/* parse a single slot specific parameter */
static void
nssutil_argDecodeSingleSlotInfo(char *name, char *params,
struct NSSUTILPreSlotInfoStr *slotInfo)
{
char *askpw;
slotInfo->slotID = NSSUTIL_ArgDecodeNumber(name);
slotInfo->defaultFlags = NSSUTIL_ArgParseSlotFlags("slotFlags", params);
slotInfo->timeout = NSSUTIL_ArgReadLong("timeout", params, 0, NULL);
askpw = NSSUTIL_ArgGetParamValue("askpw", params);
slotInfo->askpw = 0;
if (askpw) {
if (PORT_Strcasecmp(askpw, "every") == 0) {
slotInfo->askpw = -1;
} else if (PORT_Strcasecmp(askpw, "timeout") == 0) {
slotInfo->askpw = 1;
}
PORT_Free(askpw);
slotInfo->defaultFlags |= PK11_OWN_PW_DEFAULTS;
}
slotInfo->hasRootCerts = NSSUTIL_ArgHasFlag("rootFlags", "hasRootCerts",
params);
slotInfo->hasRootTrust = NSSUTIL_ArgHasFlag("rootFlags", "hasRootTrust",
params);
}
/* turn the slot flags into a bit mask */
unsigned long
NSSUTIL_ArgParseSlotFlags(const char *label, const char *params)
{
char *flags;
const char *index;
unsigned long retValue = 0;
int i;
PRBool all = PR_FALSE;
flags = NSSUTIL_ArgGetParamValue(label, params);
if (flags == NULL)
return 0;
if (PORT_Strcasecmp(flags, "all") == 0)
all = PR_TRUE;
for (index = flags; *index; index = NSSUTIL_ArgNextFlag(index)) {
for (i = 0; i < nssutil_argSlotFlagTableSize; i++) {
if (all ||
(PORT_Strncasecmp(index, nssutil_argSlotFlagTable[i].name,
nssutil_argSlotFlagTable[i].len) == 0)) {
retValue |= nssutil_argSlotFlagTable[i].value;
}
}
}
PORT_Free(flags);
return retValue;
}
/*
* read an argument at a Long integer
*/
long
NSSUTIL_ArgReadLong(char *label,char *params, long defValue, PRBool *isdefault)
{
char *value;
long retValue;
if (isdefault) *isdefault = PR_FALSE;
value = NSSUTIL_ArgGetParamValue(label,params);
if (value == NULL) {
if (isdefault) *isdefault = PR_TRUE;
return defValue;
}
retValue = NSSUTIL_ArgDecodeNumber(value);
if (value) PORT_Free(value);
return retValue;
}
/*
* return true if the flag is set in the label parameter.
*/
PRBool
NSSUTIL_ArgHasFlag(char *label, char *flag, char *parameters)
{
char *flags,*index;
int len = strlen(flag);
PRBool found = PR_FALSE;
flags = NSSUTIL_ArgGetParamValue(label,parameters);
if (flags == NULL) return PR_FALSE;
for (index=flags; *index; index=NSSUTIL_ArgNextFlag(index)) {
if (PORT_Strncasecmp(index,flag,len) == 0) {
found=PR_TRUE;
break;
}
}
PORT_Free(flags);
return found;
}
/*
* Delete a module from the Data Base
*/
static SECStatus
nssutil_DeleteSecmodDBEntry(const char *appName,
const char *filename,
const char *dbname,
char *args,
PRBool rw)
{
/* SHDB_FIXME implement */
os_stat_type stat_existing;
os_open_permissions_type file_mode;
FILE *fd = NULL;
FILE *fd2 = NULL;
char line[MAX_LINE_LENGTH];
char *dbname2 = NULL;
char *block = NULL;
char *name = NULL;
char *lib = NULL;
int name_len = 0, lib_len = 0;
PRBool skip = PR_FALSE;
PRBool found = PR_FALSE;
if (dbname == NULL) {
PORT_SetError(SEC_ERROR_INVALID_ARGS);
return SECFailure;
}
if (!rw) {
PORT_SetError(SEC_ERROR_READ_ONLY);
return SECFailure;
}
dbname2 = PORT_Strdup(dbname);
if (dbname2 == NULL) goto loser;
dbname2[strlen(dbname)-1]++;
/* get the permissions of the existing file, or use the default */
if (!os_stat(dbname, &stat_existing)) {
file_mode = stat_existing.st_mode;
} else {
file_mode = os_open_permissions_default;
}
/* do we really want to use streams here */
fd = fopen(dbname, "r");
if (fd == NULL) goto loser;
fd2 = lfopen(dbname2, lfopen_truncate, file_mode);
if (fd2 == NULL) goto loser;
name = NSSUTIL_ArgGetParamValue("name",args);
if (name) {
name_len = PORT_Strlen(name);
}
lib = NSSUTIL_ArgGetParamValue("library",args);
if (lib) {
lib_len = PORT_Strlen(lib);
}
/*
* the following loop takes line separated config files and collapses
* the lines to a single string, escaping and quoting as necessary.
*/
/* loop state variables */
block = NULL;
skip = PR_FALSE;
while (fgets(line, sizeof(line), fd) != NULL) {
/* If we are processing a block (we haven't hit a blank line yet */
if (*line != '\n') {
/* skip means we are in the middle of a block we are deleting */
if (skip) {
continue;
}
/* if we haven't found the block yet, check to see if this block
* matches our requirements */
if (!found && ((name && (PORT_Strncasecmp(line,"name=",5) == 0) &&
(PORT_Strncmp(line+5,name,name_len) == 0)) ||
(lib && (PORT_Strncasecmp(line,"library=",8) == 0) &&
(PORT_Strncmp(line+8,lib,lib_len) == 0)))) {
/* yup, we don't need to save any more data, */
PORT_Free(block);
block=NULL;
/* we don't need to collect more of this block */
skip = PR_TRUE;
/* we don't need to continue searching for the block */
found =PR_TRUE;
continue;
}
/* not our match, continue to collect data in this block */
block = nssutil_DupCat(block,line);
continue;
}
/* we've collected a block of data that wasn't the module we were
* looking for, write it out */
if (block) {
fwrite(block, PORT_Strlen(block), 1, fd2);
PORT_Free(block);
block = NULL;
}
/* If we didn't just delete the this block, keep the blank line */
if (!skip) {
fputs(line,fd2);
}
/* we are definately not in a deleted block anymore */
skip = PR_FALSE;
}
fclose(fd);
fclose(fd2);
if (found) {
/* rename dbname2 to dbname */
PR_Delete(dbname);
PR_Rename(dbname2,dbname);
} else {
PR_Delete(dbname2);
}
PORT_Free(dbname2);
PORT_Free(lib);
PORT_Free(name);
PORT_Free(block);
return SECSuccess;
loser:
if (fd != NULL) {
fclose(fd);
}
if (fd2 != NULL) {
fclose(fd2);
}
if (dbname2) {
PR_Delete(dbname2);
PORT_Free(dbname2);
}
PORT_Free(lib);
PORT_Free(name);
return SECFailure;
}
/*
* for 3.4 we continue to use the old SECMODModule structure
*/
SECMODModule *
SECMOD_CreateModuleEx(const char *library, const char *moduleName,
const char *parameters, const char *nss,
const char *config)
{
SECMODModule *mod;
SECStatus rv;
char *slotParams,*ciphers;
/* pk11pars.h still does not have const char * interfaces */
char *nssc = (char *)nss;
char *configc = NULL;
if (config) {
configc = PORT_Strdup(config); /* no const */
}
rv = applyCryptoPolicy(configc);
if (configc) PORT_Free(configc);
/* do not load the module if policy parsing fails */
if (rv != SECSuccess) {
return NULL;
}
mod = secmod_NewModule();
if (mod == NULL) return NULL;
mod->commonName = PORT_ArenaStrdup(mod->arena,moduleName ? moduleName : "");
if (library) {
mod->dllName = PORT_ArenaStrdup(mod->arena,library);
}
/* new field */
if (parameters) {
mod->libraryParams = PORT_ArenaStrdup(mod->arena,parameters);
}
mod->internal = NSSUTIL_ArgHasFlag("flags","internal",nssc);
mod->isFIPS = NSSUTIL_ArgHasFlag("flags","FIPS",nssc);
mod->isCritical = NSSUTIL_ArgHasFlag("flags","critical",nssc);
slotParams = NSSUTIL_ArgGetParamValue("slotParams",nssc);
mod->slotInfo = NSSUTIL_ArgParseSlotInfo(mod->arena,slotParams,
&mod->slotInfoCount);
if (slotParams) PORT_Free(slotParams);
/* new field */
mod->trustOrder = NSSUTIL_ArgReadLong("trustOrder",nssc,
NSSUTIL_DEFAULT_TRUST_ORDER,NULL);
/* new field */
mod->cipherOrder = NSSUTIL_ArgReadLong("cipherOrder",nssc,
NSSUTIL_DEFAULT_CIPHER_ORDER,NULL);
/* new field */
mod->isModuleDB = NSSUTIL_ArgHasFlag("flags","moduleDB",nssc);
mod->moduleDBOnly = NSSUTIL_ArgHasFlag("flags","moduleDBOnly",nssc);
if (mod->moduleDBOnly) mod->isModuleDB = PR_TRUE;
/* we need more bits, but we also want to preserve binary compatibility
* so we overload the isModuleDB PRBool with additional flags.
* These flags are only valid if mod->isModuleDB is already set.
* NOTE: this depends on the fact that PRBool is at least a char on
* all platforms. These flags are only valid if moduleDB is set, so
* code checking if (mod->isModuleDB) will continue to work correctly. */
if (mod->isModuleDB) {
char flags = SECMOD_FLAG_MODULE_DB_IS_MODULE_DB;
if (NSSUTIL_ArgHasFlag("flags","skipFirst",nssc)) {
flags |= SECMOD_FLAG_MODULE_DB_SKIP_FIRST;
}
if (NSSUTIL_ArgHasFlag("flags","defaultModDB",nssc)) {
flags |= SECMOD_FLAG_MODULE_DB_DEFAULT_MODDB;
}
/* additional moduleDB flags could be added here in the future */
mod->isModuleDB = (PRBool) flags;
}
if (mod->internal) {
char flags = SECMOD_FLAG_INTERNAL_IS_INTERNAL;
if (NSSUTIL_ArgHasFlag("flags", "internalKeySlot", nssc)) {
flags |= SECMOD_FLAG_INTERNAL_KEY_SLOT;
}
mod->internal = (PRBool) flags;
}
ciphers = NSSUTIL_ArgGetParamValue("ciphers",nssc);
NSSUTIL_ArgParseCipherFlags(&mod->ssl[0],ciphers);
if (ciphers) PORT_Free(ciphers);
secmod_PrivateModuleCount++;
return mod;
}
