michael@0: /* This Source Code Form is subject to the terms of the Mozilla Public
michael@0:  * License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0:  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0: /*
michael@0:  * Internal PKCS #11 functions. Should only be called by pkcs11.c
michael@0:  */
michael@0: #include "pkcs11.h"
michael@0: #include "lgdb.h"
michael@0: 
michael@0: #include "pcertt.h"
michael@0: #include "lowkeyi.h"
michael@0: #include "pcert.h"
michael@0: #include "blapi.h"
michael@0: #include "secerr.h"
michael@0: #include "secasn1.h"
michael@0: 
michael@0: /*
michael@0:  * Cache the object we are working on during Set's and Get's
michael@0:  */
michael@0: typedef struct LGObjectCacheStr {
michael@0:     CK_OBJECT_CLASS  objclass;
michael@0:     CK_OBJECT_HANDLE handle;
michael@0:     SDB              *sdb;
michael@0:     void             *objectInfo;
michael@0:     LGFreeFunc       infoFree;
michael@0:     SECItem          dbKey;
michael@0: } LGObjectCache;
michael@0: 
michael@0: static const CK_OBJECT_HANDLE lg_classArray[] = {
michael@0:     0, CKO_PRIVATE_KEY, CKO_PUBLIC_KEY, CKO_SECRET_KEY,
michael@0:     CKO_NSS_TRUST, CKO_NSS_CRL, CKO_NSS_SMIME,
michael@0:      CKO_CERTIFICATE };
michael@0: 
michael@0: #define handleToClass(handle) \
michael@0:     lg_classArray[((handle & LG_TOKEN_TYPE_MASK))>>LG_TOKEN_TYPE_SHIFT]
michael@0: 
michael@0: 
michael@0: static void lg_DestroyObjectCache(LGObjectCache *obj);
michael@0: 
michael@0: static LGObjectCache *
michael@0: lg_NewObjectCache(SDB *sdb, const SECItem *dbKey, CK_OBJECT_HANDLE handle)
michael@0: {
michael@0:     LGObjectCache *obj = NULL;
michael@0:     SECStatus rv;
michael@0: 
michael@0:     obj = PORT_New(LGObjectCache);
michael@0:     if (obj == NULL) {
michael@0: 	return NULL;
michael@0:     }
michael@0: 
michael@0:     obj->objclass = handleToClass(handle);
michael@0:     obj->handle = handle;
michael@0:     obj->sdb = sdb;
michael@0:     obj->objectInfo = NULL;
michael@0:     obj->infoFree = NULL;
michael@0:     obj->dbKey.data = NULL;
michael@0:     obj->dbKey.len = 0;
michael@0:     lg_DBLock(sdb);
michael@0:     if (dbKey == NULL) {
michael@0: 	dbKey = lg_lookupTokenKeyByHandle(sdb,handle);
michael@0:     }
michael@0:     if (dbKey == NULL) {
michael@0: 	lg_DBUnlock(sdb);
michael@0: 	goto loser;
michael@0:     }
michael@0:     rv = SECITEM_CopyItem(NULL,&obj->dbKey,dbKey);
michael@0:     lg_DBUnlock(sdb);
michael@0:     if (rv != SECSuccess) {
michael@0: 	goto loser;
michael@0:     }
michael@0: 
michael@0:     return obj;
michael@0: loser:
michael@0:     if (obj) {
michael@0: 	(void) lg_DestroyObjectCache(obj);
michael@0:     }
michael@0:     return NULL;
michael@0: 
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * free all the data associated with an object. Object reference count must
michael@0:  * be 'zero'.
michael@0:  */
michael@0: static void
michael@0: lg_DestroyObjectCache(LGObjectCache *obj)
michael@0: {
michael@0:     if (obj->dbKey.data) {
michael@0: 	PORT_Free(obj->dbKey.data);
michael@0: 	obj->dbKey.data = NULL;
michael@0:     } 
michael@0:     if (obj->objectInfo) {
michael@0: 	(*obj->infoFree)(obj->objectInfo);
michael@0: 	obj->objectInfo = NULL;
michael@0: 	obj->infoFree = NULL;
michael@0:     }
michael@0:     PORT_Free(obj);
michael@0: }
michael@0: /*
michael@0:  * ******************** Attribute Utilities *******************************
michael@0:  */
michael@0: 
michael@0: static CK_RV
michael@0: lg_ULongAttribute(CK_ATTRIBUTE *attr, CK_ATTRIBUTE_TYPE type, CK_ULONG value)
michael@0: {
michael@0:     unsigned char *data;
michael@0:     int i;
michael@0: 
michael@0:     if (attr->pValue == NULL) {
michael@0: 	attr->ulValueLen = 4;
michael@0: 	return CKR_OK;
michael@0:     }
michael@0:     if (attr->ulValueLen < 4) {
michael@0: 	attr->ulValueLen = (CK_ULONG) -1;
michael@0: 	return CKR_BUFFER_TOO_SMALL;
michael@0:     }
michael@0: 
michael@0:     data = (unsigned char *)attr->pValue;
michael@0:     for (i=0; i < 4; i++) {
michael@0: 	data[i] = (value >> ((3-i)*8)) & 0xff;
michael@0:     }
michael@0:     attr->ulValueLen = 4;
michael@0:     return CKR_OK;
michael@0: }
michael@0: 
michael@0: static CK_RV
michael@0: lg_CopyAttribute(CK_ATTRIBUTE *attr, CK_ATTRIBUTE_TYPE type, 
michael@0: 				CK_VOID_PTR value, CK_ULONG len)
michael@0: {
michael@0: 
michael@0:     if (attr->pValue == NULL) {
michael@0: 	attr->ulValueLen = len;
michael@0: 	return CKR_OK;
michael@0:     }
michael@0:     if (attr->ulValueLen < len) {
michael@0: 	attr->ulValueLen = (CK_ULONG) -1;
michael@0: 	return CKR_BUFFER_TOO_SMALL;
michael@0:     }
michael@0:     PORT_Memcpy(attr->pValue,value,len);
michael@0:     attr->ulValueLen = len;
michael@0:     return CKR_OK;
michael@0: }
michael@0: 
michael@0: static CK_RV
michael@0: lg_CopyAttributeSigned(CK_ATTRIBUTE *attribute, CK_ATTRIBUTE_TYPE type, 
michael@0: 				void  *value, CK_ULONG len)
michael@0: {
michael@0:     unsigned char * dval = (unsigned char *)value;
michael@0:     if (*dval == 0) {
michael@0: 	dval++;
michael@0: 	len--;
michael@0:     }
michael@0:     return lg_CopyAttribute(attribute,type,dval,len);
michael@0: }
michael@0: 
michael@0: static CK_RV
michael@0: lg_CopyPrivAttribute(CK_ATTRIBUTE *attribute, CK_ATTRIBUTE_TYPE type, 
michael@0: 				void  *value, CK_ULONG len, SDB *sdbpw)
michael@0: {
michael@0:     SECItem plainText, *cipherText = NULL;
michael@0:     CK_RV crv = CKR_USER_NOT_LOGGED_IN;
michael@0:     SECStatus rv;
michael@0: 
michael@0:     plainText.data = value;
michael@0:     plainText.len = len;
michael@0:     rv = lg_util_encrypt(NULL, sdbpw, &plainText, &cipherText);
michael@0:     if (rv != SECSuccess) {
michael@0: 	goto loser;
michael@0:     }
michael@0:     crv = lg_CopyAttribute(attribute,type,cipherText->data,cipherText->len);
michael@0: loser:
michael@0:     if (cipherText) {
michael@0: 	SECITEM_FreeItem(cipherText,PR_TRUE);
michael@0:     }
michael@0:     return crv;
michael@0: }
michael@0: 
michael@0: static CK_RV
michael@0: lg_CopyPrivAttrSigned(CK_ATTRIBUTE *attribute, CK_ATTRIBUTE_TYPE type, 
michael@0: 				void  *value, CK_ULONG len, SDB *sdbpw)
michael@0: {
michael@0:     unsigned char * dval = (unsigned char *)value;
michael@0: 
michael@0:     if (*dval == 0) {
michael@0: 	dval++;
michael@0: 	len--;
michael@0:     }
michael@0:     return lg_CopyPrivAttribute(attribute,type,dval,len,sdbpw);
michael@0: }
michael@0: 
michael@0: static CK_RV
michael@0: lg_invalidAttribute(CK_ATTRIBUTE *attr)
michael@0: {
michael@0:     attr->ulValueLen = (CK_ULONG) -1;
michael@0:     return CKR_ATTRIBUTE_TYPE_INVALID;
michael@0: }
michael@0: 
michael@0: 
michael@0: #define LG_DEF_ATTRIBUTE(value,len) \
michael@0:    { 0, value, len }
michael@0: 
michael@0: #define LG_CLONE_ATTR(attribute, type, staticAttr) \
michael@0:     lg_CopyAttribute(attribute, type, staticAttr.pValue, staticAttr.ulValueLen)
michael@0: 
michael@0: CK_BBOOL lg_staticTrueValue = CK_TRUE;
michael@0: CK_BBOOL lg_staticFalseValue = CK_FALSE;
michael@0: static const CK_ATTRIBUTE lg_StaticTrueAttr = 
michael@0:   LG_DEF_ATTRIBUTE(&lg_staticTrueValue,sizeof(lg_staticTrueValue));
michael@0: static const CK_ATTRIBUTE lg_StaticFalseAttr = 
michael@0:   LG_DEF_ATTRIBUTE(&lg_staticFalseValue,sizeof(lg_staticFalseValue));
michael@0: static const CK_ATTRIBUTE lg_StaticNullAttr = LG_DEF_ATTRIBUTE(NULL,0);
michael@0: char lg_StaticOneValue = 1;
michael@0: static const CK_ATTRIBUTE lg_StaticOneAttr = 
michael@0:   LG_DEF_ATTRIBUTE(&lg_StaticOneValue,sizeof(lg_StaticOneValue));
michael@0: 
michael@0: /*
michael@0:  * helper functions which get the database and call the underlying 
michael@0:  * low level database function.
michael@0:  */
michael@0: static char *
michael@0: lg_FindKeyNicknameByPublicKey(SDB *sdb, SECItem *dbKey)
michael@0: {
michael@0:     NSSLOWKEYDBHandle *keyHandle;
michael@0:     char * label;
michael@0: 
michael@0:     keyHandle = lg_getKeyDB(sdb);
michael@0:     if (!keyHandle) {
michael@0: 	return NULL;
michael@0:     }
michael@0: 
michael@0:     label = nsslowkey_FindKeyNicknameByPublicKey(keyHandle, dbKey, 
michael@0: 						 sdb);
michael@0:     return label;
michael@0: }
michael@0: 
michael@0: 
michael@0: NSSLOWKEYPrivateKey *
michael@0: lg_FindKeyByPublicKey(SDB *sdb, SECItem *dbKey)
michael@0: {
michael@0:     NSSLOWKEYPrivateKey *privKey;
michael@0:     NSSLOWKEYDBHandle   *keyHandle;
michael@0: 
michael@0:     keyHandle = lg_getKeyDB(sdb);
michael@0:     if (keyHandle == NULL) {
michael@0: 	return NULL;
michael@0:     }
michael@0:     privKey = nsslowkey_FindKeyByPublicKey(keyHandle, dbKey, sdb);
michael@0:     if (privKey == NULL) {
michael@0: 	return NULL;
michael@0:     }
michael@0:     return privKey;
michael@0: }
michael@0: 
michael@0: static certDBEntrySMime *
michael@0: lg_getSMime(LGObjectCache *obj)
michael@0: {
michael@0:     certDBEntrySMime *entry;
michael@0:     NSSLOWCERTCertDBHandle *certHandle;
michael@0: 
michael@0:     if (obj->objclass != CKO_NSS_SMIME) {
michael@0: 	return NULL;
michael@0:     }
michael@0:     if (obj->objectInfo) {
michael@0: 	return (certDBEntrySMime *)obj->objectInfo;
michael@0:     }
michael@0: 
michael@0:     certHandle = lg_getCertDB(obj->sdb);
michael@0:     if (!certHandle) {
michael@0: 	return NULL;
michael@0:     }
michael@0:     entry = nsslowcert_ReadDBSMimeEntry(certHandle, (char *)obj->dbKey.data);
michael@0:     obj->objectInfo = (void *)entry;
michael@0:     obj->infoFree = (LGFreeFunc) nsslowcert_DestroyDBEntry;
michael@0:     return entry;
michael@0: }
michael@0: 
michael@0: static certDBEntryRevocation *
michael@0: lg_getCrl(LGObjectCache *obj)
michael@0: {
michael@0:     certDBEntryRevocation *crl;
michael@0:     PRBool isKrl;
michael@0:     NSSLOWCERTCertDBHandle *certHandle;
michael@0: 
michael@0:     if (obj->objclass != CKO_NSS_CRL) {
michael@0: 	return NULL;
michael@0:     }
michael@0:     if (obj->objectInfo) {
michael@0: 	return (certDBEntryRevocation *)obj->objectInfo;
michael@0:     }
michael@0: 
michael@0:     isKrl = (PRBool) (obj->handle == LG_TOKEN_KRL_HANDLE);
michael@0:     certHandle = lg_getCertDB(obj->sdb);
michael@0:     if (!certHandle) {
michael@0: 	return NULL;
michael@0:     }
michael@0: 
michael@0:     crl = nsslowcert_FindCrlByKey(certHandle, &obj->dbKey, isKrl);
michael@0:     obj->objectInfo = (void *)crl;
michael@0:     obj->infoFree = (LGFreeFunc) nsslowcert_DestroyDBEntry;
michael@0:     return crl;
michael@0: }
michael@0: 
michael@0: static NSSLOWCERTCertificate *
michael@0: lg_getCert(LGObjectCache *obj, NSSLOWCERTCertDBHandle *certHandle)
michael@0: {
michael@0:     NSSLOWCERTCertificate *cert;
michael@0:     CK_OBJECT_CLASS objClass = obj->objclass;
michael@0: 
michael@0:     if ((objClass != CKO_CERTIFICATE) && (objClass != CKO_NSS_TRUST)) {
michael@0: 	return NULL;
michael@0:     }
michael@0:     if (objClass == CKO_CERTIFICATE && obj->objectInfo) {
michael@0: 	return (NSSLOWCERTCertificate *)obj->objectInfo;
michael@0:     }
michael@0:     cert = nsslowcert_FindCertByKey(certHandle, &obj->dbKey);
michael@0:     if (objClass == CKO_CERTIFICATE) {
michael@0: 	obj->objectInfo = (void *)cert;
michael@0: 	obj->infoFree = (LGFreeFunc) nsslowcert_DestroyCertificate ;
michael@0:     }
michael@0:     return cert;
michael@0: }
michael@0: 
michael@0: static NSSLOWCERTTrust *
michael@0: lg_getTrust(LGObjectCache *obj, NSSLOWCERTCertDBHandle *certHandle)
michael@0: {
michael@0:     NSSLOWCERTTrust *trust;
michael@0: 
michael@0:     if (obj->objclass != CKO_NSS_TRUST) {
michael@0: 	return NULL;
michael@0:     }
michael@0:     if (obj->objectInfo) {
michael@0: 	return (NSSLOWCERTTrust *)obj->objectInfo;
michael@0:     }
michael@0:     trust = nsslowcert_FindTrustByKey(certHandle, &obj->dbKey);
michael@0:     obj->objectInfo = (void *)trust;
michael@0:     obj->infoFree = (LGFreeFunc) nsslowcert_DestroyTrust ;
michael@0:     return trust;
michael@0: }
michael@0: 
michael@0: static NSSLOWKEYPublicKey *
michael@0: lg_GetPublicKey(LGObjectCache *obj)
michael@0: {
michael@0:     NSSLOWKEYPublicKey *pubKey;
michael@0:     NSSLOWKEYPrivateKey *privKey;
michael@0: 
michael@0:     if (obj->objclass != CKO_PUBLIC_KEY) {
michael@0: 	return NULL;
michael@0:     }
michael@0:     if (obj->objectInfo) {
michael@0: 	return (NSSLOWKEYPublicKey *)obj->objectInfo;
michael@0:     }
michael@0:     privKey = lg_FindKeyByPublicKey(obj->sdb, &obj->dbKey);
michael@0:     if (privKey == NULL) {
michael@0: 	return NULL;
michael@0:     }
michael@0:     pubKey = lg_nsslowkey_ConvertToPublicKey(privKey);
michael@0:     lg_nsslowkey_DestroyPrivateKey(privKey);
michael@0:     obj->objectInfo = (void *) pubKey;
michael@0:     obj->infoFree = (LGFreeFunc) lg_nsslowkey_DestroyPublicKey ;
michael@0:     return pubKey;
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * we need two versions of lg_GetPrivateKey. One version that takes the 
michael@0:  * DB handle so we can pass the handle we have already acquired in,
michael@0:  *  rather than going through the 'getKeyDB' code again, 
michael@0:  *  which may fail the second time and another which just aquires
michael@0:  *  the key handle from the sdb (where we don't already have a key handle.
michael@0:  * This version does the former.
michael@0:  */
michael@0: static NSSLOWKEYPrivateKey *
michael@0: lg_GetPrivateKeyWithDB(LGObjectCache *obj, NSSLOWKEYDBHandle *keyHandle)
michael@0: {
michael@0:     NSSLOWKEYPrivateKey *privKey;
michael@0: 
michael@0:     if ((obj->objclass != CKO_PRIVATE_KEY) && 
michael@0: 			(obj->objclass != CKO_SECRET_KEY)) {
michael@0: 	return NULL;
michael@0:     }
michael@0:     if (obj->objectInfo) {
michael@0: 	return (NSSLOWKEYPrivateKey *)obj->objectInfo;
michael@0:     }
michael@0:     privKey = nsslowkey_FindKeyByPublicKey(keyHandle, &obj->dbKey, obj->sdb);
michael@0:     if (privKey == NULL) {
michael@0: 	return NULL;
michael@0:     }
michael@0:     obj->objectInfo = (void *) privKey;
michael@0:     obj->infoFree = (LGFreeFunc) lg_nsslowkey_DestroyPrivateKey ;
michael@0:     return privKey;
michael@0: }
michael@0: 
michael@0: /* this version does the latter */
michael@0: static NSSLOWKEYPrivateKey *
michael@0: lg_GetPrivateKey(LGObjectCache *obj)
michael@0: {
michael@0:     NSSLOWKEYDBHandle *keyHandle;
michael@0:     NSSLOWKEYPrivateKey *privKey;
michael@0: 
michael@0:     keyHandle = lg_getKeyDB(obj->sdb);
michael@0:     if (!keyHandle) {
michael@0: 	return NULL;
michael@0:     }
michael@0:     privKey = lg_GetPrivateKeyWithDB(obj, keyHandle);
michael@0:     return privKey;
michael@0: }
michael@0: 
michael@0: /* lg_GetPubItem returns data associated with the public key.
michael@0:  * one only needs to free the public key. This comment is here
michael@0:  * because this sematic would be non-obvious otherwise. All callers
michael@0:  * should include this comment.
michael@0:  */
michael@0: static SECItem *
michael@0: lg_GetPubItem(NSSLOWKEYPublicKey *pubKey) {
michael@0:     SECItem *pubItem = NULL;
michael@0:     /* get value to compare from the cert's public key */
michael@0:     switch ( pubKey->keyType ) {
michael@0:     case NSSLOWKEYRSAKey:
michael@0: 	    pubItem = &pubKey->u.rsa.modulus;
michael@0: 	    break;
michael@0:     case NSSLOWKEYDSAKey:
michael@0: 	    pubItem = &pubKey->u.dsa.publicValue;
michael@0: 	    break;
michael@0:     case NSSLOWKEYDHKey:
michael@0: 	    pubItem = &pubKey->u.dh.publicValue;
michael@0: 	    break;
michael@0: #ifndef NSS_DISABLE_ECC
michael@0:     case NSSLOWKEYECKey:
michael@0: 	    pubItem = &pubKey->u.ec.publicValue;
michael@0: 	    break;
michael@0: #endif /* NSS_DISABLE_ECC */
michael@0:     default:
michael@0: 	    break;
michael@0:     }
michael@0:     return pubItem;
michael@0: }
michael@0: 
michael@0: static const SEC_ASN1Template lg_SerialTemplate[] = {
michael@0:     { SEC_ASN1_INTEGER, offsetof(NSSLOWCERTCertificate,serialNumber) },
michael@0:     { 0 }
michael@0: };
michael@0: 
michael@0: static CK_RV
michael@0: lg_FindRSAPublicKeyAttribute(NSSLOWKEYPublicKey *key, CK_ATTRIBUTE_TYPE type,
michael@0: 				CK_ATTRIBUTE *attribute)
michael@0: {
michael@0:     unsigned char hash[SHA1_LENGTH];
michael@0:     CK_KEY_TYPE keyType = CKK_RSA;
michael@0: 
michael@0:     switch (type) {
michael@0:     case CKA_KEY_TYPE:
michael@0: 	return lg_ULongAttribute(attribute, type, keyType);
michael@0:     case CKA_ID:
michael@0: 	SHA1_HashBuf(hash,key->u.rsa.modulus.data,key->u.rsa.modulus.len);
michael@0: 	return lg_CopyAttribute(attribute,type,hash,SHA1_LENGTH);
michael@0:     case CKA_DERIVE:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticFalseAttr);
michael@0:     case CKA_ENCRYPT:
michael@0:     case CKA_VERIFY:
michael@0:     case CKA_VERIFY_RECOVER:
michael@0:     case CKA_WRAP:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticTrueAttr);
michael@0:     case CKA_MODULUS:
michael@0: 	return lg_CopyAttributeSigned(attribute,type,key->u.rsa.modulus.data,
michael@0: 					key->u.rsa.modulus.len);
michael@0:     case CKA_PUBLIC_EXPONENT:
michael@0: 	return lg_CopyAttributeSigned(attribute, type,
michael@0: 				key->u.rsa.publicExponent.data,
michael@0: 				key->u.rsa.publicExponent.len);
michael@0:     default:
michael@0: 	break;
michael@0:     }
michael@0:     return lg_invalidAttribute(attribute);
michael@0: }
michael@0: 
michael@0: static CK_RV
michael@0: lg_FindDSAPublicKeyAttribute(NSSLOWKEYPublicKey *key, CK_ATTRIBUTE_TYPE type,
michael@0: 				CK_ATTRIBUTE *attribute)
michael@0: {
michael@0:     unsigned char hash[SHA1_LENGTH];
michael@0:     CK_KEY_TYPE keyType = CKK_DSA;
michael@0: 
michael@0:     switch (type) {
michael@0:     case CKA_KEY_TYPE:
michael@0: 	return lg_ULongAttribute(attribute, type, keyType);
michael@0:     case CKA_ID:
michael@0: 	SHA1_HashBuf(hash,key->u.dsa.publicValue.data,
michael@0: 						key->u.dsa.publicValue.len);
michael@0: 	return lg_CopyAttribute(attribute,type,hash,SHA1_LENGTH);
michael@0:     case CKA_DERIVE:
michael@0:     case CKA_ENCRYPT:
michael@0:     case CKA_VERIFY_RECOVER:
michael@0:     case CKA_WRAP:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticFalseAttr);
michael@0:     case CKA_VERIFY:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticTrueAttr);
michael@0:     case CKA_VALUE:
michael@0: 	return lg_CopyAttributeSigned(attribute,type,
michael@0: 					key->u.dsa.publicValue.data,
michael@0: 					key->u.dsa.publicValue.len);
michael@0:     case CKA_PRIME:
michael@0: 	return lg_CopyAttributeSigned(attribute,type,
michael@0: 					key->u.dsa.params.prime.data,
michael@0: 					key->u.dsa.params.prime.len);
michael@0:     case CKA_SUBPRIME:
michael@0: 	return lg_CopyAttributeSigned(attribute,type,
michael@0: 				key->u.dsa.params.subPrime.data,
michael@0: 				key->u.dsa.params.subPrime.len);
michael@0:     case CKA_BASE:
michael@0: 	return lg_CopyAttributeSigned(attribute,type,
michael@0: 					key->u.dsa.params.base.data,
michael@0: 					key->u.dsa.params.base.len);
michael@0:     default:
michael@0: 	break;
michael@0:     }
michael@0:     return lg_invalidAttribute(attribute);
michael@0: }
michael@0: 
michael@0: static CK_RV
michael@0: lg_FindDHPublicKeyAttribute(NSSLOWKEYPublicKey *key, CK_ATTRIBUTE_TYPE type,
michael@0: 				CK_ATTRIBUTE *attribute)
michael@0: {
michael@0:     unsigned char hash[SHA1_LENGTH];
michael@0:     CK_KEY_TYPE keyType = CKK_DH;
michael@0: 
michael@0:     switch (type) {
michael@0:     case CKA_KEY_TYPE:
michael@0: 	return lg_ULongAttribute(attribute, type, keyType);
michael@0:     case CKA_ID:
michael@0: 	SHA1_HashBuf(hash,key->u.dh.publicValue.data,key->u.dh.publicValue.len);
michael@0: 	return lg_CopyAttribute(attribute,type,hash,SHA1_LENGTH);
michael@0:     case CKA_DERIVE:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticTrueAttr);
michael@0:     case CKA_ENCRYPT:
michael@0:     case CKA_VERIFY:
michael@0:     case CKA_VERIFY_RECOVER:
michael@0:     case CKA_WRAP:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticFalseAttr);
michael@0:     case CKA_VALUE:
michael@0: 	return lg_CopyAttributeSigned(attribute,type,
michael@0: 					key->u.dh.publicValue.data,
michael@0: 					key->u.dh.publicValue.len);
michael@0:     case CKA_PRIME:
michael@0: 	return lg_CopyAttributeSigned(attribute,type,key->u.dh.prime.data,
michael@0: 					key->u.dh.prime.len);
michael@0:     case CKA_BASE:
michael@0: 	return lg_CopyAttributeSigned(attribute,type,key->u.dh.base.data,
michael@0: 					key->u.dh.base.len);
michael@0:     default:
michael@0: 	break;
michael@0:     }
michael@0:     return lg_invalidAttribute(attribute);
michael@0: }
michael@0: 
michael@0: #ifndef NSS_DISABLE_ECC
michael@0: static CK_RV
michael@0: lg_FindECPublicKeyAttribute(NSSLOWKEYPublicKey *key, CK_ATTRIBUTE_TYPE type,
michael@0: 				CK_ATTRIBUTE *attribute)
michael@0: {
michael@0:     unsigned char hash[SHA1_LENGTH];
michael@0:     CK_KEY_TYPE keyType = CKK_EC;
michael@0: 
michael@0:     switch (type) {
michael@0:     case CKA_KEY_TYPE:
michael@0: 	return lg_ULongAttribute(attribute, type, keyType);
michael@0:     case CKA_ID:
michael@0: 	SHA1_HashBuf(hash, key->u.ec.publicValue.data,
michael@0: 		     key->u.ec.publicValue.len);
michael@0: 	return lg_CopyAttribute(attribute,type,hash,SHA1_LENGTH);
michael@0:     case CKA_DERIVE:
michael@0:     case CKA_VERIFY:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticTrueAttr);
michael@0:     case CKA_ENCRYPT:
michael@0:     case CKA_VERIFY_RECOVER:
michael@0:     case CKA_WRAP:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticFalseAttr);
michael@0:     case CKA_EC_PARAMS:
michael@0: 	return lg_CopyAttributeSigned(attribute,type,
michael@0: 					key->u.ec.ecParams.DEREncoding.data,
michael@0: 					key->u.ec.ecParams.DEREncoding.len);
michael@0:     case CKA_EC_POINT:
michael@0: 	if (getenv("NSS_USE_DECODED_CKA_EC_POINT")) {
michael@0: 	    return lg_CopyAttributeSigned(attribute, type,
michael@0: 					key->u.ec.publicValue.data,
michael@0: 					key->u.ec.publicValue.len);
michael@0: 	} else {
michael@0: 	    SECItem *pubValue = SEC_ASN1EncodeItem(NULL, NULL, 
michael@0: 					&(key->u.ec.publicValue), 
michael@0: 					SEC_ASN1_GET(SEC_OctetStringTemplate));
michael@0: 	    CK_RV crv;
michael@0: 	    if (!pubValue) {
michael@0: 		return CKR_HOST_MEMORY;
michael@0: 	    }
michael@0: 	    crv = lg_CopyAttributeSigned(attribute, type,
michael@0: 					pubValue->data,
michael@0: 					pubValue->len);
michael@0: 	    SECITEM_FreeItem(pubValue, PR_TRUE);
michael@0: 	    return crv;
michael@0: 	}
michael@0:     default:
michael@0: 	break;
michael@0:     }
michael@0:     return lg_invalidAttribute(attribute);
michael@0: }
michael@0: #endif /* NSS_DISABLE_ECC */
michael@0: 
michael@0: 
michael@0: static CK_RV
michael@0: lg_FindPublicKeyAttribute(LGObjectCache *obj, CK_ATTRIBUTE_TYPE type,
michael@0: 				CK_ATTRIBUTE *attribute)
michael@0: {
michael@0:     NSSLOWKEYPublicKey   *key;
michael@0:     CK_RV crv;
michael@0:     char *label;
michael@0: 
michael@0:     switch (type) {
michael@0:     case CKA_PRIVATE:
michael@0:     case CKA_SENSITIVE:
michael@0:     case CKA_ALWAYS_SENSITIVE:
michael@0:     case CKA_NEVER_EXTRACTABLE:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticFalseAttr);
michael@0:     case CKA_MODIFIABLE:
michael@0:     case CKA_EXTRACTABLE:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticTrueAttr);
michael@0:     case CKA_SUBJECT:
michael@0: 	   return LG_CLONE_ATTR(attribute,type,lg_StaticNullAttr);
michael@0:     case CKA_START_DATE:
michael@0:     case CKA_END_DATE:
michael@0: 	   return LG_CLONE_ATTR(attribute,type,lg_StaticNullAttr);
michael@0:     case CKA_LABEL:
michael@0:         label = lg_FindKeyNicknameByPublicKey(obj->sdb, &obj->dbKey);
michael@0: 	if (label == NULL) {
michael@0: 	   return LG_CLONE_ATTR(attribute,type,lg_StaticNullAttr);
michael@0: 	}
michael@0: 	crv = lg_CopyAttribute(attribute,type,label,PORT_Strlen(label));
michael@0: 	PORT_Free(label);
michael@0: 	return crv;
michael@0:     default:
michael@0: 	break;
michael@0:     }
michael@0: 
michael@0:     key = lg_GetPublicKey(obj);
michael@0:     if (key == NULL) {
michael@0: 	if (type == CKA_ID) {
michael@0: 	   return LG_CLONE_ATTR(attribute,type,lg_StaticNullAttr);
michael@0: 	}
michael@0: 	return CKR_OBJECT_HANDLE_INVALID;
michael@0:     }
michael@0: 
michael@0:     switch (key->keyType) {
michael@0:     case NSSLOWKEYRSAKey:
michael@0: 	return lg_FindRSAPublicKeyAttribute(key,type,attribute);
michael@0:     case NSSLOWKEYDSAKey:
michael@0: 	return lg_FindDSAPublicKeyAttribute(key,type,attribute);
michael@0:     case NSSLOWKEYDHKey:
michael@0: 	return lg_FindDHPublicKeyAttribute(key,type,attribute);
michael@0: #ifndef NSS_DISABLE_ECC
michael@0:     case NSSLOWKEYECKey:
michael@0: 	return lg_FindECPublicKeyAttribute(key,type,attribute);
michael@0: #endif /* NSS_DISABLE_ECC */
michael@0:     default:
michael@0: 	break;
michael@0:     }
michael@0: 
michael@0:     return lg_invalidAttribute(attribute);
michael@0: }
michael@0: 
michael@0: static CK_RV
michael@0: lg_FindSecretKeyAttribute(LGObjectCache *obj, CK_ATTRIBUTE_TYPE type,
michael@0: 				CK_ATTRIBUTE *attribute)
michael@0: {
michael@0:     NSSLOWKEYPrivateKey  *key;
michael@0:     char *label;
michael@0:     unsigned char *keyString;
michael@0:     CK_RV crv;
michael@0:     int keyTypeLen;
michael@0:     CK_ULONG keyLen;
michael@0:     CK_KEY_TYPE keyType;
michael@0:     PRUint32 keyTypeStorage;
michael@0: 
michael@0:     switch (type) {
michael@0:     case CKA_PRIVATE:
michael@0:     case CKA_SENSITIVE:
michael@0:     case CKA_ALWAYS_SENSITIVE:
michael@0:     case CKA_EXTRACTABLE:
michael@0:     case CKA_DERIVE:
michael@0:     case CKA_ENCRYPT:
michael@0:     case CKA_DECRYPT:
michael@0:     case CKA_SIGN:
michael@0:     case CKA_VERIFY:
michael@0:     case CKA_WRAP:
michael@0:     case CKA_UNWRAP:
michael@0:     case CKA_MODIFIABLE:
michael@0:     case CKA_LOCAL:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticTrueAttr);
michael@0:     case CKA_NEVER_EXTRACTABLE:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticFalseAttr);
michael@0:     case CKA_START_DATE:
michael@0:     case CKA_END_DATE:
michael@0: 	   return LG_CLONE_ATTR(attribute,type,lg_StaticNullAttr);
michael@0:     case CKA_LABEL:
michael@0:         label = lg_FindKeyNicknameByPublicKey(obj->sdb, &obj->dbKey);
michael@0: 	if (label == NULL) {
michael@0: 	   return LG_CLONE_ATTR(attribute,type,lg_StaticNullAttr);
michael@0: 	}
michael@0: 	crv = lg_CopyAttribute(attribute,type,label,PORT_Strlen(label));
michael@0: 	PORT_Free(label);
michael@0: 	return crv;
michael@0:     case CKA_ID:
michael@0: 	return lg_CopyAttribute(attribute,type,obj->dbKey.data,
michael@0: 						obj->dbKey.len);
michael@0:     case CKA_KEY_TYPE:
michael@0:     case CKA_VALUE_LEN:
michael@0:     case CKA_VALUE:
michael@0: 	break;
michael@0:     default:
michael@0: 	return lg_invalidAttribute(attribute);
michael@0:     }
michael@0: 
michael@0:     key = lg_GetPrivateKey(obj);
michael@0:     if (key == NULL) {
michael@0: 	return CKR_OBJECT_HANDLE_INVALID;
michael@0:     }
michael@0:     switch (type) {
michael@0:     case CKA_KEY_TYPE:
michael@0: 	/* handle legacy databases. In legacy databases key_type was stored
michael@0: 	 * in host order, with any leading zeros stripped off. Only key types
michael@0: 	 * under 0x1f (AES) were stored. We assume that any values which are
michael@0: 	 * either 1 byte long (big endian), or have byte[0] between 0 and 
michael@0: 	 * 0x7f and bytes[1]-bytes[3] equal to '0' (little endian). All other
michael@0: 	 * values are assumed to be from the new database, which is always 4
michael@0: 	 * bytes in network order */
michael@0: 	keyType=0;
michael@0: 	keyString = key->u.rsa.coefficient.data;
michael@0: 	keyTypeLen = key->u.rsa.coefficient.len;
michael@0: 
michael@0: 
michael@0: 	/*
michael@0:  	 * Because of various endian and word lengths The database may have
michael@0: 	 * stored the keyType value in one of the following formats:
michael@0: 	 *   (kt) <= 0x1f 
michael@0: 	 *                                   length data
michael@0: 	 * Big Endian,     pre-3.9, all lengths: 1  (kt)
michael@0: 	 * Little Endian,  pre-3.9, 32 bits:     4  (kt) 0  0  0
michael@0: 	 * Little Endian,  pre-3.9, 64 bits:     8  (kt) 0  0  0   0  0  0  0
michael@0: 	 * All platforms,      3.9, 32 bits:     4    0  0  0 (kt)
michael@0: 	 * Big Endian,         3.9, 64 bits:     8    0  0  0 (kt) 0  0  0  0
michael@0: 	 * Little  Endian,     3.9, 64 bits:     8    0  0  0  0   0  0  0 (kt)
michael@0: 	 * All platforms, >= 3.9.1, all lengths: 4   (a) k1 k2 k3
michael@0: 	 * where (a) is 0 or >= 0x80. currently (a) can only be 0.
michael@0: 	 */
michael@0: 	/*
michael@0:  	 * this key was written on a 64 bit platform with a using NSS 3.9
michael@0: 	 * or earlier. Reduce the 64 bit possibilities above. When we are
michael@0: 	 * through, we will only have:
michael@0: 	 * 
michael@0: 	 * Big Endian,     pre-3.9, all lengths: 1  (kt)
michael@0: 	 * Little Endian,  pre-3.9, all lengths: 4  (kt) 0  0  0
michael@0: 	 * All platforms,      3.9, all lengths: 4    0  0  0 (kt)
michael@0: 	 * All platforms, => 3.9.1, all lengths: 4   (a) k1 k2 k3
michael@0: 	 */
michael@0: 	if (keyTypeLen == 8) {
michael@0: 	    keyTypeStorage = *(PRUint32 *) keyString;
michael@0: 	    if (keyTypeStorage == 0) {
michael@0: 		keyString += sizeof(PRUint32);
michael@0: 	    }
michael@0: 	    keyTypeLen = 4;
michael@0: 	}
michael@0: 	/*
michael@0: 	 * Now Handle:
michael@0: 	 *
michael@0: 	 * All platforms,      3.9, all lengths: 4    0  0  0 (kt)
michael@0: 	 * All platforms, => 3.9.1, all lengths: 4   (a) k1 k2 k3
michael@0: 	 *
michael@0: 	 * NOTE: if  kt == 0 or ak1k2k3 == 0, the test fails and
michael@0: 	 * we handle it as:
michael@0: 	 *
michael@0: 	 * Little Endian,  pre-3.9, all lengths: 4  (kt) 0  0  0
michael@0: 	 */
michael@0: 	if (keyTypeLen == sizeof(keyTypeStorage) &&
michael@0: 	     (((keyString[0] & 0x80) == 0x80) ||
michael@0: 		!((keyString[1] == 0) && (keyString[2] == 0)
michael@0: 	   				    && (keyString[3] == 0))) ) {
michael@0: 	    PORT_Memcpy(&keyTypeStorage, keyString, sizeof(keyTypeStorage));
michael@0: 	    keyType = (CK_KEY_TYPE) PR_ntohl(keyTypeStorage);
michael@0: 	} else {
michael@0: 	/*
michael@0: 	 * Now Handle:
michael@0: 	 *
michael@0: 	 * Big Endian,     pre-3.9, all lengths: 1  (kt)
michael@0: 	 * Little Endian,  pre-3.9, all lengths: 4  (kt) 0  0  0
michael@0: 	 *  -- KeyType == 0 all other cases ---: 4    0  0  0  0
michael@0: 	 */
michael@0: 	    keyType = (CK_KEY_TYPE) keyString[0] ;
michael@0:         }
michael@0: 	return lg_ULongAttribute(attribute, type, keyType);
michael@0:     case CKA_VALUE:
michael@0: 	return lg_CopyPrivAttribute(attribute,type,key->u.rsa.privateExponent.data,
michael@0: 				key->u.rsa.privateExponent.len, obj->sdb);
michael@0:     case CKA_VALUE_LEN:
michael@0: 	keyLen=key->u.rsa.privateExponent.len;
michael@0: 	return lg_ULongAttribute(attribute,type, keyLen);
michael@0:     }
michael@0:     return lg_invalidAttribute(attribute);
michael@0: }
michael@0: 
michael@0: static CK_RV
michael@0: lg_FindRSAPrivateKeyAttribute(NSSLOWKEYPrivateKey *key, CK_ATTRIBUTE_TYPE type,
michael@0: 				CK_ATTRIBUTE *attribute, SDB *sdbpw)
michael@0: {
michael@0:     unsigned char hash[SHA1_LENGTH];
michael@0:     CK_KEY_TYPE keyType = CKK_RSA;
michael@0: 
michael@0:     switch (type) {
michael@0:     case CKA_KEY_TYPE:
michael@0: 	return lg_ULongAttribute(attribute, type, keyType);
michael@0:     case CKA_ID:
michael@0: 	SHA1_HashBuf(hash,key->u.rsa.modulus.data,key->u.rsa.modulus.len);
michael@0: 	return lg_CopyAttribute(attribute,type,hash,SHA1_LENGTH);
michael@0:     case CKA_DERIVE:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticFalseAttr);
michael@0:     case CKA_DECRYPT:
michael@0:     case CKA_SIGN:
michael@0:     case CKA_SIGN_RECOVER:
michael@0:     case CKA_UNWRAP:
michael@0: 	return LG_CLONE_ATTR(attribute, type,lg_StaticTrueAttr);
michael@0:     case CKA_MODULUS:
michael@0: 	return lg_CopyAttributeSigned(attribute,type,key->u.rsa.modulus.data,
michael@0: 					key->u.rsa.modulus.len);
michael@0:     case CKA_PUBLIC_EXPONENT:
michael@0: 	return lg_CopyAttributeSigned(attribute, type,
michael@0: 				key->u.rsa.publicExponent.data,
michael@0: 				key->u.rsa.publicExponent.len);
michael@0:     case CKA_PRIVATE_EXPONENT:
michael@0: 	return lg_CopyPrivAttrSigned(attribute,type,
michael@0: 				key->u.rsa.privateExponent.data,
michael@0: 				key->u.rsa.privateExponent.len, sdbpw);
michael@0:     case CKA_PRIME_1:
michael@0: 	return lg_CopyPrivAttrSigned(attribute, type, key->u.rsa.prime1.data,
michael@0: 				key->u.rsa.prime1.len, sdbpw);
michael@0:     case CKA_PRIME_2:
michael@0: 	return lg_CopyPrivAttrSigned(attribute, type, key->u.rsa.prime2.data,
michael@0: 				key->u.rsa.prime2.len, sdbpw);
michael@0:     case CKA_EXPONENT_1:
michael@0: 	return lg_CopyPrivAttrSigned(attribute, type, 
michael@0: 				key->u.rsa.exponent1.data,
michael@0: 				key->u.rsa.exponent1.len, sdbpw);
michael@0:     case CKA_EXPONENT_2:
michael@0: 	return lg_CopyPrivAttrSigned(attribute, type, 
michael@0: 				key->u.rsa.exponent2.data,
michael@0: 				key->u.rsa.exponent2.len, sdbpw);
michael@0:     case CKA_COEFFICIENT:
michael@0: 	return lg_CopyPrivAttrSigned(attribute, type, 
michael@0: 				key->u.rsa.coefficient.data,
michael@0: 				key->u.rsa.coefficient.len, sdbpw);
michael@0:     default:
michael@0: 	break;
michael@0:     }
michael@0:     return lg_invalidAttribute(attribute);
michael@0: }
michael@0: 
michael@0: static CK_RV
michael@0: lg_FindDSAPrivateKeyAttribute(NSSLOWKEYPrivateKey *key, CK_ATTRIBUTE_TYPE type,
michael@0: 				CK_ATTRIBUTE *attribute, SDB *sdbpw)
michael@0: {
michael@0:     unsigned char hash[SHA1_LENGTH];
michael@0:     CK_KEY_TYPE keyType = CKK_DSA;
michael@0: 
michael@0:     switch (type) {
michael@0:     case CKA_KEY_TYPE:
michael@0: 	return lg_ULongAttribute(attribute, type, keyType);
michael@0:     case CKA_ID:
michael@0: 	SHA1_HashBuf(hash,key->u.dsa.publicValue.data,
michael@0: 			  key->u.dsa.publicValue.len);
michael@0: 	return lg_CopyAttribute(attribute,type,hash,SHA1_LENGTH);
michael@0:     case CKA_DERIVE:
michael@0:     case CKA_DECRYPT:
michael@0:     case CKA_SIGN_RECOVER:
michael@0:     case CKA_UNWRAP:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticFalseAttr);
michael@0:     case CKA_SIGN:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticTrueAttr);
michael@0:     case CKA_VALUE:
michael@0: 	return lg_CopyPrivAttrSigned(attribute, type,
michael@0: 				key->u.dsa.privateValue.data,
michael@0: 				key->u.dsa.privateValue.len, sdbpw);
michael@0:     case CKA_PRIME:
michael@0: 	return lg_CopyAttributeSigned(attribute, type,
michael@0: 					key->u.dsa.params.prime.data,
michael@0: 					key->u.dsa.params.prime.len);
michael@0:     case CKA_SUBPRIME:
michael@0: 	return lg_CopyAttributeSigned(attribute, type,
michael@0: 				key->u.dsa.params.subPrime.data,
michael@0: 				key->u.dsa.params.subPrime.len);
michael@0:     case CKA_BASE:
michael@0: 	return lg_CopyAttributeSigned(attribute, type,
michael@0: 					key->u.dsa.params.base.data,
michael@0: 					key->u.dsa.params.base.len);
michael@0:     case CKA_NETSCAPE_DB:
michael@0: 	return lg_CopyAttributeSigned(attribute, type,
michael@0: 					key->u.dsa.publicValue.data,
michael@0: 					key->u.dsa.publicValue.len);
michael@0:     default:
michael@0: 	break;
michael@0:     }
michael@0:     return lg_invalidAttribute(attribute);
michael@0: }
michael@0: 
michael@0: static CK_RV
michael@0: lg_FindDHPrivateKeyAttribute(NSSLOWKEYPrivateKey *key, CK_ATTRIBUTE_TYPE type,
michael@0: 				CK_ATTRIBUTE *attribute, SDB *sdbpw)
michael@0: {
michael@0:     unsigned char hash[SHA1_LENGTH];
michael@0:     CK_KEY_TYPE keyType = CKK_DH;
michael@0: 
michael@0:     switch (type) {
michael@0:     case CKA_KEY_TYPE:
michael@0: 	return lg_ULongAttribute(attribute, type, keyType);
michael@0:     case CKA_ID:
michael@0: 	SHA1_HashBuf(hash,key->u.dh.publicValue.data,key->u.dh.publicValue.len);
michael@0: 	return lg_CopyAttribute(attribute,type,hash,SHA1_LENGTH);
michael@0:     case CKA_DERIVE:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticTrueAttr);
michael@0:     case CKA_DECRYPT:
michael@0:     case CKA_SIGN:
michael@0:     case CKA_SIGN_RECOVER:
michael@0:     case CKA_UNWRAP:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticFalseAttr);
michael@0:     case CKA_VALUE:
michael@0: 	return lg_CopyPrivAttrSigned(attribute, type,
michael@0: 					key->u.dh.privateValue.data,
michael@0: 					key->u.dh.privateValue.len, sdbpw);
michael@0:     case CKA_PRIME:
michael@0: 	return lg_CopyAttributeSigned(attribute, type, key->u.dh.prime.data,
michael@0: 					key->u.dh.prime.len);
michael@0:     case CKA_BASE:
michael@0: 	return lg_CopyAttributeSigned(attribute, type, key->u.dh.base.data,
michael@0: 					key->u.dh.base.len);
michael@0:     case CKA_NETSCAPE_DB:
michael@0: 	return lg_CopyAttributeSigned(attribute, type,
michael@0: 					key->u.dh.publicValue.data,
michael@0: 					key->u.dh.publicValue.len);
michael@0:     default:
michael@0: 	break;
michael@0:     }
michael@0:     return lg_invalidAttribute(attribute);
michael@0: }
michael@0: 
michael@0: #ifndef NSS_DISABLE_ECC
michael@0: static CK_RV
michael@0: lg_FindECPrivateKeyAttribute(NSSLOWKEYPrivateKey *key, CK_ATTRIBUTE_TYPE type,
michael@0: 				CK_ATTRIBUTE *attribute, SDB *sdbpw)
michael@0: {
michael@0:     unsigned char hash[SHA1_LENGTH];
michael@0:     CK_KEY_TYPE keyType = CKK_EC;
michael@0: 
michael@0:     switch (type) {
michael@0:     case CKA_KEY_TYPE:
michael@0: 	return lg_ULongAttribute(attribute, type, keyType);
michael@0:     case CKA_ID:
michael@0: 	SHA1_HashBuf(hash,key->u.ec.publicValue.data,key->u.ec.publicValue.len);
michael@0: 	return lg_CopyAttribute(attribute,type,hash,SHA1_LENGTH);
michael@0:     case CKA_DERIVE:
michael@0:     case CKA_SIGN:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticTrueAttr);
michael@0:     case CKA_DECRYPT:
michael@0:     case CKA_SIGN_RECOVER:
michael@0:     case CKA_UNWRAP:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticFalseAttr);
michael@0:     case CKA_VALUE:
michael@0: 	return lg_CopyPrivAttrSigned(attribute, type,
michael@0: 					key->u.ec.privateValue.data,
michael@0: 					key->u.ec.privateValue.len, sdbpw);
michael@0:     case CKA_EC_PARAMS:
michael@0: 	return lg_CopyAttributeSigned(attribute, type,
michael@0: 					key->u.ec.ecParams.DEREncoding.data,
michael@0: 					key->u.ec.ecParams.DEREncoding.len);
michael@0:     case CKA_NETSCAPE_DB:
michael@0: 	return lg_CopyAttributeSigned(attribute, type,
michael@0: 					key->u.ec.publicValue.data,
michael@0: 					key->u.ec.publicValue.len);
michael@0:     default:
michael@0: 	break;
michael@0:     }
michael@0:     return lg_invalidAttribute(attribute);
michael@0: }
michael@0: #endif /* NSS_DISABLE_ECC */
michael@0: 
michael@0: static CK_RV
michael@0: lg_FindPrivateKeyAttribute(LGObjectCache *obj, CK_ATTRIBUTE_TYPE type,
michael@0: 				CK_ATTRIBUTE *attribute)
michael@0: {
michael@0:     NSSLOWKEYPrivateKey  *key;
michael@0:     char *label;
michael@0:     CK_RV crv;
michael@0: 
michael@0:     switch (type) {
michael@0:     case CKA_PRIVATE:
michael@0:     case CKA_SENSITIVE:
michael@0:     case CKA_ALWAYS_SENSITIVE:
michael@0:     case CKA_EXTRACTABLE:
michael@0:     case CKA_MODIFIABLE:
michael@0:     case CKA_LOCAL:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticTrueAttr);
michael@0:     case CKA_NEVER_EXTRACTABLE:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticFalseAttr);
michael@0:     case CKA_SUBJECT:
michael@0: 	   return LG_CLONE_ATTR(attribute,type,lg_StaticNullAttr);
michael@0:     case CKA_START_DATE:
michael@0:     case CKA_END_DATE:
michael@0: 	   return LG_CLONE_ATTR(attribute,type,lg_StaticNullAttr);
michael@0:     case CKA_LABEL:
michael@0:         label = lg_FindKeyNicknameByPublicKey(obj->sdb, &obj->dbKey);
michael@0: 	if (label == NULL) {
michael@0: 	   return LG_CLONE_ATTR(attribute,type,lg_StaticNullAttr);
michael@0: 	}
michael@0: 	crv = lg_CopyAttribute(attribute,type,label,PORT_Strlen(label));
michael@0: 	PORT_Free(label);
michael@0: 	return crv;
michael@0:     default:
michael@0: 	break;
michael@0:     }
michael@0:     key = lg_GetPrivateKey(obj);
michael@0:     if (key == NULL) {
michael@0: 	return CKR_OBJECT_HANDLE_INVALID;
michael@0:     }
michael@0:     switch (key->keyType) {
michael@0:     case NSSLOWKEYRSAKey:
michael@0: 	return lg_FindRSAPrivateKeyAttribute(key,type,attribute,obj->sdb);
michael@0:     case NSSLOWKEYDSAKey:
michael@0: 	return lg_FindDSAPrivateKeyAttribute(key,type,attribute,obj->sdb);
michael@0:     case NSSLOWKEYDHKey:
michael@0: 	return lg_FindDHPrivateKeyAttribute(key,type,attribute,obj->sdb);
michael@0: #ifndef NSS_DISABLE_ECC
michael@0:     case NSSLOWKEYECKey:
michael@0: 	return lg_FindECPrivateKeyAttribute(key,type,attribute,obj->sdb);
michael@0: #endif /* NSS_DISABLE_ECC */
michael@0:     default:
michael@0: 	break;
michael@0:     }
michael@0: 
michael@0:     return lg_invalidAttribute(attribute);
michael@0: }
michael@0: 
michael@0: static CK_RV
michael@0: lg_FindSMIMEAttribute(LGObjectCache *obj, CK_ATTRIBUTE_TYPE type,
michael@0: 				CK_ATTRIBUTE *attribute)
michael@0: {
michael@0:     certDBEntrySMime *entry;
michael@0:     switch (type) {
michael@0:     case CKA_PRIVATE:
michael@0:     case CKA_MODIFIABLE:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticFalseAttr);
michael@0:     case CKA_NSS_EMAIL:
michael@0: 	return lg_CopyAttribute(attribute,type,obj->dbKey.data,
michael@0: 						obj->dbKey.len-1);
michael@0:     case CKA_NSS_SMIME_TIMESTAMP:
michael@0:     case CKA_SUBJECT:
michael@0:     case CKA_VALUE:
michael@0: 	break;
michael@0:     default:
michael@0: 	return lg_invalidAttribute(attribute);
michael@0:     }
michael@0:     entry = lg_getSMime(obj);
michael@0:     if (entry == NULL) {
michael@0: 	return CKR_OBJECT_HANDLE_INVALID;
michael@0:     }
michael@0:     switch (type) {
michael@0:     case CKA_NSS_SMIME_TIMESTAMP:
michael@0: 	return lg_CopyAttribute(attribute,type,entry->optionsDate.data,
michael@0: 					entry->optionsDate.len);
michael@0:     case CKA_SUBJECT:
michael@0: 	return lg_CopyAttribute(attribute,type,entry->subjectName.data,
michael@0: 					entry->subjectName.len);
michael@0:     case CKA_VALUE:
michael@0: 	return lg_CopyAttribute(attribute,type,entry->smimeOptions.data,
michael@0: 					entry->smimeOptions.len);
michael@0:     default:
michael@0: 	break;
michael@0:     }
michael@0:     return lg_invalidAttribute(attribute);
michael@0: }
michael@0: 
michael@0: static CK_RV
michael@0: lg_FindTrustAttribute(LGObjectCache *obj, CK_ATTRIBUTE_TYPE type,
michael@0: 				CK_ATTRIBUTE *attribute)
michael@0: {
michael@0:     NSSLOWCERTTrust *trust;
michael@0:     NSSLOWCERTCertDBHandle *certHandle;
michael@0:     NSSLOWCERTCertificate *cert;
michael@0:     unsigned char hash[SHA1_LENGTH];
michael@0:     unsigned int trustFlags;
michael@0:     CK_RV crv;
michael@0: 
michael@0:     switch (type) {
michael@0:     case CKA_PRIVATE:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticFalseAttr);
michael@0:     case CKA_MODIFIABLE:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticTrueAttr);
michael@0:     case CKA_CERT_SHA1_HASH:
michael@0:     case CKA_CERT_MD5_HASH:
michael@0:     case CKA_TRUST_CLIENT_AUTH:
michael@0:     case CKA_TRUST_SERVER_AUTH:
michael@0:     case CKA_TRUST_EMAIL_PROTECTION:
michael@0:     case CKA_TRUST_CODE_SIGNING:
michael@0:     case CKA_TRUST_STEP_UP_APPROVED:
michael@0:     case CKA_ISSUER:
michael@0:     case CKA_SERIAL_NUMBER:
michael@0: 	break;
michael@0:     default:
michael@0:         return lg_invalidAttribute(attribute);
michael@0:     }
michael@0:     certHandle = lg_getCertDB(obj->sdb);
michael@0:     if (!certHandle) {
michael@0: 	return CKR_OBJECT_HANDLE_INVALID;
michael@0:     }
michael@0:     trust = lg_getTrust(obj, certHandle);
michael@0:     if (trust == NULL) {
michael@0: 	return CKR_OBJECT_HANDLE_INVALID;
michael@0:     }
michael@0:     switch (type) {
michael@0:     case CKA_CERT_SHA1_HASH:
michael@0: 	SHA1_HashBuf(hash,trust->derCert->data,trust->derCert->len);
michael@0: 	return lg_CopyAttribute(attribute, type, hash, SHA1_LENGTH);
michael@0:     case CKA_CERT_MD5_HASH:
michael@0: 	MD5_HashBuf(hash,trust->derCert->data,trust->derCert->len);
michael@0: 	return lg_CopyAttribute(attribute, type, hash, MD5_LENGTH);
michael@0:     case CKA_TRUST_CLIENT_AUTH:
michael@0: 	trustFlags = trust->trust->sslFlags & CERTDB_TRUSTED_CLIENT_CA ?
michael@0: 		trust->trust->sslFlags | CERTDB_TRUSTED_CA : 0 ;
michael@0: 	goto trust;
michael@0:     case CKA_TRUST_SERVER_AUTH:
michael@0: 	trustFlags = trust->trust->sslFlags;
michael@0: 	goto trust;
michael@0:     case CKA_TRUST_EMAIL_PROTECTION:
michael@0: 	trustFlags = trust->trust->emailFlags;
michael@0: 	goto trust;
michael@0:     case CKA_TRUST_CODE_SIGNING:
michael@0: 	trustFlags = trust->trust->objectSigningFlags;
michael@0: trust:
michael@0: 	if (trustFlags & CERTDB_TRUSTED_CA ) {
michael@0: 	    return lg_ULongAttribute(attribute, type,
michael@0: 				     CKT_NSS_TRUSTED_DELEGATOR);
michael@0: 	}
michael@0: 	if (trustFlags & CERTDB_TRUSTED) {
michael@0: 	    return lg_ULongAttribute(attribute, type, CKT_NSS_TRUSTED);
michael@0: 	}
michael@0: 	if (trustFlags & CERTDB_MUST_VERIFY) {
michael@0: 	    return lg_ULongAttribute(attribute, type, 
michael@0: 				     CKT_NSS_MUST_VERIFY_TRUST);
michael@0: 	}
michael@0: 	if (trustFlags & CERTDB_TRUSTED_UNKNOWN) {
michael@0: 	    return lg_ULongAttribute(attribute, type, CKT_NSS_TRUST_UNKNOWN);
michael@0: 	}
michael@0: 	if (trustFlags & CERTDB_VALID_CA) {
michael@0: 	    return lg_ULongAttribute(attribute, type, CKT_NSS_VALID_DELEGATOR);
michael@0: 	}
michael@0: 	if (trustFlags & CERTDB_TERMINAL_RECORD) {
michael@0: 	    return lg_ULongAttribute(attribute, type, CKT_NSS_NOT_TRUSTED);
michael@0: 	}
michael@0: 	return lg_ULongAttribute(attribute, type, CKT_NSS_TRUST_UNKNOWN);
michael@0:     case CKA_TRUST_STEP_UP_APPROVED:
michael@0: 	if (trust->trust->sslFlags & CERTDB_GOVT_APPROVED_CA) {
michael@0: 	    return LG_CLONE_ATTR(attribute,type,lg_StaticTrueAttr);
michael@0: 	} else {
michael@0: 	    return LG_CLONE_ATTR(attribute,type,lg_StaticFalseAttr);
michael@0: 	}
michael@0:     default:
michael@0: 	break;
michael@0:     }
michael@0: 
michael@0: 
michael@0:     switch (type) {
michael@0:     case CKA_ISSUER:
michael@0: 	cert = lg_getCert(obj, certHandle);
michael@0: 	if (cert == NULL) break;
michael@0: 	crv = lg_CopyAttribute(attribute,type,cert->derIssuer.data,
michael@0: 						cert->derIssuer.len);
michael@0: 	break;
michael@0:     case CKA_SERIAL_NUMBER:
michael@0: 	cert = lg_getCert(obj, certHandle);
michael@0: 	if (cert == NULL) break;
michael@0: 	crv =  lg_CopyAttribute(attribute,type,cert->derSN.data,
michael@0: 						cert->derSN.len);
michael@0: 	break;
michael@0:     default:
michael@0: 	cert = NULL;
michael@0: 	break;
michael@0:     }
michael@0:     if (cert) {
michael@0: 	nsslowcert_DestroyCertificate(cert);
michael@0: 	return crv;
michael@0:     }
michael@0:     return lg_invalidAttribute(attribute);
michael@0: }
michael@0: 
michael@0: static CK_RV
michael@0: lg_FindCrlAttribute(LGObjectCache *obj, CK_ATTRIBUTE_TYPE type,
michael@0: 				CK_ATTRIBUTE *attribute)
michael@0: {
michael@0:     certDBEntryRevocation *crl;
michael@0: 
michael@0:     switch (type) {
michael@0:     case CKA_PRIVATE:
michael@0:     case CKA_MODIFIABLE:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticFalseAttr);
michael@0:     case CKA_NSS_KRL:
michael@0: 	return ((obj->handle == LG_TOKEN_KRL_HANDLE) 
michael@0: 		? LG_CLONE_ATTR(attribute,type,lg_StaticTrueAttr)
michael@0: 		: LG_CLONE_ATTR(attribute,type,lg_StaticFalseAttr));
michael@0:     case CKA_SUBJECT:
michael@0: 	return lg_CopyAttribute(attribute,type,obj->dbKey.data,
michael@0: 						obj->dbKey.len);
michael@0:     case CKA_NSS_URL:
michael@0:     case CKA_VALUE:
michael@0: 	break;
michael@0:     default:
michael@0: 	return lg_invalidAttribute(attribute);
michael@0:     }
michael@0:     crl =  lg_getCrl(obj);
michael@0:     if (!crl) {
michael@0: 	return CKR_OBJECT_HANDLE_INVALID;
michael@0:     }
michael@0:     switch (type) {
michael@0:     case CKA_NSS_URL:
michael@0: 	if (crl->url == NULL) {
michael@0: 	    return LG_CLONE_ATTR(attribute,type,lg_StaticNullAttr);
michael@0: 	}
michael@0: 	return lg_CopyAttribute(attribute, type, crl->url, 
michael@0: 					PORT_Strlen(crl->url)+1);
michael@0:     case CKA_VALUE:
michael@0: 	return lg_CopyAttribute(attribute, type, crl->derCrl.data, 
michael@0: 						crl->derCrl.len);
michael@0:     default:
michael@0: 	break;
michael@0:     }
michael@0:     return lg_invalidAttribute(attribute);
michael@0: }
michael@0: 
michael@0: static CK_RV
michael@0: lg_FindCertAttribute(LGObjectCache *obj, CK_ATTRIBUTE_TYPE type,
michael@0: 				CK_ATTRIBUTE *attribute)
michael@0: {
michael@0:     NSSLOWCERTCertificate  *cert;
michael@0:     NSSLOWCERTCertDBHandle *certHandle;
michael@0:     NSSLOWKEYPublicKey     *pubKey;
michael@0:     unsigned char hash[SHA1_LENGTH];
michael@0:     SECItem *item;
michael@0: 
michael@0:     switch (type) {
michael@0:     case CKA_PRIVATE:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticFalseAttr);
michael@0:     case CKA_MODIFIABLE:
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticTrueAttr);
michael@0:     case CKA_CERTIFICATE_TYPE:
michael@0:         /* hardcoding X.509 into here */
michael@0:         return lg_ULongAttribute(attribute, type, CKC_X_509);
michael@0:     case CKA_VALUE:
michael@0:     case CKA_ID:
michael@0:     case CKA_LABEL:
michael@0:     case CKA_SUBJECT:
michael@0:     case CKA_ISSUER:
michael@0:     case CKA_SERIAL_NUMBER:
michael@0:     case CKA_NSS_EMAIL:
michael@0: 	break;
michael@0:     default:
michael@0: 	return lg_invalidAttribute(attribute);
michael@0:     }
michael@0: 
michael@0:     certHandle = lg_getCertDB(obj->sdb);
michael@0:     if (certHandle == NULL) {
michael@0: 	return CKR_OBJECT_HANDLE_INVALID;
michael@0:     }
michael@0: 
michael@0:     cert = lg_getCert(obj, certHandle);
michael@0:     if (cert == NULL) {
michael@0: 	return CKR_OBJECT_HANDLE_INVALID;
michael@0:     }
michael@0:     switch (type) {
michael@0:     case CKA_VALUE:
michael@0: 	return lg_CopyAttribute(attribute,type,cert->derCert.data,
michael@0: 						cert->derCert.len);
michael@0:     case CKA_ID:
michael@0: 	if (((cert->trust->sslFlags & CERTDB_USER) == 0) &&
michael@0: 		((cert->trust->emailFlags & CERTDB_USER) == 0) &&
michael@0: 		((cert->trust->objectSigningFlags & CERTDB_USER) == 0)) {
michael@0: 	    return LG_CLONE_ATTR(attribute,type,lg_StaticNullAttr);
michael@0: 	}
michael@0: 	pubKey = nsslowcert_ExtractPublicKey(cert);
michael@0: 	if (pubKey == NULL) break;
michael@0: 	item = lg_GetPubItem(pubKey);
michael@0: 	if (item == NULL) {
michael@0: 	    lg_nsslowkey_DestroyPublicKey(pubKey);
michael@0: 	    break;
michael@0: 	}
michael@0: 	SHA1_HashBuf(hash,item->data,item->len);
michael@0: 	/* item is imbedded in pubKey, just free the key */
michael@0: 	lg_nsslowkey_DestroyPublicKey(pubKey);
michael@0: 	return lg_CopyAttribute(attribute, type, hash, SHA1_LENGTH);
michael@0:     case CKA_LABEL:
michael@0: 	return cert->nickname 
michael@0: 	       ? lg_CopyAttribute(attribute, type, cert->nickname,
michael@0: 				        PORT_Strlen(cert->nickname))
michael@0: 	       : LG_CLONE_ATTR(attribute,type,lg_StaticNullAttr);
michael@0:     case CKA_SUBJECT:
michael@0: 	return lg_CopyAttribute(attribute,type,cert->derSubject.data,
michael@0: 						cert->derSubject.len);
michael@0:     case CKA_ISSUER:
michael@0: 	return lg_CopyAttribute(attribute,type,cert->derIssuer.data,
michael@0: 						cert->derIssuer.len);
michael@0:     case CKA_SERIAL_NUMBER:
michael@0: 	return lg_CopyAttribute(attribute,type,cert->derSN.data,
michael@0: 						cert->derSN.len);
michael@0:     case CKA_NSS_EMAIL:
michael@0: 	return (cert->emailAddr && cert->emailAddr[0])
michael@0: 	    ? lg_CopyAttribute(attribute, type, cert->emailAddr,
michael@0: 	                             PORT_Strlen(cert->emailAddr))
michael@0: 	    : LG_CLONE_ATTR(attribute,type,lg_StaticNullAttr);
michael@0:     default:
michael@0: 	break;
michael@0:     }
michael@0:     return lg_invalidAttribute(attribute);
michael@0: }
michael@0: 
michael@0: CK_RV
michael@0: lg_GetSingleAttribute(LGObjectCache *obj, CK_ATTRIBUTE *attribute)
michael@0: {
michael@0:     /* handle the common ones */
michael@0:     CK_ATTRIBUTE_TYPE type = attribute->type;
michael@0:     switch (type) {
michael@0:     case CKA_CLASS:
michael@0: 	return lg_ULongAttribute(attribute,type,obj->objclass);
michael@0:     case CKA_TOKEN:
michael@0: 	return LG_CLONE_ATTR(attribute, type,lg_StaticTrueAttr);
michael@0:     case CKA_LABEL:
michael@0: 	if (  (obj->objclass == CKO_CERTIFICATE) 
michael@0: 	   || (obj->objclass == CKO_PRIVATE_KEY)
michael@0: 	   || (obj->objclass == CKO_PUBLIC_KEY)
michael@0: 	   || (obj->objclass == CKO_SECRET_KEY)) {
michael@0: 	    break;
michael@0: 	}
michael@0: 	return LG_CLONE_ATTR(attribute,type,lg_StaticNullAttr);
michael@0:     default:
michael@0: 	break;
michael@0:     }
michael@0:     switch (obj->objclass) {
michael@0:     case CKO_CERTIFICATE:
michael@0: 	return lg_FindCertAttribute(obj,type,attribute);
michael@0:     case CKO_NSS_CRL:
michael@0: 	return lg_FindCrlAttribute(obj,type,attribute);
michael@0:     case CKO_NSS_TRUST:
michael@0: 	return lg_FindTrustAttribute(obj,type,attribute);
michael@0:     case CKO_NSS_SMIME:
michael@0: 	return lg_FindSMIMEAttribute(obj,type,attribute);
michael@0:     case CKO_PUBLIC_KEY:
michael@0: 	return lg_FindPublicKeyAttribute(obj,type,attribute);
michael@0:     case CKO_PRIVATE_KEY:
michael@0: 	return lg_FindPrivateKeyAttribute(obj,type,attribute);
michael@0:     case CKO_SECRET_KEY:
michael@0: 	return lg_FindSecretKeyAttribute(obj,type,attribute);
michael@0:     default:
michael@0: 	break;
michael@0:     }
michael@0:     return lg_invalidAttribute(attribute);
michael@0: } 
michael@0: 
michael@0: /*
michael@0:  * Fill in the attribute template based on the data in the database.
michael@0:  */    
michael@0: CK_RV
michael@0: lg_GetAttributeValue(SDB *sdb, CK_OBJECT_HANDLE handle, CK_ATTRIBUTE *templ, 
michael@0: 		CK_ULONG count)
michael@0: {
michael@0:     LGObjectCache *obj = lg_NewObjectCache(sdb, NULL, handle & ~LG_TOKEN_MASK);
michael@0:     CK_RV crv, crvCollect = CKR_OK;
michael@0:     unsigned int i;
michael@0: 
michael@0:     if (obj == NULL) {
michael@0: 	return CKR_OBJECT_HANDLE_INVALID;
michael@0:     }
michael@0: 
michael@0:     for (i=0; i < count; i++) {
michael@0: 	crv = lg_GetSingleAttribute(obj, &templ[i]);
michael@0: 	if (crvCollect == CKR_OK) crvCollect = crv;
michael@0:     }
michael@0: 
michael@0:     lg_DestroyObjectCache(obj);
michael@0:     return crvCollect;
michael@0: }
michael@0: 
michael@0: PRBool
michael@0: lg_cmpAttribute(LGObjectCache *obj, const CK_ATTRIBUTE *attribute)
michael@0: {
michael@0:     unsigned char buf[LG_BUF_SPACE];
michael@0:     CK_ATTRIBUTE testAttr;
michael@0:     unsigned char *tempBuf = NULL;
michael@0:     PRBool match = PR_TRUE;
michael@0:     CK_RV crv;
michael@0: 
michael@0:     /* we're going to compare 'attribute' with the actual attribute from
michael@0:      * the object. We'll use the length of 'attribute' to decide how much
michael@0:      * space we need to read the test attribute. If 'attribute' doesn't give
michael@0:      * enough space, then we know the values don't match and that will
michael@0:      * show up as ckr != CKR_OK */
michael@0:     testAttr = *attribute;
michael@0:     testAttr.pValue = buf;
michael@0: 
michael@0:     /* if we don't have enough space, malloc it */
michael@0:     if (attribute->ulValueLen > LG_BUF_SPACE) {
michael@0: 	tempBuf = PORT_Alloc(attribute->ulValueLen);
michael@0: 	if (!tempBuf) {
michael@0: 	    return PR_FALSE;
michael@0: 	}
michael@0: 	testAttr.pValue = tempBuf;
michael@0:     }
michael@0: 
michael@0:     /* get the attribute */
michael@0:     crv = lg_GetSingleAttribute(obj, &testAttr);
michael@0:     /* if the attribute was read OK, compare it */
michael@0:     if ((crv != CKR_OK) || (attribute->ulValueLen != testAttr.ulValueLen) ||
michael@0:      (PORT_Memcmp(attribute->pValue,testAttr.pValue,testAttr.ulValueLen)!= 0)){
michael@0: 	/* something didn't match, this isn't the object we are looking for */
michael@0: 	match = PR_FALSE;
michael@0:     }
michael@0:     /* free the buffer we may have allocated */
michael@0:     if (tempBuf) {
michael@0: 	PORT_Free(tempBuf);
michael@0:     }
michael@0:     return match;
michael@0: }
michael@0: 
michael@0: PRBool
michael@0: lg_tokenMatch(SDB *sdb, const SECItem *dbKey, CK_OBJECT_HANDLE class,
michael@0: 		const CK_ATTRIBUTE *templ, CK_ULONG count)
michael@0: {
michael@0:     PRBool match = PR_TRUE;
michael@0:     LGObjectCache *obj = lg_NewObjectCache(sdb, dbKey, class);
michael@0:     unsigned int i;
michael@0: 
michael@0:     if (obj == NULL) {
michael@0: 	return PR_FALSE;
michael@0:     }
michael@0: 
michael@0:     for (i=0; i < count; i++) {
michael@0: 	match = lg_cmpAttribute(obj, &templ[i]);
michael@0: 	if (!match) {
michael@0: 	   break;
michael@0: 	}
michael@0:     }
michael@0: 
michael@0:     /* done looking, free up our cache */
michael@0:     lg_DestroyObjectCache(obj);
michael@0: 
michael@0:     /* if we get through the whole list without finding a mismatched attribute,
michael@0:      * then this object fits the criteria we are matching */
michael@0:     return match;
michael@0: }
michael@0: 
michael@0: static CK_RV
michael@0: lg_SetCertAttribute(LGObjectCache *obj, CK_ATTRIBUTE_TYPE type, 
michael@0: 					const void *value, unsigned int len)
michael@0: {
michael@0:     NSSLOWCERTCertificate  *cert;
michael@0:     NSSLOWCERTCertDBHandle *certHandle;
michael@0:     char *nickname = NULL;
michael@0:     SECStatus rv;
michael@0:     CK_RV crv;
michael@0: 
michael@0:     /* we can't change  the EMAIL values, but let the
michael@0:      * upper layers feel better about the fact we tried to set these */
michael@0:     if (type == CKA_NSS_EMAIL) {
michael@0: 	return CKR_OK;
michael@0:     }
michael@0: 
michael@0:     certHandle = lg_getCertDB(obj->sdb);
michael@0:     if (certHandle == NULL) {
michael@0: 	crv = CKR_TOKEN_WRITE_PROTECTED;
michael@0: 	goto done;
michael@0:     }
michael@0: 
michael@0:     if ((type != CKA_LABEL)  && (type != CKA_ID)) {
michael@0: 	crv = CKR_ATTRIBUTE_READ_ONLY;
michael@0: 	goto done;
michael@0:     }
michael@0: 
michael@0:     cert = lg_getCert(obj, certHandle);
michael@0:     if (cert == NULL) {
michael@0: 	crv = CKR_OBJECT_HANDLE_INVALID;
michael@0: 	goto done;
michael@0:     }
michael@0: 
michael@0:     /* if the app is trying to set CKA_ID, it's probably because it just
michael@0:      * imported the key. Look to see if we need to set the CERTDB_USER bits.
michael@0:      */
michael@0:     if (type == CKA_ID) {
michael@0: 	if (((cert->trust->sslFlags & CERTDB_USER) == 0) &&
michael@0: 		((cert->trust->emailFlags & CERTDB_USER) == 0) &&
michael@0: 		((cert->trust->objectSigningFlags & CERTDB_USER) == 0)) {
michael@0: 	    NSSLOWKEYDBHandle      *keyHandle;
michael@0: 
michael@0: 	    keyHandle = lg_getKeyDB(obj->sdb);
michael@0: 	    if (keyHandle) {
michael@0: 		if (nsslowkey_KeyForCertExists(keyHandle, cert)) {
michael@0: 		    NSSLOWCERTCertTrust trust = *cert->trust;
michael@0: 		    trust.sslFlags |= CERTDB_USER;
michael@0: 		    trust.emailFlags |= CERTDB_USER;
michael@0: 		    trust.objectSigningFlags |= CERTDB_USER;
michael@0: 		    nsslowcert_ChangeCertTrust(certHandle,cert,&trust);
michael@0: 		}
michael@0: 	    }
michael@0: 	}
michael@0: 	crv = CKR_OK;
michael@0: 	goto done;
michael@0:     }
michael@0: 
michael@0:     /* must be CKA_LABEL */
michael@0:     if (value != NULL) {
michael@0: 	nickname = PORT_ZAlloc(len+1);
michael@0: 	if (nickname == NULL) {
michael@0: 	    crv = CKR_HOST_MEMORY;
michael@0: 	    goto done;
michael@0: 	}
michael@0: 	PORT_Memcpy(nickname,value,len);
michael@0: 	nickname[len] = 0;
michael@0:     }
michael@0:     rv = nsslowcert_AddPermNickname(certHandle, cert, nickname);
michael@0:     crv = (rv == SECSuccess) ? CKR_OK : CKR_DEVICE_ERROR;
michael@0: 
michael@0: done:
michael@0:     if (nickname) {
michael@0: 	PORT_Free(nickname);
michael@0:     }
michael@0:     return crv;
michael@0: }
michael@0: 
michael@0: static CK_RV
michael@0: lg_SetPrivateKeyAttribute(LGObjectCache *obj, CK_ATTRIBUTE_TYPE type, 
michael@0: 			const void *value, unsigned int len, 
michael@0: 			PRBool *writePrivate)
michael@0: {
michael@0:     NSSLOWKEYPrivateKey *privKey;
michael@0:     NSSLOWKEYDBHandle   *keyHandle;
michael@0:     char *nickname = NULL;
michael@0:     SECStatus rv;
michael@0:     CK_RV crv;
michael@0: 
michael@0:     /* we can't change the ID and we don't store the subject, but let the
michael@0:      * upper layers feel better about the fact we tried to set these */
michael@0:     if ((type == CKA_ID) || (type == CKA_SUBJECT) ||
michael@0: 	(type == CKA_LOCAL) || (type == CKA_NEVER_EXTRACTABLE) ||
michael@0: 	(type == CKA_ALWAYS_SENSITIVE)) {
michael@0: 	return CKR_OK;
michael@0:     }
michael@0: 
michael@0:     keyHandle = lg_getKeyDB(obj->sdb);
michael@0:     if (keyHandle == NULL) {
michael@0: 	crv = CKR_TOKEN_WRITE_PROTECTED;
michael@0: 	goto done;
michael@0:     }
michael@0: 
michael@0:     privKey = lg_GetPrivateKeyWithDB(obj, keyHandle);
michael@0:     if (privKey == NULL) {
michael@0: 	crv = CKR_OBJECT_HANDLE_INVALID;
michael@0: 	goto done;
michael@0:     }
michael@0: 
michael@0:     crv = CKR_ATTRIBUTE_READ_ONLY;
michael@0:     switch(type) {
michael@0:     case CKA_LABEL:
michael@0: 	if (value != NULL) {
michael@0: 	    nickname = PORT_ZAlloc(len+1);
michael@0: 	    if (nickname == NULL) {
michael@0: 		crv = CKR_HOST_MEMORY;
michael@0: 		goto done;
michael@0: 	    }
michael@0: 	    PORT_Memcpy(nickname,value,len);
michael@0: 	    nickname[len] = 0;
michael@0: 	}
michael@0: 	rv = nsslowkey_UpdateNickname(keyHandle, privKey, &obj->dbKey, 
michael@0: 					nickname, obj->sdb);
michael@0: 	crv = (rv == SECSuccess) ? CKR_OK :  CKR_DEVICE_ERROR;
michael@0: 	break;
michael@0:     case CKA_UNWRAP:
michael@0:     case CKA_SIGN:
michael@0:     case CKA_DERIVE:
michael@0:     case CKA_SIGN_RECOVER:
michael@0:     case CKA_DECRYPT:
michael@0: 	/* ignore attempts to change restrict these.
michael@0: 	 * legacyDB ignore these flags and always presents all of them 
michael@0: 	 * that are valid as true. 
michael@0: 	 * NOTE: We only get here if the current value and the new value do
michael@0: 	 * not match. */
michael@0: 	if (*(char *)value == 0) {
michael@0: 	    crv = CKR_OK;
michael@0: 	}
michael@0: 	break;
michael@0:     case CKA_VALUE:
michael@0:     case CKA_PRIVATE_EXPONENT:
michael@0:     case CKA_PRIME_1:
michael@0:     case CKA_PRIME_2:
michael@0:     case CKA_EXPONENT_1:
michael@0:     case CKA_EXPONENT_2:
michael@0:     case CKA_COEFFICIENT:
michael@0: 	/* We aren't really changing these values, we are just triggering
michael@0: 	 * the database to update it's entry */
michael@0: 	*writePrivate = PR_TRUE;
michael@0: 	crv = CKR_OK;
michael@0: 	break;
michael@0:     default:
michael@0: 	crv = CKR_ATTRIBUTE_READ_ONLY;
michael@0: 	break;
michael@0:     }
michael@0: done:
michael@0:     if (nickname) {
michael@0: 	PORT_Free(nickname);
michael@0:     }
michael@0:     return crv;
michael@0: }
michael@0: 
michael@0: static CK_RV
michael@0: lg_SetPublicKeyAttribute(LGObjectCache *obj, CK_ATTRIBUTE_TYPE type, 
michael@0: 			const void *value, unsigned int len, 
michael@0: 			PRBool *writePrivate)
michael@0: {
michael@0:     /* we can't change the ID and we don't store the subject, but let the
michael@0:      * upper layers feel better about the fact we tried to set these */
michael@0:     if ((type == CKA_ID) || (type == CKA_SUBJECT) || (type == CKA_LABEL)) {
michael@0: 	return CKR_OK;
michael@0:     }
michael@0:     return  CKR_ATTRIBUTE_READ_ONLY;
michael@0: }
michael@0: 
michael@0: static CK_RV
michael@0: lg_SetTrustAttribute(LGObjectCache *obj, const CK_ATTRIBUTE *attr)
michael@0: {
michael@0:     unsigned int flags;
michael@0:     CK_TRUST  trust;
michael@0:     NSSLOWCERTCertificate  *cert;
michael@0:     NSSLOWCERTCertDBHandle *certHandle;
michael@0:     NSSLOWCERTCertTrust    dbTrust;
michael@0:     SECStatus rv;
michael@0:     CK_RV crv;
michael@0: 
michael@0:     if (attr->type == CKA_LABEL) {
michael@0: 	return CKR_OK;
michael@0:     }
michael@0: 
michael@0:     crv = lg_GetULongAttribute(attr->type, attr, 1, &trust);
michael@0:     if (crv != CKR_OK) {
michael@0: 	return crv;
michael@0:     }
michael@0:     flags = lg_MapTrust(trust, (PRBool) (attr->type == CKA_TRUST_CLIENT_AUTH));
michael@0: 
michael@0:     certHandle = lg_getCertDB(obj->sdb);
michael@0: 
michael@0:     if (certHandle == NULL) {
michael@0: 	crv = CKR_TOKEN_WRITE_PROTECTED;
michael@0: 	goto done;
michael@0:     }
michael@0: 
michael@0:     cert = lg_getCert(obj, certHandle);
michael@0:     if (cert == NULL) {
michael@0: 	crv = CKR_OBJECT_HANDLE_INVALID;
michael@0: 	goto done;
michael@0:     }
michael@0:     dbTrust = *cert->trust;
michael@0: 
michael@0:     switch (attr->type) {
michael@0:     case CKA_TRUST_EMAIL_PROTECTION:
michael@0: 	dbTrust.emailFlags = flags |
michael@0: 		(cert->trust->emailFlags & CERTDB_PRESERVE_TRUST_BITS);
michael@0: 	break;
michael@0:     case CKA_TRUST_CODE_SIGNING:
michael@0: 	dbTrust.objectSigningFlags = flags |
michael@0: 		(cert->trust->objectSigningFlags & CERTDB_PRESERVE_TRUST_BITS);
michael@0: 	break;
michael@0:     case CKA_TRUST_CLIENT_AUTH:
michael@0: 	dbTrust.sslFlags = flags | (cert->trust->sslFlags & 
michael@0: 				(CERTDB_PRESERVE_TRUST_BITS|CERTDB_TRUSTED_CA));
michael@0: 	break;
michael@0:     case CKA_TRUST_SERVER_AUTH:
michael@0: 	dbTrust.sslFlags = flags | (cert->trust->sslFlags & 
michael@0: 			(CERTDB_PRESERVE_TRUST_BITS|CERTDB_TRUSTED_CLIENT_CA));
michael@0: 	break;
michael@0:     default:
michael@0: 	crv = CKR_ATTRIBUTE_READ_ONLY;
michael@0: 	goto done;
michael@0:     }
michael@0: 
michael@0:     rv = nsslowcert_ChangeCertTrust(certHandle, cert, &dbTrust);
michael@0:     crv = (rv == SECSuccess) ? CKR_OK : CKR_DEVICE_ERROR;
michael@0: done:
michael@0:     return crv;
michael@0: }
michael@0: 
michael@0: static CK_RV
michael@0: lg_SetSingleAttribute(LGObjectCache *obj, const CK_ATTRIBUTE *attr, 
michael@0: 		      PRBool *writePrivate)
michael@0: {
michael@0:     CK_ATTRIBUTE attribLocal;
michael@0:     CK_RV crv;
michael@0: 
michael@0:     if ((attr->type == CKA_NETSCAPE_DB) && (obj->objclass == CKO_PRIVATE_KEY)) {
michael@0: 	*writePrivate = PR_TRUE;
michael@0: 	return CKR_OK;
michael@0:     }
michael@0: 
michael@0:     /* Make sure the attribute exists first */
michael@0:     attribLocal.type = attr->type;
michael@0:     attribLocal.pValue = NULL;
michael@0:     attribLocal.ulValueLen = 0;
michael@0:     crv = lg_GetSingleAttribute(obj, &attribLocal);
michael@0:     if (crv != CKR_OK) {
michael@0: 	return crv;
michael@0:     }
michael@0: 
michael@0:     /* if we are just setting it to the value we already have,
michael@0:      * allow it to happen. Let label setting go through so
michael@0:      * we have the opportunity to repair any database corruption. */
michael@0:     if (attr->type != CKA_LABEL) {
michael@0: 	if (lg_cmpAttribute(obj,attr)) {
michael@0: 	    return CKR_OK;
michael@0: 	}
michael@0:     }
michael@0: 
michael@0:     crv = CKR_ATTRIBUTE_READ_ONLY;
michael@0:     switch (obj->objclass) {
michael@0:     case CKO_CERTIFICATE:
michael@0: 	/* change NICKNAME, EMAIL,  */
michael@0: 	crv = lg_SetCertAttribute(obj,attr->type,
michael@0: 				  attr->pValue,attr->ulValueLen);
michael@0: 	break;
michael@0:     case CKO_NSS_CRL:
michael@0: 	/* change URL */
michael@0: 	break;
michael@0:     case CKO_NSS_TRUST:
michael@0: 	crv = lg_SetTrustAttribute(obj,attr);
michael@0: 	break;
michael@0:     case CKO_PRIVATE_KEY:
michael@0:     case CKO_SECRET_KEY:
michael@0: 	crv = lg_SetPrivateKeyAttribute(obj,attr->type,
michael@0: 			attr->pValue,attr->ulValueLen, writePrivate);
michael@0: 	break;
michael@0:     case CKO_PUBLIC_KEY:
michael@0: 	crv = lg_SetPublicKeyAttribute(obj,attr->type,
michael@0: 			attr->pValue,attr->ulValueLen, writePrivate);
michael@0: 	break;
michael@0:     }
michael@0:     return crv;
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * Fill in the attribute template based on the data in the database.
michael@0:  */    
michael@0: CK_RV
michael@0: lg_SetAttributeValue(SDB *sdb, CK_OBJECT_HANDLE handle, 
michael@0: 			const CK_ATTRIBUTE *templ, CK_ULONG count)
michael@0: {
michael@0:     LGObjectCache *obj = lg_NewObjectCache(sdb, NULL, handle & ~LG_TOKEN_MASK);
michael@0:     CK_RV crv, crvCollect = CKR_OK;
michael@0:     PRBool writePrivate = PR_FALSE;
michael@0:     unsigned int i;
michael@0: 
michael@0:     if (obj == NULL) {
michael@0: 	return CKR_OBJECT_HANDLE_INVALID;
michael@0:     }
michael@0: 
michael@0:     for (i=0; i < count; i++) {
michael@0: 	crv = lg_SetSingleAttribute(obj, &templ[i], &writePrivate);
michael@0: 	if (crvCollect == CKR_OK) crvCollect = crv;
michael@0:     }
michael@0: 
michael@0:     /* Write any collected changes out for private and secret keys.
michael@0:      *  don't do the write for just the label */
michael@0:     if (writePrivate) {
michael@0: 	NSSLOWKEYPrivateKey *privKey = lg_GetPrivateKey(obj);
michael@0: 	SECStatus rv = SECFailure;
michael@0: 	char * label = lg_FindKeyNicknameByPublicKey(obj->sdb, &obj->dbKey);
michael@0: 
michael@0: 	if (privKey) {
michael@0: 	    rv = nsslowkey_StoreKeyByPublicKeyAlg(lg_getKeyDB(sdb), privKey, 
michael@0: 		&obj->dbKey, label, sdb, PR_TRUE );
michael@0: 	}
michael@0: 	if (rv != SECSuccess) {
michael@0: 	    crv = CKR_DEVICE_ERROR;
michael@0: 	}
michael@0:     }
michael@0: 
michael@0:     lg_DestroyObjectCache(obj);
michael@0:     return crvCollect;
michael@0: }