testcrmf.c

Bug Summary

File:	crmftest/testcrmf.c
Warning:	line 1269, column 44 Access to field 'pkcs11Slot' results in a dereference of a null pointer (loaded from variable 'privKey')
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name testcrmf.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -analyzer-config-compatibility-mode=true -mrelocation-model pic -pic-level 2 -fhalf-no-semantic-interposition -mframe-pointer=all -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fdebug-compilation-dir=/nss/cmd/crmftest -ffunction-sections -fdata-sections -fcoverage-compilation-dir=/nss/cmd/crmftest -resource-dir /usr/lib/llvm-22/lib/clang/22 -D HAVE_STRERROR -D LINUX -D linux -D XP_UNIX -D XP_UNIX -D DEBUG -U NDEBUG -D _DEFAULT_SOURCE -D _BSD_SOURCE -D _POSIX_SOURCE -D SDB_MEASURE_USE_TEMP_DIR -D _REENTRANT -D DEBUG -U NDEBUG -D _DEFAULT_SOURCE -D _BSD_SOURCE -D _POSIX_SOURCE -D SDB_MEASURE_USE_TEMP_DIR -D _REENTRANT -D NSS_DISABLE_SSE3 -D NSS_NO_INIT_SUPPORT -D USE_UTIL_DIRECTLY -D NO_NSPR_10_SUPPORT -D SSL_DISABLE_DEPRECATED_CIPHER_SUITE_NAMES -I ../../../dist/Linux6.1_x86_64_gcc_glibc_PTH_64_DBG.OBJ/include -I ../../../dist/public/nss -I ../../../dist/private/nss -internal-isystem /usr/lib/llvm-22/lib/clang/22/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/15/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -std=c99 -ferror-limit 19 -fgnuc-version=4.2.1 -fskip-odr-check-in-gmf -analyzer-output=html -analyzer-config stable-report-filename=true -faddrsig -fdwarf2-cfi-asm -o /tmp/scan-build-2026-02-23-233301-2142034-1 -x c testcrmf.c
1/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */

5/*
* This program does 5 separate functions.  By default, it does them all.
* It can be told to do any subset of them.
* It does them in this order:
*
* 1. Generate file of CRMF cert requests.
*     Generates 2 keys pairs, one for signing, one for encryption.
*     Can generate RSA or DSA (XXX - DSA is only useful for signing).
*     Generate a cert request for each of the two public keys.
*     Generate a single CRMF cert request message that requests both certs.
*     Leave the generated CRMF request message in file
*         configdir/CertReqMessages.der
*
* 2. Decode CRMF Request(s) Message.
*  Reads in the file   configdir/CertReqMessages.der
*  (either generated by step 1 above, or user supplied).
*  Decodes it.  NOTHING MORE.  Drops these decoded results on the floor.
*  The CMMF response (below) contains a completely unrelated cert.  :-(
*
* 3. CMMF "Stuff".
*  a)  Generates a CMMF response, containing a single cert chain, as if
*  it was a response to a received CRMF request.  But the cert is
*  simply a user cert from the user's local soft token, whose
*  nickname is given in the -p option.  The CMMF response has no
*  relationship to the request generated above.  The CMMF message
*  is placed in configdir/CertRepContent.der.
*  b)  Decodes the newly generated CMMF response found in file
*  configdir/CertRepContent.der and discards the result.  8-/
*  c)  Generate a CMMF Key Escrow message
*      needs 2 nicknames:
*      It takes the public and private keys for the cert identified
*      by -p nickname, and wraps them with a sym key that is in turn
*      wrapped with the pubkey in the CA cert, whose nickname is
*      given with the -s option.
*      Store the message in configdir/KeyRecRepContent.der
*  d)  Decode the CMMF Key Escrow message generated just above.
*      Get it from file configdir/KeyRecRepContent.der
*      This is just a decoder test.  Results are discarded.
*
* 4. Key Recovery
*  This code does not yet compile, and what it was intended to do
*  has not been fully determined.
*
* 5. Challenge/Response.
*  Haven't analyzed this code yet.
*
*
*/

54/* KNOWN BUGS:
55** 1. generates BOTH signing and encryption cert requests, even for DSA keys.
56**
57** 2. Does not verify the siganture in the "Proof of Posession" in the
58**  decoded cert requests.  It only checks syntax of the POP.
59** 3. CMMF "Stuff" should be broken up into separate steps, each of
60**  which may be optionally selected.
61*/

63#include <stdio.h>
64#include "nspr.h"
65#include "nss.h"
66#include "crmf.h"
67#include "secerr.h"
68#include "pk11func.h"
69#include "keyhi.h"
70#include "cmmf.h"
71#include "plgetopt.h"
72#include "secutil.h"
73#include "pk11pqg.h"

75#if 0
76#include "pkcs11.h"
77#include "secmod.h"
78#include "secmodi.h"
79#include "pqggen.h"
80#include "secmod.h"
81#include "secmodi.h"
82#include "pkcs11.h"
83#include "secitem.h"
84#include "secasn1.h"
85#include "sechash.h"
86#endif

88#define MAX_KEY_LEN1024 1024
89#define PATH_LEN150 150
90#define BUFF_SIZE150 150
91#define UID_BITS800 800
92#define BPB8 8
93#define CRMF_FILE"CertReqMessages.der" "CertReqMessages.der"

95PRTime notBefore;
96char *personalCert = NULL((void*)0);
97char *recoveryEncrypter = NULL((void*)0);
98char *caCertName = NULL((void*)0);
99static secuPWData pwdata = { PW_NONE, 0 };
100char *configdir;
101PRBool doingDSA = PR_FALSE0;

103CERTCertDBHandle *db;

105typedef struct {
  SECKEYPrivateKey *privKey;
  SECKEYPublicKey *pubKey;
  CRMFCertRequest *certReq;
  CRMFCertReqMsg *certReqMsg;
110} TESTKeyPair;

112void
113debug_test(SECItem *src, char *filePath)
114{
  PRFileDesc *fileDesc;

  fileDesc = PR_Open(filePath, PR_WRONLY0x02 | PR_CREATE_FILE0x08 | PR_TRUNCATE0x20,
                     0666);
  if (fileDesc == NULL((void*)0)) {
      printf("Could not cretae file %s.\n", filePath);
      return;
  }
  PR_Write(fileDesc, src->data, src->len);
124}

126SECStatus
127get_serial_number(long *dest)
128{
  SECStatus rv;

  if (dest == NULL((void*)0)) {
      PORT_SetErrorPORT_SetError_Util(SEC_ERROR_INVALID_ARGS);
      return SECFailure;
  }
  rv = PK11_GenerateRandom((unsigned char *)dest, sizeof(long));
  if (rv != SECSuccess) {
      /* PK11_GenerateRandom calls PORT_SetError */
      return SECFailure;
  }
  /* make serial number positive */
  if (*dest < 0L)
      *dest = -*dest;
  return SECSuccess;
144}

146PK11RSAGenParams *
147GetRSAParams(void)
148{
  PK11RSAGenParams *rsaParams;

  rsaParams = PORT_ZNew(PK11RSAGenParams)(PK11RSAGenParams *)PORT_ZAlloc_Util(sizeof(PK11RSAGenParams)
);

  if (rsaParams == NULL((void*)0))
      return NULL((void*)0);

  rsaParams->keySizeInBits = MAX_KEY_LEN1024;
  rsaParams->pe = 0x10001;

  return rsaParams;
160}

162PQGParams *
163GetDSAParams(void)
164{
  PQGParams *params = NULL((void*)0);
  PQGVerify *vfy = NULL((void*)0);

  SECStatus rv;

  rv = PK11_PQG_ParamGen(0, &params, &vfy);
  if (rv != SECSuccess) {
      return NULL((void*)0);
  }
  PK11_PQG_DestroyVerify(vfy);
  return params;
176}

178/* Generate a key pair, and then generate a subjectPublicKeyInfo
179** for the public key in that pair.  return all 3.
180*/
181CERTSubjectPublicKeyInfo *
182GetSubjectPubKeyInfo(TESTKeyPair *pair)
183{
  CERTSubjectPublicKeyInfo *spki = NULL((void*)0);
  SECKEYPrivateKey *privKey = NULL((void*)0);
  SECKEYPublicKey *pubKey = NULL((void*)0);
  PK11SlotInfo *keySlot = NULL((void*)0);

  keySlot = PK11_GetInternalKeySlot();
  PK11_Authenticate(keySlot, PR_FALSE0, &pwdata);

  if (!doingDSA) {
      PK11RSAGenParams *rsaParams = GetRSAParams();
      if (rsaParams == NULL((void*)0)) {
          PK11_FreeSlot(keySlot);
          return NULL((void*)0);
      }
      privKey = PK11_GenerateKeyPair(keySlot, CKM_RSA_PKCS_KEY_PAIR_GEN0x00000000UL,
                                     (void *)rsaParams, &pubKey, PR_FALSE0,
                                     PR_FALSE0, &pwdata);
      PORT_FreePORT_Free_Util(rsaParams);
  } else {
      PQGParams *dsaParams = GetDSAParams();
      if (dsaParams == NULL((void*)0)) {
          PK11_FreeSlot(keySlot);
          return NULL((void*)0);
      }
      privKey = PK11_GenerateKeyPair(keySlot, CKM_DSA_KEY_PAIR_GEN0x00000010UL,
                                     (void *)dsaParams, &pubKey, PR_FALSE0,
                                     PR_FALSE0, &pwdata);
  }
  PK11_FreeSlot(keySlot);
  if (privKey == NULL((void*)0) || pubKey == NULL((void*)0)) {
      if (pubKey) {
          SECKEY_DestroyPublicKey(pubKey);
      }
      if (privKey) {
          SECKEY_DestroyPrivateKey(privKey);
      }
      return NULL((void*)0);
  }

  spki = SECKEY_CreateSubjectPublicKeyInfo(pubKey);
  pair->privKey = privKey;
  pair->pubKey = pubKey;
  return spki;
227}

229SECStatus
230InitPKCS11(void)
231{
  PK11SlotInfo *keySlot;

  PK11_SetPasswordFunc(SECU_GetModulePassword);

  keySlot = PK11_GetInternalKeySlot();

  if (PK11_NeedUserInit(keySlot) && PK11_NeedLogin(keySlot)) {
      if (SECU_ChangePW(keySlot, NULL((void*)0), NULL((void*)0)) != SECSuccess) {
          printf("Initializing the PINs failed.\n");
          return SECFailure;
      }
  }

  PK11_FreeSlot(keySlot);
  return SECSuccess;
247}

249void
250WriteItOut(void *arg, const char *buf, unsigned long len)
251{
  PRFileDesc *fileDesc = (PRFileDesc *)arg;

  PR_Write(fileDesc, (void *)buf, len);
255}

257CRMFCertExtCreationInfo *
258GetExtensions(void)
259{
  unsigned char keyUsage[4] = { 0x03, 0x02, 0x07, KU_DIGITAL_SIGNATURE(0x80) };
  /* What are these magic numbers? */
  SECItem data = { 0, NULL((void*)0), 0 };
  CRMFCertExtension *extension;
  CRMFCertExtCreationInfo *extInfo =
      PORT_ZNew(CRMFCertExtCreationInfo)(CRMFCertExtCreationInfo *)PORT_ZAlloc_Util(sizeof(CRMFCertExtCreationInfo
));

  data.data = keyUsage;
  data.len = sizeof keyUsage;

  extension =
      CRMF_CreateCertExtension(SEC_OID_X509_KEY_USAGE, PR_FALSE0, &data);
  if (extension && extInfo) {
      extInfo->numExtensions = 1;
      extInfo->extensions = PORT_ZNewArray(CRMFCertExtension *, 1)(CRMFCertExtension * *)PORT_ZAlloc_Util(sizeof(CRMFCertExtension
 *) * (1));
      extInfo->extensions[0] = extension;
  }
  return extInfo;
278}

280void
281FreeExtInfo(CRMFCertExtCreationInfo *extInfo)
282{
  int i;

  for (i = 0; i < extInfo->numExtensions; i++) {
      CRMF_DestroyCertExtension(extInfo->extensions[i]);
  }
  PORT_FreePORT_Free_Util(extInfo->extensions);
  PORT_FreePORT_Free_Util(extInfo);
290}

292int
293InjectCertName(CRMFCertRequest *certReq,
             CRMFCertTemplateField inTemplateField,
             const char *inNameString)
296{
  char *nameStr;
  CERTName *name;
  int irv = 0;

  nameStr = PORT_StrdupPORT_Strdup_Util(inNameString);
  if (!nameStr)
      return 5;
  name = CERT_AsciiToName(nameStr);
  if (name == NULL((void*)0)) {
      printf("Could not create CERTName structure from %s.\n", nameStr);
      irv = 5;
      goto finish;
  }

  irv = CRMF_CertRequestSetTemplateField(certReq, inTemplateField, (void *)name);
  if (irv != SECSuccess) {
      printf("Could not add name to cert template\n");
      irv = 6;
  }

317finish:
  PORT_FreePORT_Free_Util(nameStr);
  if (name)
      CERT_DestroyName(name);
  return irv;
322}

324int
325CreateCertRequest(TESTKeyPair *pair, long inRequestID)
326{
  CERTCertificate *caCert;
  CERTSubjectPublicKeyInfo *spki;
  CRMFCertExtCreationInfo *extInfo;
  CRMFCertRequest *certReq;
  CRMFEncryptedKey *encKey;
  CRMFPKIArchiveOptions *pkiArchOpt;
  SECAlgorithmID *algID;
  long serialNumber;
  long version = 3;
  SECStatus rv;
  CRMFValidityCreationInfo validity;
  unsigned char UIDbuf[UID_BITS800 / BPB8];
  SECItem issuerUID = { siBuffer, NULL((void*)0), 0 };
  SECItem subjectUID = { siBuffer, NULL((void*)0), 0 };

  /* len in bits */
  issuerUID.data = UIDbuf;
  issuerUID.len = UID_BITS800;
  subjectUID.data = UIDbuf;
  subjectUID.len = UID_BITS800;

  pair->certReq = NULL((void*)0);
  certReq = CRMF_CreateCertRequest(inRequestID);
  if (certReq == NULL((void*)0)) {
      printf("Could not initialize a certificate request.\n");
      return 1;
  }

  /* set to version 3 */
  rv = CRMF_CertRequestSetTemplateField(certReq, crmfVersion,
                                        (void *)(&version));
  if (rv != SECSuccess) {
      printf("Could not add the version number to the "
             "Certificate Request.\n");
      CRMF_DestroyCertRequest(certReq);
      return 2;
  }

  /* set serial number */
  if (get_serial_number(&serialNumber) != SECSuccess) {
      printf("Could not generate a serial number for cert request.\n");
      CRMF_DestroyCertRequest(certReq);
      return 3;
  }
  rv = CRMF_CertRequestSetTemplateField(certReq, crmfSerialNumber,
                                        (void *)(&serialNumber));
  if (rv != SECSuccess) {
      printf("Could not add serial number to certificate template\n.");
      CRMF_DestroyCertRequest(certReq);
      return 4;
  }

  /* Set issuer name */
  rv = InjectCertName(certReq, crmfIssuer,
                      "CN=mozilla CA Shack,O=Information Systems");
  if (rv) {
      printf("Could not add issuer to cert template\n");
      CRMF_DestroyCertRequest(certReq);
      return 5;
  }

  /* Set Subject Name */
  rv = InjectCertName(certReq, crmfSubject,
                      "CN=mozilla CA Shack ID,O=Engineering,C=US");
  if (rv) {
      printf("Could not add Subject to cert template\n");
      CRMF_DestroyCertRequest(certReq);
      return 5;
  }

  /* Set Algorithm ID */
  algID = PK11_CreatePBEAlgorithmID(SEC_OID_PKCS5_PBE_WITH_SHA1_AND_DES_CBC,
                                    1, NULL((void*)0));
  if (algID == NULL((void*)0)) {
      printf("Couldn't create algorithm ID\n");
      CRMF_DestroyCertRequest(certReq);
      return 9;
  }
  rv = CRMF_CertRequestSetTemplateField(certReq, crmfSigningAlg, (void *)algID);
  SECOID_DestroyAlgorithmIDSECOID_DestroyAlgorithmID_Util(algID, PR_TRUE1);
  if (rv != SECSuccess) {
      printf("Could not add the signing algorithm to the cert template.\n");
      CRMF_DestroyCertRequest(certReq);
      return 10;
  }

  /* Set Validity Dates */
  validity.notBefore = &notBefore;
  validity.notAfter = NULL((void*)0);
  notBefore = PR_Now();
  rv = CRMF_CertRequestSetTemplateField(certReq, crmfValidity, (void *)(&validity));
  if (rv != SECSuccess) {
      printf("Could not add validity to cert template\n");
      CRMF_DestroyCertRequest(certReq);
      return 11;
  }

  /* Generate a key pair and Add the spki to the request */
  spki = GetSubjectPubKeyInfo(pair);
  if (spki == NULL((void*)0)) {
      printf("Could not create a Subject Public Key Info to add\n");
      CRMF_DestroyCertRequest(certReq);
      return 12;
  }
  rv = CRMF_CertRequestSetTemplateField(certReq, crmfPublicKey, (void *)spki);
  SECKEY_DestroySubjectPublicKeyInfo(spki);
  if (rv != SECSuccess) {
      printf("Could not add the public key to the template\n");
      CRMF_DestroyCertRequest(certReq);
      return 13;
  }

  /* Set the requested isser Unique ID */
  PK11_GenerateRandom(UIDbuf, sizeof UIDbuf);
  CRMF_CertRequestSetTemplateField(certReq, crmfIssuerUID, (void *)&issuerUID);

  /* Set the requested Subject Unique ID */
  PK11_GenerateRandom(UIDbuf, sizeof UIDbuf);
  CRMF_CertRequestSetTemplateField(certReq, crmfSubjectUID, (void *)&subjectUID);

  /* Add extensions - XXX need to understand these magic numbers */
  extInfo = GetExtensions();
  CRMF_CertRequestSetTemplateField(certReq, crmfExtension, (void *)extInfo);
  FreeExtInfo(extInfo);

  /* get the recipient CA's cert */
  caCert = CERT_FindCertByNickname(db, caCertName);
  if (caCert == NULL((void*)0)) {
      printf("Could not find the certificate for %s\n", caCertName);
      CRMF_DestroyCertRequest(certReq);
      return 50;
  }
  encKey = CRMF_CreateEncryptedKeyWithEncryptedValue(pair->privKey, caCert);
  CERT_DestroyCertificate(caCert);
  if (encKey == NULL((void*)0)) {
      printf("Could not create Encrypted Key with Encrypted Value.\n");
      return 14;
  }
  pkiArchOpt = CRMF_CreatePKIArchiveOptions(crmfEncryptedPrivateKey, encKey);
  CRMF_DestroyEncryptedKey(encKey);
  if (pkiArchOpt == NULL((void*)0)) {
      printf("Could not create PKIArchiveOptions.\n");
      return 15;
  }
  rv = CRMF_CertRequestSetPKIArchiveOptions(certReq, pkiArchOpt);
  CRMF_DestroyPKIArchiveOptions(pkiArchOpt);
  if (rv != SECSuccess) {
      printf("Could not add the PKIArchiveControl to Cert Request.\n");
      return 16;
  }
  pair->certReq = certReq;
  return 0;
479}

481int
482Encode(CRMFCertReqMsg *inCertReq1, CRMFCertReqMsg *inCertReq2)
483{
  PRFileDesc *fileDesc;
  SECStatus rv;
  int irv = 0;
  CRMFCertReqMsg *msgArr[3];
  char filePath[PATH_LEN150];

  PR_snprintf(filePath, PATH_LEN150, "%s/%s", configdir, CRMF_FILE"CertReqMessages.der");
  fileDesc = PR_Open(filePath, PR_WRONLY0x02 | PR_CREATE_FILE0x08 | PR_TRUNCATE0x20,
                     0666);
  if (fileDesc == NULL((void*)0)) {
      printf("Could not open file %s\n", filePath);
      irv = 14;
      goto finish;
  }
  msgArr[0] = inCertReq1;
  msgArr[1] = inCertReq2;
  msgArr[2] = NULL((void*)0);
  rv = CRMF_EncodeCertReqMessages(msgArr, WriteItOut, (void *)fileDesc);
  if (rv != SECSuccess) {
      printf("An error occurred while encoding.\n");
      irv = 15;
  }
506finish:
  PR_Close(fileDesc);
  return irv;
509}

511int
512AddProofOfPossession(TESTKeyPair *pair,
                   CRMFPOPChoice inPOPChoice)
514{

  switch (inPOPChoice) {
      case crmfSignature:
          CRMF_CertReqMsgSetSignaturePOP(pair->certReqMsg, pair->privKey,
                                         pair->pubKey, NULL((void*)0), NULL((void*)0), &pwdata);
          break;
      case crmfRAVerified:
          CRMF_CertReqMsgSetRAVerifiedPOP(pair->certReqMsg);
          break;
      case crmfKeyEncipherment:
          CRMF_CertReqMsgSetKeyEnciphermentPOP(pair->certReqMsg,
                                               crmfSubsequentMessage,
                                               crmfChallengeResp, NULL((void*)0));
          break;
      case crmfKeyAgreement: {
          SECItem pendejo;
          unsigned char lame[] = { 0xf0, 0x0f, 0xf0, 0x0f, 0xf0 };

          pendejo.data = lame;
          pendejo.len = 5;

          CRMF_CertReqMsgSetKeyAgreementPOP(pair->certReqMsg, crmfThisMessage,
                                            crmfNoSubseqMess, &pendejo);
      } break;
      default:
          return 1;
  }
  return 0;
543}

545int
546Decode(void)
547{
  PRFileDesc *fileDesc;
  CRMFCertReqMsg *certReqMsg;
  CRMFCertRequest *certReq;
  CRMFCertReqMessages *certReqMsgs;
  SECStatus rv;
  int numMsgs, i;
  long lame;
  CRMFGetValidity validity = { NULL((void*)0), NULL((void*)0) };
  SECItem item = { siBuffer, NULL((void*)0), 0 };
  char filePath[PATH_LEN150];

  PR_snprintf(filePath, PATH_LEN150, "%s/%s", configdir, CRMF_FILE"CertReqMessages.der");
  fileDesc = PR_Open(filePath, PR_RDONLY0x01, 0644);
  if (fileDesc == NULL((void*)0)) {
      printf("Could not open file %s\n", filePath);
      return 214;
  }
  rv = SECU_FileToItem(&item, fileDesc);
  PR_Close(fileDesc);
  if (rv != SECSuccess) {
      return 215;
  }

  certReqMsgs = CRMF_CreateCertReqMessagesFromDER((char *)item.data, item.len);
  if (certReqMsgs == NULL((void*)0)) {
      printf("Error decoding CertReqMessages.\n");
      return 202;
  }
  numMsgs = CRMF_CertReqMessagesGetNumMessages(certReqMsgs);
  if (numMsgs <= 0) {
      printf("WARNING: The DER contained %d messages.\n", numMsgs);
  }
  for (i = 0; i < numMsgs; i++) {
      printf("crmftest: Processing cert request %d\n", i);
      certReqMsg = CRMF_CertReqMessagesGetCertReqMsgAtIndex(certReqMsgs, i);
      if (certReqMsg == NULL((void*)0)) {
          printf("ERROR: Could not access the message at index %d of %s\n",
                 i, filePath);
      }
      rv = CRMF_CertReqMsgGetID(certReqMsg, &lame);
      if (rv) {
          SECU_PrintError("crmftest", "CRMF_CertReqMsgGetID");
      }
      certReq = CRMF_CertReqMsgGetCertRequest(certReqMsg);
      if (!certReq) {
          SECU_PrintError("crmftest", "CRMF_CertReqMsgGetCertRequest");
      }
      rv = CRMF_CertRequestGetCertTemplateValidity(certReq, &validity);
      if (rv) {
          SECU_PrintError("crmftest", "CRMF_CertRequestGetCertTemplateValidity");
      }
      if (!validity.notBefore) {
          /* We encoded a notBefore, so somthing's wrong if it's not here. */
          printf("ERROR: Validity period notBefore date missing.\n");
      }
      /* XXX It's all parsed now.  We probably should DO SOMETHING with it.
       ** But nope.  We just throw it all away.
       ** Maybe this was intended to be no more than a decoder test.
       */
      CRMF_DestroyGetValidity(&validity);
      CRMF_DestroyCertRequest(certReq);
      CRMF_DestroyCertReqMsg(certReqMsg);
  }
  CRMF_DestroyCertReqMessages(certReqMsgs);
  SECITEM_FreeItemSECITEM_FreeItem_Util(&item, PR_FALSE0);
  return 0;
614}

616int
617GetBitsFromFile(const char *filePath, SECItem *item)
618{
  PRFileDesc *fileDesc;
  SECStatus rv;

  fileDesc = PR_Open(filePath, PR_RDONLY0x01, 0644);
  if (fileDesc == NULL((void*)0)) {
      printf("Could not open file %s\n", filePath);
      return 14;
  }

  rv = SECU_FileToItem(item, fileDesc);
  PR_Close(fileDesc);

  if (rv != SECSuccess) {
      item->data = NULL((void*)0);
      item->len = 0;
      return 15;
  }
  return 0;
637}

639int
640DecodeCMMFCertRepContent(char *derFile)
641{
  CMMFCertRepContent *certRepContent;
  int irv = 0;
  SECItem fileBits = { siBuffer, NULL((void*)0), 0 };

  GetBitsFromFile(derFile, &fileBits);
  if (fileBits.data == NULL((void*)0)) {
      printf("Could not get bits from file %s\n", derFile);
      return 304;
  }
  certRepContent = CMMF_CreateCertRepContentFromDER(db,
                                                    (char *)fileBits.data, fileBits.len);
  if (certRepContent == NULL((void*)0)) {
      printf("Error while decoding %s\n", derFile);
      irv = 303;
  } else {
      /* That was fun.  Now, let's throw it away!  */
      CMMF_DestroyCertRepContent(certRepContent);
  }
  SECITEM_FreeItemSECITEM_FreeItem_Util(&fileBits, PR_FALSE0);
  return irv;
662}

664int
665EncodeCMMFCertReply(const char *filePath,
                  CERTCertificate *cert,
                  CERTCertList *list)
668{
  int rv = 0;
  SECStatus srv;
  PRFileDesc *fileDesc = NULL((void*)0);
  CMMFCertRepContent *certRepContent = NULL((void*)0);
  CMMFCertResponse *certResp = NULL((void*)0);
  CMMFCertResponse *certResponses[3];

  certResp = CMMF_CreateCertResponse(0xff123);
  CMMF_CertResponseSetPKIStatusInfoStatus(certResp, cmmfGranted);

  CMMF_CertResponseSetCertificate(certResp, cert);

  certResponses[0] = certResp;
  certResponses[1] = NULL((void*)0);
  certResponses[2] = NULL((void*)0);

  certRepContent = CMMF_CreateCertRepContent();
  CMMF_CertRepContentSetCertResponses(certRepContent, certResponses, 1);

  CMMF_CertRepContentSetCAPubs(certRepContent, list);

  fileDesc = PR_Open(filePath, PR_WRONLY0x02 | PR_CREATE_FILE0x08 | PR_TRUNCATE0x20,
                     0666);
  if (fileDesc == NULL((void*)0)) {
      printf("Could not open file %s\n", filePath);
      rv = 400;
      goto finish;
  }

  srv = CMMF_EncodeCertRepContent(certRepContent, WriteItOut,
                                  (void *)fileDesc);
  PR_Close(fileDesc);
  if (srv != SECSuccess) {
      printf("CMMF_EncodeCertRepContent failed,\n");
      rv = 401;
  }
705finish:
  if (certRepContent) {
      CMMF_DestroyCertRepContent(certRepContent);
  }
  if (certResp) {
      CMMF_DestroyCertResponse(certResp);
  }
  return rv;
713}

715/* Extract the public key from the cert whose nickname is given. */
716int
717extractPubKeyFromNamedCert(const char *nickname, SECKEYPublicKey **pPubKey)
718{
  CERTCertificate *caCert = NULL((void*)0);
  SECKEYPublicKey *caPubKey = NULL((void*)0);
  int rv = 0;

  caCert = CERT_FindCertByNickname(db, (char *)nickname);
  if (caCert == NULL((void*)0)) {
      printf("Could not get the certifcate for %s\n", caCertName);
      rv = 411;
      goto finish;
  }
  caPubKey = CERT_ExtractPublicKey(caCert);
  if (caPubKey == NULL((void*)0)) {
      printf("Could not extract the public from the "
             "certificate for \n%s\n",
             caCertName);
      rv = 412;
  }
736finish:
  *pPubKey = caPubKey;
  CERT_DestroyCertificate(caCert);
  caCert = NULL((void*)0);
  return rv;
741}

743int
744EncodeCMMFRecoveryMessage(const char *filePath,
                        CERTCertificate *cert,
                        CERTCertList *list)
747{
  SECKEYPublicKey *caPubKey = NULL((void*)0);
  SECKEYPrivateKey *privKey = NULL((void*)0);
  CMMFKeyRecRepContent *repContent = NULL((void*)0);
  PRFileDesc *fileDesc;
  int rv = 0;
  SECStatus srv;

  /* Extract the public key from the cert whose nickname is given in
  ** the -s option.
  */
  rv = extractPubKeyFromNamedCert(caCertName, &caPubKey);
  if (rv)
      goto finish;

  repContent = CMMF_CreateKeyRecRepContent();
  if (repContent == NULL((void*)0)) {
      printf("Could not allocate a CMMFKeyRecRepContent structure\n");
      rv = 407;
      goto finish;
  }
  srv = CMMF_KeyRecRepContentSetPKIStatusInfoStatus(repContent,
                                                    cmmfGrantedWithMods);
  if (srv != SECSuccess) {
      printf("Error trying to set PKIStatusInfo for "
             "CMMFKeyRecRepContent.\n");
      rv = 406;
      goto finish;
  }
  srv = CMMF_KeyRecRepContentSetNewSignCert(repContent, cert);
  if (srv != SECSuccess) {
      printf("Error trying to set the new signing certificate for "
             "key recovery\n");
      rv = 408;
      goto finish;
  }
  srv = CMMF_KeyRecRepContentSetCACerts(repContent, list);
  if (srv != SECSuccess) {
      printf("Errory trying to add the list of CA certs to the "
             "CMMFKeyRecRepContent structure.\n");
      rv = 409;
      goto finish;
  }
  privKey = PK11_FindKeyByAnyCert(cert, &pwdata);
  if (privKey == NULL((void*)0)) {
      printf("Could not get the private key associated with the\n"
             "certificate %s\n",
             personalCert);
      rv = 410;
      goto finish;
  }

  srv = CMMF_KeyRecRepContentSetCertifiedKeyPair(repContent, cert, privKey,
                                                 caPubKey);
  if (srv != SECSuccess) {
      printf("Could not set the Certified Key Pair\n");
      rv = 413;
      goto finish;
  }
  fileDesc = PR_Open(filePath, PR_WRONLY0x02 | PR_CREATE_FILE0x08 | PR_TRUNCATE0x20,
                     0666);
  if (fileDesc == NULL((void*)0)) {
      printf("Could not open file %s\n", filePath);
      rv = 414;
      goto finish;
  }

  srv = CMMF_EncodeKeyRecRepContent(repContent, WriteItOut,
                                    (void *)fileDesc);
  PR_Close(fileDesc);
  if (srv != SECSuccess) {
      printf("CMMF_EncodeKeyRecRepContent failed\n");
      rv = 415;
  }
821finish:
  if (privKey)
      SECKEY_DestroyPrivateKey(privKey);
  if (caPubKey)
      SECKEY_DestroyPublicKey(caPubKey);
  if (repContent)
      CMMF_DestroyKeyRecRepContent(repContent);
  return rv;
829}

831int
832decodeCMMFRecoveryMessage(const char *filePath)
833{
  CMMFKeyRecRepContent *repContent = NULL((void*)0);
  int rv = 0;
  SECItem fileBits = { siBuffer, NULL((void*)0), 0 };

  GetBitsFromFile(filePath, &fileBits);
  if (!fileBits.len) {
      rv = 451;
      goto finish;
  }
  repContent =
      CMMF_CreateKeyRecRepContentFromDER(db, (const char *)fileBits.data,
                                         fileBits.len);
  if (repContent == NULL((void*)0)) {
      printf("ERROR: CMMF_CreateKeyRecRepContentFromDER failed on file:\n"
             "\t%s\n",
             filePath);
      rv = 452;
  }
852finish:
  if (repContent) {
      CMMF_DestroyKeyRecRepContent(repContent);
  }
  SECITEM_FreeItemSECITEM_FreeItem_Util(&fileBits, PR_FALSE0);
  return rv;
858}

860int
861DoCMMFStuff(void)
862{
  CERTCertificate *cert = NULL((void*)0);
  CERTCertList *list = NULL((void*)0);
  int rv = 0;
  char filePath[PATH_LEN150];

  /* Do common setup for the following steps.
   */
  PR_snprintf(filePath, PATH_LEN150, "%s/%s", configdir, "CertRepContent.der");

  cert = CERT_FindCertByNickname(db, personalCert);
  if (cert == NULL((void*)0)) {
      printf("Could not find the certificate for %s\n", personalCert);
      rv = 416;
      goto finish;
  }
  list = CERT_GetCertChainFromCert(cert, PR_Now(), certUsageEmailSigner);
  if (list == NULL((void*)0)) {
      printf("Could not find the certificate chain for %s\n", personalCert);
      rv = 418;
      goto finish;
  }

  /* a) Generate the CMMF response message, using a user cert named
  **    by -p option, rather than a cert generated from the CRMF
  **    request itself.   The CMMF message is placed in
  **    configdir/CertRepContent.der.
  */
  rv = EncodeCMMFCertReply(filePath, cert, list);
  if (rv != 0) {
      goto finish;
  }

  /* b) Decode the CMMF Cert granting message encoded just above,
  **    found in configdir/CertRepContent.der.
  **    This only tests the decoding.  The decoded content is discarded.
  */
  rv = DecodeCMMFCertRepContent(filePath);
  if (rv != 0) {
      goto finish;
  }

  /* c) Generate a CMMF Key Excrow message
  **    It takes the public and private keys for the cert identified
  **    by -p nickname, and wraps them with a sym key that is in turn
  **    wrapped with the pubkey in the CA cert, whose nickname is
  **    given by the -s option.
  **    Store the message in configdir/KeyRecRepContent.der
  */
  PR_snprintf(filePath, PATH_LEN150, "%s/%s", configdir,
              "KeyRecRepContent.der");

  rv = EncodeCMMFRecoveryMessage(filePath, cert, list);
  if (rv)
      goto finish;

  /* d) Decode the CMMF Key Excrow message generated just above.
  **    Get it from file configdir/KeyRecRepContent.der
  **    This is just a decoder test.  Results are discarded.
  */

  rv = decodeCMMFRecoveryMessage(filePath);

925finish:
  if (cert) {
      CERT_DestroyCertificate(cert);
  }
  if (list) {
      CERT_DestroyCertList(list);
  }
  return rv;
933}

935#define KNOWN_MESSAGE_LENGTH20 20 /*160 bits*/

937int
938DoKeyRecovery(SECKEYPrivateKey *privKey)
939{
940#ifdef DOING_KEY_RECOVERY /* Doesn't compile yet. */
  SECKEYPublicKey *pubKey;
  PK11SlotInfo *slot;
  unsigned char *ciphertext;
  unsigned char *text_compared;
  SECKEYPrivateKey *unwrappedPrivKey;
  SECKEYPrivateKey *caPrivKey;
  CMMFKeyRecRepContent *keyRecRep;
  CMMFCertifiedKeyPair *certKeyPair;
  CERTCertificate *caCert;
  CERTCertificate *myCert;
  SECKEYPublicKey *caPubKey;
  PRFileDesc *fileDesc;
  CK_ULONG max_bytes_encrypted;
  CK_ULONG bytes_encrypted;
  CK_ULONG bytes_compared;
  CK_ULONG bytes_decrypted;
  CK_RV crv;
  CK_OBJECT_HANDLE id;
  CK_MECHANISM mech = { CKM_INVALID_MECHANISM0xffffffffUL, NULL((void*)0), 0 };
  SECStatus rv;
  SECItem fileBits;
  SECItem nickname;
  unsigned char plaintext[KNOWN_MESSAGE_LENGTH20];
  char filePath[PATH_LEN150];
  static const unsigned char known_message[] = { "Known Crypto Message" };

  /*caCert = CERT_FindCertByNickname(db, caCertName);*/
  myCert = CERT_FindCertByNickname(db, personalCert);
  if (myCert == NULL((void*)0)) {
      printf("Could not find the certificate for %s\n", personalCert);
      return 700;
  }
  caCert = CERT_FindCertByNickname(db, recoveryEncrypter);
  if (caCert == NULL((void*)0)) {
      printf("Could not find the certificate for %s\n", recoveryEncrypter);
      return 701;
  }
  caPubKey = CERT_ExtractPublicKey(caCert);
  pubKey = SECKEY_ConvertToPublicKey(privKey);
  max_bytes_encrypted = PK11_GetPrivateModulusLen(privKey);
  slot = PK11_GetBestSlotWithAttributes(mapWrapKeyType(privKey->keyType),
                                        CKF_ENCRYPT0x00000100UL, 0, NULL((void*)0));
  id = PK11_ImportPublicKey(slot, pubKey, PR_FALSE0);

  switch (privKey->keyType) {
      case rsaKey:
          mech.mechanism = CKM_RSA_PKCS0x00000001UL;
          break;
      case dsaKey:
          mech.mechanism = CKM_DSA0x00000011UL;
          break;
      case dhKey:
          mech.mechanism = CKM_DH_PKCS_DERIVE0x00000021UL;
          break;
      default:
          printf("Bad Key type in key recovery.\n");
          return 512;
  }
  PK11_EnterSlotMonitor(slot);
  crv = PK11_GETTAB(slot)->C_EncryptInit(slot->session, &mech, id);
  if (crv != CKR_OK0x00000000UL) {
      PK11_ExitSlotMonitor(slot);
      PK11_FreeSlot(slot);
      printf("C_EncryptInit failed in KeyRecovery\n");
      return 500;
  }
  ciphertext = PORT_NewArray(unsigned char, max_bytes_encrypted)(unsigned char *)PORT_Alloc_Util(sizeof(unsigned char) * (max_bytes_encrypted
));
  if (ciphertext == NULL((void*)0)) {
      PK11_ExitSlotMonitor(slot);
      PK11_FreeSlot(slot);
      printf("Could not allocate memory for ciphertext.\n");
      return 501;
  }
  bytes_encrypted = max_bytes_encrypted;
  crv = PK11_GETTAB(slot)->C_Encrypt(slot->session,
                                     known_message,
                                     KNOWN_MESSAGE_LENGTH20,
                                     ciphertext,
                                     &bytes_encrypted);
  PK11_ExitSlotMonitor(slot);
  PK11_FreeSlot(slot);
  if (crv != CKR_OK0x00000000UL) {
      PORT_FreePORT_Free_Util(ciphertext);
      return 502;
  }
  /* Always use the smaller of these two values . . . */
  bytes_compared = (bytes_encrypted > KNOWN_MESSAGE_LENGTH20)
                       ? KNOWN_MESSAGE_LENGTH20
                       : bytes_encrypted;

  /* If there was a failure, the plaintext */
  /* goes at the end, therefore . . .      */
  text_compared = (bytes_encrypted > KNOWN_MESSAGE_LENGTH20)
                      ? (ciphertext + bytes_encrypted -
                         KNOWN_MESSAGE_LENGTH20)
                      : ciphertext;

  keyRecRep = CMMF_CreateKeyRecRepContent();
  if (keyRecRep == NULL((void*)0)) {
      PORT_FreePORT_Free_Util(ciphertext);
      PK11_FreeSlot(slot);
      CMMF_DestroyKeyRecRepContent(keyRecRep);
      printf("Could not allocate a CMMFKeyRecRepContent structre.\n");
      return 503;
  }
  rv = CMMF_KeyRecRepContentSetPKIStatusInfoStatus(keyRecRep,
                                                   cmmfGranted);
  if (rv != SECSuccess) {
      PORT_FreePORT_Free_Util(ciphertext);
      PK11_FreeSlot(slot);
      CMMF_DestroyKeyRecRepContent(keyRecRep);
      printf("Could not set the status for the KeyRecRepContent\n");
      return 504;
  }
  /* The myCert here should correspond to the certificate corresponding
   * to the private key, but for this test any certificate will do.
   */
  rv = CMMF_KeyRecRepContentSetCertifiedKeyPair(keyRecRep, myCert,
                                                privKey, caPubKey);
  if (rv != SECSuccess) {
      PORT_FreePORT_Free_Util(ciphertext);
      PK11_FreeSlot(slot);
      CMMF_DestroyKeyRecRepContent(keyRecRep);
      printf("Could not set the Certified Key Pair\n");
      return 505;
  }
  PR_snprintf(filePath, PATH_LEN150, "%s/%s", configdir,
              "KeyRecRepContent.der");
  fileDesc = PR_Open(filePath, PR_WRONLY0x02 | PR_CREATE_FILE0x08 | PR_TRUNCATE0x20,
                     0666);
  if (fileDesc == NULL((void*)0)) {
      PORT_FreePORT_Free_Util(ciphertext);
      PK11_FreeSlot(slot);
      CMMF_DestroyKeyRecRepContent(keyRecRep);
      printf("Could not open file %s\n", filePath);
      return 506;
  }
  rv = CMMF_EncodeKeyRecRepContent(keyRecRep, WriteItOut, fileDesc);
  CMMF_DestroyKeyRecRepContent(keyRecRep);
  PR_Close(fileDesc);

  if (rv != SECSuccess) {
      PORT_FreePORT_Free_Util(ciphertext);
      PK11_FreeSlot(slot);
      printf("Error while encoding CMMFKeyRecRepContent\n");
      return 507;
  }
  GetBitsFromFile(filePath, &fileBits);
  if (fileBits.data == NULL((void*)0)) {
      PORT_FreePORT_Free_Util(ciphertext);
      PK11_FreeSlot(slot);
      printf("Could not get the bits from file %s\n", filePath);
      return 508;
  }
  keyRecRep =
      CMMF_CreateKeyRecRepContentFromDER(db, (const char *)fileBits.data,
                                         fileBits.len);
  if (keyRecRep == NULL((void*)0)) {
      printf("Could not decode the KeyRecRepContent in file %s\n",
             filePath);
      PORT_FreePORT_Free_Util(ciphertext);
      PK11_FreeSlot(slot);
      return 509;
  }
  caPrivKey = PK11_FindKeyByAnyCert(caCert, &pwdata);
  if (CMMF_KeyRecRepContentGetPKIStatusInfoStatus(keyRecRep) !=
      cmmfGranted) {
      PORT_FreePORT_Free_Util(ciphertext);
      PK11_FreeSlot(slot);
      CMMF_DestroyKeyRecRepContent(keyRecRep);
      printf("A bad status came back with the "
             "KeyRecRepContent structure\n");
      return 510;
  }

1116#define NICKNAME "Key Recovery Test Key"
  nickname.data = (unsigned char *)NICKNAME;
  nickname.len = PORT_Strlen(NICKNAME)strlen(NICKNAME);

  certKeyPair = CMMF_KeyRecRepContentGetCertKeyAtIndex(keyRecRep, 0);
  CMMF_DestroyKeyRecRepContent(keyRecRep);
  rv = CMMF_CertifiedKeyPairUnwrapPrivKey(certKeyPair,
                                          caPrivKey,
                                          &nickname,
                                          PK11_GetInternalKeySlot(),
                                          db,
                                          &unwrappedPrivKey, &pwdata);
  CMMF_DestroyCertifiedKeyPair(certKeyPair);
  if (rv != SECSuccess) {
      printf("Unwrapping the private key failed.\n");
      return 511;
  }
  /*Now let's try to decrypt the ciphertext with the "recovered" key*/
  PK11_EnterSlotMonitor(slot);
  crv =
      PK11_GETTAB(slot)->C_DecryptInit(unwrappedPrivKey->pkcs11Slot->session,
                                       &mech,
                                       unwrappedPrivKey->pkcs11ID);
  if (crv != CKR_OK0x00000000UL) {
      PK11_ExitSlotMonitor(slot);
      PORT_FreePORT_Free_Util(ciphertext);
      PK11_FreeSlot(slot);
      printf("Decrypting with the recovered key failed.\n");
      return 513;
  }
  bytes_decrypted = KNOWN_MESSAGE_LENGTH20;
  crv = PK11_GETTAB(slot)->C_Decrypt(unwrappedPrivKey->pkcs11Slot->session,
                                     ciphertext,
                                     bytes_encrypted, plaintext,
                                     &bytes_decrypted);
  SECKEY_DestroyPrivateKey(unwrappedPrivKey);
  PK11_ExitSlotMonitor(slot);
  PORT_FreePORT_Free_Util(ciphertext);
  if (crv != CKR_OK0x00000000UL) {
      PK11_FreeSlot(slot);
      printf("Decrypting the ciphertext with recovered key failed.\n");
      return 514;
  }
  if ((bytes_decrypted != KNOWN_MESSAGE_LENGTH20) ||
      (PORT_Memcmpmemcmp(plaintext, known_message, KNOWN_MESSAGE_LENGTH20) != 0)) {
      PK11_FreeSlot(slot);
      printf("The recovered plaintext does not equal the known message:\n"
             "\tKnown message:       %s\n"
             "\tRecovered plaintext: %s\n",
             known_message, plaintext);
      return 515;
  }
1168#endif
  return 0;
1170}

1172int
1173DoChallengeResponse(SECKEYPrivateKey *privKey,
                  SECKEYPublicKey *pubKey)
1175{
  CMMFPOPODecKeyChallContent *chalContent = NULL((void*)0);
  CMMFPOPODecKeyRespContent *respContent = NULL((void*)0);
  CERTCertificate *myCert = NULL((void*)0);
  CERTGeneralName *myGenName = NULL((void*)0);
  PLArenaPool *poolp = NULL((void*)0);
  PRFileDesc *fileDesc;
  SECItem *publicValue;
  SECItem *keyID;
  SECKEYPrivateKey *foundPrivKey;
  long *randomNums;
  int numChallengesFound = 0;
  int numChallengesSet = 1;
  int i;
  long retrieved;
  SECStatus rv;
  SECItem DecKeyChallBits;
  char filePath[PATH_LEN150];

  chalContent = CMMF_CreatePOPODecKeyChallContent();
  myCert = CERT_FindCertByNickname(db, personalCert);
  if (myCert == NULL((void*)0)) {
39
←
Assuming 'myCert' is not equal to NULL→
40
←
Taking false branch→
      printf("Could not find the certificate for %s\n", personalCert);
      return 900;
  }
  poolp = PORT_NewArenaPORT_NewArena_Util(1024);
  if (poolp == NULL((void*)0)) {
41
←
Assuming 'poolp' is not equal to NULL→
42
←
Taking false branch→
      printf("Could no allocate a new arena in DoChallengeResponse\n");
      return 901;
  }
  myGenName = CERT_GetCertificateNames(myCert, poolp);
  if (myGenName == NULL((void*)0)) {
43
←
Assuming 'myGenName' is not equal to NULL→
44
←
Taking false branch→
      printf("Could not get the general names for %s certificate\n",
             personalCert);
      return 902;
  }
  randomNums = PORT_ArenaNewArray(poolp, long, numChallengesSet)(long *)PORT_ArenaAlloc_Util(poolp, sizeof(long) * (numChallengesSet
));
  PK11_GenerateRandom((unsigned char *)randomNums,
                      numChallengesSet * sizeof(long));
  for (i = 0; i < numChallengesSet; i++) {
45
←
Loop condition is true.  Entering loop body→
48
←
Loop condition is false. Execution continues on line 1225→
      rv = CMMF_POPODecKeyChallContentSetNextChallenge(chalContent,
                                                       randomNums[i],
                                                       myGenName,
                                                       pubKey,
                                                       &pwdata);
      if (rv != SECSuccess) {
46
←
Assuming 'rv' is equal to SECSuccess→
47
←
Taking false branch→
          printf("Could not set the challenge in DoChallengeResponse\n");
          return 903;
      }
  }
  PR_snprintf(filePath, PATH_LEN150, "%s/POPODecKeyChallContent.der",
              configdir);
  fileDesc = PR_Open(filePath, PR_WRONLY0x02 | PR_CREATE_FILE0x08 | PR_TRUNCATE0x20,
                     0666);
  if (fileDesc == NULL((void*)0)) {
49
←
Assuming 'fileDesc' is not equal to NULL→
50
←
Taking false branch→
      printf("Could not open file %s\n", filePath);
      return 904;
  }
  rv = CMMF_EncodePOPODecKeyChallContent(chalContent, WriteItOut,
                                         (void *)fileDesc);
  PR_Close(fileDesc);
  CMMF_DestroyPOPODecKeyChallContent(chalContent);
  if (rv != SECSuccess) {
51
←
Assuming 'rv' is equal to SECSuccess→
52
←
Taking false branch→
      printf("Could not encode the POPODecKeyChallContent.\n");
      return 905;
  }
  GetBitsFromFile(filePath, &DecKeyChallBits);
  chalContent = CMMF_CreatePOPODecKeyChallContentFromDER((const char *)DecKeyChallBits.data, DecKeyChallBits.len);
  SECITEM_FreeItemSECITEM_FreeItem_Util(&DecKeyChallBits, PR_FALSE0);
  if (chalContent == NULL((void*)0)) {
53
←
Assuming 'chalContent' is not equal to NULL→
54
←
Taking false branch→
      printf("Could not create the POPODecKeyChallContent from DER\n");
      return 906;
  }
  numChallengesFound =
      CMMF_POPODecKeyChallContentGetNumChallenges(chalContent);
  if (numChallengesFound != numChallengesSet) {
55
←
Assuming 'numChallengesFound' is equal to 'numChallengesSet'→
56
←
Taking false branch→
      printf("Number of Challenges Found (%d) does not equal the number "
             "set (%d)\n",
             numChallengesFound, numChallengesSet);
      return 907;
  }
  for (i = 0; i < numChallengesSet; i++) {
57
←
Loop condition is true.  Entering loop body→
      publicValue = CMMF_POPODecKeyChallContentGetPublicValue(chalContent, i);
      if (publicValue == NULL((void*)0)) {
58
←
Assuming 'publicValue' is not equal to NULL→
59
←
Taking false branch→
          printf("Could not get the public value for challenge at index %d\n",
                 i);
          return 908;
      }
      keyID = PK11_MakeIDFromPubKey(publicValue);
      SECITEM_FreeItemSECITEM_FreeItem_Util(publicValue, PR_TRUE1);
      if (keyID == NULL((void*)0)) {
60
←
Assuming 'keyID' is not equal to NULL→
61
←
Taking false branch→
          printf("Could not make the keyID from the public value\n");
          return 909;
      }
      foundPrivKey = PK11_FindKeyByKeyID(privKey->pkcs11Slot, keyID, &pwdata);
62
←
Access to field 'pkcs11Slot' results in a dereference of a null pointer (loaded from variable 'privKey')
      SECITEM_FreeItemSECITEM_FreeItem_Util(keyID, PR_TRUE1);
      if (foundPrivKey == NULL((void*)0)) {
          printf("Could not find the private key corresponding to the public"
                 " value.\n");
          return 910;
      }
      rv = CMMF_POPODecKeyChallContDecryptChallenge(chalContent, i,
                                                    foundPrivKey);
      if (rv != SECSuccess) {
          printf("Could not decrypt the challenge at index %d\n", i);
          return 911;
      }
      rv = CMMF_POPODecKeyChallContentGetRandomNumber(chalContent, i,
                                                      &retrieved);
      if (rv != SECSuccess) {
          printf("Could not get the random number from the challenge at "
                 "index %d\n",
                 i);
          return 912;
      }
      if (retrieved != randomNums[i]) {
          printf("Retrieved the number (%ld), expected (%ld)\n", retrieved,
                 randomNums[i]);
          return 913;
      }
  }
  CMMF_DestroyPOPODecKeyChallContent(chalContent);
  PR_snprintf(filePath, PATH_LEN150, "%s/POPODecKeyRespContent.der",
              configdir);
  fileDesc = PR_Open(filePath, PR_WRONLY0x02 | PR_CREATE_FILE0x08 | PR_TRUNCATE0x20,
                     0666);
  if (fileDesc == NULL((void*)0)) {
      printf("Could not open file %s\n", filePath);
      return 914;
  }
  rv = CMMF_EncodePOPODecKeyRespContent(randomNums, numChallengesSet,
                                        WriteItOut, fileDesc);
  PR_Close(fileDesc);
  if (rv != 0) {
      printf("Could not encode the POPODecKeyRespContent\n");
      return 915;
  }
  GetBitsFromFile(filePath, &DecKeyChallBits);
  respContent =
      CMMF_CreatePOPODecKeyRespContentFromDER((const char *)DecKeyChallBits.data,
                                              DecKeyChallBits.len);
  if (respContent == NULL((void*)0)) {
      printf("Could not decode the contents of the file %s\n", filePath);
      return 916;
  }
  numChallengesFound =
      CMMF_POPODecKeyRespContentGetNumResponses(respContent);
  if (numChallengesFound != numChallengesSet) {
      printf("Number of responses found (%d) does not match the number "
             "of challenges set (%d)\n",
             numChallengesFound, numChallengesSet);
      return 917;
  }
  for (i = 0; i < numChallengesSet; i++) {
      rv = CMMF_POPODecKeyRespContentGetResponse(respContent, i, &retrieved);
      if (rv != SECSuccess) {
          printf("Could not retrieve the response at index %d\n", i);
          return 918;
      }
      if (retrieved != randomNums[i]) {
          printf("Retrieved the number (%ld), expected (%ld)\n", retrieved,
                 randomNums[i]);
          return 919;
      }
  }
  CMMF_DestroyPOPODecKeyRespContent(respContent);
  return 0;
1342}

1344int
1345MakeCertRequest(TESTKeyPair *pair, CRMFPOPChoice inPOPChoice, long inRequestID)
1346{
  int irv;

  /* Generate a key pair and a cert request for it. */
  irv = CreateCertRequest(pair, inRequestID);
  if (irv != 0 || pair->certReq == NULL((void*)0)) {
      goto loser;
  }

  pair->certReqMsg = CRMF_CreateCertReqMsg();
  if (!pair->certReqMsg) {
      irv = 999;
      goto loser;
  }
  /* copy certReq into certReqMsg */
  CRMF_CertReqMsgSetCertRequest(pair->certReqMsg, pair->certReq);
  irv = AddProofOfPossession(pair, inPOPChoice);
1363loser:
  return irv;
1365}

1367int
1368DestroyPairReqAndMsg(TESTKeyPair *pair)
1369{
  SECStatus rv = SECSuccess;
  int irv = 0;

  if (pair->certReq) {
      rv = CRMF_DestroyCertRequest(pair->certReq);
      pair->certReq = NULL((void*)0);
      if (rv != SECSuccess) {
          printf("Error when destroying cert request.\n");
          irv = 100;
      }
  }
  if (pair->certReqMsg) {
      rv = CRMF_DestroyCertReqMsg(pair->certReqMsg);
      pair->certReqMsg = NULL((void*)0);
      if (rv != SECSuccess) {
          printf("Error when destroying cert request msg.\n");
          if (!irv)
              irv = 101;
      }
  }
  return irv;
1391}

1393int
1394DestroyPair(TESTKeyPair *pair)
1395{
  int irv = 0;

  if (pair->pubKey) {
      SECKEY_DestroyPublicKey(pair->pubKey);
      pair->pubKey = NULL((void*)0);
  }
  if (pair->privKey) {
      SECKEY_DestroyPrivateKey(pair->privKey);
      pair->privKey = NULL((void*)0);
  }
  DestroyPairReqAndMsg(pair);
  return irv;
1408}

1410int
1411DoCRMFRequest(TESTKeyPair *signPair, TESTKeyPair *cryptPair)
1412{
  int irv, tirv = 0;

  /* Generate a key pair and a cert request for it. */
  irv = MakeCertRequest(signPair, crmfSignature, 0x0f020304);
  if (irv != 0 || signPair->certReq == NULL((void*)0)) {
      goto loser;
  }

  if (!doingDSA) {
      irv = MakeCertRequest(cryptPair, crmfKeyAgreement, 0x0f050607);
      if (irv != 0 || cryptPair->certReq == NULL((void*)0)) {
          goto loser;
      }
  }

  /* encode the cert request messages into a unified request message.
  ** leave it in a file with a fixed name.  :(
  */
  irv = Encode(signPair->certReqMsg, cryptPair->certReqMsg);

1433loser:
  if (signPair->certReq) {
      tirv = DestroyPairReqAndMsg(signPair);
      if (tirv && !irv)
          irv = tirv;
  }
  if (cryptPair->certReq) {
      tirv = DestroyPairReqAndMsg(cryptPair);
      if (tirv && !irv)
          irv = tirv;
  }
  return irv;
1445}

1447void
1448Usage(void)
1449{
  printf("Usage:\n"
         "\tcrmftest -d [Database Directory] -p [Personal Cert]\n"
         "\t         -e [Encrypter] -s [CA Certificate] [-P password]\n\n"
         "\t         [crmf] [dsa] [decode] [cmmf] [recover] [challenge]\n"
         "\t         [-f password_file]\n"
         "Database Directory\n"
         "\tThis is the directory where the key3.db, cert7.db, and\n"
         "\tsecmod.db files are located.  This is also the directory\n"
         "\twhere the program will place CRMF/CMMF der files\n"
         "Personal Cert\n"
         "\tThis is the certificate that already exists in the cert\n"
         "\tdatabase to use while encoding the response.  The private\n"
         "\tkey associated with the certificate must also exist in the\n"
         "\tkey database.\n"
         "Encrypter\n"
         "\tThis is the certificate to use when encrypting the the \n"
         "\tkey recovery response.  The private key for this cert\n"
         "\tmust also be present in the key database.\n"
         "CA Certificate\n"
         "\tThis is the nickname of the certificate to use as the\n"
         "\tCA when doing all of the encoding.\n");
1471}

1473#define TEST_MAKE_CRMF_REQ0x0001 0x0001
1474#define TEST_USE_DSA0x0002 0x0002
1475#define TEST_DECODE_CRMF_REQ0x0004 0x0004
1476#define TEST_DO_CMMF_STUFF0x0008 0x0008
1477#define TEST_KEY_RECOVERY0x0010 0x0010
1478#define TEST_CHALLENGE_RESPONSE0x0020 0x0020

1480SECStatus
1481parsePositionalParam(const char *arg, PRUint32 *flags)
1482{
  if (!strcmp(arg, "crmf")) {
6
←
Assuming the condition is false→
7
←
Taking false branch→
      *flags |= TEST_MAKE_CRMF_REQ0x0001;
  } else if (!strcmp(arg, "dsa")) {
8
←
Assuming the condition is false→
9
←
Taking false branch→
      *flags |= TEST_MAKE_CRMF_REQ0x0001 | TEST_USE_DSA0x0002;
      doingDSA = PR_TRUE1;
  } else if (!strcmp(arg, "decode")) {
10
←
Assuming the condition is false→
11
←
Taking false branch→
      *flags |= TEST_DECODE_CRMF_REQ0x0004;
  } else if (!strcmp(arg, "cmmf")) {
12
←
Assuming the condition is false→
13
←
Taking false branch→
      *flags |= TEST_DO_CMMF_STUFF0x0008;
  } else if (!strcmp(arg, "recover")) {
14
←
Assuming the condition is false→
15
←
Taking false branch→
      *flags |= TEST_KEY_RECOVERY0x0010;
  } else if (!strcmp(arg, "challenge")) {
16
←
Taking true branch→
      *flags |= TEST_CHALLENGE_RESPONSE0x0020;
  } else {
      printf("unknown positional paremeter: %s\n", arg);
      return SECFailure;
  }
  return SECSuccess;
17
←
Returning zero, which participates in a condition later→
1501}

1503/* it's not clear, in some cases, whether the desired key is from
1504** the sign pair or the crypt pair, so we're guessing in some places.
1505** This define serves to remind us of the places where we're guessing.
1506*/
1507#define WHICH_KEYcryptPair cryptPair

1509int
1510main(int argc, char **argv)
1511{
  TESTKeyPair signPair, cryptPair;
  PLOptState *optstate;
  PLOptStatus status;
  char *password = NULL((void*)0);
  char *pwfile = NULL((void*)0);
  int irv = 0;
  PRUint32 flags = 0;
  SECStatus rv;
  PRBool nssInit = PR_FALSE0;

  memset(&signPair, 0, sizeof signPair);
  memset(&cryptPair, 0, sizeof cryptPair);
1
Null pointer value stored to 'cryptPair.privKey'→
  printf("\ncrmftest v1.0\n");
  optstate = PL_CreateOptState(argc, argv, "d:p:e:s:P:f:");
  while ((status = PL_GetNextOpt(optstate)) == PL_OPT_OK) {
2
←
Assuming the condition is true→
3
←
Loop condition is true.  Entering loop body→
20
←
 Execution continues on line 1526→
21
←
Assuming the condition is true→
22
←
Loop condition is true.  Entering loop body→
26
←
 Execution continues on line 1526→
27
←
Assuming the condition is false→
28
←
Loop condition is false. Execution continues on line 1588→
      switch (optstate->option) {
4
←
Control jumps to 'case 0:'  at line 1576→
23
←
Control jumps to 'case 100:'  at line 1528→
          case 'd':
              configdir = PORT_StrdupPORT_Strdup_Util(optstate->value);
              rv = NSS_Init(configdir);
              if (rv != SECSuccess) {
24
←
Assuming 'rv' is equal to SECSuccess→
25
←
Taking false branch→
                  printf("NSS_Init (-d) failed\n");
                  return 101;
              }
              nssInit = PR_TRUE1;
              break;
          case 'p':
              personalCert = PORT_StrdupPORT_Strdup_Util(optstate->value);
              if (personalCert == NULL((void*)0)) {
                  printf("-p  failed\n");
                  return 603;
              }
              break;
          case 'e':
              recoveryEncrypter = PORT_StrdupPORT_Strdup_Util(optstate->value);
              if (recoveryEncrypter == NULL((void*)0)) {
                  printf("-e  failed\n");
                  return 602;
              }
              break;
          case 's':
              caCertName = PORT_StrdupPORT_Strdup_Util(optstate->value);
              if (caCertName == NULL((void*)0)) {
                  printf("-s  failed\n");
                  return 604;
              }
              break;
          case 'P':
              password = PORT_StrdupPORT_Strdup_Util(optstate->value);
              if (password == NULL((void*)0)) {
                  printf("-P  failed\n");
                  return 606;
              }
              pwdata.source = PW_PLAINTEXT;
              pwdata.data = password;
              break;
          case 'f':
              pwfile = PORT_StrdupPORT_Strdup_Util(optstate->value);
              if (pwfile == NULL((void*)0)) {
                  printf("-f  failed\n");
                  return 607;
              }
              pwdata.source = PW_FROMFILE;
              pwdata.data = pwfile;
              break;
          case 0: /* positional parameter */
              rv = parsePositionalParam(optstate->value, &flags);
5
←
Calling 'parsePositionalParam'→
18
←
Returning from 'parsePositionalParam'→
              if (rv18.1
'rv' is 0
) {
19
←
Taking false branch→
                  printf("bad positional parameter.\n");
                  return 605;
              }
              break;
          default:
              Usage();
              return 601;
      }
  }
  PL_DestroyOptState(optstate);
  if (status == PL_OPT_BAD || !nssInit29.1
'nssInit' is 1
) {
29
←
Assuming 'status' is not equal to PL_OPT_BAD→
30
←
Taking false branch→
      Usage();
      return 600;
  }
  if (!flags30.1
'flags' is 32
)
31
←
Taking false branch→
      flags = ~TEST_USE_DSA0x0002;
  db = CERT_GetDefaultCertDB();
  InitPKCS11();

  if (flags & TEST_MAKE_CRMF_REQ0x0001) {
32
←
Taking false branch→
      printf("Generating CRMF request\n");
      irv = DoCRMFRequest(&signPair, &cryptPair);
      if (irv)
          goto loser;
  }

  if (flags & TEST_DECODE_CRMF_REQ0x0004) {
33
←
Taking false branch→
      printf("Decoding CRMF request\n");
      irv = Decode();
      if (irv != 0) {
          printf("Error while decoding\n");
          goto loser;
      }
  }

  if (flags & TEST_DO_CMMF_STUFF0x0008) {
34
←
Taking false branch→
      printf("Doing CMMF Stuff\n");
      if ((irv = DoCMMFStuff()) != 0) {
          printf("CMMF tests failed.\n");
          goto loser;
      }
  }

  if (flags & TEST_KEY_RECOVERY0x0010) {
35
←
Taking false branch→
      /* Requires some other options be set.
      ** Once we know exactly what hey are, test for them here.
      */
      printf("Doing Key Recovery\n");
      irv = DoKeyRecovery(WHICH_KEYcryptPair.privKey);
      if (irv != 0) {
          printf("Error doing key recovery\n");
          goto loser;
      }
  }

  if (flags & TEST_CHALLENGE_RESPONSE0x0020) {
36
←
Taking true branch→
      printf("Doing Challenge / Response\n");
      irv = DoChallengeResponse(WHICH_KEYcryptPair.privKey, WHICH_KEYcryptPair.pubKey);
37
←
Passing null pointer value via 1st parameter 'privKey'→
38
←
Calling 'DoChallengeResponse'→
      if (irv != 0) {
          printf("Error doing challenge-response\n");
          goto loser;
      }
  }
  printf("Exiting successfully!!!\n\n");
  irv = 0;

1645loser:
  DestroyPair(&signPair);
  DestroyPair(&cryptPair);
  rv = NSS_Shutdown();
  if (rv) {
      printf("NSS_Shutdown did not shutdown cleanly!\n");
  }
  PORT_FreePORT_Free_Util(configdir);
  if (irv)
      printf("crmftest returning %d\n", irv);
  return irv;
1656}