Changeset 358
- Timestamp:
- 11/06/08 14:28:46 (4 years ago)
- Location:
- trunk/src
- Files:
-
- 58 edited
-
common/NSPRerrs.h (modified) (2 diffs)
-
common/SECerrs.h (modified) (2 diffs)
-
common/algorithm.c (modified) (1 diff)
-
common/base64.h (modified) (1 diff)
-
common/cert_info.c (modified) (11 diffs)
-
common/cert_info.h (modified) (2 diffs)
-
common/cert_vfy.c (modified) (4 diffs)
-
common/cert_vfy.h (modified) (1 diff)
-
common/debug.c (modified) (2 diffs)
-
common/debug.h (modified) (2 diffs)
-
common/error.h (modified) (1 diff)
-
common/pkcs11_lib.c (modified) (36 diffs)
-
common/pkcs11_lib.h (modified) (4 diffs)
-
common/rsaref/PKCS11_README (modified) (1 diff)
-
common/rsaref/pkcs11.h (modified) (1 diff)
-
common/rsaref/pkcs11f.h (modified) (6 diffs)
-
common/rsaref/pkcs11t.h (modified) (17 diffs)
-
common/secutil.h (modified) (11 diffs)
-
common/strings.h (modified) (3 diffs)
-
common/uri.c (modified) (1 diff)
-
mappers/cn_mapper.c (modified) (1 diff)
-
mappers/cn_mapper.h (modified) (1 diff)
-
mappers/digest_mapper.c (modified) (1 diff)
-
mappers/digest_mapper.h (modified) (1 diff)
-
mappers/generic_mapper.c (modified) (4 diffs)
-
mappers/generic_mapper.h (modified) (1 diff)
-
mappers/krb_mapper.c (modified) (1 diff)
-
mappers/krb_mapper.h (modified) (1 diff)
-
mappers/ldap_mapper.c (modified) (34 diffs)
-
mappers/ldap_mapper.h (modified) (1 diff)
-
mappers/mail_mapper.c (modified) (1 diff)
-
mappers/mail_mapper.h (modified) (1 diff)
-
mappers/mapper.c (modified) (2 diffs)
-
mappers/mapper.h (modified) (5 diffs)
-
mappers/mapperlist.h (modified) (1 diff)
-
mappers/ms_mapper.c (modified) (3 diffs)
-
mappers/ms_mapper.h (modified) (1 diff)
-
mappers/null_mapper.h (modified) (1 diff)
-
mappers/opensc_mapper.c (modified) (1 diff)
-
mappers/opensc_mapper.h (modified) (1 diff)
-
mappers/openssh_mapper.c (modified) (3 diffs)
-
mappers/openssh_mapper.h (modified) (1 diff)
-
mappers/pwent_mapper.c (modified) (2 diffs)
-
mappers/pwent_mapper.h (modified) (1 diff)
-
mappers/subject_mapper.h (modified) (1 diff)
-
mappers/uid_mapper.c (modified) (2 diffs)
-
mappers/uid_mapper.h (modified) (1 diff)
-
pam_pkcs11/mapper_mgr.c (modified) (7 diffs)
-
pam_pkcs11/mapper_mgr.h (modified) (1 diff)
-
pam_pkcs11/pam_config.c (modified) (4 diffs)
-
pam_pkcs11/pam_pkcs11.c (modified) (25 diffs)
-
scconf/README.scconf (modified) (7 diffs)
-
scconf/parse.c (modified) (2 diffs)
-
tools/card_eventmgr.c (modified) (4 diffs)
-
tools/pkcs11_eventmgr.c (modified) (14 diffs)
-
tools/pkcs11_listcerts.c (modified) (2 diffs)
-
tools/pkcs11_setup.c (modified) (17 diffs)
-
tools/pklogin_finder.c (modified) (1 diff)
Legend:
- Unmodified
- Added
- Removed
-
trunk/src/common/NSPRerrs.h
r244 r358 62 62 ER2( PR_LOAD_LIBRARY_ERROR, "Failure to load dynamic library." ) 63 63 ER2( PR_UNLOAD_LIBRARY_ERROR, "Failure to unload dynamic library." ) 64 ER2( PR_FIND_SYMBOL_ERROR, 64 ER2( PR_FIND_SYMBOL_ERROR, 65 65 "Symbol not found in any of the loaded dynamic libraries." ) 66 66 ER2( PR_INSUFFICIENT_RESOURCES_ERROR, "Insufficient system resources." ) 67 ER2( PR_DIRECTORY_LOOKUP_ERROR, 67 ER2( PR_DIRECTORY_LOOKUP_ERROR, 68 68 "A directory lookup on a network address has failed." ) 69 ER2( PR_TPD_RANGE_ERROR, 69 ER2( PR_TPD_RANGE_ERROR, 70 70 "Attempt to access a TPD key that is out of range." ) 71 71 ER2( PR_PROC_DESC_TABLE_FULL_ERROR, "Process open FD table is full." ) 72 72 ER2( PR_SYS_DESC_TABLE_FULL_ERROR, "System open FD table is full." ) 73 ER2( PR_NOT_SOCKET_ERROR, 73 ER2( PR_NOT_SOCKET_ERROR, 74 74 "Network operation attempted on non-network file descriptor." ) 75 ER2( PR_NOT_TCP_SOCKET_ERROR, 75 ER2( PR_NOT_TCP_SOCKET_ERROR, 76 76 "TCP-specific function attempted on a non-TCP file descriptor." ) 77 77 ER2( PR_SOCKET_ADDRESS_IS_BOUND_ERROR, "TCP file descriptor is already bound." ) 78 78 ER2( PR_NO_ACCESS_RIGHTS_ERROR, "Access Denied." ) 79 ER2( PR_OPERATION_NOT_SUPPORTED_ERROR, 79 ER2( PR_OPERATION_NOT_SUPPORTED_ERROR, 80 80 "The requested operation is not supported by the platform." ) 81 ER2( PR_PROTOCOL_NOT_SUPPORTED_ERROR, 81 ER2( PR_PROTOCOL_NOT_SUPPORTED_ERROR, 82 82 "The host operating system does not support the protocol requested." ) 83 83 ER2( PR_REMOTE_FILE_ERROR, "Access to the remote file has been severed." ) 84 ER2( PR_BUFFER_OVERFLOW_ERROR, 84 ER2( PR_BUFFER_OVERFLOW_ERROR, 85 85 "The value requested is too large to be stored in the data buffer provided." ) 86 86 ER2( PR_CONNECT_RESET_ERROR, "TCP connection reset by peer." ) … … 88 88 ER2( PR_DEADLOCK_ERROR, "The operation would have deadlocked." ) 89 89 ER2( PR_FILE_IS_LOCKED_ERROR, "The file is already locked." ) 90 ER2( PR_FILE_TOO_BIG_ERROR, 90 ER2( PR_FILE_TOO_BIG_ERROR, 91 91 "Write would result in file larger than the system allows." ) 92 92 ER2( PR_NO_DEVICE_SPACE_ERROR, "The device for storing the file is full." ) 93 93 ER2( PR_PIPE_ERROR, "Unused." ) 94 94 ER2( PR_NO_SEEK_DEVICE_ERROR, "Unused." ) 95 ER2( PR_IS_DIRECTORY_ERROR, 95 ER2( PR_IS_DIRECTORY_ERROR, 96 96 "Cannot perform a normal file operation on a directory." ) 97 97 ER2( PR_LOOP_ERROR, "Symbolic link loop." ) 98 98 ER2( PR_NAME_TOO_LONG_ERROR, "File name is too long." ) 99 99 ER2( PR_FILE_NOT_FOUND_ERROR, "File not found." ) 100 ER2( PR_NOT_DIRECTORY_ERROR, 100 ER2( PR_NOT_DIRECTORY_ERROR, 101 101 "Cannot perform directory operation on a normal file." ) 102 ER2( PR_READ_ONLY_FILESYSTEM_ERROR, 102 ER2( PR_READ_ONLY_FILESYSTEM_ERROR, 103 103 "Cannot write to a read-only file system." ) 104 ER2( PR_DIRECTORY_NOT_EMPTY_ERROR, 104 ER2( PR_DIRECTORY_NOT_EMPTY_ERROR, 105 105 "Cannot delete a directory that is not empty." ) 106 ER2( PR_FILESYSTEM_MOUNTED_ERROR, 106 ER2( PR_FILESYSTEM_MOUNTED_ERROR, 107 107 "Cannot delete or rename a file object while the file system is busy." ) 108 ER2( PR_NOT_SAME_DEVICE_ERROR, 108 ER2( PR_NOT_SAME_DEVICE_ERROR, 109 109 "Cannot rename a file to a file system on another device." ) 110 ER2( PR_DIRECTORY_CORRUPTED_ERROR, 110 ER2( PR_DIRECTORY_CORRUPTED_ERROR, 111 111 "The directory object in the file system is corrupted." ) 112 ER2( PR_FILE_EXISTS_ERROR, 112 ER2( PR_FILE_EXISTS_ERROR, 113 113 "Cannot create or rename a filename that already exists." ) 114 ER2( PR_MAX_DIRECTORY_ENTRIES_ERROR, 114 ER2( PR_MAX_DIRECTORY_ENTRIES_ERROR, 115 115 "Directory is full. No additional filenames may be added." ) 116 ER2( PR_INVALID_DEVICE_STATE_ERROR, 116 ER2( PR_INVALID_DEVICE_STATE_ERROR, 117 117 "The required device was in an invalid state." ) 118 118 ER2( PR_DEVICE_IS_LOCKED_ERROR, "The device is locked." ) -
trunk/src/common/SECerrs.h
r244 r358 148 148 ER3(SEC_ERROR_CA_CERT_INVALID, (SEC_ERROR_BASE + 36), 149 149 "Issuer certificate is invalid.") 150 150 151 151 ER3(SEC_ERROR_PATH_LEN_CONSTRAINT_INVALID, (SEC_ERROR_BASE + 37), 152 152 "Certificate path length constraint is invalid.") … … 376 376 ER3(SEC_ERROR_OLD_KRL, (SEC_ERROR_BASE + 110), 377 377 "New KRL is not later than the current one.") 378 378 379 379 ER3(SEC_ERROR_CKL_CONFLICT, (SEC_ERROR_BASE + 111), 380 380 "New CKL has different issuer than current CKL. Delete current CKL.") -
trunk/src/common/algorithm.c
r244 r358 28 28 ALGORITHM_TYPE Alg_get_alg_from_string(const char *hashString) 29 29 { 30 /* sigh, we don't have any string to out conversion 30 /* sigh, we don't have any string to out conversion 31 31 * it would be nice to at least search the oid table by 32 32 * description */ -
trunk/src/common/base64.h
r233 r358 1 1 /* 2 * BASE64 Encoding funtions 2 * BASE64 Encoding funtions 3 3 * Copyright (C) 2001, 2002 Juha Yrj\uffffl\uffff <juha.yrjola@iki.fi> 4 4 * Copyright (C) 2003-2004 Mario Strasser <mast@gmx.net> -
trunk/src/common/cert_info.c
r344 r358 36 36 /* 37 37 * NSS dynamic oid support. 38 * NSS is able to understand new oid tags provided by the application, 38 * NSS is able to understand new oid tags provided by the application, 39 39 * including 40 40 * understanding new cert extensions that NSS previously did not understand. … … 46 46 SECOidTag CERT_KerberosPN_OID = SEC_OID_UNKNOWN; 47 47 static const unsigned char kerberosOID[] = { 0x2b, 0x6, 0x1, 0x5, 0x2, 0x2 }; 48 static const SECOidData kerberosPN_Entry = 49 { TO_ITEM(kerberosOID), SEC_OID_UNKNOWN, 48 static const SECOidData kerberosPN_Entry = 49 { TO_ITEM(kerberosOID), SEC_OID_UNKNOWN, 50 50 "Kerberos Priniciple", CKM_INVALID_MECHANISM, INVALID_CERT_EXTENSION }; 51 51 52 52 SECOidTag CERT_MicrosoftUPN_OID = SEC_OID_UNKNOWN; 53 53 /* { 1.3.6.1.4.1.311 } */ 54 static const unsigned char microsoftUPNOID[] = 54 static const unsigned char microsoftUPNOID[] = 55 55 { 0x2b, 0x6, 0x1, 0x4, 0x1, 0x82, 0x37, 0x14, 0x2, 0x3 }; 56 static const SECOidData microsoftUPN_Entry = 57 { TO_ITEM(microsoftUPNOID), SEC_OID_UNKNOWN, 58 "Microsoft Universal Priniciple", CKM_INVALID_MECHANISM, 56 static const SECOidData microsoftUPN_Entry = 57 { TO_ITEM(microsoftUPNOID), SEC_OID_UNKNOWN, 58 "Microsoft Universal Priniciple", CKM_INVALID_MECHANISM, 59 59 INVALID_CERT_EXTENSION }; 60 60 … … 148 148 goto no_upn; 149 149 } 150 150 151 151 arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); 152 152 if (!arena) { … … 252 252 if ( !algorithm ) { 253 253 DBG("Must specify digest algorithm"); 254 return NULL; 254 return NULL; 255 255 } 256 256 return cert_info_digest(x509,algorithm); … … 431 431 if (OBJ_cmp(name->d.otherName->type_id, krb5PrincipalName)) continue; /* object is not a UPN */ 432 432 else { 433 /* NOTE: 433 /* NOTE: 434 434 from PKINIT RFC, I deduce that stored format for kerberos 435 435 Principal Name is ASN1_STRING, but not sure at 100% … … 613 613 } 614 614 pt=key2pem(pubk); 615 if (!pt) { 615 if (!pt) { 616 616 DBG("key2pem() failed"); 617 617 EVP_PKEY_free(pubk); … … 630 630 *pt++= (n&0x0000ff00) >>8; 631 631 *pt++= (n&0x000000ff) >>0; 632 return 4; 632 return 4; 633 633 } 634 634 … … 696 696 res= BN_append(pt, pubk->pkey.dsa->pub_key); pt+=res; 697 697 break; 698 case EVP_PKEY_RSA: 698 case EVP_PKEY_RSA: 699 699 if (!pubk->pkey.rsa) { 700 700 DBG("No data for public RSA key"); … … 702 702 } 703 703 /* dump key into a byte array */ 704 type="ssh-rsa"; 704 type="ssh-rsa"; 705 705 res= int_append(pt,strlen(type)); pt+=res; 706 706 res= str_append(pt,type,strlen(type)); pt+=res; … … 826 826 827 827 len = i2c_ASN1_INTEGER(serial, NULL); 828 828 829 829 if (len < 0) { 830 830 return NULL; … … 883 883 if ( !algorithm ) { 884 884 DBG("Must specify digest algorithm"); 885 return NULL; 885 return NULL; 886 886 } 887 887 return cert_info_digest(x509,algorithm); -
trunk/src/common/cert_info.h
r238 r358 23 23 24 24 /** Certificate Common Name */ 25 #define CERT_CN 1 25 #define CERT_CN 1 26 26 /** Certificate subject */ 27 27 #define CERT_SUBJECT 2 28 28 /** Kerberos principal name */ 29 #define CERT_KPN 3 29 #define CERT_KPN 3 30 30 /** Certificate e-mail */ 31 #define CERT_EMAIL 4 31 #define CERT_EMAIL 4 32 32 /** Microsoft's Universal Principal Name */ 33 #define CERT_UPN 5 33 #define CERT_UPN 5 34 34 /** Certificate Unique Identifier */ 35 #define CERT_UID 6 35 #define CERT_UID 6 36 36 /** Certificate Public Key (PEM Format)*/ 37 #define CERT_PUK 7 37 #define CERT_PUK 7 38 38 /** Certificate Digest */ 39 #define CERT_DIGEST 8 39 #define CERT_DIGEST 8 40 40 /** Certificate Public key in OpenSSH format */ 41 #define CERT_SSHPUK 9 41 #define CERT_SSHPUK 9 42 42 /** Certificate in PEM format */ 43 #define CERT_PEM 10 43 #define CERT_PEM 10 44 44 /** Certificate issuer */ 45 45 #define CERT_ISSUER 11 … … 52 52 #define CERT_INFO_SIZE 16 53 53 /** Max number of entries to find from certificate */ 54 #define CERT_INFO_MAX_ENTRIES ( CERT_INFO_SIZE - 1 ) 54 #define CERT_INFO_MAX_ENTRIES ( CERT_INFO_SIZE - 1 ) 55 55 56 56 #ifndef __CERT_INFO_C_ -
trunk/src/common/cert_vfy.c
r348 r358 71 71 } 72 72 73 #else 73 #else 74 74 75 75 #define __CERT_VFY_C_ … … 255 255 DBG1("downloading crl from %s", name->d.ia5->data); 256 256 crl = download_crl((const char *)name->d.ia5->data); 257 257 258 258 /*crl = download_crl("file:///home/mario/projects/pkcs11_login/tests/ca_crl_0.pem"); */ 259 259 /*crl = download_crl("http://www-t.zhwin.ch/ca/root_ca.crl"); */ … … 394 394 395 395 /* 396 * @return -1 on error, 0 on verify failed, 1 on verify sucess 396 * @return -1 on error, 0 on verify failed, 1 on verify sucess 397 397 */ 398 398 int verify_certificate(X509 * x509, cert_policy *policy) … … 429 429 if (rv != 1) { 430 430 X509_STORE_CTX_free(ctx); 431 X509_STORE_free(store); 431 X509_STORE_free(store); 432 432 set_error("certificate is invalid: %s", X509_verify_cert_error_string(ctx->error)); 433 return 0; 433 return 0; 434 434 } else { 435 435 DBG("certificate is valid"); -
trunk/src/common/cert_vfy.h
r238 r358 30 30 #include "cert_st.h" 31 31 32 typedef enum { 32 typedef enum { 33 33 /** Do not perform any CRL verification */ 34 CRLP_NONE, 34 CRLP_NONE, 35 35 /** Retrieve CRL from CA site */ 36 CRLP_ONLINE, 36 CRLP_ONLINE, 37 37 /** Retrieve CRL from local filesystem */ 38 38 CRLP_OFFLINE, 39 39 /** Try CRL check online, else ofline, else fail */ 40 CRLP_AUTO 40 CRLP_AUTO 41 41 } crl_policy_t; 42 42 43 typedef enum { 44 OCSP_NONE, 45 OCSP_ON 43 typedef enum { 44 OCSP_NONE, 45 OCSP_ON 46 46 } ocsp_policy_t; 47 47 -
trunk/src/common/debug.c
r305 r358 1 /* 1 /* 2 2 * PKCS #11 PAM Login Module 3 3 * Copyright (C) 2003 Mario Strasser <mast@gmx.net>, … … 60 60 vsnprintf(buf, sizeof(buf), format, ap); 61 61 va_end(ap); 62 62 63 63 syslog(LOG_INFO, buf); 64 64 } -
trunk/src/common/debug.h
r246 r358 63 63 #ifndef __DEBUG_C_ 64 64 #define DEBUG_EXTERN extern 65 #else 65 #else 66 66 #define DEBUG_EXTERN 67 67 #endif … … 80 80 81 81 /** 82 * debug_print() prints the given message 82 * debug_print() prints the given message 83 83 84 * if the current debug-level 84 * if the current debug-level 85 85 * is greater or equal to the defined level. The format string as well as all 86 * further arguments are interpreted as by the printf() function. 86 * further arguments are interpreted as by the printf() function. 87 87 *@param level Debug level of message 88 88 *@param file Name of the file where message is generated -
trunk/src/common/error.h
r247 r358 31 31 32 32 /** Default error message buffer size */ 33 #define ERROR_BUFFER_SIZE 512 33 #define ERROR_BUFFER_SIZE 512 34 34 35 35 #ifndef __ERROR_C_ -
trunk/src/common/pkcs11_lib.c
r352 r358 213 213 214 214 215 static SECMODModule *find_module_by_library(char *pkcs11_module) 215 static SECMODModule *find_module_by_library(char *pkcs11_module) 216 216 { 217 217 SECMODModule *module = NULL; … … 236 236 * NSS allows you to load a specific module. If the user specified a module 237 237 * to load, load it, otherwize select on of the standard modules from the 238 * secmod.db list. 238 * secmod.db list. 239 239 */ 240 240 int load_pkcs11_module(char *pkcs11_module, pkcs11_handle_t **hp) … … 261 261 } 262 262 263 /* specified module is not already loaded, load it now */ 263 /* specified module is not already loaded, load it now */ 264 264 moduleSpec = (char *)malloc(sizeof(SPEC_TEMPLATE) + strlen(pkcs11_module)); 265 265 if (!moduleSpec) { … … 298 298 int i; 299 299 300 /* if module is null, 300 /* if module is null, 301 301 * any of the PKCS #11 modules specified in the system config 302 302 * is available, find one */ … … 364 364 * slot is ok. 365 365 */ 366 int find_slot_by_number_and_label(pkcs11_handle_t *h, 366 int find_slot_by_number_and_label(pkcs11_handle_t *h, 367 367 int wanted_slot_id, 368 368 const char *wanted_token_label, … … 385 385 token_label = PK11_GetTokenName(h->slot); 386 386 387 if ((token_label != NULL) && 387 if ((token_label != NULL) && 388 388 (strcmp (wanted_token_label, token_label) == 0)) { 389 389 return 0; … … 413 413 } 414 414 415 int wait_for_token(pkcs11_handle_t *h, 415 int wait_for_token(pkcs11_handle_t *h, 416 416 int wanted_slot_id, 417 417 const char *wanted_token_label, … … 450 450 } 451 451 452 /* 452 /* 453 453 * This function will search the slot list to find a slot based on the slot 454 454 * label. If the wanted_slot_label is "none", then we will return the first 455 455 * slot with the token presented. 456 * 456 * 457 457 * This function return 0 if it found a matching slot; otherwise, it returns 458 458 * -1. … … 481 481 482 482 slot = PK11_ReferenceSlot(module->slots[i]); 483 slot_label = PK11_GetSlotName(slot); 483 slot_label = PK11_GetSlotName(slot); 484 484 if (memcmp_pad_max((void *)slot_label, strlen(slot_label), 485 485 (void *)wanted_slot_label, strlen(wanted_slot_label), 64) == 0) { … … 509 509 return (-1); 510 510 511 if (wanted_token_label == NULL){ 511 if (wanted_token_label == NULL){ 512 512 rv = find_slot_by_slotlabel(h, wanted_slot_label, slot_num); 513 513 return (rv); … … 515 515 516 516 /* wanted_token_label != NULL */ 517 if (strcmp(wanted_slot_label, "none") == 0) { 517 if (strcmp(wanted_slot_label, "none") == 0) { 518 518 for (i = 0; i < module->slotCount; i++) { 519 519 if (module->slots[i] && PK11_IsPresent(module->slots[i])) { … … 554 554 } 555 555 556 int wait_for_token_by_slotlabel(pkcs11_handle_t *h, 556 int wait_for_token_by_slotlabel(pkcs11_handle_t *h, 557 557 const char *wanted_slot_label, 558 558 const char *wanted_token_label, … … 566 566 rv = find_slot_by_slotlabel_and_tokenlabel (h, wanted_slot_label, 567 567 wanted_token_label, slot_num); 568 568 569 569 if (rv != 0) { 570 570 PK11SlotInfo *slot; … … 593 593 594 594 595 void release_pkcs11_module(pkcs11_handle_t *h) 595 void release_pkcs11_module(pkcs11_handle_t *h) 596 596 { 597 597 SECStatus rv; … … 715 715 if (rv != SECSuccess) { 716 716 CERT_DestroyCertList(certList); 717 DBG1("Couldn't filter out email certs: %s", 717 DBG1("Couldn't filter out email certs: %s", 718 718 SECU_Strerror(PR_GetError())); 719 719 return NULL; … … 729 729 730 730 /* convert the link list from NSS to the array used by pam_pkcs11 */ 731 for (node = CERT_LIST_HEAD(certList); !CERT_LIST_END(node,certList); 731 for (node = CERT_LIST_HEAD(certList); !CERT_LIST_END(node,certList); 732 732 node = CERT_LIST_NEXT(node)) { 733 733 if (node->cert) { … … 749 749 } 750 750 751 for (node = CERT_LIST_HEAD(certList); !CERT_LIST_END(node,certList); 751 for (node = CERT_LIST_HEAD(certList); !CERT_LIST_END(node,certList); 752 752 node = CERT_LIST_NEXT(node)) { 753 753 if (node->cert) { … … 812 812 } 813 813 814 int get_random_value(unsigned char *data, int length) 814 int get_random_value(unsigned char *data, int length) 815 815 { 816 816 SECStatus rv = PK11_GenerateRandom(data,length); … … 848 848 */ 849 849 const char * 850 SECU_Strerror(PRErrorCode errNum) 850 SECU_Strerror(PRErrorCode errNum) 851 851 { 852 852 PRInt32 low = 0; … … 864 864 num = errStrings[i].errNum; 865 865 if (num <= lastNum) { 866 fprintf(stderr, 866 fprintf(stderr, 867 867 "sequence error in error strings at item %d\n" 868 868 "error %d (%s)\n" 869 869 "should come after \n" 870 870 "error %d (%s)\n", 871 i, lastNum, errStrings[i-1].errString, 871 i, lastNum, errStrings[i-1].errString, 872 872 num, errStrings[i].errString); 873 873 } … … 881 881 i = (low + high) / 2; 882 882 num = errStrings[i].errNum; 883 if (errNum == num) 883 if (errNum == num) 884 884 return errStrings[i].errString; 885 885 if (errNum < num) 886 886 high = i; 887 else 887 else 888 888 low = i; 889 889 } … … 949 949 DBG1("PKCS #11 module = [%s]", module); 950 950 /* reset pkcs #11 handle */ 951 951 952 952 h = (pkcs11_handle_t *)calloc(sizeof(pkcs11_handle_t), 1); 953 953 if (h == NULL) { … … 1049 1049 CK_INFO info; 1050 1050 CK_C_INITIALIZE_ARGS initArgs; 1051 /* 1052 Set up arguments to allow native threads 1051 /* 1052 Set up arguments to allow native threads 1053 1053 According with pkcs#11v2.20, must set all pointers to null 1054 1054 and flags CKF_OS_LOCKING_OK … … 1141 1141 /* zero means find the best slot */ 1142 1142 if (slot_num == 0) { 1143 for (slot_num = 0; slot_num < h->slot_count && 1143 for (slot_num = 0; slot_num < h->slot_count && 1144 1144 !h->slots[slot_num].token_present; slot_num++); 1145 1145 } else { … … 1154 1154 return 0; 1155 1155 } 1156 1157 int find_slot_by_number_and_label(pkcs11_handle_t *h, 1156 1157 int find_slot_by_number_and_label(pkcs11_handle_t *h, 1158 1158 int wanted_slot_id, 1159 1159 const char *wanted_token_label, … … 1176 1176 token_label = h->slots[*slot_num].label; 1177 1177 1178 if ((token_label != NULL) && 1178 if ((token_label != NULL) && 1179 1179 (strcmp (wanted_token_label, token_label) == 0)) { 1180 1180 return 0; … … 1187 1187 if (h->slots[slot_index].token_present) { 1188 1188 token_label = h->slots[slot_index].label; 1189 if ((token_label != NULL) && 1189 if ((token_label != NULL) && 1190 1190 (strcmp (wanted_token_label, token_label) == 0)) { 1191 1191 *slot_num = slot_index; … … 1198 1198 1199 1199 1200 /* 1200 /* 1201 1201 * This function will search the slot list to find a slot based on the slot 1202 1202 * label. If the wanted_slot_label is "none", then we will return the first 1203 1203 * slot with the token presented. 1204 * 1204 * 1205 1205 * This function return 0 if it found a matching slot; otherwise, it returns 1206 1206 * -1. … … 1257 1257 1258 1258 /* wanted_token_label != NULL */ 1259 if (strcmp(wanted_slot_label, "none") == 0) { 1259 if (strcmp(wanted_slot_label, "none") == 0) { 1260 1260 for (i= 0; i < h->slot_count; i++) { 1261 1261 if (h->slots[i].token_present && … … 1286 1286 } 1287 1287 1288 int wait_for_token_by_slotlabel(pkcs11_handle_t *h, 1288 int wait_for_token_by_slotlabel(pkcs11_handle_t *h, 1289 1289 const char *wanted_slot_label, 1290 1290 const char *wanted_token_label, … … 1309 1309 } 1310 1310 1311 int wait_for_token(pkcs11_handle_t *h, 1311 int wait_for_token(pkcs11_handle_t *h, 1312 1312 int wanted_slot_id, 1313 1313 const char *wanted_token_label, … … 1340 1340 set_error("invalid slot number %d", slot); 1341 1341 return -1; 1342 } 1342 } 1343 1343 /* open a readonly user-session */ 1344 1344 rv = h->fl->C_OpenSession(h->slots[slot].id, CKF_SERIAL_SESSION, NULL, NULL, &h->session); … … 1408 1408 1409 1409 /* get a list of certificates */ 1410 cert_object_t **get_certificate_list(pkcs11_handle_t *h, int *ncerts) 1410 cert_object_t **get_certificate_list(pkcs11_handle_t *h, int *ncerts) 1411 1411 { 1412 1412 CK_BYTE *id_value; … … 1417 1417 cert_object_t **certs = NULL; 1418 1418 int rv; 1419 1419 1420 1420 CK_OBJECT_CLASS cert_class = CKO_CERTIFICATE; 1421 1421 CK_CERTIFICATE_TYPE cert_type = CKC_X_509; … … 1640 1640 } 1641 1641 1642 int sign_value(pkcs11_handle_t *h, cert_object_t *cert, CK_BYTE *data, 1642 int sign_value(pkcs11_handle_t *h, cert_object_t *cert, CK_BYTE *data, 1643 1643 CK_ULONG length, CK_BYTE **signature, CK_ULONG *signature_length) 1644 1644 { … … 1652 1652 set_error("Couldn't find private key for certificate"); 1653 1653 return -1; 1654 } 1654 } 1655 1655 1656 1656 /* set mechanism */ -
trunk/src/common/pkcs11_lib.h
r346 r358 25 25 #ifndef __PKCS11_LIB_C__ 26 26 #define PKCS11_EXTERN extern 27 #else 27 #else 28 28 #define PKCS11_EXTERN 29 29 #endif … … 39 39 PKCS11_EXTERN const char *get_slot_tokenlabel(pkcs11_handle_t *h); 40 40 PKCS11_EXTERN int wait_for_token(pkcs11_handle_t *h, 41 int wanted_slot_num, 41 int wanted_slot_num, 42 42 const char *wanted_token_label, 43 43 unsigned int *slot); … … 50 50 unsigned int *slot); 51 51 PKCS11_EXTERN int wait_for_token_by_slotlabel(pkcs11_handle_t *h, 52 const char *wanted_slot_label, 52 const char *wanted_slot_label, 53 53 const char *wanted_token_label, 54 54 unsigned int *slot); … … 59 59 PKCS11_EXTERN int pkcs11_login(pkcs11_handle_t *h, char *password); 60 60 PKCS11_EXTERN int pkcs11_pass_login(pkcs11_handle_t *h, int nullok); 61 PKCS11_EXTERN cert_object_t **get_certificate_list(pkcs11_handle_t *h, 61 PKCS11_EXTERN cert_object_t **get_certificate_list(pkcs11_handle_t *h, 62 62 int *ncert); 63 63 PKCS11_EXTERN int get_private_key(pkcs11_handle_t *h, cert_object_t *); -
trunk/src/common/rsaref/PKCS11_README
r200 r358 4 4 5 5 License to copy and use this software is granted provided that it is identified 6 as "RSA Security Inc. PKCS #11 Cryptographic Token Interface (Cryptoki)" 7 in all material mentioning or referencing this software or this function. 6 as "RSA Security Inc. PKCS #11 Cryptographic Token Interface (Cryptoki)" 7 in all material mentioning or referencing this software or this function. 8 8 9 9 License is also granted to make and use derivative works provided that such 10 10 works are identified as "derived from the RSA Security Inc. PKCS #11 11 11 Cryptographic Token Interface (Cryptoki)" in all material mentioning or 12 referencing the derived work. 12 referencing the derived work. 13 13 14 14 This software is provided AS IS and RSA Security, Inc. disclaims all warranties -
trunk/src/common/rsaref/pkcs11.h
r233 r358 42 42 * License is also granted to make and use derivative works provided that 43 43 * such works are identified as "derived from the RSA Security Inc. PKCS #11 44 * Cryptographic Token Interface (Cryptoki)" in all material mentioning or 44 * Cryptographic Token Interface (Cryptoki)" in all material mentioning or 45 45 * referencing the derived work. 46 46 47 * RSA Security Inc. makes no representations concerning either the 47 * RSA Security Inc. makes no representations concerning either the 48 48 * merchantability of this software or the suitability of this software for 49 49 * any particular purpose. It is provided "as is" without express or implied -
trunk/src/common/rsaref/pkcs11f.h
r199 r358 8 8 * License is also granted to make and use derivative works provided that 9 9 * such works are identified as "derived from the RSA Security Inc. PKCS #11 10 * Cryptographic Token Interface (Cryptoki)" in all material mentioning or 10 * Cryptographic Token Interface (Cryptoki)" in all material mentioning or 11 11 * referencing the derived work. 12 12 13 * RSA Security Inc. makes no representations concerning either the 13 * RSA Security Inc. makes no representations concerning either the 14 14 * merchantability of this software or the suitability of this software for 15 15 * any particular purpose. It is provided "as is" without express or implied … … 521 521 522 522 /* C_SignUpdate continues a multiple-part signature operation, 523 * where the signature is (will be) an appendix to the data, 523 * where the signature is (will be) an appendix to the data, 524 524 * and plaintext cannot be recovered from the signature. */ 525 525 CK_PKCS11_FUNCTION_INFO(C_SignUpdate) … … 532 532 533 533 534 /* C_SignFinal finishes a multiple-part signature operation, 534 /* C_SignFinal finishes a multiple-part signature operation, 535 535 * returning the signature. */ 536 536 CK_PKCS11_FUNCTION_INFO(C_SignFinal) … … 582 582 583 583 584 /* C_Verify verifies a signature in a single-part operation, 584 /* C_Verify verifies a signature in a single-part operation, 585 585 * where the signature is an appendix to the data, and plaintext 586 586 * cannot be recovered from the signature. */ … … 597 597 598 598 /* C_VerifyUpdate continues a multiple-part verification 599 * operation, where the signature is an appendix to the data, 599 * operation, where the signature is an appendix to the data, 600 600 * and plaintext cannot be recovered from the signature. */ 601 601 CK_PKCS11_FUNCTION_INFO(C_VerifyUpdate) … … 714 714 715 715 716 /* C_GenerateKeyPair generates a public-key/private-key pair, 716 /* C_GenerateKeyPair generates a public-key/private-key pair, 717 717 * creating new key objects. */ 718 718 CK_PKCS11_FUNCTION_INFO(C_GenerateKeyPair) -
trunk/src/common/rsaref/pkcs11t.h
r199 r358 8 8 * License is also granted to make and use derivative works provided that 9 9 * such works are identified as "derived from the RSA Security Inc. PKCS #11 10 * Cryptographic Token Interface (Cryptoki)" in all material mentioning or 10 * Cryptographic Token Interface (Cryptoki)" in all material mentioning or 11 11 * referencing the derived work. 12 12 13 * RSA Security Inc. makes no representations concerning either the 13 * RSA Security Inc. makes no representations concerning either the 14 14 * merchantability of this software or the suitability of this software for 15 15 * any particular purpose. It is provided "as is" without express or implied … … 171 171 172 172 /* The flags parameter is defined as follows: 173 * Bit Flag Mask Meaning 173 * Bit Flag Mask Meaning 174 174 */ 175 175 #define CKF_RNG 0x00000001 /* has random # … … 207 207 208 208 /* CKF_TOKEN_INITIALIZED if new for v2.10. If it is true, the 209 * token has been initialized using C_InitializeToken or an 209 * token has been initialized using C_InitializeToken or an 210 210 * equivalent mechanism outside the scope of PKCS #11. 211 * Calling C_InitializeToken when this flag is set will cause 211 * Calling C_InitializeToken when this flag is set will cause 212 212 * the token to be reinitialized. */ 213 213 #define CKF_TOKEN_INITIALIZED 0x00000400 214 214 215 /* CKF_SECONDARY_AUTHENTICATION if new for v2.10. If it is 216 * true, the token supports secondary authentication for 215 /* CKF_SECONDARY_AUTHENTICATION if new for v2.10. If it is 216 * true, the token supports secondary authentication for 217 217 * private key objects. */ 218 218 #define CKF_SECONDARY_AUTHENTICATION 0x00000800 219 219 220 /* CKF_USER_PIN_COUNT_LOW if new for v2.10. If it is true, an 221 * incorrect user login PIN has been entered at least once 220 /* CKF_USER_PIN_COUNT_LOW if new for v2.10. If it is true, an 221 * incorrect user login PIN has been entered at least once 222 222 * since the last successful authentication. */ 223 223 #define CKF_USER_PIN_COUNT_LOW 0x00010000 … … 227 227 #define CKF_USER_PIN_FINAL_TRY 0x00020000 228 228 229 /* CKF_USER_PIN_LOCKED if new for v2.10. If it is true, the 230 * user PIN has been locked. User login to the token is not 229 /* CKF_USER_PIN_LOCKED if new for v2.10. If it is true, the 230 * user PIN has been locked. User login to the token is not 231 231 * possible. */ 232 232 #define CKF_USER_PIN_LOCKED 0x00040000 233 233 234 /* CKF_USER_PIN_TO_BE_CHANGED if new for v2.10. If it is true, 235 * the user PIN value is the default value set by token 234 /* CKF_USER_PIN_TO_BE_CHANGED if new for v2.10. If it is true, 235 * the user PIN value is the default value set by token 236 236 * initialization or manufacturing, or the PIN has been 237 237 * expired by the card. */ 238 238 #define CKF_USER_PIN_TO_BE_CHANGED 0x00080000 239 239 240 /* CKF_SO_PIN_COUNT_LOW if new for v2.10. If it is true, an 241 * incorrect SO login PIN has been entered at least once since 240 /* CKF_SO_PIN_COUNT_LOW if new for v2.10. If it is true, an 241 * incorrect SO login PIN has been entered at least once since 242 242 * the last successful authentication. */ 243 243 #define CKF_SO_PIN_COUNT_LOW 0x00100000 … … 247 247 #define CKF_SO_PIN_FINAL_TRY 0x00200000 248 248 249 /* CKF_SO_PIN_LOCKED if new for v2.10. If it is true, the SO 249 /* CKF_SO_PIN_LOCKED if new for v2.10. If it is true, the SO 250 250 * PIN has been locked. SO login to the token is not possible. 251 251 */ 252 252 #define CKF_SO_PIN_LOCKED 0x00400000 253 253 254 /* CKF_SO_PIN_TO_BE_CHANGED if new for v2.10. If it is true, 255 * the SO PIN value is the default value set by token 254 /* CKF_SO_PIN_TO_BE_CHANGED if new for v2.10. If it is true, 255 * the SO PIN value is the default value set by token 256 256 * initialization or manufacturing, or the PIN has been 257 257 * expired by the card. */ … … 421 421 #define CKA_SERIAL_NUMBER 0x00000082 422 422 423 /* CKA_AC_ISSUER, CKA_OWNER, and CKA_ATTR_TYPES are new 423 /* CKA_AC_ISSUER, CKA_OWNER, and CKA_ATTR_TYPES are new 424 424 * for v2.10 */ 425 425 #define CKA_AC_ISSUER 0x00000083 … … 487 487 #define CKA_EC_POINT 0x00000181 488 488 489 /* CKA_SECONDARY_AUTH, CKA_AUTH_PIN_FLAGS, 489 /* CKA_SECONDARY_AUTH, CKA_AUTH_PIN_FLAGS, 490 490 * CKA_HW_FEATURE_TYPE, CKA_RESET_ON_INIT, and CKA_HAS_RESET 491 491 * are new for v2.10 */ … … 622 622 #define CKM_SHA_1_HMAC_GENERAL 0x00000222 623 623 624 /* CKM_RIPEMD128, CKM_RIPEMD128_HMAC, 624 /* CKM_RIPEMD128, CKM_RIPEMD128_HMAC, 625 625 * CKM_RIPEMD128_HMAC_GENERAL, CKM_RIPEMD160, CKM_RIPEMD160_HMAC, 626 626 * and CKM_RIPEMD160_HMAC_GENERAL are new for v2.10 */ … … 1040 1040 #define CKF_DONT_BLOCK 1 1041 1041 1042 /* CK_RSA_PKCS_OAEP_MGF_TYPE is new for v2.10. 1043 * CK_RSA_PKCS_OAEP_MGF_TYPE is used to indicate the Message 1044 * Generation Function (MGF) applied to a message block when 1045 * formatting a message block for the PKCS #1 OAEP encryption 1042 /* CK_RSA_PKCS_OAEP_MGF_TYPE is new for v2.10. 1043 * CK_RSA_PKCS_OAEP_MGF_TYPE is used to indicate the Message 1044 * Generation Function (MGF) applied to a message block when 1045 * formatting a message block for the PKCS #1 OAEP encryption 1046 1046 * scheme. */ 1047 1047 typedef CK_ULONG CK_RSA_PKCS_MGF_TYPE; … … 1052 1052 #define CKG_MGF1_SHA1 0x00000001 1053 1053 1054 /* CK_RSA_PKCS_OAEP_SOURCE_TYPE is new for v2.10. 1054 /* CK_RSA_PKCS_OAEP_SOURCE_TYPE is new for v2.10. 1055 1055 * CK_RSA_PKCS_OAEP_SOURCE_TYPE is used to indicate the source 1056 * of the encoding parameter when formatting a message block 1056 * of the encoding parameter when formatting a message block 1057 1057 * for the PKCS #1 OAEP encryption scheme. */ 1058 1058 typedef CK_ULONG CK_RSA_PKCS_OAEP_SOURCE_TYPE; … … 1064 1064 1065 1065 /* CK_RSA_PKCS_OAEP_PARAMS is new for v2.10. 1066 * CK_RSA_PKCS_OAEP_PARAMS provides the parameters to the 1066 * CK_RSA_PKCS_OAEP_PARAMS provides the parameters to the 1067 1067 * CKM_RSA_PKCS_OAEP mechanism. */ 1068 1068 typedef struct CK_RSA_PKCS_OAEP_PARAMS { … … 1127 1127 typedef CK_ECDH2_DERIVE_PARAMS CK_PTR CK_ECDH2_DERIVE_PARAMS_PTR; 1128 1128 1129 /* Typedefs and defines for the CKM_X9_42_DH_KEY_PAIR_GEN and the 1129 /* Typedefs and defines for the CKM_X9_42_DH_KEY_PAIR_GEN and the 1130 1130 * CKM_X9_42_DH_PARAMETER_GEN mechanisms (new for PKCS #11 v2.11) */ 1131 1131 typedef CK_ULONG CK_X9_42_DH_KDF_TYPE; … … 1138 1138 1139 1139 /* CK_X9_42_DH1_DERIVE_PARAMS is new for v2.11. 1140 * CK_X9_42_DH1_DERIVE_PARAMS provides the parameters to the 1140 * CK_X9_42_DH1_DERIVE_PARAMS provides the parameters to the 1141 1141 * CKM_X9_42_DH_DERIVE key derivation mechanism, where each party 1142 1142 * contributes one key pair */ … … 1152 1152 1153 1153 /* CK_X9_42_DH2_DERIVE_PARAMS is new for v2.11. 1154 * CK_X9_42_DH2_DERIVE_PARAMS provides the parameters to the 1154 * CK_X9_42_DH2_DERIVE_PARAMS provides the parameters to the 1155 1155 * CKM_X9_42_DH_HYBRID_DERIVE and CKM_X9_42_MQV_DERIVE key derivation 1156 1156 * mechanisms, where each party contributes two key pairs */ … … 1386 1386 1387 1387 /* CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE is new for v2.10. 1388 * CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE is used to 1389 * indicate the Pseudo-Random Function (PRF) used to generate 1388 * CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE is used to 1389 * indicate the Pseudo-Random Function (PRF) used to generate 1390 1390 * key bits using PKCS #5 PBKDF2. */ 1391 1391 typedef CK_ULONG CK_PKCS5_PBKD2_PSEUDO_RANDOM_FUNCTION_TYPE; … … 1399 1399 1400 1400 /* CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE is new for v2.10. 1401 * CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE is used to indicate the 1402 * source of the salt value when deriving a key using PKCS #5 1401 * CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE is used to indicate the 1402 * source of the salt value when deriving a key using PKCS #5 1403 1403 * PBKDF2. */ 1404 1404 typedef CK_ULONG CK_PKCS5_PBKDF2_SALT_SOURCE_TYPE; … … 1410 1410 1411 1411 /* CK_PKCS5_PBKD2_PARAMS is new for v2.10. 1412 * CK_PKCS5_PBKD2_PARAMS is a structure that provides the 1412 * CK_PKCS5_PBKD2_PARAMS is a structure that provides the 1413 1413 * parameters to the CKM_PKCS5_PBKD2 mechanism. */ 1414 1414 typedef struct CK_PKCS5_PBKD2_PARAMS { -
trunk/src/common/secutil.h
r244 r358 69 69 70 70 #ifdef SECUTIL_NEW 71 typedef int (*SECU_PPFunc)(PRFileDesc *out, SECItem *item, 71 typedef int (*SECU_PPFunc)(PRFileDesc *out, SECItem *item, 72 72 char *msg, int level); 73 73 #else … … 102 102 103 103 /* 104 ** Blind check of a password. Complement to SEC_CheckPassword which 104 ** Blind check of a password. Complement to SEC_CheckPassword which 105 105 ** ignores length and content type, just retuning DSTrue is the password 106 106 ** exists, DSFalse if NULL … … 144 144 145 145 /* 146 ** Should be called once during initialization to set the default 146 ** Should be called once during initialization to set the default 147 147 ** directory for looking for cert.db, key.db, and cert-nameidx.db files 148 ** Removes trailing '/' in 'base' 148 ** Removes trailing '/' in 'base' 149 149 ** If 'base' is NULL, defaults to set to .netscape in home directory. 150 150 */ 151 151 extern char *SECU_ConfigDirectory(const char* base); 152 152 153 /* 153 /* 154 154 ** Basic callback function for SSL_GetClientAuthDataHook 155 155 */ … … 171 171 /* print information about cert verification failure */ 172 172 extern void 173 SECU_printCertProblems(FILE *outfile, CERTCertDBHandle *handle, 174 CERTCertificate *cert, PRBool checksig, 173 SECU_printCertProblems(FILE *outfile, CERTCertDBHandle *handle, 174 CERTCertificate *cert, PRBool checksig, 175 175 SECCertificateUsage certUsage, void *pinArg, PRBool verbose); 176 176 … … 180 180 181 181 /* Read in a DER from a file, may be ascii */ 182 extern SECStatus 182 extern SECStatus 183 183 SECU_ReadDERFromFile(SECItem *der, PRFileDesc *inFile, PRBool ascii); 184 184 … … 229 229 /* Dump all certificate nicknames in a database */ 230 230 extern SECStatus 231 SECU_PrintCertificateNames(CERTCertDBHandle *handle, PRFileDesc* out, 231 SECU_PrintCertificateNames(CERTCertDBHandle *handle, PRFileDesc* out, 232 232 PRBool sortByName, PRBool sortByTrust); 233 233 … … 258 258 259 259 /* Pretty-print any PKCS7 thing */ 260 extern int SECU_PrintPKCS7ContentInfo(FILE *out, SECItem *der, char *m, 260 extern int SECU_PrintPKCS7ContentInfo(FILE *out, SECItem *der, char *m, 261 261 int level); 262 262 … … 319 319 ** encodes the result. 320 320 ** "arena" is the memory arena to use to allocate data from 321 ** "sd" returned CERTSignedData 321 ** "sd" returned CERTSignedData 322 322 ** "result" the final der encoded data (memory is allocated) 323 323 ** "buf" the input data to sign … … 365 365 366 366 /* Encodes and adds extensions to the CRL or CRL entries. */ 367 SECStatus 368 SECU_EncodeAndAddExtensionValue(PRArenaPool *arena, void *extHandle, 369 void *value, PRBool criticality, int extenType, 367 SECStatus 368 SECU_EncodeAndAddExtensionValue(PRArenaPool *arena, void *extHandle, 369 void *value, PRBool criticality, int extenType, 370 370 EXTEN_EXT_VALUE_ENCODER EncodeValueFn); 371 371 … … 373 373 /* 374 374 * 375 * Utilities for parsing security tools command lines 375 * Utilities for parsing security tools command lines 376 376 * 377 377 */ … … 396 396 397 397 /* fill the "arg" and "activated" fields for each flag */ 398 SECStatus 398 SECStatus 399 399 SECU_ParseCommandLine(int argc, char **argv, char *progName, secuCommand *cmd); 400 400 char * -
trunk/src/common/strings.h
r233 r358 84 84 85 85 /** 86 * Convert a colon-separated hexadecimal data into a byte array, 86 * Convert a colon-separated hexadecimal data into a byte array, 87 87 * store result into a previously allocated space 88 88 *@param str String to be parsed … … 108 108 * using dest as pre-allocated destination memory for the resulting array 109 109 * 110 * To free() memory used by this call, just call free result pointer 110 * To free() memory used by this call, just call free result pointer 111 111 *@param str String to be parsed 112 112 *@param sep Character to be used as separator … … 118 118 119 119 /** 120 * Remove all extra spaces from a string. 120 * Remove all extra spaces from a string. 121 121 * a char is considered space if trues isspace() 122 122 * -
trunk/src/common/uri.c
r264 r358 27 27 #include "strings.h" 28 28 29 static const char *valid_urls[]= 29 static const char *valid_urls[]= 30 30 {"file:///","http://","https://","ftp://","ldap://",NULL}; 31 /* 32 comodity functions 31 /* 32 comodity functions 33 33 Analize provided pathname and check type 34 34 Returns 1 on true, 0 on false, -1 on error -
trunk/src/mappers/cn_mapper.c
r238 r358 42 42 /* 43 43 * This mapper uses the common name (CN) entry on the certificate to 44 * find user name. 44 * find user name. 45 45 * When a mapfile is specified, try to map CN entry to a user login 46 46 */ -
trunk/src/mappers/cn_mapper.h
r233 r358 43 43 /* end of static (if any) declarations */ 44 44 #endif 45 45 46 46 /* End of cn_mapper.h */ 47 47 #endif -
trunk/src/mappers/digest_mapper.c
r256 r358 110 110 mapper_module *pt; 111 111 const char *hash_alg_string = NULL; 112 if (blk) { 112 if (blk) { 113 113 debug = scconf_get_bool( blk,"debug",0); 114 114 hash_alg_string = scconf_get_str( blk,"algorithm","sha1"); -
trunk/src/mappers/digest_mapper.h
r233 r358 43 43 /* end of static (if any) declarations */ 44 44 #endif 45 45 46 46 /* End of digest_mapper.h */ 47 47 #endif -
trunk/src/mappers/generic_mapper.c
r257 r358 52 52 return NULL; 53 53 } 54 return cert_info(x509, id_type, ALGORITHM_NULL); 54 return cert_info(x509, id_type, ALGORITHM_NULL); 55 55 } 56 56 … … 131 131 DBG2("Trying to match generic_mapped entry '%s' with login '%s'",str,login); 132 132 if (ignorecase) { 133 if (! strcasecmp(str,login) ) return 1; 133 if (! strcasecmp(str,login) ) return 1; 134 134 } else { 135 if (! strcmp(str,login) ) return 1; 135 if (! strcmp(str,login) ) return 1; 136 136 } 137 137 } … … 167 167 mapper_module *pt; 168 168 const char *item="cn"; 169 if (blk) { 169 if (blk) { 170 170 debug = scconf_get_bool( blk,"debug",0); 171 171 ignorecase = scconf_get_bool( blk,"ignorecase",0); … … 173 173 mapfile= scconf_get_str(blk,"mapfile",mapfile); 174 174 item= scconf_get_str(blk,"cert_item","cn"); 175 } else { 175 } else { 176 176 /* should not occurs, but... */ 177 177 DBG1("No block declaration for mapper '%s'",name); -
trunk/src/mappers/generic_mapper.h
r233 r358 43 43 /* end of static (if any) declarations */ 44 44 #endif 45 45 46 46 /* End of generic_mapper.h */ 47 47 #endif -
trunk/src/mappers/krb_mapper.c
r238 r358 37 37 38 38 /* 39 * This mapper uses (if available) the optional Kerberos Principal Name 39 * This mapper uses (if available) the optional Kerberos Principal Name 40 40 * entry on the certificate to find user name. 41 41 */ -
trunk/src/mappers/krb_mapper.h
r233 r358 43 43 /* end of static (if any) declarations */ 44 44 #endif 45 45 46 46 /* End of krb_mapper.h */ 47 47 #endif -
trunk/src/mappers/ldap_mapper.c
r357 r358 64 64 65 65 /* 66 * TODO: 66 * TODO: 67 67 * - Support for SASL-AUTH not included yet, I can't test it 68 * 68 * 69 69 * - ldap_unbind (*ld) crash if you connect to a SSL port but have set TLS intead SSL 70 70 * - no idea why!? 71 71 * - you got no error-massage from your application 72 72 * - believe skip ldap_unbind (*ld) for a bind handle isn't a good solution 73 * 73 * 74 74 * - implement searchtimeout 75 75 * - implement ignorecase … … 88 88 #ifndef LDAPS_PORT 89 89 #define LDAPS_PORT 636 90 #endif 90 #endif 91 91 92 92 … … 117 117 static int tls_checkpeer=-1; 118 118 static const char *tls_ciphers=""; 119 static const char *tls_cert=""; 119 static const char *tls_cert=""; 120 120 static const char *tls_key=""; 121 121 #endif 122 122 123 static int ldapVersion = 3; 123 static int ldapVersion = 3; 124 124 #ifdef HAVE_LDAP_SET_OPTION 125 125 static int timeout = 8; /* 8 seconds */ … … 128 128 129 129 static const int sscope[] = { 130 LDAP_SCOPE_BASE, 131 LDAP_SCOPE_ONELEVEL, 130 LDAP_SCOPE_BASE, 131 LDAP_SCOPE_ONELEVEL, 132 132 LDAP_SCOPE_SUBTREE}; 133 133 … … 141 141 char uribuf[512]; 142 142 char *p; 143 143 144 144 DBG("do_init():"); 145 145 … … 174 174 { 175 175 size_t urilen = (p - uri); 176 176 177 177 if (urilen >= sizeof (uribuf)) 178 178 { 179 179 return LDAP_UNAVAILABLE; 180 180 } 181 181 182 182 memcpy (uribuf, uri, urilen); 183 183 uribuf[urilen] = '\0'; 184 184 185 185 ldapdefport = atoi (p + 1); 186 186 uri = uribuf; … … 205 205 206 206 #if defined HAVE_LDAP_START_TLS_S || (defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS)) 207 /* 207 /* 208 208 * Set the ssl option 209 209 */ … … 280 280 if (strncmp(tls_cert,"",1)) 281 281 { 282 rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CERTFILE, 282 rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_CERTFILE, 283 283 tls_cert); 284 284 if (rc != LDAP_SUCCESS) … … 292 292 if (strncmp(tls_key,"",1)) 293 293 { 294 rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_KEYFILE, 294 rc = ldap_set_option (NULL, LDAP_OPT_X_TLS_KEYFILE, 295 295 tls_key); 296 296 if (rc != LDAP_SUCCESS) … … 314 314 315 315 /* 316 * set timelimit in ld for select() call in ldap_pvt_connect() 316 * set timelimit in ld for select() call in ldap_pvt_connect() 317 317 * function implemented in libldap2's os-ip.c 318 318 */ … … 322 322 DBG2("do_bind(): bind DN=\"%s\" pass=\"%s\"",binddn,passwd); 323 323 324 /* LDAPv3 doesn't need bind at all, 324 /* LDAPv3 doesn't need bind at all, 325 325 * nevertheless, if no binddn is given than bind anonymous */ 326 326 if ( ! strncmp(binddn,"",1) ) { … … 333 333 { 334 334 DBG("do_bind: rv < 0"); 335 335 336 336 #if defined(HAVE_LDAP_GET_OPTION) && defined(LDAP_OPT_ERROR_NUMBER) 337 337 if (ldap_get_option (ldap_connection, LDAP_OPT_ERROR_NUMBER, &rc) != … … 362 362 { 363 363 DBG("do_bind rc=0"); 364 364 365 365 ldap_abandon (ldap_connection, rv); 366 366 } … … 376 376 static int do_open (LDAP **ld, const char* uri, int defport, ldap_ssl_options_t ssl_on_local) 377 377 { 378 379 #if defined(LDAP_OPT_NETWORK_TIMEOUT) || defined(HAVE_LDAP_START_TLS) 378 379 #if defined(LDAP_OPT_NETWORK_TIMEOUT) || defined(HAVE_LDAP_START_TLS) 380 380 struct timeval tv; 381 381 #endif … … 384 384 LDAPMessage *res = NULL; 385 385 int msgid; 386 #endif 386 #endif 387 387 int rc; 388 388 389 389 rc = do_init (ld, uri, defport); 390 390 391 391 if (rc != LDAP_SUCCESS) 392 392 { … … 533 533 return LDAP_UNAVAILABLE; 534 534 } 535 #endif 535 #endif 536 536 } 537 537 538 538 rc = do_bind (*ld, bind_timelimit); 539 539 if (rc != LDAP_SUCCESS) … … 619 619 620 620 /* Put the login to the %s in Filterstring */ 621 snprintf(filter_str, sizeof(filter_str), filter, login); 621 snprintf(filter_str, sizeof(filter_str), filter, login); 622 622 623 623 DBG1("ldap_get_certificate(): filter_str = %s", filter_str); 624 624 625 625 /* parse and split URI config entry */ 626 626 buffer = uribuf; … … 637 637 if (q != NULL) 638 638 *q = '\0'; 639 639 640 640 if( strlen(p) > 1 ) /* SAW: don't add spaces */ 641 641 rv = ldap_add_uri (uris, p, &buffer, &buflen); 642 642 643 643 p = (q != NULL) ? ++q : NULL; 644 644 645 645 if (rv) 646 646 break; … … 663 663 { 664 664 /* No port specified in URI and non-default port specified */ 665 snprintf (uri, sizeof (uri), "%s%s:%d", 665 snprintf (uri, sizeof (uri), "%s%s:%d", 666 666 ssl_on == SSL_LDAPS ? "ldaps://" : "ldap://", 667 667 ldaphost, ldapport); … … 674 674 return(-1); 675 675 } 676 676 677 677 /* Attempt to connect to specified URI in order until do_open succeed */ 678 678 start_uri = current_uri; … … 686 686 break; 687 687 current_uri++; 688 688 689 689 if (uris[current_uri] == NULL) 690 690 current_uri = 0; 691 691 } 692 692 while (current_uri != start_uri); 693 693 694 694 if( rv != LDAP_SUCCESS ) 695 695 { … … 706 706 707 707 rv = ldap_search_s( 708 ldap_connection, 709 base, 710 sscope[scope], 711 filter_str, 712 attrs, 713 0, 708 ldap_connection, 709 base, 710 sscope[scope], 711 filter_str, 712 attrs, 713 0, 714 714 &res); 715 715 if ( rv != LDAP_SUCCESS ) { … … 722 722 723 723 if( entries > 1 ) { 724 DBG("! Warning, more than one entry found. Please choose \"filter\" and"); 724 DBG("! Warning, more than one entry found. Please choose \"filter\" and"); 725 725 DBG("! \"attribute\" in ldap mapper config section of your config,"); 726 726 DBG("! that only one entry with one attribute is matched"); … … 728 728 DBG("! entries in your LDAP server."); 729 729 } 730 731 /* Only first entry is used. "filter" and "attribute" 730 731 /* Only first entry is used. "filter" and "attribute" 732 732 * should be choosen, so that only one entry with 733 733 * one attribute is returned */ … … 750 750 751 751 DBG1("number of user certificates = %d", certcnt); 752 752 753 753 ldap_x509 = malloc(sizeof(X509*) * certcnt ); 754 754 if (NULL == ldap_x509) … … 757 757 return(-7); 758 758 } 759 759 760 760 rv = 0; 761 761 while(rv < certcnt ) … … 766 766 if (NULL == ldap_x509[rv]) { 767 767 DBG1("d2i_X509() failed for certificate %d", rv); 768 free(ldap_x509); 768 free(ldap_x509); 769 769 certcnt=0; 770 770 ldap_msgfree(res); … … 807 807 808 808 ssltls = scconf_get_str(blk,"ssl","off"); 809 if (! strncasecmp (ssltls, "tls", 3)) 809 if (! strncasecmp (ssltls, "tls", 3)) 810 810 ssl_on = SSL_START_TLS; 811 811 else if( ! strncasecmp (ssltls, "on", 2)) … … 813 813 else if( ! strncasecmp (ssltls, "ssl", 3)) 814 814 ssl_on = SSL_LDAPS; 815 815 816 816 #if defined HAVE_LDAP_START_TLS_S || (defined(HAVE_LDAP_SET_OPTION) && defined(LDAP_OPT_X_TLS)) 817 817 /* TLS specific options */ … … 821 821 tls_checkpeer=scconf_get_int(blk,"tls_checkpeer",tls_checkpeer); 822 822 tls_ciphers = scconf_get_str(blk,"tls_ciphers",tls_ciphers); 823 tls_cert = scconf_get_str(blk,"tls_cert",tls_cert); 823 tls_cert = scconf_get_str(blk,"tls_cert",tls_cert); 824 824 tls_key = scconf_get_str(blk,"tls_key",tls_key); 825 825 #endif … … 849 849 DBG1("tls_checkpeer = %d", tls_checkpeer); 850 850 DBG1("tls_ciphers = %s", tls_ciphers); 851 DBG1("tls_cert = %s", tls_cert); 852 DBG1("tls_key = %s", tls_key); 851 DBG1("tls_cert = %s", tls_cert); 852 DBG1("tls_key = %s", tls_key); 853 853 #endif 854 854 return 1; … … 884 884 DBG1("Certificate %d is matching", i); 885 885 match_found = 1; 886 } else { 886 } else { 887 887 DBG1("Certificate %d is NOT matching", i); 888 888 } 889 889 i++; 890 890 } 891 if (certcnt) 891 if (certcnt) 892 892 free(ldap_x509); 893 893 certcnt=0; … … 915 915 916 916 #ifdef false 917 int res; 917 int res; 918 918 res= ldap_mapper_match_user(x509,"wefel",context); 919 919 if (res) { … … 924 924 } 925 925 #endif 926 926 927 927 return found; 928 928 } -
trunk/src/mappers/ldap_mapper.h
r233 r358 43 43 /* end of static (if any) declarations */ 44 44 #endif 45 45 46 46 /* End of ldap_mapper.h */ 47 47 #endif -
trunk/src/mappers/mail_mapper.c
r265 r358 38 38 39 39 /* 40 * This mapper uses (if available) the optional email entry on the certificate 40 * This mapper uses (if available) the optional email entry on the certificate 41 41 * to find user name. 42 42 */ -
trunk/src/mappers/mail_mapper.h
r233 r358 43 43 /* end of static (if any) declarations */ 44 44 #endif 45 45 46 46 /* End of mail_mapper.h */ 47 47 #endif -
trunk/src/mappers/mapper.c
r233 r358 47 47 * load url and store into mapfile 48 48 * returns struct or NULL on error 49 */ 49 */ 50 50 struct mapfile *set_mapent(const char *url) { 51 51 int res; … … 127 127 if (!mfile) return; 128 128 /* don't free uri: is a scconf provided "const char *" */; 129 /* free (mfile->uri); */ 129 /* free (mfile->uri); */ 130 130 /* don't free key/value: they are pointers to somewhere in buffer */ 131 131 /* free (mfile->value); */ -
trunk/src/mappers/mapper.h
r238 r358 36 36 37 37 /** 38 * Structure to be filled on mapper module initialization 38 * Structure to be filled on mapper module initialization 39 39 */ 40 40 typedef struct mapper_module_st { 41 41 /** mapper name */ 42 const char *name; 42 const char *name; 43 43 /** mapper configuration block */ 44 scconf_block *block; 44 scconf_block *block; 45 45 /** debug level to set before call entry points */ 46 int dbg_level; 46 int dbg_level; 47 47 /** pointer to mapper local data */ 48 void *context; 48 void *context; 49 49 /** cert. entries enumerator */ 50 char **(*entries)(X509 *x509, void *context); 50 char **(*entries)(X509 *x509, void *context); 51 51 /** cert. login finder */ 52 char *(*finder)(X509 *x509, void *context); 52 char *(*finder)(X509 *x509, void *context); 53 53 /** cert-to-login matcher*/ 54 int (*matcher)(X509 *x509, const char *login, void *context); 54 int (*matcher)(X509 *x509, const char *login, void *context); 55 55 /** module de-initialization */ 56 void (*deinit)( void *context); 56 void (*deinit)( void *context); 57 57 } mapper_module; 58 58 … … 65 65 const char *uri; 66 66 /** buffer to content of mapfile */ 67 char *buffer; 67 char *buffer; 68 68 /** lenght of buffer */ 69 size_t length; 69 size_t length; 70 70 /** pointer to last readed entry in buffer */ 71 char *pt; 71 char *pt; 72 72 /** key entry in current buffer */ 73 char *key; 73 char *key; 74 74 /** value assigned to key */ 75 char *value; 75 char *value; 76 76 }; 77 77 … … 124 124 * Try to map "key" to provided mapfile 125 125 *@param file URL of map file 126 *@param key String to be mapped 126 *@param key String to be mapped 127 127 *@param ignorecase Flag to indicate upper/lowercase ignore in string compare 128 128 *@return key on no match, else a clone_str()'d of found mapping … … 182 182 *@param x509 X509 Certificate 183 183 *@param context Mapper context 184 *@return Found user, or NULL 184 *@return Found user, or NULL 185 185 */ 186 186 #define _DEFAULT_MAPPER_FIND_USER \ … … 210 210 } 211 211 212 /** 212 /** 213 213 * Macro for de-initialization routine 214 214 *@param context Mapper context -
trunk/src/mappers/mapperlist.h
r233 r358 41 41 extern mapper_list static_mapper_list[]; 42 42 #endif 43 43 44 44 /* End of mapperlist.h */ 45 45 #endif -
trunk/src/mappers/ms_mapper.c
r338 r358 37 37 38 38 /* 39 * This mapper uses (if available) the optional MS's Universal Principal Name 39 * This mapper uses (if available) the optional MS's Universal Principal Name 40 40 * entry on the certificate to find user name. 41 41 * According with MS documentation, UPN has following structure: … … 43 43 * UPN OtherName: user@domain.com 44 44 * UPN encoding:ASN1 UTF8 45 * 45 * 46 46 * As UPN has in-built login and domain, No mapping file is used: login 47 47 * is implicit. … … 146 146 /* parse list of uids until match */ 147 147 for (str=*entries; str && (match_found==0); str=*++entries) { 148 char *login; 148 char *login; 149 149 if (ignorecase) login= check_upn(tolower_str(str)); 150 150 else login= check_upn(clone_str(str)); -
trunk/src/mappers/ms_mapper.h
r233 r358 43 43 /* end of static (if any) declarations */ 44 44 #endif 45 45 46 46 /* End of ms_mapper.h */ 47 47 #endif -
trunk/src/mappers/null_mapper.h
r233 r358 43 43 /* end of static (if any) declarations */ 44 44 #endif 45 45 46 46 /* End of null_mapper.h */ 47 47 #endif -
trunk/src/mappers/opensc_mapper.c
r350 r358 51 51 /** 52 52 * This mapper try to locate user by comparing authorized certificates 53 * from each $HOME/.eid/authorized_certificates user entry, 53 * from each $HOME/.eid/authorized_certificates user entry, 54 54 * as stored by OpenSC package 55 55 */ -
trunk/src/mappers/opensc_mapper.h
r233 r358 43 43 /* end of static (if any) declarations */ 44 44 #endif 45 45 46 46 /* End of opensc_mapper.h */ 47 47 #endif -
trunk/src/mappers/openssh_mapper.c
r320 r358 53 53 #include "openssh_mapper.h" 54 54 55 /* TODO 55 /* TODO 56 56 Not sure on usage of authorized keys map file... 57 So the first version, will use getpwent() to navigate across all users 57 So the first version, will use getpwent() to navigate across all users 58 58 and parsing ${userhome}/.ssh/authorized_keys 59 59 */ … … 173 173 174 174 /* now: key_from_blob */ 175 if (strncmp((char *)&decoded[i], "ssh-rsa", 7) != 0) return NULL; 175 if (strncmp((char *)&decoded[i], "ssh-rsa", 7) != 0) return NULL; 176 176 i += len; 177 177 … … 317 317 318 318 /* 319 parses the certificate and return the _first_ user that matches public key 319 parses the certificate and return the _first_ user that matches public key 320 320 */ 321 321 static char * openssh_mapper_find_user(X509 *x509, void *context) { -
trunk/src/mappers/openssh_mapper.h
r233 r358 43 43 /* end of static (if any) declarations */ 44 44 #endif 45 45 46 46 /* End of openssh_mapper.h */ 47 47 #endif -
trunk/src/mappers/pwent_mapper.c
r238 r358 41 41 * This mapper search the common name (CN) of the certificate in 42 42 * getpwent() passwd entries by trying to match login or gecos fields 43 * 43 * 44 44 * note: nss implementations use /etc/nsswitch.conf as indicator to 45 45 * where to retrieve pw entries ( see man 5 nsswitch.conf ) … … 98 98 static int pwent_mapper_match_user(X509 *x509, const char *login, void *context) { 99 99 char *str; 100 struct passwd *pw = getpwnam(login); 100 struct passwd *pw = getpwnam(login); 101 101 char **entries = cert_info(x509,CERT_CN,ALGORITHM_NULL); 102 102 if (!entries) { -
trunk/src/mappers/pwent_mapper.h
r233 r358 43 43 /* end of static (if any) declarations */ 44 44 #endif 45 45 46 46 /* End of pwent_mapper.h */ 47 47 #endif -
trunk/src/mappers/subject_mapper.h
r233 r358 43 43 /* end of static (if any) declarations */ 44 44 #endif 45 45 46 46 /* End of subject_mapper.h */ 47 47 #endif -
trunk/src/mappers/uid_mapper.c
r238 r358 38 38 /* 39 39 * This mapper uses the Unique ID (UID) entry on the certificate to 40 * find user name. 40 * find user name. 41 41 */ 42 42 … … 47 47 /** 48 48 * Return the list of UID's on this certificate 49 */ 49 */ 50 50 static char ** uid_mapper_find_entries(X509 *x509, void *context) { 51 51 char **entries= cert_info(x509,CERT_UID,ALGORITHM_NULL); -
trunk/src/mappers/uid_mapper.h
r233 r358 43 43 /* end of static (if any) declarations */ 44 44 #endif 45 45 46 46 /* End of uid_mapper.h */ 47 47 #endif -
trunk/src/pam_pkcs11/mapper_mgr.c
r238 r358 87 87 res->dbg_level=get_debug_level(); 88 88 set_debug_level(old_level); 89 } 89 } 90 90 if ( !mapper_init ) { 91 91 DBG1("Static mapper '%s' not found",name); … … 99 99 return NULL; 100 100 } 101 mapper_init = ( mapper_module * (*)(scconf_block *blk, const char *mapper_name) ) 101 mapper_init = ( mapper_module * (*)(scconf_block *blk, const char *mapper_name) ) 102 102 dlsym(handler,"mapper_module_init"); 103 103 if ( !mapper_init) { … … 131 131 132 132 void unload_module( struct mapper_instance *module ) { 133 if (!module) { 133 if (!module) { 134 134 DBG("Trying to unmap empty module"); 135 135 return; … … 142 142 set_debug_level(old_level); 143 143 } 144 if (module->module_handler) { 144 if (module->module_handler) { 145 145 DBG1("unloading module %s",module->module_name); 146 146 dlclose(module->module_handler); … … 186 186 struct mapper_instance *module = load_module(ctx,name); 187 187 if (module) { 188 struct mapper_listitem *item= 188 struct mapper_listitem *item= 189 189 (struct mapper_listitem *) malloc(sizeof(struct mapper_listitem)); 190 190 if (!item) { … … 201 201 } else { /* insert at end of list */ 202 202 last->next= item; 203 last = item; 203 last = item; 204 204 } 205 205 } … … 244 244 item=item->next; 245 245 continue; 246 } 246 } 247 247 printf("Printing data for mapper %s:\n",item->module->module_name); 248 248 for (str=*data; str; str=*++data) -
trunk/src/pam_pkcs11/mapper_mgr.h
r238 r358 92 92 * This funcions goest throught the mapper list 93 93 * and trying to get the certificate strings to be used on each 94 * module to perform find/match functions. 94 * module to perform find/match functions. 95 95 * No map / match are done: just print found strings on stdout. 96 96 * This function is mostly used in pkcert_view toool -
trunk/src/pam_pkcs11/pam_config.c
r343 r358 114 114 return; 115 115 } 116 configuration.nullok = 116 configuration.nullok = 117 117 scconf_get_bool(root,"nullok",configuration.nullok); 118 configuration.debug = 118 configuration.debug = 119 119 scconf_get_bool(root,"debug",configuration.debug); 120 120 /*if (configuration.debug) set_debug_level(1); 121 121 else set_debug_level(0); */ 122 configuration.use_first_pass = 122 configuration.use_first_pass = 123 123 scconf_get_bool(root,"use_first_pass",configuration.use_first_pass); 124 configuration.try_first_pass = 124 configuration.try_first_pass = 125 125 scconf_get_bool(root,"try_first_pass",configuration.try_first_pass); 126 configuration.use_authok = 126 configuration.use_authok = 127 127 scconf_get_bool(root,"use_authok",configuration.use_authok); 128 configuration.card_only = 128 configuration.card_only = 129 129 scconf_get_bool(root,"card_only",configuration.card_only); 130 configuration.wait_for_card = 130 configuration.wait_for_card = 131 131 scconf_get_bool(root,"wait_for_card",configuration.wait_for_card); 132 132 configuration.pkcs11_module = ( char * ) … … 153 153 scconf_get_str(pkcs11_mblk,"slot_description",configuration.slot_description); 154 154 155 configuration.slot_num = 155 configuration.slot_num = 156 156 scconf_get_int(pkcs11_mblk,"slot_num",configuration.slot_num); 157 157 … … 166 166 } 167 167 168 configuration.support_threads = 168 configuration.support_threads = 169 169 scconf_get_bool(pkcs11_mblk,"support_threads",configuration.support_threads); 170 170 policy_list= scconf_find_list(pkcs11_mblk,"cert_policy"); … … 202 202 for (count=0, tmp=screen_saver_list; tmp ; tmp=tmp->next, count++); 203 203 204 configuration.screen_savers = 204 configuration.screen_savers = 205 205 (char **) malloc((count+1)*sizeof(char *)); 206 206 for (i=0, tmp=screen_saver_list; tmp; tmp=tmp->next, i++) { -
trunk/src/pam_pkcs11/pam_pkcs11.c
r341 r358 103 103 } 104 104 105 static void 105 static void 106 106 pam_syslog(pam_handle_t *pamh, int priority, const char *fmt, ...) 107 107 { … … 222 222 { 223 223 ERR1("Remote login (from %s) is not (yet) supported", display); 224 pam_syslog(pamh, LOG_ERR, 224 pam_syslog(pamh, LOG_ERR, 225 225 "Remote login (from %s) is not (yet) supported", 226 226 display); … … 234 234 textdomain(PACKAGE); 235 235 #endif 236 236 237 237 /* init openssl */ 238 238 rv = crypto_init(&configuration->policy); … … 254 254 * 2) if logged in, block in pam conversation until the token used for login 255 255 * is inserted 256 * 3) if not logged in, block until a token that could be used for logging in 256 * 3) if not logged in, block until a token that could be used for logging in 257 257 * is inserted 258 258 * right now, logged in means PKC11_LOGIN_TOKEN_NAME is set, … … 274 274 275 275 pkcs11_pam_fail = PAM_CRED_INSUFFICIENT; 276 276 277 277 /* look to see if username is already set */ 278 278 rv = pam_get_item(pamh, PAM_USER, (const void **) &user); 279 279 if (user) { 280 280 DBG1("explicit username = [%s]", user); 281 } 281 } 282 282 } else { 283 283 sprintf(password_prompt, … … 289 289 290 290 if (rv != PAM_SUCCESS) { 291 pam_syslog(pamh, LOG_ERR, 291 pam_syslog(pamh, LOG_ERR, 292 292 "pam_get_user() failed %s", pam_strerror(pamh, rv)); 293 293 return PAM_USER_UNKNOWN; … … 420 420 if (rv != PAM_SUCCESS) { 421 421 release_pkcs11_module(ph); 422 pam_syslog(pamh, LOG_ERR, 422 pam_syslog(pamh, LOG_ERR, 423 423 "pam_get_pwd() failed: %s", pam_strerror(pamh, rv)); 424 424 return pkcs11_pam_fail; … … 433 433 memset(password, 0, strlen(password)); 434 434 free(password); 435 pam_syslog(pamh, LOG_ERR, 435 pam_syslog(pamh, LOG_ERR, 436 436 "password length is zero but the 'nullok' argument was not defined."); 437 437 return PAM_AUTH_ERR; 438 438 } 439 439 440 /* call pkcs#11 login to ensure that the user is the real owner of the card 440 /* call pkcs#11 login to ensure that the user is the real owner of the card 441 441 * we need to do thise before get_certificate_list because some tokens 442 442 * can not read their certificates until the token is authenticated */ … … 444 444 /* erase and free in-memory password data asap */ 445 445 memset(password, 0, strlen(password)); 446 free(password); 446 free(password); 447 447 if (rv != 0) { 448 448 ERR1("open_pkcs11_login() failed: %s", get_error()); … … 471 471 if (rv < 0) { 472 472 ERR1("verify_certificate() failed: %s", get_error()); 473 pam_syslog(pamh, LOG_ERR, 473 pam_syslog(pamh, LOG_ERR, 474 474 "verify_certificate() failed: %s", get_error()); 475 475 goto auth_failed_nopw; … … 482 482 483 483 if ( is_spaced_str(user) ) { 484 /* 484 /* 485 485 if provided user is null or empty extract and set user 486 486 name from certificate … … 499 499 if (rv != PAM_SUCCESS) { 500 500 ERR1("pam_set_item() failed %s", pam_strerror(pamh, rv)); 501 pam_syslog(pamh, LOG_ERR, 501 pam_syslog(pamh, LOG_ERR, 502 502 "pam_set_item() failed %s", pam_strerror(pamh, rv)); 503 503 goto auth_failed_nopw; … … 528 528 if (!chosen_cert) { 529 529 ERR("no valid certificate which meets all requirements found"); 530 pam_syslog(pamh, LOG_ERR, 530 pam_syslog(pamh, LOG_ERR, 531 531 "no valid certificate which meets all requirements found"); 532 532 goto auth_failed_nopw; … … 541 541 if (rv != 0) { 542 542 ERR1("get_private_key() failed: %s", get_error()); 543 pam_syslog(pamh, LOG_ERR, 543 pam_syslog(pamh, LOG_ERR, 544 544 "get_private_key() failed: %s", get_error()); 545 545 goto auth_failed_nopw; … … 557 557 /* sign random value */ 558 558 signature = NULL; 559 rv = sign_value(ph, chosen_cert, random_value, sizeof(random_value), 559 rv = sign_value(ph, chosen_cert, random_value, sizeof(random_value), 560 560 &signature, &signature_length); 561 561 if (rv != 0) { … … 588 588 */ 589 589 snprintf(env_temp, sizeof(env_temp) - 1, 590 "PKCS11_LOGIN_TOKEN_NAME=%.*s", 590 "PKCS11_LOGIN_TOKEN_NAME=%.*s", 591 591 (sizeof(env_temp) - 1) - strlen("PKCS11_LOGIN_TOKEN_NAME="), 592 592 get_slot_tokenlabel(ph)); … … 595 595 if (rv != PAM_SUCCESS) { 596 596 ERR1("could not put token name in environment: %s", 597 pam_strerror(pamh, rv)); 597 pam_strerror(pamh, rv)); 598 598 pam_syslog(pamh, LOG_ERR, "could not put token name in environment: %s", 599 pam_strerror(pamh, rv)); 599 pam_strerror(pamh, rv)); 600 600 } 601 601 … … 604 604 if (issuer) { 605 605 snprintf(env_temp, sizeof(env_temp) - 1, 606 "PKCS11_LOGIN_CERT_ISSUER=%.*s", 606 "PKCS11_LOGIN_CERT_ISSUER=%.*s", 607 607 (sizeof(env_temp) - 1) - strlen("PKCS11_LOGIN_CERT_ISSUER="), 608 608 issuer[0]); … … 615 615 if (rv != PAM_SUCCESS) { 616 616 ERR1("could not put cert issuer in environment: %s", 617 pam_strerror(pamh, rv)); 617 pam_strerror(pamh, rv)); 618 618 pam_syslog(pamh, LOG_ERR, "could not put cert issuer in environment: %s", 619 pam_strerror(pamh, rv)); 619 pam_strerror(pamh, rv)); 620 620 } 621 621 … … 624 624 if (serial) { 625 625 snprintf(env_temp, sizeof(env_temp) - 1, 626 "PKCS11_LOGIN_CERT_SERIAL=%.*s", 626 "PKCS11_LOGIN_CERT_SERIAL=%.*s", 627 627 (sizeof(env_temp) - 1) - strlen("PKCS11_LOGIN_CERT_SERIAL="), 628 628 serial[0]); … … 635 635 if (rv != PAM_SUCCESS) { 636 636 ERR1("could not put cert serial in environment: %s", 637 pam_strerror(pamh, rv)); 637 pam_strerror(pamh, rv)); 638 638 pam_syslog(pamh, LOG_ERR, "could not put cert serial in environment: %s", 639 pam_strerror(pamh, rv)); 639 pam_strerror(pamh, rv)); 640 640 } 641 641 … … 677 677 { 678 678 ERR("Warning: Function pm_sm_acct_mgmt() is not implemented in this module"); 679 pam_syslog(pamh, LOG_WARNING, 679 pam_syslog(pamh, LOG_WARNING, 680 680 "Function pm_sm_acct_mgmt() is not implemented in this module"); 681 681 return PAM_SERVICE_ERR; … … 685 685 { 686 686 ERR("Warning: Function pam_sm_open_session() is not implemented in this module"); 687 pam_syslog(pamh, LOG_WARNING, 687 pam_syslog(pamh, LOG_WARNING, 688 688 "Function pm_sm_open_session() is not implemented in this module"); 689 689 return PAM_SERVICE_ERR; … … 693 693 { 694 694 ERR("Warning: Function pam_sm_close_session() is not implemented in this module"); 695 pam_syslog(pamh, LOG_WARNING, 695 pam_syslog(pamh, LOG_WARNING, 696 696 "Function pm_sm_close_session() is not implemented in this module"); 697 697 return PAM_SERVICE_ERR; … … 703 703 704 704 ERR("Warning: Function pam_sm_chauthtok() is not implemented in this module"); 705 pam_syslog(pamh, LOG_WARNING, 705 pam_syslog(pamh, LOG_WARNING, 706 706 "Function pam_sm_chauthtok() is not implemented in this module"); 707 707 -
trunk/src/scconf/README.scconf
r2 r358 19 19 - anything else but data. No locking, no threads etc. 20 20 21 It has heirarchical data blocks, it has lists. 21 It has heirarchical data blocks, it has lists. 22 22 23 23 Similar, but different: … … 217 217 * block has an item with this key. Run the block 218 218 * or blocks found against the rest of this entry 219 * Stop after the first one, unless 220 * SCCONF_ALL_BLOCKS is set in flags 219 * Stop after the first one, unless 220 * SCCONF_ALL_BLOCKS is set in flags 221 221 unsigned int type; 222 222 * SCCONF_CALLBACK … … 227 227 * int depth); 228 228 * run the callback with the block found 229 * 229 * 230 230 * SCCONF_BLOCK 231 231 * param contains a pointer to another entry table … … 270 270 * can be stored 271 271 * 272 * 272 * 273 273 unsigned int flags; 274 274 * SCCONF_PRESENT … … 299 299 300 300 typedef struct _scconf_entry { 301 const char *name; 302 * key value for blocks and items * 301 const char *name; 302 * key value for blocks and items * 303 303 unsigned int type; 304 304 * SCCONF_CALLBACK … … 308 308 * scconf_entry* entry, 309 309 * int depth); 310 * 310 * 311 311 * SCCONF_BLOCK 312 312 * param contains a pointer to another entry table 313 313 * the entry table is added as a block to the 314 314 * current block, with name as the key, and 315 * arg is a list of names 315 * arg is a list of names 316 316 * 317 317 * SCCONF_LIST … … 321 321 * these add key=value pairs to the current 322 322 * block. The value is in parm. 323 * 323 * 324 324 unsigned int flags; 325 325 * SCCONF_PRESENT -
trunk/src/scconf/parse.c
r233 r358 72 72 parser->warnings = 1; 73 73 74 snprintf(parser->emesg, sizeof(parser->emesg), 74 snprintf(parser->emesg, sizeof(parser->emesg), 75 75 "Line %d: missing '%s', ignoring\n", 76 76 parser->line, token); … … 355 355 break; 356 356 default: 357 snprintf(parser->emesg, sizeof(parser->emesg), 357 snprintf(parser->emesg, sizeof(parser->emesg), 358 358 "Line %d: bad token ignoring\n", 359 359 parser->line); -
trunk/src/tools/card_eventmgr.c
r323 r358 129 129 DBG1("No action list for event '%s'",action); 130 130 return 0; 131 } 131 } 132 132 DBG1("Onerror is set to: '%s'",onerrorstr); 133 133 while (actionlist) { … … 136 136 DBG1("Executiong action: '%s'",action_cmd); 137 137 /* 138 there are some security issues on using system() in 138 there are some security issues on using system() in 139 139 setuid/setgid programs. so we will use an alternate function 140 */ 140 */ 141 141 /* res=system(action_cmd); */ 142 142 res = my_system(action_cmd); … … 149 149 case ONERROR_RETURN: return 0; 150 150 case ONERROR_QUIT: thats_all_folks(); 151 exit(0); 151 exit(0); 152 152 default: DBG("Invalid onerror value"); 153 return -1; 153 return -1; 154 154 } 155 155 } … … 347 347 return 1; 348 348 } 349 349 350 350 /* put my self into background if flag is set */ 351 351 if (daemonize) { -
trunk/src/tools/pkcs11_eventmgr.c
r349 r358 84 84 int current_slot; 85 85 }; 86 86 87 87 #endif 88 88 … … 107 107 return; 108 108 } 109 109 110 110 /* release pkcs #11 module */ 111 111 DBG("releasing pkcs #11 module..."); … … 166 166 DBG1("No action list for event '%s'",action); 167 167 return 0; 168 } 168 } 169 169 DBG1("Onerror is set to: '%s'",onerrorstr); 170 170 while (actionlist) { … … 173 173 DBG1("Executiong action: '%s'",action_cmd); 174 174 /* 175 there are some security issues on using system() in 175 there are some security issues on using system() in 176 176 setuid/setgid programs. so we will use an alternate function 177 */ 177 */ 178 178 /* res=system(action_cmd); */ 179 179 res = my_system(action_cmd); … … 186 186 case ONERROR_RETURN: return 0; 187 187 case ONERROR_QUIT: thats_all_folks(); 188 exit(0); 188 exit(0); 189 189 default: DBG("Invalid onerror value"); 190 return -1; 190 return -1; 191 191 } 192 192 } … … 313 313 struct SlotStatusStr *tmp; 314 314 tmp = (struct SlotStatusStr *) 315 realloc(slotStatus, 315 realloc(slotStatus, 316 316 (maxEntries+ENTRY_STEP)*sizeof(struct SlotStatusStr)); 317 317 if (!tmp) { … … 391 391 } 392 392 393 /* acquire the module before we daemonize so we can return an error 393 /* acquire the module before we daemonize so we can return an error 394 394 * to the user if it fails */ 395 395 DBG("loading the module ..."); 396 396 if (pkcs11_module) { 397 397 #define SPEC_TEMPLATE "library=\"%s\" name=\"SmartCard\"" 398 char *moduleSpec = 398 char *moduleSpec = 399 399 (char *)malloc(sizeof(SPEC_TEMPLATE) + strlen(pkcs11_module)); 400 400 if (!moduleSpec) { … … 403 403 } 404 404 sprintf(moduleSpec,SPEC_TEMPLATE, pkcs11_module); 405 DBG2("loading Module explictly, moduleSpec=<%s> module=%s\n", 405 DBG2("loading Module explictly, moduleSpec=<%s> module=%s\n", 406 406 moduleSpec, pkcs11_module); 407 407 module = SECMOD_LoadUserModule(moduleSpec, NULL, 0); … … 415 415 } 416 416 } else { 417 /* no module specified? look for one in the our of NSS's 417 /* no module specified? look for one in the our of NSS's 418 418 * secmod.db */ 419 419 SECMODModuleList *modList = SECMOD_GetDefaultModuleList(); 420 420 421 /* threaded applications should also acquire the 421 /* threaded applications should also acquire the 422 422 * DefaultModuleListLock */ 423 423 DBG("Looking up new module\n"); … … 447 447 #endif 448 448 449 /* 449 /* 450 450 * Wait endlessly for all events in the list of readers 451 451 * We only stop in case of an error … … 457 457 * otherwise it polls by hand*/ 458 458 struct SlotStatusStr *slotStatus; 459 PK11SlotInfo *slot = SECMOD_WaitForAnyTokenEvent(module, 0, 459 PK11SlotInfo *slot = SECMOD_WaitForAnyTokenEvent(module, 0, 460 460 PR_SecondsToInterval(polling_time)); 461 461 … … 475 475 if (series != slotStatus->series) { 476 476 #ifdef notdef 477 /* if one was already present, remove it 477 /* if one was already present, remove it 478 478 * This can happen if you pull the token and insert it 479 479 * before the PK11_IsPresent call above */ … … 542 542 ph->should_finalize = 1; 543 543 544 /* 544 /* 545 545 * Wait endlessly for all events in the list of readers 546 546 * We only stop in case of an error … … 584 584 DBG("Card removed, "); 585 585 execute_event("card_remove"); 586 /* 586 /* 587 587 some pkcs11's fails on reinsert card. To avoid this 588 re-initialize library on card removal 589 */ 588 re-initialize library on card removal 589 */ 590 590 DBG("Re-initialising pkcs #11 module..."); 591 591 rv = ph->fl->C_Finalize(NULL); -
trunk/src/tools/pkcs11_listcerts.c
r332 r358 86 86 if (configuration->slot_description != NULL) { 87 87 rv = find_slot_by_slotlabel(ph,configuration->slot_description, &slot_num); 88 } else { 88 } else { 89 89 rv = find_slot_by_number(ph,configuration->slot_num, &slot_num); 90 90 } … … 124 124 char **name; 125 125 X509 *cert=get_X509_certificate(certs[i]); 126 126 127 127 DBG1("Certificate #%d:", i+1); 128 128 name = cert_info(cert, CERT_SUBJECT, ALGORITHM_NULL); -
trunk/src/tools/pkcs11_setup.c
r320 r358 67 67 char *lstitem = NULL; 68 68 char *next; 69 69 70 70 while (value != NULL) { 71 71 if ((next=strchr(value, ',')) != NULL) { … … 82 82 free(lstitem); 83 83 } 84 84 85 85 item = scconf_item_add(NULL, block, NULL, SCCONF_ITEM_TYPE_VALUE, option, list); 86 86 … … 121 121 for (i=0; pkcs11_blocks[i]; i++) { 122 122 void *libhandle; 123 const char *path = 123 const char *path = 124 124 scconf_get_str(pkcs11_blocks[i], "module", NULL); 125 125 /* check to see if the module exists on the system */ … … 136 136 } 137 137 } 138 138 139 139 result = 0; 140 140 141 bail: 141 bail: 142 142 if (ctx) { 143 143 scconf_free(ctx); … … 169 169 result = 0; 170 170 171 bail: 171 bail: 172 172 if (ctx) { 173 173 scconf_free(ctx); … … 231 231 result = scconf_write(ectx, NULL); 232 232 233 bail: 233 bail: 234 234 if (modules) { 235 235 free(modules); … … 241 241 scconf_free(ectx); 242 242 } 243 243 244 244 return result; 245 245 } … … 267 267 goto bail; 268 268 } 269 event_blocks = scconf_find_blocks(ctx, pkcs11_eventmgr, "event", 269 event_blocks = scconf_find_blocks(ctx, pkcs11_eventmgr, "event", 270 270 "card_insert"); 271 271 if (!event_blocks || !event_blocks[0]) { … … 315 315 goto bail; 316 316 } 317 insert_blocks = scconf_find_blocks(ctx, pkcs11_eventmgr, 317 insert_blocks = scconf_find_blocks(ctx, pkcs11_eventmgr, 318 318 "event", "card_insert"); 319 319 if (!insert_blocks || !insert_blocks[0]) { … … 357 357 goto bail; 358 358 } 359 event_blocks = scconf_find_blocks(ctx, pkcs11_eventmgr, "event", 359 event_blocks = scconf_find_blocks(ctx, pkcs11_eventmgr, "event", 360 360 "card_remove"); 361 361 if (!event_blocks || !event_blocks[0]) { … … 405 405 goto bail; 406 406 } 407 insert_blocks = scconf_find_blocks(ctx, pkcs11_eventmgr, 407 insert_blocks = scconf_find_blocks(ctx, pkcs11_eventmgr, 408 408 "event", "card_remove"); 409 409 if (!insert_blocks || !insert_blocks[0]) { … … 430 430 unsigned int pname; 431 431 const char *params[NUM_PARAMS]; 432 432 433 433 memset(params, '\0', sizeof(params)); 434 434 435 435 for (i = 1; i < argc; i++) { 436 436 for (pname = 0; pname < NUM_PARAMS; pname++) { … … 448 448 params[pname] = (void *)1; 449 449 } 450 } 451 } 452 } 453 450 } 451 } 452 } 453 454 454 for (pname = 0; pname < NUM_PARAMS; pname++) { 455 455 if (params[pname] != NULL) 456 456 break; 457 457 } 458 458 459 459 if (pname == NUM_PARAMS) { 460 460 DBG("No correct parameter specified"); … … 463 463 " [rm_action[=<executable,executable,...>]]\n"); 464 464 } 465 465 466 466 if (params[LIST_MODULES] != NULL) { 467 467 DBG("List modules:"); 468 468 return list_modules(); 469 } 469 } 470 470 else { 471 471 if (params[USE_MODULE] == (void *)1) { … … 491 491 } 492 492 return 0; 493 } 493 } 494 494 else if (params[INS_ACTION] != NULL) { 495 495 DBG1("Set card insert action: %s", params[INS_ACTION]); … … 506 506 } 507 507 return 0; 508 } 508 } 509 509 else if (params[RM_ACTION] != NULL) { 510 510 DBG1("Set card remove action: %s", params[RM_ACTION]); … … 513 513 return i; 514 514 } 515 } 515 } 516 516 } 517 517 DBG("Process completed"); -
trunk/src/tools/pklogin_finder.c
r332 r358 88 88 if (configuration->slot_description != NULL) { 89 89 rv = find_slot_by_slotlabel(ph,configuration->slot_description, &slot_num); 90 } else { 90 } else { 91 91 rv = find_slot_by_number(ph,configuration->slot_num, &slot_num); 92 92 }
Note: See TracChangeset
for help on using the changeset viewer.
