diff options
Diffstat (limited to 'security/nss/cmd/dbck')
| -rw-r--r-- | security/nss/cmd/dbck/Makefile | 47 | ||||
| -rw-r--r-- | security/nss/cmd/dbck/dbck.c | 1348 | ||||
| -rw-r--r-- | security/nss/cmd/dbck/dbrecover.c | 669 | ||||
| -rw-r--r-- | security/nss/cmd/dbck/manifest.mn | 22 |
4 files changed, 2086 insertions, 0 deletions
diff --git a/security/nss/cmd/dbck/Makefile b/security/nss/cmd/dbck/Makefile new file mode 100644 index 0000000000..ea1d2f49ae --- /dev/null +++ b/security/nss/cmd/dbck/Makefile @@ -0,0 +1,47 @@ +#! gmake +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +####################################################################### +# (1) Include initial platform-independent assignments (MANDATORY). # +####################################################################### + +include manifest.mn + +####################################################################### +# (2) Include "global" configuration information. (OPTIONAL) # +####################################################################### + +include $(CORE_DEPTH)/coreconf/config.mk + +####################################################################### +# (3) Include "component" configuration information. (OPTIONAL) # +####################################################################### + +####################################################################### +# (4) Include "local" platform-dependent assignments (OPTIONAL). # +####################################################################### + +include ../platlibs.mk + +####################################################################### +# (5) Execute "global" rules. (OPTIONAL) # +####################################################################### + +include $(CORE_DEPTH)/coreconf/rules.mk + +####################################################################### +# (6) Execute "component" rules. (OPTIONAL) # +####################################################################### + +INCLUDES += -I ../../lib/softoken + +####################################################################### +# (7) Execute "local" rules. (OPTIONAL). # +####################################################################### + + +include ../platrules.mk + diff --git a/security/nss/cmd/dbck/dbck.c b/security/nss/cmd/dbck/dbck.c new file mode 100644 index 0000000000..934bde0048 --- /dev/null +++ b/security/nss/cmd/dbck/dbck.c @@ -0,0 +1,1348 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +/* +** dbck.c +** +** utility for fixing corrupt cert databases +** +*/ +#include <stdio.h> +#include <string.h> + +#include "secutil.h" +#include "cdbhdl.h" +#include "certdb.h" +#include "cert.h" +#include "nspr.h" +#include "prtypes.h" +#include "prtime.h" +#include "prlong.h" +#include "pcert.h" +#include "nss.h" + +static char *progName; + +/* placeholders for pointer error types */ +static void *WrongEntry; +static void *NoNickname; +static void *NoSMime; + +typedef enum { + /* 0*/ NoSubjectForCert = 0, + /* 1*/ SubjectHasNoKeyForCert, + /* 2*/ NoNicknameOrSMimeForSubject, + /* 3*/ WrongNicknameForSubject, + /* 4*/ NoNicknameEntry, + /* 5*/ WrongSMimeForSubject, + /* 6*/ NoSMimeEntry, + /* 7*/ NoSubjectForNickname, + /* 8*/ NoSubjectForSMime, + /* 9*/ NicknameAndSMimeEntries, + NUM_ERROR_TYPES +} dbErrorType; + +static char *dbErrorString[NUM_ERROR_TYPES] = { + /* 0*/ "<CERT ENTRY>\nDid not find a subject entry for this certificate.", + /* 1*/ "<SUBJECT ENTRY>\nSubject has certKey which is not in db.", + /* 2*/ "<SUBJECT ENTRY>\nSubject does not have a nickname or email address.", + /* 3*/ "<SUBJECT ENTRY>\nUsing this subject's nickname, found a nickname entry for a different subject.", + /* 4*/ "<SUBJECT ENTRY>\nDid not find a nickname entry for this subject.", + /* 5*/ "<SUBJECT ENTRY>\nUsing this subject's email, found an S/MIME entry for a different subject.", + /* 6*/ "<SUBJECT ENTRY>\nDid not find an S/MIME entry for this subject.", + /* 7*/ "<NICKNAME ENTRY>\nDid not find a subject entry for this nickname.", + /* 8*/ "<S/MIME ENTRY>\nDid not find a subject entry for this S/MIME profile.", +}; + +static char *errResult[NUM_ERROR_TYPES] = { + "Certificate entries that had no subject entry.", + "Subject entries with no corresponding Certificate entries.", + "Subject entries that had no nickname or S/MIME entries.", + "Redundant nicknames (subjects with the same nickname).", + "Subject entries that had no nickname entry.", + "Redundant email addresses (subjects with the same email address).", + "Subject entries that had no S/MIME entry.", + "Nickname entries that had no subject entry.", + "S/MIME entries that had no subject entry.", + "Subject entries with BOTH nickname and S/MIME entries." +}; + +enum { + GOBOTH = 0, + GORIGHT, + GOLEFT +}; + +typedef struct +{ + PRBool verbose; + PRBool dograph; + PRFileDesc *out; + PRFileDesc *graphfile; + int dbErrors[NUM_ERROR_TYPES]; +} dbDebugInfo; + +struct certDBEntryListNodeStr { + PRCList link; + certDBEntry entry; + void *appData; +}; +typedef struct certDBEntryListNodeStr certDBEntryListNode; + +/* + * A list node for a cert db entry. The index is a unique identifier + * to use for creating generic maps of a db. This struct handles + * the cert, nickname, and smime db entry types, as all three have a + * single handle to a subject entry. + * This structure is pointed to by certDBEntryListNode->appData. + */ +typedef struct +{ + PLArenaPool *arena; + int index; + certDBEntryListNode *pSubject; +} certDBEntryMap; + +/* + * Subject entry is special case, it has bidirectional handles. One + * subject entry can point to several certs (using the same DN), and + * a nickname and/or smime entry. + * This structure is pointed to by certDBEntryListNode->appData. + */ +typedef struct +{ + PLArenaPool *arena; + int index; + int numCerts; + certDBEntryListNode **pCerts; + certDBEntryListNode *pNickname; + certDBEntryListNode *pSMime; +} certDBSubjectEntryMap; + +/* + * A map of a certdb. + */ +typedef struct +{ + int numCerts; + int numSubjects; + int numNicknames; + int numSMime; + int numRevocation; + certDBEntryListNode certs; /* pointer to head of cert list */ + certDBEntryListNode subjects; /* pointer to head of subject list */ + certDBEntryListNode nicknames; /* pointer to head of nickname list */ + certDBEntryListNode smime; /* pointer to head of smime list */ + certDBEntryListNode revocation; /* pointer to head of revocation list */ +} certDBArray; + +/* Cast list to the base element, a certDBEntryListNode. */ +#define LISTNODE_CAST(node) \ + ((certDBEntryListNode *)(node)) + +static void +Usage(char *progName) +{ +#define FPS fprintf(stderr, + FPS "Type %s -H for more detailed descriptions\n", progName); + FPS "Usage: %s -D [-d certdir] [-m] [-v [-f dumpfile]]\n", + progName); +#ifdef DORECOVER + FPS " %s -R -o newdbname [-d certdir] [-aprsx] [-v [-f dumpfile]]\n", + progName); +#endif + exit(-1); +} + +static void +LongUsage(char *progName) +{ + FPS "%-15s Display this help message.\n", + "-H"); + FPS "%-15s Dump analysis. No changes will be made to the database.\n", + "-D"); + FPS "%-15s Cert database directory (default is ~/.netscape)\n", + " -d certdir"); + FPS "%-15s Put database graph in ./mailfile (default is stdout).\n", + " -m"); + FPS "%-15s Verbose mode. Dumps the entire contents of your cert8.db.\n", + " -v"); + FPS "%-15s File to dump verbose output into. (default is stdout)\n", + " -f dumpfile"); +#ifdef DORECOVER + FPS "%-15s Repair the database. The program will look for broken\n", + "-R"); + FPS "%-15s dependencies between subject entries and certificates,\n", + ""); + FPS "%-15s between nickname entries and subjects, and between SMIME\n", + ""); + FPS "%-15s profiles and subjects. Any duplicate entries will be\n", + ""); + FPS "%-15s removed, any missing entries will be created.\n", + ""); + FPS "%-15s File to store new database in (default is new_cert8.db)\n", + " -o newdbname"); + FPS "%-15s Cert database directory (default is ~/.netscape)\n", + " -d certdir"); + FPS "%-15s Prompt before removing any certificates.\n", + " -p"); + FPS "%-15s Keep all possible certificates. Only remove certificates\n", + " -a"); + FPS "%-15s which prevent creation of a consistent database. Thus any\n", + ""); + FPS "%-15s expired or redundant entries will be kept.\n", + ""); + FPS "%-15s Keep redundant nickname/email entries. It is possible\n", + " -r"); + FPS "%-15s only one such entry will be usable.\n", + ""); + FPS "%-15s Don't require an S/MIME profile in order to keep an S/MIME\n", + " -s"); + FPS "%-15s cert. An empty profile will be created.\n", + ""); + FPS "%-15s Keep expired certificates.\n", + " -x"); + FPS "%-15s Verbose mode - report all activity while recovering db.\n", + " -v"); + FPS "%-15s File to dump verbose output into.\n", + " -f dumpfile"); + FPS "\n"); +#endif + exit(-1); +#undef FPS +} + +/******************************************************************* + * + * Functions for dbck. + * + ******************************************************************/ + +void +printHexString(PRFileDesc *out, SECItem *hexval) +{ + unsigned int i; + for (i = 0; i < hexval->len; i++) { + if (i != hexval->len - 1) { + PR_fprintf(out, "%02x:", hexval->data[i]); + } else { + PR_fprintf(out, "%02x", hexval->data[i]); + } + } + PR_fprintf(out, "\n"); +} + +SECStatus +dumpCertificate(CERTCertificate *cert, int num, PRFileDesc *outfile) +{ + int userCert = 0; + CERTCertTrust *trust = cert->trust; + userCert = (SEC_GET_TRUST_FLAGS(trust, trustSSL) & CERTDB_USER) || + (SEC_GET_TRUST_FLAGS(trust, trustEmail) & CERTDB_USER) || + (SEC_GET_TRUST_FLAGS(trust, trustObjectSigning) & CERTDB_USER); + if (num >= 0) { + PR_fprintf(outfile, "Certificate: %3d\n", num); + } else { + PR_fprintf(outfile, "Certificate:\n"); + } + PR_fprintf(outfile, "----------------\n"); + if (userCert) + PR_fprintf(outfile, "(User Cert)\n"); + PR_fprintf(outfile, "## SUBJECT: %s\n", cert->subjectName); + PR_fprintf(outfile, "## ISSUER: %s\n", cert->issuerName); + PR_fprintf(outfile, "## SERIAL NUMBER: "); + printHexString(outfile, &cert->serialNumber); + { /* XXX should be separate function. */ + PRTime timeBefore, timeAfter; + PRExplodedTime beforePrintable, afterPrintable; + char *beforestr, *afterstr; + DER_DecodeTimeChoice(&timeBefore, &cert->validity.notBefore); + DER_DecodeTimeChoice(&timeAfter, &cert->validity.notAfter); + PR_ExplodeTime(timeBefore, PR_GMTParameters, &beforePrintable); + PR_ExplodeTime(timeAfter, PR_GMTParameters, &afterPrintable); + beforestr = PORT_Alloc(100); + afterstr = PORT_Alloc(100); + PR_FormatTime(beforestr, 100, "%a %b %d %H:%M:%S %Y", &beforePrintable); + PR_FormatTime(afterstr, 100, "%a %b %d %H:%M:%S %Y", &afterPrintable); + PR_fprintf(outfile, "## VALIDITY: %s to %s\n", beforestr, afterstr); + } + PR_fprintf(outfile, "\n"); + return SECSuccess; +} + +SECStatus +dumpCertEntry(certDBEntryCert *entry, int num, PRFileDesc *outfile) +{ +#if 0 + NSSLOWCERTCertificate *cert; + /* should we check for existing duplicates? */ + cert = nsslowcert_DecodeDERCertificate(&entry->cert.derCert, + entry->cert.nickname); +#else + CERTCertificate *cert; + cert = CERT_DecodeDERCertificate(&entry->derCert, PR_FALSE, NULL); +#endif + if (!cert) { + fprintf(stderr, "Failed to decode certificate.\n"); + return SECFailure; + } + cert->trust = (CERTCertTrust *)&entry->trust; + dumpCertificate(cert, num, outfile); + CERT_DestroyCertificate(cert); + return SECSuccess; +} + +SECStatus +dumpSubjectEntry(certDBEntrySubject *entry, int num, PRFileDesc *outfile) +{ + char *subjectName = CERT_DerNameToAscii(&entry->derSubject); + + PR_fprintf(outfile, "Subject: %3d\n", num); + PR_fprintf(outfile, "------------\n"); + PR_fprintf(outfile, "## %s\n", subjectName); + if (entry->nickname) + PR_fprintf(outfile, "## Subject nickname: %s\n", entry->nickname); + if (entry->emailAddrs) { + unsigned int n; + for (n = 0; n < entry->nemailAddrs && entry->emailAddrs[n]; ++n) { + char *emailAddr = entry->emailAddrs[n]; + if (emailAddr[0]) { + PR_fprintf(outfile, "## Subject email address: %s\n", + emailAddr); + } + } + } + PR_fprintf(outfile, "## This subject has %d cert(s).\n", entry->ncerts); + PR_fprintf(outfile, "\n"); + PORT_Free(subjectName); + return SECSuccess; +} + +SECStatus +dumpNicknameEntry(certDBEntryNickname *entry, int num, PRFileDesc *outfile) +{ + PR_fprintf(outfile, "Nickname: %3d\n", num); + PR_fprintf(outfile, "-------------\n"); + PR_fprintf(outfile, "## \"%s\"\n\n", entry->nickname); + return SECSuccess; +} + +SECStatus +dumpSMimeEntry(certDBEntrySMime *entry, int num, PRFileDesc *outfile) +{ + PR_fprintf(outfile, "S/MIME Profile: %3d\n", num); + PR_fprintf(outfile, "-------------------\n"); + PR_fprintf(outfile, "## \"%s\"\n", entry->emailAddr); +#ifdef OLDWAY + PR_fprintf(outfile, "## OPTIONS: "); + printHexString(outfile, &entry->smimeOptions); + PR_fprintf(outfile, "## TIMESTAMP: "); + printHexString(outfile, &entry->optionsDate); +#else + SECU_PrintAny(stdout, &entry->smimeOptions, "## OPTIONS ", 0); + fflush(stdout); + if (entry->optionsDate.len && entry->optionsDate.data) + PR_fprintf(outfile, "## TIMESTAMP: %.*s\n", + entry->optionsDate.len, entry->optionsDate.data); +#endif + PR_fprintf(outfile, "\n"); + return SECSuccess; +} + +SECStatus +mapCertEntries(certDBArray *dbArray) +{ + certDBEntryCert *certEntry; + certDBEntrySubject *subjectEntry; + certDBEntryListNode *certNode, *subjNode; + certDBSubjectEntryMap *smap; + certDBEntryMap *map; + PLArenaPool *tmparena; + SECItem derSubject; + SECItem certKey; + PRCList *cElem, *sElem; + + /* Arena for decoded entries */ + tmparena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE); + if (tmparena == NULL) { + PORT_SetError(SEC_ERROR_NO_MEMORY); + return SECFailure; + } + + /* Iterate over cert entries and map them to subject entries. + * NOTE: mapSubjectEntries must be called first to alloc memory + * for array of subject->cert map. + */ + for (cElem = PR_LIST_HEAD(&dbArray->certs.link); + cElem != &dbArray->certs.link; cElem = PR_NEXT_LINK(cElem)) { + certNode = LISTNODE_CAST(cElem); + certEntry = (certDBEntryCert *)&certNode->entry; + map = (certDBEntryMap *)certNode->appData; + CERT_NameFromDERCert(&certEntry->derCert, &derSubject); + CERT_KeyFromDERCert(tmparena, &certEntry->derCert, &certKey); + /* Loop over found subjects for cert's DN. */ + for (sElem = PR_LIST_HEAD(&dbArray->subjects.link); + sElem != &dbArray->subjects.link; sElem = PR_NEXT_LINK(sElem)) { + subjNode = LISTNODE_CAST(sElem); + subjectEntry = (certDBEntrySubject *)&subjNode->entry; + if (SECITEM_ItemsAreEqual(&derSubject, &subjectEntry->derSubject)) { + unsigned int i; + /* Found matching subject name, create link. */ + map->pSubject = subjNode; + /* Make sure subject entry has cert's key. */ + for (i = 0; i < subjectEntry->ncerts; i++) { + if (SECITEM_ItemsAreEqual(&certKey, + &subjectEntry->certKeys[i])) { + /* Found matching cert key. */ + smap = (certDBSubjectEntryMap *)subjNode->appData; + smap->pCerts[i] = certNode; + break; + } + } + } + } + } + PORT_FreeArena(tmparena, PR_FALSE); + return SECSuccess; +} + +SECStatus +mapSubjectEntries(certDBArray *dbArray) +{ + certDBEntrySubject *subjectEntry; + certDBEntryListNode *subjNode; + certDBSubjectEntryMap *subjMap; + PRCList *sElem; + + for (sElem = PR_LIST_HEAD(&dbArray->subjects.link); + sElem != &dbArray->subjects.link; sElem = PR_NEXT_LINK(sElem)) { + /* Iterate over subject entries and map subjects to nickname + * and smime entries. The cert<->subject map will be handled + * by a subsequent call to mapCertEntries. + */ + subjNode = LISTNODE_CAST(sElem); + subjectEntry = (certDBEntrySubject *)&subjNode->entry; + subjMap = (certDBSubjectEntryMap *)subjNode->appData; + /* need to alloc memory here for array of matching certs. */ + subjMap->pCerts = PORT_ArenaAlloc(subjMap->arena, + subjectEntry->ncerts * sizeof(int)); + subjMap->numCerts = subjectEntry->ncerts; + subjMap->pNickname = NoNickname; + subjMap->pSMime = NoSMime; + + if (subjectEntry->nickname) { + /* Subject should have a nickname entry, so create a link. */ + PRCList *nElem; + for (nElem = PR_LIST_HEAD(&dbArray->nicknames.link); + nElem != &dbArray->nicknames.link; + nElem = PR_NEXT_LINK(nElem)) { + certDBEntryListNode *nickNode; + certDBEntryNickname *nicknameEntry; + /* Look for subject's nickname in nickname entries. */ + nickNode = LISTNODE_CAST(nElem); + nicknameEntry = (certDBEntryNickname *)&nickNode->entry; + if (PL_strcmp(subjectEntry->nickname, + nicknameEntry->nickname) == 0) { + /* Found a nickname entry for subject's nickname. */ + if (SECITEM_ItemsAreEqual(&subjectEntry->derSubject, + &nicknameEntry->subjectName)) { + certDBEntryMap *nickMap; + nickMap = (certDBEntryMap *)nickNode->appData; + /* Nickname and subject match. */ + subjMap->pNickname = nickNode; + nickMap->pSubject = subjNode; + } else if (subjMap->pNickname == NoNickname) { + /* Nickname entry found is for diff. subject. */ + subjMap->pNickname = WrongEntry; + } + } + } + } + if (subjectEntry->emailAddrs) { + unsigned int n; + for (n = 0; n < subjectEntry->nemailAddrs && + subjectEntry->emailAddrs[n]; + ++n) { + char *emailAddr = subjectEntry->emailAddrs[n]; + if (emailAddr[0]) { + PRCList *mElem; + /* Subject should have an smime entry, so create a link. */ + for (mElem = PR_LIST_HEAD(&dbArray->smime.link); + mElem != &dbArray->smime.link; + mElem = PR_NEXT_LINK(mElem)) { + certDBEntryListNode *smimeNode; + certDBEntrySMime *smimeEntry; + /* Look for subject's email in S/MIME entries. */ + smimeNode = LISTNODE_CAST(mElem); + smimeEntry = (certDBEntrySMime *)&smimeNode->entry; + if (PL_strcmp(emailAddr, + smimeEntry->emailAddr) == 0) { + /* Found a S/MIME entry for subject's email. */ + if (SECITEM_ItemsAreEqual( + &subjectEntry->derSubject, + &smimeEntry->subjectName)) { + certDBEntryMap *smimeMap; + /* S/MIME entry and subject match. */ + subjMap->pSMime = smimeNode; + smimeMap = (certDBEntryMap *)smimeNode->appData; + smimeMap->pSubject = subjNode; + } else if (subjMap->pSMime == NoSMime) { + /* S/MIME entry found is for diff. subject. */ + subjMap->pSMime = WrongEntry; + } + } + } /* end for */ + } /* endif (emailAddr[0]) */ + } /* end for */ + } /* endif (subjectEntry->emailAddrs) */ + } + return SECSuccess; +} + +void +printnode(dbDebugInfo *info, const char *str, int num) +{ + if (!info->dograph) + return; + if (num < 0) { + PR_fprintf(info->graphfile, str); + } else { + PR_fprintf(info->graphfile, str, num); + } +} + +PRBool +map_handle_is_ok(dbDebugInfo *info, void *mapPtr, int indent) +{ + if (mapPtr == NULL) { + if (indent > 0) + printnode(info, " ", -1); + if (indent >= 0) + printnode(info, "******************* ", -1); + return PR_FALSE; + } else if (mapPtr == WrongEntry) { + if (indent > 0) + printnode(info, " ", -1); + if (indent >= 0) + printnode(info, "??????????????????? ", -1); + return PR_FALSE; + } else { + return PR_TRUE; + } +} + +/* these call each other */ +void print_smime_graph(dbDebugInfo *info, certDBEntryMap *smimeMap, + int direction); +void print_nickname_graph(dbDebugInfo *info, certDBEntryMap *nickMap, + int direction); +void print_subject_graph(dbDebugInfo *info, certDBSubjectEntryMap *subjMap, + int direction, int optindex, int opttype); +void print_cert_graph(dbDebugInfo *info, certDBEntryMap *certMap, + int direction); + +/* Given an smime entry, print its unique identifier. If GOLEFT is + * specified, print the cert<-subject<-smime map, else just print + * the smime entry. + */ +void +print_smime_graph(dbDebugInfo *info, certDBEntryMap *smimeMap, int direction) +{ + certDBSubjectEntryMap *subjMap; + certDBEntryListNode *subjNode; + if (direction == GOLEFT) { + /* Need to output subject and cert first, see print_subject_graph */ + subjNode = smimeMap->pSubject; + if (map_handle_is_ok(info, (void *)subjNode, 1)) { + subjMap = (certDBSubjectEntryMap *)subjNode->appData; + print_subject_graph(info, subjMap, GOLEFT, + smimeMap->index, certDBEntryTypeSMimeProfile); + } else { + printnode(info, "<---- S/MIME %5d ", smimeMap->index); + info->dbErrors[NoSubjectForSMime]++; + } + } else { + printnode(info, "S/MIME %5d ", smimeMap->index); + } +} + +/* Given a nickname entry, print its unique identifier. If GOLEFT is + * specified, print the cert<-subject<-nickname map, else just print + * the nickname entry. + */ +void +print_nickname_graph(dbDebugInfo *info, certDBEntryMap *nickMap, int direction) +{ + certDBSubjectEntryMap *subjMap; + certDBEntryListNode *subjNode; + if (direction == GOLEFT) { + /* Need to output subject and cert first, see print_subject_graph */ + subjNode = nickMap->pSubject; + if (map_handle_is_ok(info, (void *)subjNode, 1)) { + subjMap = (certDBSubjectEntryMap *)subjNode->appData; + print_subject_graph(info, subjMap, GOLEFT, + nickMap->index, certDBEntryTypeNickname); + } else { + printnode(info, "<---- Nickname %5d ", nickMap->index); + info->dbErrors[NoSubjectForNickname]++; + } + } else { + printnode(info, "Nickname %5d ", nickMap->index); + } +} + +/* Given a subject entry, if going right print the graph of the nickname|smime + * that it maps to (by its unique identifier); and if going left + * print the list of certs that it points to. + */ +void +print_subject_graph(dbDebugInfo *info, certDBSubjectEntryMap *subjMap, + int direction, int optindex, int opttype) +{ + certDBEntryMap *map; + certDBEntryListNode *node; + int i; + /* The first line of output always contains the cert id, subject id, + * and nickname|smime id. Subsequent lines may contain additional + * cert id's for the subject if going left or both directions. + * Ex. of printing the graph for a subject entry: + * Cert 3 <- Subject 5 -> Nickname 32 + * Cert 8 / + * Cert 9 / + * means subject 5 has 3 certs, 3, 8, and 9, and corresponds + * to nickname entry 32. + * To accomplish the above, it is required to dump the entire first + * line left-to-right, regardless of the input direction, and then + * finish up any remaining cert entries. Hence the code is uglier + * than one may expect. + */ + if (direction == GOLEFT || direction == GOBOTH) { + /* In this case, nothing should be output until the first cert is + * located and output (cert 3 in the above example). + */ + if (subjMap->numCerts == 0 || subjMap->pCerts == NULL) + /* XXX uh-oh */ + return; + /* get the first cert and dump it. */ + node = subjMap->pCerts[0]; + if (map_handle_is_ok(info, (void *)node, 0)) { + map = (certDBEntryMap *)node->appData; + /* going left here stops. */ + print_cert_graph(info, map, GOLEFT); + } else { + info->dbErrors[SubjectHasNoKeyForCert]++; + } + /* Now it is safe to output the subject id. */ + if (direction == GOLEFT) + printnode(info, "Subject %5d <---- ", subjMap->index); + else /* direction == GOBOTH */ + printnode(info, "Subject %5d ----> ", subjMap->index); + } + if (direction == GORIGHT || direction == GOBOTH) { + /* Okay, now output the nickname|smime for this subject. */ + if (direction != GOBOTH) /* handled above */ + printnode(info, "Subject %5d ----> ", subjMap->index); + if (subjMap->pNickname) { + node = subjMap->pNickname; + if (map_handle_is_ok(info, (void *)node, 0)) { + map = (certDBEntryMap *)node->appData; + /* going right here stops. */ + print_nickname_graph(info, map, GORIGHT); + } + } + if (subjMap->pSMime) { + node = subjMap->pSMime; + if (map_handle_is_ok(info, (void *)node, 0)) { + map = (certDBEntryMap *)node->appData; + /* going right here stops. */ + print_smime_graph(info, map, GORIGHT); + } + } + if (!subjMap->pNickname && !subjMap->pSMime) { + printnode(info, "******************* ", -1); + info->dbErrors[NoNicknameOrSMimeForSubject]++; + } + if (subjMap->pNickname && subjMap->pSMime) { + info->dbErrors[NicknameAndSMimeEntries]++; + } + } + if (direction != GORIGHT) { /* going right has only one cert */ + if (opttype == certDBEntryTypeNickname) + printnode(info, "Nickname %5d ", optindex); + else if (opttype == certDBEntryTypeSMimeProfile) + printnode(info, "S/MIME %5d ", optindex); + for (i = 1 /* 1st one already done */; i < subjMap->numCerts; i++) { + printnode(info, "\n", -1); /* start a new line */ + node = subjMap->pCerts[i]; + if (map_handle_is_ok(info, (void *)node, 0)) { + map = (certDBEntryMap *)node->appData; + /* going left here stops. */ + print_cert_graph(info, map, GOLEFT); + printnode(info, "/", -1); + } + } + } +} + +/* Given a cert entry, print its unique identifer. If GORIGHT is specified, + * print the cert->subject->nickname|smime map, else just print + * the cert entry. + */ +void +print_cert_graph(dbDebugInfo *info, certDBEntryMap *certMap, int direction) +{ + certDBSubjectEntryMap *subjMap; + certDBEntryListNode *subjNode; + if (direction == GOLEFT) { + printnode(info, "Cert %5d <---- ", certMap->index); + /* only want cert entry, terminate here. */ + return; + } + /* Keep going right then. */ + printnode(info, "Cert %5d ----> ", certMap->index); + subjNode = certMap->pSubject; + if (map_handle_is_ok(info, (void *)subjNode, 0)) { + subjMap = (certDBSubjectEntryMap *)subjNode->appData; + print_subject_graph(info, subjMap, GORIGHT, -1, -1); + } else { + info->dbErrors[NoSubjectForCert]++; + } +} + +SECStatus +computeDBGraph(certDBArray *dbArray, dbDebugInfo *info) +{ + PRCList *cElem, *sElem, *nElem, *mElem; + certDBEntryListNode *node; + certDBEntryMap *map; + certDBSubjectEntryMap *subjMap; + + /* Graph is of this form: + * + * certs: + * cert ---> subject ---> (nickname|smime) + * + * subjects: + * cert <--- subject ---> (nickname|smime) + * + * nicknames and smime: + * cert <--- subject <--- (nickname|smime) + */ + + /* Print cert graph. */ + for (cElem = PR_LIST_HEAD(&dbArray->certs.link); + cElem != &dbArray->certs.link; cElem = PR_NEXT_LINK(cElem)) { + /* Print graph of everything to right of cert entry. */ + node = LISTNODE_CAST(cElem); + map = (certDBEntryMap *)node->appData; + print_cert_graph(info, map, GORIGHT); + printnode(info, "\n", -1); + } + printnode(info, "\n", -1); + + /* Print subject graph. */ + for (sElem = PR_LIST_HEAD(&dbArray->subjects.link); + sElem != &dbArray->subjects.link; sElem = PR_NEXT_LINK(sElem)) { + /* Print graph of everything to both sides of subject entry. */ + node = LISTNODE_CAST(sElem); + subjMap = (certDBSubjectEntryMap *)node->appData; + print_subject_graph(info, subjMap, GOBOTH, -1, -1); + printnode(info, "\n", -1); + } + printnode(info, "\n", -1); + + /* Print nickname graph. */ + for (nElem = PR_LIST_HEAD(&dbArray->nicknames.link); + nElem != &dbArray->nicknames.link; nElem = PR_NEXT_LINK(nElem)) { + /* Print graph of everything to left of nickname entry. */ + node = LISTNODE_CAST(nElem); + map = (certDBEntryMap *)node->appData; + print_nickname_graph(info, map, GOLEFT); + printnode(info, "\n", -1); + } + printnode(info, "\n", -1); + + /* Print smime graph. */ + for (mElem = PR_LIST_HEAD(&dbArray->smime.link); + mElem != &dbArray->smime.link; mElem = PR_NEXT_LINK(mElem)) { + /* Print graph of everything to left of smime entry. */ + node = LISTNODE_CAST(mElem); + if (node == NULL) + break; + map = (certDBEntryMap *)node->appData; + print_smime_graph(info, map, GOLEFT); + printnode(info, "\n", -1); + } + printnode(info, "\n", -1); + + return SECSuccess; +} + +/* + * List the entries in the db, showing handles between entry types. + */ +void +verboseOutput(certDBArray *dbArray, dbDebugInfo *info) +{ + int i, ref; + PRCList *elem; + certDBEntryListNode *node; + certDBEntryMap *map; + certDBSubjectEntryMap *smap; + certDBEntrySubject *subjectEntry; + + /* List certs */ + for (elem = PR_LIST_HEAD(&dbArray->certs.link); + elem != &dbArray->certs.link; elem = PR_NEXT_LINK(elem)) { + node = LISTNODE_CAST(elem); + map = (certDBEntryMap *)node->appData; + dumpCertEntry((certDBEntryCert *)&node->entry, map->index, info->out); + /* walk the cert handle to it's subject entry */ + if (map_handle_is_ok(info, map->pSubject, -1)) { + smap = (certDBSubjectEntryMap *)map->pSubject->appData; + ref = smap->index; + PR_fprintf(info->out, "-->(subject %d)\n\n\n", ref); + } else { + PR_fprintf(info->out, "-->(MISSING SUBJECT ENTRY)\n\n\n"); + } + } + /* List subjects */ + for (elem = PR_LIST_HEAD(&dbArray->subjects.link); + elem != &dbArray->subjects.link; elem = PR_NEXT_LINK(elem)) { + int refs = 0; + node = LISTNODE_CAST(elem); + subjectEntry = (certDBEntrySubject *)&node->entry; + smap = (certDBSubjectEntryMap *)node->appData; + dumpSubjectEntry(subjectEntry, smap->index, info->out); + /* iterate over subject's certs */ + for (i = 0; i < smap->numCerts; i++) { + /* walk each subject handle to it's cert entries */ + if (map_handle_is_ok(info, smap->pCerts[i], -1)) { + ref = ((certDBEntryMap *)smap->pCerts[i]->appData)->index; + PR_fprintf(info->out, "-->(%d. certificate %d)\n", i, ref); + } else { + PR_fprintf(info->out, "-->(%d. MISSING CERT ENTRY)\n", i); + } + } + if (subjectEntry->nickname) { + ++refs; + /* walk each subject handle to it's nickname entry */ + if (map_handle_is_ok(info, smap->pNickname, -1)) { + ref = ((certDBEntryMap *)smap->pNickname->appData)->index; + PR_fprintf(info->out, "-->(nickname %d)\n", ref); + } else { + PR_fprintf(info->out, "-->(MISSING NICKNAME ENTRY)\n"); + } + } + if (subjectEntry->nemailAddrs && + subjectEntry->emailAddrs && + subjectEntry->emailAddrs[0] && + subjectEntry->emailAddrs[0][0]) { + ++refs; + /* walk each subject handle to it's smime entry */ + if (map_handle_is_ok(info, smap->pSMime, -1)) { + ref = ((certDBEntryMap *)smap->pSMime->appData)->index; + PR_fprintf(info->out, "-->(s/mime %d)\n", ref); + } else { + PR_fprintf(info->out, "-->(MISSING S/MIME ENTRY)\n"); + } + } + if (!refs) { + PR_fprintf(info->out, "-->(NO NICKNAME+S/MIME ENTRY)\n"); + } + PR_fprintf(info->out, "\n\n"); + } + for (elem = PR_LIST_HEAD(&dbArray->nicknames.link); + elem != &dbArray->nicknames.link; elem = PR_NEXT_LINK(elem)) { + node = LISTNODE_CAST(elem); + map = (certDBEntryMap *)node->appData; + dumpNicknameEntry((certDBEntryNickname *)&node->entry, map->index, + info->out); + if (map_handle_is_ok(info, map->pSubject, -1)) { + ref = ((certDBEntryMap *)map->pSubject->appData)->index; + PR_fprintf(info->out, "-->(subject %d)\n\n\n", ref); + } else { + PR_fprintf(info->out, "-->(MISSING SUBJECT ENTRY)\n\n\n"); + } + } + for (elem = PR_LIST_HEAD(&dbArray->smime.link); + elem != &dbArray->smime.link; elem = PR_NEXT_LINK(elem)) { + node = LISTNODE_CAST(elem); + map = (certDBEntryMap *)node->appData; + dumpSMimeEntry((certDBEntrySMime *)&node->entry, map->index, info->out); + if (map_handle_is_ok(info, map->pSubject, -1)) { + ref = ((certDBEntryMap *)map->pSubject->appData)->index; + PR_fprintf(info->out, "-->(subject %d)\n\n\n", ref); + } else { + PR_fprintf(info->out, "-->(MISSING SUBJECT ENTRY)\n\n\n"); + } + } + PR_fprintf(info->out, "\n\n"); +} + +/* A callback function, intended to be called from nsslowcert_TraverseDBEntries + * Builds a PRCList of DB entries of the specified type. + */ +SECStatus +SEC_GetCertDBEntryList(SECItem *dbdata, SECItem *dbkey, + certDBEntryType entryType, void *pdata) +{ + certDBEntry *entry; + certDBEntryListNode *node; + PRCList *list = (PRCList *)pdata; + + if (!dbdata || !dbkey || !pdata || !dbdata->data || !dbkey->data) { + PORT_SetError(SEC_ERROR_INVALID_ARGS); + return SECFailure; + } + entry = nsslowcert_DecodeAnyDBEntry(dbdata, dbkey, entryType, NULL); + if (!entry) { + return SECSuccess; /* skip it */ + } + node = PORT_ArenaZNew(entry->common.arena, certDBEntryListNode); + if (!node) { + /* DestroyDBEntry(entry); */ + PLArenaPool *arena = entry->common.arena; + PORT_Memset(&entry->common, 0, sizeof entry->common); + PORT_FreeArena(arena, PR_FALSE); + return SECFailure; + } + node->entry = *entry; /* crude but effective. */ + PR_INIT_CLIST(&node->link); + PR_INSERT_BEFORE(&node->link, list); + return SECSuccess; +} + +int +fillDBEntryArray(NSSLOWCERTCertDBHandle *handle, certDBEntryType type, + certDBEntryListNode *list) +{ + PRCList *elem; + certDBEntryListNode *node; + certDBEntryMap *mnode; + certDBSubjectEntryMap *smnode; + PLArenaPool *arena; + int count = 0; + + /* Initialize a dummy entry in the list. The list head will be the + * next element, so this element is skipped by for loops. + */ + PR_INIT_CLIST((PRCList *)list); + /* Collect all of the cert db entries for this type into a list. */ + nsslowcert_TraverseDBEntries(handle, type, SEC_GetCertDBEntryList, list); + + for (elem = PR_LIST_HEAD(&list->link); + elem != &list->link; elem = PR_NEXT_LINK(elem)) { + /* Iterate over the entries and ... */ + node = (certDBEntryListNode *)elem; + if (type != certDBEntryTypeSubject) { + arena = PORT_NewArena(sizeof(*mnode)); + mnode = PORT_ArenaZNew(arena, certDBEntryMap); + mnode->arena = arena; + /* ... assign a unique index number to each node, and ... */ + mnode->index = count; + /* ... set the map pointer for the node. */ + node->appData = (void *)mnode; + } else { + /* allocate some room for the cert pointers also */ + arena = PORT_NewArena(sizeof(*smnode) + 20 * sizeof(void *)); + smnode = PORT_ArenaZNew(arena, certDBSubjectEntryMap); + smnode->arena = arena; + smnode->index = count; + node->appData = (void *)smnode; + } + count++; + } + return count; +} + +void +freeDBEntryList(PRCList *list) +{ + PRCList *next, *elem; + certDBEntryListNode *node; + certDBEntryMap *map; + + for (elem = PR_LIST_HEAD(list); elem != list;) { + next = PR_NEXT_LINK(elem); + node = (certDBEntryListNode *)elem; + map = (certDBEntryMap *)node->appData; + PR_REMOVE_LINK(&node->link); + PORT_FreeArena(map->arena, PR_TRUE); + PORT_FreeArena(node->entry.common.arena, PR_TRUE); + elem = next; + } +} + +void +DBCK_DebugDB(NSSLOWCERTCertDBHandle *handle, PRFileDesc *out, + PRFileDesc *mailfile) +{ + int i, nCertsFound, nSubjFound, nErr; + int nCerts, nSubjects, nSubjCerts, nNicknames, nSMime, nRevocation; + PRCList *elem; + char c; + dbDebugInfo info; + certDBArray dbArray; + + PORT_Memset(&dbArray, 0, sizeof(dbArray)); + PORT_Memset(&info, 0, sizeof(info)); + info.verbose = (PRBool)(out != NULL); + info.dograph = info.verbose; + info.out = (out) ? out : PR_STDOUT; + info.graphfile = mailfile ? mailfile : PR_STDOUT; + + /* Fill the array structure with cert/subject/nickname/smime entries. */ + dbArray.numCerts = fillDBEntryArray(handle, certDBEntryTypeCert, + &dbArray.certs); + dbArray.numSubjects = fillDBEntryArray(handle, certDBEntryTypeSubject, + &dbArray.subjects); + dbArray.numNicknames = fillDBEntryArray(handle, certDBEntryTypeNickname, + &dbArray.nicknames); + dbArray.numSMime = fillDBEntryArray(handle, certDBEntryTypeSMimeProfile, + &dbArray.smime); + dbArray.numRevocation = fillDBEntryArray(handle, certDBEntryTypeRevocation, + &dbArray.revocation); + + /* Compute the map between the database entries. */ + mapSubjectEntries(&dbArray); + mapCertEntries(&dbArray); + computeDBGraph(&dbArray, &info); + + /* Store the totals for later reference. */ + nCerts = dbArray.numCerts; + nSubjects = dbArray.numSubjects; + nNicknames = dbArray.numNicknames; + nSMime = dbArray.numSMime; + nRevocation = dbArray.numRevocation; + nSubjCerts = 0; + for (elem = PR_LIST_HEAD(&dbArray.subjects.link); + elem != &dbArray.subjects.link; elem = PR_NEXT_LINK(elem)) { + certDBSubjectEntryMap *smap; + smap = (certDBSubjectEntryMap *)LISTNODE_CAST(elem)->appData; + nSubjCerts += smap->numCerts; + } + + if (info.verbose) { + /* Dump the database contents. */ + verboseOutput(&dbArray, &info); + } + + freeDBEntryList(&dbArray.certs.link); + freeDBEntryList(&dbArray.subjects.link); + freeDBEntryList(&dbArray.nicknames.link); + freeDBEntryList(&dbArray.smime.link); + freeDBEntryList(&dbArray.revocation.link); + + PR_fprintf(info.out, "\n"); + PR_fprintf(info.out, "Database statistics:\n"); + PR_fprintf(info.out, "N0: Found %4d Certificate entries.\n", + nCerts); + PR_fprintf(info.out, "N1: Found %4d Subject entries (unique DN's).\n", + nSubjects); + PR_fprintf(info.out, "N2: Found %4d Cert keys within Subject entries.\n", + nSubjCerts); + PR_fprintf(info.out, "N3: Found %4d Nickname entries.\n", + nNicknames); + PR_fprintf(info.out, "N4: Found %4d S/MIME entries.\n", + nSMime); + PR_fprintf(info.out, "N5: Found %4d CRL entries.\n", + nRevocation); + PR_fprintf(info.out, "\n"); + + nErr = 0; + for (i = 0; i < NUM_ERROR_TYPES; i++) { + PR_fprintf(info.out, "E%d: Found %4d %s\n", + i, info.dbErrors[i], errResult[i]); + nErr += info.dbErrors[i]; + } + PR_fprintf(info.out, "--------------\n Found %4d errors in database.\n", + nErr); + + PR_fprintf(info.out, "\nCertificates:\n"); + PR_fprintf(info.out, "N0 == N2 + E%d + E%d\n", NoSubjectForCert, + SubjectHasNoKeyForCert); + nCertsFound = nSubjCerts + + info.dbErrors[NoSubjectForCert] + + info.dbErrors[SubjectHasNoKeyForCert]; + c = (nCertsFound == nCerts) ? '=' : '!'; + PR_fprintf(info.out, "%d %c= %d + %d + %d\n", nCerts, c, nSubjCerts, + info.dbErrors[NoSubjectForCert], + info.dbErrors[SubjectHasNoKeyForCert]); + PR_fprintf(info.out, "\nSubjects:\n"); + PR_fprintf(info.out, + "N1 == N3 + N4 + E%d + E%d + E%d + E%d + E%d - E%d - E%d - E%d\n", + NoNicknameOrSMimeForSubject, + WrongNicknameForSubject, + NoNicknameEntry, + WrongSMimeForSubject, + NoSMimeEntry, + NoSubjectForNickname, + NoSubjectForSMime, + NicknameAndSMimeEntries); + nSubjFound = nNicknames + nSMime + + info.dbErrors[NoNicknameOrSMimeForSubject] + + info.dbErrors[WrongNicknameForSubject] + + info.dbErrors[NoNicknameEntry] + + info.dbErrors[WrongSMimeForSubject] + + info.dbErrors[NoSMimeEntry] - + info.dbErrors[NoSubjectForNickname] - + info.dbErrors[NoSubjectForSMime] - + info.dbErrors[NicknameAndSMimeEntries]; + c = (nSubjFound == nSubjects) ? '=' : '!'; + PR_fprintf(info.out, + "%2d %c= %2d + %2d + %2d + %2d + %2d + %2d + %2d - %2d - %2d - %2d\n", + nSubjects, c, nNicknames, nSMime, + info.dbErrors[NoNicknameOrSMimeForSubject], + info.dbErrors[WrongNicknameForSubject], + info.dbErrors[NoNicknameEntry], + info.dbErrors[WrongSMimeForSubject], + info.dbErrors[NoSMimeEntry], + info.dbErrors[NoSubjectForNickname], + info.dbErrors[NoSubjectForSMime], + info.dbErrors[NicknameAndSMimeEntries]); + PR_fprintf(info.out, "\n"); +} + +#ifdef DORECOVER +#include "dbrecover.c" +#endif /* DORECOVER */ + +enum { + cmd_Debug = 0, + cmd_LongUsage, + cmd_Recover +}; + +enum { + opt_KeepAll = 0, + opt_CertDir, + opt_Dumpfile, + opt_InputDB, + opt_OutputDB, + opt_Mailfile, + opt_Prompt, + opt_KeepRedundant, + opt_KeepNoSMimeProfile, + opt_Verbose, + opt_KeepExpired +}; + +static secuCommandFlag dbck_commands[] = { + { /* cmd_Debug, */ 'D', PR_FALSE, 0, PR_FALSE }, + { /* cmd_LongUsage,*/ 'H', PR_FALSE, 0, PR_FALSE }, + { /* cmd_Recover, */ 'R', PR_FALSE, 0, PR_FALSE } +}; + +static secuCommandFlag dbck_options[] = { + { /* opt_KeepAll, */ 'a', PR_FALSE, 0, PR_FALSE }, + { /* opt_CertDir, */ 'd', PR_TRUE, 0, PR_FALSE }, + { /* opt_Dumpfile, */ 'f', PR_TRUE, 0, PR_FALSE }, + { /* opt_InputDB, */ 'i', PR_TRUE, 0, PR_FALSE }, + { /* opt_OutputDB, */ 'o', PR_TRUE, 0, PR_FALSE }, + { /* opt_Mailfile, */ 'm', PR_FALSE, 0, PR_FALSE }, + { /* opt_Prompt, */ 'p', PR_FALSE, 0, PR_FALSE }, + { /* opt_KeepRedundant, */ 'r', PR_FALSE, 0, PR_FALSE }, + { /* opt_KeepNoSMimeProfile,*/ 's', PR_FALSE, 0, PR_FALSE }, + { /* opt_Verbose, */ 'v', PR_FALSE, 0, PR_FALSE }, + { /* opt_KeepExpired, */ 'x', PR_FALSE, 0, PR_FALSE } +}; + +#define CERT_DB_FMT "%s/cert%s.db" + +static char * +dbck_certdb_name_cb(void *arg, int dbVersion) +{ + const char *configdir = (const char *)arg; + const char *dbver; + char *smpname = NULL; + char *dbname = NULL; + + switch (dbVersion) { + case 8: + dbver = "8"; + break; + case 7: + dbver = "7"; + break; + case 6: + dbver = "6"; + break; + case 5: + dbver = "5"; + break; + case 4: + default: + dbver = ""; + break; + } + + /* make sure we return something allocated with PORT_ so we have properly + * matched frees at the end */ + smpname = PR_smprintf(CERT_DB_FMT, configdir, dbver); + if (smpname) { + dbname = PORT_Strdup(smpname); + PR_smprintf_free(smpname); + } + return dbname; +} + +int +main(int argc, char **argv) +{ + NSSLOWCERTCertDBHandle *certHandle; + + PRFileDesc *mailfile = NULL; + PRFileDesc *dumpfile = NULL; + + char *pathname = 0; + char *fullname = 0; + char *newdbname = 0; + + PRBool removeExpired, requireProfile, singleEntry; + SECStatus rv; + secuCommand dbck; + + dbck.numCommands = sizeof(dbck_commands) / sizeof(secuCommandFlag); + dbck.numOptions = sizeof(dbck_options) / sizeof(secuCommandFlag); + dbck.commands = dbck_commands; + dbck.options = dbck_options; + + progName = strrchr(argv[0], '/'); + progName = progName ? progName + 1 : argv[0]; + + rv = SECU_ParseCommandLine(argc, argv, progName, &dbck); + + if (rv != SECSuccess) + Usage(progName); + + if (dbck.commands[cmd_LongUsage].activated) + LongUsage(progName); + + if (!dbck.commands[cmd_Debug].activated && + !dbck.commands[cmd_Recover].activated) { + PR_fprintf(PR_STDERR, "Please specify -H, -D or -R.\n"); + Usage(progName); + } + + removeExpired = !(dbck.options[opt_KeepAll].activated || + dbck.options[opt_KeepExpired].activated); + + requireProfile = !(dbck.options[opt_KeepAll].activated || + dbck.options[opt_KeepNoSMimeProfile].activated); + + singleEntry = !(dbck.options[opt_KeepAll].activated || + dbck.options[opt_KeepRedundant].activated); + + if (dbck.options[opt_OutputDB].activated) { + newdbname = PL_strdup(dbck.options[opt_OutputDB].arg); + } else { + newdbname = PL_strdup("new_cert8.db"); + } + + /* Create a generic graph of the database. */ + if (dbck.options[opt_Mailfile].activated) { + mailfile = PR_Open("./mailfile", PR_RDWR | PR_CREATE_FILE, 00660); + if (!mailfile) { + fprintf(stderr, "Unable to create mailfile.\n"); + return -1; + } + } + + /* Dump all debugging info while running. */ + if (dbck.options[opt_Verbose].activated) { + if (dbck.options[opt_Dumpfile].activated) { + dumpfile = PR_Open(dbck.options[opt_Dumpfile].arg, + PR_RDWR | PR_CREATE_FILE, 00660); + if (!dumpfile) { + fprintf(stderr, "Unable to create dumpfile.\n"); + return -1; + } + } else { + dumpfile = PR_STDOUT; + } + } + + /* Set the cert database directory. */ + if (dbck.options[opt_CertDir].activated) { + SECU_ConfigDirectory(dbck.options[opt_CertDir].arg); + } + + pathname = SECU_ConfigDirectory(NULL); + + PR_Init(PR_SYSTEM_THREAD, PR_PRIORITY_NORMAL, 1); + rv = NSS_NoDB_Init(pathname); + if (rv != SECSuccess) { + fprintf(stderr, "NSS_NoDB_Init failed\n"); + return -1; + } + + certHandle = PORT_ZNew(NSSLOWCERTCertDBHandle); + if (!certHandle) { + SECU_PrintError(progName, "unable to get database handle"); + return -1; + } + certHandle->ref = 1; + +#ifdef NOTYET + /* Open the possibly corrupt database. */ + if (dbck.options[opt_InputDB].activated) { + PRFileInfo fileInfo; + fullname = PR_smprintf("%s/%s", pathname, + dbck.options[opt_InputDB].arg); + if (PR_GetFileInfo(fullname, &fileInfo) != PR_SUCCESS) { + fprintf(stderr, "Unable to read file \"%s\".\n", fullname); + return -1; + } + rv = CERT_OpenCertDBFilename(certHandle, fullname, PR_TRUE); + } else +#endif + { +/* Use the default. */ +#ifdef NOTYET + fullname = SECU_CertDBNameCallback(NULL, CERT_DB_FILE_VERSION); + if (PR_GetFileInfo(fullname, &fileInfo) != PR_SUCCESS) { + fprintf(stderr, "Unable to read file \"%s\".\n", fullname); + return -1; + } +#endif + rv = nsslowcert_OpenCertDB(certHandle, + PR_TRUE, /* readOnly */ + NULL, /* rdb appName */ + "", /* rdb prefix */ + dbck_certdb_name_cb, /* namecb */ + pathname, /* configDir */ + PR_FALSE); /* volatile */ + } + + if (rv) { + SECU_PrintError(progName, "unable to open cert database"); + return -1; + } + + if (dbck.commands[cmd_Debug].activated) { + DBCK_DebugDB(certHandle, dumpfile, mailfile); + return 0; + } + +#ifdef DORECOVER + if (dbck.commands[cmd_Recover].activated) { + DBCK_ReconstructDBFromCerts(certHandle, newdbname, + dumpfile, removeExpired, + requireProfile, singleEntry, + dbck.options[opt_Prompt].activated); + return 0; + } +#endif + + if (mailfile) + PR_Close(mailfile); + if (dumpfile) + PR_Close(dumpfile); + if (certHandle) { + nsslowcert_ClosePermCertDB(certHandle); + PORT_Free(certHandle); + } + return -1; +} diff --git a/security/nss/cmd/dbck/dbrecover.c b/security/nss/cmd/dbck/dbrecover.c new file mode 100644 index 0000000000..318e4eb242 --- /dev/null +++ b/security/nss/cmd/dbck/dbrecover.c @@ -0,0 +1,669 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +enum { + dbInvalidCert = 0, + dbNoSMimeProfile, + dbOlderCert, + dbBadCertificate, + dbCertNotWrittenToDB +}; + +typedef struct dbRestoreInfoStr { + NSSLOWCERTCertDBHandle *handle; + PRBool verbose; + PRFileDesc *out; + int nCerts; + int nOldCerts; + int dbErrors[5]; + PRBool removeType[3]; + PRBool promptUser[3]; +} dbRestoreInfo; + +char * +IsEmailCert(CERTCertificate *cert) +{ + char *email, *tmp1, *tmp2; + PRBool isCA; + int len; + + if (!cert->subjectName) { + return NULL; + } + + tmp1 = PORT_Strstr(cert->subjectName, "E="); + tmp2 = PORT_Strstr(cert->subjectName, "MAIL="); + /* XXX Nelson has cert for KTrilli which does not have either + * of above but is email cert (has cert->emailAddr). + */ + if (!tmp1 && !tmp2 && !(cert->emailAddr && cert->emailAddr[0])) { + return NULL; + } + + /* Server or CA cert, not personal email. */ + isCA = CERT_IsCACert(cert, NULL); + if (isCA) + return NULL; + + /* XXX CERT_IsCACert advertises checking the key usage ext., + but doesn't appear to. */ + /* Check the key usage extension. */ + if (cert->keyUsagePresent) { + /* Must at least be able to sign or encrypt (not neccesarily + * both if it is one of a dual cert). + */ + if (!((cert->rawKeyUsage & KU_DIGITAL_SIGNATURE) || + (cert->rawKeyUsage & KU_KEY_ENCIPHERMENT))) + return NULL; + + /* CA cert, not personal email. */ + if (cert->rawKeyUsage & (KU_KEY_CERT_SIGN | KU_CRL_SIGN)) + return NULL; + } + + if (cert->emailAddr && cert->emailAddr[0]) { + email = PORT_Strdup(cert->emailAddr); + } else { + if (tmp1) + tmp1 += 2; /* "E=" */ + else + tmp1 = tmp2 + 5; /* "MAIL=" */ + len = strcspn(tmp1, ", "); + email = (char *)PORT_Alloc(len + 1); + PORT_Strncpy(email, tmp1, len); + email[len] = '\0'; + } + + return email; +} + +SECStatus +deleteit(CERTCertificate *cert, void *arg) +{ + return SEC_DeletePermCertificate(cert); +} + +/* Different than DeleteCertificate - has the added bonus of removing + * all certs with the same DN. + */ +SECStatus +deleteAllEntriesForCert(NSSLOWCERTCertDBHandle *handle, CERTCertificate *cert, + PRFileDesc *outfile) +{ +#if 0 + certDBEntrySubject *subjectEntry; + certDBEntryNickname *nicknameEntry; + certDBEntrySMime *smimeEntry; + int i; +#endif + + if (outfile) { + PR_fprintf(outfile, "$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$\n\n"); + PR_fprintf(outfile, "Deleting redundant certificate:\n"); + dumpCertificate(cert, -1, outfile); + } + + CERT_TraverseCertsForSubject(handle, cert->subjectList, deleteit, NULL); +#if 0 + CERT_LockDB(handle); + subjectEntry = ReadDBSubjectEntry(handle, &cert->derSubject); + /* It had better be there, or created a bad db. */ + PORT_Assert(subjectEntry); + for (i=0; i<subjectEntry->ncerts; i++) { + DeleteDBCertEntry(handle, &subjectEntry->certKeys[i]); + } + DeleteDBSubjectEntry(handle, &cert->derSubject); + if (subjectEntry->emailAddr && subjectEntry->emailAddr[0]) { + smimeEntry = ReadDBSMimeEntry(handle, subjectEntry->emailAddr); + if (smimeEntry) { + if (SECITEM_ItemsAreEqual(&subjectEntry->derSubject, + &smimeEntry->subjectName)) + /* Only delete it if it's for this subject! */ + DeleteDBSMimeEntry(handle, subjectEntry->emailAddr); + SEC_DestroyDBEntry((certDBEntry*)smimeEntry); + } + } + if (subjectEntry->nickname) { + nicknameEntry = ReadDBNicknameEntry(handle, subjectEntry->nickname); + if (nicknameEntry) { + if (SECITEM_ItemsAreEqual(&subjectEntry->derSubject, + &nicknameEntry->subjectName)) + /* Only delete it if it's for this subject! */ + DeleteDBNicknameEntry(handle, subjectEntry->nickname); + SEC_DestroyDBEntry((certDBEntry*)nicknameEntry); + } + } + SEC_DestroyDBEntry((certDBEntry*)subjectEntry); + CERT_UnlockDB(handle); +#endif + return SECSuccess; +} + +void +getCertsToDelete(char *numlist, int len, int *certNums, int nCerts) +{ + int j, num; + char *numstr, *numend, *end; + + numstr = numlist; + end = numstr + len - 1; + while (numstr != end) { + numend = strpbrk(numstr, ", \n"); + *numend = '\0'; + if (PORT_Strlen(numstr) == 0) + return; + num = PORT_Atoi(numstr); + if (numstr == numlist) + certNums[0] = num; + for (j = 1; j < nCerts + 1; j++) { + if (num == certNums[j]) { + certNums[j] = -1; + break; + } + } + if (numend == end) + break; + numstr = strpbrk(numend + 1, "0123456789"); + } +} + +PRBool +userSaysDeleteCert(CERTCertificate **certs, int nCerts, + int errtype, dbRestoreInfo *info, int *certNums) +{ + char response[32]; + PRInt32 nb; + int i; + /* User wants to remove cert without prompting. */ + if (info->promptUser[errtype] == PR_FALSE) + return (info->removeType[errtype]); + switch (errtype) { + case dbInvalidCert: + PR_fprintf(PR_STDOUT, "******** Expired ********\n"); + PR_fprintf(PR_STDOUT, "Cert has expired.\n\n"); + dumpCertificate(certs[0], -1, PR_STDOUT); + PR_fprintf(PR_STDOUT, + "Keep it? (y/n - this one, Y/N - all expired certs) [n] "); + break; + case dbNoSMimeProfile: + PR_fprintf(PR_STDOUT, "******** No Profile ********\n"); + PR_fprintf(PR_STDOUT, "S/MIME cert has no profile.\n\n"); + dumpCertificate(certs[0], -1, PR_STDOUT); + PR_fprintf(PR_STDOUT, + "Keep it? (y/n - this one, Y/N - all S/MIME w/o profile) [n] "); + break; + case dbOlderCert: + PR_fprintf(PR_STDOUT, "******* Redundant nickname/email *******\n\n"); + PR_fprintf(PR_STDOUT, "These certs have the same nickname/email:\n"); + for (i = 0; i < nCerts; i++) + dumpCertificate(certs[i], i, PR_STDOUT); + PR_fprintf(PR_STDOUT, + "Enter the certs you would like to keep from those listed above.\n"); + PR_fprintf(PR_STDOUT, + "Use a comma-separated list of the cert numbers (ex. 0, 8, 12).\n"); + PR_fprintf(PR_STDOUT, + "The first cert in the list will be the primary cert\n"); + PR_fprintf(PR_STDOUT, + " accessed by the nickname/email handle.\n"); + PR_fprintf(PR_STDOUT, + "List cert numbers to keep here, or hit enter\n"); + PR_fprintf(PR_STDOUT, + " to always keep only the newest cert: "); + break; + default: + } + nb = PR_Read(PR_STDIN, response, sizeof(response)); + PR_fprintf(PR_STDOUT, "\n\n"); + if (errtype == dbOlderCert) { + if (!isdigit(response[0])) { + info->promptUser[errtype] = PR_FALSE; + info->removeType[errtype] = PR_TRUE; + return PR_TRUE; + } + getCertsToDelete(response, nb, certNums, nCerts); + return PR_TRUE; + } + /* User doesn't want to be prompted for this type anymore. */ + if (response[0] == 'Y') { + info->promptUser[errtype] = PR_FALSE; + info->removeType[errtype] = PR_FALSE; + return PR_FALSE; + } else if (response[0] == 'N') { + info->promptUser[errtype] = PR_FALSE; + info->removeType[errtype] = PR_TRUE; + return PR_TRUE; + } + return (response[0] != 'y') ? PR_TRUE : PR_FALSE; +} + +SECStatus +addCertToDB(certDBEntryCert *certEntry, dbRestoreInfo *info, + NSSLOWCERTCertDBHandle *oldhandle) +{ + SECStatus rv = SECSuccess; + PRBool allowOverride; + PRBool userCert; + SECCertTimeValidity validity; + CERTCertificate *oldCert = NULL; + CERTCertificate *dbCert = NULL; + CERTCertificate *newCert = NULL; + CERTCertTrust *trust; + certDBEntrySMime *smimeEntry = NULL; + char *email = NULL; + char *nickname = NULL; + int nCertsForSubject = 1; + + oldCert = CERT_DecodeDERCertificate(&certEntry->derCert, PR_FALSE, + certEntry->nickname); + if (!oldCert) { + info->dbErrors[dbBadCertificate]++; + SEC_DestroyDBEntry((certDBEntry *)certEntry); + return SECSuccess; + } + + oldCert->dbEntry = certEntry; + oldCert->trust = &certEntry->trust; + oldCert->dbhandle = oldhandle; + + trust = oldCert->trust; + + info->nOldCerts++; + + if (info->verbose) + PR_fprintf(info->out, "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%\n\n"); + + if (oldCert->nickname) + nickname = PORT_Strdup(oldCert->nickname); + + /* Always keep user certs. Skip ahead. */ + /* XXX if someone sends themselves a signed message, it is possible + for their cert to be imported as an "other" cert, not a user cert. + this mucks with smime entries... */ + userCert = (SEC_GET_TRUST_FLAGS(trust, trustSSL) & CERTDB_USER) || + (SEC_GET_TRUST_FLAGS(trust, trustEmail) & CERTDB_USER) || + (SEC_GET_TRUST_FLAGS(trust, trustObjectSigning) & CERTDB_USER); + if (userCert) + goto createcert; + + /* If user chooses so, ignore expired certificates. */ + allowOverride = (PRBool)((oldCert->keyUsage == certUsageSSLServer) || + (oldCert->keyUsage == certUsageSSLServerWithStepUp) || + (oldCert->keyUsage == certUsageIPsec)); + validity = CERT_CheckCertValidTimes(oldCert, PR_Now(), allowOverride); + /* If cert expired and user wants to delete it, ignore it. */ + if ((validity != secCertTimeValid) && + userSaysDeleteCert(&oldCert, 1, dbInvalidCert, info, 0)) { + info->dbErrors[dbInvalidCert]++; + if (info->verbose) { + PR_fprintf(info->out, "Deleting expired certificate:\n"); + dumpCertificate(oldCert, -1, info->out); + } + goto cleanup; + } + + /* New database will already have default certs, don't attempt + to overwrite them. */ + dbCert = CERT_FindCertByDERCert(info->handle, &oldCert->derCert); + if (dbCert) { + info->nCerts++; + if (info->verbose) { + PR_fprintf(info->out, "Added certificate to database:\n"); + dumpCertificate(oldCert, -1, info->out); + } + goto cleanup; + } + + /* Determine if cert is S/MIME and get its email if so. */ + email = IsEmailCert(oldCert); + + /* + XXX Just create empty profiles? + if (email) { + SECItem *profile = CERT_FindSMimeProfile(oldCert); + if (!profile && + userSaysDeleteCert(&oldCert, 1, dbNoSMimeProfile, info, 0)) { + info->dbErrors[dbNoSMimeProfile]++; + if (info->verbose) { + PR_fprintf(info->out, + "Deleted cert missing S/MIME profile.\n"); + dumpCertificate(oldCert, -1, info->out); + } + goto cleanup; + } else { + SECITEM_FreeItem(profile); + } + } + */ + +createcert: + + /* Sometimes happens... */ + if (!nickname && userCert) + nickname = PORT_Strdup(oldCert->subjectName); + + /* Create a new certificate, copy of the old one. */ + newCert = CERT_NewTempCertificate(info->handle, &oldCert->derCert, + nickname, PR_FALSE, PR_TRUE); + if (!newCert) { + PR_fprintf(PR_STDERR, "Unable to create new certificate.\n"); + dumpCertificate(oldCert, -1, PR_STDERR); + info->dbErrors[dbBadCertificate]++; + goto cleanup; + } + + /* Add the cert to the new database. */ + rv = CERT_AddTempCertToPerm(newCert, nickname, oldCert->trust); + if (rv) { + PR_fprintf(PR_STDERR, "Failed to write temp cert to perm database.\n"); + dumpCertificate(oldCert, -1, PR_STDERR); + info->dbErrors[dbCertNotWrittenToDB]++; + goto cleanup; + } + + if (info->verbose) { + PR_fprintf(info->out, "Added certificate to database:\n"); + dumpCertificate(oldCert, -1, info->out); + } + + /* If the cert is an S/MIME cert, and the first with it's subject, + * modify the subject entry to include the email address, + * CERT_AddTempCertToPerm does not do email addresses and S/MIME entries. + */ + if (smimeEntry) { /*&& !userCert && nCertsForSubject == 1) { */ +#if 0 + UpdateSubjectWithEmailAddr(newCert, email); +#endif + SECItem emailProfile, profileTime; + rv = CERT_FindFullSMimeProfile(oldCert, &emailProfile, &profileTime); + /* calls UpdateSubjectWithEmailAddr */ + if (rv == SECSuccess) + rv = CERT_SaveSMimeProfile(newCert, &emailProfile, &profileTime); + } + + info->nCerts++; + +cleanup: + + if (nickname) + PORT_Free(nickname); + if (email) + PORT_Free(email); + if (oldCert) + CERT_DestroyCertificate(oldCert); + if (dbCert) + CERT_DestroyCertificate(dbCert); + if (newCert) + CERT_DestroyCertificate(newCert); + if (smimeEntry) + SEC_DestroyDBEntry((certDBEntry *)smimeEntry); + return SECSuccess; +} + +#if 0 +SECStatus +copyDBEntry(SECItem *data, SECItem *key, certDBEntryType type, void *pdata) +{ + SECStatus rv; + NSSLOWCERTCertDBHandle *newdb = (NSSLOWCERTCertDBHandle *)pdata; + certDBEntryCommon common; + SECItem dbkey; + + common.type = type; + common.version = CERT_DB_FILE_VERSION; + common.flags = data->data[2]; + common.arena = NULL; + + dbkey.len = key->len + SEC_DB_KEY_HEADER_LEN; + dbkey.data = (unsigned char *)PORT_Alloc(dbkey.len*sizeof(unsigned char)); + PORT_Memcpy(&dbkey.data[SEC_DB_KEY_HEADER_LEN], key->data, key->len); + dbkey.data[0] = type; + + rv = WriteDBEntry(newdb, &common, &dbkey, data); + + PORT_Free(dbkey.data); + return rv; +} +#endif + +int +certIsOlder(CERTCertificate **cert1, CERTCertificate **cert2) +{ + return !CERT_IsNewer(*cert1, *cert2); +} + +int +findNewestSubjectForEmail(NSSLOWCERTCertDBHandle *handle, int subjectNum, + certDBArray *dbArray, dbRestoreInfo *info, + int *subjectWithSMime, int *smimeForSubject) +{ + int newestSubject; + int subjectsForEmail[50]; + int i, j, ns, sNum; + certDBEntryListNode *subjects = &dbArray->subjects; + certDBEntryListNode *smime = &dbArray->smime; + certDBEntrySubject *subjectEntry1, *subjectEntry2; + certDBEntrySMime *smimeEntry; + CERTCertificate **certs; + CERTCertificate *cert; + CERTCertTrust *trust; + PRBool userCert; + int *certNums; + + ns = 0; + subjectEntry1 = (certDBEntrySubject *)&subjects.entries[subjectNum]; + subjectsForEmail[ns++] = subjectNum; + + *subjectWithSMime = -1; + *smimeForSubject = -1; + newestSubject = subjectNum; + + cert = CERT_FindCertByKey(handle, &subjectEntry1->certKeys[0]); + if (cert) { + trust = cert->trust; + userCert = (SEC_GET_TRUST_FLAGS(trust, trustSSL) & CERTDB_USER) || + (SEC_GET_TRUST_FLAGS(trust, trustEmail) & CERTDB_USER) || + (SEC_GET_TRUST_FLAGS(trust, trustObjectSigning) & CERTDB_USER); + CERT_DestroyCertificate(cert); + } + + /* + * XXX Should we make sure that subjectEntry1->emailAddr is not + * a null pointer or an empty string before going into the next + * two for loops, which pass it to PORT_Strcmp? + */ + + /* Loop over the remaining subjects. */ + for (i = subjectNum + 1; i < subjects.numEntries; i++) { + subjectEntry2 = (certDBEntrySubject *)&subjects.entries[i]; + if (!subjectEntry2) + continue; + if (subjectEntry2->emailAddr && subjectEntry2->emailAddr[0] && + PORT_Strcmp(subjectEntry1->emailAddr, + subjectEntry2->emailAddr) == 0) { + /* Found a subject using the same email address. */ + subjectsForEmail[ns++] = i; + } + } + + /* Find the S/MIME entry for this email address. */ + for (i = 0; i < smime.numEntries; i++) { + smimeEntry = (certDBEntrySMime *)&smime.entries[i]; + if (smimeEntry->common.arena == NULL) + continue; + if (smimeEntry->emailAddr && smimeEntry->emailAddr[0] && + PORT_Strcmp(subjectEntry1->emailAddr, smimeEntry->emailAddr) == 0) { + /* Find which of the subjects uses this S/MIME entry. */ + for (j = 0; j < ns && *subjectWithSMime < 0; j++) { + sNum = subjectsForEmail[j]; + subjectEntry2 = (certDBEntrySubject *)&subjects.entries[sNum]; + if (SECITEM_ItemsAreEqual(&smimeEntry->subjectName, + &subjectEntry2->derSubject)) { + /* Found the subject corresponding to the S/MIME entry. */ + *subjectWithSMime = sNum; + *smimeForSubject = i; + } + } + SEC_DestroyDBEntry((certDBEntry *)smimeEntry); + PORT_Memset(smimeEntry, 0, sizeof(certDBEntry)); + break; + } + } + + if (ns <= 1) + return subjectNum; + + if (userCert) + return *subjectWithSMime; + + /* Now find which of the subjects has the newest cert. */ + certs = (CERTCertificate **)PORT_Alloc(ns * sizeof(CERTCertificate *)); + certNums = (int *)PORT_Alloc((ns + 1) * sizeof(int)); + certNums[0] = 0; + for (i = 0; i < ns; i++) { + sNum = subjectsForEmail[i]; + subjectEntry1 = (certDBEntrySubject *)&subjects.entries[sNum]; + certs[i] = CERT_FindCertByKey(handle, &subjectEntry1->certKeys[0]); + certNums[i + 1] = i; + } + /* Sort the array by validity. */ + qsort(certs, ns, sizeof(CERTCertificate *), + (int (*)(const void *, const void *))certIsOlder); + newestSubject = -1; + for (i = 0; i < ns; i++) { + sNum = subjectsForEmail[i]; + subjectEntry1 = (certDBEntrySubject *)&subjects.entries[sNum]; + if (SECITEM_ItemsAreEqual(&subjectEntry1->derSubject, + &certs[0]->derSubject)) + newestSubject = sNum; + else + SEC_DestroyDBEntry((certDBEntry *)subjectEntry1); + } + if (info && userSaysDeleteCert(certs, ns, dbOlderCert, info, certNums)) { + for (i = 1; i < ns + 1; i++) { + if (certNums[i] >= 0 && certNums[i] != certNums[0]) { + deleteAllEntriesForCert(handle, certs[certNums[i]], info->out); + info->dbErrors[dbOlderCert]++; + } + } + } + CERT_DestroyCertArray(certs, ns); + return newestSubject; +} + +NSSLOWCERTCertDBHandle * +DBCK_ReconstructDBFromCerts(NSSLOWCERTCertDBHandle *oldhandle, char *newdbname, + PRFileDesc *outfile, PRBool removeExpired, + PRBool requireProfile, PRBool singleEntry, + PRBool promptUser) +{ + SECStatus rv; + dbRestoreInfo info; + certDBEntryContentVersion *oldContentVersion; + certDBArray dbArray; + int i; + + PORT_Memset(&dbArray, 0, sizeof(dbArray)); + PORT_Memset(&info, 0, sizeof(info)); + info.verbose = (outfile) ? PR_TRUE : PR_FALSE; + info.out = (outfile) ? outfile : PR_STDOUT; + info.removeType[dbInvalidCert] = removeExpired; + info.removeType[dbNoSMimeProfile] = requireProfile; + info.removeType[dbOlderCert] = singleEntry; + info.promptUser[dbInvalidCert] = promptUser; + info.promptUser[dbNoSMimeProfile] = promptUser; + info.promptUser[dbOlderCert] = promptUser; + + /* Allocate a handle to fill with CERT_OpenCertDB below. */ + info.handle = PORT_ZNew(NSSLOWCERTCertDBHandle); + if (!info.handle) { + fprintf(stderr, "unable to get database handle"); + return NULL; + } + + /* Create a certdb with the most recent set of roots. */ + rv = CERT_OpenCertDBFilename(info.handle, newdbname, PR_FALSE); + + if (rv) { + fprintf(stderr, "could not open certificate database"); + goto loser; + } + + /* Create certificate, subject, nickname, and email records. + * mcom_db seems to have a sequential access bug. Though reads and writes + * should be allowed during traversal, they seem to screw up the sequence. + * So, stuff all the cert entries into an array, and loop over the array + * doing read/writes in the db. + */ + fillDBEntryArray(oldhandle, certDBEntryTypeCert, &dbArray.certs); + for (elem = PR_LIST_HEAD(&dbArray->certs.link); + elem != &dbArray->certs.link; elem = PR_NEXT_LINK(elem)) { + node = LISTNODE_CAST(elem); + addCertToDB((certDBEntryCert *)&node->entry, &info, oldhandle); + /* entries get destroyed in addCertToDB */ + } +#if 0 + rv = nsslowcert_TraverseDBEntries(oldhandle, certDBEntryTypeSMimeProfile, + copyDBEntry, info.handle); +#endif + +/* Fix up the pointers between (nickname|S/MIME) --> (subject). + * Create S/MIME entries for S/MIME certs. + * Have the S/MIME entry point to the last-expiring cert using + * an email address. + */ +#if 0 + CERT_RedoHandlesForSubjects(info.handle, singleEntry, &info); +#endif + + freeDBEntryList(&dbArray.certs.link); + +/* Copy over the version record. */ +/* XXX Already exists - and _must_ be correct... */ +/* + versionEntry = ReadDBVersionEntry(oldhandle); + rv = WriteDBVersionEntry(info.handle, versionEntry); + */ + +/* Copy over the content version record. */ +/* XXX Can probably get useful info from old content version? + * Was this db created before/after this tool? etc. + */ +#if 0 + oldContentVersion = ReadDBContentVersionEntry(oldhandle); + CERT_SetDBContentVersion(oldContentVersion->contentVersion, info.handle); +#endif + +#if 0 + /* Copy over the CRL & KRL records. */ + rv = nsslowcert_TraverseDBEntries(oldhandle, certDBEntryTypeRevocation, + copyDBEntry, info.handle); + /* XXX Only one KRL, just do db->get? */ + rv = nsslowcert_TraverseDBEntries(oldhandle, certDBEntryTypeKeyRevocation, + copyDBEntry, info.handle); +#endif + + PR_fprintf(info.out, "Database had %d certificates.\n", info.nOldCerts); + + PR_fprintf(info.out, "Reconstructed %d certificates.\n", info.nCerts); + PR_fprintf(info.out, "(ax) Rejected %d expired certificates.\n", + info.dbErrors[dbInvalidCert]); + PR_fprintf(info.out, "(as) Rejected %d S/MIME certificates missing a profile.\n", + info.dbErrors[dbNoSMimeProfile]); + PR_fprintf(info.out, "(ar) Rejected %d certificates for which a newer certificate was found.\n", + info.dbErrors[dbOlderCert]); + PR_fprintf(info.out, " Rejected %d corrupt certificates.\n", + info.dbErrors[dbBadCertificate]); + PR_fprintf(info.out, " Rejected %d certificates which did not write to the DB.\n", + info.dbErrors[dbCertNotWrittenToDB]); + + if (rv) + goto loser; + + return info.handle; + +loser: + if (info.handle) + PORT_Free(info.handle); + return NULL; +} diff --git a/security/nss/cmd/dbck/manifest.mn b/security/nss/cmd/dbck/manifest.mn new file mode 100644 index 0000000000..ec8812edb0 --- /dev/null +++ b/security/nss/cmd/dbck/manifest.mn @@ -0,0 +1,22 @@ +# +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +CORE_DEPTH = ../.. + +DEFINES += -DNSPR20 + +# MODULE public and private header directories are implicitly REQUIRED. +MODULE = nss + +CSRCS = \ + dbck.c \ + $(NULL) + +# The MODULE is always implicitly required. +# Listing it here in REQUIRES makes it appear twice in the cc command line. +REQUIRES = dbm seccmd + +PROGRAM = dbck +USE_STATIC_LIBS = 1 |