Update NSS to 3.21 RTM and NSPR to 4.11 RTM

nss/lib/softoken/pkcs11.c

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /*
  * This file implements PKCS 11 on top of our existing security modules
  *
  * For more information about PKCS 11 See PKCS 11 Token Inteface Standard.
  *   This implementation has two slots:
  *      slot 1 is our generic crypto support. It does not require login.
  *   It supports Public Key ops, and all they bulk ciphers and hashes. 
@@ skipping 378 matching lines @@
      {CKM_SHA256,               {0,   0, CKF_DIGEST},           PR_FALSE},
      {CKM_SHA256_HMAC,          {1, 128, CKF_SN_VR},            PR_TRUE},
      {CKM_SHA256_HMAC_GENERAL,  {1, 128, CKF_SN_VR},            PR_TRUE},
      {CKM_SHA384,               {0,   0, CKF_DIGEST},           PR_FALSE},
      {CKM_SHA384_HMAC,          {1, 128, CKF_SN_VR},            PR_TRUE},
      {CKM_SHA384_HMAC_GENERAL,  {1, 128, CKF_SN_VR},            PR_TRUE},
      {CKM_SHA512,               {0,   0, CKF_DIGEST},           PR_FALSE},
      {CKM_SHA512_HMAC,          {1, 128, CKF_SN_VR},            PR_TRUE},
      {CKM_SHA512_HMAC_GENERAL,  {1, 128, CKF_SN_VR},            PR_TRUE},
      {CKM_TLS_PRF_GENERAL,      {0, 512, CKF_SN_VR},            PR_FALSE},
+     {CKM_TLS_MAC,              {0, 512, CKF_SN_VR},            PR_FALSE},
      {CKM_NSS_TLS_PRF_GENERAL_SHA256,
                                 {0, 512, CKF_SN_VR},            PR_FALSE},
      /* ------------------------- HKDF Operations -------------------------- */
      {CKM_NSS_HKDF_SHA1,        {1, 128, CKF_DERIVE},           PR_TRUE},
      {CKM_NSS_HKDF_SHA256,      {1, 128, CKF_DERIVE},           PR_TRUE},
      {CKM_NSS_HKDF_SHA384,      {1, 128, CKF_DERIVE},           PR_TRUE},
      {CKM_NSS_HKDF_SHA512,      {1, 128, CKF_DERIVE},           PR_TRUE},
      /* ------------------------- CAST Operations --------------------------- */
 #ifdef NSS_SOFTOKEN_DOES_CAST
      /* Cast operations are not supported ( yet? ) */
@@ skipping 49 matching lines @@
      {CKM_SSL3_MD5_MAC,                 { 0, 16, CKF_DERIVE},   PR_FALSE}, 
      {CKM_SSL3_SHA1_MAC,                { 0, 20, CKF_DERIVE},   PR_FALSE}, 
      {CKM_MD5_KEY_DERIVATION,           { 0, 16, CKF_DERIVE},   PR_FALSE}, 
      {CKM_MD2_KEY_DERIVATION,           { 0, 16, CKF_DERIVE},   PR_FALSE}, 
      {CKM_SHA1_KEY_DERIVATION,          { 0, 20, CKF_DERIVE},   PR_FALSE}, 
      {CKM_SHA224_KEY_DERIVATION,        { 0, 28, CKF_DERIVE},   PR_FALSE}, 
      {CKM_SHA256_KEY_DERIVATION,        { 0, 32, CKF_DERIVE},   PR_FALSE}, 
      {CKM_SHA384_KEY_DERIVATION,        { 0, 48, CKF_DERIVE},   PR_FALSE}, 
      {CKM_SHA512_KEY_DERIVATION,        { 0, 64, CKF_DERIVE},   PR_FALSE}, 
      {CKM_TLS_MASTER_KEY_DERIVE,        {48, 48, CKF_DERIVE},   PR_FALSE}, 
+     {CKM_TLS12_MASTER_KEY_DERIVE,      {48, 48, CKF_DERIVE},   PR_FALSE}, 
      {CKM_NSS_TLS_MASTER_KEY_DERIVE_SHA256,
                                         {48, 48, CKF_DERIVE},   PR_FALSE},
      {CKM_TLS_MASTER_KEY_DERIVE_DH,     {8, 128, CKF_DERIVE},   PR_FALSE}, 
+     {CKM_TLS12_MASTER_KEY_DERIVE_DH,   {8, 128, CKF_DERIVE},   PR_FALSE}, 
      {CKM_NSS_TLS_MASTER_KEY_DERIVE_DH_SHA256,
                                         {8, 128, CKF_DERIVE},   PR_FALSE},
      {CKM_TLS_KEY_AND_MAC_DERIVE,       {48, 48, CKF_DERIVE},   PR_FALSE}, 
+     {CKM_TLS12_KEY_AND_MAC_DERIVE,     {48, 48, CKF_DERIVE},   PR_FALSE}, 
      {CKM_NSS_TLS_KEY_AND_MAC_DERIVE_SHA256,
                                         {48, 48, CKF_DERIVE},   PR_FALSE},
+     {CKM_NSS_TLS_EXTENDED_MASTER_KEY_DERIVE,
+                                        {48,128, CKF_DERIVE},   PR_FALSE},
+     {CKM_NSS_TLS_EXTENDED_MASTER_KEY_DERIVE_DH,
+                                        {48,128, CKF_DERIVE},   PR_FALSE},
      /* ---------------------- PBE Key Derivations  ------------------------ */
      {CKM_PBE_MD2_DES_CBC,              {8, 8, CKF_DERIVE},   PR_TRUE},
      {CKM_PBE_MD5_DES_CBC,              {8, 8, CKF_DERIVE},   PR_TRUE},
      /* ------------------ NETSCAPE PBE Key Derivations  ------------------- */
      {CKM_NETSCAPE_PBE_SHA1_DES_CBC,         { 8, 8, CKF_GENERATE}, PR_TRUE},
      {CKM_NETSCAPE_PBE_SHA1_FAULTY_3DES_CBC, {24,24, CKF_GENERATE}, PR_TRUE},
      {CKM_PBE_SHA1_DES3_EDE_CBC,             {24,24, CKF_GENERATE}, PR_TRUE},
      {CKM_PBE_SHA1_DES2_EDE_CBC,             {24,24, CKF_GENERATE}, PR_TRUE},
      {CKM_PBE_SHA1_RC2_40_CBC,               {40,40, CKF_GENERATE}, PR_TRUE},
      {CKM_PBE_SHA1_RC2_128_CBC,              {128,128, CKF_GENERATE}, PR_TRUE},
@@ skipping 1252 matching lines @@
          */
         if (EC_FillParams(arena, &pubKey->u.ec.ecParams.DEREncoding,
                     &pubKey->u.ec.ecParams) != SECSuccess) {
             crv = CKR_DOMAIN_PARAMS_INVALID;
             break;
         }
             
         crv = sftk_Attribute2SSecItem(arena,&pubKey->u.ec.publicValue,
                                       object,CKA_EC_POINT);
         if (crv == CKR_OK) {
-            int keyLen,curveLen;
+            unsigned int keyLen,curveLen;
 
             curveLen = (pubKey->u.ec.ecParams.fieldID.size +7)/8;
             keyLen = (2*curveLen)+1;
 
             /* special note: We can't just use the first byte to determine
              * between these 2 cases because both EC_POINT_FORM_UNCOMPRESSED 
              * and SEC_ASN1_OCTET_STRING are 0x04 */
 
             /* handle the non-DER encoded case (UNCOMPRESSED only) */   
             if (pubKey->u.ec.publicValue.data[0] == EC_POINT_FORM_UNCOMPRESSED
@@ skipping 454 matching lines @@
 CK_RV C_GetFunctionList(CK_FUNCTION_LIST_PTR *pFunctionList)
 {
     CHECK_FORK();
 
     return NSC_GetFunctionList(pFunctionList);
 }
 
 static PLHashNumber
 sftk_HashNumber(const void *key)
 {
-    return (PLHashNumber) key;
+    return (PLHashNumber)((char *)key - (char *)NULL);
 }
 
 /*
  * eventually I'd like to expunge all occurances of XXX_SLOT_ID and
  * just go with the info in the slot. This is one place, however,
  * where it might be a little difficult.
  */
 const char *
 sftk_getDefTokName(CK_SLOT_ID slotID)
 {
@@ skipping 360 matching lines @@
              * do more efficient processing */
             if (session) {
                 slot->head[i] = session->next;
                 if (session->next) session->next->prev = NULL;
                 session->next = session->prev = NULL;
                 SKIP_AFTER_FORK(PZ_Unlock(lock));
                 SKIP_AFTER_FORK(PZ_Lock(slot->slotLock));
                 --slot->sessionCount;
                 SKIP_AFTER_FORK(PZ_Unlock(slot->slotLock));
                 if (session->info.flags & CKF_RW_SESSION) {
-                    PR_ATOMIC_DECREMENT(&slot->rwSessionCount);
+                    (void)PR_ATOMIC_DECREMENT(&slot->rwSessionCount);
                 }
             } else {
                 SKIP_AFTER_FORK(PZ_Unlock(lock));
             }
             if (session) sftk_FreeSession(session);
         } while (session != NULL);
     }
     return CKR_OK;
 }
 
@@ skipping 134 matching lines @@
    /* The legacy database uses the old dbm, which is only linked with the 
     * legacy DB handler, which is only callable from softoken */
 
     secmod = _NSSUTIL_GetSecmodName(parameters, &dbType, &appName,
                                     &filename, &rw);
 
     switch (function) {
     case SECMOD_MODULE_DB_FUNCTION_FIND:
         if (secmod == NULL) {
             PORT_SetError(SEC_ERROR_INVALID_ARGS);
-            return NULL;
+            goto loser;
         }
         if (rw && (dbType != NSS_DB_TYPE_LEGACY) && 
             (dbType != NSS_DB_TYPE_MULTIACCESS)) {
             /* if we get here, we are trying to update the local database */
             /* force data from the legacy DB */
             char *oldSecmod = NULL;
             char *oldAppName = NULL;
             char *oldFilename = NULL;
             PRBool oldrw;
             char **strings = NULL;
@@ skipping 22 matching lines @@
             if (oldFilename) { PORT_Free(oldFilename); }
             rvstr = NSSUTIL_DoModuleDBFunction(function, parameters, args);
             break;
         }
         rvstr = sftkdbCall_ReadSecmodDB(appName,filename,secmod,
                                         (char *)parameters,rw);
         break;
     case SECMOD_MODULE_DB_FUNCTION_ADD:
         if (secmod == NULL) {
             PORT_SetError(SEC_ERROR_INVALID_ARGS);
-            return NULL;
+            goto loser;
         }
         rvstr = (sftkdbCall_AddSecmodDB(appName,filename,secmod,
                         (char *)args,rw) == SECSuccess) ? &success: NULL;
         break;
     case SECMOD_MODULE_DB_FUNCTION_DEL:
         if (secmod == NULL) {
             PORT_SetError(SEC_ERROR_INVALID_ARGS);
-            return NULL;
+            goto loser;
         }
         rvstr = (sftkdbCall_DeleteSecmodDB(appName,filename,secmod,
                         (char *)args,rw) == SECSuccess) ? &success: NULL;
         break;
     case SECMOD_MODULE_DB_FUNCTION_RELEASE:
         rvstr = (sftkdbCall_ReleaseSecmodDBData(appName,filename,secmod,
                         (char **)args,rw) == SECSuccess) ? &success: NULL;
         break;
     }
+
+loser:
     if (secmod) PR_smprintf_free(secmod);
     if (appName) PORT_Free(appName);
     if (filename) PORT_Free(filename);
     return rvstr;
 }
 
 static void nscFreeAllSlots(int moduleIndex)
 {
     /* free all the slots */
     SFTKSlot *slot = NULL;
@@ skipping 301 matching lines @@
         return CKR_OK;
     }
 
     crv = nsc_CommonFinalize (pReserved, PR_FALSE);
 
     nsc_init = (PRBool) !(crv == CKR_OK);
 
     return crv;
 }
 
-extern const char __nss_softokn_rcsid[];
-extern const char __nss_softokn_sccsid[];
+extern const char __nss_softokn_version[];
 
 /* NSC_GetInfo returns general information about Cryptoki. */
 CK_RV  NSC_GetInfo(CK_INFO_PTR pInfo)
 {
-    volatile char c; /* force a reference that won't get optimized away */
+#define NSS_VERSION_VARIABLE __nss_softokn_version
+#include "verref.h"
 
     CHECK_FORK();
     
-    c = __nss_softokn_rcsid[0] + __nss_softokn_sccsid[0]; 
     pInfo->cryptokiVersion.major = 2;
     pInfo->cryptokiVersion.minor = 20;
     PORT_Memcpy(pInfo->manufacturerID,manufacturerID,32);
     pInfo->libraryVersion.major = SOFTOKEN_VMAJOR;
     pInfo->libraryVersion.minor = SOFTOKEN_VMINOR;
     PORT_Memcpy(pInfo->libraryDescription,libraryDescription,32);
     pInfo->flags = 0;
     return CKR_OK;
 }
 
@@ skipping 550 matching lines @@
     if (session == NULL) return CKR_HOST_MEMORY;
 
     if (slot->readOnly && (flags & CKF_RW_SESSION)) {
         /* NETSCAPE_SLOT_ID is Read ONLY */
         session->info.flags &= ~CKF_RW_SESSION;
     }
     PZ_Lock(slot->slotLock);
     ++slot->sessionCount;
     PZ_Unlock(slot->slotLock);
     if (session->info.flags & CKF_RW_SESSION) {
-        PR_ATOMIC_INCREMENT(&slot->rwSessionCount);
+        (void)PR_ATOMIC_INCREMENT(&slot->rwSessionCount);
     }
 
     do {
         PZLock *lock;
         do {
             sessionID = (PR_ATOMIC_INCREMENT(&slot->sessionIDCount) & 0xffffff)
                         | (slot->index << 24);
         } while (sessionID == CK_INVALID_HANDLE);
         lock = SFTK_SESSION_LOCK(slot,sessionID);
         PZ_Lock(lock);
@@ skipping 47 matching lines @@
             slot->isLoggedIn = PR_FALSE;
             if (slot->needLogin && handle) {
                 sftkdb_ClearPassword(handle);
             }
         }
         PZ_Unlock(slot->slotLock);
         if (handle) {
             sftk_freeDB(handle);
         }
         if (session->info.flags & CKF_RW_SESSION) {
-            PR_ATOMIC_DECREMENT(&slot->rwSessionCount);
+            (void)PR_ATOMIC_DECREMENT(&slot->rwSessionCount);
         }
     }
 
     sftk_FreeSession(session);
     return CKR_OK;
 }
 
 
 /* NSC_CloseAllSessions closes all sessions with a token. */
 CK_RV NSC_CloseAllSessions (CK_SLOT_ID slotID)
@@ skipping 197 matching lines @@
  * "object" is the creation object that specifies the module spec for the slot
  * to add or remove.
  */
 static CK_RV sftk_CreateNewSlot(SFTKSlot *slot, CK_OBJECT_CLASS class,
                                 SFTKObject *object)
 {
     PRBool isValidUserSlot = PR_FALSE;
     PRBool isValidFIPSUserSlot = PR_FALSE;
     PRBool isValidSlot = PR_FALSE;
     PRBool isFIPS = PR_FALSE;
-    unsigned long moduleIndex;
+    unsigned long moduleIndex = NSC_NON_FIPS_MODULE;
     SFTKAttribute *attribute;
     sftk_parameters paramStrings;
     char *paramString;
     CK_SLOT_ID slotID = 0;
     SFTKSlot *newSlot = NULL;
     CK_RV crv = CKR_OK;
 
     if (class != CKO_NETSCAPE_DELSLOT && class != CKO_NETSCAPE_NEWSLOT) {
         return CKR_ATTRIBUTE_VALUE_INVALID;
     }
@@ skipping 488 matching lines @@
 /* softoken used to search the SMimeEntries automatically instead of
  * doing this in pk11wrap. This code should really be up in
  * pk11wrap so that it will work with other tokens other than softoken.
  */
 CK_RV
 sftk_emailhack(SFTKSlot *slot, SFTKDBHandle *handle, 
     SFTKSearchResults *search, CK_ATTRIBUTE *pTemplate, CK_ULONG ulCount)
 {
     PRBool isCert = PR_FALSE;
     int emailIndex = -1;
-    int i;
+    unsigned int i;
     SFTKSearchResults smime_search;
     CK_ATTRIBUTE smime_template[2];
     CK_OBJECT_CLASS smime_class = CKO_NETSCAPE_SMIME;
     SFTKAttribute *attribute = NULL;
     SFTKObject *object = NULL;
     CK_RV crv = CKR_OK;
 
 
     smime_search.handles = NULL; /* paranoia, some one is bound to add a goto
                                   * loser before this gets initialized */
@@ skipping 255 matching lines @@
 
 
 CK_RV NSC_WaitForSlotEvent(CK_FLAGS flags, CK_SLOT_ID_PTR pSlot,
                                                          CK_VOID_PTR pReserved)
 {
     CHECK_FORK();
 
     return CKR_FUNCTION_NOT_SUPPORTED;
 }