michael@0: /* This Source Code Form is subject to the terms of the Mozilla Public
michael@0:  * License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0:  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0: 
michael@0: #ifndef PKIM_H
michael@0: #include "pkim.h"
michael@0: #endif /* PKIM_H */
michael@0: 
michael@0: #ifndef PKIT_H
michael@0: #include "pkit.h"
michael@0: #endif /* PKIT_H */
michael@0: 
michael@0: #ifndef NSSPKI_H
michael@0: #include "nsspki.h"
michael@0: #endif /* NSSPKI_H */
michael@0: 
michael@0: #ifndef PKI_H
michael@0: #include "pki.h"
michael@0: #endif /* PKI_H */
michael@0: 
michael@0: #ifndef NSSBASE_H
michael@0: #include "nssbase.h"
michael@0: #endif /* NSSBASE_H */
michael@0: 
michael@0: #ifndef BASE_H
michael@0: #include "base.h"
michael@0: #endif /* BASE_H */
michael@0: 
michael@0: #include "cert.h"
michael@0: #include "dev.h"
michael@0: #include "pki3hack.h"
michael@0: 
michael@0: #ifdef DEBUG_CACHE
michael@0: static PRLogModuleInfo *s_log = NULL;
michael@0: #endif
michael@0: 
michael@0: #ifdef DEBUG_CACHE
michael@0: static void log_item_dump(const char *msg, NSSItem *it)
michael@0: {
michael@0:     char buf[33];
michael@0:     int i, j;
michael@0:     for (i=0; i<10 && i<it->size; i++) {
michael@0: 	sprintf(&buf[2*i], "%02X", ((PRUint8 *)it->data)[i]);
michael@0:     }
michael@0:     if (it->size>10) {
michael@0: 	sprintf(&buf[2*i], "..");
michael@0: 	i += 1;
michael@0: 	for (j=it->size-1; i<=16 && j>10; i++, j--) {
michael@0: 	    sprintf(&buf[2*i], "%02X", ((PRUint8 *)it->data)[j]);
michael@0: 	}
michael@0:     }
michael@0:     PR_LOG(s_log, PR_LOG_DEBUG, ("%s: %s", msg, buf));
michael@0: }
michael@0: #endif
michael@0: 
michael@0: #ifdef DEBUG_CACHE
michael@0: static void log_cert_ref(const char *msg, NSSCertificate *c)
michael@0: {
michael@0:     PR_LOG(s_log, PR_LOG_DEBUG, ("%s: %s", msg,
michael@0:                            (c->nickname) ? c->nickname : c->email));
michael@0:     log_item_dump("\tserial", &c->serial);
michael@0:     log_item_dump("\tsubject", &c->subject);
michael@0: }
michael@0: #endif
michael@0: 
michael@0: /* Certificate cache routines */
michael@0: 
michael@0: /* XXX
michael@0:  * Locking is not handled well at all.  A single, global lock with sub-locks
michael@0:  * in the collection types.  Cleanup needed.
michael@0:  */
michael@0: 
michael@0: /* should it live in its own arena? */
michael@0: struct nssTDCertificateCacheStr 
michael@0: {
michael@0:     PZLock *lock;
michael@0:     NSSArena *arena;
michael@0:     nssHash *issuerAndSN;
michael@0:     nssHash *subject;
michael@0:     nssHash *nickname;
michael@0:     nssHash *email;
michael@0: };
michael@0: 
michael@0: struct cache_entry_str 
michael@0: {
michael@0:     union {
michael@0: 	NSSCertificate *cert;
michael@0: 	nssList *list;
michael@0: 	void *value;
michael@0:     } entry;
michael@0:     PRUint32 hits;
michael@0:     PRTime lastHit;
michael@0:     NSSArena *arena;
michael@0:     NSSUTF8 *nickname;
michael@0: };
michael@0: 
michael@0: typedef struct cache_entry_str cache_entry;
michael@0: 
michael@0: static cache_entry *
michael@0: new_cache_entry(NSSArena *arena, void *value, PRBool ownArena)
michael@0: {
michael@0:     cache_entry *ce = nss_ZNEW(arena, cache_entry);
michael@0:     if (ce) {
michael@0: 	ce->entry.value = value;
michael@0: 	ce->hits = 1;
michael@0: 	ce->lastHit = PR_Now();
michael@0: 	if (ownArena) {
michael@0: 	    ce->arena = arena;
michael@0: 	}
michael@0: 	ce->nickname = NULL;
michael@0:     }
michael@0:     return ce;
michael@0: }
michael@0: 
michael@0: /* this should not be exposed in a header, but is here to keep the above
michael@0:  * types/functions static
michael@0:  */
michael@0: NSS_IMPLEMENT PRStatus
michael@0: nssTrustDomain_InitializeCache (
michael@0:   NSSTrustDomain *td,
michael@0:   PRUint32 cacheSize
michael@0: )
michael@0: {
michael@0:     NSSArena *arena;
michael@0:     nssTDCertificateCache *cache = td->cache;
michael@0: #ifdef DEBUG_CACHE
michael@0:     s_log = PR_NewLogModule("nss_cache");
michael@0:     PR_ASSERT(s_log);
michael@0: #endif
michael@0:     PR_ASSERT(!cache);
michael@0:     arena = nssArena_Create();
michael@0:     if (!arena) {
michael@0: 	return PR_FAILURE;
michael@0:     }
michael@0:     cache = nss_ZNEW(arena, nssTDCertificateCache);
michael@0:     if (!cache) {
michael@0: 	nssArena_Destroy(arena);
michael@0: 	return PR_FAILURE;
michael@0:     }
michael@0:     cache->lock = PZ_NewLock(nssILockCache);
michael@0:     if (!cache->lock) {
michael@0: 	nssArena_Destroy(arena);
michael@0: 	return PR_FAILURE;
michael@0:     }
michael@0:     /* Create the issuer and serial DER --> certificate hash */
michael@0:     cache->issuerAndSN = nssHash_CreateCertificate(arena, cacheSize);
michael@0:     if (!cache->issuerAndSN) {
michael@0: 	goto loser;
michael@0:     }
michael@0:     /* Create the subject DER --> subject list hash */
michael@0:     cache->subject = nssHash_CreateItem(arena, cacheSize);
michael@0:     if (!cache->subject) {
michael@0: 	goto loser;
michael@0:     }
michael@0:     /* Create the nickname --> subject list hash */
michael@0:     cache->nickname = nssHash_CreateString(arena, cacheSize);
michael@0:     if (!cache->nickname) {
michael@0: 	goto loser;
michael@0:     }
michael@0:     /* Create the email --> list of subject lists hash */
michael@0:     cache->email = nssHash_CreateString(arena, cacheSize);
michael@0:     if (!cache->email) {
michael@0: 	goto loser;
michael@0:     }
michael@0:     cache->arena = arena;
michael@0:     td->cache = cache;
michael@0: #ifdef DEBUG_CACHE
michael@0:     PR_LOG(s_log, PR_LOG_DEBUG, ("Cache initialized."));
michael@0: #endif
michael@0:     return PR_SUCCESS;
michael@0: loser:
michael@0:     PZ_DestroyLock(cache->lock);
michael@0:     nssArena_Destroy(arena);
michael@0:     td->cache = NULL;
michael@0: #ifdef DEBUG_CACHE
michael@0:     PR_LOG(s_log, PR_LOG_DEBUG, ("Cache initialization failed."));
michael@0: #endif
michael@0:     return PR_FAILURE;
michael@0: }
michael@0: 
michael@0: /* The entries of the hashtable are currently dependent on the certificate(s)
michael@0:  * that produced them.  That is, the entries will be freed when the cert is
michael@0:  * released from the cache.  If there are certs in the cache at any time,
michael@0:  * including shutdown, the hash table entries will hold memory.  In order for
michael@0:  * clean shutdown, it is necessary for there to be no certs in the cache.
michael@0:  */
michael@0: 
michael@0: extern const NSSError NSS_ERROR_INTERNAL_ERROR;
michael@0: extern const NSSError NSS_ERROR_BUSY;
michael@0: 
michael@0: NSS_IMPLEMENT PRStatus
michael@0: nssTrustDomain_DestroyCache (
michael@0:   NSSTrustDomain *td
michael@0: )
michael@0: {
michael@0:     if (!td->cache) {
michael@0: 	nss_SetError(NSS_ERROR_INTERNAL_ERROR);
michael@0: 	return PR_FAILURE;
michael@0:     }
michael@0:     if (nssHash_Count(td->cache->issuerAndSN) > 0) {
michael@0: 	nss_SetError(NSS_ERROR_BUSY);
michael@0: 	return PR_FAILURE;
michael@0:     }
michael@0:     PZ_DestroyLock(td->cache->lock);
michael@0:     nssHash_Destroy(td->cache->issuerAndSN);
michael@0:     nssHash_Destroy(td->cache->subject);
michael@0:     nssHash_Destroy(td->cache->nickname);
michael@0:     nssHash_Destroy(td->cache->email);
michael@0:     nssArena_Destroy(td->cache->arena);
michael@0:     td->cache = NULL;
michael@0: #ifdef DEBUG_CACHE
michael@0:     PR_LOG(s_log, PR_LOG_DEBUG, ("Cache destroyed."));
michael@0: #endif
michael@0:     return PR_SUCCESS;
michael@0: }
michael@0: 
michael@0: static PRStatus
michael@0: remove_issuer_and_serial_entry (
michael@0:   nssTDCertificateCache *cache,
michael@0:   NSSCertificate *cert
michael@0: )
michael@0: {
michael@0:     /* Remove the cert from the issuer/serial hash */
michael@0:     nssHash_Remove(cache->issuerAndSN, cert);
michael@0: #ifdef DEBUG_CACHE
michael@0:     log_cert_ref("removed issuer/sn", cert);
michael@0: #endif
michael@0:     return PR_SUCCESS;
michael@0: }
michael@0: 
michael@0: static PRStatus
michael@0: remove_subject_entry (
michael@0:   nssTDCertificateCache *cache,
michael@0:   NSSCertificate *cert,
michael@0:   nssList **subjectList,
michael@0:   NSSUTF8 **nickname,
michael@0:   NSSArena **arena
michael@0: )
michael@0: {
michael@0:     PRStatus nssrv;
michael@0:     cache_entry *ce;
michael@0:     *subjectList = NULL;
michael@0:     *arena = NULL;
michael@0:     /* Get the subject list for the cert's subject */
michael@0:     ce = (cache_entry *)nssHash_Lookup(cache->subject, &cert->subject);
michael@0:     if (ce) {
michael@0: 	/* Remove the cert from the subject hash */
michael@0: 	nssList_Remove(ce->entry.list, cert);
michael@0: 	*subjectList = ce->entry.list;
michael@0: 	*nickname = ce->nickname;
michael@0: 	*arena = ce->arena;
michael@0: 	nssrv = PR_SUCCESS;
michael@0: #ifdef DEBUG_CACHE
michael@0: 	log_cert_ref("removed cert", cert);
michael@0: 	log_item_dump("from subject list", &cert->subject);
michael@0: #endif
michael@0:     } else {
michael@0: 	nssrv = PR_FAILURE;
michael@0:     }
michael@0:     return nssrv;
michael@0: }
michael@0: 
michael@0: static PRStatus
michael@0: remove_nickname_entry (
michael@0:   nssTDCertificateCache *cache,
michael@0:   NSSUTF8 *nickname,
michael@0:   nssList *subjectList
michael@0: )
michael@0: {
michael@0:     PRStatus nssrv;
michael@0:     if (nickname) {
michael@0: 	nssHash_Remove(cache->nickname, nickname);
michael@0: 	nssrv = PR_SUCCESS;
michael@0: #ifdef DEBUG_CACHE
michael@0: 	PR_LOG(s_log, PR_LOG_DEBUG, ("removed nickname %s", nickname));
michael@0: #endif
michael@0:     } else {
michael@0: 	nssrv = PR_FAILURE;
michael@0:     }
michael@0:     return nssrv;
michael@0: }
michael@0: 
michael@0: static PRStatus
michael@0: remove_email_entry (
michael@0:   nssTDCertificateCache *cache,
michael@0:   NSSCertificate *cert,
michael@0:   nssList *subjectList
michael@0: )
michael@0: {
michael@0:     PRStatus nssrv = PR_FAILURE;
michael@0:     cache_entry *ce;
michael@0:     /* Find the subject list in the email hash */
michael@0:     if (cert->email) {
michael@0: 	ce = (cache_entry *)nssHash_Lookup(cache->email, cert->email);
michael@0: 	if (ce) {
michael@0: 	    nssList *subjects = ce->entry.list;
michael@0: 	    /* Remove the subject list from the email hash */
michael@0: 	    nssList_Remove(subjects, subjectList);
michael@0: #ifdef DEBUG_CACHE
michael@0: 	    log_item_dump("removed subject list", &cert->subject);
michael@0: 	    PR_LOG(s_log, PR_LOG_DEBUG, ("for email %s", cert->email));
michael@0: #endif
michael@0: 	    if (nssList_Count(subjects) == 0) {
michael@0: 		/* No more subject lists for email, delete list and
michael@0: 		* remove hash entry
michael@0: 		*/
michael@0: 		(void)nssList_Destroy(subjects);
michael@0: 		nssHash_Remove(cache->email, cert->email);
michael@0: 		/* there are no entries left for this address, free space
michael@0: 		 * used for email entries
michael@0: 		 */
michael@0: 		nssArena_Destroy(ce->arena);
michael@0: #ifdef DEBUG_CACHE
michael@0: 		PR_LOG(s_log, PR_LOG_DEBUG, ("removed email %s", cert->email));
michael@0: #endif
michael@0: 	    }
michael@0: 	    nssrv = PR_SUCCESS;
michael@0: 	}
michael@0:     }
michael@0:     return nssrv;
michael@0: }
michael@0: 
michael@0: NSS_IMPLEMENT void
michael@0: nssTrustDomain_RemoveCertFromCacheLOCKED (
michael@0:   NSSTrustDomain *td,
michael@0:   NSSCertificate *cert
michael@0: )
michael@0: {
michael@0:     nssList *subjectList;
michael@0:     cache_entry *ce;
michael@0:     NSSArena *arena;
michael@0:     NSSUTF8 *nickname;
michael@0: 
michael@0: #ifdef DEBUG_CACHE
michael@0:     log_cert_ref("attempt to remove cert", cert);
michael@0: #endif
michael@0:     ce = (cache_entry *)nssHash_Lookup(td->cache->issuerAndSN, cert);
michael@0:     if (!ce || ce->entry.cert != cert) {
michael@0: 	/* If it's not in the cache, or a different cert is (this is really
michael@0: 	 * for safety reasons, though it shouldn't happen), do nothing 
michael@0: 	 */
michael@0: #ifdef DEBUG_CACHE
michael@0: 	PR_LOG(s_log, PR_LOG_DEBUG, ("but it wasn't in the cache"));
michael@0: #endif
michael@0: 	return;
michael@0:     }
michael@0:     (void)remove_issuer_and_serial_entry(td->cache, cert);
michael@0:     (void)remove_subject_entry(td->cache, cert, &subjectList, 
michael@0:                                &nickname, &arena);
michael@0:     if (nssList_Count(subjectList) == 0) {
michael@0: 	(void)remove_nickname_entry(td->cache, nickname, subjectList);
michael@0: 	(void)remove_email_entry(td->cache, cert, subjectList);
michael@0: 	(void)nssList_Destroy(subjectList);
michael@0: 	nssHash_Remove(td->cache->subject, &cert->subject);
michael@0: 	/* there are no entries left for this subject, free the space used
michael@0: 	 * for both the nickname and subject entries
michael@0: 	 */
michael@0: 	if (arena) {
michael@0: 	    nssArena_Destroy(arena);
michael@0: 	}
michael@0:     }
michael@0: }
michael@0: 
michael@0: NSS_IMPLEMENT void
michael@0: nssTrustDomain_LockCertCache (
michael@0:   NSSTrustDomain *td
michael@0: )
michael@0: {
michael@0:     PZ_Lock(td->cache->lock);
michael@0: }
michael@0: 
michael@0: NSS_IMPLEMENT void
michael@0: nssTrustDomain_UnlockCertCache (
michael@0:   NSSTrustDomain *td
michael@0: )
michael@0: {
michael@0:     PZ_Unlock(td->cache->lock);
michael@0: }
michael@0: 
michael@0: struct token_cert_dtor {
michael@0:     NSSToken *token;
michael@0:     nssTDCertificateCache *cache;
michael@0:     NSSCertificate **certs;
michael@0:     PRUint32 numCerts, arrSize;
michael@0: };
michael@0: 
michael@0: static void 
michael@0: remove_token_certs(const void *k, void *v, void *a)
michael@0: {
michael@0:     NSSCertificate *c = (NSSCertificate *)k;
michael@0:     nssPKIObject *object = &c->object;
michael@0:     struct token_cert_dtor *dtor = a;
michael@0:     PRUint32 i;
michael@0:     nssPKIObject_Lock(object);
michael@0:     for (i=0; i<object->numInstances; i++) {
michael@0: 	if (object->instances[i]->token == dtor->token) {
michael@0: 	    nssCryptokiObject_Destroy(object->instances[i]);
michael@0: 	    object->instances[i] = object->instances[object->numInstances-1];
michael@0: 	    object->instances[object->numInstances-1] = NULL;
michael@0: 	    object->numInstances--;
michael@0: 	    dtor->certs[dtor->numCerts++] = c;
michael@0: 	    if (dtor->numCerts == dtor->arrSize) {
michael@0: 		dtor->arrSize *= 2;
michael@0: 		dtor->certs = nss_ZREALLOCARRAY(dtor->certs, 
michael@0: 		                                NSSCertificate *,
michael@0: 		                                dtor->arrSize);
michael@0: 	    }
michael@0: 	    break;
michael@0: 	}
michael@0:     }
michael@0:     nssPKIObject_Unlock(object);
michael@0:     return;
michael@0: }
michael@0: 
michael@0: /* 
michael@0:  * Remove all certs for the given token from the cache.  This is
michael@0:  * needed if the token is removed. 
michael@0:  */
michael@0: NSS_IMPLEMENT PRStatus
michael@0: nssTrustDomain_RemoveTokenCertsFromCache (
michael@0:   NSSTrustDomain *td,
michael@0:   NSSToken *token
michael@0: )
michael@0: {
michael@0:     NSSCertificate **certs;
michael@0:     PRUint32 i, arrSize = 10;
michael@0:     struct token_cert_dtor dtor;
michael@0:     certs = nss_ZNEWARRAY(NULL, NSSCertificate *, arrSize);
michael@0:     if (!certs) {
michael@0: 	return PR_FAILURE;
michael@0:     }
michael@0:     dtor.cache = td->cache;
michael@0:     dtor.token = token;
michael@0:     dtor.certs = certs;
michael@0:     dtor.numCerts = 0;
michael@0:     dtor.arrSize = arrSize;
michael@0:     PZ_Lock(td->cache->lock);
michael@0:     nssHash_Iterate(td->cache->issuerAndSN, remove_token_certs, (void *)&dtor);
michael@0:     for (i=0; i<dtor.numCerts; i++) {
michael@0: 	if (dtor.certs[i]->object.numInstances == 0) {
michael@0: 	    nssTrustDomain_RemoveCertFromCacheLOCKED(td, dtor.certs[i]);
michael@0: 	    dtor.certs[i] = NULL;  /* skip this cert in the second for loop */
michael@0: 	}
michael@0:     }
michael@0:     PZ_Unlock(td->cache->lock);
michael@0:     for (i=0; i<dtor.numCerts; i++) {
michael@0: 	if (dtor.certs[i]) {
michael@0: 	    STAN_ForceCERTCertificateUpdate(dtor.certs[i]);
michael@0: 	}
michael@0:     }
michael@0:     nss_ZFreeIf(dtor.certs);
michael@0:     return PR_SUCCESS;
michael@0: }
michael@0: 
michael@0: NSS_IMPLEMENT PRStatus
michael@0: nssTrustDomain_UpdateCachedTokenCerts (
michael@0:   NSSTrustDomain *td,
michael@0:   NSSToken *token
michael@0: )
michael@0: {
michael@0:     NSSCertificate **cp, **cached = NULL;
michael@0:     nssList *certList;
michael@0:     PRUint32 count;
michael@0:     certList = nssList_Create(NULL, PR_FALSE);
michael@0:     if (!certList) return PR_FAILURE;
michael@0:     (void)nssTrustDomain_GetCertsFromCache(td, certList);
michael@0:     count = nssList_Count(certList);
michael@0:     if (count > 0) {
michael@0: 	cached = nss_ZNEWARRAY(NULL, NSSCertificate *, count + 1);
michael@0: 	if (!cached) {
michael@0: 	    nssList_Destroy(certList);
michael@0: 	    return PR_FAILURE;
michael@0: 	}
michael@0: 	nssList_GetArray(certList, (void **)cached, count);
michael@0: 	for (cp = cached; *cp; cp++) {
michael@0: 	    nssCryptokiObject *instance;
michael@0: 	    NSSCertificate *c = *cp;
michael@0: 	    nssTokenSearchType tokenOnly = nssTokenSearchType_TokenOnly;
michael@0: 	    instance = nssToken_FindCertificateByIssuerAndSerialNumber(
michael@0: 	                                                       token,
michael@0:                                                                NULL,
michael@0:                                                                &c->issuer,
michael@0:                                                                &c->serial,
michael@0:                                                                tokenOnly,
michael@0:                                                                NULL);
michael@0: 	    if (instance) {
michael@0: 		nssPKIObject_AddInstance(&c->object, instance);
michael@0: 		STAN_ForceCERTCertificateUpdate(c);
michael@0: 	    }
michael@0: 	}
michael@0: 	nssCertificateArray_Destroy(cached);
michael@0:     }
michael@0:     nssList_Destroy(certList);
michael@0:     return PR_SUCCESS;
michael@0: }
michael@0: 
michael@0: static PRStatus
michael@0: add_issuer_and_serial_entry (
michael@0:   NSSArena *arena,
michael@0:   nssTDCertificateCache *cache, 
michael@0:   NSSCertificate *cert
michael@0: )
michael@0: {
michael@0:     cache_entry *ce;
michael@0:     ce = new_cache_entry(arena, (void *)cert, PR_FALSE);
michael@0: #ifdef DEBUG_CACHE
michael@0:     log_cert_ref("added to issuer/sn", cert);
michael@0: #endif
michael@0:     return nssHash_Add(cache->issuerAndSN, cert, (void *)ce);
michael@0: }
michael@0: 
michael@0: static PRStatus
michael@0: add_subject_entry (
michael@0:   NSSArena *arena,
michael@0:   nssTDCertificateCache *cache, 
michael@0:   NSSCertificate *cert,
michael@0:   NSSUTF8 *nickname,
michael@0:   nssList **subjectList
michael@0: )
michael@0: {
michael@0:     PRStatus nssrv;
michael@0:     nssList *list;
michael@0:     cache_entry *ce;
michael@0:     *subjectList = NULL;  /* this is only set if a new one is created */
michael@0:     ce = (cache_entry *)nssHash_Lookup(cache->subject, &cert->subject);
michael@0:     if (ce) {
michael@0: 	ce->hits++;
michael@0: 	ce->lastHit = PR_Now();
michael@0: 	/* The subject is already in, add this cert to the list */
michael@0: 	nssrv = nssList_AddUnique(ce->entry.list, cert);
michael@0: #ifdef DEBUG_CACHE
michael@0: 	log_cert_ref("added to existing subject list", cert);
michael@0: #endif
michael@0:     } else {
michael@0: 	NSSDER *subject;
michael@0: 	/* Create a new subject list for the subject */
michael@0: 	list = nssList_Create(arena, PR_FALSE);
michael@0: 	if (!list) {
michael@0: 	    return PR_FAILURE;
michael@0: 	}
michael@0: 	ce = new_cache_entry(arena, (void *)list, PR_TRUE);
michael@0: 	if (!ce) {
michael@0: 	    return PR_FAILURE;
michael@0: 	}
michael@0: 	if (nickname) {
michael@0: 	    ce->nickname = nssUTF8_Duplicate(nickname, arena);
michael@0: 	}
michael@0: 	nssList_SetSortFunction(list, nssCertificate_SubjectListSort);
michael@0: 	/* Add the cert entry to this list of subjects */
michael@0: 	nssrv = nssList_AddUnique(list, cert);
michael@0: 	if (nssrv != PR_SUCCESS) {
michael@0: 	    return nssrv;
michael@0: 	}
michael@0: 	/* Add the subject list to the cache */
michael@0: 	subject = nssItem_Duplicate(&cert->subject, arena, NULL);
michael@0: 	if (!subject) {
michael@0: 	    return PR_FAILURE;
michael@0: 	}
michael@0: 	nssrv = nssHash_Add(cache->subject, subject, ce);
michael@0: 	if (nssrv != PR_SUCCESS) {
michael@0: 	    return nssrv;
michael@0: 	}
michael@0: 	*subjectList = list;
michael@0: #ifdef DEBUG_CACHE
michael@0: 	log_cert_ref("created subject list", cert);
michael@0: #endif
michael@0:     }
michael@0:     return nssrv;
michael@0: }
michael@0: 
michael@0: static PRStatus
michael@0: add_nickname_entry (
michael@0:   NSSArena *arena,
michael@0:   nssTDCertificateCache *cache, 
michael@0:   NSSUTF8 *certNickname,
michael@0:   nssList *subjectList
michael@0: )
michael@0: {
michael@0:     PRStatus nssrv = PR_SUCCESS;
michael@0:     cache_entry *ce;
michael@0:     ce = (cache_entry *)nssHash_Lookup(cache->nickname, certNickname);
michael@0:     if (ce) {
michael@0: 	/* This is a collision.  A nickname entry already exists for this
michael@0: 	 * subject, but a subject entry didn't.  This would imply there are
michael@0: 	 * two subjects using the same nickname, which is not allowed.
michael@0: 	 */
michael@0: 	return PR_FAILURE;
michael@0:     } else {
michael@0: 	NSSUTF8 *nickname;
michael@0: 	ce = new_cache_entry(arena, subjectList, PR_FALSE);
michael@0: 	if (!ce) {
michael@0: 	    return PR_FAILURE;
michael@0: 	}
michael@0: 	nickname = nssUTF8_Duplicate(certNickname, arena);
michael@0: 	if (!nickname) {
michael@0: 	    return PR_FAILURE;
michael@0: 	}
michael@0: 	nssrv = nssHash_Add(cache->nickname, nickname, ce);
michael@0: #ifdef DEBUG_CACHE
michael@0: 	log_cert_ref("created nickname for", cert);
michael@0: #endif
michael@0:     }
michael@0:     return nssrv;
michael@0: }
michael@0: 
michael@0: static PRStatus
michael@0: add_email_entry (
michael@0:   nssTDCertificateCache *cache, 
michael@0:   NSSCertificate *cert,
michael@0:   nssList *subjectList
michael@0: )
michael@0: {
michael@0:     PRStatus nssrv = PR_SUCCESS;
michael@0:     nssList *subjects;
michael@0:     cache_entry *ce;
michael@0:     ce = (cache_entry *)nssHash_Lookup(cache->email, cert->email);
michael@0:     if (ce) {
michael@0: 	/* Already have an entry for this email address, but not subject */
michael@0: 	subjects = ce->entry.list;
michael@0: 	nssrv = nssList_AddUnique(subjects, subjectList);
michael@0: 	ce->hits++;
michael@0: 	ce->lastHit = PR_Now();
michael@0: #ifdef DEBUG_CACHE
michael@0: 	log_cert_ref("added subject to email for", cert);
michael@0: #endif
michael@0:     } else {
michael@0: 	NSSASCII7 *email;
michael@0: 	NSSArena *arena;
michael@0: 	arena = nssArena_Create();
michael@0: 	if (!arena) {
michael@0: 	    return PR_FAILURE;
michael@0: 	}
michael@0: 	/* Create a new list of subject lists, add this subject */
michael@0: 	subjects = nssList_Create(arena, PR_TRUE);
michael@0: 	if (!subjects) {
michael@0: 	    nssArena_Destroy(arena);
michael@0: 	    return PR_FAILURE;
michael@0: 	}
michael@0: 	/* Add the new subject to the list */
michael@0: 	nssrv = nssList_AddUnique(subjects, subjectList);
michael@0: 	if (nssrv != PR_SUCCESS) {
michael@0: 	    nssArena_Destroy(arena);
michael@0: 	    return nssrv;
michael@0: 	}
michael@0: 	/* Add the new entry to the cache */
michael@0: 	ce = new_cache_entry(arena, (void *)subjects, PR_TRUE);
michael@0: 	if (!ce) {
michael@0: 	    nssArena_Destroy(arena);
michael@0: 	    return PR_FAILURE;
michael@0: 	}
michael@0: 	email = nssUTF8_Duplicate(cert->email, arena);
michael@0: 	if (!email) {
michael@0: 	    nssArena_Destroy(arena);
michael@0: 	    return PR_FAILURE;
michael@0: 	}
michael@0: 	nssrv = nssHash_Add(cache->email, email, ce);
michael@0: 	if (nssrv != PR_SUCCESS) {
michael@0: 	    nssArena_Destroy(arena);
michael@0: 	    return nssrv;
michael@0: 	}
michael@0: #ifdef DEBUG_CACHE
michael@0: 	log_cert_ref("created email for", cert);
michael@0: #endif
michael@0:     }
michael@0:     return nssrv;
michael@0: }
michael@0: 
michael@0: extern const NSSError NSS_ERROR_CERTIFICATE_IN_CACHE;
michael@0: 
michael@0: static void
michael@0: remove_object_instances (
michael@0:   nssPKIObject *object,
michael@0:   nssCryptokiObject **instances,
michael@0:   int numInstances
michael@0: )
michael@0: {
michael@0:     int i;
michael@0: 
michael@0:     for (i = 0; i < numInstances; i++) {
michael@0: 	nssPKIObject_RemoveInstanceForToken(object, instances[i]->token);
michael@0:     }
michael@0: }
michael@0: 
michael@0: static SECStatus
michael@0: merge_object_instances (
michael@0:   nssPKIObject *to,
michael@0:   nssPKIObject *from
michael@0: )
michael@0: {
michael@0:     nssCryptokiObject **instances, **ci;
michael@0:     int i;
michael@0:     SECStatus rv = SECSuccess;
michael@0: 
michael@0:     instances = nssPKIObject_GetInstances(from);
michael@0:     if (instances == NULL) {
michael@0: 	return SECFailure;
michael@0:     }
michael@0:     for (ci = instances, i = 0; *ci; ci++, i++) {
michael@0: 	nssCryptokiObject *instance = nssCryptokiObject_Clone(*ci);
michael@0: 	if (instance) {
michael@0: 	    if (nssPKIObject_AddInstance(to, instance) == PR_SUCCESS) {
michael@0: 		continue;
michael@0: 	    }
michael@0: 	    nssCryptokiObject_Destroy(instance);
michael@0: 	}
michael@0: 	remove_object_instances(to, instances, i);
michael@0: 	rv = SECFailure;
michael@0: 	break;
michael@0:     }
michael@0:     nssCryptokiObjectArray_Destroy(instances);
michael@0:     return rv;
michael@0: }
michael@0: 
michael@0: static NSSCertificate *
michael@0: add_cert_to_cache (
michael@0:   NSSTrustDomain *td, 
michael@0:   NSSCertificate *cert
michael@0: )
michael@0: {
michael@0:     NSSArena *arena = NULL;
michael@0:     nssList *subjectList = NULL;
michael@0:     PRStatus nssrv;
michael@0:     PRUint32 added = 0;
michael@0:     cache_entry *ce;
michael@0:     NSSCertificate *rvCert = NULL;
michael@0:     NSSUTF8 *certNickname = nssCertificate_GetNickname(cert, NULL);
michael@0: 
michael@0:     PZ_Lock(td->cache->lock);
michael@0:     /* If it exists in the issuer/serial hash, it's already in all */
michael@0:     ce = (cache_entry *)nssHash_Lookup(td->cache->issuerAndSN, cert);
michael@0:     if (ce) {
michael@0: 	ce->hits++;
michael@0: 	ce->lastHit = PR_Now();
michael@0: 	rvCert = nssCertificate_AddRef(ce->entry.cert);
michael@0: #ifdef DEBUG_CACHE
michael@0: 	log_cert_ref("attempted to add cert already in cache", cert);
michael@0: #endif
michael@0: 	PZ_Unlock(td->cache->lock);
michael@0:         nss_ZFreeIf(certNickname);
michael@0: 	/* collision - somebody else already added the cert
michael@0: 	 * to the cache before this thread got around to it.
michael@0: 	 */
michael@0: 	/* merge the instances of the cert */
michael@0: 	if (merge_object_instances(&rvCert->object, &cert->object)
michael@0: 							!= SECSuccess) {
michael@0: 	    nssCertificate_Destroy(rvCert);
michael@0: 	    return NULL;
michael@0: 	}
michael@0: 	STAN_ForceCERTCertificateUpdate(rvCert);
michael@0: 	nssCertificate_Destroy(cert);
michael@0: 	return rvCert;
michael@0:     }
michael@0:     /* create a new cache entry for this cert within the cert's arena*/
michael@0:     nssrv = add_issuer_and_serial_entry(cert->object.arena, td->cache, cert);
michael@0:     if (nssrv != PR_SUCCESS) {
michael@0: 	goto loser;
michael@0:     }
michael@0:     added++;
michael@0:     /* create an arena for the nickname and subject entries */
michael@0:     arena = nssArena_Create();
michael@0:     if (!arena) {
michael@0: 	goto loser;
michael@0:     }
michael@0:     /* create a new subject list for this cert, or add to existing */
michael@0:     nssrv = add_subject_entry(arena, td->cache, cert, 
michael@0: 						certNickname, &subjectList);
michael@0:     if (nssrv != PR_SUCCESS) {
michael@0: 	goto loser;
michael@0:     }
michael@0:     added++;
michael@0:     /* If a new subject entry was created, also need nickname and/or email */
michael@0:     if (subjectList != NULL) {
michael@0: 	PRBool handle = PR_FALSE;
michael@0: 	if (certNickname) {
michael@0: 	    nssrv = add_nickname_entry(arena, td->cache, 
michael@0: 						certNickname, subjectList);
michael@0: 	    if (nssrv != PR_SUCCESS) {
michael@0: 		goto loser;
michael@0: 	    }
michael@0: 	    handle = PR_TRUE;
michael@0: 	    added++;
michael@0: 	}
michael@0: 	if (cert->email) {
michael@0: 	    nssrv = add_email_entry(td->cache, cert, subjectList);
michael@0: 	    if (nssrv != PR_SUCCESS) {
michael@0: 		goto loser;
michael@0: 	    }
michael@0: 	    handle = PR_TRUE;
michael@0: 	    added += 2;
michael@0: 	}
michael@0: #ifdef nodef
michael@0: 	/* I think either a nickname or email address must be associated
michael@0: 	 * with the cert.  However, certs are passed to NewTemp without
michael@0: 	 * either.  This worked in the old code, so it must work now.
michael@0: 	 */
michael@0: 	if (!handle) {
michael@0: 	    /* Require either nickname or email handle */
michael@0: 	    nssrv = PR_FAILURE;
michael@0: 	    goto loser;
michael@0: 	}
michael@0: #endif
michael@0:     } else {
michael@0:     	/* A new subject entry was not created.  arena is unused. */
michael@0: 	nssArena_Destroy(arena);
michael@0:     }
michael@0:     rvCert = cert;
michael@0:     PZ_Unlock(td->cache->lock);
michael@0:     nss_ZFreeIf(certNickname);
michael@0:     return rvCert;
michael@0: loser:
michael@0:     nss_ZFreeIf(certNickname);
michael@0:     certNickname = NULL;
michael@0:     /* Remove any handles that have been created */
michael@0:     subjectList = NULL;
michael@0:     if (added >= 1) {
michael@0: 	(void)remove_issuer_and_serial_entry(td->cache, cert);
michael@0:     }
michael@0:     if (added >= 2) {
michael@0: 	(void)remove_subject_entry(td->cache, cert, &subjectList, 
michael@0: 						&certNickname, &arena);
michael@0:     }
michael@0:     if (added == 3 || added == 5) {
michael@0: 	(void)remove_nickname_entry(td->cache, certNickname, subjectList);
michael@0:     }
michael@0:     if (added >= 4) {
michael@0: 	(void)remove_email_entry(td->cache, cert, subjectList);
michael@0:     }
michael@0:     if (subjectList) {
michael@0: 	nssHash_Remove(td->cache->subject, &cert->subject);
michael@0: 	nssList_Destroy(subjectList);
michael@0:     }
michael@0:     if (arena) {
michael@0: 	nssArena_Destroy(arena);
michael@0:     }
michael@0:     PZ_Unlock(td->cache->lock);
michael@0:     return NULL;
michael@0: }
michael@0: 
michael@0: NSS_IMPLEMENT PRStatus
michael@0: nssTrustDomain_AddCertsToCache (
michael@0:   NSSTrustDomain *td,
michael@0:   NSSCertificate **certs,
michael@0:   PRUint32 numCerts
michael@0: )
michael@0: {
michael@0:     PRUint32 i;
michael@0:     NSSCertificate *c;
michael@0:     for (i=0; i<numCerts && certs[i]; i++) {
michael@0: 	c = add_cert_to_cache(td, certs[i]);
michael@0: 	if (c == NULL) {
michael@0: 	    return PR_FAILURE;
michael@0: 	} else {
michael@0: 	    certs[i] = c;
michael@0: 	}
michael@0:     }
michael@0:     return PR_SUCCESS;
michael@0: }
michael@0: 
michael@0: static NSSCertificate **
michael@0: collect_subject_certs (
michael@0:   nssList *subjectList,
michael@0:   nssList *rvCertListOpt
michael@0: )
michael@0: {
michael@0:     NSSCertificate *c;
michael@0:     NSSCertificate **rvArray = NULL;
michael@0:     PRUint32 count;
michael@0:     nssCertificateList_AddReferences(subjectList);
michael@0:     if (rvCertListOpt) {
michael@0: 	nssListIterator *iter = nssList_CreateIterator(subjectList);
michael@0: 	if (!iter) {
michael@0: 	    return (NSSCertificate **)NULL;
michael@0: 	}
michael@0: 	for (c  = (NSSCertificate *)nssListIterator_Start(iter);
michael@0: 	     c != (NSSCertificate *)NULL;
michael@0: 	     c  = (NSSCertificate *)nssListIterator_Next(iter)) {
michael@0: 	    nssList_Add(rvCertListOpt, c);
michael@0: 	}
michael@0: 	nssListIterator_Finish(iter);
michael@0: 	nssListIterator_Destroy(iter);
michael@0:     } else {
michael@0: 	count = nssList_Count(subjectList);
michael@0: 	rvArray = nss_ZNEWARRAY(NULL, NSSCertificate *, count + 1);
michael@0: 	if (!rvArray) {
michael@0: 	    return (NSSCertificate **)NULL;
michael@0: 	}
michael@0: 	nssList_GetArray(subjectList, (void **)rvArray, count);
michael@0:     }
michael@0:     return rvArray;
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * Find all cached certs with this subject.
michael@0:  */
michael@0: NSS_IMPLEMENT NSSCertificate **
michael@0: nssTrustDomain_GetCertsForSubjectFromCache (
michael@0:   NSSTrustDomain *td,
michael@0:   NSSDER *subject,
michael@0:   nssList *certListOpt
michael@0: )
michael@0: {
michael@0:     NSSCertificate **rvArray = NULL;
michael@0:     cache_entry *ce;
michael@0: #ifdef DEBUG_CACHE
michael@0:     log_item_dump("looking for cert by subject", subject);
michael@0: #endif
michael@0:     PZ_Lock(td->cache->lock);
michael@0:     ce = (cache_entry *)nssHash_Lookup(td->cache->subject, subject);
michael@0:     if (ce) {
michael@0: 	ce->hits++;
michael@0: 	ce->lastHit = PR_Now();
michael@0: #ifdef DEBUG_CACHE
michael@0: 	PR_LOG(s_log, PR_LOG_DEBUG, ("... found, %d hits", ce->hits));
michael@0: #endif
michael@0: 	rvArray = collect_subject_certs(ce->entry.list, certListOpt);
michael@0:     }
michael@0:     PZ_Unlock(td->cache->lock);
michael@0:     return rvArray;
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * Find all cached certs with this label.
michael@0:  */
michael@0: NSS_IMPLEMENT NSSCertificate **
michael@0: nssTrustDomain_GetCertsForNicknameFromCache (
michael@0:   NSSTrustDomain *td,
michael@0:   const NSSUTF8 *nickname,
michael@0:   nssList *certListOpt
michael@0: )
michael@0: {
michael@0:     NSSCertificate **rvArray = NULL;
michael@0:     cache_entry *ce;
michael@0: #ifdef DEBUG_CACHE
michael@0:     PR_LOG(s_log, PR_LOG_DEBUG, ("looking for cert by nick %s", nickname));
michael@0: #endif
michael@0:     PZ_Lock(td->cache->lock);
michael@0:     ce = (cache_entry *)nssHash_Lookup(td->cache->nickname, nickname);
michael@0:     if (ce) {
michael@0: 	ce->hits++;
michael@0: 	ce->lastHit = PR_Now();
michael@0: #ifdef DEBUG_CACHE
michael@0: 	PR_LOG(s_log, PR_LOG_DEBUG, ("... found, %d hits", ce->hits));
michael@0: #endif
michael@0: 	rvArray = collect_subject_certs(ce->entry.list, certListOpt);
michael@0:     }
michael@0:     PZ_Unlock(td->cache->lock);
michael@0:     return rvArray;
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * Find all cached certs with this email address.
michael@0:  */
michael@0: NSS_IMPLEMENT NSSCertificate **
michael@0: nssTrustDomain_GetCertsForEmailAddressFromCache (
michael@0:   NSSTrustDomain *td,
michael@0:   NSSASCII7 *email,
michael@0:   nssList *certListOpt
michael@0: )
michael@0: {
michael@0:     NSSCertificate **rvArray = NULL;
michael@0:     cache_entry *ce;
michael@0:     nssList *collectList = NULL;
michael@0:     nssListIterator *iter = NULL;
michael@0:     nssList *subjectList;
michael@0: #ifdef DEBUG_CACHE
michael@0:     PR_LOG(s_log, PR_LOG_DEBUG, ("looking for cert by email %s", email));
michael@0: #endif
michael@0:     PZ_Lock(td->cache->lock);
michael@0:     ce = (cache_entry *)nssHash_Lookup(td->cache->email, email);
michael@0:     if (ce) {
michael@0: 	ce->hits++;
michael@0: 	ce->lastHit = PR_Now();
michael@0: #ifdef DEBUG_CACHE
michael@0: 	PR_LOG(s_log, PR_LOG_DEBUG, ("... found, %d hits", ce->hits));
michael@0: #endif
michael@0: 	/* loop over subject lists and get refs for certs */
michael@0: 	if (certListOpt) {
michael@0: 	    collectList = certListOpt;
michael@0: 	} else {
michael@0: 	    collectList = nssList_Create(NULL, PR_FALSE);
michael@0: 	    if (!collectList) {
michael@0: 		PZ_Unlock(td->cache->lock);
michael@0: 		return NULL;
michael@0: 	    }
michael@0: 	}
michael@0: 	iter = nssList_CreateIterator(ce->entry.list);
michael@0: 	if (!iter) {
michael@0: 	    PZ_Unlock(td->cache->lock);
michael@0: 	    if (!certListOpt) {
michael@0: 		nssList_Destroy(collectList);
michael@0: 	    }
michael@0: 	    return NULL;
michael@0: 	}
michael@0: 	for (subjectList  = (nssList *)nssListIterator_Start(iter);
michael@0: 	     subjectList != (nssList *)NULL;
michael@0: 	     subjectList  = (nssList *)nssListIterator_Next(iter)) {
michael@0: 	    (void)collect_subject_certs(subjectList, collectList);
michael@0: 	}
michael@0: 	nssListIterator_Finish(iter);
michael@0: 	nssListIterator_Destroy(iter);
michael@0:     }
michael@0:     PZ_Unlock(td->cache->lock);
michael@0:     if (!certListOpt && collectList) {
michael@0: 	PRUint32 count = nssList_Count(collectList);
michael@0: 	rvArray = nss_ZNEWARRAY(NULL, NSSCertificate *, count);
michael@0: 	if (rvArray) {
michael@0: 	    nssList_GetArray(collectList, (void **)rvArray, count);
michael@0: 	}
michael@0: 	nssList_Destroy(collectList);
michael@0:     }
michael@0:     return rvArray;
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * Look for a specific cert in the cache
michael@0:  */
michael@0: NSS_IMPLEMENT NSSCertificate *
michael@0: nssTrustDomain_GetCertForIssuerAndSNFromCache (
michael@0:   NSSTrustDomain *td,
michael@0:   NSSDER *issuer,
michael@0:   NSSDER *serial
michael@0: )
michael@0: {
michael@0:     NSSCertificate certkey;
michael@0:     NSSCertificate *rvCert = NULL;
michael@0:     cache_entry *ce;
michael@0:     certkey.issuer.data = issuer->data;
michael@0:     certkey.issuer.size = issuer->size;
michael@0:     certkey.serial.data = serial->data;
michael@0:     certkey.serial.size = serial->size;
michael@0: #ifdef DEBUG_CACHE
michael@0:     log_item_dump("looking for cert by issuer/sn, issuer", issuer);
michael@0:     log_item_dump("                               serial", serial);
michael@0: #endif
michael@0:     PZ_Lock(td->cache->lock);
michael@0:     ce = (cache_entry *)nssHash_Lookup(td->cache->issuerAndSN, &certkey);
michael@0:     if (ce) {
michael@0: 	ce->hits++;
michael@0: 	ce->lastHit = PR_Now();
michael@0: 	rvCert = nssCertificate_AddRef(ce->entry.cert);
michael@0: #ifdef DEBUG_CACHE
michael@0: 	PR_LOG(s_log, PR_LOG_DEBUG, ("... found, %d hits", ce->hits));
michael@0: #endif
michael@0:     }
michael@0:     PZ_Unlock(td->cache->lock);
michael@0:     return rvCert;
michael@0: }
michael@0: 
michael@0: static PRStatus
michael@0: issuer_and_serial_from_encoding (
michael@0:   NSSBER *encoding, 
michael@0:   NSSDER *issuer, 
michael@0:   NSSDER *serial
michael@0: )
michael@0: {
michael@0:     SECItem derCert, derIssuer, derSerial;
michael@0:     SECStatus secrv;
michael@0:     derCert.data = (unsigned char *)encoding->data;
michael@0:     derCert.len = encoding->size;
michael@0:     secrv = CERT_IssuerNameFromDERCert(&derCert, &derIssuer);
michael@0:     if (secrv != SECSuccess) {
michael@0: 	return PR_FAILURE;
michael@0:     }
michael@0:     secrv = CERT_SerialNumberFromDERCert(&derCert, &derSerial);
michael@0:     if (secrv != SECSuccess) {
michael@0: 	return PR_FAILURE;
michael@0:     }
michael@0:     issuer->data = derIssuer.data;
michael@0:     issuer->size = derIssuer.len;
michael@0:     serial->data = derSerial.data;
michael@0:     serial->size = derSerial.len;
michael@0:     return PR_SUCCESS;
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * Look for a specific cert in the cache
michael@0:  */
michael@0: NSS_IMPLEMENT NSSCertificate *
michael@0: nssTrustDomain_GetCertByDERFromCache (
michael@0:   NSSTrustDomain *td,
michael@0:   NSSDER *der
michael@0: )
michael@0: {
michael@0:     PRStatus nssrv = PR_FAILURE;
michael@0:     NSSDER issuer, serial;
michael@0:     NSSCertificate *rvCert;
michael@0:     nssrv = issuer_and_serial_from_encoding(der, &issuer, &serial);
michael@0:     if (nssrv != PR_SUCCESS) {
michael@0: 	return NULL;
michael@0:     }
michael@0: #ifdef DEBUG_CACHE
michael@0:     log_item_dump("looking for cert by DER", der);
michael@0: #endif
michael@0:     rvCert = nssTrustDomain_GetCertForIssuerAndSNFromCache(td, 
michael@0:                                                            &issuer, &serial);
michael@0:     PORT_Free(issuer.data);
michael@0:     PORT_Free(serial.data);
michael@0:     return rvCert;
michael@0: }
michael@0: 
michael@0: static void cert_iter(const void *k, void *v, void *a)
michael@0: {
michael@0:     nssList *certList = (nssList *)a;
michael@0:     NSSCertificate *c = (NSSCertificate *)k;
michael@0:     nssList_Add(certList, nssCertificate_AddRef(c));
michael@0: }
michael@0: 
michael@0: NSS_EXTERN NSSCertificate **
michael@0: nssTrustDomain_GetCertsFromCache (
michael@0:   NSSTrustDomain *td,
michael@0:   nssList *certListOpt
michael@0: )
michael@0: {
michael@0:     NSSCertificate **rvArray = NULL;
michael@0:     nssList *certList;
michael@0:     if (certListOpt) {
michael@0: 	certList = certListOpt;
michael@0:     } else {
michael@0: 	certList = nssList_Create(NULL, PR_FALSE);
michael@0: 	if (!certList) {
michael@0: 	    return NULL;
michael@0: 	}
michael@0:     }
michael@0:     PZ_Lock(td->cache->lock);
michael@0:     nssHash_Iterate(td->cache->issuerAndSN, cert_iter, (void *)certList);
michael@0:     PZ_Unlock(td->cache->lock);
michael@0:     if (!certListOpt) {
michael@0: 	PRUint32 count = nssList_Count(certList);
michael@0: 	rvArray = nss_ZNEWARRAY(NULL, NSSCertificate *, count);
michael@0: 	nssList_GetArray(certList, (void **)rvArray, count);
michael@0: 	/* array takes the references */
michael@0: 	nssList_Destroy(certList);
michael@0:     }
michael@0:     return rvArray;
michael@0: }
michael@0: 
michael@0: NSS_IMPLEMENT void
michael@0: nssTrustDomain_DumpCacheInfo (
michael@0:   NSSTrustDomain *td,
michael@0:   void (* cert_dump_iter)(const void *, void *, void *),
michael@0:   void *arg
michael@0: )
michael@0: {
michael@0:     PZ_Lock(td->cache->lock);
michael@0:     nssHash_Iterate(td->cache->issuerAndSN, cert_dump_iter, arg);
michael@0:     PZ_Unlock(td->cache->lock);
michael@0: }