michael@0: /* This Source Code Form is subject to the terms of the Mozilla Public
michael@0:  * License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0:  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0: 
michael@0: /* To edit this file, set TABSTOPS to 4 spaces. 
michael@0:  * This is not the normal NSS convention. 
michael@0:  */
michael@0: 
michael@0: #include "modutil.h"
michael@0: #include "install.h"
michael@0: #include <plstr.h>
michael@0: #include "certdb.h" /* for CERT_DB_FILE_VERSION */
michael@0: #include "nss.h"
michael@0: 
michael@0: static void install_error(char *message);
michael@0: static char* PR_fgets(char *buf, int size, PRFileDesc *file);
michael@0: static char *progName;
michael@0: 
michael@0: 
michael@0: /* This enum must be kept in sync with the commandNames list */
michael@0: typedef enum {
michael@0: 	NO_COMMAND,
michael@0: 	ADD_COMMAND,
michael@0: 	CHANGEPW_COMMAND,
michael@0: 	CREATE_COMMAND,
michael@0: 	DEFAULT_COMMAND,
michael@0: 	DELETE_COMMAND,
michael@0: 	DISABLE_COMMAND,
michael@0: 	ENABLE_COMMAND,
michael@0: 	FIPS_COMMAND,
michael@0: 	JAR_COMMAND,
michael@0: 	LIST_COMMAND,
michael@0: 	RAW_LIST_COMMAND,
michael@0: 	RAW_ADD_COMMAND,
michael@0: 	CHKFIPS_COMMAND,
michael@0: 	UNDEFAULT_COMMAND
michael@0: } Command;
michael@0: 
michael@0: /* This list must be kept in sync with the Command enum */
michael@0: static char *commandNames[] = {
michael@0: 	"(no command)",
michael@0: 	"-add",
michael@0: 	"-changepw",
michael@0: 	"-create",
michael@0: 	"-default",
michael@0: 	"-delete",
michael@0: 	"-disable",
michael@0: 	"-enable",
michael@0: 	"-fips",
michael@0: 	"-jar",
michael@0: 	"-list",
michael@0: 	"-rawlist",
michael@0: 	"-rawadd",
michael@0: 	"-chkfips",
michael@0: 	"-undefault"
michael@0: };
michael@0: 
michael@0: 
michael@0: /* this enum must be kept in sync with the optionStrings list */
michael@0: typedef enum {
michael@0: 	ADD_ARG=0,
michael@0: 	RAW_ADD_ARG,
michael@0: 	CHANGEPW_ARG,
michael@0: 	CIPHERS_ARG,
michael@0: 	CREATE_ARG,
michael@0: 	DBDIR_ARG,
michael@0: 	DBPREFIX_ARG,
michael@0: 	DEFAULT_ARG,
michael@0: 	DELETE_ARG,
michael@0: 	DISABLE_ARG,
michael@0: 	ENABLE_ARG,
michael@0: 	FIPS_ARG,
michael@0: 	FORCE_ARG,
michael@0: 	JAR_ARG,
michael@0: 	LIBFILE_ARG,
michael@0: 	LIST_ARG,
michael@0: 	RAW_LIST_ARG,
michael@0: 	MECHANISMS_ARG,
michael@0: 	NEWPWFILE_ARG,
michael@0: 	PWFILE_ARG,
michael@0: 	SLOT_ARG,
michael@0: 	UNDEFAULT_ARG,
michael@0: 	INSTALLDIR_ARG,
michael@0: 	TEMPDIR_ARG,
michael@0: 	SECMOD_ARG,
michael@0: 	NOCERTDB_ARG,
michael@0: 	STRING_ARG,
michael@0: 	CHKFIPS_ARG,
michael@0: 
michael@0: 	NUM_ARGS	/* must be last */
michael@0: } Arg;
michael@0: 
michael@0: /* This list must be kept in sync with the Arg enum */
michael@0: static char *optionStrings[] = {
michael@0: 	"-add",
michael@0: 	"-rawadd",
michael@0: 	"-changepw",
michael@0: 	"-ciphers",
michael@0: 	"-create",
michael@0: 	"-dbdir",
michael@0: 	"-dbprefix",
michael@0: 	"-default",
michael@0: 	"-delete",
michael@0: 	"-disable",
michael@0: 	"-enable",
michael@0: 	"-fips",
michael@0: 	"-force",
michael@0: 	"-jar",
michael@0: 	"-libfile",
michael@0: 	"-list",
michael@0: 	"-rawlist",
michael@0: 	"-mechanisms",
michael@0: 	"-newpwfile",
michael@0: 	"-pwfile",
michael@0: 	"-slot",
michael@0: 	"-undefault",
michael@0: 	"-installdir",
michael@0: 	"-tempdir",
michael@0: 	"-secmod",
michael@0: 	"-nocertdb",
michael@0: 	"-string",
michael@0: 	"-chkfips",
michael@0: };
michael@0: 
michael@0: /* Increment i if doing so would have i still be less than j.  If you
michael@0:    are able to do this, return 0.  Otherwise return 1. */
michael@0: #define TRY_INC(i,j)  ( ((i+1)<j) ? (++i, 0) : 1 )
michael@0: 
michael@0: /********************************************************************
michael@0:  *
michael@0:  * file-wide variables obtained from the command line
michael@0:  */
michael@0: static Command command = NO_COMMAND;
michael@0: static char* pwFile = NULL;
michael@0: static char* newpwFile = NULL;
michael@0: static char* moduleName = NULL;
michael@0: static char* moduleSpec = NULL;
michael@0: static char* slotName = NULL;
michael@0: static char* secmodName = NULL;
michael@0: static char* tokenName = NULL;
michael@0: static char* libFile = NULL;
michael@0: static char* dbdir = NULL;
michael@0: static char* dbprefix = "";
michael@0: static char* secmodString = NULL;
michael@0: static char* mechanisms = NULL;
michael@0: static char* ciphers = NULL;
michael@0: static char* fipsArg = NULL;
michael@0: static char* jarFile = NULL;
michael@0: static char* installDir = NULL;
michael@0: static char* tempDir = NULL;
michael@0: static short force = 0;
michael@0: static PRBool nocertdb = PR_FALSE;
michael@0: 
michael@0: /*******************************************************************
michael@0:  *
michael@0:  * p a r s e _ a r g s
michael@0:  */
michael@0: static Error
michael@0: parse_args(int argc, char *argv[])
michael@0: {
michael@0: 	int i;
michael@0: 	char *arg;
michael@0: 	int optionType;
michael@0: 
michael@0: 	/* Loop over all arguments */
michael@0: 	for(i=1; i < argc; i++) {
michael@0: 		arg = argv[i];
michael@0: 
michael@0: 		/* Make sure this is an option and not some floating argument */
michael@0: 		if(arg[0] != '-') {
michael@0: 			PR_fprintf(PR_STDERR, errStrings[UNEXPECTED_ARG_ERR], argv[i]);
michael@0: 			return UNEXPECTED_ARG_ERR;
michael@0: 		}
michael@0: 
michael@0: 		/* Find which option this is */
michael@0: 		for(optionType=0; optionType < NUM_ARGS; optionType++) {
michael@0: 			if(! strcmp(arg, optionStrings[optionType])) {
michael@0: 				break;
michael@0: 			}
michael@0: 		}
michael@0: 		
michael@0: 		/* Deal with this specific option */
michael@0: 		switch(optionType) {
michael@0: 		case NUM_ARGS:
michael@0: 		default:
michael@0: 			PR_fprintf(PR_STDERR, errStrings[UNKNOWN_OPTION_ERR], arg);
michael@0: 			return UNKNOWN_OPTION_ERR;
michael@0: 			break;
michael@0: 		case ADD_ARG:
michael@0: 			if(command != NO_COMMAND) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[MULTIPLE_COMMAND_ERR], arg);
michael@0: 				return MULTIPLE_COMMAND_ERR;
michael@0: 			}
michael@0: 			command = ADD_COMMAND;
michael@0: 			if(TRY_INC(i, argc)) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[OPTION_NEEDS_ARG_ERR], arg);
michael@0: 				return OPTION_NEEDS_ARG_ERR;
michael@0: 			}
michael@0: 			moduleName = argv[i];
michael@0: 			break;
michael@0: 		case CHANGEPW_ARG:
michael@0: 			if(command != NO_COMMAND) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[MULTIPLE_COMMAND_ERR], arg);
michael@0: 				return MULTIPLE_COMMAND_ERR;
michael@0: 			}
michael@0: 			command = CHANGEPW_COMMAND;
michael@0: 			if(TRY_INC(i, argc)) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[OPTION_NEEDS_ARG_ERR], arg);
michael@0: 				return OPTION_NEEDS_ARG_ERR;
michael@0: 			}
michael@0: 			tokenName = argv[i];
michael@0: 			break;
michael@0: 		case CIPHERS_ARG:
michael@0: 			if(ciphers != NULL) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[DUPLICATE_OPTION_ERR], arg);
michael@0: 				return DUPLICATE_OPTION_ERR;
michael@0: 			}
michael@0: 			if(TRY_INC(i, argc)) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[OPTION_NEEDS_ARG_ERR], arg);
michael@0: 				return OPTION_NEEDS_ARG_ERR;
michael@0: 			}
michael@0: 			ciphers = argv[i];
michael@0: 			break;
michael@0: 		case CREATE_ARG:
michael@0: 			if(command != NO_COMMAND) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[MULTIPLE_COMMAND_ERR], arg);
michael@0: 				return MULTIPLE_COMMAND_ERR;
michael@0: 			}
michael@0: 			command = CREATE_COMMAND;
michael@0: 			break;
michael@0: 		case DBDIR_ARG:
michael@0: 			if(dbdir != NULL) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[DUPLICATE_OPTION_ERR], arg);
michael@0: 				return DUPLICATE_OPTION_ERR;
michael@0: 			}
michael@0: 			if(TRY_INC(i, argc)) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[OPTION_NEEDS_ARG_ERR], arg);
michael@0: 				return OPTION_NEEDS_ARG_ERR;
michael@0: 			}
michael@0: 			dbdir = argv[i];
michael@0: 			break;
michael@0: 		case DBPREFIX_ARG:
michael@0: 			if(TRY_INC(i, argc)) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[OPTION_NEEDS_ARG_ERR], arg);
michael@0: 				return OPTION_NEEDS_ARG_ERR;
michael@0: 			}
michael@0: 			dbprefix = argv[i];
michael@0: 			break;
michael@0: 		case UNDEFAULT_ARG:
michael@0: 		case DEFAULT_ARG:
michael@0: 			if(command != NO_COMMAND) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[MULTIPLE_COMMAND_ERR], arg);
michael@0: 				return MULTIPLE_COMMAND_ERR;
michael@0: 			}
michael@0: 			if(optionType == DEFAULT_ARG) {
michael@0: 				command = DEFAULT_COMMAND;
michael@0: 			} else {
michael@0: 				command = UNDEFAULT_COMMAND;
michael@0: 			}
michael@0: 			if(TRY_INC(i, argc)) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[OPTION_NEEDS_ARG_ERR], arg);
michael@0: 				return OPTION_NEEDS_ARG_ERR;
michael@0: 			}
michael@0: 			moduleName = argv[i];
michael@0: 			break;
michael@0: 		case DELETE_ARG:
michael@0: 			if(command != NO_COMMAND) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[MULTIPLE_COMMAND_ERR], arg);
michael@0: 				return MULTIPLE_COMMAND_ERR;
michael@0: 			}
michael@0: 			command = DELETE_COMMAND;
michael@0: 			if(TRY_INC(i, argc)) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[OPTION_NEEDS_ARG_ERR], arg);
michael@0: 				return OPTION_NEEDS_ARG_ERR;
michael@0: 			}
michael@0: 			moduleName = argv[i];
michael@0: 			break;
michael@0: 		case DISABLE_ARG:
michael@0: 			if(command != NO_COMMAND) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[MULTIPLE_COMMAND_ERR], arg);
michael@0: 				return MULTIPLE_COMMAND_ERR;
michael@0: 			}
michael@0: 			command = DISABLE_COMMAND;
michael@0: 			if(TRY_INC(i, argc)) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[OPTION_NEEDS_ARG_ERR], arg);
michael@0: 				return OPTION_NEEDS_ARG_ERR;
michael@0: 			}
michael@0: 			moduleName = argv[i];
michael@0: 			break;
michael@0: 		case ENABLE_ARG:
michael@0: 			if(command != NO_COMMAND) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[MULTIPLE_COMMAND_ERR], arg);
michael@0: 				return MULTIPLE_COMMAND_ERR;
michael@0: 			}
michael@0: 			command = ENABLE_COMMAND;
michael@0: 			if(TRY_INC(i, argc)) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[OPTION_NEEDS_ARG_ERR], arg);
michael@0: 				return OPTION_NEEDS_ARG_ERR;
michael@0: 			}
michael@0: 			moduleName = argv[i];
michael@0: 			break;
michael@0: 		case FIPS_ARG:
michael@0: 			if(command != NO_COMMAND) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[MULTIPLE_COMMAND_ERR], arg);
michael@0: 				return MULTIPLE_COMMAND_ERR;
michael@0: 			}
michael@0: 			command = FIPS_COMMAND;
michael@0: 			if(TRY_INC(i, argc)) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[OPTION_NEEDS_ARG_ERR], arg);
michael@0: 				return OPTION_NEEDS_ARG_ERR;
michael@0: 			}
michael@0: 			fipsArg = argv[i];
michael@0: 			break;
michael@0: 		case CHKFIPS_ARG:
michael@0: 			if(command != NO_COMMAND) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[MULTIPLE_COMMAND_ERR], arg);
michael@0: 				return MULTIPLE_COMMAND_ERR;
michael@0: 			}
michael@0: 			command = CHKFIPS_COMMAND;
michael@0: 			if(TRY_INC(i, argc)) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[OPTION_NEEDS_ARG_ERR], arg);
michael@0: 				return OPTION_NEEDS_ARG_ERR;
michael@0: 			}
michael@0: 			fipsArg = argv[i];
michael@0: 			break;
michael@0: 		case FORCE_ARG:
michael@0: 			force = 1;
michael@0: 			break;
michael@0: 		case NOCERTDB_ARG:
michael@0: 			nocertdb = PR_TRUE;
michael@0: 			break;
michael@0: 		case INSTALLDIR_ARG:
michael@0: 			if(installDir != NULL) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[DUPLICATE_OPTION_ERR], arg);
michael@0: 				return DUPLICATE_OPTION_ERR;
michael@0: 			}
michael@0: 			if(TRY_INC(i, argc)) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[OPTION_NEEDS_ARG_ERR], arg);
michael@0: 				return OPTION_NEEDS_ARG_ERR;
michael@0: 			}
michael@0: 			installDir = argv[i];
michael@0: 			break;
michael@0: 		case TEMPDIR_ARG:
michael@0: 			if(tempDir != NULL) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[DUPLICATE_OPTION_ERR], arg);
michael@0: 				return DUPLICATE_OPTION_ERR;
michael@0: 			}
michael@0: 			if(TRY_INC(i, argc)) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[OPTION_NEEDS_ARG_ERR], arg);
michael@0: 				return OPTION_NEEDS_ARG_ERR;
michael@0: 			}
michael@0: 			tempDir = argv[i];
michael@0: 			break;
michael@0: 		case JAR_ARG:
michael@0: 			if(command != NO_COMMAND) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[MULTIPLE_COMMAND_ERR], arg);
michael@0: 				return MULTIPLE_COMMAND_ERR;
michael@0: 			}
michael@0: 			command = JAR_COMMAND;
michael@0: 			if(TRY_INC(i, argc)) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[OPTION_NEEDS_ARG_ERR], arg);
michael@0: 				return OPTION_NEEDS_ARG_ERR;
michael@0: 			}
michael@0: 			jarFile = argv[i];
michael@0: 			break;
michael@0: 		case LIBFILE_ARG:
michael@0: 			if(libFile != NULL) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[DUPLICATE_OPTION_ERR], arg);
michael@0: 				return DUPLICATE_OPTION_ERR;
michael@0: 			}
michael@0: 			if(TRY_INC(i, argc)) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[OPTION_NEEDS_ARG_ERR], arg);
michael@0: 				return OPTION_NEEDS_ARG_ERR;
michael@0: 			}
michael@0: 			libFile = argv[i];
michael@0: 			break;
michael@0: 		case LIST_ARG:
michael@0: 			if(command != NO_COMMAND) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[MULTIPLE_COMMAND_ERR], arg);
michael@0: 				return MULTIPLE_COMMAND_ERR;
michael@0: 			}
michael@0: 			command = LIST_COMMAND;
michael@0: 			/* This option may or may not have an argument */
michael@0: 			if( (i+1 < argc) && (argv[i+1][0] != '-') ) {
michael@0: 				moduleName = argv[++i];
michael@0: 			}
michael@0: 			break;
michael@0: 		case RAW_LIST_ARG:
michael@0: 			if(command != NO_COMMAND) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[MULTIPLE_COMMAND_ERR], arg);
michael@0: 				return MULTIPLE_COMMAND_ERR;
michael@0: 			}
michael@0: 			command = RAW_LIST_COMMAND;
michael@0: 			/* This option may or may not have an argument */
michael@0: 			if( (i+1 < argc) && (argv[i+1][0] != '-') ) {
michael@0: 				moduleName = argv[++i];
michael@0: 			}
michael@0: 			break;
michael@0: 		case RAW_ADD_ARG:
michael@0: 			if(command != NO_COMMAND) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[MULTIPLE_COMMAND_ERR], arg);
michael@0: 				return MULTIPLE_COMMAND_ERR;
michael@0: 			}
michael@0: 			command = RAW_ADD_COMMAND;
michael@0: 			if(TRY_INC(i, argc)) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[OPTION_NEEDS_ARG_ERR], arg);
michael@0: 				return OPTION_NEEDS_ARG_ERR;
michael@0: 			}
michael@0: 			moduleSpec = argv[i];
michael@0: 			break;
michael@0: 		case MECHANISMS_ARG:
michael@0: 			if(mechanisms != NULL) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[DUPLICATE_OPTION_ERR], arg);
michael@0: 				return DUPLICATE_OPTION_ERR;
michael@0: 			}
michael@0: 			if(TRY_INC(i, argc)) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[OPTION_NEEDS_ARG_ERR], arg);
michael@0: 				return OPTION_NEEDS_ARG_ERR;
michael@0: 			}
michael@0: 			mechanisms = argv[i];
michael@0: 			break;
michael@0: 		case NEWPWFILE_ARG:
michael@0: 			if(newpwFile != NULL) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[DUPLICATE_OPTION_ERR], arg);
michael@0: 				return DUPLICATE_OPTION_ERR;
michael@0: 			}
michael@0: 			if(TRY_INC(i, argc)) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[OPTION_NEEDS_ARG_ERR], arg);
michael@0: 				return OPTION_NEEDS_ARG_ERR;
michael@0: 			}
michael@0: 			newpwFile = argv[i];
michael@0: 			break;
michael@0: 		case PWFILE_ARG:
michael@0: 			if(pwFile != NULL) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[DUPLICATE_OPTION_ERR], arg);
michael@0: 				return DUPLICATE_OPTION_ERR;
michael@0: 			}
michael@0: 			if(TRY_INC(i, argc)) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[OPTION_NEEDS_ARG_ERR], arg);
michael@0: 				return OPTION_NEEDS_ARG_ERR;
michael@0: 			}
michael@0: 			pwFile = argv[i];
michael@0: 			break;
michael@0: 		case SLOT_ARG:
michael@0: 			if(slotName != NULL) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[DUPLICATE_OPTION_ERR], arg);
michael@0: 				return DUPLICATE_OPTION_ERR;
michael@0: 			}
michael@0: 			if(TRY_INC(i, argc)) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[OPTION_NEEDS_ARG_ERR], arg);
michael@0: 				return OPTION_NEEDS_ARG_ERR;
michael@0: 			}
michael@0: 			slotName = argv[i];
michael@0: 			break;
michael@0: 		case SECMOD_ARG:
michael@0: 			if(secmodName != NULL) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[DUPLICATE_OPTION_ERR], arg);
michael@0: 				return DUPLICATE_OPTION_ERR;
michael@0: 			}
michael@0: 			if(TRY_INC(i, argc)) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[OPTION_NEEDS_ARG_ERR], arg);
michael@0: 				return OPTION_NEEDS_ARG_ERR;
michael@0: 			}
michael@0: 			secmodName = argv[i];
michael@0: 			break;
michael@0: 		case STRING_ARG:
michael@0: 			if(secmodString != NULL) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[DUPLICATE_OPTION_ERR], arg);
michael@0: 				return DUPLICATE_OPTION_ERR;
michael@0: 			}
michael@0: 			if(TRY_INC(i, argc)) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[OPTION_NEEDS_ARG_ERR], arg);
michael@0: 				return OPTION_NEEDS_ARG_ERR;
michael@0: 			}
michael@0: 			secmodString = argv[i];
michael@0: 			break;
michael@0: 		}
michael@0: 	}
michael@0: 	return SUCCESS;
michael@0: }
michael@0: 
michael@0: /************************************************************************
michael@0:  *
michael@0:  * v e r i f y _ p a r a m s
michael@0:  */
michael@0: static Error
michael@0: verify_params()
michael@0: {
michael@0: 	switch(command) {
michael@0: 	case ADD_COMMAND:
michael@0: 		if(libFile == NULL) {
michael@0: 			PR_fprintf(PR_STDERR, errStrings[MISSING_PARAM_ERR],
michael@0: 				commandNames[ADD_COMMAND], optionStrings[LIBFILE_ARG]);
michael@0: 			return MISSING_PARAM_ERR;
michael@0: 		}
michael@0: 		break;
michael@0: 	case CHANGEPW_COMMAND:
michael@0: 		break;
michael@0: 	case CREATE_COMMAND:
michael@0: 		break;
michael@0: 	case DELETE_COMMAND:
michael@0: 		break;
michael@0: 	case DISABLE_COMMAND:
michael@0: 		break;
michael@0: 	case ENABLE_COMMAND:
michael@0: 		break;
michael@0: 	case FIPS_COMMAND:
michael@0: 	case CHKFIPS_COMMAND:
michael@0: 		if(PL_strcasecmp(fipsArg, "true") &&
michael@0: 			PL_strcasecmp(fipsArg, "false")) {
michael@0: 			PR_fprintf(PR_STDERR, errStrings[INVALID_FIPS_ARG]);
michael@0: 			return INVALID_FIPS_ARG;
michael@0: 		}
michael@0: 		break;
michael@0: 	case JAR_COMMAND:
michael@0: 		if(installDir == NULL) {
michael@0: 			PR_fprintf(PR_STDERR, errStrings[MISSING_PARAM_ERR],
michael@0: 				commandNames[JAR_COMMAND], optionStrings[INSTALLDIR_ARG]);
michael@0: 			return MISSING_PARAM_ERR;
michael@0: 		}
michael@0: 		break;
michael@0: 	case LIST_COMMAND:
michael@0: 	case RAW_LIST_COMMAND:
michael@0: 		break;
michael@0: 	case RAW_ADD_COMMAND:
michael@0: 		break;
michael@0: 	case UNDEFAULT_COMMAND:
michael@0: 	case DEFAULT_COMMAND:
michael@0: 		if(mechanisms == NULL) {
michael@0: 			PR_fprintf(PR_STDERR, errStrings[MISSING_PARAM_ERR],
michael@0: 				commandNames[command], optionStrings[MECHANISMS_ARG]);
michael@0: 			return MISSING_PARAM_ERR;
michael@0: 		}
michael@0: 		break;
michael@0: 	default:
michael@0: 		/* Ignore this here */
michael@0: 		break;
michael@0: 	}
michael@0: 
michael@0: 	return SUCCESS;
michael@0: }
michael@0: 
michael@0: /********************************************************************
michael@0:  *
michael@0:  * i n i t _ c r y p t o
michael@0:  *
michael@0:  * Does crypto initialization that all commands will require.
michael@0:  * If -nocertdb option is specified, don't open key or cert db (we don't
michael@0:  * need them if we aren't going to be verifying signatures).  This is
michael@0:  * because serverland doesn't always have cert and key database files
michael@0:  * available.
michael@0:  *
michael@0:  * This function is ill advised. Names and locations of databases are
michael@0:  * private to NSS proper. Such functions only confuse other users.
michael@0:  *
michael@0:  */
michael@0: static Error
michael@0: check_crypto(PRBool create, PRBool readOnly)
michael@0: {
michael@0: 	char *dir;
michael@0: 	char *moddbname=NULL;
michael@0: 	Error retval;
michael@0: 	static const char multiaccess[] = { "multiaccess:" };
michael@0: 
michael@0: 	dir = SECU_ConfigDirectory(dbdir); /* dir is never NULL */
michael@0: 	if (dir[0] == '\0') {
michael@0: 		PR_fprintf(PR_STDERR, errStrings[NO_DBDIR_ERR]);
michael@0: 		retval=NO_DBDIR_ERR;
michael@0: 		goto loser;
michael@0: 	}
michael@0: 	if (strncmp(dir, multiaccess, sizeof multiaccess - 1) == 0) {
michael@0: 		/* won't attempt to handle the multiaccess case. */
michael@0: 		return SUCCESS;
michael@0: 	}
michael@0: #ifdef notdef
michael@0: 	/* Make sure db directory exists and is readable */
michael@0: 	if(PR_Access(dir, PR_ACCESS_EXISTS) != PR_SUCCESS) {
michael@0: 		PR_fprintf(PR_STDERR, errStrings[DIR_DOESNT_EXIST_ERR], dir);
michael@0: 		retval = DIR_DOESNT_EXIST_ERR;
michael@0: 		goto loser;
michael@0: 	} else if(PR_Access(dir, PR_ACCESS_READ_OK) != PR_SUCCESS) {
michael@0: 		PR_fprintf(PR_STDERR, errStrings[DIR_NOT_READABLE_ERR], dir);
michael@0: 		retval = DIR_NOT_READABLE_ERR;
michael@0: 		goto loser;
michael@0: 	}
michael@0: 
michael@0: 	if (secmodName == NULL) {
michael@0: 		secmodName = "secmod.db";
michael@0: 	}
michael@0: 
michael@0: 	moddbname = PR_smprintf("%s/%s", dir, secmodName);
michael@0: 	if (!moddbname)
michael@0: 	    return OUT_OF_MEM_ERR;
michael@0: 
michael@0: 	/* Check for the proper permissions on databases */
michael@0: 	if(create) {
michael@0: 		/* Make sure dbs don't already exist, and the directory is
michael@0: 			writeable */
michael@0: 		if(PR_Access(moddbname, PR_ACCESS_EXISTS)==PR_SUCCESS) {
michael@0: 			PR_fprintf(PR_STDERR, errStrings[FILE_ALREADY_EXISTS_ERR],
michael@0: 			           moddbname);
michael@0: 			retval=FILE_ALREADY_EXISTS_ERR;
michael@0: 			goto loser;
michael@0: 		} else 
michael@0: 		if(PR_Access(dir, PR_ACCESS_WRITE_OK) != PR_SUCCESS) {
michael@0: 			PR_fprintf(PR_STDERR, errStrings[DIR_NOT_WRITEABLE_ERR], dir);
michael@0: 			retval=DIR_NOT_WRITEABLE_ERR;
michael@0: 			goto loser;
michael@0: 		}
michael@0: 	} else {
michael@0: 		/* Make sure dbs are readable and writeable */
michael@0: 		if(PR_Access(moddbname, PR_ACCESS_READ_OK) != PR_SUCCESS) {
michael@0: 			PR_fprintf(PR_STDERR, errStrings[FILE_NOT_READABLE_ERR], moddbname);
michael@0: 			retval=FILE_NOT_READABLE_ERR;
michael@0: 			goto loser;
michael@0: 		}
michael@0: 
michael@0: 		/* Check for write access if we'll be making changes */
michael@0: 		if( !readOnly ) {
michael@0: 			if(PR_Access(moddbname, PR_ACCESS_WRITE_OK) != PR_SUCCESS) {
michael@0: 				PR_fprintf(PR_STDERR, errStrings[FILE_NOT_WRITEABLE_ERR],
michael@0: 							moddbname);
michael@0: 				retval=FILE_NOT_WRITEABLE_ERR;
michael@0: 				goto loser;
michael@0: 			}
michael@0: 		}
michael@0: 		PR_fprintf(PR_STDOUT, msgStrings[USING_DBDIR_MSG],
michael@0: 		  SECU_ConfigDirectory(NULL));
michael@0: 	}
michael@0: #endif
michael@0: 	retval=SUCCESS;
michael@0: loser:
michael@0: 	if (moddbname) {
michael@0: 		PR_Free(moddbname);
michael@0: 	}
michael@0: 	return retval;
michael@0: }
michael@0: 
michael@0: static Error
michael@0: init_crypto(PRBool create, PRBool readOnly)
michael@0: {
michael@0: 
michael@0: 	PRUint32  flags = 0;
michael@0: 	SECStatus rv;
michael@0: 	Error     retval;
michael@0: 	/* Open/create key database */
michael@0: 
michael@0: 	if (readOnly) flags |= NSS_INIT_READONLY;
michael@0: 	if (nocertdb) flags |= NSS_INIT_NOCERTDB;
michael@0: 	rv = NSS_Initialize(SECU_ConfigDirectory(NULL), dbprefix, dbprefix,
michael@0: 		       secmodName, flags);
michael@0: 	if (rv != SECSuccess) {
michael@0: 		SECU_PrintPRandOSError(progName);
michael@0: 		retval=NSS_INITIALIZE_FAILED_ERR;
michael@0: 	} else 
michael@0: 		retval=SUCCESS;
michael@0: 
michael@0: 	return retval;
michael@0: }
michael@0: 
michael@0: /*************************************************************************
michael@0:  *
michael@0:  * u s a g e
michael@0:  */
michael@0: static void
michael@0: usage()
michael@0: {
michael@0: 	PR_fprintf(PR_STDOUT,
michael@0: "\nNetscape Cryptographic Module Utility\n"
michael@0: "Usage: modutil [command] [options]\n\n"
michael@0: "                            COMMANDS\n"
michael@0: "---------------------------------------------------------------------------\n"
michael@0: "-add MODULE_NAME                 Add the named module to the module database\n"
michael@0: "   -libfile LIBRARY_FILE         The name of the file (.so or .dll)\n"
michael@0: "                                 containing the implementation of PKCS #11\n"
michael@0: "   [-ciphers CIPHER_LIST]        Enable the given ciphers on this module\n"
michael@0: "   [-mechanisms MECHANISM_LIST]  Make the module a default provider of the\n"
michael@0: "                                 given mechanisms\n"
michael@0: "   [-string CONFIG_STRING]       Pass a configuration string to this module\n"
michael@0: "-changepw TOKEN                  Change the password on the named token\n"
michael@0: "   [-pwfile FILE]                The old password is in this file\n"
michael@0: "   [-newpwfile FILE]             The new password is in this file\n"
michael@0: "-chkfips [ true | false ]        If true, verify  FIPS mode.  If false,\n"
michael@0: "                                 verify not FIPS mode\n"
michael@0: "-create                          Create a new set of security databases\n"
michael@0: "-default MODULE                  Make the given module a default provider\n"
michael@0: "   -mechanisms MECHANISM_LIST    of the given mechanisms\n"
michael@0: "   [-slot SLOT]                  limit change to only the given slot\n"
michael@0: "-delete MODULE                   Remove the named module from the module\n"
michael@0: "                                 database\n"
michael@0: "-disable MODULE                  Disable the named module\n"
michael@0: "   [-slot SLOT]                  Disable only the named slot on the module\n"
michael@0: "-enable MODULE                   Enable the named module\n"
michael@0: "   [-slot SLOT]                  Enable only the named slot on the module\n"
michael@0: "-fips [ true | false ]           If true, enable FIPS mode.  If false,\n"
michael@0: "                                 disable FIPS mode\n"
michael@0: "-force                           Do not run interactively\n"
michael@0: "-jar JARFILE                     Install a PKCS #11 module from the given\n"
michael@0: "                                 JAR file in the PKCS #11 JAR format\n"
michael@0: "   -installdir DIR               Use DIR as the root directory of the\n"
michael@0: "                                 installation\n"
michael@0: "   [-tempdir DIR]                Use DIR as the temporary installation\n"
michael@0: "                                 directory. If not specified, the current\n"
michael@0: "                                 directory is used\n"
michael@0: "-list [MODULE]                   Lists information about the specified module\n"
michael@0: "                                 or about all modules if none is specified\n"
michael@0: "-rawadd MODULESPEC               Add module spec string to secmod DB\n"
michael@0: "-rawlist [MODULE]                Display module spec(s) for one or all\n"
michael@0: "                                 loadable modules\n"
michael@0: "-undefault MODULE                The given module is NOT a default provider\n"
michael@0: "   -mechanisms MECHANISM_LIST    of the listed mechanisms\n"
michael@0: "   [-slot SLOT]                  limit change to only the given slot\n"
michael@0: "---------------------------------------------------------------------------\n"
michael@0: "\n"
michael@0: "                             OPTIONS\n"
michael@0: "---------------------------------------------------------------------------\n"
michael@0: "-dbdir DIR                       Directory DIR contains the security databases\n"
michael@0: "-dbprefix prefix                 Prefix for the security databases\n"
michael@0: "-nocertdb                        Do not load certificate or key databases. No\n"
michael@0: "                                 verification will be performed on JAR files.\n"
michael@0: "-secmod secmodName               Name of the security modules file\n"
michael@0: "---------------------------------------------------------------------------\n"
michael@0: "\n"
michael@0: "Mechanism lists are colon-separated.  The following mechanisms are recognized:\n"
michael@0: "RSA, DSA, DH, RC2, RC4, RC5, AES, CAMELLIA, DES, MD2, MD5, SHA1, SHA256, SHA512,\n"
michael@0: "SSL, TLS, RANDOM, and FRIENDLY\n"
michael@0: "\n"
michael@0: "Cipher lists are colon-separated.  The following ciphers are recognized:\n"
michael@0: "\n"
michael@0: "\nQuestions or bug reports should be sent to modutil-support@netscape.com.\n"
michael@0: );
michael@0: 
michael@0: }
michael@0: 
michael@0: /*************************************************************************
michael@0:  *
michael@0:  * m a i n
michael@0:  */
michael@0: int
michael@0: main(int argc, char *argv[])
michael@0: {
michael@0: 	int errcode = SUCCESS;
michael@0: 	PRBool createdb, readOnly;
michael@0: #define STDINBUF_SIZE 80
michael@0: 	char stdinbuf[STDINBUF_SIZE];
michael@0: 
michael@0: 	progName = strrchr(argv[0], '/');
michael@0: 	progName = progName ? progName+1 : argv[0];
michael@0: 
michael@0: 
michael@0: 	PR_Init(PR_USER_THREAD, PR_PRIORITY_NORMAL, 0);
michael@0: 
michael@0: 	if(parse_args(argc, argv) != SUCCESS) {
michael@0: 		usage();
michael@0: 		errcode = INVALID_USAGE_ERR;
michael@0: 		goto loser;
michael@0: 	}
michael@0: 
michael@0: 	if(verify_params() != SUCCESS) {
michael@0: 		usage();
michael@0: 		errcode = INVALID_USAGE_ERR;
michael@0: 		goto loser;
michael@0: 	}
michael@0: 
michael@0: 	if(command==NO_COMMAND) {
michael@0: 		PR_fprintf(PR_STDERR, errStrings[NO_COMMAND_ERR]);
michael@0: 		usage();
michael@0: 		errcode = INVALID_USAGE_ERR;
michael@0: 		goto loser;
michael@0: 	}
michael@0: 
michael@0: 	/* Set up crypto stuff */
michael@0: 	createdb = command==CREATE_COMMAND;
michael@0: 	readOnly = ((command == LIST_COMMAND) || 
michael@0: 	            (command == CHKFIPS_COMMAND) ||
michael@0: 	            (command == RAW_LIST_COMMAND));
michael@0: 
michael@0: 	/* Make sure browser is not running if we're writing to a database */
michael@0: 	/* Do this before initializing crypto */
michael@0: 	if(!readOnly && !force) {
michael@0: 		char *response;
michael@0: 
michael@0: 		PR_fprintf(PR_STDOUT, msgStrings[BROWSER_RUNNING_MSG]);
michael@0: 		if( ! PR_fgets(stdinbuf, STDINBUF_SIZE, PR_STDIN)) {
michael@0: 			PR_fprintf(PR_STDERR, errStrings[STDIN_READ_ERR]);
michael@0: 			errcode = STDIN_READ_ERR;
michael@0: 			goto loser;
michael@0: 		}
michael@0: 		if( (response=strtok(stdinbuf, " \r\n\t")) ) {
michael@0: 			if(!PL_strcasecmp(response, "q")) {
michael@0: 				PR_fprintf(PR_STDOUT, msgStrings[ABORTING_MSG]);
michael@0: 				errcode = SUCCESS;
michael@0: 				goto loser;
michael@0: 			}
michael@0: 		}
michael@0: 		PR_fprintf(PR_STDOUT, "\n");
michael@0: 	}
michael@0: 
michael@0: 	errcode = check_crypto(createdb, readOnly);
michael@0: 	if( errcode != SUCCESS) {
michael@0: 		goto loser;
michael@0: 	}
michael@0: 
michael@0: 	if ((command == RAW_LIST_COMMAND) || (command == RAW_ADD_COMMAND)) {
michael@0: 		if(!moduleName) {
michael@0: 			char *readOnlyStr, *noCertDBStr, *sep;
michael@0: 			if (!secmodName) secmodName="secmod.db";
michael@0: 			if (!dbprefix) dbprefix = "";
michael@0: 			sep = ((command == RAW_LIST_COMMAND) && nocertdb) ? "," : " ";
michael@0: 			readOnlyStr = (command == RAW_LIST_COMMAND) ? "readOnly" : "" ;
michael@0: 			noCertDBStr = nocertdb ? "noCertDB" : "";
michael@0: 			SECU_ConfigDirectory(dbdir);
michael@0: 
michael@0: 			moduleName=PR_smprintf(
michael@0:     "name=\"NSS default Module DB\" parameters=\"configdir=%s certPrefix=%s "
michael@0:     "keyPrefix=%s secmod=%s flags=%s%s%s\" NSS=\"flags=internal,moduleDB,"
michael@0:     "moduleDBOnly,critical\"",
michael@0: 			                       SECU_ConfigDirectory(NULL),dbprefix,dbprefix,
michael@0: 			                       secmodName, readOnlyStr,sep, noCertDBStr);
michael@0: 		}
michael@0: 		if (command == RAW_LIST_COMMAND) {
michael@0: 			errcode = RawListModule(moduleName);
michael@0: 		} else {
michael@0: 			PORT_Assert(moduleSpec);
michael@0: 			errcode = RawAddModule(moduleName,moduleSpec);
michael@0: 		}
michael@0: 		goto loser;
michael@0: 	}
michael@0: 
michael@0: 	errcode = init_crypto(createdb, readOnly);
michael@0: 	if( errcode != SUCCESS) {
michael@0: 		goto loser;
michael@0: 	}
michael@0: 
michael@0: 	errcode = LoadMechanismList();
michael@0: 	if (errcode != SUCCESS) {
michael@0: 		goto loser;
michael@0: 	}
michael@0: 
michael@0: 	/* Execute the command */
michael@0: 	switch(command) {
michael@0: 	case ADD_COMMAND:
michael@0: 		errcode = AddModule(moduleName, libFile, ciphers, mechanisms, secmodString);
michael@0: 		break;
michael@0: 	case CHANGEPW_COMMAND:
michael@0: 		errcode = ChangePW(tokenName, pwFile, newpwFile);
michael@0: 		break;
michael@0: 	case CREATE_COMMAND:
michael@0: 		/* The work was already done in init_crypto() */
michael@0: 		break;
michael@0: 	case DEFAULT_COMMAND:
michael@0: 		errcode = SetDefaultModule(moduleName, slotName, mechanisms);
michael@0: 		break;
michael@0: 	case DELETE_COMMAND:
michael@0: 		errcode = DeleteModule(moduleName);
michael@0: 		break;
michael@0: 	case DISABLE_COMMAND:
michael@0: 		errcode = EnableModule(moduleName, slotName, PR_FALSE);
michael@0: 		break;
michael@0: 	case ENABLE_COMMAND:
michael@0: 		errcode = EnableModule(moduleName, slotName, PR_TRUE);
michael@0: 		break;
michael@0: 	case FIPS_COMMAND:
michael@0: 		errcode = FipsMode(fipsArg);
michael@0: 		break;
michael@0: 	case CHKFIPS_COMMAND:
michael@0: 		errcode = ChkFipsMode(fipsArg);
michael@0: 		break;
michael@0: 	case JAR_COMMAND:
michael@0: 		Pk11Install_SetErrorHandler(install_error);
michael@0: 		errcode = Pk11Install_DoInstall(jarFile, installDir, tempDir,
michael@0: 		                                PR_STDOUT, force, nocertdb);
michael@0: 		break;
michael@0: 	case LIST_COMMAND:
michael@0: 		if(moduleName) {
michael@0: 			errcode = ListModule(moduleName);
michael@0: 		} else {
michael@0: 			errcode = ListModules();
michael@0: 		}
michael@0: 		break;
michael@0: 	case UNDEFAULT_COMMAND:
michael@0: 		errcode = UnsetDefaultModule(moduleName, slotName, mechanisms);
michael@0: 		break;
michael@0: 	default:
michael@0: 		PR_fprintf(PR_STDERR, "This command is not supported yet.\n");
michael@0: 		errcode = INVALID_USAGE_ERR;
michael@0: 		break;
michael@0: 	}
michael@0: 
michael@0: 	if (NSS_Shutdown() != SECSuccess) {
michael@0: 		exit(1);
michael@0: 	}
michael@0: 
michael@0: loser:
michael@0: 	PR_Cleanup();
michael@0: 	return errcode;
michael@0: }
michael@0: 
michael@0: /************************************************************************
michael@0:  *
michael@0:  * i n s t a l l _ e r r o r
michael@0:  *
michael@0:  * Callback function to handle errors in PK11 JAR file installation.
michael@0:  */
michael@0: static void
michael@0: install_error(char *message)
michael@0: {
michael@0: 	PR_fprintf(PR_STDERR, "Install error: %s\n", message);
michael@0: }
michael@0: 
michael@0: /*************************************************************************
michael@0:  *
michael@0:  * o u t _ o f _ m e m o r y
michael@0:  */
michael@0: void
michael@0: out_of_memory(void)
michael@0: {
michael@0: 	PR_fprintf(PR_STDERR, errStrings[OUT_OF_MEM_ERR]);
michael@0: 	exit(OUT_OF_MEM_ERR);
michael@0: }
michael@0: 
michael@0: 
michael@0: /**************************************************************************
michael@0:  *
michael@0:  * P R _ f g e t s
michael@0:  *
michael@0:  * fgets implemented with NSPR.
michael@0:  */
michael@0: static char*
michael@0: PR_fgets(char *buf, int size, PRFileDesc *file)
michael@0: {
michael@0: 	int i;
michael@0: 	int status;
michael@0: 	char c;
michael@0: 
michael@0: 	i=0;
michael@0: 	while(i < size-1) {
michael@0: 		status = PR_Read(file, (void*) &c, 1);
michael@0: 		if(status==-1) {
michael@0: 			return NULL;
michael@0: 		} else if(status==0) {
michael@0: 			break;
michael@0: 		}
michael@0: 		buf[i++] = c;
michael@0: 		if(c=='\n') {
michael@0: 			break;
michael@0: 		}
michael@0: 	}
michael@0: 	buf[i]='\0';
michael@0: 
michael@0: 	return buf;
michael@0: }