lib/nss/nssinit.c

/*
 * NSS utility functions
 *
 * This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#include <ctype.h>
#include <string.h>
#include "seccomon.h"
#include "prinit.h"
#include "prprf.h"
#include "prmem.h"
#include "cert.h"
#include "keyhi.h"
#include "secmod.h"
#include "secoid.h"
#include "nss.h"
#include "pk11func.h"
#include "secerr.h"
#include "nssbase.h"
#include "nssutil.h"

#ifndef NSS_DISABLE_LIBPKIX
#include "pkixt.h"
#include "pkix.h"
#include "pkix_tools.h"
#endif /* NSS_DISABLE_LIBPKIX */

#include "pki3hack.h"
#include "certi.h"
#include "secmodi.h"
#include "ocspti.h"
#include "ocspi.h"
#include "utilpars.h"

/*
 * On Windows nss3.dll needs to export the symbol 'mktemp' to be
 * fully backward compatible with the nss3.dll in NSS 3.2.x and
 * 3.3.x.  This symbol was unintentionally exported and its
 * definition (in DBM) was moved from nss3.dll to softokn3.dll
 * in NSS 3.4.  See bug 142575.
 */
#ifdef WIN32_NSS3_DLL_COMPAT
#include <io.h>

/* exported as 'mktemp' */
char *
nss_mktemp(char *path)
{
    return _mktemp(path);
}
#endif

#define NSS_MAX_FLAG_SIZE sizeof("readOnly") + sizeof("noCertDB") +                                  \
                              sizeof("noModDB") + sizeof("forceOpen") + sizeof("passwordRequired") + \
                              sizeof("optimizeSpace") + sizeof("printPolicyFeedback")
#define NSS_DEFAULT_MOD_NAME "NSS Internal Module"

static char *
nss_makeFlags(PRBool readOnly, PRBool noCertDB,
              PRBool noModDB, PRBool forceOpen,
              PRBool passwordRequired, PRBool optimizeSpace)
{
    char *flags = (char *)PORT_Alloc(NSS_MAX_FLAG_SIZE);
    PRBool first = PR_TRUE;

    PORT_Memset(flags, 0, NSS_MAX_FLAG_SIZE);
    if (readOnly) {
        PORT_Strcat(flags, "readOnly");
        first = PR_FALSE;
    }
    if (noCertDB) {
        if (!first)
            PORT_Strcat(flags, ",");
        PORT_Strcat(flags, "noCertDB");
        first = PR_FALSE;
    }
    if (noModDB) {
        if (!first)
            PORT_Strcat(flags, ",");
        PORT_Strcat(flags, "noModDB");
        first = PR_FALSE;
    }
    if (forceOpen) {
        if (!first)
            PORT_Strcat(flags, ",");
        PORT_Strcat(flags, "forceOpen");
        first = PR_FALSE;
    }
    if (passwordRequired) {
        if (!first)
            PORT_Strcat(flags, ",");
        PORT_Strcat(flags, "passwordRequired");
        first = PR_FALSE;
    }
    if (optimizeSpace) {
        if (!first)
            PORT_Strcat(flags, ",");
        PORT_Strcat(flags, "optimizeSpace");
    }
    return flags;
}

/*
 * build config string from individual internationalized strings
 */
char *
nss_MkConfigString(const char *man, const char *libdesc, const char *tokdesc,
                   const char *ptokdesc, const char *slotdesc, const char *pslotdesc,
                   const char *fslotdesc, const char *fpslotdesc, int minPwd)
{
    char *strings = NULL;
    char *newStrings;

    /* make sure the internationalization was done correctly... */
    strings = PR_smprintf("");
    if (strings == NULL)
        return NULL;

    if (man) {
        newStrings = PR_smprintf("%s manufacturerID='%s'", strings, man);
        PR_smprintf_free(strings);
        strings = newStrings;
    }
    if (strings == NULL)
        return NULL;

    if (libdesc) {
        newStrings = PR_smprintf("%s libraryDescription='%s'", strings, libdesc);
        PR_smprintf_free(strings);
        strings = newStrings;
    }
    if (strings == NULL)
        return NULL;

    if (tokdesc) {
        newStrings = PR_smprintf("%s cryptoTokenDescription='%s'", strings,
                                 tokdesc);
        PR_smprintf_free(strings);
        strings = newStrings;
    }
    if (strings == NULL)
        return NULL;

    if (ptokdesc) {
        newStrings = PR_smprintf("%s dbTokenDescription='%s'", strings, ptokdesc);
        PR_smprintf_free(strings);
        strings = newStrings;
    }
    if (strings == NULL)
        return NULL;

    if (slotdesc) {
        newStrings = PR_smprintf("%s cryptoSlotDescription='%s'", strings,
                                 slotdesc);
        PR_smprintf_free(strings);
        strings = newStrings;
    }
    if (strings == NULL)
        return NULL;

    if (pslotdesc) {
        newStrings = PR_smprintf("%s dbSlotDescription='%s'", strings, pslotdesc);
        PR_smprintf_free(strings);
        strings = newStrings;
    }
    if (strings == NULL)
        return NULL;

    if (fslotdesc) {
        newStrings = PR_smprintf("%s FIPSSlotDescription='%s'",
                                 strings, fslotdesc);
        PR_smprintf_free(strings);
        strings = newStrings;
    }
    if (strings == NULL)
        return NULL;

    if (fpslotdesc) {
        newStrings = PR_smprintf("%s FIPSTokenDescription='%s'",
                                 strings, fpslotdesc);
        PR_smprintf_free(strings);
        strings = newStrings;
    }
    if (strings == NULL)
        return NULL;

    newStrings = PR_smprintf("%s minPS=%d", strings, minPwd);
    PR_smprintf_free(strings);
    strings = newStrings;

    return (strings);
}

/*
 * statics to remember the PK11_ConfigurePKCS11()
 * info.
 */
static char *pk11_config_strings = NULL;
static char *pk11_config_name = NULL;
static PRBool pk11_password_required = PR_FALSE;

/*
 * this is a legacy configuration function which used to be part of
 * the PKCS #11 internal token.
 */
void
PK11_ConfigurePKCS11(const char *man, const char *libdesc, const char *tokdesc,
                     const char *ptokdesc, const char *slotdesc, const char *pslotdesc,
                     const char *fslotdesc, const char *fpslotdesc, int minPwd,
                     int pwRequired)
{
    char *strings;

    strings = nss_MkConfigString(man, libdesc, tokdesc, ptokdesc, slotdesc,
                                 pslotdesc, fslotdesc, fpslotdesc, minPwd);
    if (strings == NULL) {
        return;
    }

    if (libdesc) {
        if (pk11_config_name != NULL) {
            PORT_Free(pk11_config_name);
        }
        pk11_config_name = PORT_Strdup(libdesc);
    }

    if (pk11_config_strings != NULL) {
        PR_smprintf_free(pk11_config_strings);
    }
    pk11_config_strings = strings;
    pk11_password_required = pwRequired;

    return;
}

void
PK11_UnconfigurePKCS11(void)
{
    if (pk11_config_strings != NULL) {
        PR_smprintf_free(pk11_config_strings);
        pk11_config_strings = NULL;
    }
    if (pk11_config_name) {
        PORT_Free(pk11_config_name);
        pk11_config_name = NULL;
    }
}

/*
 * The following code is an attempt to automagically find the external root
 * module.
 * Note: Keep the #if-defined chunks in order. HPUX must select before UNIX.
 */

static const char *dllname =
#if defined(XP_WIN32) || defined(XP_OS2)
    "nssckbi.dll";
#elif defined(HPUX) && !defined(__ia64) /* HP-UX PA-RISC */
    "libnssckbi.sl";
#elif defined(DARWIN)
    "libnssckbi.dylib";
#elif defined(XP_UNIX) || defined(XP_BEOS)
    "libnssckbi.so";
#else
#error "Uh! Oh! I don't know about this platform."
#endif

/* Should we have platform ifdefs here??? */
#define FILE_SEP '/'

static void
nss_FindExternalRootPaths(const char *dbpath,
                          const char *secmodprefix,
                          char **retoldpath, char **retnewpath)
{
    char *path, *oldpath = NULL, *lastsep;
    int len, path_len, secmod_len, dll_len;

    path_len = PORT_Strlen(dbpath);
    secmod_len = secmodprefix ? PORT_Strlen(secmodprefix) : 0;
    dll_len = PORT_Strlen(dllname);
    len = path_len + secmod_len + dll_len + 2; /* FILE_SEP + NULL */

    path = PORT_Alloc(len);
    if (path == NULL)
        return;

    /* back up to the top of the directory */
    PORT_Memcpy(path, dbpath, path_len);
    if (path[path_len - 1] != FILE_SEP) {
        path[path_len++] = FILE_SEP;
    }
    PORT_Strcpy(&path[path_len], dllname);
    if (secmod_len > 0) {
        lastsep = PORT_Strrchr(secmodprefix, FILE_SEP);
        if (lastsep) {
            int secmoddir_len = lastsep - secmodprefix + 1; /* FILE_SEP */
            oldpath = PORT_Alloc(len);
            if (oldpath == NULL) {
                PORT_Free(path);
                return;
            }
            PORT_Memcpy(oldpath, path, path_len);
            PORT_Memcpy(&oldpath[path_len], secmodprefix, secmoddir_len);
            PORT_Strcpy(&oldpath[path_len + secmoddir_len], dllname);
        }
    }
    *retoldpath = oldpath;
    *retnewpath = path;
    return;
}

static void
nss_FreeExternalRootPaths(char *oldpath, char *path)
{
    if (path) {
        PORT_Free(path);
    }
    if (oldpath) {
        PORT_Free(oldpath);
    }
}

static void
nss_FindExternalRoot(const char *dbpath, const char *secmodprefix)
{
    char *path = NULL;
    char *oldpath = NULL;
    PRBool hasrootcerts = PR_FALSE;

    /*
     * 'oldpath' is the external root path in NSS 3.3.x or older.
     * For backward compatibility we try to load the root certs
     * module with the old path first.
     */
    nss_FindExternalRootPaths(dbpath, secmodprefix, &oldpath, &path);
    if (oldpath) {
        (void)SECMOD_AddNewModule("Root Certs", oldpath, 0, 0);
        hasrootcerts = SECMOD_HasRootCerts();
    }
    if (path && !hasrootcerts) {
        (void)SECMOD_AddNewModule("Root Certs", path, 0, 0);
    }
    nss_FreeExternalRootPaths(oldpath, path);
    return;
}

/*
 * see nss_Init for definitions of the various options.
 *
 * this function builds a moduleSpec string from the options and previously
 * set statics (from PKCS11_Configure, for instance), and uses it to kick off
 * the loading of the various PKCS #11 modules.
 */
static SECMODModule *
nss_InitModules(const char *configdir, const char *certPrefix,
                const char *keyPrefix, const char *secmodName,
                const char *updateDir, const char *updCertPrefix,
                const char *updKeyPrefix, const char *updateID,
                const char *updateName, char *configName, char *configStrings,
                PRBool pwRequired, PRBool readOnly, PRBool noCertDB,
                PRBool noModDB, PRBool forceOpen, PRBool optimizeSpace,
                PRBool isContextInit)
{
    SECMODModule *module = NULL;
    char *moduleSpec = NULL;
    char *flags = NULL;
    char *lconfigdir = NULL;
    char *lcertPrefix = NULL;
    char *lkeyPrefix = NULL;
    char *lsecmodName = NULL;
    char *lupdateDir = NULL;
    char *lupdCertPrefix = NULL;
    char *lupdKeyPrefix = NULL;
    char *lupdateID = NULL;
    char *lupdateName = NULL;

    if (NSS_InitializePRErrorTable() != SECSuccess) {
        PORT_SetError(SEC_ERROR_NO_MEMORY);
        return NULL;
    }

    flags = nss_makeFlags(readOnly, noCertDB, noModDB, forceOpen,
                          pwRequired, optimizeSpace);
    if (flags == NULL)
        return NULL;

    /*
     * configdir is double nested, and Windows uses the same character
     * for file seps as we use for escapes! (sigh).
     */
    lconfigdir = NSSUTIL_DoubleEscape(configdir, '\'', '\"');
    if (lconfigdir == NULL) {
        goto loser;
    }
    lcertPrefix = NSSUTIL_DoubleEscape(certPrefix, '\'', '\"');
    if (lcertPrefix == NULL) {
        goto loser;
    }
    lkeyPrefix = NSSUTIL_DoubleEscape(keyPrefix, '\'', '\"');
    if (lkeyPrefix == NULL) {
        goto loser;
    }
    lsecmodName = NSSUTIL_DoubleEscape(secmodName, '\'', '\"');
    if (lsecmodName == NULL) {
        goto loser;
    }
    lupdateDir = NSSUTIL_DoubleEscape(updateDir, '\'', '\"');
    if (lupdateDir == NULL) {
        goto loser;
    }
    lupdCertPrefix = NSSUTIL_DoubleEscape(updCertPrefix, '\'', '\"');
    if (lupdCertPrefix == NULL) {
        goto loser;
    }
    lupdKeyPrefix = NSSUTIL_DoubleEscape(updKeyPrefix, '\'', '\"');
    if (lupdKeyPrefix == NULL) {
        goto loser;
    }
    lupdateID = NSSUTIL_DoubleEscape(updateID, '\'', '\"');
    if (lupdateID == NULL) {
        goto loser;
    }
    lupdateName = NSSUTIL_DoubleEscape(updateName, '\'', '\"');
    if (lupdateName == NULL) {
        goto loser;
    }

    moduleSpec = PR_smprintf(
        "name=\"%s\" parameters=\"configdir='%s' certPrefix='%s' keyPrefix='%s' "
        "secmod='%s' flags=%s updatedir='%s' updateCertPrefix='%s' "
        "updateKeyPrefix='%s' updateid='%s' updateTokenDescription='%s' %s\" "
        "NSS=\"flags=internal,moduleDB,moduleDBOnly,critical%s\"",
        configName ? configName : NSS_DEFAULT_MOD_NAME,
        lconfigdir, lcertPrefix, lkeyPrefix, lsecmodName, flags,
        lupdateDir, lupdCertPrefix, lupdKeyPrefix, lupdateID,
        lupdateName, configStrings ? configStrings : "",
        isContextInit ? "" : ",defaultModDB,internalKeySlot");

loser:
    PORT_Free(flags);
    if (lconfigdir)
        PORT_Free(lconfigdir);
    if (lcertPrefix)
        PORT_Free(lcertPrefix);
    if (lkeyPrefix)
        PORT_Free(lkeyPrefix);
    if (lsecmodName)
        PORT_Free(lsecmodName);
    if (lupdateDir)
        PORT_Free(lupdateDir);
    if (lupdCertPrefix)
        PORT_Free(lupdCertPrefix);
    if (lupdKeyPrefix)
        PORT_Free(lupdKeyPrefix);
    if (lupdateID)
        PORT_Free(lupdateID);
    if (lupdateName)
        PORT_Free(lupdateName);

    if (moduleSpec) {
        module = SECMOD_LoadModule(moduleSpec, NULL, PR_TRUE);
        PR_smprintf_free(moduleSpec);
        if (module && !module->loaded) {
            SECMOD_DestroyModule(module);
            return NULL;
        }
    }
    return module;
}

/*
 * OK there are now lots of options here, lets go through them all:
 *
 * configdir - base directory where all the cert, key, and module datbases live.
 * certPrefix - prefix added to the beginning of the cert database example: "
 *             "https-server1-"
 * keyPrefix - prefix added to the beginning of the key database example: "
 *             "https-server1-"
 * secmodName - name of the security module database (usually "secmod.db").
 * updateDir - used in initMerge, old directory to update from.
 * updateID - used in initMerge, unique ID to represent the updated directory.
 * updateName - used in initMerge, token name when updating.
 * initContextPtr -  used in initContext, pointer to return a unique context
 *            value.
 * readOnly - Boolean: true if the databases are to be opened read only.
 * nocertdb - Don't open the cert DB and key DB's, just initialize the
 *             Volatile certdb.
 * nomoddb - Don't open the security module DB, just initialize the
 *             PKCS #11 module.
 * forceOpen - Continue to force initializations even if the databases cannot
 *             be opened.
 * noRootInit - don't try to automatically load the root cert store if one is
 *           not found.
 * optimizeSpace - tell NSS to use fewer hash table buckets.
 *
 * The next three options are used in an attempt to share PKCS #11 modules
 * with other loaded, running libraries. PKCS #11 was not designed with this
 * sort of sharing in mind, so use of these options may lead to questionable
 * results. These options are may be incompatible with NSS_LoadContext() calls.
 *
 * noSingleThreadedModules - don't load modules that are not thread safe (many
 *           smart card tokens will not work).
 * allowAlreadyInitializedModules - if a module has already been loaded and
 *           initialize try to use it.
 * don'tFinalizeModules -  dont shutdown modules we may have loaded.
 */

static PRBool nssIsInitted = PR_FALSE;
static NSSInitContext *nssInitContextList = NULL;

#ifndef NSS_DISABLE_LIBPKIX
static void *plContext = NULL;
#endif /* NSS_DISABLE_LIBPKIX */

struct NSSInitContextStr {
    NSSInitContext *next;
    PRUint32 magic;
};

#define NSS_INIT_MAGIC 0x1413A91C
static SECStatus nss_InitShutdownList(void);

/* All initialized to zero in BSS */
static PRCallOnceType nssInitOnce;
static PZLock *nssInitLock;
static PZCondVar *nssInitCondition;
static int nssIsInInit;

static PRStatus
nss_doLockInit(void)
{
    nssInitLock = PZ_NewLock(nssILockOther);
    if (nssInitLock == NULL) {
        return PR_FAILURE;
    }
    nssInitCondition = PZ_NewCondVar(nssInitLock);
    if (nssInitCondition == NULL) {
        return PR_FAILURE;
    }
    return PR_SUCCESS;
}

static SECStatus
nss_Init(const char *configdir, const char *certPrefix, const char *keyPrefix,
         const char *secmodName, const char *updateDir,
         const char *updCertPrefix, const char *updKeyPrefix,
         const char *updateID, const char *updateName,
         NSSInitContext **initContextPtr,
         NSSInitParameters *initParams,
         PRBool readOnly, PRBool noCertDB,
         PRBool noModDB, PRBool forceOpen, PRBool noRootInit,
         PRBool optimizeSpace, PRBool noSingleThreadedModules,
         PRBool allowAlreadyInitializedModules,
         PRBool dontFinalizeModules)
{
    SECMODModule *parent = NULL;
#ifndef NSS_DISABLE_LIBPKIX
    PKIX_UInt32 actualMinorVersion = 0;
    PKIX_Error *pkixError = NULL;
#endif /* NSS_DISABLE_LIBPKIX */
    PRBool isReallyInitted;
    char *configStrings = NULL;
    char *configName = NULL;
    PRBool passwordRequired = PR_FALSE;
#ifdef POLICY_FILE
    char *ignoreVar;
#endif

    /* if we are trying to init with a traditional NSS_Init call, maintain
     * the traditional idempotent behavior. */
    if (!initContextPtr && nssIsInitted) {
        return SECSuccess;
    }

    /* make sure our lock and condition variable are initialized one and only
     * one time */
    if (PR_CallOnce(&nssInitOnce, nss_doLockInit) != PR_SUCCESS) {
        return SECFailure;
    }

    /*
     * if we haven't done basic initialization, single thread the
     * initializations.
     */
    PZ_Lock(nssInitLock);
    isReallyInitted = NSS_IsInitialized();
    if (!isReallyInitted) {
        while (!isReallyInitted && nssIsInInit) {
            PZ_WaitCondVar(nssInitCondition, PR_INTERVAL_NO_TIMEOUT);
            isReallyInitted = NSS_IsInitialized();
        }
        /* once we've completed basic initialization, we can allow more than
         * one process initialize NSS at a time. */
    }
    nssIsInInit++;
    PZ_Unlock(nssInitLock);

    /* this tells us whether or not some library has already initialized us.
     * if so, we don't want to double call some of the basic initialization
     * functions */

    if (!isReallyInitted) {
#ifdef DEBUG
        CERTCertificate dummyCert;
        /* New option bits must not change the size of CERTCertificate. */
        PORT_Assert(sizeof(dummyCert.options) == sizeof(void *));
#endif

        if (SECSuccess != cert_InitLocks()) {
            goto loser;
        }

        if (SECSuccess != InitCRLCache()) {
            goto loser;
        }

        if (SECSuccess != OCSP_InitGlobal()) {
            goto loser;
        }
    }

    if (noSingleThreadedModules || allowAlreadyInitializedModules ||
        dontFinalizeModules) {
        pk11_setGlobalOptions(noSingleThreadedModules,
                              allowAlreadyInitializedModules,
                              dontFinalizeModules);
    }

    if (initContextPtr) {
        *initContextPtr = PORT_ZNew(NSSInitContext);
        if (*initContextPtr == NULL) {
            goto loser;
        }
        /*
         * For traditional NSS_Init, we used the PK11_Configure() call to set
         * globals. with InitContext, we pass those strings in as parameters.
         *
         * This allows old NSS_Init calls to work as before, while at the same
         * time new calls and old calls will not interfere with each other.
         */
        if (initParams) {
            if (initParams->length < sizeof(NSSInitParameters)) {
                PORT_SetError(SEC_ERROR_INVALID_ARGS);
                goto loser;
            }
            configStrings = nss_MkConfigString(initParams->manufactureID,
                                               initParams->libraryDescription,
                                               initParams->cryptoTokenDescription,
                                               initParams->dbTokenDescription,
                                               initParams->cryptoSlotDescription,
                                               initParams->dbSlotDescription,
                                               initParams->FIPSSlotDescription,
                                               initParams->FIPSTokenDescription,
                                               initParams->minPWLen);
            if (configStrings == NULL) {
                PORT_SetError(SEC_ERROR_NO_MEMORY);
                goto loser;
            }
            configName = initParams->libraryDescription;
            passwordRequired = initParams->passwordRequired;
        }

        /* If we're NSS_ContextInit, we're probably a library. It could be
         * possible that the application initialized NSS then forked(). The
         * library would have no knowledge of that. If we call
         * SECMOD_RestartModules() here, we will be able to continue on with
         * NSS as normal. SECMOD_RestartModules() does have the side affect
         * of losing all our PKCS #11 objects in the new process, but only if
         * the module needs to be reinited. If it needs to be reinit those
         * objects are inaccessible anyway, it's always save to call
         * SECMOD_RestartModules(PR_FALSE).
         */
        /* NOTE: We could call SECMOD_Init() here, but if we aren't already
         * inited, then there's no modules to restart, so SECMOD_RestartModules
         * will return immediately */
        SECMOD_RestartModules(PR_FALSE);
    } else {
        configStrings = pk11_config_strings;
        configName = pk11_config_name;
        passwordRequired = pk11_password_required;
    }

    /* Skip the module init if we are already initted and we are trying
     * to init with noCertDB and noModDB */
    if (!(isReallyInitted && noCertDB && noModDB)) {
        parent = nss_InitModules(configdir, certPrefix, keyPrefix, secmodName,
                                 updateDir, updCertPrefix, updKeyPrefix, updateID,
                                 updateName, configName, configStrings, passwordRequired,
                                 readOnly, noCertDB, noModDB, forceOpen, optimizeSpace,
                                 (initContextPtr != NULL));

        if (parent == NULL) {
            goto loser;
        }
    }

    /* finish up initialization */
    if (!isReallyInitted) {
        if (SECOID_Init() != SECSuccess) {
            goto loser;
        }
#ifdef POLICY_FILE
        /* Load the system crypto policy file if it exists,
         * unless the NSS_IGNORE_SYSTEM_POLICY environment
         * variable has been set to 1. */
        ignoreVar = PR_GetEnvSecure("NSS_IGNORE_SYSTEM_POLICY");
        if (ignoreVar == NULL || strncmp(ignoreVar, "1", sizeof("1")) != 0) {
            if (PR_Access(POLICY_PATH "/" POLICY_FILE, PR_ACCESS_READ_OK) == PR_SUCCESS) {
                SECMODModule *module = SECMOD_LoadModule(
                    "name=\"Policy File\" "
                    "parameters=\"configdir='sql:" POLICY_PATH "' "
                    "secmod='" POLICY_FILE "' "
                    "flags=readOnly,noCertDB,forceSecmodChoice,forceOpen\" "
                    "NSS=\"flags=internal,moduleDB,skipFirst,moduleDBOnly,critical\"",
                    parent, PR_TRUE);
                if (module) {
                    PRBool isLoaded = module->loaded;
                    SECMOD_DestroyModule(module);
                    if (!isLoaded) {
                        goto loser;
                    }
                }
            }
        }
#endif
        if (STAN_LoadDefaultNSS3TrustDomain() != PR_SUCCESS) {
            goto loser;
        }
        if (nss_InitShutdownList() != SECSuccess) {
            goto loser;
        }
        CERT_SetDefaultCertDB((CERTCertDBHandle *)
                                  STAN_GetDefaultTrustDomain());
        if ((!noModDB) && (!noCertDB) && (!noRootInit)) {
            if (!SECMOD_HasRootCerts()) {
                const char *dbpath = configdir;
                /* handle supported database modifiers */
                if (strncmp(dbpath, "sql:", 4) == 0) {
                    dbpath += 4;
                } else if (strncmp(dbpath, "dbm:", 4) == 0) {
                    dbpath += 4;
                } else if (strncmp(dbpath, "extern:", 7) == 0) {
                    dbpath += 7;
                } else if (strncmp(dbpath, "rdb:", 4) == 0) {
                    /* if rdb: is specified, the configdir isn't really a
               * path. Skip it */
                    dbpath = NULL;
                }
                if (dbpath) {
                    nss_FindExternalRoot(dbpath, secmodName);
                }
            }
        }
        pk11sdr_Init();
        cert_CreateSubjectKeyIDHashTable();

#ifndef NSS_DISABLE_LIBPKIX
        pkixError = PKIX_Initialize(PKIX_FALSE, PKIX_MAJOR_VERSION, PKIX_MINOR_VERSION,
                                    PKIX_MINOR_VERSION, &actualMinorVersion, &plContext);

        if (pkixError != NULL) {
            goto loser;
        } else {
            char *ev = PR_GetEnvSecure("NSS_ENABLE_PKIX_VERIFY");
            if (ev && ev[0]) {
                CERT_SetUsePKIXForValidation(PR_TRUE);
            }
        }
#endif /* NSS_DISABLE_LIBPKIX */
    }

    /*
     * Now mark the appropriate init state. If initContextPtr was passed
     * in, then return the new context pointer and add it to the
     * nssInitContextList. Otherwise set the global nss_isInitted flag
     */
    PZ_Lock(nssInitLock);
    if (!initContextPtr) {
        nssIsInitted = PR_TRUE;
    } else {
        (*initContextPtr)->magic = NSS_INIT_MAGIC;
        (*initContextPtr)->next = nssInitContextList;
        nssInitContextList = (*initContextPtr);
    }
    nssIsInInit--;
    /* now that we are inited, all waiters can move forward */
    PZ_NotifyAllCondVar(nssInitCondition);
    PZ_Unlock(nssInitLock);

    if (initContextPtr && configStrings) {
        PR_smprintf_free(configStrings);
    }
    if (parent) {
        SECMOD_DestroyModule(parent);
    }

    return SECSuccess;

loser:
    if (initContextPtr && *initContextPtr) {
        PORT_Free(*initContextPtr);
        *initContextPtr = NULL;
        if (configStrings) {
            PR_smprintf_free(configStrings);
        }
    }
    PZ_Lock(nssInitLock);
    nssIsInInit--;
    /* We failed to init, allow one to move forward */
    PZ_NotifyCondVar(nssInitCondition);
    PZ_Unlock(nssInitLock);
    if (parent) {
        SECMOD_DestroyModule(parent);
    }
    return SECFailure;
}

SECStatus
NSS_Init(const char *configdir)
{
    return nss_Init(configdir, "", "", SECMOD_DB, "", "", "", "", "", NULL,
                    NULL, PR_TRUE, PR_FALSE, PR_FALSE, PR_FALSE, PR_FALSE,
                    PR_TRUE, PR_FALSE, PR_FALSE, PR_FALSE);
}

SECStatus
NSS_InitReadWrite(const char *configdir)
{
    return nss_Init(configdir, "", "", SECMOD_DB, "", "", "", "", "", NULL,
                    NULL, PR_FALSE, PR_FALSE, PR_FALSE, PR_FALSE, PR_FALSE,
                    PR_TRUE, PR_FALSE, PR_FALSE, PR_FALSE);
}

/*
 * OK there are now lots of options here, lets go through them all:
 *
 * configdir - base directory where all the cert, key, and module datbases live.
 * certPrefix - prefix added to the beginning of the cert database example: "
 *             "https-server1-"
 * keyPrefix - prefix added to the beginning of the key database example: "
 *             "https-server1-"
 * secmodName - name of the security module database (usually "secmod.db").
 * flags - change the open options of NSS_Initialize as follows:
 *   NSS_INIT_READONLY - Open the databases read only.
 *   NSS_INIT_NOCERTDB - Don't open the cert DB and key DB's, just
 *             initialize the volatile certdb.
 *   NSS_INIT_NOMODDB  - Don't open the security module DB, just
 *             initialize the      PKCS #11 module.
 *      NSS_INIT_FORCEOPEN - Continue to force initializations even if the
 *             databases cannot be opened.
 *      NSS_INIT_PK11THREADSAFE - only load PKCS#11 modules that are
 *                      thread-safe, ie. that support locking - either OS
 *                      locking or NSS-provided locks . If a PKCS#11
 *                      module isn't thread-safe, don't serialize its
 *                      calls; just don't load it instead. This is necessary
 *                      if another piece of code is using the same PKCS#11
 *                      modules that NSS is accessing without going through
 *                      NSS, for example the Java SunPKCS11 provider.
 *      NSS_INIT_PK11RELOAD - ignore the CKR_CRYPTOKI_ALREADY_INITIALIZED
 *                      error when loading PKCS#11 modules. This is necessary
 *                      if another piece of code is using the same PKCS#11
 *                      modules that NSS is accessing without going through
 *                      NSS, for example Java SunPKCS11 provider.
 *      NSS_INIT_NOPK11FINALIZE - never call C_Finalize on any
 *                      PKCS#11 module. This may be necessary in order to
 *                      ensure continuous operation and proper shutdown
 *                      sequence if another piece of code is using the same
 *                      PKCS#11 modules that NSS is accessing without going
 *                      through NSS, for example Java SunPKCS11 provider.
 *                      The following limitation applies when this is set :
 *                      SECMOD_WaitForAnyTokenEvent will not use
 *                      C_WaitForSlotEvent, in order to prevent the need for
 *                      C_Finalize. This call will be emulated instead.
 *      NSS_INIT_RESERVED - Currently has no effect, but may be used in the
 *                      future to trigger better cooperation between PKCS#11
 *                      modules used by both NSS and the Java SunPKCS11
 *                      provider. This should occur after a new flag is defined
 *                      for C_Initialize by the PKCS#11 working group.
 *      NSS_INIT_COOPERATE - Sets 4 recommended options for applications that
 *                      use both NSS and the Java SunPKCS11 provider.
 */
SECStatus
NSS_Initialize(const char *configdir, const char *certPrefix,
               const char *keyPrefix, const char *secmodName, PRUint32 flags)
{
    return nss_Init(configdir, certPrefix, keyPrefix, secmodName,
                    "", "", "", "", "", NULL, NULL,
                    ((flags & NSS_INIT_READONLY) == NSS_INIT_READONLY),
                    ((flags & NSS_INIT_NOCERTDB) == NSS_INIT_NOCERTDB),
                    ((flags & NSS_INIT_NOMODDB) == NSS_INIT_NOMODDB),
                    ((flags & NSS_INIT_FORCEOPEN) == NSS_INIT_FORCEOPEN),
                    ((flags & NSS_INIT_NOROOTINIT) == NSS_INIT_NOROOTINIT),
                    ((flags & NSS_INIT_OPTIMIZESPACE) == NSS_INIT_OPTIMIZESPACE),
                    ((flags & NSS_INIT_PK11THREADSAFE) == NSS_INIT_PK11THREADSAFE),
                    ((flags & NSS_INIT_PK11RELOAD) == NSS_INIT_PK11RELOAD),
                    ((flags & NSS_INIT_NOPK11FINALIZE) == NSS_INIT_NOPK11FINALIZE));
}

NSSInitContext *
NSS_InitContext(const char *configdir, const char *certPrefix,
                const char *keyPrefix, const char *secmodName,
                NSSInitParameters *initParams, PRUint32 flags)
{
    SECStatus rv;
    NSSInitContext *context;

    rv = nss_Init(configdir, certPrefix, keyPrefix, secmodName,
                  "", "", "", "", "", &context, initParams,
                  ((flags & NSS_INIT_READONLY) == NSS_INIT_READONLY),
                  ((flags & NSS_INIT_NOCERTDB) == NSS_INIT_NOCERTDB),
                  ((flags & NSS_INIT_NOMODDB) == NSS_INIT_NOMODDB),
                  ((flags & NSS_INIT_FORCEOPEN) == NSS_INIT_FORCEOPEN), PR_TRUE,
                  ((flags & NSS_INIT_OPTIMIZESPACE) == NSS_INIT_OPTIMIZESPACE),
                  ((flags & NSS_INIT_PK11THREADSAFE) == NSS_INIT_PK11THREADSAFE),
                  ((flags & NSS_INIT_PK11RELOAD) == NSS_INIT_PK11RELOAD),
                  ((flags & NSS_INIT_NOPK11FINALIZE) == NSS_INIT_NOPK11FINALIZE));
    return (rv == SECSuccess) ? context : NULL;
}

SECStatus
NSS_InitWithMerge(const char *configdir, const char *certPrefix,
                  const char *keyPrefix, const char *secmodName,
                  const char *updateDir, const char *updCertPrefix,
                  const char *updKeyPrefix, const char *updateID,
                  const char *updateName, PRUint32 flags)
{
    return nss_Init(configdir, certPrefix, keyPrefix, secmodName,
                    updateDir, updCertPrefix, updKeyPrefix, updateID, updateName,
                    NULL, NULL,
                    ((flags & NSS_INIT_READONLY) == NSS_INIT_READONLY),
                    ((flags & NSS_INIT_NOCERTDB) == NSS_INIT_NOCERTDB),
                    ((flags & NSS_INIT_NOMODDB) == NSS_INIT_NOMODDB),
                    ((flags & NSS_INIT_FORCEOPEN) == NSS_INIT_FORCEOPEN),
                    ((flags & NSS_INIT_NOROOTINIT) == NSS_INIT_NOROOTINIT),
                    ((flags & NSS_INIT_OPTIMIZESPACE) == NSS_INIT_OPTIMIZESPACE),
                    ((flags & NSS_INIT_PK11THREADSAFE) == NSS_INIT_PK11THREADSAFE),
                    ((flags & NSS_INIT_PK11RELOAD) == NSS_INIT_PK11RELOAD),
                    ((flags & NSS_INIT_NOPK11FINALIZE) == NSS_INIT_NOPK11FINALIZE));
}

/*
 * initialize NSS without a creating cert db's, key db's, or secmod db's.
 */
SECStatus
NSS_NoDB_Init(const char *configdir)
{
    return nss_Init("", "", "", "", "", "", "", "", "", NULL, NULL,
                    PR_TRUE, PR_TRUE, PR_TRUE, PR_TRUE, PR_TRUE, PR_TRUE,
                    PR_FALSE, PR_FALSE, PR_FALSE);
}

#define NSS_SHUTDOWN_STEP 10

struct NSSShutdownFuncPair {
    NSS_ShutdownFunc func;
    void *appData;
};

static struct NSSShutdownListStr {
    PZLock *lock;
    int allocatedFuncs;
    int peakFuncs;
    struct NSSShutdownFuncPair *funcs;
} nssShutdownList = { 0 };

/*
 * find and existing shutdown function
 */
static int
nss_GetShutdownEntry(NSS_ShutdownFunc sFunc, void *appData)
{
    int count, i;
    count = nssShutdownList.peakFuncs;

    for (i = 0; i < count; i++) {
        if ((nssShutdownList.funcs[i].func == sFunc) &&
            (nssShutdownList.funcs[i].appData == appData)) {
            return i;
        }
    }
    return -1;
}

/*
 * register a callback to be called when NSS shuts down
 */
SECStatus
NSS_RegisterShutdown(NSS_ShutdownFunc sFunc, void *appData)
{
    int i;

    /* make sure our lock and condition variable are initialized one and only
     * one time */
    if (PR_CallOnce(&nssInitOnce, nss_doLockInit) != PR_SUCCESS) {
        return SECFailure;
    }

    PZ_Lock(nssInitLock);
    if (!NSS_IsInitialized()) {
        PZ_Unlock(nssInitLock);
        PORT_SetError(SEC_ERROR_NOT_INITIALIZED);
        return SECFailure;
    }
    PZ_Unlock(nssInitLock);
    if (sFunc == NULL) {
        PORT_SetError(SEC_ERROR_INVALID_ARGS);
        return SECFailure;
    }

    PORT_Assert(nssShutdownList.lock);
    PZ_Lock(nssShutdownList.lock);

    /* make sure we don't have a duplicate */
    i = nss_GetShutdownEntry(sFunc, appData);
    if (i >= 0) {
        PZ_Unlock(nssShutdownList.lock);
        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
        return SECFailure;
    }
    /* find an empty slot */
    i = nss_GetShutdownEntry(NULL, NULL);
    if (i >= 0) {
        nssShutdownList.funcs[i].func = sFunc;
        nssShutdownList.funcs[i].appData = appData;
        PZ_Unlock(nssShutdownList.lock);
        return SECSuccess;
    }
    if (nssShutdownList.allocatedFuncs == nssShutdownList.peakFuncs) {
        struct NSSShutdownFuncPair *funcs =
            (struct NSSShutdownFuncPair *)PORT_Realloc(nssShutdownList.funcs,
                                                       (nssShutdownList.allocatedFuncs + NSS_SHUTDOWN_STEP) * sizeof(struct NSSShutdownFuncPair));
        if (!funcs) {
            PZ_Unlock(nssShutdownList.lock);
            return SECFailure;
        }
        nssShutdownList.funcs = funcs;
        nssShutdownList.allocatedFuncs += NSS_SHUTDOWN_STEP;
    }
    nssShutdownList.funcs[nssShutdownList.peakFuncs].func = sFunc;
    nssShutdownList.funcs[nssShutdownList.peakFuncs].appData = appData;
    nssShutdownList.peakFuncs++;
    PZ_Unlock(nssShutdownList.lock);
    return SECSuccess;
}

/*
 * unregister a callback so it won't get called on shutdown.
 */
SECStatus
NSS_UnregisterShutdown(NSS_ShutdownFunc sFunc, void *appData)
{
    int i;

    /* make sure our lock and condition variable are initialized one and only
     * one time */
    if (PR_CallOnce(&nssInitOnce, nss_doLockInit) != PR_SUCCESS) {
        return SECFailure;
    }
    PZ_Lock(nssInitLock);
    if (!NSS_IsInitialized()) {
        PZ_Unlock(nssInitLock);
        PORT_SetError(SEC_ERROR_NOT_INITIALIZED);
        return SECFailure;
    }
    PZ_Unlock(nssInitLock);

    PORT_Assert(nssShutdownList.lock);
    PZ_Lock(nssShutdownList.lock);
    i = nss_GetShutdownEntry(sFunc, appData);
    if (i >= 0) {
        nssShutdownList.funcs[i].func = NULL;
        nssShutdownList.funcs[i].appData = NULL;
    }
    PZ_Unlock(nssShutdownList.lock);

    if (i < 0) {
        PORT_SetError(SEC_ERROR_LIBRARY_FAILURE);
        return SECFailure;
    }
    return SECSuccess;
}

/*
 * bring up and shutdown the shutdown list
 */
static SECStatus
nss_InitShutdownList(void)
{
    if (nssShutdownList.lock != NULL) {
        return SECSuccess;
    }
    nssShutdownList.lock = PZ_NewLock(nssILockOther);
    if (nssShutdownList.lock == NULL) {
        return SECFailure;
    }
    nssShutdownList.funcs = PORT_ZNewArray(struct NSSShutdownFuncPair,
                                           NSS_SHUTDOWN_STEP);
    if (nssShutdownList.funcs == NULL) {
        PZ_DestroyLock(nssShutdownList.lock);
        nssShutdownList.lock = NULL;
        return SECFailure;
    }
    nssShutdownList.allocatedFuncs = NSS_SHUTDOWN_STEP;
    nssShutdownList.peakFuncs = 0;

    return SECSuccess;
}

static SECStatus
nss_ShutdownShutdownList(void)
{
    SECStatus rv = SECSuccess;
    int i;

    /* call all the registerd functions first */
    for (i = 0; i < nssShutdownList.peakFuncs; i++) {
        struct NSSShutdownFuncPair *funcPair = &nssShutdownList.funcs[i];
        if (funcPair->func) {
            if ((*funcPair->func)(funcPair->appData, NULL) != SECSuccess) {
                rv = SECFailure;
            }
        }
    }

    nssShutdownList.peakFuncs = 0;
    nssShutdownList.allocatedFuncs = 0;
    PORT_Free(nssShutdownList.funcs);
    nssShutdownList.funcs = NULL;
    if (nssShutdownList.lock) {
        PZ_DestroyLock(nssShutdownList.lock);
    }
    nssShutdownList.lock = NULL;
    return rv;
}

extern const NSSError NSS_ERROR_BUSY;

SECStatus
nss_Shutdown(void)
{
    SECStatus shutdownRV = SECSuccess;
    SECStatus rv;
    PRStatus status;
    NSSInitContext *temp;

    rv = nss_ShutdownShutdownList();
    if (rv != SECSuccess) {
        shutdownRV = SECFailure;
    }
    cert_DestroyLocks();
    ShutdownCRLCache();
    OCSP_ShutdownGlobal();
#ifndef NSS_DISABLE_LIBPKIX
    PKIX_Shutdown(plContext);
#endif /* NSS_DISABLE_LIBPKIX */
    SECOID_Shutdown();
    status = STAN_Shutdown();
    cert_DestroySubjectKeyIDHashTable();
    pk11_SetInternalKeySlot(NULL);
    rv = SECMOD_Shutdown();
    if (rv != SECSuccess) {
        shutdownRV = SECFailure;
    }
    pk11sdr_Shutdown();
    nssArena_Shutdown();
    if (status == PR_FAILURE) {
        if (NSS_GetError() == NSS_ERROR_BUSY) {
            PORT_SetError(SEC_ERROR_BUSY);
        }
        shutdownRV = SECFailure;
    }
    /*
     * A thread's error stack is automatically destroyed when the thread
     * terminates, except for the primordial thread, whose error stack is
     * destroyed by PR_Cleanup.  Since NSS is usually shut down by the
     * primordial thread and many NSS-based apps don't call PR_Cleanup,
     * we destroy the calling thread's error stack here. This must be
     * done after any NSS_GetError call, otherwise NSS_GetError will
     * create the error stack again.
     */
    nss_DestroyErrorStack();
    nssIsInitted = PR_FALSE;
    temp = nssInitContextList;
    nssInitContextList = NULL;
    /* free the old list. This is necessary when we are called from
     * NSS_Shutdown(). */
    while (temp) {
        NSSInitContext *next = temp->next;
        temp->magic = 0;
        PORT_Free(temp);
        temp = next;
    }
    return shutdownRV;
}

SECStatus
NSS_Shutdown(void)
{
    SECStatus rv;
    /* make sure our lock and condition variable are initialized one and only
     * one time */
    if (PR_CallOnce(&nssInitOnce, nss_doLockInit) != PR_SUCCESS) {
        return SECFailure;
    }
    PZ_Lock(nssInitLock);

    if (!nssIsInitted) {
        PZ_Unlock(nssInitLock);
        PORT_SetError(SEC_ERROR_NOT_INITIALIZED);
        return SECFailure;
    }

    /* If one or more threads are in the middle of init, wait for them
     * to complete */
    while (nssIsInInit) {
        PZ_WaitCondVar(nssInitCondition, PR_INTERVAL_NO_TIMEOUT);
    }
    rv = nss_Shutdown();
    PZ_Unlock(nssInitLock);
    return rv;
}

/*
 * remove the context from a list. return true if found, false if not
 */
PRBool
nss_RemoveList(NSSInitContext *context)
{
    NSSInitContext *this = nssInitContextList;
    NSSInitContext **last = &nssInitContextList;

    while (this) {
        if (this == context) {
            *last = this->next;
            this->magic = 0;
            PORT_Free(this);
            return PR_TRUE;
        }
        last = &this->next;
        this = this->next;
    }
    return PR_FALSE;
}

/*
 * This form of shutdown is safe in the case where we may have multiple
 * entities using NSS in a single process. Each entity calls shutdown with
 * it's own context. The application (which doesn't get a context), calls
 * shutdown with NULL. Once all users have 'checked in' NSS will shutdown.
 * This is different than NSS_Shutdown, where calling it will shutdown NSS
 * irreguardless of who else may have NSS open.
 */
SECStatus
NSS_ShutdownContext(NSSInitContext *context)
{
    SECStatus rv = SECSuccess;

    /* make sure our lock and condition variable are initialized one and only
     * one time */
    if (PR_CallOnce(&nssInitOnce, nss_doLockInit) != PR_SUCCESS) {
        return SECFailure;
    }
    PZ_Lock(nssInitLock);
    /* If one or more threads are in the middle of init, wait for them
     * to complete */
    while (nssIsInInit) {
        PZ_WaitCondVar(nssInitCondition, PR_INTERVAL_NO_TIMEOUT);
    }

    /* OK, we are the only thread now either initializing or shutting down */

    if (!context) {
        if (!nssIsInitted) {
            PZ_Unlock(nssInitLock);
            PORT_SetError(SEC_ERROR_NOT_INITIALIZED);
            return SECFailure;
        }
        nssIsInitted = 0;
    } else if (!nss_RemoveList(context)) {
        PZ_Unlock(nssInitLock);
        /* context was already freed or wasn't valid */
        PORT_SetError(SEC_ERROR_NOT_INITIALIZED);
        return SECFailure;
    }
    if ((nssIsInitted == 0) && (nssInitContextList == NULL)) {
        rv = nss_Shutdown();
    }

    /* NOTE: we don't try to free the nssInitLocks to prevent races against
     * the locks. There may be a thread, right now, waiting in NSS_Init for us
     * to free the lock below. If we delete the locks, bad things would happen
     * to that thread */
    PZ_Unlock(nssInitLock);

    return rv;
}

PRBool
NSS_IsInitialized(void)
{
    return (nssIsInitted) || (nssInitContextList != NULL);
}

extern const char __nss_base_version[];

PRBool
NSS_VersionCheck(const char *importedVersion)
{
    /*
     * This is the secret handshake algorithm.
     *
     * This release has a simple version compatibility
     * check algorithm.  This release is not backward
     * compatible with previous major releases.  It is
     * not compatible with future major, minor, or
     * patch releases or builds.
     */
    int vmajor = 0, vminor = 0, vpatch = 0, vbuild = 0;
    const char *ptr = importedVersion;
#define NSS_VERSION_VARIABLE __nss_base_version
#include "verref.h"

    while (isdigit(*ptr)) {
        vmajor = 10 * vmajor + *ptr - '0';
        ptr++;
    }
    if (*ptr == '.') {
        ptr++;
        while (isdigit(*ptr)) {
            vminor = 10 * vminor + *ptr - '0';
            ptr++;
        }
        if (*ptr == '.') {
            ptr++;
            while (isdigit(*ptr)) {
                vpatch = 10 * vpatch + *ptr - '0';
                ptr++;
            }
            if (*ptr == '.') {
                ptr++;
                while (isdigit(*ptr)) {
                    vbuild = 10 * vbuild + *ptr - '0';
                    ptr++;
                }
            }
        }
    }

    if (vmajor != NSS_VMAJOR) {
        return PR_FALSE;
    }
    if (vmajor == NSS_VMAJOR && vminor > NSS_VMINOR) {
        return PR_FALSE;
    }
    if (vmajor == NSS_VMAJOR && vminor == NSS_VMINOR && vpatch > NSS_VPATCH) {
        return PR_FALSE;
    }
    if (vmajor == NSS_VMAJOR && vminor == NSS_VMINOR &&
        vpatch == NSS_VPATCH && vbuild > NSS_VBUILD) {
        return PR_FALSE;
    }
    return PR_TRUE;
}

const char *
NSS_GetVersion(void)
{
    return NSS_VERSION;
}