Attachment 600184 Details for Bug 820684 – Adds ability to specify opFlags and attrFlags in certutil

[patch] Adds ability to specify opFlags and attrFlags in certutil

nss-ecc-certutil-834219.patch (text/plain), 8.46 KB, created by Bob Relyea on 2012-07-25 00:13:20 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Bob Relyea

Created: 2012-07-25 00:13:20 UTC

Size: 8.46 KB

patch

obsolete

>diff -up ./mozilla/security/nss/cmd/certutil/certutil.c.orig ./mozilla/security/nss/cmd/certutil/certutil.c
>--- ./mozilla/security/nss/cmd/certutil/certutil.c.orig	2012-07-24 15:19:10.118146000 -0700
>+++ ./mozilla/security/nss/cmd/certutil/certutil.c	2012-07-24 15:20:12.376020000 -0700
>@@ -1244,6 +1244,19 @@ static void luG(enum usage_level ul, con
>         "   -d keydir");
>     FPS "%-20s Cert & Key database prefix\n",
>         "   -P dbprefix");
>+    FPS "%-20s PKCS #11 key Attributes\n",
>+        "   --keyAttrFlags attrflags.");
>+    FPS "%-20s Comma sparated list of the following pairs\n", "");
>+    FPS "%-20s (one pair member per list):\n", "");
>+    FPS "%-20s {token,session} {public,private} {sensitive,insenstive}\n", "");
>+    FPS "%-20s {modifiable,unmodifiable} {extractable,unextractable}\n", "");
>+    FPS "%-20s PKCS #11 key Operation Flags\n",
>+        "   --keyOpFlagsOn opflags.");
>+    FPS "%-20s PKCS #11 key Operation Flags\n",
>+        "   --keyOpFlagsOff opflags.");
>+    FPS "%-20s Comma sparated list of one or more of the following:\n", "");
>+    FPS "%-20s encrypt, decrypt, sign, sign_recover, verify,\n", "");
>+    FPS "%-20s verify_recover, wrap, unwrap, derive\n", "");
>     FPS "\n");
> }
> 
>@@ -1457,6 +1470,8 @@ static void luR(enum usage_level ul, con
>         "   -a");
>     FPS "%-20s \n",
>         "   See -S for available extension options");
>+    FPS "%-20s \n",
>+        "   See -G for available key flag  options");
>     FPS "\n");
> }
> 
>@@ -1639,6 +1654,8 @@ static void luS(enum usage_level ul, con
>         "   --extIA ");
>     FPS "%-20s Create a subject key ID extension\n",
>         "   --extSKID ");
>+    FPS "%-20s \n",
>+        "   See -G for available key flag  options");
>     FPS "\n");
> }
> 
>@@ -1952,6 +1969,103 @@ getObjectClass(CK_ULONG classType)
>     return buf;
> }
> 
>+typedef struct {
>+    char *name;
>+    int  nameSize;
>+    CK_ULONG value;
>+} flagArray;
>+
>+#define NAME_SIZE(x) #x,sizeof(#x)-1
>+
>+flagArray opFlagsArray[] =
>+{
>+    {NAME_SIZE(encrypt), CKF_ENCRYPT},
>+    {NAME_SIZE(decrypt), CKF_DECRYPT},
>+    {NAME_SIZE(sign), CKF_SIGN},
>+    {NAME_SIZE(sign_recover), CKF_SIGN_RECOVER},
>+    {NAME_SIZE(verify), CKF_VERIFY},
>+    {NAME_SIZE(verify_recover), CKF_VERIFY_RECOVER},
>+    {NAME_SIZE(wrap), CKF_WRAP},
>+    {NAME_SIZE(unwrap), CKF_UNWRAP},
>+    {NAME_SIZE(derive), CKF_DERIVE},
>+};
>+
>+int opFlagsCount = sizeof(opFlagsArray)/sizeof(flagArray);
>+
>+flagArray attrFlagsArray[] =
>+{
>+    {NAME_SIZE(token), PK11_ATTR_TOKEN},
>+    {NAME_SIZE(session), PK11_ATTR_SESSION},
>+    {NAME_SIZE(private), PK11_ATTR_PRIVATE},
>+    {NAME_SIZE(public), PK11_ATTR_PUBLIC},
>+    {NAME_SIZE(modifiable), PK11_ATTR_MODIFIABLE},
>+    {NAME_SIZE(unmodifiable), PK11_ATTR_UNMODIFIABLE},
>+    {NAME_SIZE(sensitive), PK11_ATTR_SENSITIVE},
>+    {NAME_SIZE(insensitive), PK11_ATTR_INSENSITIVE},
>+    {NAME_SIZE(extractable), PK11_ATTR_EXTRACTABLE},
>+    {NAME_SIZE(unextractable), PK11_ATTR_EXTRACTABLE}
>+
>+};
>+
>+int attrFlagsCount = sizeof(attrFlagsArray)/sizeof(flagArray);
>+
>+#define MAX_STRING 30
>+CK_ULONG
>+GetFlags(char *flagsString, flagArray *flagArray, int count)
>+{
>+   CK_ULONG flagsValue = strtol(flagsString, NULL, 0);
>+   int i;
>+
>+fprintf(stderr, "parsing flags <%s>\n", flagsString);
>+
>+   if ((flagsValue != 0) || (*flagsString == 0)) {
>+	return flagsValue;
>+   }
>+   while (*flagsString) {
>+	for (i=0; i < count; i++) {
>+	    if (strncmp(flagsString, flagArray[i].name, flagArray[i].nameSize) 
>+								== 0) {
>+		flagsValue |= flagArray[i].value;
>+		flagsString += flagArray[i].nameSize;
>+		if (*flagsString != 0) {
>+		    flagsString++;
>+		}
>+		break;
>+	    }
>+	}
>+	if (i == count) {
>+	    char name[MAX_STRING];
>+	    char *tok;
>+
>+	    strncpy(name,flagsString, MAX_STRING);
>+	    name[MAX_STRING-1] = 0;
>+	    tok = strchr(name, ',');
>+	    if (tok) {
>+		*tok = 0;
>+	    }
>+	    fprintf(stderr,"Unknown flag (%s)\n",name);
>+	    tok = strchr(flagsString, ',');
>+	    if (tok == NULL)  {
>+		break;
>+	    }
>+	    flagsString = tok+1;
>+	}
>+    }
>+    return flagsValue;
>+}
>+
>+CK_FLAGS
>+GetOpFlags(char *flags)
>+{
>+    return GetFlags(flags, opFlagsArray, opFlagsCount);
>+}
>+
>+PK11AttrFlags
>+GetAttrFlags(char *flags)
>+{
>+    return GetFlags(flags, attrFlagsArray, attrFlagsCount);
>+}
>+
> char *mkNickname(unsigned char *data, int len)
> {
>    char *nick = PORT_Alloc(len+1);
>@@ -2090,6 +2204,9 @@ enum certutilOpts {
>     opt_SourcePrefix,
>     opt_UpgradeID,
>     opt_UpgradeTokenName,
>+    opt_KeyOpFlagsOn,
>+    opt_KeyOpFlagsOff,
>+    opt_KeyAttrFlags,
>     opt_Help
> };
> 
>@@ -2190,6 +2307,12 @@ secuCommandFlag options_init[] =
>                                                    "upgrade-id"},
> 	{ /* opt_UpgradeTokenName    */  0,   PR_TRUE,  0, PR_FALSE, 
>                                                    "upgrade-token-name"},
>+	{ /* opt_KeyOpFlagsOn        */  0,   PR_TRUE, 0, PR_FALSE, 
>+                                                   "keyOpFlagsOn"},
>+	{ /* opt_KeyOpFlagsOff       */  0,   PR_TRUE, 0, PR_FALSE, 
>+                                                   "keyOpFlagsOff"},
>+	{ /* opt_KeyAttrFlags        */  0,   PR_TRUE, 0, PR_FALSE, 
>+                                                   "keyAttrFlags"},
> };
> #define NUM_OPTIONS ((sizeof options_init)  / (sizeof options_init[0]))
> 
>@@ -2237,6 +2360,10 @@ certutil_main(int argc, char **argv, PRB
>     secuPWData  pwdata2         = { PW_NONE, 0 };
>     PRBool      readOnly        = PR_FALSE;
>     PRBool      initialized     = PR_FALSE;
>+    CK_FLAGS    keyOpFlagsOn = 0;
>+    CK_FLAGS    keyOpFlagsOff = 0;
>+    PK11AttrFlags    keyAttrFlags = 
>+		PK11_ATTR_TOKEN | PK11_ATTR_SENSITIVE | PK11_ATTR_PRIVATE;
> 
>     SECKEYPrivateKey *privkey = NULL;
>     SECKEYPublicKey *pubkey = NULL;
>@@ -2359,6 +2486,17 @@ certutil_main(int argc, char **argv, PRB
> 	keytype = nullKey;
>     }
> 
>+    if (certutil.options[opt_KeyOpFlagsOn].activated) {
>+	keyOpFlagsOn = GetOpFlags(certutil.options[opt_KeyOpFlagsOn].arg);
>+    }
>+    if (certutil.options[opt_KeyOpFlagsOff].activated) {
>+	keyOpFlagsOff = GetOpFlags(certutil.options[opt_KeyOpFlagsOff].arg);
>+	keyOpFlagsOn &=~keyOpFlagsOff; /* make off override on */
>+    }
>+    if (certutil.options[opt_KeyAttrFlags].activated) {
>+	keyAttrFlags = GetAttrFlags(certutil.options[opt_KeyAttrFlags].arg);
>+    }
>+
>     /*  -m serial number */
>     if (certutil.options[opt_SerialNumber].activated) {
> 	int sn = PORT_Atoi(certutil.options[opt_SerialNumber].arg);
>@@ -2968,6 +3106,9 @@ merge_fail:
> 					    certutil.options[opt_NoiseFile].arg,
> 					    &pubkey, 
> 					    certutil.options[opt_PQGFile].arg,
>+					    keyAttrFlags,
>+					    keyOpFlagsOn,
>+					    keyOpFlagsOff,
> 					    &pwdata);
> 	    if (privkey == NULL) {
> 		SECU_PrintError(progName, "unable to generate key(s)\n");
>diff -up ./mozilla/security/nss/cmd/certutil/certutil.h.orig ./mozilla/security/nss/cmd/certutil/certutil.h
>--- ./mozilla/security/nss/cmd/certutil/certutil.h.orig	2012-07-24 15:19:10.135146000 -0700
>+++ ./mozilla/security/nss/cmd/certutil/certutil.h	2012-07-24 15:20:12.386020000 -0700
>@@ -46,6 +46,9 @@ CERTUTIL_GeneratePrivateKey(KeyType keyt
>                             char *noise,
>                             SECKEYPublicKey **pubkeyp,
>                             char *pqgFile,
>+			    PK11AttrFlags attrFlags,
>+			    CK_FLAGS opFlagsOn,
>+			    CK_FLAGS opFlagsOff,
>                             secuPWData *pwdata);
> 
> extern char *progName;
>diff -up ./mozilla/security/nss/cmd/certutil/keystuff.c.orig ./mozilla/security/nss/cmd/certutil/keystuff.c
>--- ./mozilla/security/nss/cmd/certutil/keystuff.c.orig	2012-07-24 15:19:10.146146000 -0700
>+++ ./mozilla/security/nss/cmd/certutil/keystuff.c	2012-07-24 15:20:12.397020000 -0700
>@@ -525,7 +525,8 @@ SECKEYPrivateKey *
> CERTUTIL_GeneratePrivateKey(KeyType keytype, PK11SlotInfo *slot, int size,
> 			    int publicExponent, const char *noise, 
> 			    SECKEYPublicKey **pubkeyp, const char *pqgFile,
>-                            secuPWData *pwdata)
>+			    PK11AttrFlags attrFlags, CK_FLAGS opFlagsOn,
>+			    CK_FLAGS opFlagsOff, secuPWData *pwdata)
> {
>     CK_MECHANISM_TYPE  mechanism;
>     SECOidTag          algtag;
>@@ -594,8 +595,8 @@ CERTUTIL_GeneratePrivateKey(KeyType keyt
>     fprintf(stderr, "\n\n");
>     fprintf(stderr, "Generating key.  This may take a few moments...\n\n");
> 
>-    privKey = PK11_GenerateKeyPair(slot, mechanism, params, pubkeyp,
>-				PR_TRUE /*isPerm*/, PR_TRUE /*isSensitive*/, 
>+    privKey = PK11_GenerateKeyPairWithOpFlags(slot, mechanism, params, pubkeyp,
>+				attrFlags, opFlagsOn, opFlagsOn|opFlagsOff,
> 				pwdata /*wincx*/);
>     /* free up the params */
>     switch (keytype) {

Actions: View | Diff

Attachments on bug 820684: 600161 | 600184