MozNSS Interception Code

Author: Matus Honek <mhonek@redhat.com>

Date: Thu Jun 21 20:37:25 CEST 2018

diff --git a/configure.in b/configure.in

--- a/configure.in

+++ b/configure.in

@@ -237,6 +237,7 @@ dnl OL_ARG_ENABLE(referrals,[  --enable-referrals	  enable LDAPv2+ Referrals (ex

 ol_enable_referrals=${ol_enable_referrals-no}

 OL_ARG_ENABLE(ipv6,[  --enable-ipv6 	  enable IPv6 support], auto)dnl

 OL_ARG_ENABLE(local,[  --enable-local	  enable AF_LOCAL (AF_UNIX) socket support], auto)dnl

+OL_ARG_ENABLE(moznss_compatibility,[  --enable-moznss-compatibility	  enable MozNSS compatibility], no)dnl

 dnl ----------------------------------------------------------------

 dnl General "with" options

@@ -1256,6 +1257,26 @@ if test $ol_link_tls = no ; then

 	fi

 fi

+if test $ol_enable_moznss_compatibility = yes ; then

+	if test $have_openssl = yes ; then

+		if test $ol_with_tls = openssl ; then

+			PKG_CHECK_MODULES(MOZNSS, [nss nspr], [have_moznss_libs=yes], [have_moznss_libs=no])

+			if test $have_moznss_libs = yes ; then

+				AC_DEFINE(HAVE_MOZNSS_COMPATIBILITY, 1,

+					[define if you want to support MozNSS databases when compiled with OpenSSL])

+				TLS_LIBS="$TLS_LIBS $MOZNSS_LIBS"

+				CFLAGS="$CFLAGS $MOZNSS_CFLAGS"

+			else

+				AC_MSG_ERROR([For MOZNSS_COMPATIBILITY you have to have MozNSS present.])

+			fi

+		else

+			AC_MSG_ERROR([For MOZNSS_COMPATIBILITY you have to compile with OpenSSL for crypto. (see --with-tls flag)])

+		fi

+	else

+		AC_MSG_ERROR([For MOZNSS_COMPATIBILITY you have to have OpenSSL devel available. (unable to build with OpenSSL)])

+	fi

+fi

+

 WITH_TLS=no

 if test $ol_link_tls = yes ; then

 	AC_DEFINE(HAVE_TLS, 1, [define if you have TLS])

diff --git a/doc/man/man3/ldap_get_option.3 b/doc/man/man3/ldap_get_option.3

--- a/doc/man/man3/ldap_get_option.3

+++ b/doc/man/man3/ldap_get_option.3

@@ -772,6 +772,19 @@ must be

 When using the OpenSSL library this is an SSL*. When using other

 crypto libraries this is a pointer to an OpenLDAP private structure.

 Applications generally should not use this option.

+.TP

+.B LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY

+Sets/gets the status of the MozNSS database compatibility layer for TLS options. This options is available only if OpenLDAP is compiled with OpenSSL. This has effect only before the TLS context is established.

+This option defaults to be on.

+.BR invalue

+should either be

+.BR LDAP_OPT_OFF

+or

+.BR LDAP_OPT_ON ;

+.BR outvalue

+must be

+.BR "int *" .

+When set, just before TLS context initialization the library will first check if TLS settings are MozNSS-specific and if so it will export certificates from a preconfigured database and set other TLS settings so that OpenSSL can continue without issues.

 .SH ERRORS

 On success, the functions return

 .BR LDAP_OPT_SUCCESS ,

diff --git a/doc/man/man5/ldap.conf.5 b/doc/man/man5/ldap.conf.5

--- a/doc/man/man5/ldap.conf.5

+++ b/doc/man/man5/ldap.conf.5

@@ -483,6 +483,11 @@ Check the CRL for a whole certificate chain

 Specifies the file containing a Certificate Revocation List to be used

 to verify if the server certificates have not been revoked. This

 parameter is only supported with GnuTLS and Mozilla NSS.

+.RE

+.TP

+.B TLS_MOZNSS_COMPATIBILITY <on/true/yes/off/false/no>

+Specifies whether the MozNSS database compatibility layer for TLS options should be enabled. This options is available only if OpenLDAP is compiled with OpenSSL.

+This option defaults to be on.

 .SH "ENVIRONMENT VARIABLES"

 .TP

 LDAPNOINIT

diff --git a/doc/man/man5/slapd-config.5 b/doc/man/man5/slapd-config.5

--- a/doc/man/man5/slapd-config.5

+++ b/doc/man/man5/slapd-config.5

@@ -1004,6 +1004,11 @@ Check the CRL for a whole certificate chain

 Specifies a file containing a Certificate Revocation List to be used

 for verifying that certificates have not been revoked. This parameter

 is only valid when using GnuTLS or Mozilla NSS.

+.RE

+.TP

+.B olcTLSMozNSSCompatibility <on/true/yes/off/false/no>

+Specifies whether the MozNSS database compatibility layer for TLS options should be enabled. This options is available only if OpenLDAP is compiled with OpenSSL.

+This option defaults to be on.

 .SH DYNAMIC MODULE OPTIONS

 If

 .B slapd

diff --git a/doc/man/man5/slapd.conf.5 b/doc/man/man5/slapd.conf.5

--- a/doc/man/man5/slapd.conf.5

+++ b/doc/man/man5/slapd.conf.5

@@ -1235,6 +1235,11 @@ Check the CRL for a whole certificate chain

 Specifies a file containing a Certificate Revocation List to be used

 for verifying that certificates have not been revoked. This directive is

 only valid when using GnuTLS and Mozilla NSS.

+.RE

+.TP

+.B TLSMozNSSCompatibility <on/true/yes/off/false/no>

+Specifies whether the MozNSS database compatibility layer for TLS options should be enabled. This options is available only if OpenLDAP is compiled with OpenSSL.

+This option defaults to be on.

 .SH GENERAL BACKEND OPTIONS

 Options in this section only apply to the configuration file section

 for the specified backend.  They are supported by every

diff --git a/include/ldap.h b/include/ldap.h

--- a/include/ldap.h

+++ b/include/ldap.h

@@ -158,6 +158,10 @@ LDAP_BEGIN_DECL

 #define LDAP_OPT_X_TLS_NEWCTX		0x600f

 #define LDAP_OPT_X_TLS_CRLFILE		0x6010	/* GNUtls only */

 #define LDAP_OPT_X_TLS_PACKAGE		0x6011

+#define LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY  0x6050

+

+#define LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_DISABLED	0

+#define LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_ENABLED	1

 #define LDAP_OPT_X_TLS_NEVER	0

 #define LDAP_OPT_X_TLS_HARD		1

diff --git a/libraries/libldap/Makefile.in b/libraries/libldap/Makefile.in

--- a/libraries/libldap/Makefile.in

+++ b/libraries/libldap/Makefile.in

@@ -26,7 +26,7 @@ SRCS	= bind.c open.c result.c error.c compare.c search.c \

 	request.c os-ip.c url.c pagectrl.c sortctrl.c vlvctrl.c \

 	init.c options.c print.c string.c util-int.c schema.c \

 	charray.c os-local.c dnssrv.c utf-8.c utf-8-conv.c \

-	tls2.c tls_o.c tls_g.c tls_m.c \

+	tls2.c tls_o.c tls_g.c tls_m.c tls_mc.c tls_mc_ossl.c \

 	turn.c ppolicy.c dds.c txn.c ldap_sync.c stctrl.c \

 	assertion.c deref.c ldif.c fetch.c

@@ -39,7 +39,7 @@ OBJS	= bind.lo open.lo result.lo error.lo compare.lo search.lo \

 	request.lo os-ip.lo url.lo pagectrl.lo sortctrl.lo vlvctrl.lo \

 	init.lo options.lo print.lo string.lo util-int.lo schema.lo \

 	charray.lo os-local.lo dnssrv.lo utf-8.lo utf-8-conv.lo \

-	tls2.lo tls_o.lo tls_g.lo tls_m.lo \

+	tls2.lo tls_o.lo tls_g.lo tls_m.lo tls_mc.lo tls_mc_ossl.lo \

 	turn.lo ppolicy.lo dds.lo txn.lo ldap_sync.lo stctrl.lo \

 	assertion.lo deref.lo ldif.lo fetch.lo

diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c

--- a/libraries/libldap/init.c

+++ b/libraries/libldap/init.c

@@ -137,7 +137,9 @@ static const struct ol_attribute {

 #ifdef HAVE_GNUTLS

 	{0, ATTR_TLS,	"TLS_CRLFILE",			NULL,	LDAP_OPT_X_TLS_CRLFILE},

 #endif

-        

+#ifdef HAVE_MOZNSS_COMPATIBILITY

+	{0, ATTR_TLS,   "TLS_MOZNSS_COMPATIBILITY",     NULL,   LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY},

+#endif

 #endif

 	{0, ATTR_NONE,		NULL,		NULL,	0}

@@ -582,6 +584,9 @@ void ldap_int_initialize_global_options( struct ldapoptions *gopts, int *dbglvl

 	gopts->ldo_tls_connect_cb = NULL;

 	gopts->ldo_tls_connect_arg = NULL;

 	gopts->ldo_tls_require_cert = LDAP_OPT_X_TLS_DEMAND;

+#ifdef HAVE_MOZNSS_COMPATIBILITY

+	gopts->ldo_tls_moznss_compatibility = LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_ENABLED;

+#endif

 #endif

 	gopts->ldo_keepalive_probes = 0;

 	gopts->ldo_keepalive_interval = 0;

diff --git a/libraries/libldap/ldap-int.h b/libraries/libldap/ldap-int.h

--- a/libraries/libldap/ldap-int.h

+++ b/libraries/libldap/ldap-int.h

@@ -260,7 +260,8 @@ struct ldapoptions {

    	int			ldo_tls_require_cert;

 	int			ldo_tls_impl;

    	int			ldo_tls_crlcheck;

-#define LDAP_LDO_TLS_NULLARG ,0,0,0,{0,0,0,0,0,0,0,0,0},0,0,0,0

+   	int			ldo_tls_moznss_compatibility;

+#define LDAP_LDO_TLS_NULLARG ,0,0,0,{0,0,0,0,0,0,0,0,0},0,0,0,0,0

 #else

 #define LDAP_LDO_TLS_NULLARG

 #endif

diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c

--- a/libraries/libldap/tls2.c

+++ b/libraries/libldap/tls2.c

@@ -37,6 +37,8 @@

 #include "ldap-tls.h"

+#include "tls_mc.h"

+

 static tls_impl *tls_imp = &ldap_int_tls_impl;

 #define HAS_TLS( sb )	ber_sockbuf_ctrl( sb, LBER_SB_OPT_HAS_IO, \

 				(void *)tls_imp->ti_sbio )

@@ -96,6 +98,7 @@ tls_ctx_ref( tls_ctx *ctx )

  * an extra mutex for the default ctx.

  */

 static ldap_pvt_thread_mutex_t tls_def_ctx_mutex;

+ldap_pvt_thread_mutex_t tlsmc_mutex;

 #endif

 void

@@ -161,6 +164,7 @@ tls_init(tls_impl *impl )

 	if ( !tls_initialized++ ) {

 #ifdef LDAP_R_COMPILE

 		ldap_pvt_thread_mutex_init( &tls_def_ctx_mutex );

+		ldap_pvt_thread_mutex_init( &tlsmc_mutex );

 #endif

 	}

@@ -196,6 +200,27 @@ ldap_int_tls_init_ctx( struct ldapoptions *lo, int is_server )

 	tls_init( ti );

+#ifdef HAVE_MOZNSS_COMPATIBILITY

+	if ( LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_ENABLED == lo->ldo_tls_moznss_compatibility ) {

+		Debug( LDAP_DEBUG_ANY,

+		       "TLSMC: MozNSS compatibility interception begins.\n",

+		       0, 0, 0 );

+		if ( 0 == tlsmc_intercept_initialization( lo, is_server ) ) {

+			Debug( LDAP_DEBUG_TRACE,

+			       "TLSMC: ERROR: MozNSS compatibility layer failed.\n",

+			       0, 0, 0 );

+		}

+		lts = lo->ldo_tls_info;

+		Debug( LDAP_DEBUG_ANY,

+		       "TLSMC: MozNSS compatibility interception ends.\n",

+		       0, 0, 0 );

+	} else {

+		Debug( LDAP_DEBUG_TRACE,

+		       "TLS: MozNSS compatibility layer disabled.\n",

+		       0, 0, 0 );

+	}

+#endif

+

 	if ( is_server && !lts.lt_certfile && !lts.lt_keyfile &&

 		!lts.lt_cacertfile && !lts.lt_cacertdir ) {

 		/* minimum configuration not provided */

@@ -572,6 +597,21 @@ ldap_int_tls_config( LDAP *ld, int option, const char *arg )

 			return ldap_pvt_tls_set_option( ld, option, &i );

 		}

 		return -1;

+#endif

+#ifdef HAVE_MOZNSS_COMPATIBILITY

+	case LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY:

+		i = -1;

+		if ( (strcasecmp( arg, "yes" ) == 0) ||

+		     (strcasecmp( arg, "true" ) == 0) ||

+		     (strcasecmp( arg, "on" ) == 0) ) {

+			i = LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_ENABLED;

+		}

+		if ( (strcasecmp( arg, "no" ) == 0) ||

+		     (strcasecmp( arg, "false" ) == 0) ||

+		     (strcasecmp( arg, "off" ) == 0)  ) {

+			i = LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY_DISABLED;

+		}

+		return ldap_pvt_tls_set_option( ld, option, &i );

 #endif

 	}

 	return -1;

@@ -675,6 +715,9 @@ ldap_pvt_tls_get_option( LDAP *ld, int option, void *arg )

 	case LDAP_OPT_X_TLS_CONNECT_ARG:

 		*(void **)arg = lo->ldo_tls_connect_arg;

 		break;

+	case LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY:

+		*(int *)arg = lo->ldo_tls_moznss_compatibility;

+		break;

 	default:

 		return -1;

 	}

@@ -802,6 +845,10 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg )

 			ldap_pvt_tls_ctx_free( lo->ldo_tls_ctx );

 		lo->ldo_tls_ctx = NULL;

 		return ldap_int_tls_init_ctx( lo, *(int *)arg );

+	case LDAP_OPT_X_TLS_MOZNSS_COMPATIBILITY:

+		if ( !arg ) return -1;

+		lo->ldo_tls_moznss_compatibility = *(int *)arg;

+		break;

 	default:

 		return -1;

 	}

diff --git a/libraries/libldap/tls_mc.c b/libraries/libldap/tls_mc.c

new file mode 100644

--- /dev/null

+++ b/libraries/libldap/tls_mc.c

@@ -0,0 +1,1369 @@

+#include "portable.h"

+

+#ifdef HAVE_MOZNSS_COMPATIBILITY

+

+#include <sys/stat.h>

+#include <sys/types.h>

+#include <ac/unistd.h>

+#include <ac/errno.h>

+#include <ac/termios.h>

+#include <fcntl.h>

+#include <dirent.h>

+

+#include <nspr/nspr.h>

+#include <nspr/private/pprio.h>

+

+#include <nss/nss.h>

+#include <nss/pk11pub.h>

+#include <nss/cert.h>

+

+#include <nss/base64.h>

+#include <nss/key.h>

+#include <nss/keyt.h>

+#include <nss/blapi.h>

+#include <nss/certdb.h>

+

+#include "ldap-int.h"

+#include "ldap-tls.h"

+#include "ldap_pvt_thread.h"

+

+#include "tls_mc.h"

+#include "tls_mc_ossl.h"

+

+#define TLSMC_CHECKSUM_LEN 32

+

+#define TLSMC_CACERTS_DIR_NAME "cacerts"

+#define TLSMC_CERT_FILE_NAME "cert.pem"

+#define TLSMC_KEY_FILE_NAME "key.pem"

+#define TLSMC_README_FILE_NAME "README"

+

+#define TLSM_CERTDB_DESC "ldap"

+#define DEFAULT_TOKEN_NAME "default"

+

+#define TLSMC_IS_INPLACE 1

+#define TLSMC_IS_TEMPORARY 2

+

+#define DONOTEDIT \

+	"This file is auto-generated by the MozNSS Compatibility Layer of OpenLDAP software.\n" \

+	"This layer is not part of the OpenLDAP software distributed in upstream.\n" \

+	"Please file any related bugs with your GNU/Linux distribution.\n" \

+	"Do not edit contents of this directory structure directly. Rather, change your configuration to use the OpenSSL-style TLS options, so that this directory structure does not need to be generated anymore.\n" \

+	"Please refer to the slapd.conf(5), slapd-config(5), and ldap.conf(5) man pages for more information."

+#define PEM_CERT_HEADER "-----BEGIN CERTIFICATE-----"

+#define PEM_CERT_FOOTER "-----END CERTIFICATE-----"

+#define PEM_KEY_HEADER  "-----BEGIN PRIVATE KEY-----"

+#define PEM_KEY_FOOTER "-----END PRIVATE KEY-----"

+#define README_HEADER "The contents of this file are hashed and used as part of the name of the parent directory.\n"

+

+#ifdef LDAP_R_COMPILE

+ldap_pvt_thread_mutex_t tlsmc_mutex;

+#endif

+/*******************************************************************/

+

+

+char *

+tlsmc_path2name( char *path )

+{

+    if ( NULL == path ) return NULL;

+    char *last_slash = strrchr( path, '/' );

+    if ( NULL == last_slash )

+        return path;

+    else

+        return last_slash + 1;

+}

+

+

+int

+tlsmc_write_file( char *filename, char *buf, mode_t final_mode )

+{

+	int rv = 0;

+	int fd = -1;

+	if ( 0 > ( fd = open( filename, O_WRONLY | O_CREAT | O_EXCL, S_IWUSR ) ) ) {

+		Debug( LDAP_DEBUG_ANY,

+		       "tlsmc_write_file: ERROR: could not open file: `%s': %s.\n",

+		       filename, strerror(errno), 0 );

+		goto bail;

+	}

+	if ( -1 >= write( fd, buf, strlen(buf) ) ) {

+		Debug( LDAP_DEBUG_ANY,

+		       "tlsmc_write_file: ERROR: could not write file: `%s': %s.\n",

+		       filename, strerror(errno), 0 );

+		goto bail;

+	}

+	if ( -1 >= fchmod( fd, final_mode ) ) {

+		Debug( LDAP_DEBUG_ANY,

+		       "tlsmc_write_file: ERROR: could not set file mode: `%s': %s.\n",

+		       filename, strerror(errno), 0 );

+		goto bail;

+	}

+	if ( -1 >= fsync( fd ) ) {

+		Debug( LDAP_DEBUG_ANY,

+		       "tlsmc_write_file: ERROR: could not fsync file: `%s': %s.\n",

+		       filename, strerror(errno), 0 );

+		goto bail;

+	}

+	if ( 0 > close( fd ) ) {

+		Debug( LDAP_DEBUG_ANY,

+		       "tlsmc_write_file: ERROR: could not close file: `%s': %s.\n",

+		       filename, strerror(errno), 0 );

+		fd = -1;

+		goto bail;

+	}

+	fd = -1;

+	rv = 1;

+bail:

+	if ( fd > -1 ) close( fd );

+	return rv;

+}

+

+

+static int

+tlsmc_remove_dir_recursively( const char *dir_name )

+{

+	int rv = 0;

+	DIR *dir = NULL;

+	struct dirent *entry = NULL;

+	char *full_path = NULL;

+

+	Debug( LDAP_DEBUG_TRACE,

+	       "tlsmc_remove_dir_recursively: INFO: starting recursively removing directory `%s'.\n",

+	       dir_name, 0, 0 );

+	if ( NULL == ( dir = opendir( dir_name ) ) ) {

+		Debug( LDAP_DEBUG_ANY,

+		       "tlsmc_remove_dir_recursively: ERROR: could not open the directory (errno %d: %s).\n",

+		       errno, strerror( errno ), 0 );

+		goto bail;

+	}

+

+	while ( NULL != ( entry = readdir( dir ) ) ) {

+		struct stat info;

+

+		full_path = NULL;

+		full_path = PR_smprintf( "%s/%s", dir_name, entry->d_name );

+

+		if ( 0 != strcmp( entry->d_name, "." ) && 0 != strcmp( entry->d_name, ".." ) ) {

+			if ( 0 == lstat( full_path, &info ) ) {

+				if ( S_ISDIR( info.st_mode ) ) {

+					Debug( LDAP_DEBUG_TRACE,

+					       "tlsmc_remove_dir_recursively: INFO: stepping into directory `%s'.\n",

+					       entry->d_name, 0, 0 );

+					if ( 0 == tlsmc_remove_dir_recursively( full_path ) ) {

+						goto bail_and_close_dir;

+					}

+				} else {

+					Debug( LDAP_DEBUG_TRACE,

+					       "tlsmc_remove_dir_recursively: INFO: removing file `%s'.\n",

+					       entry->d_name, 0, 0 );

+					if ( 0 != remove( full_path ) ) {

+						Debug( LDAP_DEBUG_ANY,

+						       "tlsmc_remove_dir_recursively: ERROR: could not remove the file (errno %d: %s).\n",

+						       errno, strerror( errno ), 0 );

+						goto bail_and_close_dir;

+					}

+				}

+			} else {

+				Debug( LDAP_DEBUG_ANY,

+				       "tlsmc_remove_dir_recursively: ERROR: could not stat `%s', (errno %d: %s).\n",

+				       full_path, errno, strerror( errno ) );

+				goto bail_and_close_dir;

+			}

+		}

+

+		if ( full_path ) {

+			PR_smprintf_free( full_path );

+			full_path = NULL;

+		}

+

+	}

+	Debug( LDAP_DEBUG_TRACE,

+	       "tlsmc_remove_dir_recursively: INFO: stepping out of the directory.\n",

+	       0, 0, 0 );

+	if ( 0 != closedir( dir ) ) {

+		Debug( LDAP_DEBUG_ANY,

+		       "tlsmc_remove_dir_recursively: WARN: could not close the directory (errno %d: %s).\n",

+		       errno, strerror( errno ), 0 );

+		goto bail;

+	}

+

+	Debug( LDAP_DEBUG_TRACE,

+	       "tlsmc_remove_dir_recursively: INFO: removing the directory itself.\n",

+	       0, 0, 0 );

+	if ( 0 != remove( dir_name ) ) {

+		PRErrorCode errcode = PR_GetError();

+		Debug( LDAP_DEBUG_ANY,

+		       "tlsmc_remove_dir_recursively: ERROR: could not remove the directory (errno %d: %s).\n",

+		       errno, strerror( errno ), 0 );

+		goto bail;

+	}

+

+	rv = 1;

+	goto bail;

+bail_and_close_dir:

+	closedir( dir );

+bail:

+	if ( full_path ) PR_smprintf_free( full_path );

+	return rv;

+}

+

+

+/* BORROWED FROM tls_m.c */

+static void

+tlsmc_get_certdb_prefix( const char *certdir, char **nsscertdir, char **realcertdir, char **prefix )

+{

+	char sep = PR_GetDirectorySeparator();

+	char *ptr = NULL;

+	char *chkpath = NULL;

+	struct PRFileInfo prfi;

+	PRStatus prc;

+

+	*realcertdir = (char *)certdir; /* default is the one passed in */

+

+	/* if certdir is not given, just return */

+	if ( !certdir ) return;

+

+	*nsscertdir = certdir;

+

+	/* ignore database type prefix (e.g. sql:, dbm:) if provided */

+	if ( NULL != ( chkpath = strchr( certdir, ':' ) ) ) {

+		*realcertdir = chkpath + 1;

+	}

+

+	/* if certdir exists (file or directory) then it cannot specify a prefix */

+	prc = PR_GetFileInfo( *realcertdir, &prfi );

+	if ( prc == PR_SUCCESS ) {

+		goto finish;

+	}

+

+	/* if certdir was given, and there is a '/' in certdir, see if there

+	   is anything after the last '/' - if so, assume it is the prefix */

+	/* if ( ( ( ptr = strrchr( *realcertdir, sep ) ) ) && *(ptr + 1) ) { */

+	/* 	*realcertdir = PL_strndup( *realcertdir, ptr - (*realcertdir) ); */

+	/* 	*prefix = PL_strdup( ptr + 1 ); */

+	/* } */

+

+

+	if ( ptr = strrchr( *realcertdir, sep ) ) {

+		if ( *(ptr + 1) ) {

+			*ptr = '\0';

+			*prefix = ptr + 1;

+		} else {

+			*prefix = *realcertdir + strlen( *realcertdir );  // empty string

+		}

+	} else {

+		*prefix = *realcertdir;

+		*realcertdir = *prefix + strlen( *prefix );  //  empty string

+	}

+finish:

+	/* drop potential last '/' from realcertdir */

+	do {

+		ptr = strrchr( *realcertdir, sep );

+		if ( ptr && (! *(ptr+1) ) ) {

+			*ptr = '\0';

+		} else {

+			break;

+		}

+	} while (1);

+

+	return;

+}

+

+

+/* BORROWED FROM tls_m.c */

+static char *

+tlsmc_get_pin_from_file(const char *token_name, char *filename)

+{

+	char *pwdstr = NULL;

+	char *contents = NULL;

+	char *lasts = NULL;

+	char *line = NULL;

+	char *candidate = NULL;

+	PRFileInfo file_info;

+	PRFileDesc *pwd_fileptr = NULL;

+	pwd_fileptr = PR_Open( filename, PR_RDONLY, 00400 );

+

+	/* open the password file */

+	if ( !pwd_fileptr ) {

+		PRErrorCode errcode = PR_GetError();

+		Debug( LDAP_DEBUG_ANY,

+		       "tlsmc_get_pin_from_file: could not open security pin file %s - error %d:%s.\n",

+		       filename, errcode,

+		       PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );

+		goto done;

+	}

+

+	/* get the file size */

+	if ( PR_SUCCESS != PR_GetFileInfo( filename, &file_info ) ) {

+		PRErrorCode errcode = PR_GetError();

+		Debug( LDAP_DEBUG_ANY,

+		       "tlsmc_get_pin_from_file: could not get file info from pin file %s - error %d:%s.\n",

+		       filename, errcode,

+		       PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );

+		goto done;

+	}

+

+	/* create a buffer to hold the file contents */

+	if ( !( contents = PR_CALLOC( file_info.size + 1 ) ) ) {

+		PRErrorCode errcode = PR_GetError();

+		Debug( LDAP_DEBUG_ANY,

+		       "tlsmc_get_pin_from_file: could not alloc a buffer for contents of pin file %s - error %d:%s.\n",

+		       filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );

+		goto done;

+	}

+

+	/* read file into the buffer */

+	if( PR_Read( pwd_fileptr, contents, file_info.size ) <= 0 ) {

+		PRErrorCode errcode = PR_GetError();

+		Debug( LDAP_DEBUG_ANY,

+		       "tlsmc_get_pin_from_file: could not read the file contents from pin file %s - error %d:%s.\n",

+		       filename, errcode, PR_ErrorToString( errcode, PR_LANGUAGE_I_DEFAULT ) );

+		goto done;

+	}

+

+	/* format is [tokenname:]password EOL [tokenname:]password EOL ... */

+	/* if you want to use a password containing a colon character, use

+	   the special tokenname "default" */

+	for ( line = PL_strtok_r( contents, "\r\n", &lasts ); line;

+	      line = PL_strtok_r( NULL, "\r\n", &lasts ) ) {

+		char *colon;

+

+		if ( !*line ) {

+			continue; /* skip blank lines */

+		}

+		colon = PL_strchr( line, ':' );

+		if ( colon ) {

+			if ( *(colon + 1) && token_name &&

+			     !PL_strncmp( token_name, line, colon-line ) ) {

+				candidate = colon + 1; /* found a definite match */

+				break;

+			} else if ( !PL_strncmp( DEFAULT_TOKEN_NAME, line, colon-line ) ) {

+				candidate = colon + 1; /* found possible match */

+			}

+		} else { /* no token name */

+			candidate = line;

+		}

+	}

+done:

+	if ( pwd_fileptr ) {

+		PR_Close( pwd_fileptr );

+	}

+	if ( candidate ) {

+		pwdstr = PL_strdup( candidate );

+	}

+	PL_strfree( contents );

+

+	return pwdstr;

+}

+

+

+/* BORROWED FROM tls_m.c */

+/*

+ * Turn the echoing off on a tty.

+ */

+static void

+echoOff(int fd)

+{

+	if ( isatty( fd ) ) {

+		struct termios tio;

+		tcgetattr( fd, &tio );

+		tio.c_lflag &= ~ECHO;

+		tcsetattr( fd, TCSAFLUSH, &tio );

+	}

+}

+

+/* BORROWED FROM tls_m.c */

+/*

+ * Turn the echoing on on a tty.

+ */

+static void

+echoOn(int fd)

+{

+	if ( isatty( fd ) ) {

+		struct termios tio;

+		tcgetattr( fd, &tio );

+		tio.c_lflag |= ECHO;

+		tcsetattr( fd, TCSAFLUSH, &tio );

+		tcsetattr( fd, TCSAFLUSH, &tio );

+	}

+}

+

+

+/* BORROWED FROM tls_m.c */

+char *

+tlsmc_get_pin( PK11SlotInfo *slot, PRBool retry, void * filename)

+{

+	char *token_name = NULL;

+	char *pwdstr = NULL;

+

+	token_name = PK11_GetTokenName( slot );

+	/* Try to get the passwords from the password file if it exists.

+	 * THIS IS UNSAFE and is provided for convenience only. Without this

+	 * capability the server would have to be started in foreground mode

+	 * if using an encrypted key.

+	 */

+	if ( filename ) {

+		fprintf( stderr,

+		         "tlsmc_get_pin: INFO: Please note the extracted key file will not be protected with a PIN any more, however it will be still protected at least by file permissions.\n");

+		pwdstr = tlsmc_get_pin_from_file( token_name, (char *)filename );

+		if ( retry && pwdstr != NULL )

+			return NULL;

+	}

+	if ( !pwdstr ) {

+		int infd = PR_FileDesc2NativeHandle( PR_STDIN );

+		int isTTY = isatty( infd );

+		unsigned char phrase[200];

+		/* Prompt for password */

+		if ( isTTY ) {

+			fprintf( stderr,

+			         "tlsmc_get_pin: INFO: Please note the extracted key file will not be protected with a PIN any more, however it will be still protected at least by file permissions.\n");

+			fprintf( stdout,

+				 "Please enter pin, password, or pass phrase for security token '%s': ",

+				 token_name ? token_name : DEFAULT_TOKEN_NAME );

+			echoOff( infd );

+		}

+		fgets( (char*)phrase, sizeof(phrase), stdin );

+		if ( isTTY ) {

+			fprintf( stdout, "\n" );

+			echoOn( infd );

+		}

+		/* stomp on newline */

+		phrase[strlen((char*)phrase)-1] = 0;

+

+		pwdstr = PL_strdup( (char*)phrase );

+	}

+

+	return pwdstr;