From fba28f19754f62b5227650143d5441fc86d4c7d7 Mon Sep 17 00:00:00 2001 From: wolfbeast Date: Wed, 25 Apr 2018 21:33:33 +0200 Subject: Revert "Update NSS to 3.35-RTM" This reverts commit f1a0f0a56fdd0fc39f255174ce08c06b91c66c94. --- security/nss/lib/softoken/pkcs11c.c | 239 +++++------------------------------- 1 file changed, 33 insertions(+), 206 deletions(-) (limited to 'security/nss/lib/softoken/pkcs11c.c') diff --git a/security/nss/lib/softoken/pkcs11c.c b/security/nss/lib/softoken/pkcs11c.c index d675d7331..0234aa431 100644 --- a/security/nss/lib/softoken/pkcs11c.c +++ b/security/nss/lib/softoken/pkcs11c.c @@ -65,6 +65,7 @@ sftk_Null(void *data, PRBool freeit) return; } +#ifndef NSS_DISABLE_ECC #ifdef EC_DEBUG #define SEC_PRINT(str1, str2, num, sitem) \ printf("pkcs11c.c:%s:%s (keytype=%d) [len=%d]\n", \ @@ -77,6 +78,7 @@ sftk_Null(void *data, PRBool freeit) #undef EC_DEBUG #define SEC_PRINT(a, b, c, d) #endif +#endif /* NSS_DISABLE_ECC */ /* * free routines.... Free local type allocated data, and convert @@ -122,6 +124,7 @@ sftk_MapCryptError(int error) return CKR_KEY_SIZE_RANGE; /* the closest error code */ case SEC_ERROR_UNSUPPORTED_EC_POINT_FORM: return CKR_TEMPLATE_INCONSISTENT; + /* EC functions set this error if NSS_DISABLE_ECC is defined */ case SEC_ERROR_UNSUPPORTED_KEYALG: return CKR_MECHANISM_INVALID; case SEC_ERROR_UNSUPPORTED_ELLIPTIC_CURVE: @@ -1524,7 +1527,8 @@ NSC_DecryptUpdate(CK_SESSION_HANDLE hSession, maxout -= padoutlen; } /* now save the final block for the next decrypt or the final */ - PORT_Memcpy(context->padBuf, &pEncryptedPart[ulEncryptedPartLen - context->blockSize], + PORT_Memcpy(context->padBuf, &pEncryptedPart[ulEncryptedPartLen - + context->blockSize], context->blockSize); context->padDataLength = context->blockSize; ulEncryptedPartLen -= context->padDataLength; @@ -2413,6 +2417,7 @@ nsc_DSA_Sign_Stub(void *ctx, void *sigBuf, return rv; } +#ifndef NSS_DISABLE_ECC static SECStatus nsc_ECDSAVerifyStub(void *ctx, void *sigBuf, unsigned int sigLen, void *dataBuf, unsigned int dataLen) @@ -2447,6 +2452,7 @@ nsc_ECDSASignStub(void *ctx, void *sigBuf, *sigLen = signature.len; return rv; } +#endif /* NSS_DISABLE_ECC */ /* NSC_SignInit setups up the signing operations. There are three basic * types of signing: @@ -2606,6 +2612,7 @@ NSC_SignInit(CK_SESSION_HANDLE hSession, break; +#ifndef NSS_DISABLE_ECC case CKM_ECDSA_SHA1: context->multi = PR_TRUE; crv = sftk_doSubSHA1(context); @@ -2628,6 +2635,7 @@ NSC_SignInit(CK_SESSION_HANDLE hSession, context->maxLen = MAX_ECKEY_LEN * 2; break; +#endif /* NSS_DISABLE_ECC */ #define INIT_HMAC_MECH(mmm) \ case CKM_##mmm##_HMAC_GENERAL: \ @@ -3295,6 +3303,7 @@ NSC_VerifyInit(CK_SESSION_HANDLE hSession, context->verify = (SFTKVerify)nsc_DSA_Verify_Stub; context->destroy = sftk_Null; break; +#ifndef NSS_DISABLE_ECC case CKM_ECDSA_SHA1: context->multi = PR_TRUE; crv = sftk_doSubSHA1(context); @@ -3315,6 +3324,7 @@ NSC_VerifyInit(CK_SESSION_HANDLE hSession, context->verify = (SFTKVerify)nsc_ECDSAVerifyStub; context->destroy = sftk_Null; break; +#endif /* NSS_DISABLE_ECC */ INIT_HMAC_MECH(MD2) INIT_HMAC_MECH(MD5) @@ -4614,10 +4624,12 @@ sftk_PairwiseConsistencyCheck(CK_SESSION_HANDLE hSession, pairwise_digest_length = subPrimeLen; mech.mechanism = CKM_DSA; break; +#ifndef NSS_DISABLE_ECC case CKK_EC: signature_length = MAX_ECKEY_LEN * 2; mech.mechanism = CKM_ECDSA; break; +#endif default: return CKR_DEVICE_ERROR; } @@ -4734,10 +4746,12 @@ NSC_GenerateKeyPair(CK_SESSION_HANDLE hSession, /* Diffie Hellman */ DHPrivateKey *dhPriv; +#ifndef NSS_DISABLE_ECC /* Elliptic Curve Cryptography */ SECItem ecEncodedParams; /* DER Encoded parameters */ ECPrivateKey *ecPriv; ECParams *ecParams; +#endif /* NSS_DISABLE_ECC */ CHECK_FORK(); @@ -5083,6 +5097,7 @@ NSC_GenerateKeyPair(CK_SESSION_HANDLE hSession, PORT_FreeArena(dhPriv->arena, PR_TRUE); break; +#ifndef NSS_DISABLE_ECC case CKM_EC_KEY_PAIR_GEN: sftk_DeleteAttributeType(privateKey, CKA_EC_PARAMS); sftk_DeleteAttributeType(privateKey, CKA_VALUE); @@ -5151,6 +5166,7 @@ NSC_GenerateKeyPair(CK_SESSION_HANDLE hSession, /* should zeroize, since this function doesn't. */ PORT_FreeArena(ecPriv->ecParams.arena, PR_TRUE); break; +#endif /* NSS_DISABLE_ECC */ default: crv = CKR_MECHANISM_INVALID; @@ -5280,10 +5296,12 @@ sftk_PackagePrivateKey(SFTKObject *key, CK_RV *crvp) void *dummy, *param = NULL; SECStatus rv = SECSuccess; SECItem *encodedKey = NULL; +#ifndef NSS_DISABLE_ECC #ifdef EC_DEBUG SECItem *fordebug; #endif int savelen; +#endif if (!key) { *crvp = CKR_KEY_HANDLE_INVALID; /* really can't happen */ @@ -5335,6 +5353,7 @@ sftk_PackagePrivateKey(SFTKObject *key, CK_RV *crvp) nsslowkey_PQGParamsTemplate); algorithm = SEC_OID_ANSIX9_DSA_SIGNATURE; break; +#ifndef NSS_DISABLE_ECC case NSSLOWKEYECKey: prepare_low_ec_priv_key_for_asn1(lk); /* Public value is encoded as a bit string so adjust length @@ -5363,6 +5382,7 @@ sftk_PackagePrivateKey(SFTKObject *key, CK_RV *crvp) algorithm = SEC_OID_ANSIX962_EC_PUBLIC_KEY; break; +#endif /* NSS_DISABLE_ECC */ case NSSLOWKEYDHKey: default: dummy = NULL; @@ -5621,7 +5641,8 @@ sftk_unwrapPrivateKey(SFTKObject *key, SECItem *bpki) prepare_low_dsa_priv_key_export_for_asn1(lpk); prepare_low_pqg_params_for_asn1(&lpk->u.dsa.params); break; - /* case NSSLOWKEYDHKey: */ +/* case NSSLOWKEYDHKey: */ +#ifndef NSS_DISABLE_ECC case SEC_OID_ANSIX962_EC_PUBLIC_KEY: keyTemplate = nsslowkey_ECPrivateKeyTemplate; paramTemplate = NULL; @@ -5630,6 +5651,7 @@ sftk_unwrapPrivateKey(SFTKObject *key, SECItem *bpki) prepare_low_ec_priv_key_for_asn1(lpk); prepare_low_ecparams_for_asn1(&lpk->u.ec.ecParams); break; +#endif /* NSS_DISABLE_ECC */ default: keyTemplate = NULL; paramTemplate = NULL; @@ -5644,6 +5666,7 @@ sftk_unwrapPrivateKey(SFTKObject *key, SECItem *bpki) /* decode the private key and any algorithm parameters */ rv = SEC_QuickDERDecodeItem(arena, lpk, keyTemplate, &pki->privateKey); +#ifndef NSS_DISABLE_ECC if (lpk->keyType == NSSLOWKEYECKey) { /* convert length in bits to length in bytes */ lpk->u.ec.publicValue.len >>= 3; @@ -5654,6 +5677,7 @@ sftk_unwrapPrivateKey(SFTKObject *key, SECItem *bpki) goto loser; } } +#endif /* NSS_DISABLE_ECC */ if (rv != SECSuccess) { goto loser; @@ -5766,7 +5790,8 @@ sftk_unwrapPrivateKey(SFTKObject *key, SECItem *bpki) keyType = CKK_DH; break; #endif - /* what about fortezza??? */ +/* what about fortezza??? */ +#ifndef NSS_DISABLE_ECC case NSSLOWKEYECKey: keyType = CKK_EC; crv = (sftk_hasAttribute(key, CKA_NETSCAPE_DB)) ? CKR_OK : CKR_KEY_TYPE_INCONSISTENT; @@ -5798,6 +5823,7 @@ sftk_unwrapPrivateKey(SFTKObject *key, SECItem *bpki) break; /* XXX Do we need to decode the EC Params here ?? */ break; +#endif /* NSS_DISABLE_ECC */ default: crv = CKR_KEY_TYPE_INCONSISTENT; break; @@ -6127,6 +6153,7 @@ sftk_MapKeySize(CK_KEY_TYPE keyType) return 0; } +#ifndef NSS_DISABLE_ECC /* Inputs: * key_len: Length of derived key to be generated. * SharedSecret: a shared secret that is the output of a key agreement primitive. @@ -6239,43 +6266,7 @@ sftk_ANSI_X9_63_kdf(CK_BYTE **key, CK_ULONG key_len, else return CKR_MECHANISM_INVALID; } - -/* - * Handle the derive from a block encryption cipher - */ -CK_RV -sftk_DeriveEncrypt(SFTKCipher encrypt, void *cipherInfo, - int blockSize, SFTKObject *key, CK_ULONG keySize, - unsigned char *data, CK_ULONG len) -{ - /* large enough for a 512-bit key */ - unsigned char tmpdata[SFTK_MAX_DERIVE_KEY_SIZE]; - SECStatus rv; - unsigned int outLen; - CK_RV crv; - - if ((len % blockSize) != 0) { - return CKR_MECHANISM_PARAM_INVALID; - } - if (len > SFTK_MAX_DERIVE_KEY_SIZE) { - return CKR_MECHANISM_PARAM_INVALID; - } - if (keySize && (len < keySize)) { - return CKR_MECHANISM_PARAM_INVALID; - } - if (keySize == 0) { - keySize = len; - } - - rv = (*encrypt)(cipherInfo, &tmpdata, &outLen, len, data, len); - if (rv != SECSuccess) { - crv = sftk_MapCryptError(PORT_GetError()); - return crv; - } - - crv = sftk_forceAttribute(key, CKA_VALUE, tmpdata, keySize); - return crv; -} +#endif /* NSS_DISABLE_ECC */ /* * SSL Key generation given pre master secret @@ -6935,172 +6926,6 @@ NSC_DeriveKey(CK_SESSION_HANDLE hSession, break; } - case CKM_DES3_ECB_ENCRYPT_DATA: - case CKM_DES3_CBC_ENCRYPT_DATA: { - void *cipherInfo; - unsigned char des3key[MAX_DES3_KEY_SIZE]; - CK_DES_CBC_ENCRYPT_DATA_PARAMS *desEncryptPtr; - int mode; - unsigned char *iv; - unsigned char *data; - CK_ULONG len; - - if (mechanism == CKM_DES3_ECB_ENCRYPT_DATA) { - stringPtr = (CK_KEY_DERIVATION_STRING_DATA *) - pMechanism->pParameter; - mode = NSS_DES_EDE3; - iv = NULL; - data = stringPtr->pData; - len = stringPtr->ulLen; - } else { - mode = NSS_DES_EDE3_CBC; - desEncryptPtr = - (CK_DES_CBC_ENCRYPT_DATA_PARAMS *) - pMechanism->pParameter; - iv = desEncryptPtr->iv; - data = desEncryptPtr->pData; - len = desEncryptPtr->length; - } - if (att->attrib.ulValueLen == 16) { - PORT_Memcpy(des3key, att->attrib.pValue, 16); - PORT_Memcpy(des3key + 16, des3key, 8); - } else if (att->attrib.ulValueLen == 24) { - PORT_Memcpy(des3key, att->attrib.pValue, 24); - } else { - crv = CKR_KEY_SIZE_RANGE; - break; - } - cipherInfo = DES_CreateContext(des3key, iv, mode, PR_TRUE); - PORT_Memset(des3key, 0, 24); - if (cipherInfo == NULL) { - crv = CKR_HOST_MEMORY; - break; - } - crv = sftk_DeriveEncrypt((SFTKCipher)DES_Encrypt, - cipherInfo, 8, key, keySize, - data, len); - DES_DestroyContext(cipherInfo, PR_TRUE); - break; - } - - case CKM_AES_ECB_ENCRYPT_DATA: - case CKM_AES_CBC_ENCRYPT_DATA: { - void *cipherInfo; - CK_AES_CBC_ENCRYPT_DATA_PARAMS *aesEncryptPtr; - int mode; - unsigned char *iv; - unsigned char *data; - CK_ULONG len; - - if (mechanism == CKM_AES_ECB_ENCRYPT_DATA) { - mode = NSS_AES; - iv = NULL; - stringPtr = (CK_KEY_DERIVATION_STRING_DATA *)pMechanism->pParameter; - data = stringPtr->pData; - len = stringPtr->ulLen; - } else { - aesEncryptPtr = - (CK_AES_CBC_ENCRYPT_DATA_PARAMS *)pMechanism->pParameter; - mode = NSS_AES_CBC; - iv = aesEncryptPtr->iv; - data = aesEncryptPtr->pData; - len = aesEncryptPtr->length; - } - - cipherInfo = AES_CreateContext((unsigned char *)att->attrib.pValue, - iv, mode, PR_TRUE, - att->attrib.ulValueLen, 16); - if (cipherInfo == NULL) { - crv = CKR_HOST_MEMORY; - break; - } - crv = sftk_DeriveEncrypt((SFTKCipher)AES_Encrypt, - cipherInfo, 16, key, keySize, - data, len); - AES_DestroyContext(cipherInfo, PR_TRUE); - break; - } - - case CKM_CAMELLIA_ECB_ENCRYPT_DATA: - case CKM_CAMELLIA_CBC_ENCRYPT_DATA: { - void *cipherInfo; - CK_AES_CBC_ENCRYPT_DATA_PARAMS *aesEncryptPtr; - int mode; - unsigned char *iv; - unsigned char *data; - CK_ULONG len; - - if (mechanism == CKM_CAMELLIA_ECB_ENCRYPT_DATA) { - stringPtr = (CK_KEY_DERIVATION_STRING_DATA *) - pMechanism->pParameter; - aesEncryptPtr = NULL; - mode = NSS_CAMELLIA; - data = stringPtr->pData; - len = stringPtr->ulLen; - iv = NULL; - } else { - stringPtr = NULL; - aesEncryptPtr = (CK_AES_CBC_ENCRYPT_DATA_PARAMS *) - pMechanism->pParameter; - mode = NSS_CAMELLIA_CBC; - iv = aesEncryptPtr->iv; - data = aesEncryptPtr->pData; - len = aesEncryptPtr->length; - } - - cipherInfo = Camellia_CreateContext((unsigned char *)att->attrib.pValue, - iv, mode, PR_TRUE, - att->attrib.ulValueLen); - if (cipherInfo == NULL) { - crv = CKR_HOST_MEMORY; - break; - } - crv = sftk_DeriveEncrypt((SFTKCipher)Camellia_Encrypt, - cipherInfo, 16, key, keySize, - data, len); - Camellia_DestroyContext(cipherInfo, PR_TRUE); - break; - } - - case CKM_SEED_ECB_ENCRYPT_DATA: - case CKM_SEED_CBC_ENCRYPT_DATA: { - void *cipherInfo; - CK_AES_CBC_ENCRYPT_DATA_PARAMS *aesEncryptPtr; - int mode; - unsigned char *iv; - unsigned char *data; - CK_ULONG len; - - if (mechanism == CKM_SEED_ECB_ENCRYPT_DATA) { - mode = NSS_SEED; - stringPtr = (CK_KEY_DERIVATION_STRING_DATA *) - pMechanism->pParameter; - aesEncryptPtr = NULL; - data = stringPtr->pData; - len = stringPtr->ulLen; - iv = NULL; - } else { - mode = NSS_SEED_CBC; - aesEncryptPtr = (CK_AES_CBC_ENCRYPT_DATA_PARAMS *) - pMechanism->pParameter; - iv = aesEncryptPtr->iv; - data = aesEncryptPtr->pData; - len = aesEncryptPtr->length; - } - - cipherInfo = SEED_CreateContext((unsigned char *)att->attrib.pValue, - iv, mode, PR_TRUE); - if (cipherInfo == NULL) { - crv = CKR_HOST_MEMORY; - break; - } - crv = sftk_DeriveEncrypt((SFTKCipher)SEED_Encrypt, - cipherInfo, 16, key, keySize, - data, len); - SEED_DestroyContext(cipherInfo, PR_TRUE); - break; - } - case CKM_CONCATENATE_BASE_AND_KEY: { SFTKObject *newKey; @@ -7417,6 +7242,7 @@ NSC_DeriveKey(CK_SESSION_HANDLE hSession, break; } +#ifndef NSS_DISABLE_ECC case CKM_ECDH1_DERIVE: case CKM_ECDH1_COFACTOR_DERIVE: { SECItem ecScalar, ecPoint; @@ -7556,6 +7382,7 @@ NSC_DeriveKey(CK_SESSION_HANDLE hSession, } break; } +#endif /* NSS_DISABLE_ECC */ /* See RFC 5869 and CK_NSS_HKDFParams for documentation. */ case CKM_NSS_HKDF_SHA1: -- cgit v1.2.3