diff options
Diffstat (limited to 'security/nss/cmd/symkeyutil')
| -rw-r--r-- | security/nss/cmd/symkeyutil/Makefile | 48 | ||||
| -rw-r--r-- | security/nss/cmd/symkeyutil/manifest.mn | 23 | ||||
| -rw-r--r-- | security/nss/cmd/symkeyutil/symkey.man | 182 | ||||
| -rw-r--r-- | security/nss/cmd/symkeyutil/symkeyutil.c | 1103 |
4 files changed, 0 insertions, 1356 deletions
diff --git a/security/nss/cmd/symkeyutil/Makefile b/security/nss/cmd/symkeyutil/Makefile deleted file mode 100644 index 74ae20020..000000000 --- a/security/nss/cmd/symkeyutil/Makefile +++ /dev/null @@ -1,48 +0,0 @@ -#! gmake -# -# This Source Code Form is subject to the terms of the Mozilla Public -# License, v. 2.0. If a copy of the MPL was not distributed with this -# file, You can obtain one at http://mozilla.org/MPL/2.0/. - -####################################################################### -# (1) Include initial platform-independent assignments (MANDATORY). # -####################################################################### - -include manifest.mn - -####################################################################### -# (2) Include "global" configuration information. (OPTIONAL) # -####################################################################### - -include $(CORE_DEPTH)/coreconf/config.mk - -####################################################################### -# (3) Include "component" configuration information. (OPTIONAL) # -####################################################################### - -####################################################################### -# (4) Include "local" platform-dependent assignments (OPTIONAL). # -####################################################################### - -include ../platlibs.mk - - -####################################################################### -# (5) Execute "global" rules. (OPTIONAL) # -####################################################################### - -include $(CORE_DEPTH)/coreconf/rules.mk - -####################################################################### -# (6) Execute "component" rules. (OPTIONAL) # -####################################################################### - - - -####################################################################### -# (7) Execute "local" rules. (OPTIONAL). # -####################################################################### - - -include ../platrules.mk - diff --git a/security/nss/cmd/symkeyutil/manifest.mn b/security/nss/cmd/symkeyutil/manifest.mn deleted file mode 100644 index 365e25f85..000000000 --- a/security/nss/cmd/symkeyutil/manifest.mn +++ /dev/null @@ -1,23 +0,0 @@ -# -# This Source Code Form is subject to the terms of the Mozilla Public -# License, v. 2.0. If a copy of the MPL was not distributed with this -# file, You can obtain one at http://mozilla.org/MPL/2.0/. - -CORE_DEPTH = ../../.. - -DEFINES += -DNSPR20 - -# MODULE public and private header directories are implicitly REQUIRED. -MODULE = nss - -CSRCS = symkeyutil.c -#CSRCS = symkeytest.c - -# The MODULE is always implicitly required. -# Listing it here in REQUIRES makes it appear twice in the cc command line. -REQUIRES = dbm seccmd - -PROGRAM = symkeyutil -#PROGRAM = symkeytest - -#USE_STATIC_LIBS = 1 diff --git a/security/nss/cmd/symkeyutil/symkey.man b/security/nss/cmd/symkeyutil/symkey.man deleted file mode 100644 index e3c2e4c6e..000000000 --- a/security/nss/cmd/symkeyutil/symkey.man +++ /dev/null @@ -1,182 +0,0 @@ - -NAME - symkeyutil - manage fixed keys in the database - -SYNOPSIS - symkeyutil -H - symkeyutil -L [std_opts] [-r] - symkeyutil -K [-n name] -t type [-s size] [-i id |-j id_file] [std_opts] - symkeyutil -D <[-n name | -i id | -j id_file> [std_opts] - symkeyutil -I [-n name] [-t type] [-i id | -j id_file] -k data_file [std_opts] - symkeyutil -E <-nname | -i id | -j id_file> [-t type] -k data_file [-r] [std_opts] - symkeyutil -U [-n name] [-t type] [-i id | -j id_file] -k data_file <wrap_opts> [std_opts] - symkeyutil -W <-n name | -i id | -j id_file> [-t type] -k data_file [-r] <wrap_opts> [std_opts] - symkeyutil -M <-n name | -i id | -j id_file> -g target_token [std_opts] - std_opts -> [-d certdir] [-P dbprefix] [-p password] [-f passwordFile] [-h token] - wrap_opts -> <-w wrap_name | -x wrap_id | -y id_file> - -DESCRIPTION - - NSS can store fixed keys as well as asymetric keys in the database. The - symkeyutil command can be used to manage these keys. - - As with certutil, symkeyutil takes two types of arguments, commands and - options. Most commands fall into one of two catagories: commands which - create keys and commands which extract or destroy keys. - - Exceptions to these catagories are listed first: - - -H takes no additional options. It lists a more detailed help message. - -L takes the standard set of options. It lists all the keys in the - specified token (NSS Internal DB Token is the default). Only the - -L option accepts the all option for tokens to list all the fixed - keys. - - Key Creation commands: - For these commands, the key type (-t) option is always required. - In addition, the -s option may be required for certain key types. - The standard set of options may be specified. - - -K Create a new key using the token key gen function. - -I Import a new key from the raw data specified in the data file, - specified with the -k options (required). This command may fail on - some tokens that don't support direct import of key material. - -U Unwrap a new key from an encrypted data file specified with the -k - option. The -w, -x, or -y option specifies the unwrapping key. - The unwrapping algorithm is selected based on the type of the - unwrapping key. - - Key extraction/destruction options: - For these keys, one and only of of the -n, -i, or -j options must be - specified. If more than one key matches the -n option, the 'first' key - matching will be used. The standard set of options may be specified. - - -D Delete the key specified by the -n, -i, or -j options. - -E Export the key specified by the -n, -i, or -j options and store the - contents to a file specified by the -k file (required). - This command will seldom work on any token since most keys are - protected from export. - -W Wrap the key specified by the -n, -i, or -j options and store the - encrypted contents to a file specified by the -k file (required). - The -w, -x, or -y option specifies the key used to wrap the - target key. - -M Move the key specified by the -n, -i, or -j options to the token - specified by the -g option (required). The new key will have the - same attributes as the source key. - -OPTIONS - - Standard options are those options that may be used by any command, and - whose meaning is the same for all commands. - - -h token Specify the token which the command will operate on. - If -h is not specified the internal token is presumed. In - addition the special value 'all' may be used to specify - that all tokens should be used. This is only valid for - the '-L' command. - -d certdir Specify the location of the NSS databases. The default - value is platform dependent. - -P dbprefix Specify the prefix for the NSS database. The default value - is NULL. - -p password Specify the password for the token. On the command line. - The -p and -f options are mutually exclusive. If - neither option is specified, the password would be - prompted from the user. - -f passwordFile Specify a file that contains the password for the token. - This option is mutually exclusive to the -p option. - - In addition to the standard options are the following command specific - options are. - - -r Opens the NSS databases Read/Write. By default the -L, - -E, and -W commands open the database read only. Other - commands automatically opens the databases Read/Write and - igore this option if it is specified. - - -n name Specifies the nickname for the key. - - For the -K, -I, or -U options, name is the name for - the new key. If -n is not specified, no name is - assumed. There is not check for duplicate names. - - For the -D, -E, -W, or -M, the name specifies the key to - operate on. In this case one andy only one of the -n, -i - or -j options should be specifed. It is possible that - the -n options specifies and ambiguous key. In that case - the 'first' valid key is used. - - For the -M option, the nickname for the new key is copied - from it's original key, even if the original key is - specified using -i or -j. - - -i key id - -j key id file These options are equivalent and mutually exclusive. - They specify the key id for the file. The -i option - specifies the key id on the command line using a hex - string. The -j specifies a file to read the raw key - id from. - - For the -K, -I, or -U options, key id is the key id for - the new key. If -i or -j is not specified, no key id - is assumed. Some tokens may generate their own unique - id for the key in this case (but it is not guarrenteed). - - For the -D, -E, -W, or -M, the key id specifies the key to - operate on. In this case one andy only one of the -n, -i - or -j options should be specifed. - - -t type Specifies the key Type for the new key. This option is - required for the -K, -I, and -U commands. Valid values - are: - generic, rc2, rc4, des, des2, des3, cast, cast3, - cast5, cast128, rc5, idea, skipjack, baton, juniper, - cdmf, aes, camellia - - Not all tokens support all key types. The generic key - type is usually used in MACing and key derivation - algorithms. Neither generic nor rc4 keys may be used - to wrap other keys. Fixed rc4 keys are dangerous since - multiple use of the same stream cipher key to encrypted - different data can compromise all data encrypted with - that key. - - -s size Specifies the key size. For most situations the key size - is already known and need not be specified. For some - algorithms, however, it is necessary to specify the key - size when generation or unwrapping the key. - - -k key file Specifies the name of a file that contains key data to - import or unwrap (-I or -U), or the location to store - key data or encrypted key data (-E or -W). - - -g target token Specifies the target token when moving a key (-M). This - option is required for the -M command. It is invalid for - all other commands. - - - - -w wrap name - -x wrap key id - -y wrap key id file Specifies the wrapping key used int the -U and -W - command. Exactly one of these must be specified for the - -U or -W commands. Same semantics as the -n, -i, and -j - options above. - -BUGS - - There is no way display the key id of a key. - - The -p and -f options only specifies one password. Multiple passwords may - be needed for the -L -h all command and the -M command. - - Perhaps RC4 should not be supported as a key type. Use of these keys as - fixed keys is exceedingly dangerous. - - The handling of multiple keys with the same nickname should be more - deterministic than 'the first one' - - There is no way to specify, or display the operation flags of a key. The - operation flags are not copied with the -M option as they should be. - - There is no way to change the attributes of a key (nickname, id, operation - flags). diff --git a/security/nss/cmd/symkeyutil/symkeyutil.c b/security/nss/cmd/symkeyutil/symkeyutil.c deleted file mode 100644 index 05de7d873..000000000 --- a/security/nss/cmd/symkeyutil/symkeyutil.c +++ /dev/null @@ -1,1103 +0,0 @@ -/* This Source Code Form is subject to the terms of the Mozilla Public - * License, v. 2.0. If a copy of the MPL was not distributed with this - * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ - -/* -** symkeyutil.c -** -** utility for managing symetric keys in the database or the token -** -*/ - -/* - * Wish List for this utility: - * 1) Display and Set the CKA_ operation flags for the key. - * 2) Modify existing keys - * 3) Copy keys - * 4) Read CKA_ID and display for keys. - * 5) Option to store CKA_ID in a file on key creation. - * 6) Encrypt, Decrypt, Hash, and Mac with generated keys. - * 7) Use asymetric keys to wrap and unwrap keys. - * 8) Derive. - * 9) PBE keys. - */ - -#include <stdio.h> -#include <string.h> - -#include "secutil.h" - -#include "nspr.h" - -#include "pk11func.h" -#include "secasn1.h" -#include "cert.h" -#include "cryptohi.h" -#include "secoid.h" -#include "certdb.h" -#include "nss.h" - -typedef struct _KeyTypes { - CK_KEY_TYPE keyType; - CK_MECHANISM_TYPE mechType; - CK_MECHANISM_TYPE wrapMech; - char *label; -} KeyTypes; - -static KeyTypes keyArray[] = { -#ifdef RECOGNIZE_ASYMETRIC_TYPES - { CKK_RSA, CKM_RSA_PKCS, CKM_RSA_PKCS, "rsa" }, - { CKK_DSA, CKM_DSA, CKM_INVALID_MECHANISM, "dsa" }, - { CKK_DH, CKM_DH_PKCS_DERIVE, CKM_INVALID_MECHANISM, "dh" }, - { CKK_EC, CKM_ECDSA, CKM_INVALID_MECHANISM, "ec" }, - { CKK_X9_42_DH, CKM_X9_42_DH_DERIVE, CKM_INVALID_MECHANISM, "x9.42dh" }, - { CKK_KEA, CKM_KEA_KEY_DERIVE, CKM_INVALID_MECHANISM, "kea" }, -#endif - { CKK_GENERIC_SECRET, CKM_SHA_1_HMAC, CKM_INVALID_MECHANISM, "generic" }, - { CKK_RC2, CKM_RC2_CBC, CKM_RC2_ECB,"rc2" }, - /* don't define a wrap mech for RC-4 since it's note really safe */ - { CKK_RC4, CKM_RC4, CKM_INVALID_MECHANISM, "rc4" }, - { CKK_DES, CKM_DES_CBC, CKM_DES_ECB,"des" }, - { CKK_DES2, CKM_DES2_KEY_GEN, CKM_DES3_ECB, "des2" }, - { CKK_DES3, CKM_DES3_KEY_GEN, CKM_DES3_ECB, "des3" }, - { CKK_CAST, CKM_CAST_CBC, CKM_CAST_ECB, "cast" }, - { CKK_CAST3, CKM_CAST3_CBC, CKM_CAST3_ECB, "cast3" }, - { CKK_CAST5, CKM_CAST5_CBC, CKM_CAST5_ECB, "cast5" }, - { CKK_CAST128, CKM_CAST128_CBC, CKM_CAST128_ECB, "cast128" }, - { CKK_RC5, CKM_RC5_CBC, CKM_RC5_ECB, "rc5" }, - { CKK_IDEA, CKM_IDEA_CBC, CKM_IDEA_ECB, "idea" }, - { CKK_SKIPJACK, CKM_SKIPJACK_CBC64, CKM_SKIPJACK_WRAP, "skipjack" }, - { CKK_BATON, CKM_BATON_CBC128, CKM_BATON_WRAP, "baton" }, - { CKK_JUNIPER, CKM_JUNIPER_CBC128, CKM_JUNIPER_WRAP, "juniper" }, - { CKK_CDMF, CKM_CDMF_CBC, CKM_CDMF_ECB, "cdmf" }, - { CKK_AES, CKM_AES_CBC, CKM_AES_ECB, "aes" }, - { CKK_CAMELLIA, CKM_CAMELLIA_CBC, CKM_CAMELLIA_ECB, "camellia" }, -}; - -static int keyArraySize = sizeof(keyArray)/sizeof(keyArray[0]); - -int -GetLen(PRFileDesc* fd) -{ - PRFileInfo info; - - if (PR_SUCCESS != PR_GetOpenFileInfo(fd, &info)) { - return -1; - } - - return info.size; -} - -int -ReadBuf(char *inFile, SECItem *item) -{ - int len; - int ret; - PRFileDesc* fd = PR_Open(inFile, PR_RDONLY, 0); - if (NULL == fd) { - SECU_PrintError("symkeyutil", "PR_Open failed"); - return -1; - } - - len = GetLen(fd); - if (len < 0) { - SECU_PrintError("symkeyutil", "PR_GetOpenFileInfo failed"); - return -1; - } - item->data = (unsigned char *)PORT_Alloc(len); - if (item->data == NULL) { - fprintf(stderr,"Failed to allocate %d to read file %s\n",len,inFile); - return -1; - } - - ret = PR_Read(fd,item->data,item->len); - if (ret < 0) { - SECU_PrintError("symkeyutil", "PR_Read failed"); - PORT_Free(item->data); - item->data = NULL; - return -1; - } - PR_Close(fd); - item->len = len; - return 0; -} - -int -WriteBuf(char *inFile, SECItem *item) -{ - int ret; - PRFileDesc* fd = PR_Open(inFile, PR_WRONLY|PR_CREATE_FILE, 0x200); - if (NULL == fd) { - SECU_PrintError("symkeyutil", "PR_Open failed"); - return -1; - } - - ret = PR_Write(fd,item->data,item->len); - if (ret < 0) { - SECU_PrintError("symkeyutil", "PR_Write failed"); - return -1; - } - PR_Close(fd); - return 0; -} - -CK_KEY_TYPE -GetKeyTypeFromString(const char *keyString) -{ - int i; - for (i=0; i < keyArraySize; i++) { - if (PL_strcasecmp(keyString,keyArray[i].label) == 0) { - return keyArray[i].keyType; - } - } - return (CK_KEY_TYPE)-1; -} - -CK_MECHANISM_TYPE -GetKeyMechFromString(const char *keyString) -{ - int i; - for (i=0; i < keyArraySize; i++) { - if (PL_strcasecmp(keyString,keyArray[i].label) == 0) { - return keyArray[i].mechType; - } - } - return (CK_MECHANISM_TYPE)-1; -} - -const char * -GetStringFromKeyType(CK_KEY_TYPE type) -{ - int i; - for (i=0; i < keyArraySize; i++) { - if (keyArray[i].keyType == type) { - return keyArray[i].label; - } - } - return "unmatched"; -} - -CK_MECHANISM_TYPE -GetWrapFromKeyType(CK_KEY_TYPE type) -{ - int i; - for (i=0; i < keyArraySize; i++) { - if (keyArray[i].keyType == type) { - return keyArray[i].wrapMech; - } - } - return CKM_INVALID_MECHANISM; -} - -CK_MECHANISM_TYPE -GetWrapMechanism(PK11SymKey *symKey) -{ - CK_KEY_TYPE type = PK11_GetSymKeyType(symKey); - - return GetWrapFromKeyType(type); -} - -int -GetDigit(char c) -{ - if (c == 0) { - return -1; - } - if (c <= '9' && c >= '0') { - return c - '0'; - } - if (c <= 'f' && c >= 'a') { - return c - 'a' + 0xa; - } - if (c <= 'F' && c >= 'A') { - return c - 'A' + 0xa; - } - return -1; -} - -char -ToDigit(unsigned char c) -{ - c = c & 0xf; - if (c <= 9) { - return (char) (c+'0'); - } - return (char) (c+'a'-0xa); -} - -char * -BufToHex(SECItem *outbuf) -{ - int len = outbuf->len * 2 +1; - char *string, *ptr; - unsigned int i; - - string = PORT_Alloc(len); - - ptr = string; - for (i=0; i < outbuf->len; i++) { - *ptr++ = ToDigit(outbuf->data[i] >> 4); - *ptr++ = ToDigit(outbuf->data[i] & 0xf); - } - *ptr = 0; - return string; -} - - -int -HexToBuf(char *inString, SECItem *outbuf) -{ - int len = strlen(inString); - int outlen = len+1/2; - int trueLen = 0; - - outbuf->data = PORT_Alloc(outlen); - if (outbuf->data) { - return -1; - } - - while (*inString) { - int digit1, digit2; - digit1 = GetDigit(*inString++); - digit2 = GetDigit(*inString++); - if ((digit1 == -1) || (digit2 == -1)) { - PORT_Free(outbuf->data); - outbuf->data = NULL; - return -1; - } - outbuf->data[trueLen++] = digit1 << 4 | digit2; - } - outbuf->len = trueLen; - return 0; -} - -void -printBuf(unsigned char *data, int len) -{ - int i; - - for (i=0; i < len; i++) { - printf("%02x",data[i]); - } -} - -void -PrintKey(PK11SymKey *symKey) -{ - char *name = PK11_GetSymKeyNickname(symKey); - int len = PK11_GetKeyLength(symKey); - int strength = PK11_GetKeyStrength(symKey, NULL); - SECItem *value = NULL; - CK_KEY_TYPE type = PK11_GetSymKeyType(symKey); - (void) PK11_ExtractKeyValue(symKey); - - value = PK11_GetKeyData(symKey); - - printf("%-20s %3d %4d %10s ", name ? name: " ", len, strength, - GetStringFromKeyType(type)); - if (value && value->data) { - printBuf(value->data, value->len); - } else { - printf("<restricted>"); - } - printf("\n"); -} - -SECStatus -ListKeys(PK11SlotInfo *slot, int *printLabel, void *pwd) { - PK11SymKey *keyList; - SECStatus rv = PK11_Authenticate(slot, PR_FALSE, pwd); - if (rv != SECSuccess) { - return rv;; - } - - keyList = PK11_ListFixedKeysInSlot(slot, NULL, pwd); - if (keyList) { - if (*printLabel) { - printf(" Name Len Strength Type Data\n"); - *printLabel = 0; - } - printf("%s:\n",PK11_GetTokenName(slot)); - } - while (keyList) { - PK11SymKey *freeKey = keyList; - PrintKey(keyList); - keyList = PK11_GetNextSymKey(keyList); - PK11_FreeSymKey(freeKey); - } - return SECSuccess; -} - -PK11SymKey * -FindKey(PK11SlotInfo *slot, char *name, SECItem *id, void *pwd) -{ - PK11SymKey *key = NULL; - SECStatus rv = PK11_Authenticate(slot, PR_FALSE, pwd); - - if (rv != SECSuccess) { - return NULL; - } - - - if (id->data) { - key = PK11_FindFixedKey(slot,CKM_INVALID_MECHANISM, id, pwd); - } - if (name && !key) { - key = PK11_ListFixedKeysInSlot(slot,name, pwd); - } - - if (key) { - printf("Found a key\n"); - PrintKey(key); - } - return key; -} - -PRBool -IsKeyList(PK11SymKey *symKey) -{ - return (PRBool) (PK11_GetNextSymKey(symKey) != NULL); -} - -void -FreeKeyList(PK11SymKey *symKey) -{ - PK11SymKey *next,*current; - - for (current = symKey; current; current = next) { - next = PK11_GetNextSymKey(current); - PK11_FreeSymKey(current); - } - return; -} - -static void -Usage(char *progName) -{ -#define FPS fprintf(stderr, - FPS "Type %s -H for more detailed descriptions\n", progName); - FPS "Usage:"); - FPS "\t%s -L [std_opts] [-r]\n", progName); - FPS "\t%s -K [-n name] -t type [-s size] [-i id |-j id_file] [std_opts]\n", progName); - FPS "\t%s -D <[-n name | -i id | -j id_file> [std_opts]\n", progName); - FPS "\t%s -I [-n name] [-t type] [-i id | -j id_file] -k data_file [std_opts]\n", progName); - FPS "\t%s -E <-nname | -i id | -j id_file> [-t type] -k data_file [-r] [std_opts]\n", progName); - FPS "\t%s -U [-n name] [-t type] [-i id | -j id_file] -k data_file <wrap_opts> [std_opts]\n", progName); - FPS "\t%s -W <-n name | -i id | -j id_file> [-t type] -k data_file [-r] <wrap_opts> [std_opts]\n", progName); - FPS "\t%s -M <-n name | -i id | -j id_file> -g target_token [std_opts]\n", progName); - FPS "\t\t std_opts -> [-d certdir] [-P dbprefix] [-p password] [-f passwordFile] [-h token]\n"); - FPS "\t\t wrap_opts -> <-w wrap_name | -x wrap_id | -y id_file>\n"); - exit(1); -} - -static void LongUsage(char *progName) -{ - int i; - FPS "%-15s List all the keys.\n", "-L"); - FPS "%-15s Generate a new key.\n", "-K"); - FPS "%-20s Specify the nickname of the new key\n", - " -n name"); - FPS "%-20s Specify the id in hex of the new key\n", - " -i key id"); - FPS "%-20s Specify a file to read the id of the new key\n", - " -j key id file"); - FPS "%-20s Specify the keyType of the new key\n", - " -t type"); - FPS "%-20s", " valid types: "); - for (i=0; i < keyArraySize ; i++) { - FPS "%s%c", keyArray[i].label, i == keyArraySize-1? '\n':','); - } - FPS "%-20s Specify the size of the new key in bytes (required by some types)\n", - " -s size"); - FPS "%-15s Delete a key.\n", "-D"); - FPS "%-20s Specify the nickname of the key to delete\n", - " -n name"); - FPS "%-20s Specify the id in hex of the key to delete\n", - " -i key id"); - FPS "%-20s Specify a file to read the id of the key to delete\n", - " -j key id file"); - FPS "%-15s Import a new key from a data file.\n", "-I"); - FPS "%-20s Specify the data file to read the key from.\n", - " -k key file"); - FPS "%-20s Specify the nickname of the new key\n", - " -n name"); - FPS "%-20s Specify the id in hex of the new key\n", - " -i key id"); - FPS "%-20s Specify a file to read the id of the new key\n", - " -j key id file"); - FPS "%-20s Specify the keyType of the new key\n", - " -t type"); - FPS "%-20s", " valid types: "); - for (i=0; i < keyArraySize ; i++) { - FPS "%s%c", keyArray[i].label, i == keyArraySize-1? '\n':','); - } - FPS "%-15s Export a key to a data file.\n", "-E"); - FPS "%-20s Specify the data file to write the key to.\n", - " -k key file"); - FPS "%-20s Specify the nickname of the key to export\n", - " -n name"); - FPS "%-20s Specify the id in hex of the key to export\n", - " -i key id"); - FPS "%-20s Specify a file to read the id of the key to export\n", - " -j key id file"); - FPS "%-15s Move a key to a new token.\n", "-M"); - FPS "%-20s Specify the nickname of the key to move\n", - " -n name"); - FPS "%-20s Specify the id in hex of the key to move\n", - " -i key id"); - FPS "%-20s Specify a file to read the id of the key to move\n", - " -j key id file"); - FPS "%-20s Specify the token to move the key to\n", - " -g target token"); - FPS "%-15s Unwrap a new key from a data file.\n", "-U"); - FPS "%-20s Specify the data file to read the encrypted key from.\n", - " -k key file"); - FPS "%-20s Specify the nickname of the new key\n", - " -n name"); - FPS "%-20s Specify the id in hex of the new key\n", - " -i key id"); - FPS "%-20s Specify a file to read the id of the new key\n", - " -j key id file"); - FPS "%-20s Specify the keyType of the new key\n", - " -t type"); - FPS "%-20s", " valid types: "); - for (i=0; i < keyArraySize ; i++) { - FPS "%s%c", keyArray[i].label, i == keyArraySize-1? '\n':','); - } - FPS "%-20s Specify the nickname of the wrapping key\n", - " -w wrap name"); - FPS "%-20s Specify the id in hex of the wrapping key\n", - " -x wrap key id"); - FPS "%-20s Specify a file to read the id of the wrapping key\n", - " -y wrap key id file"); - FPS "%-15s Wrap a new key to a data file. [not yet implemented]\n", "-W"); - FPS "%-20s Specify the data file to write the encrypted key to.\n", - " -k key file"); - FPS "%-20s Specify the nickname of the key to wrap\n", - " -n name"); - FPS "%-20s Specify the id in hex of the key to wrap\n", - " -i key id"); - FPS "%-20s Specify a file to read the id of the key to wrap\n", - " -j key id file"); - FPS "%-20s Specify the nickname of the wrapping key\n", - " -w wrap name"); - FPS "%-20s Specify the id in hex of the wrapping key\n", - " -x wrap key id"); - FPS "%-20s Specify a file to read the id of the wrapping key\n", - " -y wrap key id file"); - FPS "%-15s Options valid for all commands\n", "std_opts"); - FPS "%-20s The directory where the NSS db's reside\n", - " -d certdir"); - FPS "%-20s Prefix for the NSS db's\n", - " -P db prefix"); - FPS "%-20s Specify password on the command line\n", - " -p password"); - FPS "%-20s Specify password file on the command line\n", - " -f password file"); - FPS "%-20s Specify token to act on\n", - " -h token"); - exit(1); -#undef FPS -} - -/* Certutil commands */ -enum { - cmd_CreateNewKey = 0, - cmd_DeleteKey, - cmd_ImportKey, - cmd_ExportKey, - cmd_WrapKey, - cmd_UnwrapKey, - cmd_MoveKey, - cmd_ListKeys, - cmd_PrintHelp -}; - -/* Certutil options */ -enum { - opt_CertDir = 0, - opt_PasswordFile, - opt_TargetToken, - opt_TokenName, - opt_KeyID, - opt_KeyIDFile, - opt_KeyType, - opt_Nickname, - opt_KeyFile, - opt_Password, - opt_dbPrefix, - opt_RW, - opt_KeySize, - opt_WrapKeyName, - opt_WrapKeyID, - opt_WrapKeyIDFile, - opt_NoiseFile -}; - -static secuCommandFlag symKeyUtil_commands[] = -{ - { /* cmd_CreateNewKey */ 'K', PR_FALSE, 0, PR_FALSE }, - { /* cmd_DeleteKey */ 'D', PR_FALSE, 0, PR_FALSE }, - { /* cmd_ImportKey */ 'I', PR_FALSE, 0, PR_FALSE }, - { /* cmd_ExportKey */ 'E', PR_FALSE, 0, PR_FALSE }, - { /* cmd_WrapKey */ 'W', PR_FALSE, 0, PR_FALSE }, - { /* cmd_UnwrapKey */ 'U', PR_FALSE, 0, PR_FALSE }, - { /* cmd_MoveKey */ 'M', PR_FALSE, 0, PR_FALSE }, - { /* cmd_ListKeys */ 'L', PR_FALSE, 0, PR_FALSE }, - { /* cmd_PrintHelp */ 'H', PR_FALSE, 0, PR_FALSE }, -}; - -static secuCommandFlag symKeyUtil_options[] = -{ - { /* opt_CertDir */ 'd', PR_TRUE, 0, PR_FALSE }, - { /* opt_PasswordFile */ 'f', PR_TRUE, 0, PR_FALSE }, - { /* opt_TargetToken */ 'g', PR_TRUE, 0, PR_FALSE }, - { /* opt_TokenName */ 'h', PR_TRUE, 0, PR_FALSE }, - { /* opt_KeyID */ 'i', PR_TRUE, 0, PR_FALSE }, - { /* opt_KeyIDFile */ 'j', PR_TRUE, 0, PR_FALSE }, - { /* opt_KeyType */ 't', PR_TRUE, 0, PR_FALSE }, - { /* opt_Nickname */ 'n', PR_TRUE, 0, PR_FALSE }, - { /* opt_KeyFile */ 'k', PR_TRUE, 0, PR_FALSE }, - { /* opt_Password */ 'p', PR_TRUE, 0, PR_FALSE }, - { /* opt_dbPrefix */ 'P', PR_TRUE, 0, PR_FALSE }, - { /* opt_RW */ 'r', PR_FALSE, 0, PR_FALSE }, - { /* opt_KeySize */ 's', PR_TRUE, 0, PR_FALSE }, - { /* opt_WrapKeyName */ 'w', PR_TRUE, 0, PR_FALSE }, - { /* opt_WrapKeyID */ 'x', PR_TRUE, 0, PR_FALSE }, - { /* opt_WrapKeyIDFile */ 'y', PR_TRUE, 0, PR_FALSE }, - { /* opt_NoiseFile */ 'z', PR_TRUE, 0, PR_FALSE }, -}; - -int -main(int argc, char **argv) -{ - PK11SlotInfo *slot = NULL; - char * slotname = "internal"; - char * certPrefix = ""; - CK_MECHANISM_TYPE keyType = CKM_SHA_1_HMAC; - int keySize = 0; - char * name = NULL; - char * wrapName = NULL; - secuPWData pwdata = { PW_NONE, 0 }; - PRBool readOnly = PR_FALSE; - SECItem key; - SECItem keyID; - SECItem wrapKeyID; - int commandsEntered = 0; - int commandToRun = 0; - char *progName; - int i; - SECStatus rv = SECFailure; - - secuCommand symKeyUtil; - symKeyUtil.numCommands=sizeof(symKeyUtil_commands)/sizeof(secuCommandFlag); - symKeyUtil.numOptions=sizeof(symKeyUtil_options)/sizeof(secuCommandFlag); - symKeyUtil.commands = symKeyUtil_commands; - symKeyUtil.options = symKeyUtil_options; - - key.data = NULL; key.len = 0; - keyID.data = NULL; keyID.len = 0; - wrapKeyID.data = NULL; wrapKeyID.len = 0; - - progName = strrchr(argv[0], '/'); - progName = progName ? progName+1 : argv[0]; - - rv = SECU_ParseCommandLine(argc, argv, progName, &symKeyUtil); - - if (rv != SECSuccess) - Usage(progName); - - rv = SECFailure; - - /* -H print help */ - if (symKeyUtil.commands[cmd_PrintHelp].activated) - LongUsage(progName); - - /* -f password file, -p password */ - if (symKeyUtil.options[opt_PasswordFile].arg) { - pwdata.source = PW_FROMFILE; - pwdata.data = symKeyUtil.options[opt_PasswordFile].arg; - } else if (symKeyUtil.options[opt_Password].arg) { - pwdata.source = PW_PLAINTEXT; - pwdata.data = symKeyUtil.options[opt_Password].arg; - } - - /* -d directory */ - if (symKeyUtil.options[opt_CertDir].activated) - SECU_ConfigDirectory(symKeyUtil.options[opt_CertDir].arg); - - /* -s key size */ - if (symKeyUtil.options[opt_KeySize].activated) { - keySize = PORT_Atoi(symKeyUtil.options[opt_KeySize].arg); - } - - /* -h specify token name */ - if (symKeyUtil.options[opt_TokenName].activated) { - if (PL_strcmp(symKeyUtil.options[opt_TokenName].arg, "all") == 0) - slotname = NULL; - else - slotname = PL_strdup(symKeyUtil.options[opt_TokenName].arg); - } - - /* -t key type */ - if (symKeyUtil.options[opt_KeyType].activated) { - keyType = GetKeyMechFromString(symKeyUtil.options[opt_KeyType].arg); - if (keyType == (CK_MECHANISM_TYPE)-1) { - PR_fprintf(PR_STDERR, - "%s unknown key type (%s).\n", - progName, symKeyUtil.options[opt_KeyType].arg); - return 255; - } - } - - /* -k for import and unwrap, it specifies an input file to read from, - * for export and wrap it specifies an output file to write to */ - if (symKeyUtil.options[opt_KeyFile].activated) { - if (symKeyUtil.commands[cmd_ImportKey].activated || - symKeyUtil.commands[cmd_UnwrapKey].activated ) { - int ret = ReadBuf(symKeyUtil.options[opt_KeyFile].arg, &key); - if (ret < 0) { - PR_fprintf(PR_STDERR, - "%s Couldn't read key file (%s).\n", - progName, symKeyUtil.options[opt_KeyFile].arg); - return 255; - } - } - } - - /* -i specify the key ID */ - if (symKeyUtil.options[opt_KeyID].activated) { - int ret = HexToBuf(symKeyUtil.options[opt_KeyID].arg, &keyID); - if (ret < 0) { - PR_fprintf(PR_STDERR, - "%s invalid key ID (%s).\n", - progName, symKeyUtil.options[opt_KeyID].arg); - return 255; - } - } - - /* -i & -j are mutually exclusive */ - if ((symKeyUtil.options[opt_KeyID].activated) && - (symKeyUtil.options[opt_KeyIDFile].activated)) { - PR_fprintf(PR_STDERR, - "%s -i and -j options are mutually exclusive.\n", progName); - return 255; - } - - /* -x specify the Wrap key ID */ - if (symKeyUtil.options[opt_WrapKeyID].activated) { - int ret = HexToBuf(symKeyUtil.options[opt_WrapKeyID].arg, &wrapKeyID); - if (ret < 0) { - PR_fprintf(PR_STDERR, - "%s invalid key ID (%s).\n", - progName, symKeyUtil.options[opt_WrapKeyID].arg); - return 255; - } - } - - /* -x & -y are mutually exclusive */ - if ((symKeyUtil.options[opt_KeyID].activated) && - (symKeyUtil.options[opt_KeyIDFile].activated)) { - PR_fprintf(PR_STDERR, - "%s -i and -j options are mutually exclusive.\n", progName); - return 255; - } - - - /* -y specify the key ID */ - if (symKeyUtil.options[opt_WrapKeyIDFile].activated) { - int ret = ReadBuf(symKeyUtil.options[opt_WrapKeyIDFile].arg, - &wrapKeyID); - if (ret < 0) { - PR_fprintf(PR_STDERR, - "%s Couldn't read key ID file (%s).\n", - progName, symKeyUtil.options[opt_WrapKeyIDFile].arg); - return 255; - } - } - - /* -P certdb name prefix */ - if (symKeyUtil.options[opt_dbPrefix].activated) - certPrefix = symKeyUtil.options[opt_dbPrefix].arg; - - /* Check number of commands entered. */ - commandsEntered = 0; - for (i=0; i< symKeyUtil.numCommands; i++) { - if (symKeyUtil.commands[i].activated) { - commandToRun = symKeyUtil.commands[i].flag; - commandsEntered++; - } - if (commandsEntered > 1) - break; - } - if (commandsEntered > 1) { - PR_fprintf(PR_STDERR, "%s: only one command at a time!\n", progName); - PR_fprintf(PR_STDERR, "You entered: "); - for (i=0; i< symKeyUtil.numCommands; i++) { - if (symKeyUtil.commands[i].activated) - PR_fprintf(PR_STDERR, " -%c", symKeyUtil.commands[i].flag); - } - PR_fprintf(PR_STDERR, "\n"); - return 255; - } - if (commandsEntered == 0) { - PR_fprintf(PR_STDERR, "%s: you must enter a command!\n", progName); - Usage(progName); - } - - if (symKeyUtil.commands[cmd_ListKeys].activated || - symKeyUtil.commands[cmd_PrintHelp].activated || - symKeyUtil.commands[cmd_ExportKey].activated || - symKeyUtil.commands[cmd_WrapKey].activated) { - readOnly = !symKeyUtil.options[opt_RW].activated; - } - - if ((symKeyUtil.commands[cmd_ImportKey].activated || - symKeyUtil.commands[cmd_ExportKey].activated || - symKeyUtil.commands[cmd_WrapKey].activated || - symKeyUtil.commands[cmd_UnwrapKey].activated ) && - !symKeyUtil.options[opt_KeyFile].activated) { - PR_fprintf(PR_STDERR, - "%s -%c: keyfile is required for this command (-k).\n", - progName, commandToRun); - return 255; - } - - /* -E, -D, -W, and all require -n, -i, or -j to identify the key */ - if ((symKeyUtil.commands[cmd_ExportKey].activated || - symKeyUtil.commands[cmd_DeleteKey].activated || - symKeyUtil.commands[cmd_WrapKey].activated) && - !(symKeyUtil.options[opt_Nickname].activated || - symKeyUtil.options[opt_KeyID].activated || - symKeyUtil.options[opt_KeyIDFile].activated)) { - PR_fprintf(PR_STDERR, - "%s -%c: nickname or id is required for this command (-n, -i, -j).\n", - progName, commandToRun); - return 255; - } - - /* -W, -U, and all -w, -x, or -y to identify the wrapping key */ - if (( symKeyUtil.commands[cmd_WrapKey].activated || - symKeyUtil.commands[cmd_UnwrapKey].activated) && - !(symKeyUtil.options[opt_WrapKeyName].activated || - symKeyUtil.options[opt_WrapKeyID].activated || - symKeyUtil.options[opt_WrapKeyIDFile].activated)) { - PR_fprintf(PR_STDERR, - "%s -%c: wrap key is required for this command (-w, -x, or -y).\n", - progName, commandToRun); - return 255; - } - - /* -M needs the target slot (-g) */ - if (symKeyUtil.commands[cmd_MoveKey].activated && - !symKeyUtil.options[opt_TargetToken].activated) { - PR_fprintf(PR_STDERR, - "%s -%c: target token is required for this command (-g).\n", - progName, commandToRun); - return 255; - } - - /* Using slotname == NULL for listing keys and certs on all slots, - * but only that. */ - if (!(symKeyUtil.commands[cmd_ListKeys].activated) && slotname == NULL) { - PR_fprintf(PR_STDERR, - "%s -%c: cannot use \"-h all\" for this command.\n", - progName, commandToRun); - return 255; - } - - name = SECU_GetOptionArg(&symKeyUtil, opt_Nickname); - wrapName = SECU_GetOptionArg(&symKeyUtil, opt_WrapKeyName); - - PK11_SetPasswordFunc(SECU_GetModulePassword); - - /* Initialize NSPR and NSS. */ - PR_Init(PR_SYSTEM_THREAD, PR_PRIORITY_NORMAL, 1); - rv = NSS_Initialize(SECU_ConfigDirectory(NULL), certPrefix, certPrefix, - "secmod.db", readOnly ? NSS_INIT_READONLY: 0); - if (rv != SECSuccess) { - SECU_PrintPRandOSError(progName); - goto shutdown; - } - rv = SECFailure; - - if (PL_strcmp(slotname, "internal") == 0) - slot = PK11_GetInternalKeySlot(); - else if (slotname != NULL) - slot = PK11_FindSlotByName(slotname); - - /* generating a new key */ - if (symKeyUtil.commands[cmd_CreateNewKey].activated) { - PK11SymKey *symKey; - - symKey = PK11_TokenKeyGen(slot, keyType, NULL, keySize, - NULL, PR_TRUE, &pwdata); - if (!symKey) { - PR_fprintf(PR_STDERR, "%s: Token Key Gen Failed\n", progName); - goto shutdown; - } - if (symKeyUtil.options[opt_Nickname].activated) { - rv = PK11_SetSymKeyNickname(symKey, name); - if (rv != SECSuccess) { - PK11_DeleteTokenSymKey(symKey); - PK11_FreeSymKey(symKey); - PR_fprintf(PR_STDERR, "%s: Couldn't set nickname on key\n", - progName); - goto shutdown; - } - } - rv = SECSuccess; - PrintKey(symKey); - PK11_FreeSymKey(symKey); - } - if (symKeyUtil.commands[cmd_DeleteKey].activated) { - PK11SymKey *symKey = FindKey(slot,name,&keyID,&pwdata); - - if (!symKey) { - char *keyName = keyID.data ? BufToHex(&keyID) : PORT_Strdup(name); - PR_fprintf(PR_STDERR, "%s: Couldn't find key %s on %s\n", - progName, keyName, PK11_GetTokenName(slot)); - PORT_Free(keyName); - goto shutdown; - } - - rv = PK11_DeleteTokenSymKey(symKey); - FreeKeyList(symKey); - if (rv != SECSuccess) { - PR_fprintf(PR_STDERR, "%s: Couldn't Delete Key \n", progName); - goto shutdown; - } - } - if (symKeyUtil.commands[cmd_UnwrapKey].activated) { - PK11SymKey *wrapKey = FindKey(slot,wrapName,&wrapKeyID,&pwdata); - PK11SymKey *symKey; - CK_MECHANISM_TYPE mechanism; - - if (!wrapKey) { - char *keyName = wrapKeyID.data ? BufToHex(&wrapKeyID) - : PORT_Strdup(wrapName); - PR_fprintf(PR_STDERR, "%s: Couldn't find key %s on %s\n", - progName, keyName, PK11_GetTokenName(slot)); - PORT_Free(keyName); - goto shutdown; - } - mechanism = GetWrapMechanism(wrapKey); - if (mechanism == CKM_INVALID_MECHANISM) { - char *keyName = wrapKeyID.data ? BufToHex(&wrapKeyID) - : PORT_Strdup(wrapName); - PR_fprintf(PR_STDERR, "%s: %s on %s is an invalid wrapping key\n", - progName, keyName, PK11_GetTokenName(slot)); - PORT_Free(keyName); - PK11_FreeSymKey(wrapKey); - goto shutdown; - } - - symKey = PK11_UnwrapSymKeyWithFlagsPerm(wrapKey, mechanism, NULL, - &key, keyType, CKA_ENCRYPT, keySize, 0, PR_TRUE); - PK11_FreeSymKey(wrapKey); - if (!symKey) { - PR_fprintf(PR_STDERR, "%s: Unwrap Key Failed\n", progName); - goto shutdown; - } - - if (symKeyUtil.options[opt_Nickname].activated) { - rv = PK11_SetSymKeyNickname(symKey, name); - if (rv != SECSuccess) { - PR_fprintf(PR_STDERR, "%s: Couldn't set name on key\n", - progName); - PK11_DeleteTokenSymKey(symKey); - PK11_FreeSymKey(symKey); - goto shutdown; - } - } - rv = SECSuccess; - PrintKey(symKey); - PK11_FreeSymKey(symKey); - } - -#define MAX_KEY_SIZE 4098 - if (symKeyUtil.commands[cmd_WrapKey].activated) { - PK11SymKey *symKey = FindKey(slot, name, &keyID, &pwdata); - PK11SymKey *wrapKey; - CK_MECHANISM_TYPE mechanism; - SECItem data; - unsigned char buf[MAX_KEY_SIZE]; - int ret; - - if (!symKey) { - char *keyName = keyID.data ? BufToHex(&keyID) : PORT_Strdup(name); - PR_fprintf(PR_STDERR, "%s: Couldn't find key %s on %s\n", - progName, keyName, PK11_GetTokenName(slot)); - PORT_Free(keyName); - goto shutdown; - } - - wrapKey = FindKey(slot, wrapName, &wrapKeyID, &pwdata); - if (!wrapKey) { - char *keyName = wrapKeyID.data ? BufToHex(&wrapKeyID) - : PORT_Strdup(wrapName); - PR_fprintf(PR_STDERR, "%s: Couldn't find key %s on %s\n", - progName, keyName, PK11_GetTokenName(slot)); - PORT_Free(keyName); - PK11_FreeSymKey(symKey); - goto shutdown; - } - - mechanism = GetWrapMechanism(wrapKey); - if (mechanism == CKM_INVALID_MECHANISM) { - char *keyName = wrapKeyID.data ? BufToHex(&wrapKeyID) - : PORT_Strdup(wrapName); - PR_fprintf(PR_STDERR, "%s: %s on %s is an invalid wrapping key\n", - progName, keyName, PK11_GetTokenName(slot)); - PORT_Free(keyName); - PK11_FreeSymKey(symKey); - PK11_FreeSymKey(wrapKey); - goto shutdown; - } - - data.data = buf; - data.len = sizeof(buf); - rv = PK11_WrapSymKey(mechanism, NULL, wrapKey, symKey, &data); - PK11_FreeSymKey(symKey); - PK11_FreeSymKey(wrapKey); - if (rv != SECSuccess) { - PR_fprintf(PR_STDERR, "%s: Couldn't wrap key\n",progName); - goto shutdown; - } - - /* WriteBuf outputs it's own error using SECU_PrintError */ - ret = WriteBuf(symKeyUtil.options[opt_KeyFile].arg, &data); - if (ret < 0) { - goto shutdown; - } - } - - if (symKeyUtil.commands[cmd_ImportKey].activated) { - PK11SymKey *symKey = PK11_ImportSymKey(slot, keyType, - PK11_OriginUnwrap, CKA_ENCRYPT, &key,&pwdata); - if (!symKey) { - PR_fprintf(PR_STDERR, "%s: Import Key Failed\n", progName); - goto shutdown; - } - if (symKeyUtil.options[opt_Nickname].activated) { - rv = PK11_SetSymKeyNickname(symKey, name); - if (rv != SECSuccess) { - PR_fprintf(PR_STDERR, "%s: Couldn't set name on key\n", - progName); - PK11_DeleteTokenSymKey(symKey); - PK11_FreeSymKey(symKey); - goto shutdown; - } - } - rv = SECSuccess; - PrintKey(symKey); - PK11_FreeSymKey(symKey); - } - - /* List certs (-L) */ - if (symKeyUtil.commands[cmd_ListKeys].activated) { - int printLabel = 1; - if (slot) { - rv = ListKeys(slot,&printLabel,&pwdata); - } else { - /* loop over all the slots */ - PK11SlotList *slotList = PK11_GetAllTokens(CKM_INVALID_MECHANISM, - PR_FALSE, PR_FALSE, &pwdata); - if (slotList == NULL) { - PR_fprintf(PR_STDERR, "%s: No tokens found\n",progName); - } else { - PK11SlotListElement *se; - for (se = PK11_GetFirstSafe(slotList); se; - se=PK11_GetNextSafe(slotList,se, PR_FALSE)) { - rv = ListKeys(se->slot,&printLabel,&pwdata); - if (rv !=SECSuccess) { - break; - } - } - if (se) { - SECStatus rv2 = PK11_FreeSlotListElement(slotList, se); - PORT_Assert(SECSuccess == rv2); - } - PK11_FreeSlotList(slotList); - } - } - } - - /* Move key (-M) */ - if (symKeyUtil.commands[cmd_MoveKey].activated) { - PK11SlotInfo *target; - char *targetName = symKeyUtil.options[opt_TargetToken].arg; - PK11SymKey *newKey; - PK11SymKey *symKey = FindKey(slot,name,&keyID,&pwdata); - char *keyName = PK11_GetSymKeyNickname(symKey); - - if (!symKey) { - char *keyName = keyID.data ? BufToHex(&keyID) : PORT_Strdup(name); - PR_fprintf(PR_STDERR, "%s: Couldn't find key %s on %s\n", - progName, keyName, PK11_GetTokenName(slot)); - PORT_Free(keyName); - goto shutdown; - } - target = PK11_FindSlotByName(targetName); - if (!target) { - PR_fprintf(PR_STDERR, "%s: Couldn't find slot %s\n", - progName, targetName); - goto shutdown; - } - rv = PK11_Authenticate(target, PR_FALSE, &pwdata); - if (rv != SECSuccess) { - PR_fprintf(PR_STDERR, "%s: Failed to log into %s\n", - progName, targetName); - goto shutdown; - } - rv = SECFailure; - newKey = PK11_MoveSymKey(target, CKA_ENCRYPT, 0, PR_TRUE, symKey); - if (!newKey) { - PR_fprintf(PR_STDERR, "%s: Couldn't move the key \n",progName); - goto shutdown; - } - if (keyName) { - rv = PK11_SetSymKeyNickname(newKey, keyName); - if (rv != SECSuccess) { - PK11_DeleteTokenSymKey(newKey); - PK11_FreeSymKey(newKey); - PR_fprintf(PR_STDERR, "%s: Couldn't set nickname on key\n", - progName); - goto shutdown; - } - } - PK11_FreeSymKey(newKey); - rv = SECSuccess; - } - -shutdown: - if (rv != SECSuccess) { - PR_fprintf(PR_STDERR, "%s: %s\n", progName, - SECU_Strerror(PORT_GetError())); - } - - if (key.data) { - PORT_Free(key.data); - } - - if (keyID.data) { - PORT_Free(keyID.data); - } - - if (slot) { - PK11_FreeSlot(slot); - } - - if (NSS_Shutdown() != SECSuccess) { - exit(1); - } - - if (rv == SECSuccess) { - return 0; - } else { - return 255; - } -} - - - |