зеркало из https://github.com/mozilla/gecko-dev.git
Bug 1107731, upgrade Mozilla 37 to use NSS 3.18 (this is beta 5), r=wtc
This commit is contained in:
Kai Engert
Родитель
1bf832faa9
Коммит
9d9e763d45
|
|
@ -1 +1 @@
|
|||
NSS_3_17_3_RTM
|
||||
NSS_3_18_BETA5
|
||||
|
|
|
|||
|
|
@ -971,19 +971,19 @@ PrintSyntax(char *progName)
|
|||
FPS "Usage: %s -N [-d certdir] [-P dbprefix] [-f pwfile] [--empty-password]\n", progName);
|
||||
FPS "Usage: %s -T [-d certdir] [-P dbprefix] [-h token-name]\n"
|
||||
"\t\t [-f pwfile] [-0 SSO-password]\n", progName);
|
||||
FPS "\t%s -A -n cert-name -t trustargs [-d certdir] [-P dbprefix] [-a] [-i input]\n",
|
||||
FPS "\t%s -A -n cert-name -t trustargs [-d certdir] [-P dbprefix] [-a] [-i input]\n",
|
||||
progName);
|
||||
FPS "\t%s -B -i batch-file\n", progName);
|
||||
FPS "\t%s -C [-c issuer-name | -x] -i cert-request-file -o cert-file\n"
|
||||
"\t\t [-m serial-number] [-w warp-months] [-v months-valid]\n"
|
||||
"\t\t [-f pwfile] [-d certdir] [-P dbprefix]\n"
|
||||
"\t\t [-f pwfile] [-d certdir] [-P dbprefix] [-Z hashAlg]\n"
|
||||
"\t\t [-1 | --keyUsage [keyUsageKeyword,..]] [-2] [-3] [-4]\n"
|
||||
"\t\t [-5 | --nsCertType [nsCertTypeKeyword,...]]\n"
|
||||
"\t\t [-6 | --extKeyUsage [extKeyUsageKeyword,...]] [-7 emailAddrs]\n"
|
||||
"\t\t [-8 dns-names] [-a]\n",
|
||||
progName);
|
||||
FPS "\t%s -D -n cert-name [-d certdir] [-P dbprefix]\n", progName);
|
||||
FPS "\t%s -E -n cert-name -t trustargs [-d certdir] [-P dbprefix] [-a] [-i input]\n",
|
||||
FPS "\t%s -E -n cert-name -t trustargs [-d certdir] [-P dbprefix] [-a] [-i input]\n",
|
||||
progName);
|
||||
FPS "\t%s -F -n nickname [-d certdir] [-P dbprefix]\n",
|
||||
progName);
|
||||
|
|
@ -1010,14 +1010,15 @@ PrintSyntax(char *progName)
|
|||
progName);
|
||||
FPS "\t\t [-P targetDBPrefix] [--source-prefix sourceDBPrefix]\n");
|
||||
FPS "\t\t [-f targetPWfile] [-@ sourcePWFile]\n");
|
||||
FPS "\t%s -L [-n cert-name] [--email email-address] [-X] [-r] [-a]\n",
|
||||
FPS "\t%s -L [-n cert-name] [-h token-name] [--email email-address]\n",
|
||||
progName);
|
||||
FPS "\t\t [--dump-ext-val OID] [-d certdir] [-P dbprefix]\n");
|
||||
FPS "\t\t [-X] [-r] [-a] [--dump-ext-val OID] [-d certdir] [-P dbprefix]\n");
|
||||
FPS "\t%s -M -n cert-name -t trustargs [-d certdir] [-P dbprefix]\n",
|
||||
progName);
|
||||
FPS "\t%s -O -n cert-name [-X] [-d certdir] [-a] [-P dbprefix]\n", progName);
|
||||
FPS "\t%s -R -s subj -o cert-request-file [-d certdir] [-P dbprefix] [-p phone] [-a]\n"
|
||||
"\t\t [-7 emailAddrs] [-k key-type-or-id] [-h token-name] [-f pwfile] [-g key-size]\n",
|
||||
"\t\t [-7 emailAddrs] [-k key-type-or-id] [-h token-name] [-f pwfile]\n"
|
||||
"\t\t [-g key-size] [-Z hashAlg]\n",
|
||||
progName);
|
||||
FPS "\t%s -V -n cert-name -u usage [-b time] [-e] [-a]\n"
|
||||
"\t\t[-X] [-d certdir] [-P dbprefix]\n",
|
||||
|
|
@ -1027,7 +1028,7 @@ PrintSyntax(char *progName)
|
|||
FPS "\t%s -S -n cert-name -s subj [-c issuer-name | -x] -t trustargs\n"
|
||||
"\t\t [-k key-type-or-id] [-q key-params] [-h token-name] [-g key-size]\n"
|
||||
"\t\t [-m serial-number] [-w warp-months] [-v months-valid]\n"
|
||||
"\t\t [-f pwfile] [-d certdir] [-P dbprefix]\n"
|
||||
"\t\t [-f pwfile] [-d certdir] [-P dbprefix] [-Z hashAlg]\n"
|
||||
"\t\t [-p phone] [-1] [-2] [-3] [-4] [-5] [-6] [-7 emailAddrs]\n"
|
||||
"\t\t [-8 DNS-names]\n"
|
||||
"\t\t [--extAIA] [--extSIA] [--extCP] [--extPM] [--extPC] [--extIA]\n"
|
||||
|
|
@ -1137,6 +1138,11 @@ static void luC(enum usage_level ul, const char *command)
|
|||
" -d certdir");
|
||||
FPS "%-20s Cert & Key database prefix\n",
|
||||
" -P dbprefix");
|
||||
FPS "%-20s \n"
|
||||
"%-20s Specify the hash algorithm to use. Possible keywords:\n"
|
||||
"%-20s \"MD2\", \"MD4\", \"MD5\", \"SHA1\", \"SHA224\",\n"
|
||||
"%-20s \"SHA256\", \"SHA384\", \"SHA512\"\n",
|
||||
" -Z hashAlg", "", "", "");
|
||||
FPS "%-20s \n"
|
||||
"%-20s Create key usage extension. Possible keywords:\n"
|
||||
"%-20s \"digitalSignature\", \"nonRepudiation\", \"keyEncipherment\",\n"
|
||||
|
|
@ -1336,6 +1342,8 @@ static void luL(enum usage_level ul, const char *command)
|
|||
"-L");
|
||||
if (ul == usage_selected && !is_my_command)
|
||||
return;
|
||||
FPS "%-20s Name of token to search (\"all\" for all tokens)\n",
|
||||
" -h token-name ");
|
||||
FPS "%-20s Pretty print named cert (list all if unspecified)\n",
|
||||
" -n cert-name");
|
||||
FPS "%-20s \n"
|
||||
|
|
@ -1388,6 +1396,8 @@ static void luN(enum usage_level ul, const char *command)
|
|||
" -d certdir");
|
||||
FPS "%-20s Cert & Key database prefix\n",
|
||||
" -P dbprefix");
|
||||
FPS "%-20s Specify the password file\n",
|
||||
" -f password-file");
|
||||
FPS "%-20s use empty password when creating a new database\n",
|
||||
" --empty-password");
|
||||
FPS "\n");
|
||||
|
|
@ -1473,6 +1483,11 @@ static void luR(enum usage_level ul, const char *command)
|
|||
" -P dbprefix");
|
||||
FPS "%-20s Specify the contact phone number (\"123-456-7890\")\n",
|
||||
" -p phone");
|
||||
FPS "%-20s \n"
|
||||
"%-20s Specify the hash algorithm to use. Possible keywords:\n"
|
||||
"%-20s \"MD2\", \"MD4\", \"MD5\", \"SHA1\", \"SHA224\",\n"
|
||||
"%-20s \"SHA256\", \"SHA384\", \"SHA512\"\n",
|
||||
" -Z hashAlg", "", "", "");
|
||||
FPS "%-20s Output the cert request in ASCII (RFC1113); default is binary\n",
|
||||
" -a");
|
||||
FPS "%-20s \n",
|
||||
|
|
@ -1634,6 +1649,11 @@ static void luS(enum usage_level ul, const char *command)
|
|||
" -P dbprefix");
|
||||
FPS "%-20s Specify the contact phone number (\"123-456-7890\")\n",
|
||||
" -p phone");
|
||||
FPS "%-20s \n"
|
||||
"%-20s Specify the hash algorithm to use. Possible keywords:\n"
|
||||
"%-20s \"MD2\", \"MD4\", \"MD5\", \"SHA1\", \"SHA224\",\n"
|
||||
"%-20s \"SHA256\", \"SHA384\", \"SHA512\"\n",
|
||||
" -Z hashAlg", "", "", "");
|
||||
FPS "%-20s Create key usage extension\n",
|
||||
" -1 ");
|
||||
FPS "%-20s Create basic constraint extension\n",
|
||||
|
|
|
|||
|
|
@ -494,7 +494,6 @@ CERTUTIL_GeneratePrivateKey(KeyType keytype, PK11SlotInfo *slot, int size,
|
|||
CK_FLAGS opFlagsOff, secuPWData *pwdata)
|
||||
{
|
||||
CK_MECHANISM_TYPE mechanism;
|
||||
SECOidTag algtag;
|
||||
PK11RSAGenParams rsaparams;
|
||||
SECKEYPQGParams * dsaparams = NULL;
|
||||
void * params;
|
||||
|
|
@ -529,12 +528,10 @@ CERTUTIL_GeneratePrivateKey(KeyType keytype, PK11SlotInfo *slot, int size,
|
|||
rsaparams.keySizeInBits = size;
|
||||
rsaparams.pe = publicExponent;
|
||||
mechanism = CKM_RSA_PKCS_KEY_PAIR_GEN;
|
||||
algtag = SEC_OID_PKCS1_MD5_WITH_RSA_ENCRYPTION;
|
||||
params = &rsaparams;
|
||||
break;
|
||||
case dsaKey:
|
||||
mechanism = CKM_DSA_KEY_PAIR_GEN;
|
||||
algtag = SEC_OID_ANSIX9_DSA_SIGNATURE_WITH_SHA1_DIGEST;
|
||||
if (pqgFile) {
|
||||
dsaparams = getpqgfromfile(size, pqgFile);
|
||||
if (dsaparams == NULL)
|
||||
|
|
|
|||
|
|
@ -10,3 +10,4 @@
|
|||
*/
|
||||
|
||||
#error "Do not include this header file."
|
||||
|
||||
|
|
|
|||
|
|
@ -459,6 +459,23 @@ of the attribute codes:
|
|||
<listitem><para>Read a seed value from the specified file to generate a new private and public key pair. This argument makes it possible to use hardware-generated seed values or manually create a value from the keyboard. The minimum file size is 20 bytes.</para></listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-Z hashAlg</term>
|
||||
<listitem>
|
||||
<para>Specify the hash algorithm to use with the -C, -S or -R command options. Possible keywords:</para>
|
||||
<itemizedlist>
|
||||
<listitem><para>MD2</para></listitem>
|
||||
<listitem><para>MD4</para></listitem>
|
||||
<listitem><para>MD5</para></listitem>
|
||||
<listitem><para>SHA1</para></listitem>
|
||||
<listitem><para>SHA224</para></listitem>
|
||||
<listitem><para>SHA256</para></listitem>
|
||||
<listitem><para>SHA384</para></listitem>
|
||||
<listitem><para>SHA512</para></listitem>
|
||||
</itemizedlist>
|
||||
</listitem>
|
||||
</varlistentry>
|
||||
|
||||
<varlistentry>
|
||||
<term>-0 SSO_password</term>
|
||||
<listitem><para>Set a site security officer password on a token.</para></listitem>
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>CERTUTIL</title><meta name="generator" content="DocBook XSL Stylesheets V1.78.1"><link rel="home" href="index.html" title="CERTUTIL"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">CERTUTIL</th></tr></table><hr></div><div class="refentry"><a name="certutil"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>certutil — Manage keys and certificate in both NSS databases and other NSS tokens</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="command">certutil</code> [<em class="replaceable"><code>options</code></em>] [[<em class="replaceable"><code>arguments</code></em>]]</p></div></div><div class="refsection"><a name="idm226659332128"></a><h2>STATUS</h2><p>This documentation is still work in progress. Please contribute to the initial review in <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=836477" target="_top">Mozilla NSS bug 836477</a>
|
||||
<html><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><title>CERTUTIL</title><meta name="generator" content="DocBook XSL Stylesheets V1.78.1"><link rel="home" href="index.html" title="CERTUTIL"></head><body bgcolor="white" text="black" link="#0000FF" vlink="#840084" alink="#0000FF"><div class="navheader"><table width="100%" summary="Navigation header"><tr><th colspan="3" align="center">CERTUTIL</th></tr></table><hr></div><div class="refentry"><a name="certutil"></a><div class="titlepage"></div><div class="refnamediv"><h2>Name</h2><p>certutil — Manage keys and certificate in both NSS databases and other NSS tokens</p></div><div class="refsynopsisdiv"><h2>Synopsis</h2><div class="cmdsynopsis"><p><code class="command">certutil</code> [<em class="replaceable"><code>options</code></em>] [[<em class="replaceable"><code>arguments</code></em>]]</p></div></div><div class="refsection"><a name="idp47645360"></a><h2>STATUS</h2><p>This documentation is still work in progress. Please contribute to the initial review in <a class="ulink" href="https://bugzilla.mozilla.org/show_bug.cgi?id=836477" target="_top">Mozilla NSS bug 836477</a>
|
||||
</p></div><div class="refsection"><a name="description"></a><h2>Description</h2><p>The Certificate Database Tool, <span class="command"><strong>certutil</strong></span>, is a command-line utility that can create and modify certificate and key databases. It can specifically list, generate, modify, or delete certificates, create or change the password, generate new public and private key pairs, display the contents of the key database, or delete key pairs within the key database.</p><p>Certificate issuance, part of the key and certificate management process, requires that keys and certificates be created in the key database. This document discusses certificate and key database management. For information on the security module database management, see the <span class="command"><strong>modutil</strong></span> manpage.</p></div><div class="refsection"><a name="options"></a><h2>Command Options and Arguments</h2><p>Running <span class="command"><strong>certutil</strong></span> always requires one and only one command option to specify the type of certificate operation. Each command option may take zero or more arguments. The command option <code class="option">-H</code> will list all the command options and their relevant arguments.</p><p><span class="command"><strong>Command Options</strong></span></p><div class="variablelist"><dl class="variablelist"><dt><span class="term">-A </span></dt><dd><p>Add an existing certificate to a certificate database. The certificate database should already exist; if one is not present, this command option will initialize one by default.</p></dd><dt><span class="term">-B</span></dt><dd><p>Run a series of commands from the specified batch file. This requires the <code class="option">-i</code> argument.</p></dd><dt><span class="term">-C </span></dt><dd><p>Create a new binary certificate file from a binary certificate request file. Use the <code class="option">-i</code> argument to specify the certificate request file. If this argument is not used, <span class="command"><strong>certutil</strong></span> prompts for a filename. </p></dd><dt><span class="term">-D </span></dt><dd><p>Delete a certificate from the certificate database.</p></dd><dt><span class="term">-E </span></dt><dd><p>Add an email certificate to the certificate database.</p></dd><dt><span class="term">-F</span></dt><dd><p>Delete a private key from a key database. Specify the key to delete with the -n argument. Specify the database from which to delete the key with the
|
||||
<code class="option">-d</code> argument. Use the <code class="option">-k</code> argument to specify explicitly whether to delete a DSA, RSA, or ECC key. If you don't use the <code class="option">-k</code> argument, the option looks for an RSA key matching the specified nickname.
|
||||
</p><p>
|
||||
|
|
@ -61,7 +61,7 @@ of the attribute codes:
|
|||
the certificate or adding it to a database. Express the offset in integers,
|
||||
using a minus sign (-) to indicate a negative offset. If this argument is
|
||||
not used, the validity period begins at the current system time. The length
|
||||
of the validity period is set with the -v argument. </p></dd><dt><span class="term">-X </span></dt><dd><p>Force the key and certificate database to open in read-write mode. This is used with the <code class="option">-U</code> and <code class="option">-L</code> command options.</p></dd><dt><span class="term">-x </span></dt><dd><p>Use <span class="command"><strong>certutil</strong></span> to generate the signature for a certificate being created or added to a database, rather than obtaining a signature from a separate CA.</p></dd><dt><span class="term">-y exp</span></dt><dd><p>Set an alternate exponent value to use in generating a new RSA public key for the database, instead of the default value of 65537. The available alternate values are 3 and 17.</p></dd><dt><span class="term">-z noise-file</span></dt><dd><p>Read a seed value from the specified file to generate a new private and public key pair. This argument makes it possible to use hardware-generated seed values or manually create a value from the keyboard. The minimum file size is 20 bytes.</p></dd><dt><span class="term">-0 SSO_password</span></dt><dd><p>Set a site security officer password on a token.</p></dd><dt><span class="term">-1 | --keyUsage keyword,keyword</span></dt><dd><p>Set an X.509 V3 Certificate Type Extension in the certificate. There are several available keywords:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
|
||||
of the validity period is set with the -v argument. </p></dd><dt><span class="term">-X </span></dt><dd><p>Force the key and certificate database to open in read-write mode. This is used with the <code class="option">-U</code> and <code class="option">-L</code> command options.</p></dd><dt><span class="term">-x </span></dt><dd><p>Use <span class="command"><strong>certutil</strong></span> to generate the signature for a certificate being created or added to a database, rather than obtaining a signature from a separate CA.</p></dd><dt><span class="term">-y exp</span></dt><dd><p>Set an alternate exponent value to use in generating a new RSA public key for the database, instead of the default value of 65537. The available alternate values are 3 and 17.</p></dd><dt><span class="term">-z noise-file</span></dt><dd><p>Read a seed value from the specified file to generate a new private and public key pair. This argument makes it possible to use hardware-generated seed values or manually create a value from the keyboard. The minimum file size is 20 bytes.</p></dd><dt><span class="term">-Z hashAlg</span></dt><dd><p>Specify the hash algorithm to use with the -C, -S or -R command options. Possible keywords:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>MD2</p></li><li class="listitem"><p>MD4</p></li><li class="listitem"><p>MD5</p></li><li class="listitem"><p>SHA1</p></li><li class="listitem"><p>SHA224</p></li><li class="listitem"><p>SHA256</p></li><li class="listitem"><p>SHA384</p></li><li class="listitem"><p>SHA512</p></li></ul></div></dd><dt><span class="term">-0 SSO_password</span></dt><dd><p>Set a site security officer password on a token.</p></dd><dt><span class="term">-1 | --keyUsage keyword,keyword</span></dt><dd><p>Set an X.509 V3 Certificate Type Extension in the certificate. There are several available keywords:</p><div class="itemizedlist"><ul class="itemizedlist" style="list-style-type: disc; "><li class="listitem"><p>
|
||||
digitalSignature
|
||||
</p></li><li class="listitem"><p>
|
||||
nonRepudiation
|
||||
|
|
|
|||
|
|
@ -2,12 +2,12 @@
|
|||
.\" Title: CERTUTIL
|
||||
.\" Author: [see the "Authors" section]
|
||||
.\" Generator: DocBook XSL Stylesheets v1.78.1 <http://docbook.sf.net/>
|
||||
.\" Date: 29 July 2014
|
||||
.\" Date: 7 January 2015
|
||||
.\" Manual: NSS Security Tools
|
||||
.\" Source: nss-tools
|
||||
.\" Language: English
|
||||
.\"
|
||||
.TH "CERTUTIL" "1" "29 July 2014" "nss-tools" "NSS Security Tools"
|
||||
.TH "CERTUTIL" "1" "7 January 2015" "nss-tools" "NSS Security Tools"
|
||||
.\" -----------------------------------------------------------------
|
||||
.\" * Define some portability stuff
|
||||
.\" -----------------------------------------------------------------
|
||||
|
|
@ -619,6 +619,99 @@ Set an alternate exponent value to use in generating a new RSA public key for th
|
|||
Read a seed value from the specified file to generate a new private and public key pair\&. This argument makes it possible to use hardware\-generated seed values or manually create a value from the keyboard\&. The minimum file size is 20 bytes\&.
|
||||
.RE
|
||||
.PP
|
||||
\-Z hashAlg
|
||||
.RS 4
|
||||
Specify the hash algorithm to use with the \-C, \-S or \-R command options\&. Possible keywords:
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
MD2
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
MD4
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
MD5
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
SHA1
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
SHA224
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
SHA256
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
SHA384
|
||||
.RE
|
||||
.sp
|
||||
.RS 4
|
||||
.ie n \{\
|
||||
\h'-04'\(bu\h'+03'\c
|
||||
.\}
|
||||
.el \{\
|
||||
.sp -1
|
||||
.IP \(bu 2.3
|
||||
.\}
|
||||
SHA512
|
||||
.RE
|
||||
.RE
|
||||
.PP
|
||||
\-0 SSO_password
|
||||
.RS 4
|
||||
Set a site security officer password on a token\&.
|
||||
|
|
|
|||
|
|
@ -1093,7 +1093,6 @@ PKIX_ERRORENTRY(X500NAMEGETSECNAMEFAILED,pkix_pl_X500Name_GetSECName failed,0),
|
|||
PKIX_ERRORENTRY(X500NAMEHASHCODEFAILED,PKIX_PL_X500Name_Hashcode failed,0),
|
||||
PKIX_ERRORENTRY(X500NAMEMATCHFAILED,PKIX_PL_X500Name_Match failed,0),
|
||||
PKIX_ERRORENTRY(X500NAMETOSTRINGFAILED,PKIX_PL_X500Name_ToString failed,0),
|
||||
PKIX_ERRORENTRY(X500NAMETOSTRINGHELPERFAILED,pkix_pl_X500Name_ToString_Helper failed,0),
|
||||
PKIX_ERRORENTRY(ZEROLENGTHBYTEARRAYFORCRLENCODING,Zero-length ByteArray for CRL encoding,0),
|
||||
PKIX_ERRORENTRY(INVALIDOCSPHTTPMETHOD,Unsupported HTTP Method for OCSP retrieval,0),
|
||||
PKIX_ERRORENTRY(OCSPGETREQUESTTOOBIG,OCSP request too big for HTTP GET method,0)
|
||||
|
|
|
|||
|
|
@ -12,61 +12,6 @@
|
|||
|
||||
/* --Private-X500Name-Functions------------------------------------- */
|
||||
|
||||
/*
|
||||
* FUNCTION: pkix_pl_X500Name_ToString_Helper
|
||||
* DESCRIPTION:
|
||||
*
|
||||
* Helper function that creates a string representation of the X500Name
|
||||
* pointed to by "name" and stores it at "pString".
|
||||
*
|
||||
* PARAMETERS
|
||||
* "name"
|
||||
* Address of X500Name whose string representation is desired.
|
||||
* Must be non-NULL.
|
||||
* "pString"
|
||||
* Address where object pointer will be stored. Must be non-NULL.
|
||||
* "plContext" - Platform-specific context pointer.
|
||||
* THREAD SAFETY:
|
||||
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
|
||||
* RETURNS:
|
||||
* Returns NULL if the function succeeds.
|
||||
* Returns a X500Name Error if the function fails in a non-fatal way.
|
||||
* Returns a Fatal Error if the function fails in an unrecoverable way.
|
||||
*/
|
||||
static PKIX_Error *
|
||||
pkix_pl_X500Name_ToString_Helper(
|
||||
PKIX_PL_X500Name *name,
|
||||
PKIX_PL_String **pString,
|
||||
void *plContext)
|
||||
{
|
||||
CERTName *nssDN = NULL;
|
||||
char *utf8String = NULL;
|
||||
PKIX_UInt32 utf8Length;
|
||||
|
||||
PKIX_ENTER(X500NAME, "pkix_pl_X500Name_ToString_Helper");
|
||||
PKIX_NULLCHECK_TWO(name, pString);
|
||||
nssDN = &name->nssDN;
|
||||
|
||||
/* this should really be called CERT_NameToUTF8 */
|
||||
utf8String = CERT_NameToAsciiInvertible(nssDN, CERT_N2A_INVERTIBLE);
|
||||
if (!utf8String){
|
||||
PKIX_ERROR(PKIX_CERTNAMETOASCIIFAILED);
|
||||
}
|
||||
|
||||
PKIX_X500NAME_DEBUG("\t\tCalling PL_strlen).\n");
|
||||
utf8Length = PL_strlen(utf8String);
|
||||
|
||||
PKIX_CHECK(PKIX_PL_String_Create
|
||||
(PKIX_UTF8, utf8String, utf8Length, pString, plContext),
|
||||
PKIX_STRINGCREATEFAILED);
|
||||
|
||||
cleanup:
|
||||
|
||||
PR_Free(utf8String);
|
||||
|
||||
PKIX_RETURN(X500NAME);
|
||||
}
|
||||
|
||||
/*
|
||||
* FUNCTION: pkix_pl_X500Name_Destroy
|
||||
* (see comments for PKIX_PL_DestructorCallback in pkix_pl_system.h)
|
||||
|
|
|
|||
|
|
@ -33,12 +33,12 @@
|
|||
* The format of the version string should be
|
||||
* "<major version>.<minor version>[.<patch level>[.<build number>]][ <ECC>][ <Beta>]"
|
||||
*/
|
||||
#define NSS_VERSION "3.17.3" _NSS_ECC_STRING _NSS_CUSTOMIZED
|
||||
#define NSS_VERSION "3.18" _NSS_ECC_STRING _NSS_CUSTOMIZED " Beta"
|
||||
#define NSS_VMAJOR 3
|
||||
#define NSS_VMINOR 17
|
||||
#define NSS_VPATCH 3
|
||||
#define NSS_VMINOR 18
|
||||
#define NSS_VPATCH 0
|
||||
#define NSS_VBUILD 0
|
||||
#define NSS_BETA PR_FALSE
|
||||
#define NSS_BETA PR_TRUE
|
||||
|
||||
#ifndef RC_INVOKED
|
||||
|
||||
|
|
|
|||
|
|
@ -856,6 +856,8 @@ stan_GetCERTCertificate(NSSCertificate *c, PRBool forceUpdate)
|
|||
CERTCertificate *cc = NULL;
|
||||
CERTCertTrust certTrust;
|
||||
|
||||
/* make sure object does not go away until we finish */
|
||||
nssPKIObject_AddRef(&c->object);
|
||||
nssPKIObject_Lock(&c->object);
|
||||
|
||||
dc = c->decoding;
|
||||
|
|
@ -905,6 +907,7 @@ stan_GetCERTCertificate(NSSCertificate *c, PRBool forceUpdate)
|
|||
|
||||
loser:
|
||||
nssPKIObject_Unlock(&c->object);
|
||||
nssPKIObject_Destroy(&c->object);
|
||||
return cc;
|
||||
}
|
||||
|
||||
|
|
@ -1271,6 +1274,7 @@ DeleteCertTrustMatchingSlot(PK11SlotInfo *pk11slot, nssPKIObject *tObject)
|
|||
int failureCount = 0; /* actual deletion failures by devices */
|
||||
int index;
|
||||
|
||||
nssPKIObject_AddRef(tObject);
|
||||
nssPKIObject_Lock(tObject);
|
||||
/* Keep going even if a module fails to delete. */
|
||||
for (index = 0; index < tObject->numInstances; index++) {
|
||||
|
|
@ -1304,6 +1308,7 @@ DeleteCertTrustMatchingSlot(PK11SlotInfo *pk11slot, nssPKIObject *tObject)
|
|||
}
|
||||
|
||||
nssPKIObject_Unlock(tObject);
|
||||
nssPKIObject_Destroy(tObject);
|
||||
|
||||
return failureCount == 0 ? PR_SUCCESS : PR_FAILURE;
|
||||
}
|
||||
|
|
@ -1330,6 +1335,7 @@ STAN_DeleteCertTrustMatchingSlot(NSSCertificate *c)
|
|||
* loop so that once it's failed the other gets set.
|
||||
*/
|
||||
NSSRWLock_LockRead(td->tokensLock);
|
||||
nssPKIObject_AddRef(cobject);
|
||||
nssPKIObject_Lock(cobject);
|
||||
for (i = 0; i < cobject->numInstances; i++) {
|
||||
nssCryptokiObject *cInstance = cobject->instances[i];
|
||||
|
|
@ -1344,6 +1350,7 @@ STAN_DeleteCertTrustMatchingSlot(NSSCertificate *c)
|
|||
}
|
||||
}
|
||||
nssPKIObject_Unlock(cobject);
|
||||
nssPKIObject_Destroy(cobject);
|
||||
NSSRWLock_UnlockRead(td->tokensLock);
|
||||
return nssrv;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -391,6 +391,7 @@ remove_token_certs(const void *k, void *v, void *a)
|
|||
nssPKIObject *object = &c->object;
|
||||
struct token_cert_dtor *dtor = a;
|
||||
PRUint32 i;
|
||||
nssPKIObject_AddRef(object);
|
||||
nssPKIObject_Lock(object);
|
||||
for (i=0; i<object->numInstances; i++) {
|
||||
if (object->instances[i]->token == dtor->token) {
|
||||
|
|
@ -409,6 +410,7 @@ remove_token_certs(const void *k, void *v, void *a)
|
|||
}
|
||||
}
|
||||
nssPKIObject_Unlock(object);
|
||||
nssPKIObject_Destroy(object);
|
||||
return;
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -1691,8 +1691,6 @@ void sdb_SetForkState(PRBool forked)
|
|||
*/
|
||||
static const char INIT_CMD[] =
|
||||
"CREATE TABLE %s (id PRIMARY KEY UNIQUE ON CONFLICT ABORT%s)";
|
||||
static const char ALTER_CMD[] =
|
||||
"ALTER TABLE %s ADD COLUMN a%x";
|
||||
|
||||
CK_RV
|
||||
sdb_init(char *dbname, char *table, sdbDataType type, int *inUpdate,
|
||||
|
|
|
|||
|
|
@ -25,11 +25,11 @@
|
|||
* The format of the version string should be
|
||||
* "<major version>.<minor version>[.<patch level>[.<build number>]][ <ECC>][ <Beta>]"
|
||||
*/
|
||||
#define SOFTOKEN_VERSION "3.17.3" SOFTOKEN_ECC_STRING
|
||||
#define SOFTOKEN_VERSION "3.18" SOFTOKEN_ECC_STRING " Beta"
|
||||
#define SOFTOKEN_VMAJOR 3
|
||||
#define SOFTOKEN_VMINOR 17
|
||||
#define SOFTOKEN_VPATCH 3
|
||||
#define SOFTOKEN_VMINOR 18
|
||||
#define SOFTOKEN_VPATCH 0
|
||||
#define SOFTOKEN_VBUILD 0
|
||||
#define SOFTOKEN_BETA PR_FALSE
|
||||
#define SOFTOKEN_BETA PR_TRUE
|
||||
|
||||
#endif /* _SOFTKVER_H_ */
|
||||
|
|
|
|||
|
|
@ -904,7 +904,7 @@ ssl3_NegotiateVersion(sslSocket *ss, SSL3ProtocolVersion peerVersion,
|
|||
|
||||
if (peerVersion < ss->vrange.min ||
|
||||
(peerVersion > ss->vrange.max && !allowLargerPeerVersion)) {
|
||||
PORT_SetError(SSL_ERROR_NO_CYPHER_OVERLAP);
|
||||
PORT_SetError(SSL_ERROR_UNSUPPORTED_VERSION);
|
||||
return SECFailure;
|
||||
}
|
||||
|
||||
|
|
@ -6287,7 +6287,7 @@ ssl3_HandleServerHello(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
|
|||
if (rv != SECSuccess) {
|
||||
desc = (version > SSL_LIBRARY_VERSION_3_0) ? protocol_version
|
||||
: handshake_failure;
|
||||
errCode = SSL_ERROR_NO_CYPHER_OVERLAP;
|
||||
errCode = SSL_ERROR_UNSUPPORTED_VERSION;
|
||||
goto alert_loser;
|
||||
}
|
||||
isTLS = (ss->version > SSL_LIBRARY_VERSION_3_0);
|
||||
|
|
@ -7699,7 +7699,7 @@ ssl3_HandleClientHello(sslSocket *ss, SSL3Opaque *b, PRUint32 length)
|
|||
if (rv != SECSuccess) {
|
||||
desc = (version > SSL_LIBRARY_VERSION_3_0) ? protocol_version
|
||||
: handshake_failure;
|
||||
errCode = SSL_ERROR_NO_CYPHER_OVERLAP;
|
||||
errCode = SSL_ERROR_UNSUPPORTED_VERSION;
|
||||
goto alert_loser;
|
||||
}
|
||||
|
||||
|
|
@ -8472,8 +8472,9 @@ ssl3_HandleV2ClientHello(sslSocket *ss, unsigned char *buffer, int length)
|
|||
rv = ssl3_NegotiateVersion(ss, version, PR_TRUE);
|
||||
if (rv != SECSuccess) {
|
||||
/* send back which ever alert client will understand. */
|
||||
desc = (version > SSL_LIBRARY_VERSION_3_0) ? protocol_version : handshake_failure;
|
||||
errCode = SSL_ERROR_NO_CYPHER_OVERLAP;
|
||||
desc = (version > SSL_LIBRARY_VERSION_3_0) ? protocol_version
|
||||
: handshake_failure;
|
||||
errCode = SSL_ERROR_UNSUPPORTED_VERSION;
|
||||
goto alert_loser;
|
||||
}
|
||||
|
||||
|
|
|
|||
|
|
@ -19,12 +19,12 @@
|
|||
* The format of the version string should be
|
||||
* "<major version>.<minor version>[.<patch level>[.<build number>]][ <Beta>]"
|
||||
*/
|
||||
#define NSSUTIL_VERSION "3.17.3"
|
||||
#define NSSUTIL_VERSION "3.18 Beta"
|
||||
#define NSSUTIL_VMAJOR 3
|
||||
#define NSSUTIL_VMINOR 17
|
||||
#define NSSUTIL_VPATCH 3
|
||||
#define NSSUTIL_VMINOR 18
|
||||
#define NSSUTIL_VPATCH 0
|
||||
#define NSSUTIL_VBUILD 0
|
||||
#define NSSUTIL_BETA PR_FALSE
|
||||
#define NSSUTIL_BETA PR_TRUE
|
||||
|
||||
SEC_BEGIN_PROTOS
|
||||
|
||||
|
|
|
|||
|
|
@ -168,19 +168,29 @@ dbtest_main()
|
|||
cat $RONLY_DIR/* > /dev/null
|
||||
fi
|
||||
|
||||
${BINDIR}/dbtest -d $RONLY_DIR
|
||||
# skipping the next two tests when user is root,
|
||||
# otherwise they would fail due to rooty powers
|
||||
if [ $UID -ne 0 ] then
|
||||
${BINDIR}/dbtest -d $RONLY_DIR
|
||||
ret=$?
|
||||
if [ $ret -ne 46 ]; then
|
||||
html_failed "Dbtest r/w succeeded in an readonly directory $ret"
|
||||
html_failed "Dbtest r/w succeeded in a readonly directory $ret"
|
||||
else
|
||||
html_passed "Dbtest r/w didn't work in an readonly dir $ret"
|
||||
fi
|
||||
${BINDIR}/certutil -D -n "TestUser" -d .
|
||||
else
|
||||
html_passed "Skipping Dbtest r/w in a readonly dir because user is root"
|
||||
fi
|
||||
if [ $UID -ne 0 ] then
|
||||
${BINDIR}/certutil -D -n "TestUser" -d .
|
||||
ret=$?
|
||||
if [ $ret -ne 255 ]; then
|
||||
html_failed "Certutil succeeded in deleting a cert in an readonly directory $ret"
|
||||
html_failed "Certutil succeeded in deleting a cert in a readonly directory $ret"
|
||||
else
|
||||
html_passed "Certutil didn't work in an readonly dir $ret"
|
||||
html_passed "Certutil didn't work in an readonly dir $ret"
|
||||
fi
|
||||
else
|
||||
html_passed "Skipping Certutil delete cert in a readonly directory test because user is root"
|
||||
fi
|
||||
|
||||
Echo "test opening the database ronly in a readonly directory"
|
||||
|
|
|
|||
Загрузка…
Ссылка в новой задаче