) ; |
| + xmlSecKeyDataDestroy( data ) ; |
| + return(-1) ; |
| + } |
| + |
| + /* Get slot */ |
| + slot = xmlSecNssSlotGet(ctx->cipher); |
| + if( slot == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + "xmlSecNssSlotGet" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + |
| + xmlSecBufferDestroy( keyBuf ) ; |
| + xmlSecKeyDataDestroy( data ) ; |
| + return(-1) ; |
| + } |
| + |
| + /* Wrap the raw key value SECItem */ |
| + keyItem.type = siBuffer ; |
| + keyItem.data = xmlSecBufferGetData( keyBuf ) ; |
| + keyItem.len = xmlSecBufferGetSize( keyBuf ) ; |
| + |
| + /* Import the raw key into slot temporalily and get the key handler*/ |
| + symKey = PK11_ImportSymKey(slot, ctx->cipher, PK11_OriginGenerated, CKA_VALUE, &keyItem, NULL ) ; |
| + if( symKey == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + "PK11_ImportSymKey" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + |
| + PK11_FreeSlot( slot ) ; |
| + xmlSecBufferDestroy( keyBuf ) ; |
| + xmlSecKeyDataDestroy( data ) ; |
| + return(-1) ; |
| + } |
| + PK11_FreeSlot( slot ) ; |
| + |
| + /* raw key material has been copied into symKey, it isn't used any more */ |
| + xmlSecBufferDestroy( keyBuf ) ; |
| + |
| + /* Adopt the symmetric key into key data */ |
| + ret = xmlSecNssSymKeyDataAdoptKey(data, symKey); |
| + if(ret < 0) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + "xmlSecKeyDataBinaryValueSetBuffer", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + PK11_FreeSymKey( symKey ) ; |
| + xmlSecKeyDataDestroy( data ) ; |
| + return(-1); |
| + } |
| + /* symKey has been duplicated into data, it isn't used any more */ |
| + PK11_FreeSymKey( symKey ) ; |
| + |
| + /* Check value */ |
| + if(xmlSecKeyReqMatchKeyValue(&(keyInfoCtx->keyReq), data) != 1) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + "xmlSecKeyReqMatchKeyValue", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + xmlSecKeyDataDestroy( data ) ; |
| + return(0); |
| + } |
| |
| - return(xmlSecKeyDataBinaryValueXmlRead(id, key, node, keyInfoCtx)); |
| + ret = xmlSecKeySetValue(key, data); |
| + if(ret < 0) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + "xmlSecKeySetValue", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + xmlSecKeyDataDestroy( data ) ; |
| + return(-1); |
| + } |
| + |
| + return(0); |
| } |
| |
| static int |
| xmlSecNssSymKeyDataXmlWrite(xmlSecKeyDataId id, xmlSecKeyPtr key, |
| xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx) { |
| + PK11SymKey* symKey ; |
| + |
| xmlSecAssert2(xmlSecNssSymKeyDataKlassCheck(id), -1); |
| - |
| - return(xmlSecKeyDataBinaryValueXmlWrite(id, key, node, keyInfoCtx)); |
| + xmlSecAssert2(key != NULL, -1); |
| + xmlSecAssert2(node != NULL, -1); |
| + xmlSecAssert2(keyInfoCtx != NULL, -1); |
| + |
| + /* Get symmetric key from "key" */ |
| + symKey = xmlSecNssSymKeyDataGetKey(xmlSecKeyGetValue(key)); |
| + if( symKey != NULL ) { |
| + SECItem* keyItem ; |
| + xmlSecBufferPtr keyBuf ; |
| + |
| + /* Extract raw key data from symmetric key */ |
| + if( PK11_ExtractKeyValue( symKey ) != SECSuccess ) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + "PK11_ExtractKeyValue", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + PK11_FreeSymKey( symKey ) ; |
| + return(-1); |
| + } |
| + |
| + /* Get raw key data from "symKey" */ |
| + keyItem = PK11_GetKeyData( symKey ) ; |
| + if(keyItem == NULL) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + "PK11_GetKeyData", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + PK11_FreeSymKey( symKey ) ; |
| + return(-1); |
| + } |
| + |
| + /* Create key data buffer with raw kwy material */ |
| + keyBuf = xmlSecBufferCreate(keyItem->len) ; |
| + if(keyBuf == NULL) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + "xmlSecBufferCreate", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + PK11_FreeSymKey( symKey ) ; |
| + return(-1); |
| + } |
| + |
| + xmlSecBufferSetData( keyBuf , keyItem->data , keyItem->len ) ; |
| + |
| + /* Write raw key material into current xml node */ |
| + if( xmlSecBufferBase64NodeContentWrite( keyBuf, node, XMLSEC_BASE64_LINESIZE ) < 0 ) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + "xmlSecBufferBase64NodeContentWrite", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + xmlSecBufferDestroy(keyBuf); |
| + PK11_FreeSymKey( symKey ) ; |
| + return(-1); |
| + } |
| + xmlSecBufferDestroy(keyBuf); |
| + PK11_FreeSymKey( symKey ) ; |
| + } |
| + |
| + return 0 ; |
| } |
| |
| static int |
| xmlSecNssSymKeyDataBinRead(xmlSecKeyDataId id, xmlSecKeyPtr key, |
| const xmlSecByte* buf, xmlSecSize bufSize, |
| xmlSecKeyInfoCtxPtr keyInfoCtx) { |
| - xmlSecAssert2(xmlSecNssSymKeyDataKlassCheck(id), -1); |
| + PK11SymKey* symKey ; |
| + PK11SlotInfo* slot ; |
| + xmlSecKeyDataPtr data; |
| + xmlSecNssSymKeyDataCtxPtr ctx; |
| + SECItem keyItem ; |
| + int ret; |
| + |
| + xmlSecAssert2(id != xmlSecKeyDataIdUnknown, -1); |
| + xmlSecAssert2(key != NULL, -1); |
| + xmlSecAssert2(buf != NULL, -1); |
| + xmlSecAssert2(bufSize != 0, -1); |
| + xmlSecAssert2(keyInfoCtx != NULL, -1); |
| + |
| + /* Create a new KeyData from a id */ |
| + data = xmlSecKeyDataCreate(id); |
| + if(data == NULL ) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + "xmlSecKeyDataCreate", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + return(-1); |
| + } |
| + |
| + ctx = xmlSecNssSymKeyDataGetCtx(data); |
| + xmlSecAssert2(ctx != NULL, -1); |
| + |
| + /* Get slot */ |
| + slot = xmlSecNssSlotGet(ctx->cipher); |
| + if( slot == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + "xmlSecNssSlotGet" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + xmlSecKeyDataDestroy( data ) ; |
| + return(-1) ; |
| + } |
| + |
| + /* Wrap the raw key value SECItem */ |
| + keyItem.type = siBuffer ; |
| + keyItem.data = buf ; |
| + keyItem.len = bufSize ; |
| + |
| + /* Import the raw key into slot temporalily and get the key handler*/ |
| + symKey = PK11_ImportSymKey(slot, ctx->cipher, PK11_OriginGenerated, CKA_VALUE, &keyItem, NULL ) ; |
| + if( symKey == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + "PK11_ImportSymKey" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + PK11_FreeSlot( slot ) ; |
| + xmlSecKeyDataDestroy( data ) ; |
| + return(-1) ; |
| + } |
| + |
| + /* Adopt the symmetric key into key data */ |
| + ret = xmlSecNssSymKeyDataAdoptKey(data, symKey); |
| + if(ret < 0) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + "xmlSecKeyDataBinaryValueSetBuffer", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + PK11_FreeSymKey( symKey ) ; |
| + PK11_FreeSlot( slot ) ; |
| + xmlSecKeyDataDestroy( data ) ; |
| + return(-1); |
| + } |
| + /* symKey has been duplicated into data, it isn't used any more */ |
| + PK11_FreeSymKey( symKey ) ; |
| + PK11_FreeSlot( slot ) ; |
| + |
| + /* Check value */ |
| + if(xmlSecKeyReqMatchKeyValue(&(keyInfoCtx->keyReq), data) != 1) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + "xmlSecKeyReqMatchKeyValue", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + xmlSecKeyDataDestroy( data ) ; |
| + return(0); |
| + } |
| |
| - return(xmlSecKeyDataBinaryValueBinRead(id, key, buf, bufSize, keyInfoCtx)); |
| + ret = xmlSecKeySetValue(key, data); |
| + if(ret < 0) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + "xmlSecKeySetValue", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + xmlSecKeyDataDestroy( data ) ; |
| + return(-1); |
| + } |
| + |
| + return(0); |
| } |
| |
| static int |
| xmlSecNssSymKeyDataBinWrite(xmlSecKeyDataId id, xmlSecKeyPtr key, |
| xmlSecByte** buf, xmlSecSize* bufSize, |
| xmlSecKeyInfoCtxPtr keyInfoCtx) { |
| + PK11SymKey* symKey ; |
| + |
| xmlSecAssert2(xmlSecNssSymKeyDataKlassCheck(id), -1); |
| + xmlSecAssert2(key != NULL, -1); |
| + xmlSecAssert2(buf != NULL, -1); |
| + xmlSecAssert2(bufSize != 0, -1); |
| + xmlSecAssert2(keyInfoCtx != NULL, -1); |
| + |
| + /* Get symmetric key from "key" */ |
| + symKey = xmlSecNssSymKeyDataGetKey(xmlSecKeyGetValue(key)); |
| + if( symKey != NULL ) { |
| + SECItem* keyItem ; |
| + |
| + /* Extract raw key data from symmetric key */ |
| + if( PK11_ExtractKeyValue( symKey ) != SECSuccess ) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + "PK11_ExtractKeyValue", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + PK11_FreeSymKey( symKey ) ; |
| + return(-1); |
| + } |
| + |
| + /* Get raw key data from "symKey" */ |
| + keyItem = PK11_GetKeyData( symKey ) ; |
| + if(keyItem == NULL) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + "PK11_GetKeyData", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + PK11_FreeSymKey( symKey ) ; |
| + return(-1); |
| + } |
| + |
| + *bufSize = keyItem->len; |
| + *buf = ( xmlSecByte* )xmlMalloc( *bufSize ); |
| + if( *buf == NULL ) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + NULL, |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + PK11_FreeSymKey( symKey ) ; |
| + return(-1); |
| + } |
| + |
| + memcpy((*buf), keyItem->data, (*bufSize)); |
| + PK11_FreeSymKey( symKey ) ; |
| + } |
| |
| - return(xmlSecKeyDataBinaryValueBinWrite(id, key, buf, bufSize, keyInfoCtx)); |
| + return 0 ; |
| } |
| |
| static int |
| xmlSecNssSymKeyDataGenerate(xmlSecKeyDataPtr data, xmlSecSize sizeBits, xmlSecKeyDataType type ATTRIBUTE_UNUSED) { |
| - xmlSecBufferPtr buffer; |
| + PK11SymKey* symkey ; |
| + PK11SlotInfo* slot ; |
| + xmlSecNssSymKeyDataCtxPtr ctx; |
| + int ret; |
| |
| xmlSecAssert2(xmlSecNssSymKeyDataCheckId(data), -1); |
| xmlSecAssert2(sizeBits > 0, -1); |
| |
| - buffer = xmlSecKeyDataBinaryValueGetBuffer(data); |
| - xmlSecAssert2(buffer != NULL, -1); |
| - |
| - return(xmlSecNssGenerateRandom(buffer, (sizeBits + 7) / 8)); |
| + ctx = xmlSecNssSymKeyDataGetCtx(data); |
| + xmlSecAssert2(ctx != NULL, -1); |
| + |
| + if( sizeBits % 8 != 0 ) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)), |
| + NULL, |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + "Symmetric key size must be octuple"); |
| + return(-1); |
| + } |
| + |
| + /* Get slot */ |
| + slot = xmlSecNssSlotGet(ctx->cipher); |
| + if( slot == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)), |
| + "xmlSecNssSlotGet" , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1) ; |
| + } |
| + |
| + if( PK11_Authenticate( slot, PR_FALSE , NULL ) != SECSuccess ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyDataGetName( data ) ) , |
| + "PK11_Authenticate" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + PK11_FreeSlot( slot ) ; |
| + return -1 ; |
| + } |
| + |
| + symkey = PK11_KeyGen( slot , ctx->cipher , NULL , sizeBits/8 , NULL ) ; |
| + if( symkey == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyDataGetName( data ) ) , |
| + "PK11_KeyGen" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + PK11_FreeSlot( slot ) ; |
| + return -1 ; |
| + } |
| + |
| + if( ctx->slot != NULL ) { |
| + PK11_FreeSlot( ctx->slot ) ; |
| + ctx->slot = NULL ; |
| + } |
| + ctx->slot = slot ; |
| + |
| + if( ctx->symkey != NULL ) { |
| + PK11_FreeSymKey( ctx->symkey ) ; |
| + ctx->symkey = NULL ; |
| + } |
| + ctx->symkey = symkey ; |
| + |
| + return 0; |
| } |
| |
| static xmlSecKeyDataType |
| xmlSecNssSymKeyDataGetType(xmlSecKeyDataPtr data) { |
| - xmlSecBufferPtr buffer; |
| + xmlSecNssSymKeyDataCtxPtr context = NULL ; |
| + xmlSecKeyDataType type = xmlSecKeyDataTypeUnknown ; |
| |
| xmlSecAssert2(xmlSecNssSymKeyDataCheckId(data), xmlSecKeyDataTypeUnknown); |
| + xmlSecAssert2( xmlSecKeyDataCheckSize( data, xmlSecNssSymKeyDataSize ), xmlSecKeyDataTypeUnknown ) ; |
| |
| - buffer = xmlSecKeyDataBinaryValueGetBuffer(data); |
| - xmlSecAssert2(buffer != NULL, xmlSecKeyDataTypeUnknown); |
| + context = xmlSecNssSymKeyDataGetCtx( data ) ; |
| + if( context == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyDataGetName( data ) ) , |
| + "xmlSecNssSymKeyDataGetCtx" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return xmlSecKeyDataTypeUnknown ; |
| + } |
| |
| - return((xmlSecBufferGetSize(buffer) > 0) ? xmlSecKeyDataTypeSymmetric : xmlSecKeyDataTypeUnknown); |
| + if( context->symkey != NULL ) { |
| + type |= xmlSecKeyDataTypeSymmetric ; |
| + } else { |
| + type |= xmlSecKeyDataTypeUnknown ; |
| + } |
| + |
| + return type ; |
| } |
| |
| static xmlSecSize |
| xmlSecNssSymKeyDataGetSize(xmlSecKeyDataPtr data) { |
| + xmlSecNssSymKeyDataCtxPtr context ; |
| + unsigned int length = 0 ; |
| + |
| xmlSecAssert2(xmlSecNssSymKeyDataCheckId(data), 0); |
| + xmlSecAssert2( xmlSecKeyDataCheckSize( data, xmlSecNssSymKeyDataSize ), 0 ) ; |
| + context = xmlSecNssSymKeyDataGetCtx( data ) ; |
| + if( context == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyDataGetName( data ) ) , |
| + "xmlSecNssSymKeyDataGetCtx" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return 0 ; |
| + } |
| + |
| + if( context->symkey != NULL ) { |
| + length = PK11_GetKeyLength( context->symkey ) ; |
| + length *= 8 ; |
| + } |
| |
| - return(xmlSecKeyDataBinaryValueGetSize(data)); |
| + return length ; |
| } |
| |
| static void |
| xmlSecNssSymKeyDataDebugDump(xmlSecKeyDataPtr data, FILE* output) { |
| xmlSecAssert(xmlSecNssSymKeyDataCheckId(data)); |
| |
| - xmlSecKeyDataBinaryValueDebugDump(data, output); |
| + /* print only size, everything else is sensitive */ |
| + fprintf( output , "=== %s: size=%d\n" , data->id->dataNodeName , |
| + xmlSecKeyDataGetSize(data)) ; |
| } |
| |
| static void |
| xmlSecNssSymKeyDataDebugXmlDump(xmlSecKeyDataPtr data, FILE* output) { |
| xmlSecAssert(xmlSecNssSymKeyDataCheckId(data)); |
| - |
| - xmlSecKeyDataBinaryValueDebugXmlDump(data, output); |
| + |
| + /* print only size, everything else is sensitive */ |
| + fprintf( output , "<%s size=\"%d\" />\n" , data->id->dataNodeName , |
| + xmlSecKeyDataGetSize(data)) ; |
| } |
| |
| static int |
| @@ -201,7 +858,7 @@ |
| *************************************************************************/ |
| static xmlSecKeyDataKlass xmlSecNssKeyDataAesKlass = { |
| sizeof(xmlSecKeyDataKlass), |
| - xmlSecKeyDataBinarySize, |
| + xmlSecNssSymKeyDataSize, |
| |
| /* data */ |
| xmlSecNameAESKeyValue, |
| @@ -282,7 +939,7 @@ |
| *************************************************************************/ |
| static xmlSecKeyDataKlass xmlSecNssKeyDataDesKlass = { |
| sizeof(xmlSecKeyDataKlass), |
| - xmlSecKeyDataBinarySize, |
| + xmlSecNssSymKeyDataSize, |
| |
| /* data */ |
| xmlSecNameDESKeyValue, |
| @@ -364,7 +1021,7 @@ |
| *************************************************************************/ |
| static xmlSecKeyDataKlass xmlSecNssKeyDataHmacKlass = { |
| sizeof(xmlSecKeyDataKlass), |
| - xmlSecKeyDataBinarySize, |
| + xmlSecNssSymKeyDataSize, |
| |
| /* data */ |
| xmlSecNameHMACKeyValue, |
| --- misc/xmlsec1-1.2.14/src/nss/tokens.c 2009-09-21 14:07:19.249145861 +0200 |
| +++ misc/build/xmlsec1-1.2.14/src/nss/tokens.c 2009-09-21 14:02:48.556772442 +0200 |
| @@ -1 +1,548 @@ |
| -dummy |
| +/** |
| + * XMLSec library |
| + * |
| + * This is free software; see Copyright file in the source |
| + * distribution for preciese wording. |
| + * |
| + * Copyright.................................. |
| + * |
| + * Contributor(s): _____________________________ |
| + * |
| + */ |
| + |
| +/** |
| + * In order to ensure that particular crypto operation is performed on |
| + * particular crypto device, a subclass of xmlSecList is used to store slot and |
| + * mechanism information. |
| + * |
| + * In the list, a slot is bound with a mechanism. If the mechanism is available, |
| + * this mechanism only can perform on the slot; otherwise, it can perform on |
| + * every eligibl slot in the list. |
| + * |
| + * When try to find a slot for a particular mechanism, the slot bound with |
| + * avaliable mechanism will be looked up firstly. |
| + */ |
| +#include "globals.h" |
| +#include <string.h> |
| + |
| +#include <xmlsec/xmlsec.h> |
| +#include <xmlsec/errors.h> |
| +#include <xmlsec/list.h> |
| + |
| +#include <xmlsec/nss/tokens.h> |
| + |
| +int |
| +xmlSecNssKeySlotSetMechList( |
| + xmlSecNssKeySlotPtr keySlot , |
| + CK_MECHANISM_TYPE_PTR mechanismList |
| +) { |
| + int counter ; |
| + |
| + xmlSecAssert2( keySlot != NULL , -1 ) ; |
| + |
| + if( keySlot->mechanismList != CK_NULL_PTR ) { |
| + xmlFree( keySlot->mechanismList ) ; |
| + |
| + for( counter = 0 ; *( mechanismList + counter ) != CKM_INVALID_MECHANISM ; counter ++ ) ; |
| + keySlot->mechanismList = ( CK_MECHANISM_TYPE_PTR )xmlMalloc( ( counter + 1 ) * sizeof( CK_MECHANISM_TYPE ) ) ; |
| + if( keySlot->mechanismList == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + NULL , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return( -1 ); |
| + } |
| + for( ; counter >= 0 ; counter -- ) |
| + *( keySlot->mechanismList + counter ) = *( mechanismList + counter ) ; |
| + } |
| + |
| + return( 0 ); |
| +} |
| + |
| +int |
| +xmlSecNssKeySlotEnableMech( |
| + xmlSecNssKeySlotPtr keySlot , |
| + CK_MECHANISM_TYPE mechanism |
| +) { |
| + int counter ; |
| + CK_MECHANISM_TYPE_PTR newList ; |
| + |
| + xmlSecAssert2( keySlot != NULL , -1 ) ; |
| + |
| + if( mechanism != CKM_INVALID_MECHANISM ) { |
| + for( counter = 0 ; *( keySlot->mechanismList + counter ) != CKM_INVALID_MECHANISM ; counter ++ ) ; |
| + newList = ( CK_MECHANISM_TYPE_PTR )xmlMalloc( ( counter + 1 + 1 ) * sizeof( CK_MECHANISM_TYPE ) ) ; |
| + if( newList == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + NULL , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return( -1 ); |
| + } |
| + *( newList + counter + 1 ) = CKM_INVALID_MECHANISM ; |
| + *( newList + counter ) = mechanism ; |
| + for( counter -= 1 ; counter >= 0 ; counter -- ) |
| + *( newList + counter ) = *( keySlot->mechanismList + counter ) ; |
| + |
| + xmlFree( keySlot->mechanismList ) ; |
| + keySlot->mechanismList = newList ; |
| + } |
| + |
| + return(0); |
| +} |
| + |
| +int |
| +xmlSecNssKeySlotDisableMech( |
| + xmlSecNssKeySlotPtr keySlot , |
| + CK_MECHANISM_TYPE mechanism |
| +) { |
| + int counter ; |
| + |
| + xmlSecAssert2( keySlot != NULL , -1 ) ; |
| + |
| + for( counter = 0 ; *( keySlot->mechanismList + counter ) != CKM_INVALID_MECHANISM ; counter ++ ) { |
| + if( *( keySlot->mechanismList + counter ) == mechanism ) { |
| + for( ; *( keySlot->mechanismList + counter ) != CKM_INVALID_MECHANISM ; counter ++ ) { |
| + *( keySlot->mechanismList + counter ) = *( keySlot->mechanismList + counter + 1 ) ; |
| + } |
| + |
| + break ; |
| + } |
| + } |
| + |
| + return(0); |
| +} |
| + |
| +CK_MECHANISM_TYPE_PTR |
| +xmlSecNssKeySlotGetMechList( |
| + xmlSecNssKeySlotPtr keySlot |
| +) { |
| + if( keySlot != NULL ) |
| + return keySlot->mechanismList ; |
| + else |
| + return NULL ; |
| +} |
| + |
| +int |
| +xmlSecNssKeySlotSetSlot( |
| + xmlSecNssKeySlotPtr keySlot , |
| + PK11SlotInfo* slot |
| +) { |
| + xmlSecAssert2( keySlot != NULL , -1 ) ; |
| + |
| + if( slot != NULL && keySlot->slot != slot ) { |
| + if( keySlot->slot != NULL ) |
| + PK11_FreeSlot( keySlot->slot ) ; |
| + |
| + if( keySlot->mechanismList != NULL ) { |
| + xmlFree( keySlot->mechanismList ) ; |
| + keySlot->mechanismList = NULL ; |
| + } |
| + |
| + keySlot->slot = PK11_ReferenceSlot( slot ) ; |
| + } |
| + |
| + return(0); |
| +} |
| + |
| +int |
| +xmlSecNssKeySlotInitialize( |
| + xmlSecNssKeySlotPtr keySlot , |
| + PK11SlotInfo* slot |
| +) { |
| + xmlSecAssert2( keySlot != NULL , -1 ) ; |
| + xmlSecAssert2( keySlot->slot == NULL , -1 ) ; |
| + xmlSecAssert2( keySlot->mechanismList == NULL , -1 ) ; |
| + |
| + if( slot != NULL ) { |
| + keySlot->slot = PK11_ReferenceSlot( slot ) ; |
| + } |
| + |
| + return(0); |
| +} |
| + |
| +void |
| +xmlSecNssKeySlotFinalize( |
| + xmlSecNssKeySlotPtr keySlot |
| +) { |
| + xmlSecAssert( keySlot != NULL ) ; |
| + |
| + if( keySlot->mechanismList != NULL ) { |
| + xmlFree( keySlot->mechanismList ) ; |
| + keySlot->mechanismList = NULL ; |
| + } |
| + |
| + if( keySlot->slot != NULL ) { |
| + PK11_FreeSlot( keySlot->slot ) ; |
| + keySlot->slot = NULL ; |
| + } |
| + |
| +} |
| + |
| +PK11SlotInfo* |
| +xmlSecNssKeySlotGetSlot( |
| + xmlSecNssKeySlotPtr keySlot |
| +) { |
| + if( keySlot != NULL ) |
| + return keySlot->slot ; |
| + else |
| + return NULL ; |
| +} |
| + |
| +xmlSecNssKeySlotPtr |
| +xmlSecNssKeySlotCreate() { |
| + xmlSecNssKeySlotPtr keySlot ; |
| + |
| + /* Allocates a new xmlSecNssKeySlot and fill the fields */ |
| + keySlot = ( xmlSecNssKeySlotPtr )xmlMalloc( sizeof( xmlSecNssKeySlot ) ) ; |
| + if( keySlot == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + NULL , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return( NULL ); |
| + } |
| + memset( keySlot, 0, sizeof( xmlSecNssKeySlot ) ) ; |
| + |
| + return( keySlot ) ; |
| +} |
| + |
| +int |
| +xmlSecNssKeySlotCopy( |
| + xmlSecNssKeySlotPtr newKeySlot , |
| + xmlSecNssKeySlotPtr keySlot |
| +) { |
| + CK_MECHANISM_TYPE_PTR mech ; |
| + int counter ; |
| + |
| + xmlSecAssert2( newKeySlot != NULL , -1 ) ; |
| + xmlSecAssert2( keySlot != NULL , -1 ) ; |
| + |
| + if( keySlot->slot != NULL && newKeySlot->slot != keySlot->slot ) { |
| + if( newKeySlot->slot != NULL ) |
| + PK11_FreeSlot( newKeySlot->slot ) ; |
| + |
| + newKeySlot->slot = PK11_ReferenceSlot( keySlot->slot ) ; |
| + } |
| + |
| + if( keySlot->mechanismList != CK_NULL_PTR ) { |
| + xmlFree( newKeySlot->mechanismList ) ; |
| + |
| + for( counter = 0 ; *( keySlot->mechanismList + counter ) != CKM_INVALID_MECHANISM ; counter ++ ) ; |
| + newKeySlot->mechanismList = ( CK_MECHANISM_TYPE_PTR )xmlMalloc( ( counter + 1 ) * sizeof( CK_MECHANISM_TYPE ) ) ; |
| + if( newKeySlot->mechanismList == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + NULL , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return( -1 ); |
| + } |
| + for( ; counter >= 0 ; counter -- ) |
| + *( newKeySlot->mechanismList + counter ) = *( keySlot->mechanismList + counter ) ; |
| + } |
| + |
| + return( 0 ); |
| +} |
| + |
| +xmlSecNssKeySlotPtr |
| +xmlSecNssKeySlotDuplicate( |
| + xmlSecNssKeySlotPtr keySlot |
| +) { |
| + xmlSecNssKeySlotPtr newKeySlot ; |
| + int ret ; |
| + |
| + xmlSecAssert2( keySlot != NULL , NULL ) ; |
| + |
| + newKeySlot = xmlSecNssKeySlotCreate() ; |
| + if( newKeySlot == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + NULL , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return( NULL ); |
| + } |
| + |
| + if( xmlSecNssKeySlotCopy( newKeySlot, keySlot ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + NULL , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return( NULL ); |
| + } |
| + |
| + return( newKeySlot ); |
| +} |
| + |
| +void |
| +xmlSecNssKeySlotDestroy( |
| + xmlSecNssKeySlotPtr keySlot |
| +) { |
| + xmlSecAssert( keySlot != NULL ) ; |
| + |
| + if( keySlot->mechanismList != NULL ) |
| + xmlFree( keySlot->mechanismList ) ; |
| + |
| + if( keySlot->slot != NULL ) |
| + PK11_FreeSlot( keySlot->slot ) ; |
| + |
| + xmlFree( keySlot ) ; |
| +} |
| + |
| +int |
| +xmlSecNssKeySlotBindMech( |
| + xmlSecNssKeySlotPtr keySlot , |
| + CK_MECHANISM_TYPE type |
| +) { |
| + int counter ; |
| + |
| + xmlSecAssert2( keySlot != NULL , 0 ) ; |
| + xmlSecAssert2( keySlot->slot != NULL , 0 ) ; |
| + xmlSecAssert2( type != CKM_INVALID_MECHANISM , 0 ) ; |
| + |
| + for( counter = 0 ; *( keySlot->mechanismList + counter ) != CKM_INVALID_MECHANISM ; counter ++ ) { |
| + if( *( keySlot->mechanismList + counter ) == type ) |
| + return(1) ; |
| + } |
| + |
| + return( 0 ) ; |
| +} |
| + |
| +int |
| +xmlSecNssKeySlotSupportMech( |
| + xmlSecNssKeySlotPtr keySlot , |
| + CK_MECHANISM_TYPE type |
| +) { |
| + xmlSecAssert2( keySlot != NULL , 0 ) ; |
| + xmlSecAssert2( keySlot->slot != NULL , 0 ) ; |
| + xmlSecAssert2( type != CKM_INVALID_MECHANISM , 0 ) ; |
| + |
| + if( PK11_DoesMechanism( keySlot->slot , type ) == PR_TRUE ) { |
| + return(1); |
| + } else |
| + return(0); |
| +} |
| + |
| +void |
| +xmlSecNssKeySlotDebugDump( |
| + xmlSecNssKeySlotPtr keySlot , |
| + FILE* output |
| +) { |
| + xmlSecAssert( keySlot != NULL ) ; |
| + xmlSecAssert( output != NULL ) ; |
| + |
| + fprintf( output, "== KEY SLOT\n" ); |
| +} |
| + |
| +void |
| +xmlSecNssKeySlotDebugXmlDump( |
| + xmlSecNssKeySlotPtr keySlot , |
| + FILE* output |
| +) { |
| +} |
| + |
| +/** |
| + * Key Slot List |
| + */ |
| +#ifdef __MINGW32__ // for runtime-pseudo-reloc |
| +static struct _xmlSecPtrListKlass xmlSecNssKeySlotPtrListKlass = { |
| +#else |
| +static xmlSecPtrListKlass xmlSecNssKeySlotPtrListKlass = { |
| +#endif |
| + BAD_CAST "mechanism-list", |
| + (xmlSecPtrDuplicateItemMethod)xmlSecNssKeySlotDuplicate, |
| + (xmlSecPtrDestroyItemMethod)xmlSecNssKeySlotDestroy, |
| + (xmlSecPtrDebugDumpItemMethod)xmlSecNssKeySlotDebugDump, |
| + (xmlSecPtrDebugDumpItemMethod)xmlSecNssKeySlotDebugXmlDump, |
| +}; |
| + |
| +xmlSecPtrListId |
| +xmlSecNssKeySlotListGetKlass(void) { |
| + return(&xmlSecNssKeySlotPtrListKlass); |
| +} |
| + |
| + |
| +/*- |
| + * Global PKCS#11 crypto token repository -- Key slot list |
| + */ |
| +static xmlSecPtrListPtr _xmlSecNssKeySlotList = NULL ; |
| + |
| +PK11SlotInfo* |
| +xmlSecNssSlotGet( |
| + CK_MECHANISM_TYPE type |
| +) { |
| + PK11SlotInfo* slot = NULL ; |
| + xmlSecNssKeySlotPtr keySlot ; |
| + xmlSecSize ksSize ; |
| + xmlSecSize ksPos ; |
| + char flag ; |
| + |
| + if( _xmlSecNssKeySlotList == NULL ) { |
| + slot = PK11_GetBestSlot( type , NULL ) ; |
| + } else { |
| + ksSize = xmlSecPtrListGetSize( _xmlSecNssKeySlotList ) ; |
| + |
| + /*- |
| + * Firstly, checking whether the mechanism is bound with a special slot. |
| + * If no bound slot, we try to find the first eligible slot in the list. |
| + */ |
| + for( flag = 0, ksPos = 0 ; ksPos < ksSize ; ksPos ++ ) { |
| + keySlot = ( xmlSecNssKeySlotPtr )xmlSecPtrListGetItem( _xmlSecNssKeySlotList, ksPos ) ; |
| + if( keySlot != NULL && xmlSecNssKeySlotBindMech( keySlot, type ) ) { |
| + slot = xmlSecNssKeySlotGetSlot( keySlot ) ; |
| + flag = 2 ; |
| + } else if( flag == 0 && xmlSecNssKeySlotSupportMech( keySlot, type ) ) { |
| + slot = xmlSecNssKeySlotGetSlot( keySlot ) ; |
| + flag = 1 ; |
| + } |
| + |
| + if( flag == 2 ) |
| + break ; |
| + } |
| + if( slot != NULL ) |
| + slot = PK11_ReferenceSlot( slot ) ; |
| + } |
| + |
| + if( slot != NULL && PK11_NeedLogin( slot ) ) { |
| + if( PK11_Authenticate( slot , PR_TRUE , NULL ) != SECSuccess ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + NULL , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + PK11_FreeSlot( slot ) ; |
| + return( NULL ); |
| + } |
| + } |
| + |
| + return slot ; |
| +} |
| + |
| +int |
| +xmlSecNssSlotInitialize( |
| + void |
| +) { |
| + if( _xmlSecNssKeySlotList != NULL ) { |
| + xmlSecPtrListDestroy( _xmlSecNssKeySlotList ) ; |
| + _xmlSecNssKeySlotList = NULL ; |
| + } |
| + |
| + _xmlSecNssKeySlotList = xmlSecPtrListCreate( xmlSecNssKeySlotListId ) ; |
| + if( _xmlSecNssKeySlotList == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + NULL , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return( -1 ); |
| + } |
| + |
| + return(0); |
| +} |
| + |
| +void |
| +xmlSecNssSlotShutdown( |
| + void |
| +) { |
| + if( _xmlSecNssKeySlotList != NULL ) { |
| + xmlSecPtrListDestroy( _xmlSecNssKeySlotList ) ; |
| + _xmlSecNssKeySlotList = NULL ; |
| + } |
| +} |
| + |
| +int |
| +xmlSecNssSlotAdopt( |
| + PK11SlotInfo* slot, |
| + CK_MECHANISM_TYPE type |
| +) { |
| + xmlSecNssKeySlotPtr keySlot ; |
| + xmlSecSize ksSize ; |
| + xmlSecSize ksPos ; |
| + char flag ; |
| + |
| + xmlSecAssert2( _xmlSecNssKeySlotList != NULL, -1 ) ; |
| + xmlSecAssert2( slot != NULL, -1 ) ; |
| + |
| + ksSize = xmlSecPtrListGetSize( _xmlSecNssKeySlotList ) ; |
| + |
| + /*- |
| + * Firstly, checking whether the slot is in the repository already. |
| + */ |
| + flag = 0 ; |
| + for( ksPos = 0 ; ksPos < ksSize ; ksPos ++ ) { |
| + keySlot = ( xmlSecNssKeySlotPtr )xmlSecPtrListGetItem( _xmlSecNssKeySlotList, ksPos ) ; |
| + /* If find the slot in the list */ |
| + if( keySlot != NULL && xmlSecNssKeySlotGetSlot( keySlot ) == slot ) { |
| + /* If mechnism type is valid, bind the slot with the mechanism */ |
| + if( type != CKM_INVALID_MECHANISM ) { |
| + if( xmlSecNssKeySlotEnableMech( keySlot, type ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + NULL , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + } |
| + |
| + flag = 1 ; |
| + } |
| + } |
| + |
| + /* If the slot do not in the list, add a new item to the list */ |
| + if( flag == 0 ) { |
| + /* Create a new KeySlot */ |
| + keySlot = xmlSecNssKeySlotCreate() ; |
| + if( keySlot == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + NULL , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return(-1); |
| + } |
| + |
| + /* Initialize the keySlot with a slot */ |
| + if( xmlSecNssKeySlotInitialize( keySlot, slot ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + NULL , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + xmlSecNssKeySlotDestroy( keySlot ) ; |
| + return(-1); |
| + } |
| + |
| + /* If mechnism type is valid, bind the slot with the mechanism */ |
| + if( type != CKM_INVALID_MECHANISM ) { |
| + if( xmlSecNssKeySlotEnableMech( keySlot, type ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + NULL , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + xmlSecNssKeySlotDestroy( keySlot ) ; |
| + return(-1); |
| + } |
| + } |
| + |
| + /* Add keySlot into the list */ |
| + if( xmlSecPtrListAdd( _xmlSecNssKeySlotList, keySlot ) < 0 ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + NULL , |
| + NULL , |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + xmlSecNssKeySlotDestroy( keySlot ) ; |
| + return(-1); |
| + } |
| + } |
| + |
| + return(0); |
| +} |
| + |
| --- misc/xmlsec1-1.2.14/src/nss/x509.c 2009-06-25 22:53:18.000000000 +0200 |
| +++ misc/build/xmlsec1-1.2.14/src/nss/x509.c 2009-09-21 14:02:48.642312431 +0200 |
| @@ -34,7 +34,6 @@ |
| #include <xmlsec/keys.h> |
| #include <xmlsec/keyinfo.h> |
| #include <xmlsec/keysmngr.h> |
| -#include <xmlsec/x509.h> |
| #include <xmlsec/base64.h> |
| #include <xmlsec/errors.h> |
| |
| @@ -61,33 +60,18 @@ |
| static int xmlSecNssX509CertificateNodeRead (xmlSecKeyDataPtr data, |
| xmlNodePtr node, |
| xmlSecKeyInfoCtxPtr keyInfoCtx); |
| -static int xmlSecNssX509CertificateNodeWrite (CERTCertificate* cert, |
| - xmlNodePtr node, |
| - xmlSecKeyInfoCtxPtr keyInfoCtx); |
| static int xmlSecNssX509SubjectNameNodeRead (xmlSecKeyDataPtr data, |
| xmlNodePtr node, |
| xmlSecKeyInfoCtxPtr keyInfoCtx); |
| -static int xmlSecNssX509SubjectNameNodeWrite (CERTCertificate* cert, |
| - xmlNodePtr node, |
| - xmlSecKeyInfoCtxPtr keyInfoCtx); |
| static int xmlSecNssX509IssuerSerialNodeRead (xmlSecKeyDataPtr data, |
| xmlNodePtr node, |
| xmlSecKeyInfoCtxPtr keyInfoCtx); |
| -static int xmlSecNssX509IssuerSerialNodeWrite (CERTCertificate* cert, |
| - xmlNodePtr node, |
| - xmlSecKeyInfoCtxPtr keyInfoCtx); |
| static int xmlSecNssX509SKINodeRead (xmlSecKeyDataPtr data, |
| xmlNodePtr node, |
| xmlSecKeyInfoCtxPtr keyInfoCtx); |
| -static int xmlSecNssX509SKINodeWrite (CERTCertificate* cert, |
| - xmlNodePtr node, |
| - xmlSecKeyInfoCtxPtr keyInfoCtx); |
| static int xmlSecNssX509CRLNodeRead (xmlSecKeyDataPtr data, |
| xmlNodePtr node, |
| xmlSecKeyInfoCtxPtr keyInfoCtx); |
| -static int xmlSecNssX509CRLNodeWrite (CERTSignedCrl* crl, |
| - xmlNodePtr node, |
| - xmlSecKeyInfoCtxPtr keyInfoCtx); |
| static int xmlSecNssKeyDataX509VerifyAndExtractKey(xmlSecKeyDataPtr data, |
| xmlSecKeyPtr key, |
| xmlSecKeyInfoCtxPtr keyInfoCtx); |
| @@ -104,9 +88,6 @@ |
| xmlSecKeyInfoCtxPtr keyInfoCtx); |
| static xmlChar* xmlSecNssX509CrlBase64DerWrite (CERTSignedCrl* crl, |
| int base64LineWrap); |
| -static xmlChar* xmlSecNssX509NameWrite (CERTName* nm); |
| -static xmlChar* xmlSecNssASN1IntegerWrite (SECItem *num); |
| -static xmlChar* xmlSecNssX509SKIWrite (CERTCertificate* cert); |
| static void xmlSecNssX509CertDebugDump (CERTCertificate* cert, |
| FILE* output); |
| static void xmlSecNssX509CertDebugXmlDump (CERTCertificate* cert, |
| @@ -752,31 +733,22 @@ |
| xmlSecNssKeyDataX509XmlWrite(xmlSecKeyDataId id, xmlSecKeyPtr key, |
| xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx) { |
| xmlSecKeyDataPtr data; |
| + xmlNodePtr cur; |
| + xmlChar* buf; |
| CERTCertificate* cert; |
| CERTSignedCrl* crl; |
| xmlSecSize size, pos; |
| - int content = 0; |
| - int ret; |
| |
| xmlSecAssert2(id == xmlSecNssKeyDataX509Id, -1); |
| xmlSecAssert2(key != NULL, -1); |
| xmlSecAssert2(node != NULL, -1); |
| xmlSecAssert2(keyInfoCtx != NULL, -1); |
| |
| - content = xmlSecX509DataGetNodeContent (node, 1, keyInfoCtx); |
| - if (content < 0) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| - "xmlSecX509DataGetNodeContent", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - "content=%d", content); |
| - return(-1); |
| - } else if(content == 0) { |
| - /* by default we are writing certificates and crls */ |
| - content = XMLSEC_X509DATA_DEFAULT; |
| + /* todo: flag in ctx remove all existing content */ |
| + if(0) { |
| + xmlNodeSetContent(node, NULL); |
| } |
| |
| - /* get x509 data */ |
| data = xmlSecKeyGetData(key, id); |
| if(data == NULL) { |
| /* no x509 data in the key */ |
| @@ -796,79 +768,74 @@ |
| return(-1); |
| } |
| |
| - if((content & XMLSEC_X509DATA_CERTIFICATE_NODE) != 0) { |
| - ret = xmlSecNssX509CertificateNodeWrite(cert, node, keyInfoCtx); |
| - if(ret < 0) { |
| + /* set base64 lines size from context */ |
| + buf = xmlSecNssX509CertBase64DerWrite(cert, keyInfoCtx->base64LineSize); |
| + if(buf == NULL) { |
| xmlSecError(XMLSEC_ERRORS_HERE, |
| xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| - "xmlSecNssX509CertificateNodeWrite", |
| + "xmlSecNssX509CertBase64DerWrite", |
| XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - "pos=%d", pos); |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| return(-1); |
| - } |
| } |
| |
| - if((content & XMLSEC_X509DATA_SUBJECTNAME_NODE) != 0) { |
| - ret = xmlSecNssX509SubjectNameNodeWrite(cert, node, keyInfoCtx); |
| - if(ret < 0) { |
| + cur = xmlSecAddChild(node, xmlSecNodeX509Certificate, xmlSecDSigNs); |
| + if(cur == NULL) { |
| xmlSecError(XMLSEC_ERRORS_HERE, |
| xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| - "xmlSecNssX509SubjectNameNodeWrite", |
| + "xmlSecAddChild", |
| XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - "pos=%d", pos); |
| + "node=%s", |
| + xmlSecErrorsSafeString(xmlSecNodeX509Certificate)); |
| + xmlFree(buf); |
| return(-1); |
| - } |
| } |
| + /* todo: add \n around base64 data - from context */ |
| + /* todo: add errors check */ |
| + xmlNodeSetContent(cur, xmlSecStringCR); |
| + xmlNodeSetContent(cur, buf); |
| + xmlFree(buf); |
| + } |
| |
| - if((content & XMLSEC_X509DATA_ISSUERSERIAL_NODE) != 0) { |
| - ret = xmlSecNssX509IssuerSerialNodeWrite(cert, node, keyInfoCtx); |
| - if(ret < 0) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| - "xmlSecNssX509IssuerSerialNodeWrite", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - "pos=%d", pos); |
| - return(-1); |
| - } |
| + /* write crls */ |
| + size = xmlSecNssKeyDataX509GetCrlsSize(data); |
| + for(pos = 0; pos < size; ++pos) { |
| + crl = xmlSecNssKeyDataX509GetCrl(data, pos); |
| + if(crl == NULL) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + "xmlSecNssKeyDataX509GetCrl", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + "pos=%d", pos); |
| + return(-1); |
| } |
| |
| - if((content & XMLSEC_X509DATA_SKI_NODE) != 0) { |
| - ret = xmlSecNssX509SKINodeWrite(cert, node, keyInfoCtx); |
| - if(ret < 0) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| - "xmlSecNssX509SKINodeWrite", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - "pos=%d", pos); |
| - return(-1); |
| - } |
| + /* set base64 lines size from context */ |
| + buf = xmlSecNssX509CrlBase64DerWrite(crl, keyInfoCtx->base64LineSize); |
| + if(buf == NULL) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + "xmlSecNssX509CrlBase64DerWrite", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + return(-1); |
| } |
| - } |
| |
| - /* write crls if needed */ |
| - if((content & XMLSEC_X509DATA_CRL_NODE) != 0) { |
| - size = xmlSecNssKeyDataX509GetCrlsSize(data); |
| - for(pos = 0; pos < size; ++pos) { |
| - crl = xmlSecNssKeyDataX509GetCrl(data, pos); |
| - if(crl == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| - "xmlSecNssKeyDataX509GetCrl", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - "pos=%d", pos); |
| - return(-1); |
| - } |
| - |
| - ret = xmlSecNssX509CRLNodeWrite(crl, node, keyInfoCtx); |
| - if(ret < 0) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| - "xmlSecNssX509CRLNodeWrite", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - "pos=%d", pos); |
| - return(-1); |
| - } |
| - } |
| + cur = xmlSecAddChild(node, xmlSecNodeX509CRL, xmlSecDSigNs); |
| + if(cur == NULL) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + xmlSecErrorsSafeString(xmlSecKeyDataKlassGetName(id)), |
| + "xmlSecAddChild", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + "new_node=%s", |
| + xmlSecErrorsSafeString(xmlSecNodeX509CRL)); |
| + xmlFree(buf); |
| + return(-1); |
| + } |
| + /* todo: add \n around base64 data - from context */ |
| + /* todo: add errors check */ |
| + xmlNodeSetContent(cur, xmlSecStringCR); |
| + xmlNodeSetContent(cur, buf); |
| } |
| |
| return(0); |
| @@ -1057,46 +1024,6 @@ |
| return(0); |
| } |
| |
| -static int |
| -xmlSecNssX509CertificateNodeWrite(CERTCertificate* cert, xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx) { |
| - xmlChar* buf; |
| - xmlNodePtr cur; |
| - |
| - xmlSecAssert2(cert != NULL, -1); |
| - xmlSecAssert2(node != NULL, -1); |
| - xmlSecAssert2(keyInfoCtx != NULL, -1); |
| - |
| - /* set base64 lines size from context */ |
| - buf = xmlSecNssX509CertBase64DerWrite(cert, keyInfoCtx->base64LineSize); |
| - if(buf == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecNssX509CertBase64DerWrite", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| - return(-1); |
| - } |
| - |
| - cur = xmlSecAddChild(node, xmlSecNodeX509Certificate, xmlSecDSigNs); |
| - if(cur == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecAddChild", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - "node=%s", |
| - xmlSecErrorsSafeString(xmlSecNodeX509Certificate)); |
| - xmlFree(buf); |
| - return(-1); |
| - } |
| - |
| - /* todo: add \n around base64 data - from context */ |
| - /* todo: add errors check */ |
| - xmlNodeSetContent(cur, xmlSecStringCR); |
| - xmlNodeSetContent(cur, buf); |
| - xmlFree(buf); |
| - return(0); |
| -} |
| - |
| static int |
| xmlSecNssX509SubjectNameNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx) { |
| xmlSecKeyDataStorePtr x509Store; |
| @@ -1120,19 +1047,13 @@ |
| } |
| |
| subject = xmlNodeGetContent(node); |
| - if((subject == NULL) || (xmlSecIsEmptyString(subject) == 1)) { |
| - if(subject != NULL) { |
| - xmlFree(subject); |
| - } |
| - if((keyInfoCtx->flags & XMLSEC_KEYINFO_FLAGS_STOP_ON_EMPTY_NODE) != 0) { |
| + if(subject == NULL) { |
| xmlSecError(XMLSEC_ERRORS_HERE, |
| xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)), |
| xmlSecErrorsSafeString(xmlSecNodeGetName(node)), |
| XMLSEC_ERRORS_R_INVALID_NODE_CONTENT, |
| XMLSEC_ERRORS_NO_MESSAGE); |
| return(-1); |
| - } |
| - return(0); |
| } |
| |
| cert = xmlSecNssX509StoreFindCert(x509Store, subject, NULL, NULL, NULL, keyInfoCtx); |
| @@ -1169,40 +1090,6 @@ |
| return(0); |
| } |
| |
| -static int |
| -xmlSecNssX509SubjectNameNodeWrite(CERTCertificate* cert, xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx ATTRIBUTE_UNUSED) { |
| - xmlChar* buf = NULL; |
| - xmlNodePtr cur = NULL; |
| - |
| - xmlSecAssert2(cert != NULL, -1); |
| - xmlSecAssert2(node != NULL, -1); |
| - |
| - buf = xmlSecNssX509NameWrite(&(cert->subject)); |
| - if(buf == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecNssX509NameWrite(&(cert->subject))", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| - return(-1); |
| - } |
| - |
| - cur = xmlSecAddChild(node, xmlSecNodeX509SubjectName, xmlSecDSigNs); |
| - if(cur == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecAddChild", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - "node=%s", |
| - xmlSecErrorsSafeString(xmlSecNodeX509SubjectName)); |
| - xmlFree(buf); |
| - return(-1); |
| - } |
| - xmlSecNodeEncodeAndSetContent(cur, buf); |
| - xmlFree(buf); |
| - return(0); |
| -} |
| - |
| static int |
| xmlSecNssX509IssuerSerialNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx) { |
| xmlSecKeyDataStorePtr x509Store; |
| @@ -1228,21 +1115,9 @@ |
| } |
| |
| cur = xmlSecGetNextElementNode(node->children); |
| - if(cur == NULL) { |
| - if((keyInfoCtx->flags & XMLSEC_KEYINFO_FLAGS_STOP_ON_EMPTY_NODE) != 0) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)), |
| - xmlSecErrorsSafeString(xmlSecNodeX509IssuerName), |
| - XMLSEC_ERRORS_R_NODE_NOT_FOUND, |
| - "node=%s", |
| - xmlSecErrorsSafeString(xmlSecNodeGetName(cur))); |
| - return(-1); |
| - } |
| - return(0); |
| - } |
| |
| /* the first is required node X509IssuerName */ |
| - if(!xmlSecCheckNodeName(cur, xmlSecNodeX509IssuerName, xmlSecDSigNs)) { |
| + if((cur == NULL) || !xmlSecCheckNodeName(cur, xmlSecNodeX509IssuerName, xmlSecDSigNs)) { |
| xmlSecError(XMLSEC_ERRORS_HERE, |
| xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)), |
| xmlSecErrorsSafeString(xmlSecNodeX509IssuerName), |
| @@ -1336,78 +1211,6 @@ |
| return(0); |
| } |
| |
| -static int |
| -xmlSecNssX509IssuerSerialNodeWrite(CERTCertificate* cert, xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx ATTRIBUTE_UNUSED) { |
| - xmlNodePtr cur; |
| - xmlNodePtr issuerNameNode; |
| - xmlNodePtr issuerNumberNode; |
| - xmlChar* buf; |
| - |
| - xmlSecAssert2(cert != NULL, -1); |
| - xmlSecAssert2(node != NULL, -1); |
| - |
| - /* create xml nodes */ |
| - cur = xmlSecAddChild(node, xmlSecNodeX509IssuerSerial, xmlSecDSigNs); |
| - if(cur == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecAddChild", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - "node=%s", |
| - xmlSecErrorsSafeString(xmlSecNodeX509IssuerSerial)); |
| - return(-1); |
| - } |
| - |
| - issuerNameNode = xmlSecAddChild(cur, xmlSecNodeX509IssuerName, xmlSecDSigNs); |
| - if(issuerNameNode == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecAddChild", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - "node=%s", |
| - xmlSecErrorsSafeString(xmlSecNodeX509IssuerName)); |
| - return(-1); |
| - } |
| - |
| - issuerNumberNode = xmlSecAddChild(cur, xmlSecNodeX509SerialNumber, xmlSecDSigNs); |
| - if(issuerNumberNode == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecAddChild", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - "node=%s", |
| - xmlSecErrorsSafeString(xmlSecNodeX509SerialNumber)); |
| - return(-1); |
| - } |
| - |
| - /* write data */ |
| - buf = xmlSecNssX509NameWrite(&(cert->issuer)); |
| - if(buf == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecNssX509NameWrite(&(cert->issuer))", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| - return(-1); |
| - } |
| - xmlSecNodeEncodeAndSetContent(issuerNameNode, buf); |
| - xmlFree(buf); |
| - |
| - buf = xmlSecNssASN1IntegerWrite(&(cert->serialNumber)); |
| - if(buf == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecNssASN1IntegerWrite(&(cert->serialNumber))", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| - return(-1); |
| - } |
| - xmlNodeSetContent(issuerNumberNode, buf); |
| - xmlFree(buf); |
| - |
| - return(0); |
| -} |
| - |
| static int |
| xmlSecNssX509SKINodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx) { |
| xmlSecKeyDataStorePtr x509Store; |
| @@ -1431,11 +1234,7 @@ |
| } |
| |
| ski = xmlNodeGetContent(node); |
| - if((ski == NULL) || (xmlSecIsEmptyString(ski) == 1)) { |
| - if(ski != NULL) { |
| - xmlFree(ski); |
| - } |
| - if((keyInfoCtx->flags & XMLSEC_KEYINFO_FLAGS_STOP_ON_EMPTY_NODE) != 0) { |
| + if(ski == NULL) { |
| xmlSecError(XMLSEC_ERRORS_HERE, |
| xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)), |
| xmlSecErrorsSafeString(xmlSecNodeGetName(node)), |
| @@ -1443,8 +1242,6 @@ |
| "node=%s", |
| xmlSecErrorsSafeString(xmlSecNodeX509SKI)); |
| return(-1); |
| - } |
| - return(0); |
| } |
| |
| cert = xmlSecNssX509StoreFindCert(x509Store, NULL, NULL, NULL, ski, keyInfoCtx); |
| @@ -1479,41 +1276,6 @@ |
| return(0); |
| } |
| |
| -static int |
| -xmlSecNssX509SKINodeWrite(CERTCertificate* cert, xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx ATTRIBUTE_UNUSED) { |
| - xmlChar *buf = NULL; |
| - xmlNodePtr cur = NULL; |
| - |
| - xmlSecAssert2(cert != NULL, -1); |
| - xmlSecAssert2(node != NULL, -1); |
| - |
| - buf = xmlSecNssX509SKIWrite(cert); |
| - if(buf == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecNssX509SKIWrite", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| - return(-1); |
| - } |
| - |
| - cur = xmlSecAddChild(node, xmlSecNodeX509SKI, xmlSecDSigNs); |
| - if(cur == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecAddChild", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - "new_node=%s", |
| - xmlSecErrorsSafeString(xmlSecNodeX509SKI)); |
| - xmlFree(buf); |
| - return(-1); |
| - } |
| - xmlSecNodeEncodeAndSetContent(cur, buf); |
| - xmlFree(buf); |
| - |
| - return(0); |
| -} |
| - |
| static int |
| xmlSecNssX509CRLNodeRead(xmlSecKeyDataPtr data, xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx) { |
| xmlChar *content; |
| @@ -1524,19 +1286,13 @@ |
| xmlSecAssert2(keyInfoCtx != NULL, -1); |
| |
| content = xmlNodeGetContent(node); |
| - if((content == NULL) || (xmlSecIsEmptyString(content) == 1)) { |
| - if(content != NULL) { |
| - xmlFree(content); |
| - } |
| - if((keyInfoCtx->flags & XMLSEC_KEYINFO_FLAGS_STOP_ON_EMPTY_NODE) != 0) { |
| + if(content == NULL){ |
| xmlSecError(XMLSEC_ERRORS_HERE, |
| xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)), |
| xmlSecErrorsSafeString(xmlSecNodeGetName(node)), |
| XMLSEC_ERRORS_R_INVALID_NODE_CONTENT, |
| XMLSEC_ERRORS_NO_MESSAGE); |
| return(-1); |
| - } |
| - return(0); |
| } |
| |
| crl = xmlSecNssX509CrlBase64DerRead(content, keyInfoCtx); |
| @@ -1556,47 +1312,6 @@ |
| } |
| |
| static int |
| -xmlSecNssX509CRLNodeWrite(CERTSignedCrl* crl, xmlNodePtr node, xmlSecKeyInfoCtxPtr keyInfoCtx) { |
| - xmlChar* buf = NULL; |
| - xmlNodePtr cur = NULL; |
| - |
| - xmlSecAssert2(crl != NULL, -1); |
| - xmlSecAssert2(node != NULL, -1); |
| - xmlSecAssert2(keyInfoCtx != NULL, -1); |
| - |
| - /* set base64 lines size from context */ |
| - buf = xmlSecNssX509CrlBase64DerWrite(crl, keyInfoCtx->base64LineSize); |
| - if(buf == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecNssX509CrlBase64DerWrite", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| - return(-1); |
| - } |
| - |
| - cur = xmlSecAddChild(node, xmlSecNodeX509CRL, xmlSecDSigNs); |
| - if(cur == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecAddChild", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - "new_node=%s", |
| - xmlSecErrorsSafeString(xmlSecNodeX509CRL)); |
| - xmlFree(buf); |
| - return(-1); |
| - } |
| - /* todo: add \n around base64 data - from context */ |
| - /* todo: add errors check */ |
| - xmlNodeSetContent(cur, xmlSecStringCR); |
| - xmlNodeSetContent(cur, buf); |
| - xmlFree(buf); |
| - |
| - return(0); |
| -} |
| - |
| - |
| -static int |
| xmlSecNssKeyDataX509VerifyAndExtractKey(xmlSecKeyDataPtr data, xmlSecKeyPtr key, |
| xmlSecKeyInfoCtxPtr keyInfoCtx) { |
| xmlSecNssX509DataCtxPtr ctx; |
| @@ -1604,6 +1319,10 @@ |
| int ret; |
| SECStatus status; |
| PRTime notBefore, notAfter; |
| + |
| + PK11SlotInfo* slot ; |
| + SECKEYPublicKey *pubKey = NULL; |
| + SECKEYPrivateKey *priKey = NULL; |
| |
| xmlSecAssert2(xmlSecKeyDataCheckId(data, xmlSecNssKeyDataX509Id), -1); |
| xmlSecAssert2(key != NULL, -1); |
| @@ -1636,10 +1355,14 @@ |
| xmlSecErrorsSafeString(xmlSecKeyDataGetName(data)), |
| "CERT_DupCertificate", |
| XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| + "error code=%d", PORT_GetError()); |
| return(-1); |
| } |
| - |
| + |
| + /*- |
| + * Get Public key from cert, which does not always work for sign |
| + * action. |
| + * |
| keyValue = xmlSecNssX509CertGetKey(ctx->keyCert); |
| if(keyValue == NULL) { |
| xmlSecError(XMLSEC_ERRORS_HERE, |
| @@ -1649,6 +1372,54 @@ |
| XMLSEC_ERRORS_NO_MESSAGE); |
| return(-1); |
| } |
| + */ |
| + /*- |
| + * I'll search key according to KeyReq. |
| + */ |
| + slot = cert->slot ; |
| + if( ( keyInfoCtx->keyReq.keyType & xmlSecKeyDataTypePrivate ) == xmlSecKeyDataTypePrivate ) { |
| + if( ( priKey = PK11_FindPrivateKeyFromCert( slot , cert , NULL ) ) == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyDataGetName( data ) ) , |
| + "PK11_FindPrivateKeyFromCert" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + return -1 ; |
| + } |
| + } |
| + |
| + if( ( keyInfoCtx->keyReq.keyType & xmlSecKeyDataTypePublic ) == xmlSecKeyDataTypePublic ) { |
| + if( ( pubKey = CERT_ExtractPublicKey( cert ) ) == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyDataGetName( data ) ) , |
| + "CERT_ExtractPublicKey" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + |
| + |
| + if( priKey != NULL ) |
| + SECKEY_DestroyPrivateKey( priKey ) ; |
| + return -1 ; |
| + } |
| + } |
| + |
| + keyValue = xmlSecNssPKIAdoptKey(priKey, pubKey); |
| + if( keyValue == NULL ) { |
| + xmlSecError( XMLSEC_ERRORS_HERE , |
| + xmlSecErrorsSafeString( xmlSecKeyDataGetName( data ) ) , |
| + "xmlSecNssPKIAdoptKey" , |
| + XMLSEC_ERRORS_R_CRYPTO_FAILED , |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + |
| + if( priKey != NULL ) |
| + SECKEY_DestroyPrivateKey( priKey ) ; |
| + |
| + if( pubKey != NULL ) |
| + SECKEY_DestroyPublicKey( pubKey ) ; |
| + |
| + return -1 ; |
| + } |
| + /* Modify keyValue get Done */ |
| |
| /* verify that the key matches our expectations */ |
| if(xmlSecKeyReqMatchKeyValue(&(keyInfoCtx->keyReq), keyValue) != 1) { |
| @@ -1950,86 +1721,6 @@ |
| return(res); |
| } |
| |
| -static xmlChar* |
| -xmlSecNssX509NameWrite(CERTName* nm) { |
| - xmlChar *res = NULL; |
| - char *str; |
| - |
| - xmlSecAssert2(nm != NULL, NULL); |
| - |
| - str = CERT_NameToAscii(nm); |
| - if (str == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "CERT_NameToAscii", |
| - XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| - return(NULL); |
| - } |
| - |
| - res = xmlStrdup(BAD_CAST str); |
| - if(res == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlStrdup", |
| - XMLSEC_ERRORS_R_MALLOC_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| - PORT_Free(str); |
| - return(NULL); |
| - } |
| - PORT_Free(str); |
| - return(res); |
| -} |
| - |
| -static xmlChar* |
| -xmlSecNssASN1IntegerWrite(SECItem *num) { |
| - xmlChar *res = NULL; |
| - |
| - xmlSecAssert2(num != NULL, NULL); |
| - |
| - /* TODO : to be implemented after |
| - * NSS bug http://bugzilla.mozilla.org/show_bug.cgi?id=212864 is fixed |
| - */ |
| - return(res); |
| -} |
| - |
| -static xmlChar* |
| -xmlSecNssX509SKIWrite(CERTCertificate* cert) { |
| - xmlChar *res = NULL; |
| - SECItem ski; |
| - SECStatus rv; |
| - |
| - xmlSecAssert2(cert != NULL, NULL); |
| - |
| - memset(&ski, 0, sizeof(ski)); |
| - |
| - rv = CERT_FindSubjectKeyIDExtension(cert, &ski); |
| - if (rv != SECSuccess) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "CERT_FindSubjectKeyIDExtension", |
| - XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| - SECITEM_FreeItem(&ski, PR_FALSE); |
| - return(NULL); |
| - } |
| - |
| - res = xmlSecBase64Encode(ski.data, ski.len, 0); |
| - if(res == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecBase64Encode", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| - SECITEM_FreeItem(&ski, PR_FALSE); |
| - return(NULL); |
| - } |
| - SECITEM_FreeItem(&ski, PR_FALSE); |
| - |
| - return(res); |
| -} |
| - |
| - |
| static void |
| xmlSecNssX509CertDebugDump(CERTCertificate* cert, FILE* output) { |
| SECItem *sn; |
| --- misc/xmlsec1-1.2.14/src/nss/x509vfy.c 2009-06-25 22:53:18.000000000 +0200 |
| +++ misc/build/xmlsec1-1.2.14/src/nss/x509vfy.c 2009-09-21 14:02:48.669245207 +0200 |
| @@ -30,6 +30,7 @@ |
| #include <xmlsec/keyinfo.h> |
| #include <xmlsec/keysmngr.h> |
| #include <xmlsec/base64.h> |
| +#include <xmlsec/bn.h> |
| #include <xmlsec/errors.h> |
| |
| #include <xmlsec/nss/crypto.h> |
| @@ -61,17 +62,7 @@ |
| |
| static int xmlSecNssX509StoreInitialize (xmlSecKeyDataStorePtr store); |
| static void xmlSecNssX509StoreFinalize (xmlSecKeyDataStorePtr store); |
| -static int xmlSecNssX509NameStringRead (xmlSecByte **str, |
| - int *strLen, |
| - xmlSecByte *res, |
| - int resLen, |
| - xmlSecByte delim, |
| - int ingoreTrailingSpaces); |
| -static xmlSecByte * xmlSecNssX509NameRead (xmlSecByte *str, |
| - int len); |
| - |
| -static void xmlSecNssNumToItem(SECItem *it, unsigned long num); |
| - |
| +static int xmlSecNssIntegerToItem( const xmlChar* integer , SECItem *it ) ; |
| |
| static xmlSecKeyDataStoreKlass xmlSecNssX509StoreKlass = { |
| sizeof(xmlSecKeyDataStoreKlass), |
| @@ -339,40 +330,28 @@ |
| xmlSecNssX509FindCert(xmlChar *subjectName, xmlChar *issuerName, |
| xmlChar *issuerSerial, xmlChar *ski) { |
| CERTCertificate *cert = NULL; |
| - xmlChar *p = NULL; |
| CERTName *name = NULL; |
| SECItem *nameitem = NULL; |
| PRArenaPool *arena = NULL; |
| |
| if (subjectName != NULL) { |
| - p = xmlSecNssX509NameRead(subjectName, xmlStrlen(subjectName)); |
| - if (p == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecNssX509NameRead", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - "subject=%s", |
| - xmlSecErrorsSafeString(subjectName)); |
| - goto done; |
| - } |
| - |
| arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); |
| if (arena == NULL) { |
| xmlSecError(XMLSEC_ERRORS_HERE, |
| NULL, |
| "PORT_NewArena", |
| XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| + "error code=%d", PORT_GetError()); |
| goto done; |
| } |
| |
| - name = CERT_AsciiToName((char*)p); |
| + name = CERT_AsciiToName((char*)subjectName); |
| if (name == NULL) { |
| xmlSecError(XMLSEC_ERRORS_HERE, |
| NULL, |
| "CERT_AsciiToName", |
| XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| + "error code=%d", PORT_GetError()); |
| goto done; |
| } |
| |
| @@ -394,34 +373,23 @@ |
| if((issuerName != NULL) && (issuerSerial != NULL)) { |
| CERTIssuerAndSN issuerAndSN; |
| |
| - p = xmlSecNssX509NameRead(issuerName, xmlStrlen(issuerName)); |
| - if (p == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecNssX509NameRead", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - "issuer=%s", |
| - xmlSecErrorsSafeString(issuerName)); |
| - goto done; |
| - } |
| - |
| arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); |
| if (arena == NULL) { |
| xmlSecError(XMLSEC_ERRORS_HERE, |
| NULL, |
| "PORT_NewArena", |
| XMLSEC_ERRORS_R_CRYPTO_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| + "error code=%d", PORT_GetError()); |
| goto done; |
| } |
| |
| - name = CERT_AsciiToName((char*)p); |
| + name = CERT_AsciiToName((char*)issuerName); |
| if (name == NULL) { |
| xmlSecError(XMLSEC_ERRORS_HERE, |
| NULL, |
| "CERT_AsciiToName", |
| XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| + "error code=%d", PORT_GetError()); |
| goto done; |
| } |
| |
| @@ -441,8 +409,15 @@ |
| issuerAndSN.derIssuer.data = nameitem->data; |
| issuerAndSN.derIssuer.len = nameitem->len; |
| |
| - /* TBD: serial num can be arbitrarily long */ |
| - xmlSecNssNumToItem(&issuerAndSN.serialNumber, PORT_Atoi((char *)issuerSerial)); |
| + if( xmlSecNssIntegerToItem( issuerSerial, &issuerAndSN.serialNumber ) < 0 ) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "xmlSecNssIntegerToItem", |
| + XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| + "serial number=%s", |
| + xmlSecErrorsSafeString(issuerSerial)); |
| + goto done; |
| + } |
| |
| cert = CERT_FindCertByIssuerAndSN(CERT_GetDefaultCertDB(), |
| &issuerAndSN); |
| @@ -473,9 +448,6 @@ |
| } |
| |
| done: |
| - if (p != NULL) { |
| - PORT_Free(p); |
| - } |
| if (arena != NULL) { |
| PORT_FreeArena(arena, PR_FALSE); |
| } |
| @@ -486,176 +458,6 @@ |
| return(cert); |
| } |
| |
| -static xmlSecByte * |
| -xmlSecNssX509NameRead(xmlSecByte *str, int len) { |
| - xmlSecByte name[256]; |
| - xmlSecByte value[256]; |
| - xmlSecByte *retval = NULL; |
| - xmlSecByte *p = NULL; |
| - int nameLen, valueLen; |
| - |
| - xmlSecAssert2(str != NULL, NULL); |
| - |
| - /* return string should be no longer than input string */ |
| - retval = (xmlSecByte *)PORT_Alloc(len+1); |
| - if(retval == NULL) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "PORT_Alloc", |
| - XMLSEC_ERRORS_R_MALLOC_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| - return(NULL); |
| - } |
| - p = retval; |
| - |
| - while(len > 0) { |
| - /* skip spaces after comma or semicolon */ |
| - while((len > 0) && isspace(*str)) { |
| - ++str; --len; |
| - } |
| - |
| - nameLen = xmlSecNssX509NameStringRead(&str, &len, name, sizeof(name), '=', 0); |
| - if(nameLen < 0) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecNssX509NameStringRead", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| - goto done; |
| - } |
| - memcpy(p, name, nameLen); |
| - p+=nameLen; |
| - *p++='='; |
| - if(len > 0) { |
| - ++str; --len; |
| - if((*str) == '\"') { |
| - valueLen = xmlSecNssX509NameStringRead(&str, &len, |
| - value, sizeof(value), '"', 1); |
| - if(valueLen < 0) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecNssX509NameStringRead", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| - goto done; |
| - } |
| - /* skip spaces before comma or semicolon */ |
| - while((len > 0) && isspace(*str)) { |
| - ++str; --len; |
| - } |
| - if((len > 0) && ((*str) != ',')) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - NULL, |
| - XMLSEC_ERRORS_R_INVALID_DATA, |
| - "comma is expected"); |
| - goto done; |
| - } |
| - if(len > 0) { |
| - ++str; --len; |
| - } |
| - *p++='\"'; |
| - memcpy(p, value, valueLen); |
| - p+=valueLen; |
| - *p++='\"'; |
| - } else if((*str) == '#') { |
| - /* TODO: read octect values */ |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - NULL, |
| - XMLSEC_ERRORS_R_INVALID_DATA, |
| - "reading octect values is not implemented yet"); |
| - goto done; |
| - } else { |
| - valueLen = xmlSecNssX509NameStringRead(&str, &len, |
| - value, sizeof(value), ',', 1); |
| - if(valueLen < 0) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - "xmlSecNssX509NameStringRead", |
| - XMLSEC_ERRORS_R_XMLSEC_FAILED, |
| - XMLSEC_ERRORS_NO_MESSAGE); |
| - goto done; |
| - } |
| - memcpy(p, value, valueLen); |
| - p+=valueLen; |
| - if (len > 0) |
| - *p++=','; |
| - } |
| - } else { |
| - valueLen = 0; |
| - } |
| - if(len > 0) { |
| - ++str; --len; |
| - } |
| - } |
| - |
| - *p = 0; |
| - return(retval); |
| - |
| -done: |
| - PORT_Free(retval); |
| - return (NULL); |
| -} |
| - |
| -static int |
| -xmlSecNssX509NameStringRead(xmlSecByte **str, int *strLen, |
| - xmlSecByte *res, int resLen, |
| - xmlSecByte delim, int ingoreTrailingSpaces) { |
| - xmlSecByte *p, *q, *nonSpace; |
| - |
| - xmlSecAssert2(str != NULL, -1); |
| - xmlSecAssert2(strLen != NULL, -1); |
| - xmlSecAssert2(res != NULL, -1); |
| - |
| - p = (*str); |
| - nonSpace = q = res; |
| - while(((p - (*str)) < (*strLen)) && ((*p) != delim) && ((q - res) < resLen)) { |
| - if((*p) != '\\') { |
| - if(ingoreTrailingSpaces && !isspace(*p)) { |
| - nonSpace = q; |
| - } |
| - *(q++) = *(p++); |
| - } else { |
| - ++p; |
| - nonSpace = q; |
| - if(xmlSecIsHex((*p))) { |
| - if((p - (*str) + 1) >= (*strLen)) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - NULL, |
| - XMLSEC_ERRORS_R_INVALID_DATA, |
| - "two hex digits expected"); |
| - return(-1); |
| - } |
| - *(q++) = xmlSecGetHex(p[0]) * 16 + xmlSecGetHex(p[1]); |
| - p += 2; |
| - } else { |
| - if(((++p) - (*str)) >= (*strLen)) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - NULL, |
| - XMLSEC_ERRORS_R_INVALID_DATA, |
| - "escaped symbol missed"); |
| - return(-1); |
| - } |
| - *(q++) = *(p++); |
| - } |
| - } |
| - } |
| - if(((p - (*str)) < (*strLen)) && ((*p) != delim)) { |
| - xmlSecError(XMLSEC_ERRORS_HERE, |
| - NULL, |
| - NULL, |
| - XMLSEC_ERRORS_R_INVALID_SIZE, |
| - "buffer is too small"); |
| - return(-1); |
| - } |
| - (*strLen) -= (p - (*str)); |
| - (*str) = p; |
| - return((ingoreTrailingSpaces) ? nonSpace - res + 1 : q - res); |
| -} |
| - |
| /* code lifted from NSS */ |
| static void |
| xmlSecNssNumToItem(SECItem *it, unsigned long ui) |
| @@ -699,6 +501,77 @@ |
| it->len = len; |
| PORT_Memcpy(it->data, bb + (sizeof(bb) - len), len); |
| } |
| + |
| +static int |
| +xmlSecNssIntegerToItem( |
| + const xmlChar* integer , |
| + SECItem *item |
| +) { |
| + xmlSecBn bn ; |
| + xmlSecSize i, length ; |
| + const xmlSecByte* bnInteger ; |
| + |
| + xmlSecAssert2( integer != NULL, -1 ) ; |
| + xmlSecAssert2( item != NULL, -1 ) ; |
| + |
| + if( xmlSecBnInitialize( &bn, 0 ) < 0 ) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "xmlSecBnInitialize", |
| + XMLSEC_ERRORS_R_INVALID_DATA, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + return -1 ; |
| + } |
| + |
| + if( xmlSecBnFromDecString( &bn, integer ) < 0 ) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "xmlSecBnFromDecString", |
| + XMLSEC_ERRORS_R_INVALID_DATA, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + xmlSecBnFinalize( &bn ) ; |
| + return -1 ; |
| + } |
| + |
| + length = xmlSecBnGetSize( &bn ) ; |
| + if( length <= 0 ) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "xmlSecBnGetSize", |
| + XMLSEC_ERRORS_R_INVALID_DATA, |
| + XMLSEC_ERRORS_NO_MESSAGE); |
| + } |
| + |
| + bnInteger = xmlSecBnGetData( &bn ) ; |
| + if( bnInteger == NULL ) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "xmlSecBnGetData", |
| + XMLSEC_ERRORS_R_INVALID_DATA, |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + xmlSecBnFinalize( &bn ) ; |
| + return -1 ; |
| + } |
| + |
| + item->data = ( unsigned char * )PORT_Alloc( length ); |
| + if( item->data == NULL ) { |
| + xmlSecError(XMLSEC_ERRORS_HERE, |
| + NULL, |
| + "PORT_Alloc", |
| + XMLSEC_ERRORS_R_INVALID_DATA, |
| + XMLSEC_ERRORS_NO_MESSAGE ) ; |
| + xmlSecBnFinalize( &bn ) ; |
| + return -1 ; |
| + } |
| + |
| + item->len = length; |
| + for( i = 0 ; i < length ; i ++ ) |
| + item->data[i] = *( bnInteger + i ) ; |
| + |
| + xmlSecBnFinalize( &bn ) ; |
| + |
| + return 0 ; |
| +} |
| #endif /* XMLSEC_NO_X509 */ |
| |
| |
| --- misc/xmlsec1-1.2.14/win32/Makefile.msvc 2009-06-25 22:53:18.000000000 +0200 |
| +++ misc/build/xmlsec1-1.2.14/win32/Makefile.msvc 2009-09-21 14:02:48.607277908 +0200 |
| @@ -218,6 +218,9 @@ |
| $(XMLSEC_OPENSSL_INTDIR_A)\x509vfy.obj |
| |
| XMLSEC_NSS_OBJS = \ |
| + $(XMLSEC_NSS_INTDIR)\akmngr.obj\ |
| + $(XMLSEC_NSS_INTDIR)\keywrapers.obj\ |
| + $(XMLSEC_NSS_INTDIR)\tokens.obj\ |
| $(XMLSEC_NSS_INTDIR)\app.obj\ |
| $(XMLSEC_NSS_INTDIR)\bignum.obj\ |
| $(XMLSEC_NSS_INTDIR)\ciphers.obj \ |
| @@ -253,6 +256,7 @@ |
| $(XMLSEC_NSS_INTDIR_A)\strings.obj |
| |
| XMLSEC_MSCRYPTO_OBJS = \ |
| + $(XMLSEC_MSCRYPTO_INTDIR)\akmngr.obj\ |
| $(XMLSEC_MSCRYPTO_INTDIR)\app.obj\ |
| $(XMLSEC_MSCRYPTO_INTDIR)\crypto.obj \ |
| $(XMLSEC_MSCRYPTO_INTDIR)\ciphers.obj \ |
