Add m-esr52 at 52.6.0

1 files changed, 668 insertions, 0 deletions

diff --git a/security/nss/cmd/dbck/dbrecover.c b/security/nss/cmd/dbck/dbrecover.c
new file mode 100644
index 000000000..74d21d85e
--- /dev/null
+++ b/security/nss/cmd/dbck/dbrecover.c
@@ -0,0 +1,668 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+enum {
+    dbInvalidCert = 0,
+    dbNoSMimeProfile,
+    dbOlderCert,
+    dbBadCertificate,
+    dbCertNotWrittenToDB
+};
+
+typedef struct dbRestoreInfoStr {
+    NSSLOWCERTCertDBHandle *handle;
+    PRBool verbose;
+    PRFileDesc *out;
+    int nCerts;
+    int nOldCerts;
+    int dbErrors[5];
+    PRBool removeType[3];
+    PRBool promptUser[3];
+} dbRestoreInfo;
+
+char *
+IsEmailCert(CERTCertificate *cert)
+{
+    char *email, *tmp1, *tmp2;
+    PRBool isCA;
+    int len;
+
+    if (!cert->subjectName) {
+        return NULL;
+    }
+
+    tmp1 = PORT_Strstr(cert->subjectName, "E=");
+    tmp2 = PORT_Strstr(cert->subjectName, "MAIL=");
+    /* XXX Nelson has cert for KTrilli which does not have either
+     * of above but is email cert (has cert->emailAddr).
+     */
+    if (!tmp1 && !tmp2 && !(cert->emailAddr && cert->emailAddr[0])) {
+        return NULL;
+    }
+
+    /*  Server or CA cert, not personal email.  */
+    isCA = CERT_IsCACert(cert, NULL);
+    if (isCA)
+        return NULL;
+
+    /*  XXX CERT_IsCACert advertises checking the key usage ext.,
+        but doesn't appear to. */
+    /*  Check the key usage extension.  */
+    if (cert->keyUsagePresent) {
+        /*  Must at least be able to sign or encrypt (not neccesarily
+         *  both if it is one of a dual cert).
+         */
+        if (!((cert->rawKeyUsage & KU_DIGITAL_SIGNATURE) ||
+              (cert->rawKeyUsage & KU_KEY_ENCIPHERMENT)))
+            return NULL;
+
+        /*  CA cert, not personal email.  */
+        if (cert->rawKeyUsage & (KU_KEY_CERT_SIGN | KU_CRL_SIGN))
+            return NULL;
+    }
+
+    if (cert->emailAddr && cert->emailAddr[0]) {
+        email = PORT_Strdup(cert->emailAddr);
+    } else {
+        if (tmp1)
+            tmp1 += 2; /* "E="  */
+        else
+            tmp1 = tmp2 + 5; /* "MAIL=" */
+        len = strcspn(tmp1, ", ");
+        email = (char *)PORT_Alloc(len + 1);
+        PORT_Strncpy(email, tmp1, len);
+        email[len] = '\0';
+    }
+
+    return email;
+}
+
+SECStatus
+deleteit(CERTCertificate *cert, void *arg)
+{
+    return SEC_DeletePermCertificate(cert);
+}
+
+/*  Different than DeleteCertificate - has the added bonus of removing
+ *  all certs with the same DN.
+ */
+SECStatus
+deleteAllEntriesForCert(NSSLOWCERTCertDBHandle *handle, CERTCertificate *cert,
+                        PRFileDesc *outfile)
+{
+#if 0
+    certDBEntrySubject *subjectEntry;
+    certDBEntryNickname *nicknameEntry;
+    certDBEntrySMime *smimeEntry;
+    int i;
+#endif
+
+    if (outfile) {
+        PR_fprintf(outfile, "$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$\n\n");
+        PR_fprintf(outfile, "Deleting redundant certificate:\n");
+        dumpCertificate(cert, -1, outfile);
+    }
+
+    CERT_TraverseCertsForSubject(handle, cert->subjectList, deleteit, NULL);
+#if 0
+    CERT_LockDB(handle);
+    subjectEntry = ReadDBSubjectEntry(handle, &cert->derSubject);
+    /*  It had better be there, or created a bad db.  */
+    PORT_Assert(subjectEntry);
+    for (i=0; i<subjectEntry->ncerts; i++) {
+        DeleteDBCertEntry(handle, &subjectEntry->certKeys[i]);
+    }
+    DeleteDBSubjectEntry(handle, &cert->derSubject);
+    if (subjectEntry->emailAddr && subjectEntry->emailAddr[0]) {
+        smimeEntry = ReadDBSMimeEntry(handle, subjectEntry->emailAddr);
+        if (smimeEntry) {
+            if (SECITEM_ItemsAreEqual(&subjectEntry->derSubject,
+                                      &smimeEntry->subjectName))
+                /*  Only delete it if it's for this subject!  */
+                DeleteDBSMimeEntry(handle, subjectEntry->emailAddr);
+            SEC_DestroyDBEntry((certDBEntry*)smimeEntry);
+        }
+    }
+    if (subjectEntry->nickname) {
+        nicknameEntry = ReadDBNicknameEntry(handle, subjectEntry->nickname);
+        if (nicknameEntry) {
+            if (SECITEM_ItemsAreEqual(&subjectEntry->derSubject,
+                                      &nicknameEntry->subjectName))
+                /*  Only delete it if it's for this subject!  */
+                DeleteDBNicknameEntry(handle, subjectEntry->nickname);
+            SEC_DestroyDBEntry((certDBEntry*)nicknameEntry);
+        }
+    }
+    SEC_DestroyDBEntry((certDBEntry*)subjectEntry);
+    CERT_UnlockDB(handle);
+#endif
+    return SECSuccess;
+}
+
+void
+getCertsToDelete(char *numlist, int len, int *certNums, int nCerts)
+{
+    int j, num;
+    char *numstr, *numend, *end;
+
+    numstr = numlist;
+    end = numstr + len - 1;
+    while (numstr != end) {
+        numend = strpbrk(numstr, ", \n");
+        *numend = '\0';
+        if (PORT_Strlen(numstr) == 0)
+            return;
+        num = PORT_Atoi(numstr);
+        if (numstr == numlist)
+            certNums[0] = num;
+        for (j = 1; j < nCerts + 1; j++) {
+            if (num == certNums[j]) {
+                certNums[j] = -1;
+                break;
+            }
+        }
+        if (numend == end)
+            break;
+        numstr = strpbrk(numend + 1, "0123456789");
+    }
+}
+
+PRBool
+userSaysDeleteCert(CERTCertificate **certs, int nCerts,
+                   int errtype, dbRestoreInfo *info, int *certNums)
+{
+    char response[32];
+    PRInt32 nb;
+    int i;
+    /*  User wants to remove cert without prompting.  */
+    if (info->promptUser[errtype] == PR_FALSE)
+        return (info->removeType[errtype]);
+    switch (errtype) {
+        case dbInvalidCert:
+            PR_fprintf(PR_STDOUT, "********  Expired ********\n");
+            PR_fprintf(PR_STDOUT, "Cert has expired.\n\n");
+            dumpCertificate(certs[0], -1, PR_STDOUT);
+            PR_fprintf(PR_STDOUT,
+                       "Keep it? (y/n - this one, Y/N - all expired certs) [n] ");
+            break;
+        case dbNoSMimeProfile:
+            PR_fprintf(PR_STDOUT, "********  No Profile ********\n");
+            PR_fprintf(PR_STDOUT, "S/MIME cert has no profile.\n\n");
+            dumpCertificate(certs[0], -1, PR_STDOUT);
+            PR_fprintf(PR_STDOUT,
+                       "Keep it? (y/n - this one, Y/N - all S/MIME w/o profile) [n] ");
+            break;
+        case dbOlderCert:
+            PR_fprintf(PR_STDOUT, "*******  Redundant nickname/email *******\n\n");
+            PR_fprintf(PR_STDOUT, "These certs have the same nickname/email:\n");
+            for (i = 0; i < nCerts; i++)
+                dumpCertificate(certs[i], i, PR_STDOUT);
+            PR_fprintf(PR_STDOUT,
+                       "Enter the certs you would like to keep from those listed above.\n");
+            PR_fprintf(PR_STDOUT,
+                       "Use a comma-separated list of the cert numbers (ex. 0, 8, 12).\n");
+            PR_fprintf(PR_STDOUT,
+                       "The first cert in the list will be the primary cert\n");
+            PR_fprintf(PR_STDOUT,
+                       " accessed by the nickname/email handle.\n");
+            PR_fprintf(PR_STDOUT,
+                       "List cert numbers to keep here, or hit enter\n");
+            PR_fprintf(PR_STDOUT,
+                       " to always keep only the newest cert:  ");
+            break;
+        default:
+    }
+    nb = PR_Read(PR_STDIN, response, sizeof(response));
+    PR_fprintf(PR_STDOUT, "\n\n");
+    if (errtype == dbOlderCert) {
+        if (!isdigit(response[0])) {
+            info->promptUser[errtype] = PR_FALSE;
+            info->removeType[errtype] = PR_TRUE;
+            return PR_TRUE;
+        }
+        getCertsToDelete(response, nb, certNums, nCerts);
+        return PR_TRUE;
+    }
+    /*  User doesn't want to be prompted for this type anymore.  */
+    if (response[0] == 'Y') {
+        info->promptUser[errtype] = PR_FALSE;
+        info->removeType[errtype] = PR_FALSE;
+        return PR_FALSE;
+    } else if (response[0] == 'N') {
+        info->promptUser[errtype] = PR_FALSE;
+        info->removeType[errtype] = PR_TRUE;
+        return PR_TRUE;
+    }
+    return (response[0] != 'y') ? PR_TRUE : PR_FALSE;
+}
+
+SECStatus
+addCertToDB(certDBEntryCert *certEntry, dbRestoreInfo *info,
+            NSSLOWCERTCertDBHandle *oldhandle)
+{
+    SECStatus rv = SECSuccess;
+    PRBool allowOverride;
+    PRBool userCert;
+    SECCertTimeValidity validity;
+    CERTCertificate *oldCert = NULL;
+    CERTCertificate *dbCert = NULL;
+    CERTCertificate *newCert = NULL;
+    CERTCertTrust *trust;
+    certDBEntrySMime *smimeEntry = NULL;
+    char *email = NULL;
+    char *nickname = NULL;
+    int nCertsForSubject = 1;
+
+    oldCert = CERT_DecodeDERCertificate(&certEntry->derCert, PR_FALSE,
+                                        certEntry->nickname);
+    if (!oldCert) {
+        info->dbErrors[dbBadCertificate]++;
+        SEC_DestroyDBEntry((certDBEntry *)certEntry);
+        return SECSuccess;
+    }
+
+    oldCert->dbEntry = certEntry;
+    oldCert->trust = &certEntry->trust;
+    oldCert->dbhandle = oldhandle;
+
+    trust = oldCert->trust;
+
+    info->nOldCerts++;
+
+    if (info->verbose)
+        PR_fprintf(info->out, "%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%\n\n");
+
+    if (oldCert->nickname)
+        nickname = PORT_Strdup(oldCert->nickname);
+
+    /*  Always keep user certs.  Skip ahead.  */
+    /*  XXX if someone sends themselves a signed message, it is possible
+        for their cert to be imported as an "other" cert, not a user cert.
+        this mucks with smime entries...  */
+    userCert = (SEC_GET_TRUST_FLAGS(trust, trustSSL) & CERTDB_USER) ||
+               (SEC_GET_TRUST_FLAGS(trust, trustEmail) & CERTDB_USER) ||
+               (SEC_GET_TRUST_FLAGS(trust, trustObjectSigning) & CERTDB_USER);
+    if (userCert)
+        goto createcert;
+
+    /*  If user chooses so, ignore expired certificates.  */
+    allowOverride = (PRBool)((oldCert->keyUsage == certUsageSSLServer) ||
+                             (oldCert->keyUsage == certUsageSSLServerWithStepUp));
+    validity = CERT_CheckCertValidTimes(oldCert, PR_Now(), allowOverride);
+    /*  If cert expired and user wants to delete it, ignore it. */
+    if ((validity != secCertTimeValid) &&
+        userSaysDeleteCert(&oldCert, 1, dbInvalidCert, info, 0)) {
+        info->dbErrors[dbInvalidCert]++;
+        if (info->verbose) {
+            PR_fprintf(info->out, "Deleting expired certificate:\n");
+            dumpCertificate(oldCert, -1, info->out);
+        }
+        goto cleanup;
+    }
+
+    /*  New database will already have default certs, don't attempt
+        to overwrite them.  */
+    dbCert = CERT_FindCertByDERCert(info->handle, &oldCert->derCert);
+    if (dbCert) {
+        info->nCerts++;
+        if (info->verbose) {
+            PR_fprintf(info->out, "Added certificate to database:\n");
+            dumpCertificate(oldCert, -1, info->out);
+        }
+        goto cleanup;
+    }
+
+    /*  Determine if cert is S/MIME and get its email if so.  */
+    email = IsEmailCert(oldCert);
+
+/*
+        XXX  Just create empty profiles?
+    if (email) {
+        SECItem *profile = CERT_FindSMimeProfile(oldCert);
+        if (!profile &&
+            userSaysDeleteCert(&oldCert, 1, dbNoSMimeProfile, info, 0)) {
+            info->dbErrors[dbNoSMimeProfile]++;
+            if (info->verbose) {
+                PR_fprintf(info->out,
+                           "Deleted cert missing S/MIME profile.\n");
+                dumpCertificate(oldCert, -1, info->out);
+            }
+            goto cleanup;
+        } else {
+            SECITEM_FreeItem(profile);
+        }
+    }
+    */
+
+createcert:
+
+    /*  Sometimes happens... */
+    if (!nickname && userCert)
+        nickname = PORT_Strdup(oldCert->subjectName);
+
+    /*  Create a new certificate, copy of the old one.  */
+    newCert = CERT_NewTempCertificate(info->handle, &oldCert->derCert,
+                                      nickname, PR_FALSE, PR_TRUE);
+    if (!newCert) {
+        PR_fprintf(PR_STDERR, "Unable to create new certificate.\n");
+        dumpCertificate(oldCert, -1, PR_STDERR);
+        info->dbErrors[dbBadCertificate]++;
+        goto cleanup;
+    }
+
+    /*  Add the cert to the new database.  */
+    rv = CERT_AddTempCertToPerm(newCert, nickname, oldCert->trust);
+    if (rv) {
+        PR_fprintf(PR_STDERR, "Failed to write temp cert to perm database.\n");
+        dumpCertificate(oldCert, -1, PR_STDERR);
+        info->dbErrors[dbCertNotWrittenToDB]++;
+        goto cleanup;
+    }
+
+    if (info->verbose) {
+        PR_fprintf(info->out, "Added certificate to database:\n");
+        dumpCertificate(oldCert, -1, info->out);
+    }
+
+    /*  If the cert is an S/MIME cert, and the first with it's subject,
+     *  modify the subject entry to include the email address,
+     *  CERT_AddTempCertToPerm does not do email addresses and S/MIME entries.
+     */
+    if (smimeEntry) { /*&& !userCert && nCertsForSubject == 1) { */
+#if 0
+        UpdateSubjectWithEmailAddr(newCert, email);
+#endif
+        SECItem emailProfile, profileTime;
+        rv = CERT_FindFullSMimeProfile(oldCert, &emailProfile, &profileTime);
+        /*  calls UpdateSubjectWithEmailAddr  */
+        if (rv == SECSuccess)
+            rv = CERT_SaveSMimeProfile(newCert, &emailProfile, &profileTime);
+    }
+
+    info->nCerts++;
+
+cleanup:
+
+    if (nickname)
+        PORT_Free(nickname);
+    if (email)
+        PORT_Free(email);
+    if (oldCert)
+        CERT_DestroyCertificate(oldCert);
+    if (dbCert)
+        CERT_DestroyCertificate(dbCert);
+    if (newCert)
+        CERT_DestroyCertificate(newCert);
+    if (smimeEntry)
+        SEC_DestroyDBEntry((certDBEntry *)smimeEntry);
+    return SECSuccess;
+}
+
+#if 0
+SECStatus
+copyDBEntry(SECItem *data, SECItem *key, certDBEntryType type, void *pdata)
+{
+    SECStatus rv;
+    NSSLOWCERTCertDBHandle *newdb = (NSSLOWCERTCertDBHandle *)pdata;
+    certDBEntryCommon common;
+    SECItem dbkey;
+
+    common.type = type;
+    common.version = CERT_DB_FILE_VERSION;
+    common.flags = data->data[2];
+    common.arena = NULL;
+
+    dbkey.len = key->len + SEC_DB_KEY_HEADER_LEN;
+    dbkey.data = (unsigned char *)PORT_Alloc(dbkey.len*sizeof(unsigned char));
+    PORT_Memcpy(&dbkey.data[SEC_DB_KEY_HEADER_LEN], key->data, key->len);
+    dbkey.data[0] = type;
+
+    rv = WriteDBEntry(newdb, &common, &dbkey, data);
+
+    PORT_Free(dbkey.data);
+    return rv;
+}
+#endif
+
+int
+certIsOlder(CERTCertificate **cert1, CERTCertificate **cert2)
+{
+    return !CERT_IsNewer(*cert1, *cert2);
+}
+
+int
+findNewestSubjectForEmail(NSSLOWCERTCertDBHandle *handle, int subjectNum,
+                          certDBArray *dbArray, dbRestoreInfo *info,
+                          int *subjectWithSMime, int *smimeForSubject)
+{
+    int newestSubject;
+    int subjectsForEmail[50];
+    int i, j, ns, sNum;
+    certDBEntryListNode *subjects = &dbArray->subjects;
+    certDBEntryListNode *smime = &dbArray->smime;
+    certDBEntrySubject *subjectEntry1, *subjectEntry2;
+    certDBEntrySMime *smimeEntry;
+    CERTCertificate **certs;
+    CERTCertificate *cert;
+    CERTCertTrust *trust;
+    PRBool userCert;
+    int *certNums;
+
+    ns = 0;
+    subjectEntry1 = (certDBEntrySubject *)&subjects.entries[subjectNum];
+    subjectsForEmail[ns++] = subjectNum;
+
+    *subjectWithSMime = -1;
+    *smimeForSubject = -1;
+    newestSubject = subjectNum;
+
+    cert = CERT_FindCertByKey(handle, &subjectEntry1->certKeys[0]);
+    if (cert) {
+        trust = cert->trust;
+        userCert = (SEC_GET_TRUST_FLAGS(trust, trustSSL) & CERTDB_USER) ||
+                   (SEC_GET_TRUST_FLAGS(trust, trustEmail) & CERTDB_USER) ||
+                   (SEC_GET_TRUST_FLAGS(trust, trustObjectSigning) & CERTDB_USER);
+        CERT_DestroyCertificate(cert);
+    }
+
+    /*
+     * XXX Should we make sure that subjectEntry1->emailAddr is not
+     * a null pointer or an empty string before going into the next
+     * two for loops, which pass it to PORT_Strcmp?
+     */
+
+    /*  Loop over the remaining subjects.  */
+    for (i = subjectNum + 1; i < subjects.numEntries; i++) {
+        subjectEntry2 = (certDBEntrySubject *)&subjects.entries[i];
+        if (!subjectEntry2)
+            continue;
+        if (subjectEntry2->emailAddr && subjectEntry2->emailAddr[0] &&
+            PORT_Strcmp(subjectEntry1->emailAddr,
+                        subjectEntry2->emailAddr) == 0) {
+            /*  Found a subject using the same email address.  */
+            subjectsForEmail[ns++] = i;
+        }
+    }
+
+    /*  Find the S/MIME entry for this email address.  */
+    for (i = 0; i < smime.numEntries; i++) {
+        smimeEntry = (certDBEntrySMime *)&smime.entries[i];
+        if (smimeEntry->common.arena == NULL)
+            continue;
+        if (smimeEntry->emailAddr && smimeEntry->emailAddr[0] &&
+            PORT_Strcmp(subjectEntry1->emailAddr, smimeEntry->emailAddr) == 0) {
+            /*  Find which of the subjects uses this S/MIME entry.  */
+            for (j = 0; j < ns && *subjectWithSMime < 0; j++) {
+                sNum = subjectsForEmail[j];
+                subjectEntry2 = (certDBEntrySubject *)&subjects.entries[sNum];
+                if (SECITEM_ItemsAreEqual(&smimeEntry->subjectName,
+                                          &subjectEntry2->derSubject)) {
+                    /*  Found the subject corresponding to the S/MIME entry. */
+                    *subjectWithSMime = sNum;
+                    *smimeForSubject = i;
+                }
+            }
+            SEC_DestroyDBEntry((certDBEntry *)smimeEntry);
+            PORT_Memset(smimeEntry, 0, sizeof(certDBEntry));
+            break;
+        }
+    }
+
+    if (ns <= 1)
+        return subjectNum;
+
+    if (userCert)
+        return *subjectWithSMime;
+
+    /*  Now find which of the subjects has the newest cert.  */
+    certs = (CERTCertificate **)PORT_Alloc(ns * sizeof(CERTCertificate *));
+    certNums = (int *)PORT_Alloc((ns + 1) * sizeof(int));
+    certNums[0] = 0;
+    for (i = 0; i < ns; i++) {
+        sNum = subjectsForEmail[i];
+        subjectEntry1 = (certDBEntrySubject *)&subjects.entries[sNum];
+        certs[i] = CERT_FindCertByKey(handle, &subjectEntry1->certKeys[0]);
+        certNums[i + 1] = i;
+    }
+    /*  Sort the array by validity.  */
+    qsort(certs, ns, sizeof(CERTCertificate *),
+          (int (*)(const void *, const void *))certIsOlder);
+    newestSubject = -1;
+    for (i = 0; i < ns; i++) {
+        sNum = subjectsForEmail[i];
+        subjectEntry1 = (certDBEntrySubject *)&subjects.entries[sNum];
+        if (SECITEM_ItemsAreEqual(&subjectEntry1->derSubject,
+                                  &certs[0]->derSubject))
+            newestSubject = sNum;
+        else
+            SEC_DestroyDBEntry((certDBEntry *)subjectEntry1);
+    }
+    if (info && userSaysDeleteCert(certs, ns, dbOlderCert, info, certNums)) {
+        for (i = 1; i < ns + 1; i++) {
+            if (certNums[i] >= 0 && certNums[i] != certNums[0]) {
+                deleteAllEntriesForCert(handle, certs[certNums[i]], info->out);
+                info->dbErrors[dbOlderCert]++;
+            }
+        }
+    }
+    CERT_DestroyCertArray(certs, ns);
+    return newestSubject;
+}
+
+NSSLOWCERTCertDBHandle *
+DBCK_ReconstructDBFromCerts(NSSLOWCERTCertDBHandle *oldhandle, char *newdbname,
+                            PRFileDesc *outfile, PRBool removeExpired,
+                            PRBool requireProfile, PRBool singleEntry,
+                            PRBool promptUser)
+{
+    SECStatus rv;
+    dbRestoreInfo info;
+    certDBEntryContentVersion *oldContentVersion;
+    certDBArray dbArray;
+    int i;
+
+    PORT_Memset(&dbArray, 0, sizeof(dbArray));
+    PORT_Memset(&info, 0, sizeof(info));
+    info.verbose = (outfile) ? PR_TRUE : PR_FALSE;
+    info.out = (outfile) ? outfile : PR_STDOUT;
+    info.removeType[dbInvalidCert] = removeExpired;
+    info.removeType[dbNoSMimeProfile] = requireProfile;
+    info.removeType[dbOlderCert] = singleEntry;
+    info.promptUser[dbInvalidCert] = promptUser;
+    info.promptUser[dbNoSMimeProfile] = promptUser;
+    info.promptUser[dbOlderCert] = promptUser;
+
+    /*  Allocate a handle to fill with CERT_OpenCertDB below.  */
+    info.handle = PORT_ZNew(NSSLOWCERTCertDBHandle);
+    if (!info.handle) {
+        fprintf(stderr, "unable to get database handle");
+        return NULL;
+    }
+
+    /*  Create a certdb with the most recent set of roots.  */
+    rv = CERT_OpenCertDBFilename(info.handle, newdbname, PR_FALSE);
+
+    if (rv) {
+        fprintf(stderr, "could not open certificate database");
+        goto loser;
+    }
+
+    /*  Create certificate, subject, nickname, and email records.
+     *  mcom_db seems to have a sequential access bug.  Though reads and writes
+     *  should be allowed during traversal, they seem to screw up the sequence.
+     *  So, stuff all the cert entries into an array, and loop over the array
+     *  doing read/writes in the db.
+     */
+    fillDBEntryArray(oldhandle, certDBEntryTypeCert, &dbArray.certs);
+    for (elem = PR_LIST_HEAD(&dbArray->certs.link);
+         elem != &dbArray->certs.link; elem = PR_NEXT_LINK(elem)) {
+        node = LISTNODE_CAST(elem);
+        addCertToDB((certDBEntryCert *)&node->entry, &info, oldhandle);
+        /* entries get destroyed in addCertToDB */
+    }
+#if 0
+    rv = nsslowcert_TraverseDBEntries(oldhandle, certDBEntryTypeSMimeProfile,
+                               copyDBEntry, info.handle);
+#endif
+
+/*  Fix up the pointers between (nickname|S/MIME) --> (subject).
+     *  Create S/MIME entries for S/MIME certs.
+     *  Have the S/MIME entry point to the last-expiring cert using
+     *  an email address.
+     */
+#if 0
+    CERT_RedoHandlesForSubjects(info.handle, singleEntry, &info);
+#endif
+
+    freeDBEntryList(&dbArray.certs.link);
+
+/*  Copy over the version record.  */
+/*  XXX Already exists - and _must_ be correct... */
+/*
+    versionEntry = ReadDBVersionEntry(oldhandle);
+    rv = WriteDBVersionEntry(info.handle, versionEntry);
+    */
+
+/*  Copy over the content version record.  */
+/*  XXX Can probably get useful info from old content version?
+     *      Was this db created before/after this tool?  etc.
+     */
+#if 0
+    oldContentVersion = ReadDBContentVersionEntry(oldhandle);
+    CERT_SetDBContentVersion(oldContentVersion->contentVersion, info.handle);
+#endif
+
+#if 0
+    /*  Copy over the CRL & KRL records.  */
+    rv = nsslowcert_TraverseDBEntries(oldhandle, certDBEntryTypeRevocation,
+                               copyDBEntry, info.handle);
+    /*  XXX Only one KRL, just do db->get? */
+    rv = nsslowcert_TraverseDBEntries(oldhandle, certDBEntryTypeKeyRevocation,
+                               copyDBEntry, info.handle);
+#endif
+
+    PR_fprintf(info.out, "Database had %d certificates.\n", info.nOldCerts);
+
+    PR_fprintf(info.out, "Reconstructed %d certificates.\n", info.nCerts);
+    PR_fprintf(info.out, "(ax) Rejected %d expired certificates.\n",
+               info.dbErrors[dbInvalidCert]);
+    PR_fprintf(info.out, "(as) Rejected %d S/MIME certificates missing a profile.\n",
+               info.dbErrors[dbNoSMimeProfile]);
+    PR_fprintf(info.out, "(ar) Rejected %d certificates for which a newer certificate was found.\n",
+               info.dbErrors[dbOlderCert]);
+    PR_fprintf(info.out, "     Rejected %d corrupt certificates.\n",
+               info.dbErrors[dbBadCertificate]);
+    PR_fprintf(info.out, "     Rejected %d certificates which did not write to the DB.\n",
+               info.dbErrors[dbCertNotWrittenToDB]);
+
+    if (rv)
+        goto loser;
+
+    return info.handle;
+
+loser:
+    if (info.handle)
+        PORT_Free(info.handle);
+    return NULL;
+}