aheinecke@404: /* Copyright (C) 2014 by Bundesamt für Sicherheit in der Informationstechnik
aheinecke@404:  * Software engineering by Intevation GmbH
aheinecke@404:  *
aheinecke@404:  * This file is Free Software under the GNU GPL (v>=2)
aheinecke@404:  * and comes with ABSOLUTELY NO WARRANTY!
aheinecke@404:  * See LICENSE.txt for details.
aheinecke@404:  */
wilde@121: /**
wilde@121:  * @file
wilde@121:  * @brief Mozilla installation process
aheinecke@99:  *
wilde@315:  * Reads from a file given on command line or stdin a list of
wilde@315:  * instructions in the form:
aheinecke@99:  *
aheinecke@238:  * I:<base64 DER econded certificate>
aheinecke@238:  * R:<base64 DER econded certificate>
aheinecke@99:  * ...
aheinecke@99:  *
aheinecke@238:  * With one instruction per line. the maximum size of an input
aheinecke@238:  * line is 9999 characters (including the \r\n) at the end of the line.
aheinecke@99:  *
aheinecke@99:  * Certificates marked with I: will be installed and the ones
aheinecke@99:  * marked with R: will be searched and if available removed from
aheinecke@99:  * the databases.
aheinecke@99:  *
aheinecke@99:  * This tool tries to find all NSS databases the user has
aheinecke@99:  * access to and to execute the instructions on all of them.
aheinecke@99:  *
aheinecke@99:  * If there are other processes accessing the databases the caller
aheinecke@99:  * has to ensure that those are terminated before this process is
aheinecke@99:  * executed.
aheinecke@99:  *
aheinecke@238:  * If the same certificate is marked to be installed and to be removed
aheinecke@238:  * in one call the behavior is undefined. This should be avoided and
aheinecke@238:  * may lead to errors.
aheinecke@238:  *
aheinecke@99:  * Returns 0 on success (Even when no stores where found) an error value
aheinecke@99:  * as defined in errorcodes.h otherwise.
aheinecke@99:  *
aheinecke@99:  * Success messages are written to stdout. Errors to stderr. For logging
aheinecke@99:  * purposes each installation / removal of a certificate will be reported
aheinecke@99:  * with the profile name that it modified.
aheinecke@99:  *
aheinecke@99:  */
aheinecke@99: 
wilde@235: /**
wilde@235:  * @brief Needs to eb defined to get strnlen()
wilde@235:  */
wilde@235: #define _POSIX_C_SOURCE 200809L
wilde@235: 
wilde@235: /* REMOVEME: */
wilde@235: #include <unistd.h>
wilde@235: 
wilde@269: #include <cert.h>
wilde@269: #include <certdb.h>
wilde@269: #include <certt.h>
wilde@173: #include <dirent.h>
wilde@224: #include <nss.h>
wilde@224: #include <pk11pub.h>
wilde@119: #include <stdbool.h>
wilde@119: #include <stdio.h>
wilde@119: #include <stdlib.h>
wilde@119: #include <string.h>
wilde@173: #include <sys/types.h>
wilde@119: 
wilde@230: #define DEBUGPREFIX "MOZ-"
aheinecke@252: #include "logging.h"
wilde@230: 
wilde@261: #include "certhelp.h"
wilde@226: #include "errorcodes.h"
wilde@226: #include "portpath.h"
wilde@226: #include "strhelp.h"
wilde@244: #include "nss-secitemlist.h"
wilde@228: 
wilde@113: #ifndef _WIN32
wilde@197: #define CONFDIRS ".mozilla", ".thunderbird"
wilde@308: #define NSSSHARED ".pki/nssdb"
wilde@223: #define TARGET_LINUX 1
wilde@113: #else
wilde@197: #define CONFDIRS "Mozilla", "Thunderbird"
wilde@311: #define NSSSHARED ""
wilde@223: #define TARGET_LINUX 0
wilde@113: #endif
wilde@113: 
wilde@229: /**
wilde@229:  * @brief Length of string buffers used
wilde@229:  *
wilde@229:  * The maximal length of input is defined as 9999 (+ terminating \0).
wilde@229:  * We use it for other other input puffers besides the IPC input, too.
wilde@229:  * (One size fits all).
wilde@229:  */
wilde@229: #define LINEBUFLEN 10000
wilde@147: 
wilde@119: /**
wilde@119:  * @brief Global Return Code
wilde@119:  *
wilde@119:  * This will be retuned by the programm and might be set to an
wilde@119:  * error code on fatal errors and to and warning code on non-fatal
wilde@119:  * errors.  In case of mor than one warning the warning codes will be
wilde@119:  * ORed together.
wilde@119:  */
wilde@317: int exit_code = 0;
aheinecke@44: 
aheinecke@44: /**
wilde@194:  * @brief Return configuration base directory.
wilde@194:  * @returns A pointer to a string containing the path to the base
wilde@194:  * directory holding the configuration directories for e.g. mozilla
wilde@194:  * and thunderbird.
wilde@180:  */
wilde@180: static char *
wilde@194: get_conf_basedir()
wilde@180: {
wilde@194:   char *cdir, *envvar;
wilde@180: 
wilde@223:   if (TARGET_LINUX)
wilde@194:     envvar = "HOME" ;
wilde@180:   else
wilde@194:     envvar = "APPDATA";
wilde@180: 
wilde@194:   if ((cdir = getenv(envvar)) != NULL)
wilde@194:     return cdir;
wilde@194:   else
wilde@180:     {
wilde@228:       DEBUGPRINTF("FATAL!  No %s in environment.\n", envvar);
wilde@180:       exit(ERR_MOZ_HOMELESS);
wilde@180:     }
wilde@180: }
wilde@180: 
wilde@180: /**
wilde@119:  * @brief Get a list of all mozilla profile directories
aheinecke@44:  *
wilde@232:  * Parse the profiles.ini and extract all profile paths from that.
wilde@232:  * The expected data is in the form:
wilde@232:  *
wilde@232:  * [Profile99]
wilde@232:  * IsRelative=1
wilde@232:  * Path=Example/fooo.bar
wilde@232:  *
wilde@232:  * or
wilde@232:  * [Profile0]
wilde@232:  * IsRelative=0
wilde@232:  * Path=c:\foo\bar\baz
wilde@232:  *
wilde@232:  * Mozilla also accepts the ini file on Windows even if it is UTF-16
wilde@232:  * encoded but never writes UTF-16 on its own.  So currently we ignore
wilde@232:  * this special case.
aheinecke@44:  *
wilde@121:  * @param[in] inifile_name path of the profile.ini to read.
aheinecke@44:  * @return NULL terminated array of strings containing containing the
aheinecke@44:  * absolute path of the profile directories. The array needs to
aheinecke@44:  * be freed by the caller.
aheinecke@44:  */
wilde@119: static char **
wilde@119: get_profile_dirs (char *inifile_name)
wilde@119: {
wilde@119:   char **dirs = NULL;
wilde@147:   char *inifile_dirname;
wilde@119:   FILE *inifile;
wilde@147:   char line[LINEBUFLEN];
wilde@147:   char *key;
wilde@147:   char *value;
wilde@320:   char *path = NULL;
wilde@147:   char *fqpath;
wilde@119:   bool inprofile = false;
wilde@147:   bool relative_path = false;
aheinecke@44: 
wilde@119:   if ((inifile = fopen(inifile_name, "r")) != NULL)
wilde@119:     {
wilde@228:       DEBUGPRINTF("Searching for profile paths in: '%s'\n", inifile_name);
wilde@175: 
wilde@147:       inifile_dirname = port_dirname(inifile_name);
wilde@147:       while (fgets(line, LINEBUFLEN, inifile) != NULL)
wilde@119:         {
wilde@147:           /* Determine if we are in an profile section */
wilde@147:           if (str_starts_with(line, "[Profile"))
wilde@147:             {
wilde@147:               relative_path = false;
wilde@147:               inprofile = true;
wilde@147:             }
wilde@119:           else if (line[0] == '[')
wilde@119:             inprofile = false;
wilde@147: 
wilde@147:           /* If we are in a profile parse path related stuff */
wilde@147:           if (inprofile)
wilde@147:             {
wilde@157:               key = strtok(line, "=");
wilde@157:               value = strtok(NULL, "=");
wilde@147:               str_trim(&value);
wilde@147:               if (str_equal(key, "Path"))
wilde@147:                 {
wilde@147:                   if (relative_path)
wilde@320:                     xasprintf(&path, "%s/%s", inifile_dirname, value);
wilde@147:                   else
wilde@320:                     xasprintf(&path, "%s", value); /* FIXME: LOOKS STUPID! */
wilde@147:                   if ((fqpath = port_realpath(path)) != NULL)
wilde@147:                     {
wilde@228:                       DEBUGPRINTF("Found profile path: '%s'\n", fqpath);
wilde@147:                       strv_append(&dirs, fqpath, strlen(fqpath));
wilde@147:                       free (fqpath);
wilde@147:                     }
wilde@147:                   else
wilde@175:                     {
wilde@228:                       DEBUGPRINTF("WARN!  Non existent profile path: '%s'\n", path);
wilde@317:                       exit_code |= WARN_MOZ_PROFILE_DOES_NOT_EXIST;
wilde@175:                     }
wilde@320:                   free(path);
wilde@147:                 }
wilde@147:               else if (str_equal(key, "IsRelative") &&
wilde@147:                        str_starts_with(value, "1"))
wilde@147:                 relative_path = true;
wilde@147:             }
wilde@119:         }
bernhard@179:       fclose(inifile);
wilde@119:     }
wilde@119:   else
wilde@119:     {
wilde@228:       DEBUGPRINTF("WARN!  Could not open ini file: '%s'\n", inifile_name);
wilde@317:       exit_code |= WARN_MOZ_FAILED_TO_OPEN_INI;
wilde@119:     }
wilde@119:   return dirs;
wilde@119: }
aheinecke@44: 
wilde@173: /**
wilde@173:  * @brief Search for mozilla profiles.ini files
wilde@173:  *
wilde@173:  * Use well known paths and heuristics to find the current users
wilde@173:  * profiles.ini files on GNU/Linux and Windows systems.
wilde@173:  *
wilde@173:  * @return NULL terminated array of strings containing the absolute
wilde@173:  * path of the profiles.ini files.  The array needs to be freed by the
wilde@173:  * caller.
wilde@173:  */
wilde@173: static char **
wilde@173: get_profile_inis ()
wilde@173: {
wilde@173:   char **inis = NULL;
wilde@320:   char *mozpath, *fqpath, *subpath, *ppath;
wilde@173:   DIR *mozdir;
wilde@173:   struct dirent *mozdirent;
wilde@194:   char *confbase = get_conf_basedir();
wilde@197:   const char *confdirs[] = { CONFDIRS, NULL };
wilde@173: 
wilde@197:   for (int i=0; confdirs[i] != NULL; i++)
wilde@173:     {
wilde@320:       xasprintf(&mozpath,"%s/%s", confbase, confdirs[i]);
wilde@320:       if ((mozdir = opendir(mozpath)) != NULL)
wilde@180:         {
wilde@197:           while ((mozdirent = readdir(mozdir)) != NULL)
wilde@180:             {
wilde@320:               xasprintf(&subpath, "%s/%s/%s",
wilde@320:                         confbase,
wilde@320:                         confdirs[i],
wilde@320:                         mozdirent->d_name);
wilde@320:               if (port_isdir(subpath)
wilde@197:                   && (strcmp(mozdirent->d_name, "..") != 0))
wilde@180:                 {
wilde@320:                   xasprintf(&ppath, "%s/%s/%s/%s",
wilde@320:                             confbase,
wilde@320:                             confdirs[i],
wilde@320:                             mozdirent->d_name,
wilde@320:                             "profiles.ini");
wilde@320:                   DEBUGPRINTF("checking for %s...\n", ppath);
wilde@320:                   if ((fqpath = port_realpath(ppath)) != NULL)
wilde@197:                     {
wilde@197:                       strv_append(&inis, fqpath, strlen(fqpath));
wilde@228:                       DEBUGPRINTF("Found mozilla ini file: '%s'\n", fqpath);
wilde@197:                       free(fqpath);
wilde@197:                     }
wilde@320:                   free(ppath);
wilde@180:                 }
wilde@320:               free(subpath);
wilde@180:             }
wilde@197:           closedir(mozdir);
wilde@180:         }
wilde@197:       else
wilde@197:         {
wilde@228:           DEBUGPRINTF("Could not open %s/%s\n", confbase, confdirs[i]);
wilde@197:         }
wilde@320:       free(mozpath);
wilde@180:     }
wilde@197:   if (inis == NULL)
wilde@180:     {
wilde@228:       DEBUGPRINTF("No ini files found - will do nothing!\n");
wilde@173:     }
wilde@173:   return inis;
wilde@173: }
wilde@173: 
wilde@223: /**
wilde@231:  * @brief Collect all mozilla profile directories of current user.
wilde@231:  * @return NULL terminated array of strings containing the absolute
wilde@231:  * path of the profile directories.  The array needs to be freed by the
wilde@231:  * caller.
wilde@231:  */
wilde@231: static char**
wilde@308: get_all_nssdb_dirs()
wilde@231: {
wilde@231:   char **mozinis, **pdirs;
wilde@231:   char **alldirs = NULL;
wilde@308:   /* Search Mozilla/Firefox/Thunderbird profiles */
wilde@231:   if ((mozinis = get_profile_inis()) != NULL)
wilde@231:     {
wilde@231:       for (int i=0; mozinis[i] != NULL; i++)
wilde@231:         {
wilde@231:           pdirs =
wilde@231:             get_profile_dirs(mozinis[i]);
wilde@231:           if (pdirs != NULL)
wilde@231:             {
wilde@231:               for (int i=0; pdirs[i] != NULL; i++)
wilde@231:                 {
wilde@231:                   strv_append(&alldirs, pdirs[i], strlen(pdirs[i]));
wilde@231:                 }
wilde@231:               strv_free(pdirs);
wilde@231:             }
wilde@231:         }
wilde@231:       strv_free(mozinis);
wilde@231:     }
wilde@308:   /* Search for NSS shared DB (used by Chrome/Chromium on GNU/Linux) */
wilde@308:   if (TARGET_LINUX)
wilde@308:     {
wilde@320:       char *path, *fqpath, *sqlpath;
wilde@320:       xasprintf(&path, "%s/%s", get_conf_basedir(), NSSSHARED);
wilde@320:       if ((fqpath = port_realpath(path)) != NULL)
wilde@308:         {
wilde@320:           xasprintf(&sqlpath, "sql:%s", fqpath);
wilde@320:           strv_append(&alldirs, sqlpath, strlen(sqlpath));
wilde@320:           free(sqlpath);
wilde@308:           free(fqpath);
wilde@308:         }
wilde@320:       free(path);
wilde@308:     }
wilde@231:   return alldirs;
wilde@231: }
wilde@231: 
wilde@281: #ifdef DEBUGOUTPUT
wilde@231: /**
wilde@223:  * @brief list certificates from nss certificate store
wilde@223:  * @param[in] confdir the directory with the certificate store
wilde@223:  */
wilde@223: static void
wilde@281: DEBUG_nss_list_certs (char *confdir)
wilde@223: {
wilde@223:   CERTCertList *list;
wilde@223:   CERTCertListNode *node;
wilde@223:   char *name;
wilde@224: 
wilde@223:   if (NSS_Initialize(confdir, "", "", "secmod.db", NSS_INIT_READONLY)
wilde@223:       == SECSuccess)
wilde@223:     {
wilde@283:       DEBUGPRINTF("Listing certs in \"%s\"\n", confdir);
wilde@223:       list = PK11_ListCerts(PK11CertListAll, NULL);
wilde@223:       for (node = CERT_LIST_HEAD(list); !CERT_LIST_END(node, list);
wilde@223:            node = CERT_LIST_NEXT(node)) {
wilde@223:         name = node->appData;
wilde@223: 
wilde@281:         DEBUGPRINTF("Found certificate \"%s\"\n", name);
wilde@223:       }
wilde@223:       CERT_DestroyCertList(list);
wilde@223:       NSS_Shutdown();
wilde@223:     }
wilde@223:   else
wilde@281:     {
wilde@281:       DEBUGPRINTF("Could not open nss certificate store in %s!\n", confdir);
wilde@281:     }
wilde@223: }
wilde@281: #endif
wilde@223: 
wilde@261: /**
wilde@261:  * @brief Create a string with the name for cert in SECItem.
wilde@261:  *
wilde@261:  * Should be freed by caller.
wilde@261:  * @param[in] secitemp ponts to an SECItem holding the DER certificate.
wilde@261:  * @retruns a string of the from "CN of Subject - O of Subject"
wilde@261:  */
wilde@261: static char *
wilde@261: nss_cert_name(SECItem *secitemp)
andre@390: {
andre@390:   char *cn_str, *o_str, *name;
wilde@261:   size_t name_len;
wilde@261:   cn_str = x509_parse_subject(secitemp->data, secitemp->len, CERT_OID_CN);
wilde@261:   o_str = x509_parse_subject(secitemp->data, secitemp->len, CERT_OID_O);
aheinecke@332:   if (!cn_str || !o_str)
aheinecke@332:     {
aheinecke@332:       DEBUGPRINTF("FATAL: Could not parse certificate!");
aheinecke@332:       exit(ERR_INVALID_CERT);
aheinecke@332:     }
wilde@261:   name_len = strlen(cn_str) + strlen(o_str) + 4;
wilde@261:   name = (char *)xmalloc(name_len);
wilde@261:   snprintf(name, name_len, "%s - %s", cn_str, o_str);
wilde@261:   free(cn_str);
wilde@261:   free(o_str);
wilde@261:   return name;
wilde@261: }
wilde@261: 
wilde@276: /**
wilde@276:  * @brief Convert a base64 encoded DER certificate to SECItem
wilde@276:  * @param[in] b64 pointer to the base64 encoded certificate
wilde@276:  * @param[in] b64len length of the base64 encoded certificate
wilde@276:  * @param[out] secitem pointer to the SECItem in which to store the
wilde@276:  * raw DER certifiacte.
wilde@276:  * @returns true on success and false on failure
wilde@276:  */
wilde@244: static bool
wilde@244: base64_to_secitem(char *b64, size_t b64len, SECItem *secitem)
wilde@244: {
wilde@244:   unsigned char *dercert = NULL;
wilde@244:   size_t dercertlen;
wilde@244: 
wilde@245:   if ((str_base64_decode((char **)(&dercert), &dercertlen,
wilde@245:                          b64, b64len) == 0) &&
wilde@245:       (dercertlen > 0))
wilde@244:     {
wilde@244:       secitem->data = dercert;
wilde@246:       secitem->len = (unsigned int) dercertlen;
wilde@244:       return true;
wilde@244:     }
wilde@244:   else
wilde@281:     {
wilde@281:       DEBUGPRINTF("Base64 decode failed for: %s\n", b64);
wilde@281:     }
wilde@261:   return false;
wilde@244: }
wilde@244: 
wilde@244: /**
wilde@277:  * @brief Store DER certificate in mozilla store.
wilde@277:  * @param[in] pdir the mozilla profile directory with the certificate
wilde@277:  * store to manipulate.
wilde@277:  * @param[in] dercert pointer to a SECItem holding the DER certificate
wilde@277:  * to install
wilde@277:  * @returns true on success and false on failure
wilde@277:  */
wilde@277: static bool
wilde@277: import_cert(char *pdir, SECItem *dercert)
wilde@277: {
wilde@277:   PK11SlotInfo *pk11slot = NULL;
wilde@309:   CERTCertTrust *trust = NULL;
wilde@309:   CERTCertificate *cert = NULL;
wilde@277:   bool success = false;
wilde@277:   char *cert_name = nss_cert_name(dercert);
wilde@277: 
wilde@277:   DEBUGPRINTF("INSTALLING cert: '%s' to: %s\n", cert_name, pdir);
aheinecke@493:   pk11slot = PK11_GetInternalKeySlot();
aheinecke@493:   cert = CERT_DecodeCertFromPackage((char *)dercert->data,
aheinecke@493:                                     (int)dercert->len);
aheinecke@493:   trust = (CERTCertTrust *)xmalloc(sizeof(CERTCertTrust));
aheinecke@595:   CERT_DecodeTrustString(trust, "C,C,C");
aheinecke@493:   if ((PK11_ImportCert(pk11slot, cert, CK_INVALID_HANDLE,
aheinecke@493:                        cert_name, PR_FALSE)
aheinecke@493:        == SECSuccess) &&
aheinecke@493:       (CERT_ChangeCertTrust(CERT_GetDefaultCertDB(), cert, trust)
aheinecke@493:        == SECSuccess))
wilde@277:     {
andre@625:       log_certificate_der (pdir, dercert->data, dercert->len, true);
aheinecke@493:       success = true;
wilde@277:     }
wilde@277:   else
wilde@277:     {
aheinecke@493:       DEBUGPRINTF("Failed to install certificate '%s' to '%s'!\n", cert_name, pdir);
aheinecke@493:       ERRORPRINTF("Error installing certificate err: %i\n", PORT_GetError());
wilde@277:     }
aheinecke@493:   CERT_DestroyCertificate (cert);
aheinecke@493:   free(trust);
aheinecke@493:   PK11_FreeSlot(pk11slot);
wilde@277: 
wilde@277:   free(cert_name);
wilde@277:   return success;
wilde@277: }
wilde@277: 
wilde@277: /**
wilde@277:  * @brief Remove DER certificate from mozilla store.
wilde@277:  * @param[in] pdir the mozilla profile directory with the certificate
wilde@277:  * store to manipulate.
wilde@277:  * @param[in] dercert pointer to a SECItem holding the DER certificate
wilde@277:  * to remove
wilde@277:  * @returns true on success and false on failure
wilde@277:  */
wilde@277: static bool
wilde@277: remove_cert(char *pdir, SECItem *dercert)
wilde@277: {
wilde@277:   PK11SlotInfo *pk11slot = NULL;
wilde@277:   bool success = false;
wilde@277:   char *cert_name = nss_cert_name(dercert);
wilde@277:   CERTCertificate *cert = NULL;
wilde@277: 
wilde@277:   DEBUGPRINTF("REMOVING cert: '%s' from: %s\n", cert_name, pdir);
wilde@277:   if (NSS_Initialize(pdir, "", "", "secmod.db", 0) == SECSuccess)
wilde@277:     {
wilde@277:       pk11slot = PK11_GetInternalKeySlot();
wilde@277:       cert = PK11_FindCertFromDERCertItem(pk11slot,
wilde@277:                                           dercert, NULL);
wilde@277:       if (cert != NULL)
wilde@277:         {
wilde@277:           if (SEC_DeletePermCertificate(cert) == SECSuccess)
wilde@277:             {
wilde@277:               success = true;
andre@625:               log_certificate_der (pdir, dercert->data, dercert->len, false);
wilde@277:             }
wilde@277:           else
wilde@277:             {
wilde@277:               DEBUGPRINTF("Failed to remove certificate '%s' from '%s'!\n", cert_name, pdir);
wilde@277:             }
wilde@277:           CERT_DestroyCertificate(cert);
wilde@277:         }
wilde@277:       else
wilde@277:         {
wilde@277:           DEBUGPRINTF("Could not find Certificate '%s' in store '%s'.\n", cert_name, pdir);
wilde@277:         }
wilde@277:       PK11_FreeSlot(pk11slot);
wilde@277:       NSS_Shutdown();
wilde@277:     }
wilde@277:   else
wilde@277:     {
wilde@277:       DEBUGPRINTF("Could not open nss certificate store in %s!\n", pdir);
wilde@277:     }
wilde@277:   free(cert_name);
wilde@277:   return success;
wilde@277: }
wilde@277: 
wilde@277: /**
wilde@279:  * @brief Apply a function to a list of certificates and profiles
wilde@279:  *
wilde@279:  * The function must have the signature:
wilde@279:  *
wilde@279:  *   bool function(char *pdir, SECItem der_cert)
wilde@279:  *
wilde@279:  * where pdir is the path of an profile and der_cert is an raw DER
wilde@279:  * formatted certificate.  The function must return true on success
wilde@279:  * and false on failure.
wilde@279:  *
andre@625:  * This function is intended for use with the import_cert and
wilde@279:  * remove_cert functions.
wilde@279:  *
wilde@279:  * @param[in] fn the function to apply
wilde@279:  * @param[inout] certs a secitem list holding the certificates
wilde@279:  * the list will be change (emptied)!
wilde@279:  * @param[in] pdirs the NULL terminated list of profile directories
wilde@279:  * @returns true on success and false on failure
wilde@279:  */
wilde@279: bool
wilde@279: apply_to_certs_and_profiles(bool fn(char *, SECItem *),
wilde@279:                             seciteml_t **certs, char **pdirs)
wilde@279: {
wilde@279:   bool success = true;
wilde@280: 
aheinecke@493:   for (int i=0; pdirs[i] != NULL; i++)
wilde@279:     {
aheinecke@493:       seciteml_t *iter = *certs;
aheinecke@493:       if (NSS_Initialize(pdirs[i], "", "", "secmod.db", 0) != SECSuccess)
wilde@279:         {
aheinecke@493:           DEBUGPRINTF("Could not open nss certificate store in %s!\n", pdirs[i]);
aheinecke@493:           continue;
aheinecke@493:         }
aheinecke@493: 
aheinecke@493:       while (iter != NULL && iter->item != NULL)
aheinecke@493:         {
aheinecke@493:           SECItem *cert = iter->item;
wilde@279:           if (! (*fn)(pdirs[i], cert))
wilde@279:             success = false;
aheinecke@493:           iter = iter->next;
wilde@279:         }
aheinecke@493:       NSS_Shutdown();
wilde@279:     }
wilde@280: 
aheinecke@564:   seciteml_free(certs);
aheinecke@564: 
wilde@279:   return success;
wilde@279: }
wilde@279: 
wilde@279: /**
wilde@244:  * @brief Parse IPC commands from standard input.
wilde@244:  *
wilde@244:  * Reads command lines (R: and I:) from standard input and puts the
wilde@244:  * certificates to process in two SECItem lists holding the
wilde@244:  * certificates in DER format.
wilde@244:  * @param[inout] install_list list of SECItems with certifiactes to install
wilde@244:  * @param[inout] remove_list list of SECItems with certifiactes to remove
wilde@244:  */
wilde@244: static void
wilde@315: parse_commands (FILE *stream,
wilde@315:                 seciteml_t **install_list, seciteml_t **remove_list)
wilde@244: {
wilde@244:   char inpl[LINEBUFLEN];
wilde@244:   size_t inpllen;
wilde@244:   bool parserr = true;
wilde@244:   SECItem secitem;
wilde@244: 
wilde@315:   while ( fgets(inpl, LINEBUFLEN, stream) != NULL )
wilde@244:     {
wilde@244:       inpllen = strnlen(inpl, LINEBUFLEN);
wilde@244:       /* Validate input line:
wilde@244:        * - must be (much) longer than 3 characters
wilde@244:        * - must start with "*:"
wilde@244:        */
wilde@244:       if ((inpllen > 3) && (inpl[1] == ':'))
wilde@244:         /* Now parse Input */
wilde@244:         switch(inpl[0])
wilde@244:           {
wilde@244:           case 'R':
wilde@244:             parserr = true;
wilde@244:             DEBUGPRINTF("Request to remove certificate: %s\n", &inpl[2]);
wilde@244:             if (base64_to_secitem(&inpl[2], inpllen - 2, &secitem))
wilde@244:               {
wilde@244:                 seciteml_push(remove_list, &secitem);
wilde@244:                 parserr = false;
wilde@244:               }
wilde@244:             break;
wilde@244:           case 'I':
wilde@244:             parserr = true;
wilde@244:             DEBUGPRINTF("Request to install certificate: %s\n", &inpl[2]);
wilde@244:             if (base64_to_secitem(&inpl[2], inpllen - 2, &secitem))
wilde@244:               {
wilde@244:                 seciteml_push(install_list, &secitem);
wilde@244:                 parserr = false;
wilde@244:               }
wilde@244:             break;
wilde@244:           default:
wilde@244:             parserr = true;
wilde@244:           }
wilde@244:       else
wilde@244:         {
wilde@244:           parserr = true;
wilde@244:         }
wilde@244: 
wilde@244:       if (parserr)
wilde@244:         {
wilde@244:           DEBUGPRINTF("FATAL: Invalid input: %s\n", inpl);
wilde@244:           exit(ERR_MOZ_INVALID_INPUT);
wilde@244:         }
wilde@244:     }
wilde@244: }
wilde@244: 
wilde@173: 
wilde@113: int
wilde@315: main (int argc, char **argv)
wilde@113: {
wilde@308:   char **dbdirs;
wilde@244:   seciteml_t *certs_to_remove = NULL;
wilde@244:   seciteml_t *certs_to_add = NULL;
wilde@315:   FILE *input_stream;
wilde@315: 
wilde@315:   switch (argc)
wilde@315:     {
wilde@315:     case 1:
wilde@322:       DEBUGPRINTF("Opening STDIN for input...\n");
wilde@315:       input_stream = stdin;
wilde@315:       break;
wilde@315:     case 2:
wilde@315:       DEBUGPRINTF("Opening %s for input...\n", argv[1]);
wilde@315:       if ((input_stream = fopen(argv[1], "r")) == NULL)
wilde@315:         {
wilde@315:           DEBUGPRINTF("FATAL: Could not open %s for reading!\n",
wilde@315:                       argv[1]);
wilde@317:           exit_code = ERR_MOZ_FAILED_TO_OPEN_INPUT;
wilde@315:           goto exit;
wilde@315:         }
wilde@315:       break;
wilde@315:     default:
wilde@315:       DEBUGPRINTF("FATAL: Wrong number of arguments!\n");
wilde@317:       exit_code = ERR_MOZ_WRONG_ARGC;
wilde@315:       goto exit;
wilde@315:     }
wilde@244: 
wilde@308:   dbdirs =
wilde@308:     get_all_nssdb_dirs();
wilde@235: 
wilde@308:   if (dbdirs != NULL)
wilde@231:     {
wilde@315:       parse_commands(input_stream, &certs_to_add, &certs_to_remove);
wilde@244: 
wilde@281: #ifdef DEBUGOUTPUT
wilde@284:       DEBUGPRINTF("OLD List of installed certs:\n");
wilde@308:       for (int i=0; dbdirs[i] != NULL; i++)
wilde@308:         DEBUG_nss_list_certs(dbdirs[i]);
wilde@281: #endif
wilde@263: 
wilde@308:       if (! apply_to_certs_and_profiles(remove_cert, &certs_to_remove, dbdirs))
wilde@317:         exit_code |= WARN_MOZ_COULD_NOT_REMOVE_CERT;
wilde@280: 
wilde@308:       if (! apply_to_certs_and_profiles(import_cert, &certs_to_add, dbdirs))
wilde@317:         exit_code |= WARN_MOZ_COULD_NOT_ADD_CERT;
wilde@280: 
wilde@281: #ifdef DEBUGOUTPUT
wilde@284:       DEBUGPRINTF("NEW List of installed certs:\n");
wilde@308:       for (int i=0; dbdirs[i] != NULL; i++)
wilde@308:         DEBUG_nss_list_certs(dbdirs[i]);
wilde@281: #endif
wilde@280: 
wilde@308:       strv_free(dbdirs);
wilde@231:     }
wilde@315: 
wilde@315:  fclose(input_stream);
wilde@315: 
wilde@315:  exit:
wilde@317:   exit(exit_code);
aheinecke@44: }