diff options
| author | cvs2hg <devnull@localhost> | 2001-11-30 04:50:17 +0000 |
|---|---|---|
| committer | cvs2hg <devnull@localhost> | 2001-11-30 04:50:17 +0000 |
| commit | 48699854b5a3f8ab60d743a665515c6dc378e13b (patch) | |
| tree | 6b877f1c1aff9095a50ff5785fc7066d6935901d | |
| parent | 5600b4ae074e6c191f333501af04f02a9df070a9 (diff) | |
| download | nss-hg-CW7_20011204_TAG.tar.gz | |
fixup commit for branch 'CW7_20011205_BRANCH'CW7_20011205_TAGCW7_20011204_TAG
38 files changed, 818 insertions, 250 deletions
diff --git a/security/coreconf/rules.mk b/security/coreconf/rules.mk index 49e637e39..7126d8fc4 100644 --- a/security/coreconf/rules.mk +++ b/security/coreconf/rules.mk @@ -833,8 +833,10 @@ $(SOURCE_RELEASE_XP_DIR)/include:: $(NSINSTALL) -D $@; \ fi -release_export:: $(EXPORTS) $(SOURCE_RELEASE_XP_DIR)/include - $(INSTALL) -m 444 $(EXPORTS) $(SOURCE_RELEASE_XP_DIR)/include +release_export:: $(SOURCE_RELEASE_XP_DIR)/include + +release_export:: $(EXPORTS) + $(INSTALL) -m 444 $^ $(SOURCE_RELEASE_XP_DIR)/include endif diff --git a/security/nss/cmd/certutil/certutil.c b/security/nss/cmd/certutil/certutil.c index 286da745e..13c0deea4 100644 --- a/security/nss/cmd/certutil/certutil.c +++ b/security/nss/cmd/certutil/certutil.c @@ -78,7 +78,7 @@ extern SECKEYPrivateKey *CERTUTIL_GeneratePrivateKey(KeyType keytype, char *noise, SECKEYPublicKey **pubkeyp, char *pqgFile, - char *passFile); + secuPWData *pwdata); static char *progName; @@ -511,6 +511,7 @@ printCertCB(CERTCertificate *cert, void *arg) { SECStatus rv; SECItem data; + CERTCertTrust *trust = (CERTCertTrust *)arg; data.data = cert->derCert.data; data.len = cert->derCert.len; @@ -521,8 +522,13 @@ printCertCB(CERTCertificate *cert, void *arg) SECU_PrintError(progName, "problem printing certificate"); return(SECFailure); } - SECU_PrintTrustFlags(stdout, &cert->dbEntry->trust, - "Certificate Trust Flags", 1); + if (trust) { + SECU_PrintTrustFlags(stdout, trust, + "Certificate Trust Flags", 1); + } else { + SECU_PrintTrustFlags(stdout, &cert->dbEntry->trust, + "Certificate Trust Flags", 1); + } printf("\n"); @@ -581,7 +587,17 @@ listCerts(CERTCertDBHandle *handle, char *name, PK11SlotInfo *slot, /* List certs on a non-internal slot. */ if (PK11_NeedLogin(slot)) PK11_Authenticate(slot, PR_TRUE, pwarg); - rv = PK11_TraverseCertsInSlot(slot, SECU_PrintCertNickname, stdout); + if (name) { + CERTCertificate *the_cert; + the_cert = PK11_FindCertFromNickname(name, NULL); + if (!the_cert) { + SECU_PrintError(progName, "Could not find: %s\n", name); + return SECFailure; + } + rv = printCertCB(the_cert, the_cert->trust); + } else { + rv = PK11_TraverseCertsInSlot(slot, SECU_PrintCertNickname, stdout); + } if (rv) { SECU_PrintError(progName, "problem printing certificate nicknames"); return SECFailure; @@ -593,27 +609,21 @@ listCerts(CERTCertDBHandle *handle, char *name, PK11SlotInfo *slot, static SECStatus ListCerts(CERTCertDBHandle *handle, char *name, PK11SlotInfo *slot, - PRBool raw, PRBool ascii, PRFileDesc *outfile, char *passFile) + PRBool raw, PRBool ascii, PRFileDesc *outfile, secuPWData *pwdata) { SECStatus rv; - secuPWData pwdata = { PW_NONE, 0 }; - - if (passFile) { - pwdata.source = PW_FROMFILE; - pwdata.data = passFile; - } if (slot == NULL) { PK11SlotList *list; PK11SlotListElement *le; list= PK11_GetAllTokens(CKM_INVALID_MECHANISM, - PR_FALSE,PR_FALSE,&pwdata); + PR_FALSE,PR_FALSE,pwdata); if (list) for (le = list->head; le; le = le->next) { - rv = listCerts(handle,name,le->slot,raw,ascii,outfile,&pwdata); + rv = listCerts(handle,name,le->slot,raw,ascii,outfile,pwdata); } } else { - rv = listCerts(handle,name,slot,raw,ascii,outfile,&pwdata); + rv = listCerts(handle,name,slot,raw,ascii,outfile,pwdata); } return rv; } @@ -643,7 +653,7 @@ DeleteCert(CERTCertDBHandle *handle, char *name) static SECStatus ValidateCert(CERTCertDBHandle *handle, char *name, char *date, - char *certUsage, PRBool checkSig, PRBool logit) + char *certUsage, PRBool checkSig, PRBool logit, secuPWData *pwdata) { SECStatus rv; CERTCertificate *cert; @@ -701,7 +711,7 @@ ValidateCert(CERTCertDBHandle *handle, char *name, char *date, } rv = CERT_VerifyCert(handle, cert, checkSig, usage, - timeBoundary, NULL, log); + timeBoundary, pwdata, log); if ( log ) { if ( log->head == NULL ) { fprintf(stdout, "%s: certificate is valid\n", progName); @@ -832,11 +842,10 @@ SECStatus secu_PrintKeyFromCert(CERTCertificate *cert, void *data) { FILE *out; - char *name; - SECKEYPublicKey *key; + SECKEYPrivateKey *key; out = (FILE *)data; - key = CERT_ExtractPublicKey(cert); + key = PK11_FindPrivateKeyFromCert(PK11_GetInternalKeySlot(), cert, NULL); if (!key) { fprintf(out, "XXX could not extract key for %s.\n", cert->nickname); return SECFailure; @@ -882,15 +891,9 @@ listKeys(PK11SlotInfo *slot, KeyType keyType, void *pwarg) static SECStatus ListKeys(PK11SlotInfo *slot, char *keyname, int index, - KeyType keyType, PRBool dopriv, char *passFile) + KeyType keyType, PRBool dopriv, secuPWData *pwdata) { SECStatus rv = SECSuccess; - secuPWData pwdata = { PW_NONE, 0 }; - - if (passFile) { - pwdata.source = PW_FROMFILE; - pwdata.data = passFile; - } #ifdef notdef if (keyname) { @@ -909,29 +912,34 @@ ListKeys(PK11SlotInfo *slot, char *keyname, int index, PK11SlotList *list; PK11SlotListElement *le; - list= PK11_GetAllTokens(CKM_INVALID_MECHANISM,PR_FALSE,PR_FALSE,&pwdata); + list= PK11_GetAllTokens(CKM_INVALID_MECHANISM,PR_FALSE,PR_FALSE,pwdata); if (list) for (le = list->head; le; le = le->next) { - rv = listKeys(le->slot,keyType,&pwdata); + rv = listKeys(le->slot,keyType,pwdata); } } else { - rv = listKeys(slot,keyType,&pwdata); + rv = listKeys(slot,keyType,pwdata); } return rv; } -#ifdef notdef static SECStatus -DeleteKey(SECKEYKeyDBHandle *handle, char *nickname) +DeleteKey(char *nickname, secuPWData *pwdata) { SECStatus rv; - - rv = SECU_DeleteKeyByName(handle, nickname); + CERTCertificate *cert; + PK11SlotInfo *slot; + + slot = PK11_GetInternalKeySlot(); + if (PK11_NeedLogin(slot)) + PK11_Authenticate(slot, PR_TRUE, pwdata); + cert = PK11_FindCertFromNickname(nickname, pwdata); + if (!cert) return SECFailure; + rv = PK11_DeleteTokenCertAndKey(cert, pwdata); if (rv != SECSuccess) { SECU_PrintError("problem deleting private key \"%s\"\n", nickname); } return rv; } -#endif /* @@ -1001,7 +1009,7 @@ Usage(char *progName) "\t\t [-p phone] [-1] [-2] [-3] [-4] [-5] [-6]\n", progName); FPS "\t%s -U [-d certdir] [-P dbprefix]\n", progName); - exit(-1); + exit(1); } static void LongUsage(char *progName) @@ -1160,7 +1168,6 @@ static void LongUsage(char *progName) FPS "%-20s Cert & Key database prefix\n", " -P dbprefix"); FPS "\n"); - FPS "%-15s Reset the Key database or token\n", "-T"); FPS "%-20s Cert database directory (default is ~/.netscape)\n", @@ -1260,7 +1267,7 @@ static void LongUsage(char *progName) " -6 "); FPS "\n"); - exit(-1); + exit(1); #undef FPS } @@ -2214,7 +2221,7 @@ main(int argc, char **argv) PR_fprintf(PR_STDERR, "%s -g: Keysize must be between %d and %d.\n", MIN_KEY_BITS, MAX_KEY_BITS); - return -1; + return 255; } } @@ -2237,7 +2244,7 @@ main(int argc, char **argv) } else { PR_fprintf(PR_STDERR, "%s -k: %s is not a recognized type.\n", progName, certutil.options[opt_KeyType].arg); - return -1; + return 255; } } @@ -2247,7 +2254,7 @@ main(int argc, char **argv) if (serialNumber < 0) { PR_fprintf(PR_STDERR, "%s -m: %s is not a valid serial number.\n", progName, certutil.options[opt_SerialNumber].arg); - return -1; + return 255; } } @@ -2260,7 +2267,7 @@ main(int argc, char **argv) if (keytype != dsaKey) { PR_fprintf(PR_STDERR, "%s -q: PQG file is for DSA key (-k dsa).\n)", progName); - return -1; + return 255; } } @@ -2270,7 +2277,7 @@ main(int argc, char **argv) if (!subject) { PR_fprintf(PR_STDERR, "%s -s: improperly formatted name: \"%s\"\n", progName, certutil.options[opt_Subject].arg); - return -1; + return 255; } } @@ -2280,7 +2287,7 @@ main(int argc, char **argv) if (validitylength < 0) { PR_fprintf(PR_STDERR, "%s -v: incorrect validity period: \"%s\"\n", progName, certutil.options[opt_Validity].arg); - return -1; + return 255; } } @@ -2297,7 +2304,7 @@ main(int argc, char **argv) PR_fprintf(PR_STDERR, "%s -y: incorrect public exponent %d.", progName, publicExponent); PR_fprintf(PR_STDERR, "Must be 3, 17, or 65537.\n"); - return -1; + return 255; } } @@ -2319,7 +2326,7 @@ main(int argc, char **argv) PR_fprintf(PR_STDERR, " -%c", certutil.commands[i].flag); } PR_fprintf(PR_STDERR, "\n"); - return -1; + return 255; } if (commandsEntered == 0) { PR_fprintf(PR_STDERR, "%s: you must enter a command!\n", progName); @@ -2337,7 +2344,7 @@ main(int argc, char **argv) PR_fprintf(PR_STDERR, "%s -%c: nickname is required for this command (-n).\n", progName, commandToRun); - return -1; + return 255; } /* -A, -E, -M, -S require trust */ @@ -2349,7 +2356,7 @@ main(int argc, char **argv) PR_fprintf(PR_STDERR, "%s -%c: trust is required for this command (-t).\n", progName, commandToRun); - return -1; + return 255; } /* if -L is given raw or ascii mode, it must be for only one cert. */ @@ -2360,7 +2367,7 @@ main(int argc, char **argv) PR_fprintf(PR_STDERR, "%s: nickname is required to dump cert in raw or ascii mode.\n", progName); - return -1; + return 255; } /* -L can only be in (raw || ascii). */ @@ -2370,7 +2377,7 @@ main(int argc, char **argv) PR_fprintf(PR_STDERR, "%s: cannot specify both -r and -a when dumping cert.\n", progName); - return -1; + return 255; } /* For now, deny -C -x combination */ @@ -2379,7 +2386,7 @@ main(int argc, char **argv) PR_fprintf(PR_STDERR, "%s: self-signing a cert request is not supported.\n", progName); - return -1; + return 255; } /* If making a cert request, need a subject. */ @@ -2389,7 +2396,7 @@ main(int argc, char **argv) PR_fprintf(PR_STDERR, "%s -%c: subject is required to create a cert request.\n", progName, commandToRun); - return -1; + return 255; } /* If making a cert, need a serial number. */ @@ -2407,7 +2414,7 @@ main(int argc, char **argv) PR_fprintf(PR_STDERR, "%s -V: specify a usage to validate the cert for (-u).\n", progName); - return -1; + return 255; } /* To make a cert, need either a issuer or to self-sign it. */ @@ -2417,7 +2424,7 @@ main(int argc, char **argv) PR_fprintf(PR_STDERR, "%s -S: must specify issuer (-c) or self-sign (-x).\n", progName); - return -1; + return 255; } /* Using slotname == NULL for listing keys and certs on all slots, @@ -2427,7 +2434,7 @@ main(int argc, char **argv) PR_fprintf(PR_STDERR, "%s -%c: cannot use \"-h all\" for this command.\n", progName, commandToRun); - return -1; + return 255; } /* Using keytype == nullKey for list all key types, but only that. */ @@ -2435,7 +2442,7 @@ main(int argc, char **argv) PR_fprintf(PR_STDERR, "%s -%c: cannot use \"-k all\" for this command.\n", progName, commandToRun); - return -1; + return 255; } /* -S open outFile, temporary file for cert request. */ @@ -2446,7 +2453,7 @@ main(int argc, char **argv) "%s -o: unable to open \"%s\" for writing (%ld, %ld)\n", progName, certreqfile, PR_GetError(), PR_GetOSError()); - return -1; + return 255; } } @@ -2458,7 +2465,7 @@ main(int argc, char **argv) "%s: unable to open \"%s\" for reading (%ld, %ld).\n", progName, certutil.options[opt_InputFile].arg, PR_GetError(), PR_GetOSError()); - return -1; + return 255; } } @@ -2471,7 +2478,7 @@ main(int argc, char **argv) "%s: unable to open \"%s\" for writing (%ld, %ld).\n", progName, certutil.options[opt_OutputFile].arg, PR_GetError(), PR_GetOSError()); - return -1; + return 255; } } @@ -2485,7 +2492,7 @@ main(int argc, char **argv) "secmod.db", 0); if (rv != SECSuccess) { SECU_PrintPRandOSError(progName); - return -1; + return 255; } certHandle = CERT_GetDefaultCertDB(); @@ -2511,44 +2518,41 @@ main(int argc, char **argv) rv = ListCerts(certHandle, name, slot, certutil.options[opt_BinaryDER].activated, certutil.options[opt_ASCIIForIO].activated, - (outFile) ? outFile : PR_STDOUT, - certutil.options[opt_PasswordFile].arg); - return !rv - 1; + (outFile) ? outFile : PR_STDOUT, &pwdata); + return rv ? 255 : 0; } /* XXX needs work */ /* List keys (-K) */ if (certutil.commands[cmd_ListKeys].activated) { rv = ListKeys(slot, name, 0 /*keyindex*/, keytype, PR_FALSE /*dopriv*/, - certutil.options[opt_PasswordFile].arg); - return !rv - 1; + &pwdata); + return rv ? 255 : 0; } /* List modules (-U) */ if (certutil.commands[cmd_ListModules].activated) { rv = ListModules(); - return !rv - 1; + return rv ? 255 : 0; } /* Delete cert (-D) */ if (certutil.commands[cmd_DeleteCert].activated) { rv = DeleteCert(certHandle, name); - return !rv - 1; + return rv ? 255 : 0; } -#ifdef notdef /* Delete key (-F) */ if (certutil.commands[cmd_DeleteKey].activated) { - rv = DeleteKey(keyHandle, name); - return !rv - 1; + rv = DeleteKey(name, &pwdata); + return rv ? 255 : 0; } -#endif /* Modify trust attribute for cert (-M) */ if (certutil.commands[cmd_ModifyCertTrust].activated) { rv = ChangeTrustAttributes(certHandle, name, certutil.options[opt_Trust].arg); - return !rv - 1; + return rv ? 255 : 0; } /* Change key db password (-W) (future - change pw to slot?) */ if (certutil.commands[cmd_ChangePassword].activated) { rv = SECU_ChangePW(slot, 0, certutil.options[opt_PasswordFile].arg); - return !rv - 1; + return rv ? 255 : 0; } /* Reset the a token */ if (certutil.commands[cmd_TokenReset].activated) { @@ -2559,16 +2563,23 @@ main(int argc, char **argv) } rv = PK11_ResetToken(slot,sso_pass); - return !rv - 1; + return !rv - 1; } + /* Check cert validity against current time (-V) */ if (certutil.commands[cmd_CheckCertValidity].activated) { + /* XXX temporary hack for fips - must log in to get priv key */ + if (certutil.options[opt_VerifySig].activated) { + if (PK11_NeedLogin(slot)) + PK11_Authenticate(slot, PR_TRUE, &pwdata); + } rv = ValidateCert(certHandle, name, certutil.options[opt_ValidityTime].arg, certutil.options[opt_Usage].arg, certutil.options[opt_VerifySig].activated, - certutil.options[opt_DetailedInfo].activated); - return !rv - 1; + certutil.options[opt_DetailedInfo].activated, + &pwdata); + return rv ? 255 : 0; } /* @@ -2586,11 +2597,12 @@ main(int argc, char **argv) certutil.options[opt_NoiseFile].arg, &pubkey, certutil.options[opt_PQGFile].arg, - certutil.options[opt_PasswordFile].arg); + &pwdata); if (privkey == NULL) { SECU_PrintError(progName, "unable to generate key(s)\n"); - return -1; + return 255; } + privkey->wincx = &pwdata; PORT_Assert(pubkey != NULL); /* If all that was needed was keygen, exit. */ @@ -2611,7 +2623,8 @@ main(int argc, char **argv) certutil.options[opt_ASCIIForIO].activated, outFile ? outFile : PR_STDOUT); if (rv) - return -1; + return 255; + privkey->wincx = &pwdata; } /* @@ -2627,13 +2640,13 @@ main(int argc, char **argv) if (!inFile) { PR_fprintf(PR_STDERR, "Failed to open file \"%s\" (%ld, %ld).\n", certreqfile, PR_GetError(), PR_GetOSError()); - return -1; + return 255; } outFile = PR_Open(certfile, PR_RDWR | PR_CREATE_FILE, 00660); if (!outFile) { PR_fprintf(PR_STDERR, "Failed to open file \"%s\" (%ld, %ld).\n", certfile, PR_GetError(), PR_GetOSError()); - return -1; + return 255; } } @@ -2653,7 +2666,7 @@ main(int argc, char **argv) certutil.options[opt_AddCRLDistPtsExt].activated, certutil.options[opt_AddNSCertTypeExt].activated); if (rv) - return -1; + return 255; } /* @@ -2667,7 +2680,7 @@ main(int argc, char **argv) if (!inFile) { PR_fprintf(PR_STDERR, "Failed to open file \"%s\" (%ld, %ld).\n", certfile, PR_GetError(), PR_GetOSError()); - return -1; + return 255; } } @@ -2680,7 +2693,7 @@ main(int argc, char **argv) certutil.options[opt_ASCIIForIO].activated, certutil.commands[cmd_AddEmailCert].activated); if (rv) - return -1; + return 255; } if (certutil.commands[cmd_CreateAndAddCert].activated) { diff --git a/security/nss/cmd/certutil/keystuff.c b/security/nss/cmd/certutil/keystuff.c index e23d10020..29bc2f865 100644 --- a/security/nss/cmd/certutil/keystuff.c +++ b/security/nss/cmd/certutil/keystuff.c @@ -306,14 +306,14 @@ SECKEYPrivateKey * CERTUTIL_GeneratePrivateKey(KeyType keytype, PK11SlotInfo *slot, int size, int publicExponent, char *noise, SECKEYPublicKey **pubkeyp, char *pqgFile, - char *passFile) + secuPWData *pwdata) { CK_MECHANISM_TYPE mechanism; SECOidTag algtag; PK11RSAGenParams rsaparams; PQGParams *dsaparams = NULL; void *params; - secuPWData pwdata = { PW_NONE, 0 }; + PRArenaPool *dsaparena; /* * Do some random-number initialization. @@ -344,9 +344,20 @@ CERTUTIL_GeneratePrivateKey(KeyType keytype, PK11SlotInfo *slot, int size, if (pqgFile) { dsaparams = getpqgfromfile(size, pqgFile); } else { - dsaparams = &default_pqg_params; + dsaparena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); + if (dsaparena == NULL) return NULL; + dsaparams = PORT_ArenaZAlloc(dsaparena, sizeof(PQGParams)); + if (dsaparams == NULL) return NULL; + dsaparams->arena = dsaparena; + SECITEM_AllocItem(dsaparena, &dsaparams->prime, sizeof P); + SECITEM_AllocItem(dsaparena, &dsaparams->subPrime, sizeof Q); + SECITEM_AllocItem(dsaparena, &dsaparams->base, sizeof G); + PORT_Memcpy(dsaparams->prime.data, P, dsaparams->prime.len); + PORT_Memcpy(dsaparams->subPrime.data, Q, dsaparams->subPrime.len); + PORT_Memcpy(dsaparams->base.data, G, dsaparams->base.len); } params = dsaparams; + break; default: return NULL; } @@ -354,12 +365,7 @@ CERTUTIL_GeneratePrivateKey(KeyType keytype, PK11SlotInfo *slot, int size, if (slot == NULL) return NULL; - if (passFile) { - pwdata.source = PW_FROMFILE; - pwdata.data = passFile; - } - - if (PK11_Authenticate(slot, PR_TRUE, &pwdata) != SECSuccess) + if (PK11_Authenticate(slot, PR_TRUE, pwdata) != SECSuccess) return NULL; fprintf(stderr, "\n\n"); @@ -367,7 +373,7 @@ CERTUTIL_GeneratePrivateKey(KeyType keytype, PK11SlotInfo *slot, int size, return PK11_GenerateKeyPair(slot, mechanism, params, pubkeyp, PR_TRUE /*isPerm*/, PR_TRUE /*isSensitive*/, - NULL /*wincx*/); + pwdata /*wincx*/); } /* diff --git a/security/nss/cmd/crlutil/crlutil.c b/security/nss/cmd/crlutil/crlutil.c index b2633c40d..648d396b6 100644 --- a/security/nss/cmd/crlutil/crlutil.c +++ b/security/nss/cmd/crlutil/crlutil.c @@ -263,7 +263,6 @@ int main(int argc, char **argv) int deleteCRL; int rv; char *nickName; - char *progName; char *url; int crlType; PLOptState *optstate; diff --git a/security/nss/cmd/lib/secutil.c b/security/nss/cmd/lib/secutil.c index 78a914210..93020e725 100644 --- a/security/nss/cmd/lib/secutil.c +++ b/security/nss/cmd/lib/secutil.c @@ -214,10 +214,11 @@ char * SECU_GetModulePassword(PK11SlotInfo *slot, PRBool retry, void *arg) { char prompt[255]; - secuPWData *pwdata = arg; + secuPWData *pwdata = (secuPWData *)arg; secuPWData pwnull = { PW_NONE, 0 }; + char *pw; - if (arg == NULL) + if (pwdata == NULL) pwdata = &pwnull; if (retry && pwdata->source != PW_NONE) { @@ -225,20 +226,27 @@ SECU_GetModulePassword(PK11SlotInfo *slot, PRBool retry, void *arg) return NULL; } - sprintf(prompt, "Enter Password or Pin for \"%s\":", - PK11_GetTokenName(slot)); - switch (pwdata->source) { case PW_NONE: + sprintf(prompt, "Enter Password or Pin for \"%s\":", + PK11_GetTokenName(slot)); return SECU_GetPasswordString(NULL, prompt); case PW_FROMFILE: - return SECU_FilePasswd(slot, retry, pwdata->data); + /* Instead of opening and closing the file every time, get the pw + * once, then keep it in memory (duh). + */ + pw = SECU_FilePasswd(slot, retry, pwdata->data); + pwdata->source = PW_PLAINTEXT; + pwdata->data = PL_strdup(pw); + /* it's already been dup'ed */ + return pw; case PW_PLAINTEXT: - return PL_strdup(arg); + return PL_strdup(pwdata->data); default: break; } + PR_fprintf(PR_STDERR, "Password check failed: No password found.\n"); return NULL; } diff --git a/security/nss/cmd/pk12util/pk12util.c b/security/nss/cmd/pk12util/pk12util.c index 4d9ca833c..86c9b0616 100644 --- a/security/nss/cmd/pk12util/pk12util.c +++ b/security/nss/cmd/pk12util/pk12util.c @@ -546,7 +546,7 @@ P12U_ImportPKCS12Object(char *in_file, PK11SlotInfo *slot, } /* init the decoder context */ - p12dcx = SEC_PKCS12DecoderStart(&uniPwitem, slot, NULL, + p12dcx = SEC_PKCS12DecoderStart(&uniPwitem, slot, slotPw, p12u_DigestOpen, p12u_DigestClose, p12u_DigestRead, p12u_DigestWrite, tmpcxt); @@ -695,7 +695,7 @@ p12u_WriteToExportFile(void *arg, const char *buf, unsigned long len) } void -P12U_ExportPKCS12Object(char *nn, char *outfile, +P12U_ExportPKCS12Object(char *nn, char *outfile, PK11SlotInfo *inSlot, secuPWData *slotPw, secuPWData *p12FilePw) { SEC_PKCS12ExportContext *p12ecx = NULL; @@ -705,7 +705,13 @@ P12U_ExportPKCS12Object(char *nn, char *outfile, p12uContext *p12cxt = NULL; CERTCertificate *cert; - cert = PK11_FindCertFromNickname(nn, NULL); + if (P12U_InitSlot(inSlot, slotPw) != SECSuccess) { + SECU_PrintError(progName,"Failed to authenticate to \"%s\"", + PK11_GetSlotName(inSlot)); + pk12uErrno = PK12UERR_PK11GETSLOT; + goto loser; + } + cert = PK11_FindCertFromNickname(nn, slotPw); if(!cert) { SECU_PrintError(progName,"find cert by nickname failed"); pk12uErrno = PK12UERR_FINDCERTBYNN; @@ -717,12 +723,6 @@ P12U_ExportPKCS12Object(char *nn, char *outfile, pk12uErrno = PK12UERR_FINDCERTBYNN; goto loser; } - if (P12U_InitSlot(cert->slot, slotPw) != SECSuccess) { - SECU_PrintError(progName,"Failed to authenticate to \"%s\"", - PK11_GetSlotName(cert->slot)); - pk12uErrno = PK12UERR_PK11GETSLOT; - goto loser; - } /* Password to use for PKCS12 file. */ pwitem = P12U_GetP12FilePassword(PR_TRUE, p12FilePw); @@ -730,7 +730,7 @@ P12U_ExportPKCS12Object(char *nn, char *outfile, goto loser; } - p12ecx = SEC_PKCS12CreateExportContext(NULL, NULL, cert->slot, NULL); + p12ecx = SEC_PKCS12CreateExportContext(NULL, NULL, cert->slot, slotPw); if(!p12ecx) { SECU_PrintError(progName,"export context creation failed"); pk12uErrno = PK12UERR_EXPORTCXCREATE; @@ -952,26 +952,25 @@ main(int argc, char **argv) } P12U_Init(SECU_ConfigDirectory(NULL),dbprefix); - if (pk12util.options[opt_Import].activated) { + if (!slotname || PL_strcmp(slotname, "internal") == 0) + slot = PK11_GetInternalKeySlot(); + else + slot = PK11_FindSlotByName(slotname); - if (!slotname || PL_strcmp(slotname, "internal") == 0) - slot = PK11_GetInternalKeySlot(); - else - slot = PK11_FindSlotByName(slotname); + if (!slot) { + SECU_PrintError(progName,"Invalid slot \"%s\"", slotname); + goto done; + } - if (!slot) { - SECU_PrintError(progName,"Invalid slot \"%s\"", slotname); - goto done; - } + if (pk12util.options[opt_Import].activated) { if ((ret = P12U_ImportPKCS12Object(import_file, slot, &slotPw, &p12FilePw)) != 0) goto done; } else if (pk12util.options[opt_Export].activated) { - P12U_ExportPKCS12Object(pk12util.options[opt_Nickname].arg, - export_file, &slotPw, &p12FilePw); + export_file, slot, &slotPw, &p12FilePw); } else { Usage(progName); pk12uErrno = PK12UERR_USAGE; diff --git a/security/nss/cmd/sdrtest/sdrtest.c b/security/nss/cmd/sdrtest/sdrtest.c index 6c352d7ed..3124ef6cf 100644 --- a/security/nss/cmd/sdrtest/sdrtest.c +++ b/security/nss/cmd/sdrtest/sdrtest.c @@ -160,8 +160,15 @@ main (int argc, char **argv) */ PK11_SetPasswordFunc(SECU_GetModulePassword); - rv = NSS_Init(SECU_ConfigDirectory(NULL)); - if (rv != SECSuccess) goto prdone; + if (output_file) { + rv = NSS_InitReadWrite(SECU_ConfigDirectory(NULL)); + } else { + rv = NSS_Init(SECU_ConfigDirectory(NULL)); + } + if (rv != SECSuccess) { + retval = -1; + goto prdone; + } /* Convert value into an item */ data.data = (unsigned char *)value; @@ -215,6 +222,19 @@ file_loser: else { SECItem keyid = { 0, 0, 0 }; + PK11SlotInfo *slot = NULL; + + /* sigh, initialize the key database */ + slot = PK11_GetInternalKeySlot(); + if (slot && PK11_NeedUserInit(slot)) { + rv = SECU_ChangePW(slot, "", 0); + if (rv != SECSuccess) { + SECU_PrintError(program_name, "Failed to initialize slot \"%s\"", + PK11_GetSlotName(slot)); + return SECFailure; + } + PK11_FreeSlot(slot); + } rv = PK11SDR_Encrypt(&keyid, &data, &result, 0); if (rv != SECSuccess) { diff --git a/security/nss/cmd/signtool/util.c b/security/nss/cmd/signtool/util.c index 6f9ecf77b..8f8717864 100644 --- a/security/nss/cmd/signtool/util.c +++ b/security/nss/cmd/signtool/util.c @@ -352,8 +352,12 @@ foreach(char *dirname, char *prefix, if (!dir) return -1; for (entry = PR_ReadDir (dir,0); entry; entry = PR_ReadDir (dir,0)) { - if (*entry->name == '.' || *entry->name == '#') - continue; + if ( strcmp(entry->name, ".")==0 || + strcmp(entry->name, "..")==0 ) + { + /* no infinite recursion, please */ + continue; + } /* can't sign self */ if (!strcmp (entry->name, "META-INF")) diff --git a/security/nss/cmd/smimetools/smime b/security/nss/cmd/smimetools/smime index dba62c27a..8331188b8 100755 --- a/security/nss/cmd/smimetools/smime +++ b/security/nss/cmd/smimetools/smime @@ -258,6 +258,8 @@ sub usage { print STDERR " -p passwd use \"passwd\" as security module password\n"; print STDERR " -E rec1[,rec2...] generate encrypted message for recipients\n"; print STDERR " -D decode a S/MIME message\n"; + print STDERR " -p passwd use \"passwd\" as security module password\n"; + print STDERR " (required for decrypting only)\n"; print STDERR " -C pathname set pathname of \"cmsutil\"\n"; print STDERR " -d directory set directory containing certificate db\n"; print STDERR " (default: ~/.netscape)\n"; diff --git a/security/nss/lib/certdb/genname.c b/security/nss/lib/certdb/genname.c index 998946f65..9fe969e3a 100644 --- a/security/nss/lib/certdb/genname.c +++ b/security/nss/lib/certdb/genname.c @@ -1137,6 +1137,7 @@ cert_CompareNameWithConstraints(CERTGeneralName *name, nameString = (char*)PORT_ZAlloc(name->name.other.len + 1); nameString = PORT_Strncpy(nameString, (char *) name->name.other.data, name->name.other.len); + start = 0; while(PORT_Strncmp(nameString + start, "://", 3) != 0 && nameString[start + 3] != '\0') { start++; diff --git a/security/nss/lib/cryptohi/seckey.c b/security/nss/lib/cryptohi/seckey.c index 11eb94876..38473cf71 100644 --- a/security/nss/lib/cryptohi/seckey.c +++ b/security/nss/lib/cryptohi/seckey.c @@ -1700,14 +1700,14 @@ SECKEY_ImportDERPublicKey(SECItem *derKey, CK_KEY_TYPE type) SECKEYPublicKey *pubk = NULL; SECStatus rv = SECFailure; - pubk = PORT_New(SECKEYPublicKey); + pubk = PORT_ZNew(SECKEYPublicKey); if(pubk == NULL) { goto finish; } pubk->arena = NULL; pubk->pkcs11Slot = NULL; pubk->pkcs11ID = CK_INVALID_HANDLE; - pubk->keyType = type; + pubk->keyType = (type == CKK_RSA) ? rsaKey : dsaKey; if( type == CKK_RSA) { rv = SEC_ASN1DecodeItem(NULL, pubk, SECKEY_RSAPublicKeyTemplate, diff --git a/security/nss/lib/freebl/blapi.h b/security/nss/lib/freebl/blapi.h index 2bd4c3274..4449dc66f 100644 --- a/security/nss/lib/freebl/blapi.h +++ b/security/nss/lib/freebl/blapi.h @@ -77,6 +77,19 @@ extern SECStatus RSA_PrivateKeyOp(RSAPrivateKey * key, unsigned char * output, const unsigned char * input); +/* +** Perform a raw private-key operation, and check the parameters used in +** the operation for validity by performing a test operation first. +** Length of input and output buffers are equal to key's modulus len. +*/ +extern SECStatus RSA_PrivateKeyOpDoubleChecked(RSAPrivateKey * key, + unsigned char * output, + const unsigned char * input); + +/* +** Perform a check of private key parameters for consistency. +*/ +extern SECStatus RSA_PrivateKeyCheck(RSAPrivateKey *key); /******************************************************************** @@ -712,7 +725,7 @@ extern SECStatus RNG_RNGInit(void); ** Update the global random number generator with more seeding ** material */ -extern SECStatus RNG_RandomUpdate(void *data, size_t bytes); +extern SECStatus RNG_RandomUpdate(const void *data, size_t bytes); /* ** Generate some random bytes, using the global random number generator diff --git a/security/nss/lib/freebl/blapi_bsf.c b/security/nss/lib/freebl/blapi_bsf.c index 28e6fc705..37caf4b20 100644 --- a/security/nss/lib/freebl/blapi_bsf.c +++ b/security/nss/lib/freebl/blapi_bsf.c @@ -1508,6 +1508,26 @@ loser: return SECFailure; } +/* + * this should check the operation!!!! + */ +SECStatus +RSA_PrivateKeyOpDoubleChecked(RSAPrivateKey *key, + unsigned char *output, + const unsigned char *input) +{ + return RSA_PrivateKeyOp(key, output, input); +} + +/* + * this should check the key!!! + */ +SECStatus +RSA_PrivateKeyCheck(RSAPrivateKey *key) +{ + return SECSuccess; +} + /***************************************************************************** ** BLAPI implementation of DSA ******************************************************************************/ @@ -2044,7 +2064,7 @@ RNG_RNGInit(void) } SECStatus -RNG_RandomUpdate(void *data, size_t bytes) +RNG_RandomUpdate(const void *data, size_t bytes) { int status; if (data == NULL || bytes <= 0) { diff --git a/security/nss/lib/freebl/ldvector.c b/security/nss/lib/freebl/ldvector.c index 249985f61..0345b8dd5 100644 --- a/security/nss/lib/freebl/ldvector.c +++ b/security/nss/lib/freebl/ldvector.c @@ -112,7 +112,9 @@ static const struct FREEBLVectorStr vector = { RNG_RNGShutdown, PQG_ParamGen, PQG_ParamGenSeedLen, - PQG_VerifyParams + PQG_VerifyParams, + RSA_PrivateKeyOpDoubleChecked, + RSA_PrivateKeyCheck, }; diff --git a/security/nss/lib/freebl/loader.c b/security/nss/lib/freebl/loader.c index 333d4748f..564b14ee7 100644 --- a/security/nss/lib/freebl/loader.c +++ b/security/nss/lib/freebl/loader.c @@ -322,6 +322,24 @@ RSA_PrivateKeyOp(RSAPrivateKey * key, return (vector->p_RSA_PrivateKeyOp)(key, output, input); } +SECStatus +RSA_PrivateKeyOpDoubleChecked(RSAPrivateKey *key, + unsigned char *output, + const unsigned char *input) +{ + if (!vector && PR_SUCCESS != freebl_RunLoaderOnce()) + return SECFailure; + return (vector->p_RSA_PrivateKeyOpDoubleChecked)(key, output, input); +} + +SECStatus +RSA_PrivateKeyCheck(RSAPrivateKey *key) +{ + if (!vector && PR_SUCCESS != freebl_RunLoaderOnce()) + return SECFailure; + return (vector->p_RSA_PrivateKeyCheck)(key); +} + SECStatus DSA_NewKey(const PQGParams * params, DSAPrivateKey ** privKey) { @@ -866,7 +884,7 @@ RNG_RNGInit(void) } SECStatus -RNG_RandomUpdate(void *data, size_t bytes) +RNG_RandomUpdate(const void *data, size_t bytes) { if (!vector && PR_SUCCESS != freebl_RunLoaderOnce()) return SECFailure; diff --git a/security/nss/lib/freebl/loader.h b/security/nss/lib/freebl/loader.h index 0d62b5708..b4ce4c0ec 100644 --- a/security/nss/lib/freebl/loader.h +++ b/security/nss/lib/freebl/loader.h @@ -40,7 +40,7 @@ #include "blapi.h" -#define FREEBL_VERSION 0x0301 +#define FREEBL_VERSION 0x0302 struct FREEBLVectorStr { @@ -235,7 +235,7 @@ struct FREEBLVectorStr { SECStatus (* p_RNG_RNGInit)(void); - SECStatus (* p_RNG_RandomUpdate)(void *data, size_t bytes); + SECStatus (* p_RNG_RandomUpdate)(const void *data, size_t bytes); SECStatus (* p_RNG_GenerateGlobalRandomBytes)(void *dest, size_t len); @@ -249,6 +249,13 @@ struct FREEBLVectorStr { SECStatus (* p_PQG_VerifyParams)(const PQGParams *params, const PQGVerify *vfy, SECStatus *result); + + SECStatus (* p_RSA_PrivateKeyOpDoubleChecked)(RSAPrivateKey *key, + unsigned char *output, + const unsigned char *input); + + SECStatus (* p_RSA_PrivateKeyCheck)(RSAPrivateKey *key); + }; typedef struct FREEBLVectorStr FREEBLVector; diff --git a/security/nss/lib/freebl/mpi/montmulf.c b/security/nss/lib/freebl/mpi/montmulf.c index 0cdacce88..2cf0825f8 100644 --- a/security/nss/lib/freebl/mpi/montmulf.c +++ b/security/nss/lib/freebl/mpi/montmulf.c @@ -196,7 +196,7 @@ int i; if(i32[len]>0) i=-1; else { - for(i=len-1; i>=0; i++) + for(i=len-1; i>=0; i--) { if(i32[i]!=nint[i]) break; } diff --git a/security/nss/lib/freebl/mpi/montmulfv8.s b/security/nss/lib/freebl/mpi/montmulfv8.s index 39568d98b..f6b90dfd8 100644 --- a/security/nss/lib/freebl/mpi/montmulfv8.s +++ b/security/nss/lib/freebl/mpi/montmulfv8.s @@ -836,7 +836,7 @@ TwoToMinus32: ! 191 ! else ! 192 ! { -! 193 ! for(i=len-1; i>=0; i++) +! 193 ! for(i=len-1; i>=0; i--) /* 0x0024 193 */ sub %o2,1,%g4 /* 0x0028 */ sll %g4,2,%g1 @@ -852,9 +852,9 @@ TwoToMinus32: /* 0x0040 193 */ add %o0,%g1,%g3 .L900000510: /* 0x0044 195 */ ld [%g3],%o2 -/* 0x0048 */ add %g4,1,%g1 -/* 0x004c */ add %g2,4,%g2 -/* 0x0050 */ add %g3,4,%g3 +/* 0x0048 */ sub %g4,1,%g1 +/* 0x004c */ sub %g2,4,%g2 +/* 0x0050 */ sub %g3,4,%g3 /* 0x0054 */ cmp %o2,%o5 /* 0x0058 */ bne,pn %icc,.L77000182 /* 0x005c */ nop @@ -1758,9 +1758,9 @@ TwoToMinus32: /* 0x0a14 */ ld [%o1],%g2 .L900000648: /* 0x0a18 */ ld [%o4],%g3 -/* 0x0a1c */ add %o5,1,%o0 -/* 0x0a20 */ add %o1,4,%o1 -/* 0x0a24 */ add %o4,4,%o4 +/* 0x0a1c */ sub %o5,1,%o0 +/* 0x0a20 */ sub %o1,4,%o1 +/* 0x0a24 */ sub %o4,4,%o4 /* 0x0a28 */ cmp %g3,%g2 /* 0x0a2c */ bne,pn %icc,.L77000244 /* 0x0a30 */ nop diff --git a/security/nss/lib/freebl/mpi/montmulfv9.s b/security/nss/lib/freebl/mpi/montmulfv9.s index a1ff27044..3a0a17f7e 100644 --- a/security/nss/lib/freebl/mpi/montmulfv9.s +++ b/security/nss/lib/freebl/mpi/montmulfv9.s @@ -1164,7 +1164,7 @@ TwoToMinus32: ! 191 ! else ! 192 ! { -! 193 ! for(i=len-1; i>=0; i++) +! 193 ! for(i=len-1; i>=0; i--) /* 0x0030 193 */ sub %o1,1,%o2 /* 0x0034 */ cmp %o2,0 @@ -1176,7 +1176,7 @@ TwoToMinus32: ! 195 ! if(i32[i]!=nint[i]) break; /* 0x0040 195 */ sllx %g2,2,%g2 -/* 0x0044 */ add %o2,1,%o0 +/* 0x0044 */ sub %o2,1,%o0 /* 0x0048 */ ld [%i1+%g2],%g3 /* 0x004c */ ld [%i2+%g2],%g2 /* 0x0050 */ cmp %g2,%g3 @@ -2240,7 +2240,7 @@ TwoToMinus32: /* 0x0bcc */ sra %o1,0,%g2 .L900000645: /* 0x0bd0 */ sllx %g2,2,%g2 -/* 0x0bd4 */ add %o1,1,%o0 +/* 0x0bd4 */ sub %o1,1,%o0 /* 0x0bd8 */ ld [%l3+%g2],%g3 /* 0x0bdc */ ld [%l2+%g2],%g2 /* 0x0be0 */ cmp %g2,%g3 diff --git a/security/nss/lib/freebl/prng_fips1861.c b/security/nss/lib/freebl/prng_fips1861.c index c11fdff22..2359913fd 100644 --- a/security/nss/lib/freebl/prng_fips1861.c +++ b/security/nss/lib/freebl/prng_fips1861.c @@ -271,7 +271,8 @@ RNG_RNGInit(void) ** material */ SECStatus -prng_RandomUpdate(RNGContext *rng, void *data, size_t bytes, unsigned char *q) +prng_RandomUpdate(RNGContext *rng, + const void *data, size_t bytes, unsigned char *q) { SECStatus rv = SECSuccess; unsigned char inputhash[BSIZE]; @@ -343,7 +344,7 @@ prng_RandomUpdate(RNGContext *rng, void *data, size_t bytes, unsigned char *q) ** material. Not DSA, so no q. */ SECStatus -RNG_RandomUpdate(void *data, size_t bytes) +RNG_RandomUpdate(const void *data, size_t bytes) { return prng_RandomUpdate(globalrng, data, bytes, NULL); } diff --git a/security/nss/lib/freebl/rsa.c b/security/nss/lib/freebl/rsa.c index e91ed3c22..43d22383c 100644 --- a/security/nss/lib/freebl/rsa.c +++ b/security/nss/lib/freebl/rsa.c @@ -359,8 +359,8 @@ cleanup: ** RSA Private key operation (no CRT). */ static SECStatus -rsa_PrivateKeyOp(RSAPrivateKey *key, mp_int *m, mp_int *c, mp_int *n, - unsigned int modLen) +rsa_PrivateKeyOpNoCRT(RSAPrivateKey *key, mp_int *m, mp_int *c, mp_int *n, + unsigned int modLen) { mp_int d; mp_err err = MP_OKAY; @@ -383,11 +383,10 @@ cleanup: ** RSA Private key operation using CRT. */ static SECStatus -rsa_PrivateKeyOpCRT(RSAPrivateKey *key, mp_int *m, mp_int *c, - unsigned int modLen) +rsa_PrivateKeyOpCRTNoCheck(RSAPrivateKey *key, mp_int *m, mp_int *c) { mp_int p, q, d_p, d_q, qInv; - mp_int m1, m2, b2, h, ctmp; + mp_int m1, m2, h, ctmp; mp_err err = MP_OKAY; SECStatus rv = SECSuccess; MP_DIGITS(&p) = 0; @@ -397,7 +396,6 @@ rsa_PrivateKeyOpCRT(RSAPrivateKey *key, mp_int *m, mp_int *c, MP_DIGITS(&qInv) = 0; MP_DIGITS(&m1) = 0; MP_DIGITS(&m2) = 0; - MP_DIGITS(&b2) = 0; MP_DIGITS(&h) = 0; MP_DIGITS(&ctmp) = 0; CHECK_MPI_OK( mp_init(&p) ); @@ -407,14 +405,13 @@ rsa_PrivateKeyOpCRT(RSAPrivateKey *key, mp_int *m, mp_int *c, CHECK_MPI_OK( mp_init(&qInv) ); CHECK_MPI_OK( mp_init(&m1) ); CHECK_MPI_OK( mp_init(&m2) ); - CHECK_MPI_OK( mp_init(&b2) ); CHECK_MPI_OK( mp_init(&h) ); CHECK_MPI_OK( mp_init(&ctmp) ); /* copy private key parameters into mp integers */ SECITEM_TO_MPINT(key->prime1, &p); /* p */ SECITEM_TO_MPINT(key->prime2, &q); /* q */ SECITEM_TO_MPINT(key->exponent1, &d_p); /* d_p = d mod (p-1) */ - SECITEM_TO_MPINT(key->exponent2, &d_q); /* d_p = d mod (q-1) */ + SECITEM_TO_MPINT(key->exponent2, &d_q); /* d_q = d mod (q-1) */ SECITEM_TO_MPINT(key->coefficient, &qInv); /* qInv = q**-1 mod p */ /* 1. m1 = c**d_p mod p */ CHECK_MPI_OK( mp_mod(c, &p, &ctmp) ); @@ -436,7 +433,6 @@ cleanup: mp_clear(&qInv); mp_clear(&m1); mp_clear(&m2); - mp_clear(&b2); mp_clear(&h); mp_clear(&ctmp); if (err) { @@ -446,6 +442,46 @@ cleanup: return rv; } +/* +** An attack against RSA CRT was described by Boneh, DeMillo, and Lipton in: +** "On the Importance of Eliminating Errors in Cryptographic Computations", +** http://theory.stanford.edu/~dabo/papers/faults.ps.gz +** +** As a defense against the attack, carry out the private key operation, +** followed up with a public key operation to invert the result. +** Verify that result against the input. +*/ +static SECStatus +rsa_PrivateKeyOpCRTCheckedPubKey(RSAPrivateKey *key, mp_int *m, mp_int *c) +{ + mp_int n, e, s; + mp_err err = MP_OKAY; + SECStatus rv = SECSuccess; + MP_DIGITS(&n) = 0; + MP_DIGITS(&e) = 0; + MP_DIGITS(&s) = 0; + CHECK_MPI_OK( mp_init(&n) ); + CHECK_MPI_OK( mp_init(&e) ); + CHECK_MPI_OK( mp_init(&s) ); + CHECK_SEC_OK( rsa_PrivateKeyOpCRTNoCheck(key, m, c) ); + SECITEM_TO_MPINT(key->modulus, &n); + SECITEM_TO_MPINT(key->publicExponent, &e); + /* Perform a public key operation c = m ** e mod n */ + CHECK_MPI_OK( mp_exptmod(m, &e, &n, &s) ); + if (mp_cmp(&s, c) != 0) { + rv = SECFailure; + } +cleanup: + mp_clear(&n); + mp_clear(&e); + mp_clear(&s); + if (err) { + MP_TO_SEC_ERROR(err); + rv = SECFailure; + } + return rv; +} + static PRCallOnceType coBPInit = { 0, 0, 0 }; static PRStatus init_blinding_params_list(void) @@ -619,10 +655,11 @@ cleanup: ** Perform a raw private-key operation ** Length of input and output buffers are equal to key's modulus len. */ -SECStatus -RSA_PrivateKeyOp(RSAPrivateKey *key, +static SECStatus +rsa_PrivateKeyOp(RSAPrivateKey *key, unsigned char *output, - const unsigned char *input) + const unsigned char *input, + PRBool check) { unsigned int modLen; unsigned int offset; @@ -667,9 +704,11 @@ RSA_PrivateKeyOp(RSAPrivateKey *key, key->exponent1.len == 0 || key->exponent2.len == 0 || key->coefficient.len == 0) { - CHECK_SEC_OK( rsa_PrivateKeyOp(key, &m, &c, &n, modLen) ); + CHECK_SEC_OK( rsa_PrivateKeyOpNoCRT(key, &m, &c, &n, modLen) ); + } else if (check) { + CHECK_SEC_OK( rsa_PrivateKeyOpCRTCheckedPubKey(key, &m, &c) ); } else { - CHECK_SEC_OK( rsa_PrivateKeyOpCRT(key, &m, &c, modLen) ); + CHECK_SEC_OK( rsa_PrivateKeyOpCRTNoCheck(key, &m, &c) ); } /* If blinding, compute post-image of plaintext by multiplying by ** blinding factor @@ -692,3 +731,140 @@ cleanup: } return rv; } + +SECStatus +RSA_PrivateKeyOp(RSAPrivateKey *key, + unsigned char *output, + const unsigned char *input) +{ + return rsa_PrivateKeyOp(key, output, input, PR_FALSE); +} + +SECStatus +RSA_PrivateKeyOpDoubleChecked(RSAPrivateKey *key, + unsigned char *output, + const unsigned char *input) +{ + return rsa_PrivateKeyOp(key, output, input, PR_TRUE); +} + +SECStatus +RSA_PrivateKeyCheck(RSAPrivateKey *key) +{ + mp_int p, q, n, psub1, qsub1, e, d, d_p, d_q, qInv, res; + mp_err err = MP_OKAY; + SECStatus rv = SECSuccess; + MP_DIGITS(&n) = 0; + MP_DIGITS(&psub1)= 0; + MP_DIGITS(&qsub1)= 0; + MP_DIGITS(&e) = 0; + MP_DIGITS(&d) = 0; + MP_DIGITS(&d_p) = 0; + MP_DIGITS(&d_q) = 0; + MP_DIGITS(&qInv) = 0; + MP_DIGITS(&res) = 0; + CHECK_MPI_OK( mp_init(&n) ); + CHECK_MPI_OK( mp_init(&p) ); + CHECK_MPI_OK( mp_init(&q) ); + CHECK_MPI_OK( mp_init(&psub1)); + CHECK_MPI_OK( mp_init(&qsub1)); + CHECK_MPI_OK( mp_init(&e) ); + CHECK_MPI_OK( mp_init(&d) ); + CHECK_MPI_OK( mp_init(&d_p) ); + CHECK_MPI_OK( mp_init(&d_q) ); + CHECK_MPI_OK( mp_init(&qInv) ); + CHECK_MPI_OK( mp_init(&res) ); + SECITEM_TO_MPINT(key->modulus, &n); + SECITEM_TO_MPINT(key->prime1, &p); + SECITEM_TO_MPINT(key->prime2, &q); + SECITEM_TO_MPINT(key->publicExponent, &e); + SECITEM_TO_MPINT(key->privateExponent, &d); + SECITEM_TO_MPINT(key->exponent1, &d_p); + SECITEM_TO_MPINT(key->exponent2, &d_q); + SECITEM_TO_MPINT(key->coefficient, &qInv); + /* p > q */ + if (mp_cmp(&p, &q) <= 0) { + /* mind the p's and q's */ + SECItem tmp; + mp_exch(&p, &q); + tmp.data = key->prime1.data; + tmp.len = key->prime1.len; + key->prime1.data = key->prime2.data; + key->prime1.len = key->prime2.len; + key->prime2.data = tmp.data; + key->prime2.len = tmp.len; + } +#define VERIFY_MPI_EQUAL(m1, m2) \ + if (mp_cmp(m1, m2) != 0) { \ + rv = SECFailure; \ + goto cleanup; \ + } +#define VERIFY_MPI_EQUAL_1(m) \ + if (mp_cmp_d(m, 1) != 0) { \ + rv = SECFailure; \ + goto cleanup; \ + } + /* + * The following errors cannot be recovered from. + */ + /* n == p * q */ + CHECK_MPI_OK( mp_mul(&p, &q, &res) ); + VERIFY_MPI_EQUAL(&res, &n); + /* gcd(e, p-1) == 1 */ + CHECK_MPI_OK( mp_sub_d(&p, 1, &psub1) ); + CHECK_MPI_OK( mp_gcd(&e, &psub1, &res) ); + VERIFY_MPI_EQUAL_1(&res); + /* gcd(e, q-1) == 1 */ + CHECK_MPI_OK( mp_sub_d(&q, 1, &qsub1) ); + CHECK_MPI_OK( mp_gcd(&e, &qsub1, &res) ); + VERIFY_MPI_EQUAL_1(&res); + /* d*e == 1 mod p-1 */ + CHECK_MPI_OK( mp_mulmod(&d, &e, &psub1, &res) ); + VERIFY_MPI_EQUAL_1(&res); + /* d*e == 1 mod q-1 */ + CHECK_MPI_OK( mp_mulmod(&d, &e, &qsub1, &res) ); + VERIFY_MPI_EQUAL_1(&res); + /* + * The following errors can be recovered from. + */ + /* d_p == d mod p-1 */ + CHECK_MPI_OK( mp_mod(&d, &psub1, &res) ); + if (mp_cmp(&d_p, &res) != 0) { + /* swap in the correct value */ + SECITEM_ZfreeItem(&key->exponent1, PR_FALSE); + MPINT_TO_SECITEM(&res, &key->exponent1, key->arena); + } + /* d_q == d mod q-1 */ + CHECK_MPI_OK( mp_mod(&d, &qsub1, &res) ); + if (mp_cmp(&d_q, &res) != 0) { + /* swap in the correct value */ + SECITEM_ZfreeItem(&key->exponent2, PR_FALSE); + MPINT_TO_SECITEM(&res, &key->exponent2, key->arena); + } + /* q * q**-1 == 1 mod p */ + CHECK_MPI_OK( mp_mulmod(&q, &qInv, &p, &res) ); + if (mp_cmp_d(&res, 1) != 0) { + /* compute the correct value */ + CHECK_MPI_OK( mp_invmod(&q, &p, &qInv) ); + SECITEM_ZfreeItem(&key->coefficient, PR_FALSE); + MPINT_TO_SECITEM(&res, &key->coefficient, key->arena); + } +cleanup: + mp_clear(&n); + mp_clear(&p); + mp_clear(&q); + mp_clear(&psub1); + mp_clear(&qsub1); + mp_clear(&e); + mp_clear(&d); + mp_clear(&d_p); + mp_clear(&d_q); + mp_clear(&qInv); + mp_clear(&res); + if (err) { + MP_TO_SEC_ERROR(err); + rv = SECFailure; + } + return rv; +} + diff --git a/security/nss/lib/pk11wrap/pk11slot.c b/security/nss/lib/pk11wrap/pk11slot.c index bccb38ac0..f415f53fd 100644 --- a/security/nss/lib/pk11wrap/pk11slot.c +++ b/security/nss/lib/pk11wrap/pk11slot.c @@ -3345,14 +3345,14 @@ pk11_pbe_decode(SECAlgorithmID *algid, SECItem *mech) p5_misc = &p5_param->salt; paramSize = sizeof(CK_PBE_PARAMS); - pbe_params = (CK_PBE_PARAMS *)PORT_ZAlloc(paramSize); + pbe_params = (CK_PBE_PARAMS *)PORT_ZAlloc(paramSize + p5_misc->len); if (pbe_params == NULL) { SEC_PKCS5DestroyPBEParameter(p5_param); return SECFailure; } /* get salt */ - pbe_params->pSalt = (CK_CHAR_PTR)PORT_ZAlloc(p5_misc->len); + pbe_params->pSalt = ((CK_CHAR_PTR)pbe_params) + paramSize; if (pbe_params->pSalt == CK_NULL_PTR) { goto loser; } @@ -3370,9 +3370,6 @@ pk11_pbe_decode(SECAlgorithmID *algid, SECItem *mech) return SECSuccess; loser: - if (pbe_params->pSalt != CK_NULL_PTR) { - PORT_Free(pbe_params->pSalt); - } PORT_Free(pbe_params); SEC_PKCS5DestroyPBEParameter(p5_param); return SECFailure; diff --git a/security/nss/lib/softoken/fipstokn.c b/security/nss/lib/softoken/fipstokn.c index e72a9965a..adf5f1f39 100644 --- a/security/nss/lib/softoken/fipstokn.c +++ b/security/nss/lib/softoken/fipstokn.c @@ -54,9 +54,9 @@ /* The next two strings must be exactly 64 characters long, with the first 32 characters meaningful */ -static char *slotDescription = +static const char *slotDescription = "Netscape Internal FIPS-140-1 Cryptographic Services "; -static char *privSlotDescription = +static const char *privSlotDescription = "Netscape FIPS-140-1 User Private Key Services "; @@ -64,7 +64,7 @@ static char *privSlotDescription = * Configuration utils */ void -PK11_ConfigureFIPS(char *slotdes, char *pslotdes) +PK11_ConfigureFIPS(const char *slotdes, const char *pslotdes) { if (slotdes && (PORT_Strlen(slotdes) == 65)) { slotDescription = slotdes; diff --git a/security/nss/lib/softoken/pkcs11.c b/security/nss/lib/softoken/pkcs11.c index 4930af907..33d4e39a6 100644 --- a/security/nss/lib/softoken/pkcs11.c +++ b/security/nss/lib/softoken/pkcs11.c @@ -416,7 +416,7 @@ static CK_RV pk11_importKeyDB(PK11Slot *slot); static char * -pk11_setStringName(char *inString, char *buffer, int buffer_length) { +pk11_setStringName(const char *inString, char *buffer, int buffer_length) { int full_length, string_length; full_length = buffer_length -1; @@ -424,15 +424,16 @@ pk11_setStringName(char *inString, char *buffer, int buffer_length) { if (string_length > full_length) string_length = full_length; PORT_Memset(buffer,' ',full_length); buffer[full_length] = 0; - PORT_Memcpy(buffer,inString,full_length); + PORT_Memcpy(buffer,inString,string_length); return buffer; } /* * Configuration utils */ void -PK11_ConfigurePKCS11(char *man, char *libdes, char *tokdes, char *ptokdes, - char *slotdes, char *pslotdes, char *fslotdes, char *fpslotdes, +PK11_ConfigurePKCS11(const char *man, const char *libdes, const char *tokdes, + const char *ptokdes, const char *slotdes, const char *pslotdes, + const char *fslotdes, const char *fpslotdes, int minPwd, int pwRequired) { @@ -976,6 +977,8 @@ pk11_handlePrivateKeyObject(PK11Object *object,CK_KEY_TYPE key_type) &ckfalse,sizeof(CK_BBOOL)); if (crv != CKR_OK) return crv; + /* should we check the non-token RSA private keys? */ + if (pk11_isTrue(object,CKA_TOKEN)) { SECKEYLowPrivateKey *privKey; char *label; @@ -984,6 +987,13 @@ pk11_handlePrivateKeyObject(PK11Object *object,CK_KEY_TYPE key_type) privKey=pk11_mkPrivKey(object,key_type); if (privKey == NULL) return CKR_HOST_MEMORY; + + if (key_type == CKK_RSA) { + rv = RSA_PrivateKeyCheck(&privKey->u.rsa); + if (rv == SECFailure) { + goto fail; + } + } label = object->label = pk11_getString(object,CKA_LABEL); crv = pk11_Attribute2SecItem(NULL,&pubKey,object,CKA_NETSCAPE_DB); @@ -1003,6 +1013,7 @@ pk11_handlePrivateKeyObject(PK11Object *object,CK_KEY_TYPE key_type) rv = SECFailure; } +fail: SECKEY_LowDestroyPrivateKey(privKey); if (rv != SECSuccess) return CKR_DEVICE_ERROR; object->inDB = PR_TRUE; diff --git a/security/nss/lib/softoken/pkcs11.h b/security/nss/lib/softoken/pkcs11.h index 9ada2625e..f256d8eba 100644 --- a/security/nss/lib/softoken/pkcs11.h +++ b/security/nss/lib/softoken/pkcs11.h @@ -316,9 +316,10 @@ struct CK_FUNCTION_LIST { /* ** Functions called directly by applications to configure the FIPS token. */ -extern void PK11_ConfigurePKCS11(char *man, char *libdes, char *tokdes, - char *ptokdes, char *slotdes, char *pslotdes, char *fslotdes, - char *fpslotdes, int minPwd, int pwdRequired); -extern void PK11_ConfigureFIPS(char *slotdes, char *pslotdes); +extern void PK11_ConfigurePKCS11(const char *man, const char *libdes, + const char *tokdes, const char *ptokdes, const char *slotdes, + const char *pslotdes, const char *fslotdes, const char *fpslotdes, + int minPwd, int pwdRequired); +extern void PK11_ConfigureFIPS(const char *slotdes, const char *pslotdes); #endif diff --git a/security/nss/lib/softoken/rsawrapr.c b/security/nss/lib/softoken/rsawrapr.c index ca853269d..5b1b8d894 100644 --- a/security/nss/lib/softoken/rsawrapr.c +++ b/security/nss/lib/softoken/rsawrapr.c @@ -632,7 +632,7 @@ RSA_Sign(SECKEYLowPrivateKey *key, if (rv != SECSuccess) goto done; - rv = RSA_PrivateKeyOp(&key->u.rsa, output, formatted.data); + rv = RSA_PrivateKeyOpDoubleChecked(&key->u.rsa, output, formatted.data); *output_len = modulus_len; goto done; @@ -888,7 +888,7 @@ RSA_SignRaw(SECKEYLowPrivateKey *key, if (rv != SECSuccess) goto done; - rv = RSA_PrivateKeyOp(&key->u.rsa, output, formatted.data); + rv = RSA_PrivateKeyOpDoubleChecked(&key->u.rsa, output, formatted.data); *output_len = modulus_len; done: diff --git a/security/nss/lib/ssl/ssl3con.c b/security/nss/lib/ssl/ssl3con.c index 9aca09ac2..858e02d39 100644 --- a/security/nss/lib/ssl/ssl3con.c +++ b/security/nss/lib/ssl/ssl3con.c @@ -93,9 +93,9 @@ static SECStatus Null_Cipher(void *ctx, unsigned char *output, int *outputLen, */ static ssl3CipherSuiteCfg cipherSuites[ssl_V3_SUITES_IMPLEMENTED] = { /* cipher_suite policy enabled is_present*/ - { TLS_DHE_DSS_WITH_RC4_128_SHA, SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE}, - { SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE}, - { SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE}, + { TLS_DHE_DSS_WITH_RC4_128_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, + { SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, + { SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, { SSL_FORTEZZA_DMS_WITH_FORTEZZA_CBC_SHA, SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE}, { SSL_FORTEZZA_DMS_WITH_RC4_128_SHA, SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE}, { SSL_RSA_WITH_RC4_128_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, @@ -103,8 +103,8 @@ static ssl3CipherSuiteCfg cipherSuites[ssl_V3_SUITES_IMPLEMENTED] = { { SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA, SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE}, { SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE}, { SSL_RSA_FIPS_WITH_DES_CBC_SHA, SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE}, - { SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE}, - { SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE}, + { SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, + { SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_NOT_ALLOWED, PR_FALSE,PR_FALSE}, { SSL_RSA_WITH_DES_CBC_SHA, SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE}, { TLS_RSA_EXPORT1024_WITH_RC4_56_SHA, SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE}, { TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA, SSL_NOT_ALLOWED, PR_TRUE, PR_FALSE}, diff --git a/security/nss/lib/util/mac_rand.c b/security/nss/lib/util/mac_rand.c index 6198f3407..8578dfa08 100644 --- a/security/nss/lib/util/mac_rand.c +++ b/security/nss/lib/util/mac_rand.c @@ -79,7 +79,7 @@ size_t RNG_GetNoise(void *buf, size_t maxbytes) return CopyLowBits(buf, maxbytes, µTickCount, sizeof(microTickCount)); } -void RNG_FileForRNG(char *filename) +void RNG_FileForRNG(const char *filename) { unsigned char buffer[BUFSIZ]; size_t bytes; diff --git a/security/nss/lib/util/os2_rand.c b/security/nss/lib/util/os2_rand.c index b1dbba805..7eede8883 100644 --- a/security/nss/lib/util/os2_rand.c +++ b/security/nss/lib/util/os2_rand.c @@ -107,7 +107,7 @@ size_t RNG_GetNoise(void *buf, size_t maxbuf) } static BOOL -EnumSystemFiles(void (*func)(char *)) +EnumSystemFiles(void (*func)(const char *)) { APIRET rc; ULONG sysInfo = 0; @@ -158,13 +158,13 @@ EnumSystemFiles(void (*func)(char *)) static int dwNumFiles, dwReadEvery; static void -CountFiles(char *file) +CountFiles(const char *file) { dwNumFiles++; } static void -ReadFiles(char *file) +ReadFiles(const char *file) { if ((dwNumFiles % dwReadEvery) == 0) RNG_FileForRNG(file); @@ -293,7 +293,7 @@ void RNG_SystemInfoForRNG(void) RNG_RandomUpdate(buffer, nBytes); } -void RNG_FileForRNG(char *filename) +void RNG_FileForRNG(const char *filename) { struct stat stat_buf; unsigned char buffer[1024]; diff --git a/security/nss/lib/util/secrng.h b/security/nss/lib/util/secrng.h index c4c8686ef..cddc7b000 100644 --- a/security/nss/lib/util/secrng.h +++ b/security/nss/lib/util/secrng.h @@ -75,7 +75,7 @@ extern void RNG_SystemInfoForRNG(void); ** Use the contents (and stat) of a file to help seed the ** global random number generator. */ -extern void RNG_FileForRNG(char *filename); +extern void RNG_FileForRNG(const char *filename); SEC_END_PROTOS diff --git a/security/nss/lib/util/unix_rand.c b/security/nss/lib/util/unix_rand.c index 12b08aea3..c2f0faa7b 100644 --- a/security/nss/lib/util/unix_rand.c +++ b/security/nss/lib/util/unix_rand.c @@ -43,6 +43,7 @@ #include <assert.h> #include "secrng.h" +size_t RNG_FileUpdate(const char *fileName, size_t limit); /* * When copying data to the buffer we want the least signicant bytes @@ -154,7 +155,6 @@ GetHighResClock(void *buf, size_t maxbytes) } #else /* SunOS (Sun, but not SVR4) */ -#include <sys/wait.h> extern long sysconf(int name); static size_t @@ -177,7 +177,6 @@ GiveSystemInfo(void) #if defined(__hpux) #include <sys/unistd.h> -#include <sys/wait.h> #define getdtablesize() sysconf(_SC_OPEN_MAX) @@ -207,7 +206,6 @@ GiveSystemInfo(void) #if defined(OSF1) #include <sys/types.h> #include <sys/sysinfo.h> -#include <sys/wait.h> #include <sys/systeminfo.h> #include <c_asm.h> @@ -474,7 +472,6 @@ GiveSystemInfo(void) #endif /* sony */ #if defined(sinix) -#include <unistd.h> #include <sys/systeminfo.h> #include <sys/times.h> @@ -726,10 +723,10 @@ void RNG_SystemInfoForRNG(void) FILE *fp; char buf[BUFSIZ]; size_t bytes; - extern char **environ; - char **cp; + extern char ** environ; + const char * const *cp; char *randfile; - char *files[] = { + static const char * const files[] = { "/etc/passwd", "/etc/utmp", "/tmp", @@ -775,7 +772,7 @@ for the small amount of entropy it provides. * execution environment of the user and on the platform the program * is running on. */ - cp = environ; + cp = (const char * const *)environ; while (*cp) { RNG_RandomUpdate(*cp, strlen(*cp)); cp++; @@ -788,6 +785,9 @@ for the small amount of entropy it provides. } GiveSystemInfo(); + /* grab some data from system's PRNG before any other files. */ + RNG_FileUpdate("/dev/urandom", 1024); + /* If the user points us to a random file, pass it through the rng */ randfile = getenv("NSRANDFILE"); if ( ( randfile != NULL ) && ( randfile[0] != '\0') ) { @@ -859,26 +859,36 @@ void RNG_SystemInfoForRNG(void) } #endif -void RNG_FileForRNG(char *fileName) +#define TOTAL_FILE_LIMIT 1000000 /* one million */ + +size_t RNG_FileUpdate(const char *fileName, size_t limit) { - struct stat stat_buf; + FILE * file; + size_t bytes; + size_t fileBytes = 0; + struct stat stat_buf; unsigned char buffer[BUFSIZ]; - size_t bytes; - FILE *file; static size_t totalFileBytes = 0; if (stat((char *)fileName, &stat_buf) < 0) - return; + return fileBytes; RNG_RandomUpdate(&stat_buf, sizeof(stat_buf)); file = fopen((char *)fileName, "r"); if (file != NULL) { - for (;;) { - bytes = fread(buffer, 1, sizeof(buffer), file); - if (bytes == 0) break; + while (limit > fileBytes) { + bytes = PR_MIN(sizeof buffer, limit - fileBytes); + bytes = fread(buffer, 1, bytes, file); + if (bytes == 0) + break; RNG_RandomUpdate(buffer, bytes); + fileBytes += bytes; totalFileBytes += bytes; - if (totalFileBytes > 1024*1024) break; + /* after TOTAL_FILE_LIMIT has been reached, only read in first + ** buffer of data from each subsequent file. + */ + if (totalFileBytes > TOTAL_FILE_LIMIT) + break; } fclose(file); } @@ -888,4 +898,10 @@ void RNG_FileForRNG(char *fileName) */ bytes = RNG_GetNoise(buffer, sizeof(buffer)); RNG_RandomUpdate(buffer, bytes); + return fileBytes; +} + +void RNG_FileForRNG(const char *fileName) +{ + RNG_FileUpdate(fileName, TOTAL_FILE_LIMIT); } diff --git a/security/nss/lib/util/win_rand.c b/security/nss/lib/util/win_rand.c index de2e06ea7..dc16b19b7 100644 --- a/security/nss/lib/util/win_rand.c +++ b/security/nss/lib/util/win_rand.c @@ -161,7 +161,7 @@ size_t RNG_GetNoise(void *buf, size_t maxbuf) } static BOOL -EnumSystemFiles(void (*func)(char *)) +EnumSystemFiles(void (*func)(const char *)) { int iStatus; char szSysDir[_MAX_PATH]; @@ -212,13 +212,13 @@ EnumSystemFiles(void (*func)(char *)) static DWORD dwNumFiles, dwReadEvery; static void -CountFiles(char *file) +CountFiles(const char *file) { dwNumFiles++; } static void -ReadFiles(char *file) +ReadFiles(const char *file) { if ((dwNumFiles % dwReadEvery) == 0) RNG_FileForRNG(file); @@ -372,7 +372,7 @@ void RNG_SystemInfoForRNG(void) RNG_RandomUpdate(buffer, nBytes); } -void RNG_FileForRNG(char *filename) +void RNG_FileForRNG(const char *filename) { FILE* file; int nBytes; diff --git a/security/nss/tests/all.sh b/security/nss/tests/all.sh index 5848ac1ca..9f6c89292 100755 --- a/security/nss/tests/all.sh +++ b/security/nss/tests/all.sh @@ -52,6 +52,7 @@ # cipher.sh - test NSS ciphers # perf.sh - Nightly performance measurments # tools.sh - Tests the majority of the NSS tools +# fips.sh - Tests basic functionallity of NSS in FIPS-compliant mode # # special strings # --------------- @@ -69,18 +70,15 @@ # file tells the test suite that the output is going to a log, so any # forked() children need to redirect their output to prevent them from # being over written. -# I need to test how this works with the sourced scripts now... # ######################################################################## -#FIXME - all will be sourced by the wrapper wrapper will do cleanup etc - -TESTS="cert ssl sdr cipher smime perf tools" +TESTS="cert ssl sdr cipher smime perf tools fips" SCRIPTNAME=all.sh CLEANUP="${SCRIPTNAME}" -cd `dirname $0` #FIXME - if sourced +cd `dirname $0` # will cause problems if sourced -#all.sh is the one that always needs to source the init - just to be consistant +#all.sh should be the first one to try to source the init if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then cd common . init.sh diff --git a/security/nss/tests/cert/cert.sh b/security/nss/tests/cert/cert.sh index e36f6a798..968bf9eb4 100755 --- a/security/nss/tests/cert/cert.sh +++ b/security/nss/tests/cert/cert.sh @@ -429,6 +429,37 @@ cert_stresscerts() fi } +############################## cert_fips ##################################### +# local shell function to create certificates for FIPS tests +############################################################################## +cert_fips() +{ + CERTFAILED=0 + echo "$SCRIPTNAME: Creating FIPS 140-1 DSA Certificates ==============" + cert_init_cert "${FIPSDIR}" "FIPS PUB 140-1 Test Certificate" 1000 + + CU_ACTION="Initializing ${CERTNAME}'s Cert DB" + certu -N -d "${CERTDIR}" -f "${R_FIPSPWFILE}" 2>&1 + + echo "$SCRIPTNAME: Enable FIPS mode on database -----------------------" + modutil -dbdir ${CERTDIR} -fips true 2>&1 <<MODSCRIPT +y +MODSCRIPT + CU_ACTION="Enable FIPS mode on database for ${CERTNAME}" + if [ "$?" -ne 0 ]; then + html_failed "<TR><TD>${CU_ACTION} ($?) " + cert_log "ERROR: ${CU_ACTION} failed $?" + else + html_passed "<TR><TD>${CU_ACTION}" + fi + + CU_ACTION="Generate Certificate for ${CERTNAME}" + CU_SUBJECT="CN=${CERTNAME}, E=fips@bogus.com, O=BOGUS NSS, OU=FIPS PUB 140-1, L=Mountain View, ST=California, C=US" + certu -S -n ${FIPSCERTNICK} -x -t "Cu,Cu,Cu" -d "${CERTDIR}" -f "${R_FIPSPWFILE}" -k dsa -m ${CERTSERIAL} -z "${R_NOISE_FILE}" 2>&1 + if [ "$RET" -eq 0 ]; then + cert_log "SUCCESS: FIPS passed" + fi +} ############################## cert_cleanup ############################ # local shell function to finish this script (no exit since it might be @@ -455,4 +486,5 @@ if [ -n "$DO_DIST_ST" -a "$DO_DIST_ST" = "TRUE" ] ; then #cp -r $HOSTDIR/../clio.8/* $HOSTDIR fi +cert_fips cert_cleanup diff --git a/security/nss/tests/common/init.sh b/security/nss/tests/common/init.sh index 78db19ffb..aed1795b5 100644 --- a/security/nss/tests/common/init.sh +++ b/security/nss/tests/common/init.sh @@ -42,8 +42,8 @@ # variables, utilities and shellfunctions global to NSS QA # needs to work on all Unix and Windows platforms # -# included from (don't expect this to be up to date) -# -------------------------------------------------- +# included from +# ------------- # all.sh # ssl.sh # sdr.sh @@ -52,6 +52,7 @@ # cert.sh # smime.sh # tools.sh +# fips.sh # # special strings # --------------- @@ -71,6 +72,7 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then +# Exit shellfunction to clean up at exit (error, regular or signal) Exit() { if [ -n "$1" ] ; then @@ -97,6 +99,7 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then esac } +#html functions to give the resultfiles a consistant look html() ######################### write the results.html file { # 3 functions so we can put targets in the output.log easier echo $* >>${RESULTS} @@ -129,7 +132,11 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then fi fi } + HTML_FAILED='</TD><TD bgcolor=red>Failed</TD><TR>' + HTML_PASSED='</TD><TD bgcolor=lightGreen>Passed</TD><TR>' + +#directory name init SCRIPTNAME=init.sh mozilla_root=`(cd ../../../..; pwd)` @@ -149,12 +156,16 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then OS_ARCH=`(cd $COMMON; gmake os_arch)` OS_NAME=`uname -s | sed -e "s/-[0-9]*\.[0-9]*//"` +#in case of backward comp. tests the calling scripts set the +#PATH and LD_LIBRARY_PATH and do not want them to be changed if [ -z "${DON_T_SET_PATHS}" -o "${DON_T_SET_PATHS}" != "TRUE" ] ; then if [ "${OS_ARCH}" = "WINNT" -a "$OS_NAME" != "CYGWIN_NT" ]; then - PATH=${DIST}/${OBJDIR}/bin\;${DIST}/${OBJDIR}/lib\;$PATH + PATH=.\;${DIST}/${OBJDIR}/bin\;${DIST}/${OBJDIR}/lib\;$PATH PATH=`perl ../path_uniq -d ';' "$PATH"` else - PATH=${DIST}/${OBJDIR}/bin:${DIST}/${OBJDIR}/lib:$PATH + PATH=.:/bin:/usr/bin:${DIST}/${OBJDIR}/bin:${DIST}/${OBJDIR}/lib:$PATH + # added /bin and /usr/bin in the beginning so a local perl will + # be used PATH=`perl ../path_uniq -d ':' "$PATH"` fi @@ -168,6 +179,7 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then mkdir -p ${TESTDIR} fi +#HOST and DOMSUF are needed for the server cert case $HOST in *\.*) HOST=`echo $HOST | sed -e "s/\..*//"` @@ -175,8 +187,18 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then ?*) ;; *) - echo "$SCRIPTNAME: Fatal HOST environment variable is not defined." - exit 1 #does not need to be Exit, very early in script + HOST=`uname -n` + case $HOST in + *\.*) + HOST=`echo $HOST | sed -e "s/\..*//"` + ;; + ?*) + ;; + *) + echo "$SCRIPTNAME: Fatal HOST environment variable is not defined." + exit 1 #does not need to be Exit, very early in script + ;; + esac ;; esac @@ -187,14 +209,17 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then exit 1 #does not need to be Exit, very early in script fi fi +#HOSTADDR was a workaround for the dist. stress test, and is probably +#not needed anymore (purpose: be able to use IP address for the server +#cert instead of PC name which was not in the DNS because of dyn IP address if [ -z "$USE_IP" -o "$USE_IP" != "TRUE" ] ; then HOSTADDR=${HOST}.${DOMSUF} else HOSTADDR=${IP_ADDRESS} fi - #if running remote side of the distributed stress test we need to use the files that - #the server side gives us... +#if running remote side of the distributed stress test we need to use +#the files that the server side gives us... if [ -n "$DO_REM_ST" -a "$DO_REM_ST" = "TRUE" ] ; then for w in `ls -rtd ${TESTDIR}/${HOST}.[0-9]* 2>/dev/null | sed -e "s/.*${HOST}.//"` ; do @@ -210,6 +235,7 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then fi fi +#find the HOSTDIR, where the results are supposed to go if [ -n "${HOSTDIR}" ]; then version=`echo $HOSTDIR | sed -e "s/.*${HOST}.//"` else @@ -218,6 +244,8 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then else version=1 fi +#file has a tendency to disappear, messing up the rest of QA - +#workaround to find the next higher number if version file is not there if [ -z "${version}" ]; then # for some strange reason this file # gets truncated at times... Windos for w in `ls -d ${TESTDIR}/${HOST}.[0-9]* 2>/dev/null | @@ -235,6 +263,7 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then mkdir -p ${HOSTDIR} fi +#result and log file and filename init, if [ -z "${LOGFILE}" ]; then LOGFILE=${HOSTDIR}/output.log fi @@ -272,6 +301,8 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then KILL="kill" if [ "${OS_ARCH}" = "Linux" ]; then +#on linux the selfserv needs up to 30 seconds to fully die and free +#the socket SLEEP="sleep 30" fi if [ `uname -s` = "SunOS" ]; then @@ -279,7 +310,9 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then else PS="ps" fi - #found 3 rsh's so far that do not work as expected - cygnus mks6 (restricted sh) and mks 7 +#found 3 rsh's so far that do not work as expected - cygnus mks6 +#(restricted sh) and mks 7 - if it is not in c:/winnt/system32 it +#needs to be set in the environ.ksh if [ -z "$RSH" ]; then if [ "${OS_ARCH}" = "WINNT" -a "$OS_NAME" = "CYGWIN_NT" ]; then RSH=/cygdrive/c/winnt/system32/rsh @@ -291,17 +324,17 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then fi +#more filename and directoryname init CURDIR=`pwd` - HTML_FAILED='</TD><TD bgcolor=red>Failed</TD><TR>' - HTML_PASSED='</TD><TD bgcolor=lightGreen>Passed</TD><TR>' - CU_ACTION='Unknown certutil action' # would like to preserve some tmp files, also easier to see if there # are "leftovers" - another possibility ${HOSTDIR}/tmp TMP=${HOSTDIR} #TMP=${TMP-/tmp} + TEMP=${TMP} + TMPDIR=${TMP} CADIR=${HOSTDIR}/CA SERVERDIR=${HOSTDIR}/server @@ -309,10 +342,16 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then ALICEDIR=${HOSTDIR}/alicedir BOBDIR=${HOSTDIR}/bobdir DAVEDIR=${HOSTDIR}/dave + FIPSDIR=${HOSTDIR}/fips PWFILE=${TMP}/tests.pw.$$ NOISE_FILE=${TMP}/tests_noise.$$ + FIPSPWFILE=${TMP}/tests.fipspw.$$ + FIPSBADPWFILE=${TMP}/tests.fipsbadpw.$$ + FIPSP12PWFILE=${TMP}/tests.fipsp12pw.$$ + FIPSCERTNICK="FIPS_PUB_140-1_Test_Certificate" + # we need relative pathnames of these files abd directories, since our # tools can't handle the unix style absolut pathnames on cygnus @@ -326,6 +365,14 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then R_PWFILE=../tests.pw.$$ R_NOISE_FILE=../tests_noise.$$ + R_FIPSPWFILE=../tests.fipspw.$$ + R_FIPSBADPWFILE=../tests.fipsbadpw.$$ + R_FIPSP12PWFILE=../tests.fipsp12pw.$$ + + echo "fips140" > ${FIPSPWFILE} + echo "fips104" > ${FIPSBADPWFILE} + echo "pkcs12fips140" > ${FIPSP12PWFILE} + # a new log file, short - fast to search, mostly for tools to # see if their portion of the cert has succeeded, also for me - CERT_LOG_FILE=${HOSTDIR}/cert.log #the output.log is so crowded... @@ -339,10 +386,16 @@ if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then export MOZILLA_ROOT SECURITY_ROOT DIST TESTDIR OBJDIR HOSTDIR QADIR export LOGFILE SCRIPTNAME +#used for the distributed stress test, the server generates certificates +#from GLOB_MIN_CERT to GLOB_MAX_CERT +# NOTE - this variable actually gets initialized by directly by the +# ssl_dist_stress.shs sl_ds_init() before init is called - need to change +# in both places. speaking of data encapsulatioN... + if [ -z "$GLOB_MIN_CERT" ] ; then GLOB_MIN_CERT=0 fi - if [ -z "$GLOBMAX_CERT" ] ; then + if [ -z "$GLOB_MAX_CERT" ] ; then GLOB_MAX_CERT=200 fi if [ -z "$MIN_CERT" ] ; then diff --git a/security/nss/tests/fips/fips.sh b/security/nss/tests/fips/fips.sh new file mode 100755 index 000000000..5c857a89b --- /dev/null +++ b/security/nss/tests/fips/fips.sh @@ -0,0 +1,178 @@ +#! /bin/sh +# +# The contents of this file are subject to the Mozilla Public +# License Version 1.1 (the "License"); you may not use this file +# except in compliance with the License. You may obtain a copy of +# the License at http://www.mozilla.org/MPL/ +# +# Software distributed under the License is distributed on an "AS +# IS" basis, WITHOUT WARRANTY OF ANY KIND, either express or +# implied. See the License for the specific language governing +# rights and limitations under the License. +# +# The Original Code is the Netscape security libraries. +# +# The Initial Developer of the Original Code is Netscape +# Communications Corporation. Portions created by Netscape are +# Copyright (C) 1994-2000 Netscape Communications Corporation. All +# Rights Reserved. +# +# Contributor(s): +# +# Alternatively, the contents of this file may be used under the +# terms of the GNU General Public License Version 2 or later (the +# "GPL"), in which case the provisions of the GPL are applicable +# instead of those above. If you wish to allow use of your +# version of this file only under the terms of the GPL and not to +# allow others to use your version of this file under the MPL, +# indicate your decision by deleting the provisions above and +# replace them with the notice and other provisions required by +# the GPL. If you do not delete the provisions above, a recipient +# may use your version of this file under either the MPL or the +# GPL. +# +# +######################################################################## +# +# mozilla/security/nss/tests/fips/fips.sh +# +# Script to test basic functionallity of NSS in FIPS-compliant mode +# +# needs to work on all Unix and Windows platforms +# +# tests implemented: +# +# special strings +# --------------- +# +######################################################################## + +############################## fips_init ############################## +# local shell function to initialize this script +######################################################################## +fips_init() +{ + SCRIPTNAME=fips.sh # sourced - $0 would point to all.sh + + if [ -z "${CLEANUP}" ] ; then # if nobody else is responsible for + CLEANUP="${SCRIPTNAME}" # cleaning this script will do it + fi + + if [ -z "${INIT_SOURCED}" -o "${INIT_SOURCED}" != "TRUE" ]; then + cd ../common + . init.sh + fi + if [ ! -r $CERT_LOG_FILE ]; then # we need certificates here + cd ../cert + . cert.sh + fi + SCRIPTNAME=fips.sh + html_head "FIPS 140-1 Compliance Tests" + + grep "SUCCESS: FIPS passed" $CERT_LOG_FILE >/dev/null || { + Exit 15 "Fatal - FIPS of cert.sh needs to pass first" + } + + COPYDIR=${FIPSDIR}/copydir + + R_FIPSDIR=../fips + R_COPYDIR=../fips/copydir + + mkdir -p ${FIPSDIR} + mkdir -p ${COPYDIR} + + cd ${FIPSDIR} +} + +############################## fips_140_1 ############################## +# local shell function to test basic functionality of NSS while in +# FIPS 140-1 compliant mode +######################################################################## +fips_140_1() +{ + echo "$SCRIPTNAME: List the FIPS module certificates -----------------" + echo "certutil -d ${R_FIPSDIR} -L" + certutil -d ${R_FIPSDIR} -L 2>&1 + html_msg $? 0 "List the FIPS module certificates (certutil -L)" + + echo "$SCRIPTNAME: List the FIPS module keys -------------------------" + echo "certutil -d ${R_FIPSDIR} -K -f ${R_FIPSPWFILE}" + certutil -d ${R_FIPSDIR} -K -f ${R_FIPSPWFILE} 2>&1 + html_msg $? 0 "List the FIPS module keys (certutil -K)" + + echo "$SCRIPTNAME: Attempt to list FIPS module keys with incorrect password" + echo "certutil -d ${R_FIPSDIR} -K -f ${FIPSBADPWFILE}" + certutil -d ${R_FIPSDIR} -K -f ${FIPSBADPWFILE} 2>&1 + RET=$? + html_msg $RET 255 "Attempt to list FIPS module keys with incorrect password (certutil -K)" + echo "certutil -K returned $RET" + + echo "$SCRIPTNAME: Validate the certificate --------------------------" + echo "certutil -d ${R_FIPSDIR} -V -n ${FIPSCERTNICK} -u SR -e -f ${R_FIPSPWFILE}" + certutil -d ${R_FIPSDIR} -V -n ${FIPSCERTNICK} -u SR -e -f ${R_FIPSPWFILE} + html_msg $? 0 "Validate the certificate (certutil -V -e)" + + echo "$SCRIPTNAME: Export the certificate and key as a PKCS#12 file --" + echo "pk12util -d ${R_FIPSDIR} -o fips140.p12 -n ${FIPSCERTNICK} -w ${R_FIPSP12PWFILE} -k ${R_FIPSPWFILE}" + pk12util -d ${R_FIPSDIR} -o fips140.p12 -n ${FIPSCERTNICK} -w ${R_FIPSP12PWFILE} -k ${R_FIPSPWFILE} 2>&1 + html_msg $? 0 "Export the certificate and key as a PKCS#12 file (pk12util -o)" + + echo "$SCRIPTNAME: List the FIPS module certificates -----------------" + echo "certutil -d ${R_FIPSDIR} -L" + certutil -d ${R_FIPSDIR} -L 2>&1 + html_msg $? 0 "List the FIPS module certificates (certutil -L)" + + echo "$SCRIPTNAME: Delete the certificate and key from the FIPS module" + echo "certutil -d ${R_FIPSDIR} -F -n ${FIPSCERTNICK} -f ${R_FIPSPWFILE}" + certutil -d ${R_FIPSDIR} -F -n ${FIPSCERTNICK} -f ${R_FIPSPWFILE} 2>&1 + html_msg $? 0 "Delete the certificate and key from the FIPS module (certutil -D)" + + echo "$SCRIPTNAME: List the FIPS module certificates -----------------" + echo "certutil -d ${R_FIPSDIR} -L" + certutil -d ${R_FIPSDIR} -L 2>&1 + html_msg $? 0 "List the FIPS module certificates (certutil -L)" + + echo "$SCRIPTNAME: List the FIPS module keys." + echo "certutil -d ${R_FIPSDIR} -K -f ${R_FIPSPWFILE}" + certutil -d ${R_FIPSDIR} -K -f ${R_FIPSPWFILE} 2>&1 + html_msg $? 0 "List the FIPS module keys (certutil -K)" + + echo "$SCRIPTNAME: Import the certificate and key from the PKCS#12 file" + echo "pk12util -d ${R_FIPSDIR} -i fips140.p12 -w ${R_FIPSP12PWFILE} -k ${R_FIPSPWFILE}" + pk12util -d ${R_FIPSDIR} -i fips140.p12 -w ${R_FIPSP12PWFILE} -k ${R_FIPSPWFILE} 2>&1 + html_msg $? 0 "Import the certificate and key from the PKCS#12 file (pk12util -i)" + + echo "$SCRIPTNAME: List the FIPS module certificates -----------------" + echo "certutil -d ${R_FIPSDIR} -L" + certutil -d ${R_FIPSDIR} -L 2>&1 + html_msg $? 0 "List the FIPS module certificates (certutil -L)" + + echo "$SCRIPTNAME: List the FIPS module keys --------------------------" + echo "certutil -d ${R_FIPSDIR} -K -f ${R_FIPSPWFILE}" + certutil -d ${R_FIPSDIR} -K -f ${R_FIPSPWFILE} 2>&1 + html_msg $? 0 "List the FIPS module keys (certutil -K)" + + echo "$SCRIPTNAME: Export the certificate as a DER-encoded file ------" + echo "certutil -d ${R_FIPSDIR} -L -n ${FIPSCERTNICK} -r -o fips140.crt" + certutil -d ${R_FIPSDIR} -L -n ${FIPSCERTNICK} -r -o fips140.crt 2>&1 + html_msg $? 0 "Export the certificate as a DER (certutil -L -r)" +} + +############################## fips_cleanup ############################ +# local shell function to finish this script (no exit since it might be +# sourced) +######################################################################## +fips_cleanup() +{ + html "</TABLE><BR>" + cd ${QADIR} + . common/cleanup.sh +} + +################## main ################################################# + +fips_init + +fips_140_1 +fips_cleanup + diff --git a/security/nss/tests/ssl/ssl_dist_stress.sh b/security/nss/tests/ssl/ssl_dist_stress.sh index 9a5cb63af..33cfe8c5d 100755 --- a/security/nss/tests/ssl/ssl_dist_stress.sh +++ b/security/nss/tests/ssl/ssl_dist_stress.sh @@ -64,7 +64,7 @@ ssl_ds_init() if [ -z "$GLOB_MIN_CERT" ] ; then GLOB_MIN_CERT=0 fi - if [ -z "$GLOBMAX_CERT" ] ; then + if [ -z "$GLOB_MAX_CERT" ] ; then GLOB_MAX_CERT=200 fi IP_PARAM="" @@ -243,10 +243,8 @@ ssl_ds_dist_stress() trex-10 compaqtor-10" - #clientlist=" box-200 washer-50 charm-10 jordan-10 louie-10 smarch-10 phaedrus-10 charm-10 hbombaix-20 box-200 washer-50 " - #clientlist=" box-200 washer-50 louie-10 hbombaix-10 charm-10 trex-20 jordan-10 box-200 compaqtor-10 " #clientlist=" box-2 washer-5" #FIXME ADJUST - clientlist=" box-200 charm-10 jordan-10 louie-10 smarch-10 phaedrus-10 charm-10 " + clientlist=" box-200 washer-200" html_head "SSL Distributed Stress Test" @@ -289,9 +287,9 @@ ssl_ds_dist_stress() sleep 300 # give the clients time to finish #FIXME ADJUST echo "GET /stop HTTP/1.0\n\n" > stdin.txt #check to make sure it has /r/n - echo "tstclnt -h clio.red.iplanet.com -p 8443 -d ${CLIENTDIR} -n TestUser0 " + echo "tstclnt -h $HOSTADDR -p 8443 -d ${CLIENTDIR} -n TestUser0 " echo " -w nss -f < stdin.txt" - tstclnt -h clio.red.iplanet.com -p 8443 -d ${CLIENTDIR} -n TestUser0 \ + tstclnt -h $HOSTADDR -p 8443 -d ${CLIENTDIR} -n TestUser0 \ -w nss -f < stdin.txt html_msg 0 0 "${testname}" diff --git a/security/nss/tests/tools/tools.sh b/security/nss/tests/tools/tools.sh index e70c42d92..24b1cd101 100644 --- a/security/nss/tests/tools/tools.sh +++ b/security/nss/tests/tools/tools.sh @@ -142,6 +142,7 @@ US liz liz@moz.org SIGNSCRIPT + html_msg $? 0 "Create objsign cert (signtool -G)" echo "$SCRIPTNAME: Signing a set of files ----------------------------" echo "signtool -Z nojs.jar -d ${R_ALICEDIR} -p \"nss\" -k objsigner \\" @@ -150,9 +151,9 @@ SIGNSCRIPT html_msg $? 0 "Signing a set of files (signtool -Z)" echo "$SCRIPTNAME: Listing signed files in jar ----------------------" - echo "signtool -w nojs.jar -d ${R_ALICEDIR}" - signtool -w nojs.jar -d ${R_ALICEDIR} - html_msg $? 0 "Listing signed files in jar (signtool -w)" + echo "signtool -v nojs.jar -d ${R_ALICEDIR} -p nss -k objsigner" + signtool -v nojs.jar -d ${R_ALICEDIR} -p nss -k objsigner + html_msg $? 0 "Listing signed files in jar (signtool -v)" echo "$SCRIPTNAME: Show who signed jar ------------------------------" echo "signtool -w nojs.jar -d ${R_ALICEDIR}" @@ -175,15 +176,7 @@ tools_cleanup() tools_init -#FIXME - tmp workaround for tests that do not work in 3.2 RTM -#echo $BC_ACTION | grep "forward compatibility" && RUN_TOOLS_P12="FALSE" -echo $BC_ACTION | grep "compatibility" && RUN_TOOLS_P12="FALSE" -if [ -n "${RUN_TOOLS_P12}" -a "${RUN_TOOLS_P12}" = "FALSE" ] ; then - html_msg 0 0 "Can't run pk12util tests for NSS 3.2 (pk12util -i)" - html_msg 0 0 "Can't run pk12util tests for NSS 3.2 (pk12util -o)" -else - tools_p12 -fi +tools_p12 tools_sign tools_cleanup |