mozilla
/
pjs
зеркало из https://github.com/mozilla/pjs.git
1
0
Форкнуть 0
Код Задачи Пакеты Проекты Релизы Вики Активность

Fix for bug 337789 . PK11_FindKeyByAnyCert doe snot work if softoken is in FIPS140-2 mode. r=wtchang, rrelyea, nelson

This commit is contained in:
julien.pierre.bugs%sun.com 2006-05-15 23:51:01 +00:00
Родитель 4101f1bd3c
Коммит 355ffcddab
4 изменённых файлов: 29 добавлений и 13 удалений
Показать статистику Скачать Patch файл Скачать Diff файл Показать все файлы Свернуть все файлы

10
security/nss/cmd/lib/SECerrs.h
Просмотреть файл

@ -504,3 +504,13 @@ ER3(SEC_ERROR_INCOMPATIBLE_PKCS11, (SEC_ERROR_BASE + 151),
ER3(SEC_ERROR_NO_EVENT, (SEC_ERROR_BASE + 152),
"No new slot event is available at this time.")
ER3(SEC_ERROR_CRL_ALREADY_EXISTS, (SEC_ERROR_BASE + 153),
"CRL already exists.")
ER3(SEC_ERROR_NOT_INITIALIZED, (SEC_ERROR_BASE + 154),
"NSS is not initialized.")
ER3(SEC_ERROR_TOKEN_NOT_LOGGED_IN, (SEC_ERROR_BASE + 155),
"The operation failed because the PKCS#11 token is not logged in.")

28
security/nss/lib/pk11wrap/pk11cert.c
Просмотреть файл

@ -928,6 +928,7 @@ pk11_getcerthandle(PK11SlotInfo *slot, CERTCertificate *cert,
SECKEYPrivateKey *
PK11_FindPrivateKeyFromCert(PK11SlotInfo *slot, CERTCertificate *cert,
void *wincx) {
int err;
CK_OBJECT_CLASS certClass = CKO_CERTIFICATE;
CK_ATTRIBUTE theTemplate[] = {
{ CKA_VALUE, NULL, 0 },
@ -966,9 +967,9 @@ PK11_FindPrivateKeyFromCert(PK11SlotInfo *slot, CERTCertificate *cert,
*/
needLogin = pk11_LoginStillRequired(slot,wincx);
keyh = PK11_MatchItem(slot,certh,CKO_PRIVATE_KEY);
if ((keyh == CK_INVALID_HANDLE) &&
(PORT_GetError() == SSL_ERROR_NO_CERTIFICATE) &&
needLogin) {
if ((keyh == CK_INVALID_HANDLE) && needLogin &&
(SSL_ERROR_NO_CERTIFICATE == (err = PORT_GetError()) ||
SEC_ERROR_TOKEN_NOT_LOGGED_IN == err )) {
/* try it again authenticated */
rv = PK11_Authenticate(slot, PR_TRUE, wincx);
if (rv != SECSuccess) {
@ -995,6 +996,7 @@ PK11_KeyForCertExists(CERTCertificate *cert, CK_OBJECT_HANDLE *keyPtr,
CK_OBJECT_HANDLE key;
PK11SlotInfo *slot = NULL;
SECStatus rv;
int err;
keyID = pk11_mkcertKeyID(cert);
/* get them all! */
@ -1016,9 +1018,9 @@ PK11_KeyForCertExists(CERTCertificate *cert, CK_OBJECT_HANDLE *keyPtr,
*/
PRBool needLogin = pk11_LoginStillRequired(le->slot,wincx);
key = pk11_FindPrivateKeyFromCertID(le->slot,keyID);
if ((key == CK_INVALID_HANDLE) &&
(PORT_GetError() == SSL_ERROR_NO_CERTIFICATE) &&
needLogin) {
if ((key == CK_INVALID_HANDLE) && needLogin &&
(SSL_ERROR_NO_CERTIFICATE == (err = PORT_GetError()) ||
SEC_ERROR_TOKEN_NOT_LOGGED_IN == err )) {
/* authenticate and try again */
rv = PK11_Authenticate(le->slot, PR_TRUE, wincx);
if (rv != SECSuccess) continue;
@ -1574,6 +1576,7 @@ PK11_FindKeyByAnyCert(CERTCertificate *cert, void *wincx)
SECKEYPrivateKey *privKey = NULL;
PRBool needLogin;
SECStatus rv;
int err;
certHandle = PK11_FindObjectForCert(cert, wincx, &slot);
if (certHandle == CK_INVALID_HANDLE) {
@ -1588,9 +1591,9 @@ PK11_FindKeyByAnyCert(CERTCertificate *cert, void *wincx)
*/
needLogin = pk11_LoginStillRequired(slot,wincx);
keyHandle = PK11_MatchItem(slot,certHandle,CKO_PRIVATE_KEY);
if ((keyHandle == CK_INVALID_HANDLE) &&
(PORT_GetError() == SSL_ERROR_NO_CERTIFICATE) &&
needLogin) {
if ((keyHandle == CK_INVALID_HANDLE) && needLogin &&
(SSL_ERROR_NO_CERTIFICATE == (err = PORT_GetError()) ||
SEC_ERROR_TOKEN_NOT_LOGGED_IN == err ) ) {
/* authenticate and try again */
rv = PK11_Authenticate(slot, PR_TRUE, wincx);
if (rv == SECSuccess) {
@ -1976,6 +1979,7 @@ pk11_findKeyObjectByDERCert(PK11SlotInfo *slot, CERTCertificate *cert,
CK_OBJECT_HANDLE key;
SECStatus rv;
PRBool needLogin;
int err;
if((slot == NULL) || (cert == NULL)) {
return CK_INVALID_HANDLE;
@ -1995,9 +1999,9 @@ pk11_findKeyObjectByDERCert(PK11SlotInfo *slot, CERTCertificate *cert,
*/
needLogin = pk11_LoginStillRequired(slot,wincx);
key = pk11_FindPrivateKeyFromCertID(slot, keyID);
if ((key == CK_INVALID_HANDLE) &&
(PORT_GetError() == SSL_ERROR_NO_CERTIFICATE) &&
needLogin) {
if ((key == CK_INVALID_HANDLE) && needLogin &&
(SSL_ERROR_NO_CERTIFICATE == (err = PORT_GetError()) ||
SEC_ERROR_TOKEN_NOT_LOGGED_IN == err )) {
/* authenticate and try again */
rv = PK11_Authenticate(slot, PR_TRUE, wincx);
if (rv != SECSuccess) goto loser;

2
security/nss/lib/pk11wrap/pk11err.c
Просмотреть файл

@ -113,7 +113,7 @@ PK11_MapError(CK_RV rv) {
MAPERROR(CKR_UNWRAPPING_KEY_SIZE_RANGE, SEC_ERROR_INVALID_KEY)
MAPERROR(CKR_UNWRAPPING_KEY_TYPE_INCONSISTENT, SEC_ERROR_INVALID_KEY)
MAPERROR(CKR_USER_ALREADY_LOGGED_IN, 0)
MAPERROR(CKR_USER_NOT_LOGGED_IN, SEC_ERROR_LIBRARY_FAILURE) /* XXXX */
MAPERROR(CKR_USER_NOT_LOGGED_IN, SEC_ERROR_TOKEN_NOT_LOGGED_IN)
MAPERROR(CKR_USER_PIN_NOT_INITIALIZED, SEC_ERROR_NO_TOKEN)
MAPERROR(CKR_USER_TYPE_INVALID, SEC_ERROR_LIBRARY_FAILURE)
MAPERROR(CKR_WRAPPED_KEY_INVALID, SEC_ERROR_INVALID_KEY)

2
security/nss/lib/util/secerr.h
Просмотреть файл

@ -204,6 +204,8 @@ SEC_ERROR_UNKNOWN_OBJECT_TYPE = (SEC_ERROR_BASE + 150),
SEC_ERROR_INCOMPATIBLE_PKCS11 = (SEC_ERROR_BASE + 151),
SEC_ERROR_NO_EVENT = (SEC_ERROR_BASE + 152),
SEC_ERROR_CRL_ALREADY_EXISTS = (SEC_ERROR_BASE + 153),
SEC_ERROR_NOT_INITIALIZED = (SEC_ERROR_BASE + 154),
SEC_ERROR_TOKEN_NOT_LOGGED_IN = (SEC_ERROR_BASE + 155),
/* Add new error codes above here. */
SEC_ERROR_END_OF_LIST