ostream&
operator<<(ostream& os, SECStatusWithPRErrorCode const& value)
{
switch (value.mRv)
{
case SECSuccess:
os << "SECSuccess";
break;
case SECWouldBlock:
os << "SECWouldBlock";
break;
case SECFailure:
os << "SECFailure";
break;
default:
os << "[Invalid SECStatus: " << static_cast<int64_t>(value.mRv) << ']';
break;
}
if (value.mRv != SECSuccess) {
os << '(';
const char* name = PR_ErrorToName(value.mErrorCode);
if (name) {
os << name;
} else {
os << value.mErrorCode;
}
os << ')';
}
return os;
}
static const char* nss_error_to_name(PRErrorCode code)
{
const char *name = PR_ErrorToName(code);
if(name)
return name;
return "unknown error";
}
static CERTCertificate *load_cert_file(sxc_client_t *sx, const char *file, struct PK11_ctx *ctx) {
const char *slot_name = "PEM Token #0";
CK_OBJECT_CLASS obj_class;
CK_ATTRIBUTE attrs[/* max count of attributes */ 4];
unsigned attr_cnt = 0;
CK_BBOOL cktrue = CK_TRUE;
SECMODModule *mod;
CERTCertificate *cert = NULL;
if(!file || !ctx) {
sxi_seterr(sx, SXE_EARG, "NULL argument");
return NULL;
}
memset(ctx, 0, sizeof(*ctx));
mod = SECMOD_LoadUserModule("library=libnsspem.so name=PEM", NULL, PR_FALSE);
if (!mod || !mod->loaded) {
if (mod)
SECMOD_DestroyModule(mod);
sxi_setsyserr(sx, SXE_ECFG, "Failed to load NSS PEM library");
return NULL;
}
sxi_crypto_check_ver(NULL);
ctx->slot = PK11_FindSlotByName(slot_name);
if (ctx->slot) {
obj_class = CKO_CERTIFICATE;
PK11_SETATTRS(attrs, attr_cnt, CKA_CLASS, &obj_class, sizeof(obj_class));
PK11_SETATTRS(attrs, attr_cnt, CKA_TOKEN, &cktrue, sizeof(CK_BBOOL));
PK11_SETATTRS(attrs, attr_cnt, CKA_LABEL, (unsigned char *)file,
strlen(file) + 1);
if(CKO_CERTIFICATE == obj_class) {
CK_BBOOL *pval = &cktrue;
PK11_SETATTRS(attrs, attr_cnt, CKA_TRUST, pval, sizeof(*pval));
}
ctx->obj = PK11_CreateGenericObject(ctx->slot, attrs, attr_cnt, PR_FALSE);
if (!ctx->obj) {
sxi_seterr(sx, SXE_ECFG, "Cannot load certificate from '%s': %s, %s",
file, PR_ErrorToString(PR_GetError(), PR_LANGUAGE_I_DEFAULT),
PR_ErrorToName(PR_GetError()));
return NULL;
}
ctx->list = PK11_ListCertsInSlot(ctx->slot);
if (ctx->list) {
CERTCertListNode *node = CERT_LIST_HEAD(ctx->list);
cert = node ? node->cert : NULL;
}
} else {
sxi_seterr(sx, SXE_ECFG, "Failed to initialize NSS PEM token");
return NULL;
}
return cert;
}
/**
* @brief Initialise a context for decrypting arbitrary data using the given key.
* @note If *ctx is NULL, a apr_crypto_block_t will be created from a pool. If
* *ctx is not NULL, *ctx must point at a previously created structure.
* @param ctx The block context returned, see note.
* @param blockSize The block size of the cipher.
* @param iv Optional initialisation vector. If the buffer pointed to is NULL,
* an IV will be created at random, in space allocated from the pool.
* If the buffer is not NULL, the IV in the buffer will be used.
* @param key The key structure.
* @param p The pool to use.
* @return Returns APR_ENOIV if an initialisation vector is required but not specified.
* Returns APR_EINIT if the backend failed to initialise the context. Returns
* APR_ENOTIMPL if not implemented.
*/
static apr_status_t crypto_block_decrypt_init(apr_crypto_block_t **ctx,
apr_size_t *blockSize, const unsigned char *iv,
const apr_crypto_key_t *key, apr_pool_t *p)
{
PRErrorCode perr;
SECItem * secParam;
apr_crypto_block_t *block = *ctx;
if (!block) {
*ctx = block = apr_pcalloc(p, sizeof(apr_crypto_block_t));
}
if (!block) {
return APR_ENOMEM;
}
block->f = key->f;
block->pool = p;
block->provider = key->provider;
apr_pool_cleanup_register(p, block, crypto_block_cleanup_helper,
apr_pool_cleanup_null);
if (key->ivSize) {
SECItem ivItem;
if (iv == NULL) {
return APR_ENOIV; /* Cannot initialise without an IV */
}
ivItem.data = (unsigned char*) iv;
ivItem.len = key->ivSize;
secParam = PK11_ParamFromIV(key->cipherMech, &ivItem);
}
else {
secParam = PK11_GenerateNewParam(key->cipherMech, key->symKey);
}
block->blockSize = PK11_GetBlockSize(key->cipherMech, secParam);
block->ctx = PK11_CreateContextBySymKey(key->cipherMech, CKA_DECRYPT,
key->symKey, secParam);
/* did an error occur? */
perr = PORT_GetError();
if (perr || !block->ctx) {
key->f->result->rc = perr;
key->f->result->msg = PR_ErrorToName(perr);
return APR_EINIT;
}
if (blockSize) {
*blockSize = PK11_GetBlockSize(key->cipherMech, secParam);
}
return APR_SUCCESS;
}
void
PrintPRError(const char *aPrefix)
{
const char *err = PR_ErrorToName(PR_GetError());
if (err) {
if (gDebugLevel >= DEBUG_ERRORS) {
fprintf(stderr, "%s: %s\n", aPrefix, err);
}
} else {
if (gDebugLevel >= DEBUG_ERRORS) {
fprintf(stderr, "%s\n", aPrefix);
}
}
}
PR_IMPLEMENT(void) PL_FPrintError(PRFileDesc *fd, const char *msg)
{
PRErrorCode error = PR_GetError();
PRInt32 oserror = PR_GetOSError();
const char *name = PR_ErrorToName(error);
if (NULL != msg) PR_fprintf(fd, "%s: ", msg);
if (NULL == name)
PR_fprintf(
fd, " (%d)OUT OF RANGE, oserror = %d\n", error, oserror);
else
PR_fprintf(
fd, "%s(%d), oserror = %d\n",
name, error, oserror);
} /* PL_FPrintError */
// Print out the current NSPR error message to the given output stream.
void NSPR_PrintError(const std::string& errorPrefixString, std::ostream& out)
{
PRErrorCode err = PR_GetError();
const char* err_name = PR_ErrorToName(err);
const char* err_str = PR_ErrorToString(err,0);
out << "Error (NSPR): " << errorPrefixString << "(" << err;
if ( err_name != NULL )
{
out << ":" << err_name;
}
if ( err_str != NULL )
{
out << ", " << err_str;
}
out << ")" << std::endl;
}
/**
* @brief Decrypt final data block, write it to out.
* @note If necessary the final block will be written out after being
* padded. Typically the final block will be written to the
* same buffer used by apr_crypto_block_decrypt, offset by the
* number of bytes returned as actually written by the
* apr_crypto_block_decrypt() call. After this call, the context
* is cleaned and can be reused by apr_crypto_block_decrypt_init().
* @param out Address of a buffer to which data will be written. This
* buffer must already exist, and is usually the same
* buffer used by apr_evp_crypt(). See note.
* @param outlen Length of the output will be written here.
* @param ctx The block context to use.
* @return APR_ECRYPT if an error occurred.
* @return APR_EPADDING if padding was enabled and the block was incorrectly
* formatted.
* @return APR_ENOTIMPL if not implemented.
*/
static apr_status_t crypto_block_decrypt_finish(unsigned char *out,
apr_size_t *outlen, apr_crypto_block_t *block)
{
apr_status_t rv = APR_SUCCESS;
unsigned int outl = *outlen;
SECStatus s = PK11_DigestFinal(block->ctx, out, &outl, block->blockSize);
*outlen = outl;
if (s != SECSuccess) {
PRErrorCode perr = PORT_GetError();
if (perr) {
block->f->result->rc = perr;
block->f->result->msg = PR_ErrorToName(perr);
}
rv = APR_ECRYPT;
}
crypto_block_cleanup(block);
return rv;
}
void
SECU_PrintError(const char *progName, const char *msg, ...)
{
va_list args;
PRErrorCode err = PORT_GetError();
const char *errName = PR_ErrorToName(err);
const char *errString = PR_ErrorToString(err, 0);
va_start(args, msg);
fprintf(stderr, "%s: ", progName);
vfprintf(stderr, msg, args);
if (errName != NULL) {
fprintf(stderr, ": %s", errName);
} else {
fprintf(stderr, ": error %d", (int)err);
}
if (errString != NULL && PORT_Strlen(errString) > 0)
fprintf(stderr, ": %s\n", errString);
va_end(args);
}
/**
* @brief Decrypt data provided by in, write it to out.
* @note The number of bytes written will be written to outlen. If
* out is NULL, outlen will contain the maximum size of the
* buffer needed to hold the data, including any data
* generated by apr_crypto_block_decrypt_finish below. If *out points
* to NULL, a buffer sufficiently large will be created from
* the pool provided. If *out points to a not-NULL value, this
* value will be used as a buffer instead.
* @param out Address of a buffer to which data will be written,
* see note.
* @param outlen Length of the output will be written here.
* @param in Address of the buffer to read.
* @param inlen Length of the buffer to read.
* @param ctx The block context to use.
* @return APR_ECRYPT if an error occurred. Returns APR_ENOTIMPL if
* not implemented.
*/
static apr_status_t crypto_block_decrypt(unsigned char **out,
apr_size_t *outlen, const unsigned char *in, apr_size_t inlen,
apr_crypto_block_t *block)
{
unsigned char *buffer;
int outl = (int) *outlen;
SECStatus s;
if (!out) {
*outlen = inlen + block->blockSize;
return APR_SUCCESS;
}
if (!*out) {
buffer = apr_palloc(block->pool, inlen + block->blockSize);
if (!buffer) {
return APR_ENOMEM;
}
apr_crypto_clear(block->pool, buffer, inlen + block->blockSize);
*out = buffer;
}
s = PK11_CipherOp(block->ctx, *out, &outl, inlen, (unsigned char*) in,
inlen);
if (s != SECSuccess) {
PRErrorCode perr = PORT_GetError();
if (perr) {
block->f->result->rc = perr;
block->f->result->msg = PR_ErrorToName(perr);
}
return APR_ECRYPT;
}
*outlen = outl;
return APR_SUCCESS;
}
am_status_t
BaseService::doRequest(const ServiceInfo& service,
const BodyChunk& headerPrefix,
const std::string& uriParameters,
const Http::CookieList& cookieList,
const BodyChunk& headerSuffix,
const BodyChunkList& bodyChunkList,
Http::Response& response,
std::size_t initialBufferLen,
const std::string &cert_nick_name,
const ServerInfo** serverInfo) const
{
am_status_t status = AM_SERVICE_NOT_AVAILABLE;
std::size_t dataLen = 0;
// Create a temporary buffer for the Content-Line header
// the extra '2' is for the <CR><LF> at the end. The
// sizeof the CONTENT_LENGTH_HDR includes space for the
// terminating NUL.
char contentLine[sizeof(CONTENT_LENGTH_HDR) +
(sizeof(dataLen) * DIGITS_PER_BYTE) + 2];
std::size_t contentLineLen;
for (unsigned int i = 0; i < bodyChunkList.size(); ++i) {
dataLen += bodyChunkList[i].data.size();
}
contentLineLen = snprintf(contentLine, sizeof(contentLine), "%s%d\r\n",
CONTENT_LENGTH_HDR, dataLen);
if (sizeof(contentLine) > contentLineLen) {
BodyChunk contentLineChunk(contentLine, contentLineLen);
ServiceInfo::const_iterator iter;
for (iter = service.begin(); iter != service.end(); ++iter) {
ServerInfo svrInfo = ServerInfo((const ServerInfo&)(*iter));
if (!svrInfo.isHealthy(poll_primary_server)) {
Log::log(logModule, Log::LOG_WARNING,
"BaseService::doRequest(): "
"Server is unavailable: %s.",
svrInfo.getURL().c_str());
continue;
} else {
Log::log(logModule, Log::LOG_DEBUG,
"BaseService::doRequest(): Using server: %s.",
iter->getURL().c_str());
}
Http::HeaderList headerList, proxyHeaderList;
Http::Cookie hostHeader("Host", svrInfo.getHost());
headerList.push_back(hostHeader);
if (useProxy) {
proxyHeaderList.push_back(hostHeader);
// Override (temporarily) server credentials if using proxy
svrInfo.setHost(proxyHost);
svrInfo.setPort(proxyPort);
// We don't use SSL for initial proxy connection
svrInfo.setUseSSL(false);
Log::log(logModule, Log::LOG_DEBUG,
"BaseService::doRequest(): Using proxy: %s:%d",
proxyHost.c_str(),proxyPort);
// Add Proxy-Authorization header if user defined
if (useProxyAuth) {
// allocate enough for a base64-encoded digest
int authSize = proxyUser.size() +
proxyPassword.size() + 1;
// 11 extra bytes for prefix and terminator
char * digest = (char *)malloc(authSize * 4/3 + 11);
strcpy(digest, "Basic ");
encode_base64((proxyUser + ":" + proxyPassword).c_str(),
authSize,(digest + 6));
Log::log(logModule, Log::LOG_MAX_DEBUG,
"BaseService::doRequest(): Using proxy auth as: %s",
proxyUser.c_str());
hostHeader = Http::Cookie("Proxy-Authorization", digest);
proxyHeaderList.push_back(hostHeader);
free(digest);
}
}
// retry to connect to server before marking it as down.
// making the number of attempts configurable may have a negative
// side effect on performance, if the the value is a high number.
int retryAttempts = 3;
int retryCount = 0;
while(retryCount < retryAttempts) {
retryCount++;
try {
Connection conn(svrInfo, certDBPasswd,
(cert_nick_name.size()>0)?cert_nick_name:certNickName,
alwaysTrustServerCert);
const char *operation = "sending to";
// in case proxy is defined and target URL is HTTPS,
// establish an SSL tunnel first send
// CONNECT host:port string
if (useProxy && iter->useSSL()) {
SECStatus secStatus = SECFailure;
// All the other parameters would be empty for a
// proxy CONNECT
Http::CookieList emptyCookieList;
BodyChunk emptyChunk;
BodyChunkList emptyChunkList;
// Add a Keep-alive header since we're using HTTP/1.0
hostHeader = Http::Cookie("Connection",
"Keep-Alive\r\n");
proxyHeaderList.push_back(hostHeader);
status = sendRequest(conn,
BodyChunk(std::string("CONNECT ")),
iter->getHost() + ":" +
Utils::toString(iter->getPort()),
std::string(""), proxyHeaderList,
emptyCookieList, emptyChunk,
emptyChunk, emptyChunkList);
if (status == AM_SUCCESS) {
// Retrieve proxie's response if tunnel
// established
(void) response.readAndIgnore(logModule, conn);
// Secure the tunnel now by upgrading the socket
PRFileDesc *sock = conn.secureSocket(
certDBPasswd,
(cert_nick_name.size()>0)?
cert_nick_name:certNickName,
alwaysTrustServerCert, NULL);
if (sock != static_cast<PRFileDesc *>(NULL)) {
secStatus = SSL_SetURL(sock,
iter->getHost().c_str());
}
}
if (status != AM_SUCCESS || SECSuccess != secStatus){
Log::log(logModule, Log::LOG_ERROR,
"BaseService::doRequest(): could not "
"establish a secure proxy tunnel");
// Can't continue and mark server as down as
// it was a proxy failure
return AM_FAILURE;
}
}
if(Log::isLevelEnabled(logModule, Log::LOG_MAX_DEBUG)) {
std::string commString;
for(std::size_t i = 0; i<bodyChunkList.size(); ++i) {
if(!bodyChunkList[i].secure) {
commString.append(bodyChunkList[i].data);
} else {
commString.append("<secure data>");
}
}
for(std::size_t commPos = commString.find("%");
commPos != std::string::npos &&
commPos < commString.size();
commPos = commString.find("%", commPos)) {
commString.replace(commPos, 1, "%%");
commPos += 2;
}
Log::log(logModule, Log::LOG_MAX_DEBUG,
commString.c_str());
}
std::string requestString = iter->getURI();
/*
* In case the following request would go to a proxy
* we need to use full URL and special headers.
* If the resource is HTTPS, we're not posting our
* request to the proxy, but to the server
* through proxy tunnel
*/
if (useProxy && !(iter->useSSL())) {
requestString = iter->getURL();
headerList = proxyHeaderList;
}
status = sendRequest(conn, headerPrefix, requestString,
uriParameters, headerList, cookieList,
contentLineChunk, headerSuffix,
bodyChunkList);
if (AM_SUCCESS == status) {
operation = "receiving from";
status = response.readAndParse(logModule, conn,
initialBufferLen);
if (AM_SUCCESS == status) {
Log::log(logModule, Log::LOG_MAX_DEBUG, "%.*s",
response.getBodyLen(), response.getBodyPtr());
}
}
if (AM_NSPR_ERROR == status) {
PRErrorCode nspr_code = PR_GetError();
Log::log(logModule, Log::LOG_ALWAYS,
"BaseService::doRequest() NSPR failure while "
"%s %s, error = %s", operation,
(*iter).toString().c_str(),
PR_ErrorToName(nspr_code));
}
if (AM_SUCCESS == status) {
if(serverInfo != NULL) *serverInfo = &(*iter);
break;
} else {
if(retryCount < retryAttempts) {
continue;
} else {
Log::log(logModule, Log::LOG_DEBUG,
"BaseService::doRequest() Invoking markSeverDown");
svrInfo.markServerDown(poll_primary_server);
}
}
} catch (const NSPRException& exc) {
Log::log(logModule, Log::LOG_DEBUG,
"BaseService::doRequest() caught %s: %s called by %s "
"returned %s", exc.what(), exc.getNsprMethod(),
exc.getThrowingMethod(),
PR_ErrorToName(exc.getErrorCode()));
if(retryCount < retryAttempts) {
status = AM_NSPR_ERROR;
continue;
} else {
Log::log(logModule, Log::LOG_DEBUG,
"BaseService::doRequest() Invoking markSeverDown");
svrInfo.markServerDown(poll_primary_server);
status = AM_NSPR_ERROR;
}
}
} //end of while
if (AM_SUCCESS == status) {
if(serverInfo != NULL) *serverInfo = &(*iter);
break;
}
if (status = AM_NSPR_ERROR) {
continue;
}
} // end of for
} else {
status = AM_BUFFER_TOO_SMALL;
}
return status;
}
const char *
nsNSSErrors::getDefaultErrorStringName(PRErrorCode err)
{
return PR_ErrorToName(err);
}
ConnThread(void *arg)
{
PRInt32 num;
nsresult rv = NS_OK;
ipcConnectionState *s = (ipcConnectionState *) arg;
// we monitor two file descriptors in this thread. the first (at index 0) is
// the socket connection with the IPC daemon. the second (at index 1) is the
// pollable event we monitor in order to know when to send messages to the
// IPC daemon.
s->fds[SOCK].in_flags = PR_POLL_READ;
s->fds[POLL].in_flags = PR_POLL_READ;
while (NS_SUCCEEDED(rv))
{
s->fds[SOCK].out_flags = 0;
s->fds[POLL].out_flags = 0;
//
// poll on the IPC socket and NSPR pollable event
//
num = PR_Poll(s->fds, 2, PR_INTERVAL_NO_TIMEOUT);
if (num > 0)
{
ipcCallbackQ cbs_to_run;
// check if something has been added to the send queue. if so, then
// acknowledge pollable event (wait should not block), and configure
// poll flags to find out when we can write.
if (s->fds[POLL].out_flags & PR_POLL_READ)
{
PR_WaitForPollableEvent(s->fds[POLL].fd);
PR_Lock(s->lock);
if (!s->send_queue.IsEmpty())
s->fds[SOCK].in_flags |= PR_POLL_WRITE;
if (!s->callback_queue.IsEmpty())
s->callback_queue.MoveTo(cbs_to_run);
PR_Unlock(s->lock);
}
// check if we can read...
if (s->fds[SOCK].out_flags & PR_POLL_READ)
rv = ConnRead(s);
// check if we can write...
if (s->fds[SOCK].out_flags & PR_POLL_WRITE)
rv = ConnWrite(s);
// check if we have callbacks to run
while (!cbs_to_run.IsEmpty())
{
ipcCallback *cb = cbs_to_run.First();
(cb->func)(cb->arg);
cbs_to_run.DeleteFirst();
}
// check if we should exit this thread. delay processing a shutdown
// request until after all queued up messages have been sent and until
// after all queued up callbacks have been run.
PR_Lock(s->lock);
if (s->shutdown && s->send_queue.IsEmpty() && s->callback_queue.IsEmpty())
rv = NS_ERROR_ABORT;
PR_Unlock(s->lock);
}
else
{
LOG(("PR_Poll returned error %d (%s), os error %d\n", PR_GetError(),
PR_ErrorToName(PR_GetError()), PR_GetOSError()));
rv = NS_ERROR_UNEXPECTED;
}
}
// notify termination of the IPC connection
if (rv == NS_ERROR_ABORT)
rv = NS_OK;
IPC_OnConnectionEnd(rv);
LOG(("IPC thread exiting\n"));
}
/**
* @brief Initialise a context for encrypting arbitrary data using the given key.
* @note If *ctx is NULL, a apr_crypto_block_t will be created from a pool. If
* *ctx is not NULL, *ctx must point at a previously created structure.
* @param ctx The block context returned, see note.
* @param iv Optional initialisation vector. If the buffer pointed to is NULL,
* an IV will be created at random, in space allocated from the pool.
* If the buffer pointed to is not NULL, the IV in the buffer will be
* used.
* @param key The key structure.
* @param blockSize The block size of the cipher.
* @param p The pool to use.
* @return Returns APR_ENOIV if an initialisation vector is required but not specified.
* Returns APR_EINIT if the backend failed to initialise the context. Returns
* APR_ENOTIMPL if not implemented.
*/
static apr_status_t crypto_block_encrypt_init(apr_crypto_block_t **ctx,
const unsigned char **iv, const apr_crypto_key_t *key,
apr_size_t *blockSize, apr_pool_t *p)
{
PRErrorCode perr;
SECItem * secParam;
SECItem ivItem;
unsigned char * usedIv;
apr_crypto_block_t *block = *ctx;
if (!block) {
*ctx = block = apr_pcalloc(p, sizeof(apr_crypto_block_t));
}
if (!block) {
return APR_ENOMEM;
}
block->f = key->f;
block->pool = p;
block->provider = key->provider;
apr_pool_cleanup_register(p, block, crypto_block_cleanup_helper,
apr_pool_cleanup_null);
if (key->ivSize) {
if (iv == NULL) {
return APR_ENOIV;
}
if (*iv == NULL) {
SECStatus s;
usedIv = apr_pcalloc(p, key->ivSize);
if (!usedIv) {
return APR_ENOMEM;
}
apr_crypto_clear(p, usedIv, key->ivSize);
s = PK11_GenerateRandom(usedIv, key->ivSize);
if (s != SECSuccess) {
return APR_ENOIV;
}
*iv = usedIv;
}
else {
usedIv = (unsigned char *) *iv;
}
ivItem.data = usedIv;
ivItem.len = key->ivSize;
secParam = PK11_ParamFromIV(key->cipherMech, &ivItem);
}
else {
secParam = PK11_GenerateNewParam(key->cipherMech, key->symKey);
}
block->blockSize = PK11_GetBlockSize(key->cipherMech, secParam);
block->ctx = PK11_CreateContextBySymKey(key->cipherMech, CKA_ENCRYPT,
key->symKey, secParam);
/* did an error occur? */
perr = PORT_GetError();
if (perr || !block->ctx) {
key->f->result->rc = perr;
key->f->result->msg = PR_ErrorToName(perr);
return APR_EINIT;
}
if (blockSize) {
*blockSize = PK11_GetBlockSize(key->cipherMech, secParam);
}
return APR_SUCCESS;
}
/**
* @brief Create a key from the given passphrase. By default, the PBKDF2
* algorithm is used to generate the key from the passphrase. It is expected
* that the same pass phrase will generate the same key, regardless of the
* backend crypto platform used. The key is cleaned up when the context
* is cleaned, and may be reused with multiple encryption or decryption
* operations.
* @note If *key is NULL, a apr_crypto_key_t will be created from a pool. If
* *key is not NULL, *key must point at a previously created structure.
* @param key The key returned, see note.
* @param ivSize The size of the initialisation vector will be returned, based
* on whether an IV is relevant for this type of crypto.
* @param pass The passphrase to use.
* @param passLen The passphrase length in bytes
* @param salt The salt to use.
* @param saltLen The salt length in bytes
* @param type 3DES_192, AES_128, AES_192, AES_256.
* @param mode Electronic Code Book / Cipher Block Chaining.
* @param doPad Pad if necessary.
* @param iterations Iteration count
* @param f The context to use.
* @param p The pool to use.
* @return Returns APR_ENOKEY if the pass phrase is missing or empty, or if a backend
* error occurred while generating the key. APR_ENOCIPHER if the type or mode
* is not supported by the particular backend. APR_EKEYTYPE if the key type is
* not known. APR_EPADDING if padding was requested but is not supported.
* APR_ENOTIMPL if not implemented.
*/
static apr_status_t crypto_passphrase(apr_crypto_key_t **k, apr_size_t *ivSize,
const char *pass, apr_size_t passLen, const unsigned char * salt,
apr_size_t saltLen, const apr_crypto_block_key_type_e type,
const apr_crypto_block_key_mode_e mode, const int doPad,
const int iterations, const apr_crypto_t *f, apr_pool_t *p)
{
apr_status_t rv = APR_SUCCESS;
PK11SlotInfo * slot;
SECItem passItem;
SECItem saltItem;
SECAlgorithmID *algid;
void *wincx = NULL; /* what is wincx? */
apr_crypto_key_t *key = *k;
if (!key) {
*k = key = apr_array_push(f->keys);
}
if (!key) {
return APR_ENOMEM;
}
key->f = f;
key->provider = f->provider;
/* decide on what cipher mechanism we will be using */
switch (type) {
case (APR_KEY_3DES_192):
if (APR_MODE_CBC == mode) {
key->cipherOid = SEC_OID_DES_EDE3_CBC;
}
else if (APR_MODE_ECB == mode) {
return APR_ENOCIPHER;
/* No OID for CKM_DES3_ECB; */
}
break;
case (APR_KEY_AES_128):
if (APR_MODE_CBC == mode) {
key->cipherOid = SEC_OID_AES_128_CBC;
}
else {
key->cipherOid = SEC_OID_AES_128_ECB;
}
break;
case (APR_KEY_AES_192):
if (APR_MODE_CBC == mode) {
key->cipherOid = SEC_OID_AES_192_CBC;
}
else {
key->cipherOid = SEC_OID_AES_192_ECB;
}
break;
case (APR_KEY_AES_256):
if (APR_MODE_CBC == mode) {
key->cipherOid = SEC_OID_AES_256_CBC;
}
else {
key->cipherOid = SEC_OID_AES_256_ECB;
}
break;
default:
/* unknown key type, give up */
return APR_EKEYTYPE;
}
/* AES_128_CBC --> CKM_AES_CBC --> CKM_AES_CBC_PAD */
key->cipherMech = PK11_AlgtagToMechanism(key->cipherOid);
if (key->cipherMech == CKM_INVALID_MECHANISM) {
return APR_ENOCIPHER;
}
if (doPad) {
CK_MECHANISM_TYPE paddedMech;
paddedMech = PK11_GetPadMechanism(key->cipherMech);
if (CKM_INVALID_MECHANISM == paddedMech || key->cipherMech
== paddedMech) {
return APR_EPADDING;
}
key->cipherMech = paddedMech;
}
/* Turn the raw passphrase and salt into SECItems */
passItem.data = (unsigned char*) pass;
passItem.len = passLen;
saltItem.data = (unsigned char*) salt;
saltItem.len = saltLen;
/* generate the key */
/* pbeAlg and cipherAlg are the same. NSS decides the keylength. */
algid = PK11_CreatePBEV2AlgorithmID(key->cipherOid, key->cipherOid,
SEC_OID_HMAC_SHA1, 0, iterations, &saltItem);
if (algid) {
slot = PK11_GetBestSlot(key->cipherMech, wincx);
if (slot) {
key->symKey = PK11_PBEKeyGen(slot, algid, &passItem, PR_FALSE,
wincx);
PK11_FreeSlot(slot);
}
SECOID_DestroyAlgorithmID(algid, PR_TRUE);
}
/* sanity check? */
if (!key->symKey) {
PRErrorCode perr = PORT_GetError();
if (perr) {
f->result->rc = perr;
f->result->msg = PR_ErrorToName(perr);
rv = APR_ENOKEY;
}
}
key->ivSize = PK11_GetIVLength(key->cipherMech);
if (ivSize) {
*ivSize = key->ivSize;
}
return rv;
}