Added a USB-token into nssdb path using modutil linking its vendor lib and slot/token name. The same nssdb path has been selected in certificate path in LibreOffice (Tools --> Options --> Security --> Certificate) and its listing the certificate correctly.
Using libnss, we tried to simulate listing of certificates using the below code:
PK11_SetPasswordFunc( GetPasswordFunction ) ; // GetPasswordFunction() returns the password string just like that without any user input.
if (NSS_InitReadWrite("/home/<user>/.pki/nssdb") == SECSuccess)
{
printf("\n----------->NSS_Init successful");
cert_handle = CERT_GetDefaultCertDB();
if (cert_handle == NULL)
{
error = PR_GetError();
printf("\n----------->Unable to get cert_handle:%s (%d)", PR_ErrorToName(error), (int)error);
}
else
{
printf("\n----------->Got cert_handle");
PK11SlotList * slotList = PK11_GetAllTokens( CKM_INVALID_MECHANISM, PR_FALSE, PR_FALSE, NULL ) ;
if(slotList == NULL) {
error = PR_GetError();
printf("\n----------->PK11_GetAllTokens failed !:%s (%d)", PR_ErrorToName(error), (int)error);
} else {
PK11SlotInfo * usb_token = NULL;
for (PK11SlotListElement* slotEle = slotList->head ; slotEle != NULL; slotEle = slotEle->next)
{
PK11SlotInfo * pSlot = slotEle->slot ;
if(pSlot != NULL)
{
printf("\n----------->SlotName(%s) TokenName(%s)", PK11_GetSlotName(pSlot), PK11_GetTokenName(pSlot));
if(PK11_IsHW(pSlot) && PK11_IsRemovable(pSlot)){ // select the USB-token in the slots list
usb_token = pSlot;
break;
}
} else {
printf("\n----------->pSlot is empty");
}
}// end of for
if(usb_token != NULL){
printf("\n----------->Found USB-TOKEN SlotName(%s) TokenName(%s)", PK11_GetSlotName(usb_token), PK11_GetTokenName(usb_token));
if (PK11_NeedLogin(usb_token)){
SECStatus nRet = PK11_Authenticate(usb_token, PR_TRUE, NULL);
if(nRet != SECSuccess){
error = PR_GetError();
printf("\n----------->PK11_Authenticate failed !:%s (%d)", PR_ErrorToName(error), (int)error);
printf("\n----------->PORT_GetError() !:(%d)", PORT_GetError());
if(PORT_GetError() != SEC_ERROR_IO) {
printf("\n----------->NoPassword Exception");
} else {
printf("\n----------->Some other Exception");
}
}else {
printf("\n----------->PK11_Authenticate successful !");
}
}
}
PK11_FreeSlotList(slotList);
}
}
PK11_SetPasswordFunc( NULL ) ;
PK11_LogoutAll();
NSS_Shutdown();
}
else
{
error = PR_GetError();
printf("\n----------->NSS_Init failed:%s (%d)", PR_ErrorToName(error), (int)error);
}
We get the following error even though the returned password in GetPasswordFunction() is correct: PK11_Authenticate failed !:SEC_ERROR_BAD_PASSWORD (-8177)
Any help is appreciated! Thanks in advance!
Top comments (1)
Solved this!
While debugging PK11_Authenticate() and related functions in the flow, it was identified that the password returned from password callback function (as per my sample code --> GetPasswordFunction()) was NULL. This was odd as I had already debugged that function and made sure that the password was properly returned.
On checking other functions in libnss, I came to know about PORT_Alloc() which is a memory allocator (secport.h) similar to malloc(). I had used normal C-style string memory allocation. On trying the allocation with PORT_Alloc(), it worked!