The Tor Browser / file comparison

comparison: security/nss/cmd/signtool/util.c

security/nss/cmd/signtool/util.c

changeset 0
6474c204b198
equal deleted inserted replaced
-1:000000000000 0:31d859a48148
1 /* This Source Code Form is subject to the terms of the Mozilla Public
2 * License, v. 2.0. If a copy of the MPL was not distributed with this
3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
4
5 #include "signtool.h"
6 #include "prio.h"
7 #include "prmem.h"
8 #include "nss.h"
9
10 static int is_dir (char *filename);
11
12 /***********************************************************
13 * Nasty hackish function definitions
14 */
15
16 long *mozilla_event_queue = 0;
17
18 #ifndef XP_WIN
19 char *XP_GetString (int i)
20 {
21 return SECU_Strerror (i);
22 }
23 #endif
24
25 void FE_SetPasswordEnabled()
26 {
27 }
28
29
30 void /*MWContext*/ *FE_GetInitContext (void)
31 {
32 return 0;
33 }
34
35
36 void /*MWContext*/ *XP_FindSomeContext()
37 {
38 /* No windows context in command tools */
39 return NULL;
40 }
41
42
43 void ET_moz_CallFunction()
44 {
45 }
46
47
48 /*
49 * R e m o v e A l l A r c
50 *
51 * Remove .arc directories that are lingering
52 * from a previous run of signtool.
53 *
54 */
55 int
56 RemoveAllArc(char *tree)
57 {
58 PRDir * dir;
59 PRDirEntry * entry;
60 char *archive = NULL;
61 int retval = 0;
62
63 dir = PR_OpenDir (tree);
64 if (!dir)
65 return - 1;
66
67 for (entry = PR_ReadDir (dir, 0); entry; entry = PR_ReadDir (dir,
68 0)) {
69
70 if (entry->name[0] == '.') {
71 continue;
72 }
73
74 if (archive)
75 PR_Free(archive);
76 archive = PR_smprintf("%s/%s", tree, entry->name);
77
78 if (PL_strcaserstr (entry->name, ".arc")
79 == (entry->name + strlen(entry->name) - 4) ) {
80
81 if (verbosity >= 0) {
82 PR_fprintf(outputFD, "removing: %s\n", archive);
83 }
84
85 if (rm_dash_r(archive)) {
86 PR_fprintf(errorFD, "Error removing %s\n", archive);
87 errorCount++;
88 retval = -1;
89 goto finish;
90 }
91 } else if (is_dir(archive)) {
92 if (RemoveAllArc(archive)) {
93 retval = -1;
94 goto finish;
95 }
96 }
97 }
98
99 finish:
100 PR_CloseDir (dir);
101 if (archive)
102 PR_Free(archive);
103
104 return retval;
105 }
106
107
108 /*
109 * r m _ d a s h _ r
110 *
111 * Remove a file, or a directory recursively.
112 *
113 */
114 int rm_dash_r (char *path)
115 {
116 PRDir * dir;
117 PRDirEntry * entry;
118 PRFileInfo fileinfo;
119 char filename[FNSIZE];
120
121 if (PR_GetFileInfo(path, &fileinfo) != PR_SUCCESS) {
122 /*fprintf(stderr, "Error: Unable to access %s\n", filename);*/
123 return - 1;
124 }
125 if (fileinfo.type == PR_FILE_DIRECTORY) {
126
127 dir = PR_OpenDir(path);
128 if (!dir) {
129 PR_fprintf(errorFD, "Error: Unable to open directory %s.\n", path);
130 errorCount++;
131 return - 1;
132 }
133
134 /* Recursively delete all entries in the directory */
135 while ((entry = PR_ReadDir(dir, PR_SKIP_BOTH)) != NULL) {
136 sprintf(filename, "%s/%s", path, entry->name);
137 if (rm_dash_r(filename))
138 return - 1;
139 }
140
141 if (PR_CloseDir(dir) != PR_SUCCESS) {
142 PR_fprintf(errorFD, "Error: Could not close %s.\n", path);
143 errorCount++;
144 return - 1;
145 }
146
147 /* Delete the directory itself */
148 if (PR_RmDir(path) != PR_SUCCESS) {
149 PR_fprintf(errorFD, "Error: Unable to delete %s\n", path);
150 errorCount++;
151 return - 1;
152 }
153 } else {
154 if (PR_Delete(path) != PR_SUCCESS) {
155 PR_fprintf(errorFD, "Error: Unable to delete %s\n", path);
156 errorCount++;
157 return - 1;
158 }
159 }
160 return 0;
161 }
162
163
164 /*
165 * u s a g e
166 *
167 * Print some useful help information
168 *
169 */
170
171
172 void
173 Usage (void)
174 {
175 #define FPS PR_fprintf(outputFD,
176 FPS "%s %s -a signing tool for jar files\n", LONG_PROGRAM_NAME,NSS_VERSION);
177 FPS "\n\nType %s -H for more detailed descriptions\n", PROGRAM_NAME);
178 FPS "\nUsage: %s -k keyName [-b basename] [-c Compression Level]\n"
179 "\t\t [-d cert-dir] [-i installer script] [-m metafile] [-x name]\n"
180 "\t\t [-e extension] [-o] [-z] [-X] [--outfile] [--verbose value]\n"
181 "\t\t [--norecurse] [--leavearc] [-j directory] [-Z jarfile] [-O]\n"
182 "\t\t [-p password] directory-tree\n", PROGRAM_NAME);
183 FPS "\t%s -J -k keyName [-b basename] [-c Compression Level]\n"
184 "\t\t [-d cert-dir][-i installer script] [-m metafile] [-x name]\n"
185 "\t\t [-e extension] [-o] [-z] [-X] [--outfile] [--verbose value]\n"
186 "\t\t [--norecurse] [--leavearc] [-j directory] [-p password] [-O] \n"
187 "\t\t directory-tree\n", PROGRAM_NAME);
188 FPS "\t%s -h \n", PROGRAM_NAME);
189 FPS "\t%s -H \n", PROGRAM_NAME);
190 FPS "\t%s -l [-k keyName] [-d cert-dir] [--outfile] [-O] \n", PROGRAM_NAME);
191 FPS "\t%s -L [-k keyName] [-d cert-dir] [--outfile] [-O] \n", PROGRAM_NAME);
192 FPS "\t%s -M [--outfile] [-O] \n", PROGRAM_NAME);
193 FPS "\t%s -v [-d cert-dir] [--outfile] [-O] archive\n", PROGRAM_NAME);
194 FPS "\t%s -w [--outfile] [-O] archive\n" , PROGRAM_NAME);
195 FPS "\t%s -G nickname [--keysize|-s size] [-t |--token tokenname]\n"
196 "\t\t [--outfile] [-O] \n", PROGRAM_NAME);
197 FPS "\t%s -f filename\n" , PROGRAM_NAME);
198 exit (ERRX);
199 }
200
201 void
202 LongUsage(void)
203 {
204 FPS "%s %s -a signing tool for jar files\n", LONG_PROGRAM_NAME,NSS_VERSION);
205 FPS "\n%-20s Signs the directory-tree\n",
206 "signtool directory-tree");
207 FPS "%-30s Nickname (key) of the certificate to sign with\n",
208 " -k keyname");
209 FPS "%-30s Base filename for the .rsa and.sf files in the\n",
210 " -b basename");
211 FPS "%-30s META-INF directory\n"," ");
212 FPS "%-30s Set the compression level. 0-9, 0=none\n",
213 " -c CompressionLevel");
214 FPS "%-30s Certificate database directory containing cert*db\n",
215 " -d certificate directory");
216 FPS "%-30s and key*db\n"," ");
217 FPS "%-30s Name of the installer script for SmartUpdate\n",
218 " -i installer script");
219 FPS "%-30s Name of a metadata control file\n",
220 " -m metafile");
221 FPS "%-30s For optimizing the archive for size.\n",
222 " -o");
223 FPS "%-30s Omit Optional Headers\n"," ");
224 FPS "%-30s Excludes the specified directory or file from\n",
225 " -x directory or file name");
226 FPS "%-30s signing\n"," ");
227 FPS "%-30s To not store the signing time in digital\n",
228 " -z directory or file name");
229 FPS "%-30s signature\n"," ");
230 FPS "%-30s Create XPI Compatible Archive. It requires -Z\n",
231 " -X directory or file name");
232 FPS "%-30s option\n"," ");
233 FPS "%-30s Sign only files with the given extension\n",
234 " -e");
235 FPS "%-30s Causes the specified directory to be signed and\n",
236 " -j");
237 FPS "%-30s tags its entries as inline JavaScript\n"," ");
238 FPS "%-30s Creates a JAR file with the specified name.\n",
239 " -Z");
240 FPS "%-30s -Z option cannot be used with -J option\n"," ");
241 FPS "%-30s Specifies a password for the private-key database\n",
242 " -p");
243 FPS "%-30s (insecure)\n"," ");
244 FPS "%-30s File to receive redirected output\n",
245 " --outfile filename");
246 FPS "%-30s Sets the quantity of information generated in\n",
247 " --verbosity value");
248 FPS "%-30s operation\n"," ");
249 FPS "%-30s Blocks recursion into subdirectories\n",
250 " --norecurse");
251 FPS "%-30s Retains the temporary .arc (archive) directories\n",
252 " --leavearc");
253 FPS "%-30s -J option creates\n"," ");
254
255 FPS "\n%-20s Signs a directory of HTML files containing JavaScript and\n",
256 "-J" );
257 FPS "%-20s creates as many archive files as are in the HTML tags.\n"," ");
258
259 FPS "%-20s The options are same as without any command option given\n"," ");
260 FPS "%-20s above. -Z and -J options are not allowed together\n"," ");
261
262 FPS "\n%-20s Generates a new private-public key pair and corresponding\n",
263 "-G nickname");
264 FPS "%-20s object-signing certificates with the given nickname\n"," ");
265 FPS "%-30s Specifies the size of the key for generated \n",
266 " --keysize|-s keysize");
267 FPS "%-30s certificate\n"," ");
268 FPS "%-30s Specifies which available token should generate\n",
269 " --token|-t token name ");
270 FPS "%-30s the key and receive the certificate\n"," ");
271 FPS "%-30s Specifies a file to receive redirected output\n",
272 " --outfile filename ");
273
274 FPS "\n%-20s Display signtool help\n",
275 "-h ");
276
277 FPS "\n%-20s Display signtool help(Detailed)\n",
278 "-H ");
279
280 FPS "\n%-20s Lists signing certificates, including issuing CAs\n",
281 "-l ");
282 FPS "%-30s Certificate database directory containing cert*db\n",
283 " -d certificate directory");
284 FPS "%-30s and key*db\n"," ");
285
286 FPS "%-30s Specifies a file to receive redirected output\n",
287 " --outfile filename ");
288 FPS "%-30s Specifies the nickname (key) of the certificate\n",
289 " -k keyname");
290
291
292 FPS "\n%-20s Lists the certificates in your database\n",
293 "-L ");
294 FPS "%-30s Certificate database directory containing cert*db\n",
295 " -d certificate directory");
296 FPS "%-30s and key*db\n"," ");
297
298 FPS "%-30s Specifies a file to receive redirected output\n",
299 " --outfile filename ");
300 FPS "%-30s Specifies the nickname (key) of the certificate\n",
301 " -k keyname");
302
303 FPS "\n%-20s Lists the PKCS #11 modules available to signtool\n",
304 "-M ");
305
306 FPS "\n%-20s Displays the contents of an archive and verifies\n",
307 "-v archive");
308 FPS "%-20s cryptographic integrity\n"," ");
309 FPS "%-30s Certificate database directory containing cert*db\n",
310 " -d certificate directory");
311 FPS "%-30s and key*db\n"," ");
312 FPS "%-30s Specifies a file to receive redirected output\n",
313 " --outfile filename ");
314
315 FPS "\n%-20s Displays the names of signers in the archive\n",
316 "-w archive");
317 FPS "%-30s Specifies a file to receive redirected output\n",
318 " --outfile filename ");
319
320
321 FPS "\n%-30s Common option to all the above.\n",
322 " -O");
323 FPS "%-30s Enable OCSP checking\n"," ");
324
325 FPS "\n%-20s Specifies a text file containing options and arguments in\n",
326 "-f command-file");
327 FPS "%-20s keyword=value format. Commands are taken from this file\n"," ");
328
329 FPS "\n\n\n");
330 FPS "Example:\n");
331 FPS "%-10s -d \"certificate directory\" -k \"certnickname\" \\",
332 PROGRAM_NAME);
333 FPS "\n%-10s -p \"password\" -X -Z \"file.xpi\" directory-tree\n"," " );
334 FPS "Common syntax to create an XPInstall compatible"
335 " signed archive\n\n"," ");
336 FPS "\nCommand File Keywords and Example:\n");
337 FPS "\nKeyword\t\tValue\n");
338 FPS "basename\tSame as -b option\n");
339 FPS "compression\tSame as -c option\n");
340 FPS "certdir\t\tSame as -d option\n");
341 FPS "extension\tSame as -e option\n");
342 FPS "generate\tSame as -G option\n");
343 FPS "installscript\tSame as -i option\n");
344 FPS "javascriptdir\tSame as -j option\n");
345 FPS "htmldir\t\tSame as -J option\n");
346 FPS "certname\tNickname of certificate, as with -k option\n");
347 FPS "signdir\t\tThe directory to be signed, as with -k option\n");
348 FPS "list\t\tSame as -l option. Value is ignored,\n"
349 " \t\tbut = sign must be present\n");
350 FPS "listall\t\tSame as -L option. Value is ignored\n"
351 " \t\tbut = sign must be present\n");
352 FPS "metafile\tSame as -m option\n");
353 FPS "modules\t\tSame as -M option. Value is ignored,\n"
354 " \t\tbut = sign must be present\n");
355 FPS "optimize\tSame as -o option. Value is ignored,\n"
356 " \tbut = sign must be present\n");
357 FPS "ocsp\t\tSame as -O option\n");
358 FPS "password\tSame as -p option\n");
359 FPS "verify\t\tSame as -v option\n");
360 FPS "who\t\tSame as -w option\n");
361 FPS "exclude\t\tSame as -x option\n");
362 FPS "notime\t\tSame as -z option. Value is ignored,\n"
363 " \t\tbut = sign must be present\n");
364 FPS "jarfile\t\tSame as -Z option\n");
365 FPS "outfile\t\tSame as --outfile option. The argument\n");
366 FPS " \t\tis the name of a file to which output\n");
367 FPS " \t\tof a file and error messages will be \n");
368 FPS " \t\tredirected\n");
369 FPS "leavearc\tSame as --leavearc option\n");
370 FPS "verbosity\tSame as --verbosity option\n");
371 FPS "keysize\t\tSame as -s option\n");
372 FPS "token\t\tSame as -t option\n");
373 FPS "xpi\t\tSame as -X option\n");
374 FPS "\n\n");
375 FPS "Here's an example of the use of the command file. The command\n\n");
376 FPS " signtool -d c:\\netscape\\users\\james -k mycert -Z myjar.jar \\\n"
377 " signdir > output.txt\n\n");
378 FPS "becomes\n\n");
379 FPS " signtool -f somefile\n\n");
380 FPS "where somefile contains the following lines:\n\n");
381 FPS " certdir=c:\\netscape\\users\\james\n"," ");
382 FPS " certname=mycert\n"," ");
383 FPS " jarfile=myjar.jar\n"," ");
384 FPS " signdir=signdir\n"," ");
385 FPS " outfile=output.txt\n"," ");
386 exit (ERRX);
387 #undef FPS
388 }
389
390 /*
391 * p r i n t _ e r r o r
392 *
393 * For the undocumented -E function. If an older version
394 * of communicator gives you a numeric error, we can see what
395 * really happened without doing hex math.
396 *
397 */
398
399 void
400 print_error (int err)
401 {
402 PR_fprintf(errorFD, "Error %d: %s\n", err, JAR_get_error (err));
403 errorCount++;
404 give_help (err);
405 }
406
407
408 /*
409 * o u t _ o f _ m e m o r y
410 *
411 * Out of memory, exit Signtool.
412 *
413 */
414 void
415 out_of_memory (void)
416 {
417 PR_fprintf(errorFD, "%s: out of memory\n", PROGRAM_NAME);
418 errorCount++;
419 exit (ERRX);
420 }
421
422
423 /*
424 * V e r i f y C e r t D i r
425 *
426 * Validate that the specified directory
427 * contains a certificate database
428 *
429 */
430 void
431 VerifyCertDir(char *dir, char *keyName)
432 {
433 char fn [FNSIZE];
434
435 /* don't try verifying if we don't have a local directory */
436 if (strncmp(dir, "multiaccess:", sizeof("multiaccess:") - 1) == 0) {
437 return;
438 }
439 /* this function is truly evil. Tools and applications should not have
440 * any knowledge of actual cert databases! */
441 return;
442
443 /* This code is really broken because it makes underlying assumptions about
444 * how the NSS profile directory is laid out, but these names can change
445 * from release to release. */
446 sprintf (fn, "%s/cert8.db", dir);
447
448 if (PR_Access (fn, PR_ACCESS_EXISTS)) {
449 PR_fprintf(errorFD, "%s: No certificate database in \"%s\"\n",
450 PROGRAM_NAME, dir);
451 PR_fprintf(errorFD, "%s: Check the -d arguments that you gave\n",
452 PROGRAM_NAME);
453 errorCount++;
454 exit (ERRX);
455 }
456
457 if (verbosity >= 0) {
458 PR_fprintf(outputFD, "using certificate directory: %s\n", dir);
459 }
460
461 if (keyName == NULL)
462 return;
463
464 /* if the user gave the -k key argument, verify that
465 a key database already exists */
466
467 sprintf (fn, "%s/key3.db", dir);
468
469 if (PR_Access (fn, PR_ACCESS_EXISTS)) {
470 PR_fprintf(errorFD, "%s: No private key database in \"%s\"\n",
471 PROGRAM_NAME,
472 dir);
473 PR_fprintf(errorFD, "%s: Check the -d arguments that you gave\n",
474 PROGRAM_NAME);
475 errorCount++;
476 exit (ERRX);
477 }
478 }
479
480
481 /*
482 * f o r e a c h
483 *
484 * A recursive function to loop through all names in
485 * the specified directory, as well as all subdirectories.
486 *
487 * FIX: Need to see if all platforms allow multiple
488 * opendir's to be called.
489 *
490 */
491
492 int
493 foreach(char *dirname, char *prefix,
494 int (*fn)(char *relpath, char *basedir, char *reldir, char *filename,
495 void*arg),
496 PRBool recurse, PRBool includeDirs, void *arg)
497 {
498 char newdir [FNSIZE];
499 int retval = 0;
500
501 PRDir * dir;
502 PRDirEntry * entry;
503
504 strcpy (newdir, dirname);
505 if (*prefix) {
506 strcat (newdir, "/");
507 strcat (newdir, prefix);
508 }
509
510 dir = PR_OpenDir (newdir);
511 if (!dir)
512 return - 1;
513
514 for (entry = PR_ReadDir (dir, 0); entry; entry = PR_ReadDir (dir, 0)) {
515 if ( strcmp(entry->name, ".") == 0 ||
516 strcmp(entry->name, "..") == 0 ) {
517 /* no infinite recursion, please */
518 continue;
519 }
520
521 /* can't sign self */
522 if (!strcmp (entry->name, "META-INF"))
523 continue;
524
525 /* -x option */
526 if (PL_HashTableLookup(excludeDirs, entry->name))
527 continue;
528
529 strcpy (newdir, dirname);
530 if (*dirname)
531 strcat (newdir, "/");
532
533 if (*prefix) {
534 strcat (newdir, prefix);
535 strcat (newdir, "/");
536 }
537 strcat (newdir, entry->name);
538
539 if (!is_dir(newdir) || includeDirs) {
540 char newpath [FNSIZE];
541
542 strcpy (newpath, prefix);
543 if (*newpath)
544 strcat (newpath, "/");
545 strcat (newpath, entry->name);
546
547 if ( (*fn) (newpath, dirname, prefix, (char *) entry->name,
548 arg)) {
549 retval = -1;
550 break;
551 }
552 }
553
554 if (is_dir (newdir)) {
555 if (recurse) {
556 char newprefix [FNSIZE];
557
558 strcpy (newprefix, prefix);
559 if (*newprefix) {
560 strcat (newprefix, "/");
561 }
562 strcat (newprefix, entry->name);
563
564 if (foreach (dirname, newprefix, fn, recurse,
565 includeDirs, arg)) {
566 retval = -1;
567 break;
568 }
569 }
570 }
571
572 }
573
574 PR_CloseDir (dir);
575
576 return retval;
577 }
578
579
580 /*
581 * i s _ d i r
582 *
583 * Return 1 if file is a directory.
584 * Wonder if this runs on a mac, trust not.
585 *
586 */
587 static int is_dir (char *filename)
588 {
589 PRFileInfo finfo;
590
591 if ( PR_GetFileInfo(filename, &finfo) != PR_SUCCESS ) {
592 printf("Unable to get information about %s\n", filename);
593 return 0;
594 }
595
596 return ( finfo.type == PR_FILE_DIRECTORY );
597 }
598
599
600 /***************************************************************
601 *
602 * s e c E r r o r S t r i n g
603 *
604 * Returns an error string corresponding to the given error code.
605 * Doesn't cover all errors; returns a default for many.
606 * Returned string is only valid until the next call of this function.
607 */
608 const char *
609 secErrorString(long code)
610 {
611 static char errstring[80]; /* dynamically constructed error string */
612 char *c; /* the returned string */
613
614 switch (code) {
615 case SEC_ERROR_IO:
616 c = "io error";
617 break;
618 case SEC_ERROR_LIBRARY_FAILURE:
619 c = "security library failure";
620 break;
621 case SEC_ERROR_BAD_DATA:
622 c = "bad data";
623 break;
624 case SEC_ERROR_OUTPUT_LEN:
625 c = "output length";
626 break;
627 case SEC_ERROR_INPUT_LEN:
628 c = "input length";
629 break;
630 case SEC_ERROR_INVALID_ARGS:
631 c = "invalid args";
632 break;
633 case SEC_ERROR_EXPIRED_CERTIFICATE:
634 c = "expired certificate";
635 break;
636 case SEC_ERROR_REVOKED_CERTIFICATE:
637 c = "revoked certificate";
638 break;
639 case SEC_ERROR_INADEQUATE_KEY_USAGE:
640 c = "inadequate key usage";
641 break;
642 case SEC_ERROR_INADEQUATE_CERT_TYPE:
643 c = "inadequate certificate type";
644 break;
645 case SEC_ERROR_UNTRUSTED_CERT:
646 c = "untrusted cert";
647 break;
648 case SEC_ERROR_NO_KRL:
649 c = "no key revocation list";
650 break;
651 case SEC_ERROR_KRL_BAD_SIGNATURE:
652 c = "key revocation list: bad signature";
653 break;
654 case SEC_ERROR_KRL_EXPIRED:
655 c = "key revocation list expired";
656 break;
657 case SEC_ERROR_REVOKED_KEY:
658 c = "revoked key";
659 break;
660 case SEC_ERROR_CRL_BAD_SIGNATURE:
661 c = "certificate revocation list: bad signature";
662 break;
663 case SEC_ERROR_CRL_EXPIRED:
664 c = "certificate revocation list expired";
665 break;
666 case SEC_ERROR_CRL_NOT_YET_VALID:
667 c = "certificate revocation list not yet valid";
668 break;
669 case SEC_ERROR_UNKNOWN_ISSUER:
670 c = "unknown issuer";
671 break;
672 case SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE:
673 c = "expired issuer certificate";
674 break;
675 case SEC_ERROR_BAD_SIGNATURE:
676 c = "bad signature";
677 break;
678 case SEC_ERROR_BAD_KEY:
679 c = "bad key";
680 break;
681 case SEC_ERROR_NOT_FORTEZZA_ISSUER:
682 c = "not fortezza issuer";
683 break;
684 case SEC_ERROR_CA_CERT_INVALID:
685 c = "Certificate Authority certificate invalid";
686 break;
687 case SEC_ERROR_EXTENSION_NOT_FOUND:
688 c = "extension not found";
689 break;
690 case SEC_ERROR_CERT_NOT_IN_NAME_SPACE:
691 c = "certificate not in name space";
692 break;
693 case SEC_ERROR_UNTRUSTED_ISSUER:
694 c = "untrusted issuer";
695 break;
696 default:
697 sprintf(errstring, "security error %ld", code);
698 c = errstring;
699 break;
700 }
701
702 return c;
703 }
704
705
706 /***************************************************************
707 *
708 * d i s p l a y V e r i f y L o g
709 *
710 * Prints the log of a cert verification.
711 */
712 void
713 displayVerifyLog(CERTVerifyLog *log)
714 {
715 CERTVerifyLogNode * node;
716 CERTCertificate * cert;
717 char *name;
718
719 if ( !log || (log->count <= 0) ) {
720 return;
721 }
722
723 for (node = log->head; node != NULL; node = node->next) {
724
725 if ( !(cert = node->cert) ) {
726 continue;
727 }
728
729 /* Get a name for this cert */
730 if (cert->nickname != NULL) {
731 name = cert->nickname;
732 } else if (cert->emailAddr && cert->emailAddr[0]) {
733 name = cert->emailAddr;
734 } else {
735 name = cert->subjectName;
736 }
737
738 printf( "%s%s:\n", name,
739 (node->depth > 0) ? " [Certificate Authority]" : "");
740
741 printf("\t%s\n", secErrorString(node->error));
742
743 }
744 }
745
746
747 /*
748 * J a r L i s t M o d u l e s
749 *
750 * Print a list of the PKCS11 modules that are
751 * available. This is useful for smartcard people to
752 * make sure they have the drivers loaded.
753 *
754 */
755 void
756 JarListModules(void)
757 {
758 int i;
759 int count = 0;
760
761 SECMODModuleList * modules = NULL;
762 static SECMODListLock *moduleLock = NULL;
763
764 SECMODModuleList * mlp;
765
766 if ((moduleLock = SECMOD_GetDefaultModuleListLock()) == NULL) {
767 /* this is the wrong text */
768 PR_fprintf(errorFD, "%s: unable to acquire lock on module list\n",
769 PROGRAM_NAME);
770 errorCount++;
771 exit (ERRX);
772 }
773
774 SECMOD_GetReadLock (moduleLock);
775
776 modules = SECMOD_GetDefaultModuleList();
777
778 if (modules == NULL) {
779 SECMOD_ReleaseReadLock (moduleLock);
780 PR_fprintf(errorFD, "%s: Can't get module list\n", PROGRAM_NAME);
781 errorCount++;
782 exit (ERRX);
783 }
784
785 PR_fprintf(outputFD, "\nListing of PKCS11 modules\n");
786 PR_fprintf(outputFD, "-----------------------------------------------\n");
787
788 for (mlp = modules; mlp != NULL; mlp = mlp->next) {
789 count++;
790 PR_fprintf(outputFD, "%3d. %s\n", count, mlp->module->commonName);
791
792 if (mlp->module->internal)
793 PR_fprintf(outputFD, " (this module is internally loaded)\n");
794 else
795 PR_fprintf(outputFD, " (this is an external module)\n");
796
797 if (mlp->module->dllName)
798 PR_fprintf(outputFD, " DLL name: %s\n",
799 mlp->module->dllName);
800
801 if (mlp->module->slotCount == 0)
802 PR_fprintf(outputFD, " slots: There are no slots attached to this module\n");
803 else
804 PR_fprintf(outputFD, " slots: %d slots attached\n",
805 mlp->module->slotCount);
806
807 if (mlp->module->loaded == 0)
808 PR_fprintf(outputFD, " status: Not loaded\n");
809 else
810 PR_fprintf(outputFD, " status: loaded\n");
811
812 for (i = 0; i < mlp->module->slotCount; i++) {
813 PK11SlotInfo * slot = mlp->module->slots[i];
814
815 PR_fprintf(outputFD, "\n");
816 PR_fprintf(outputFD, " slot: %s\n", PK11_GetSlotName(slot));
817 PR_fprintf(outputFD, " token: %s\n", PK11_GetTokenName(slot));
818 }
819 }
820
821 PR_fprintf(outputFD, "-----------------------------------------------\n");
822
823 if (count == 0)
824 PR_fprintf(outputFD,
825 "Warning: no modules were found (should have at least one)\n");
826
827 SECMOD_ReleaseReadLock (moduleLock);
828 }
829
830
831 /**********************************************************************
832 * c h o p
833 *
834 * Eliminates leading and trailing whitespace. Returns a pointer to the
835 * beginning of non-whitespace, or an empty string if it's all whitespace.
836 */
837 char*
838 chop(char *str)
839 {
840 char *start, *end;
841
842 if (str) {
843 start = str;
844
845 /* Nip leading whitespace */
846 while (isspace(*start)) {
847 start++;
848 }
849
850 /* Nip trailing whitespace */
851 if (*start) {
852 end = start + strlen(start) - 1;
853 while (isspace(*end) && end > start) {
854 end--;
855 }
856 *(end + 1) = '\0';
857 }
858
859 return start;
860 } else {
861 return NULL;
862 }
863 }
864
865
866 /***********************************************************************
867 *
868 * F a t a l E r r o r
869 *
870 * Outputs an error message and bails out of the program.
871 */
872 void
873 FatalError(char *msg)
874 {
875 if (!msg)
876 msg = "";
877
878 PR_fprintf(errorFD, "FATAL ERROR: %s\n", msg);
879 errorCount++;
880 exit(ERRX);
881 }
882
883
884 /*************************************************************************
885 *
886 * I n i t C r y p t o
887 */
888 int
889 InitCrypto(char *cert_dir, PRBool readOnly)
890 {
891 SECStatus rv;
892 static int prior = 0;
893 PK11SlotInfo * slotinfo;
894
895 if (prior == 0) {
896 /* some functions such as OpenKeyDB expect this path to be
897 * implicitly set prior to calling */
898 if (readOnly) {
899 rv = NSS_Init(cert_dir);
900 } else {
901 rv = NSS_InitReadWrite(cert_dir);
902 }
903 if (rv != SECSuccess) {
904 SECU_PrintPRandOSError(PROGRAM_NAME);
905 exit(-1);
906 }
907
908 SECU_ConfigDirectory (cert_dir);
909
910 /* Been there done that */
911 prior++;
912
913 PK11_SetPasswordFunc(SECU_GetModulePassword);
914
915 /* Must login to FIPS before you do anything else */
916 if (PK11_IsFIPS()) {
917 slotinfo = PK11_GetInternalSlot();
918 if (!slotinfo) {
919 fprintf(stderr, "%s: Unable to get PKCS #11 Internal Slot."
920 "\n", PROGRAM_NAME);
921 return - 1;
922 }
923 if (PK11_Authenticate(slotinfo, PR_FALSE /*loadCerts*/,
924 &pwdata) != SECSuccess) {
925 fprintf(stderr, "%s: Unable to authenticate to %s.\n",
926 PROGRAM_NAME, PK11_GetSlotName(slotinfo));
927 PK11_FreeSlot(slotinfo);
928 return - 1;
929 }
930 PK11_FreeSlot(slotinfo);
931 }
932
933 /* Make sure there is a password set on the internal key slot */
934 slotinfo = PK11_GetInternalKeySlot();
935 if (!slotinfo) {
936 fprintf(stderr, "%s: Unable to get PKCS #11 Internal Key Slot."
937 "\n", PROGRAM_NAME);
938 return - 1;
939 }
940 if (PK11_NeedUserInit(slotinfo)) {
941 PR_fprintf(errorFD,
942 "\nWARNING: No password set on internal key database. Most operations will fail."
943 "\nYou must create a password.\n");
944 warningCount++;
945 }
946
947 /* Make sure we can authenticate to the key slot in FIPS mode */
948 if (PK11_IsFIPS()) {
949 if (PK11_Authenticate(slotinfo, PR_FALSE /*loadCerts*/,
950 &pwdata) != SECSuccess) {
951 fprintf(stderr, "%s: Unable to authenticate to %s.\n",
952 PROGRAM_NAME, PK11_GetSlotName(slotinfo));
953 PK11_FreeSlot(slotinfo);
954 return - 1;
955 }
956 }
957 PK11_FreeSlot(slotinfo);
958 }
959
960 return 0;
961 }
962
963
964 /* Windows foolishness is now in the secutil lib */
965
966 /*****************************************************************
967 * g e t _ d e f a u l t _ c e r t _ d i r
968 *
969 * Attempt to locate a certificate directory.
970 * Failing that, complain that the user needs to
971 * use the -d(irectory) parameter.
972 *
973 */
974 char *get_default_cert_dir (void)
975 {
976 char *home;
977
978 char *cd = NULL;
979 static char db [FNSIZE];
980
981 #ifdef XP_UNIX
982 home = getenv ("HOME");
983
984 if (home && *home) {
985 sprintf (db, "%s/.netscape", home);
986 cd = db;
987 }
988 #endif
989
990 #ifdef XP_PC
991 FILE * fp;
992
993 /* first check the environment override */
994
995 home = getenv ("JAR_HOME");
996
997 if (home && *home) {
998 sprintf (db, "%s/cert7.db", home);
999
1000 if ((fp = fopen (db, "r")) != NULL) {
1001 fclose (fp);
1002 cd = home;
1003 }
1004 }
1005
1006 /* try the old navigator directory */
1007
1008 if (cd == NULL) {
1009 home = "c:/Program Files/Netscape/Navigator";
1010
1011 sprintf (db, "%s/cert7.db", home);
1012
1013 if ((fp = fopen (db, "r")) != NULL) {
1014 fclose (fp);
1015 cd = home;
1016 }
1017 }
1018
1019 /* Try the current directory, I wonder if this
1020 is really a good idea. Remember, Windows only.. */
1021
1022 if (cd == NULL) {
1023 home = ".";
1024
1025 sprintf (db, "%s/cert7.db", home);
1026
1027 if ((fp = fopen (db, "r")) != NULL) {
1028 fclose (fp);
1029 cd = home;
1030 }
1031 }
1032
1033 #endif
1034
1035 if (!cd) {
1036 PR_fprintf(errorFD,
1037 "You must specify the location of your certificate directory\n");
1038 PR_fprintf(errorFD,
1039 "with the -d option. Example: -d ~/.netscape in many cases with Unix.\n");
1040 errorCount++;
1041 exit (ERRX);
1042 }
1043
1044 return cd;
1045 }
1046
1047
1048 /************************************************************************
1049 * g i v e _ h e l p
1050 */
1051 void give_help (int status)
1052 {
1053 if (status == SEC_ERROR_UNKNOWN_ISSUER) {
1054 PR_fprintf(errorFD,
1055 "The Certificate Authority (CA) for this certificate\n");
1056 PR_fprintf(errorFD,
1057 "does not appear to be in your database. You should contact\n");
1058 PR_fprintf(errorFD,
1059 "the organization which issued this certificate to obtain\n");
1060 PR_fprintf(errorFD, "a copy of its CA Certificate.\n");
1061 }
1062 }
1063
1064
1065 /**************************************************************************
1066 *
1067 * p r _ f g e t s
1068 *
1069 * fgets implemented with NSPR.
1070 */
1071 char*
1072 pr_fgets(char *buf, int size, PRFileDesc *file)
1073 {
1074 int i;
1075 int status;
1076 char c;
1077
1078 i = 0;
1079 while (i < size - 1) {
1080 status = PR_Read(file, &c, 1);
1081 if (status == -1) {
1082 return NULL;
1083 } else if (status == 0) {
1084 if (i == 0) {
1085 return NULL;
1086 }
1087 break;
1088 }
1089 buf[i++] = c;
1090 if (c == '\n') {
1091 break;
1092 }
1093 }
1094 buf[i] = '\0';
1095
1096 return buf;
1097 }
1098
1099

Mercurial Repository: The Tor Browser

Europalab SCM Repository Server

mercurial