password.c

来自「支持SSL v2/v3, TLS, PKCS #5, PKCS #7, PKCS」· C语言 代码 · 共 1,046 行 · 第 1/3 页

    slot = PK11_GetInternalKeySlot();
  else if (strcmp(slotname, "all") == 0) {
      char *userSlotName = NULL;

      /* ask user */
      userSlotName = SSM_GetSlotNameForPasswordChange(cx->m_request);
      if (!userSlotName) 
        goto cancel;
      slot = PK11_FindSlotByName(userSlotName);
      PR_Free(userSlotName);
  } 
  else 
    slot = PK11_FindSlotByName(slotname);
  if (!slot) {
    SSM_DEBUG("ReSetPasswordKeywordHandler: bad slotname %s\n", slotname);
    goto loser;
  }
  
  slotname = PK11_GetTokenName(slot);
  if (PK11_NeedPWInitForSlot(slot))
    rv = SSM_GetAndExpandTextKeyedByString(cx, "set_new_password", &tmp);
  else 
    rv = SSM_GetAndExpandTextKeyedByString(cx, "reset_password", &tmp);
  if (rv != SSM_SUCCESS) 
    goto loser;
  PR_FREEIF(cx->m_result);
  cx->m_result = PR_smprintf(tmp, slotname);
  return rv;
  
 loser:
  if (cx->m_result) 
    PR_Free(cx->m_result);
  cx->m_result = NULL;
  return PR_FAILURE;
 cancel:
  SSM_HTTPCloseWindow(cx->m_request);
  goto loser;
}

PRBool 
ssm_VerifyPwdLength(char * password)
{
  if (!password)
    return (!SSM_MIN_PWD_LEN);

  if (strlen(password) < SSM_MIN_PWD_LEN)
    return PR_FALSE;
  if (strlen(password) > SSM_MAX_PWD_LEN)
    return PR_FALSE;
  return PR_TRUE;
}

SSMStatus SSM_PasswordPrefKeywordHandler(SSMTextGenContext * cx)
{
  char * fmt = NULL, * checked = NULL;
  char * markchecked[] = { "", "", ""};
  SSMStatus rv;
  PRIntn askpw, timeout;

  PR_ASSERT(cx != NULL);
  PR_ASSERT(cx->m_request != NULL);
  PR_ASSERT(cx->m_result != NULL);
  
  /* need to get the table and fill it with current preferences */
  rv = SSM_GetAndExpandTextKeyedByString(cx, "password_lifetime", &fmt);
  if (rv != SSM_SUCCESS || !fmt) 
    goto done;
  rv = SSM_GetAndExpandTextKeyedByString(cx, "text_checked", &checked);
  if (rv != SSM_SUCCESS || !checked) 
    goto done;
  rv = PREF_GetIntPref(cx->m_request->ctrlconn->m_prefs, 
                       "security.ask_for_password", &askpw);
  if (rv != SSM_SUCCESS)
    goto done;
  rv = PREF_GetIntPref(cx->m_request->ctrlconn->m_prefs, 
                       "security.password_lifetime", &timeout);
  if (rv != SSM_SUCCESS)
    goto done;

  markchecked[askpw] = checked;
  PR_FREEIF(cx->m_result);
  cx->m_result = PR_smprintf(fmt, markchecked[0], markchecked[1], 
                             markchecked[2], timeout);
  
done: 
  return rv;
}

SSMStatus SSM_SetDBPasswordHandler(HTTPRequest * req)
{
  SSMStatus rv = SSM_FAILURE;
  char * oldpassword, * newpassword, *repeatpassword, * action;
  PK11SlotInfo * slot;
  char * responseKey = NULL;
  char * result = NULL;
  char * slotname = NULL, * askpwdoption, * pwdlifetime;
  PRIntn askpw, timeout;

  rv = SSM_HTTPParamValue(req, "baseRef", &action);
  if (rv != SSM_SUCCESS || strcmp(action, "windowclose_doclose_js")!= 0)
    SSM_DEBUG("SetDBPasswordHandler: bad action %s\n", action);
  
  rv = SSM_HTTPParamValue(req, "slot", &slotname);
  if (rv != SSM_SUCCESS || !slotname || 
      !(slot = PK11_FindSlotByName(slotname)))
    goto loser;

  /* process password preferences */
  rv = SSM_HTTPParamValue(req, "passwordlife", &askpwdoption);
  if (rv != SSM_SUCCESS || !askpwdoption) 
    goto loser;
  rv = SSM_HTTPParamValue(req, "passwordwillexpire", &pwdlifetime);
  if (rv != SSM_SUCCESS || !pwdlifetime) 
    goto loser;
  if (strcmp(askpwdoption, "firsttime") == 0)
    askpw = 0;
  else if (strcmp(askpwdoption, "everytime") == 0)
    askpw = 1;
  else if (strcmp(askpwdoption, "expiretime")==0) {
    askpw = 2;
  }
  else {
    SSM_DEBUG("SetDBPasswordHandler: bad password lifetime parameter %s\n", 
              askpwdoption);
    goto loser;
  }
  timeout = atoi(pwdlifetime);
  if (askpw == 2 && !timeout) 
    goto loser;

  PK11_SetSlotPWValues(slot, askpw, timeout);
  rv = SSMControlConnection_SaveIntPref(req->ctrlconn, 
                                        "security.ask_for_password", askpw);
  if (rv != PR_SUCCESS)
    goto loser;
  rv = SSMControlConnection_SaveIntPref(req->ctrlconn,
                                        "security.password_lifetime", timeout);
  if (rv != SSM_SUCCESS)
    goto loser;

  rv = SSM_HTTPParamValue(req, "newpassword", &newpassword);
  if (rv != SSM_SUCCESS) 
    goto loser;
  rv = SSM_HTTPParamValue(req, "repeatpassword", &repeatpassword);
  if (rv != SSM_SUCCESS) 
    goto loser;

  if (!PK11_NeedPWInitForSlot(slot)) {
      /* oldpassword doesn't make sense for password initialization dialog */
      rv = SSM_HTTPParamValue(req, "oldpassword", &oldpassword);
      if (rv != SSM_SUCCESS) {
          goto loser;
      }

      /* we do this check to find the case where the user changed only password
       * settings, not the password itself
       */
      if ((oldpassword[0] == '\0') && (newpassword[0] == '\0') &&
          (repeatpassword[0] == '\0')) {
          rv = SSM_HTTPDefaultCommandHandler(req);
          goto done;
      }
  }

  if (!ssm_VerifyPwdLength(newpassword))
    goto loser;

  if (strcmp(newpassword, repeatpassword) != 0)
    goto loser;

  if (!PK11_NeedPWInitForSlot(slot)) { /* there is some password on the DB */
    if (!oldpassword) 
      goto loser;
    if (PK11_CheckUserPassword(slot, oldpassword) != 
        SECSuccess)
      goto loser;
    if (PK11_ChangePW(slot, oldpassword, newpassword) != 
      SECSuccess)
      goto loser;
  }
  else 
    {
      if (PK11_NeedUserInit(slot)) {
        if (PK11_InitPin(slot, NULL, newpassword) != SECSuccess)
          goto loser;
        }
      else {
        if (PK11_ChangePW(slot, NULL, newpassword) != SECSuccess) 
          goto loser;
      }
    }

  result = PR_smprintf("result=password_success");
 loser:
  if (!result)
    result = PR_smprintf("result=password_failure");
  
  rv = SSM_HTTPCloseAndSleep(req);
  if (rv != SSM_SUCCESS) 
    SSM_DEBUG("SetDBPasswordHandler: failure in DefaultCommandHandler\n");

  /* post status if password dialog was invoked from the SecurityAdvisor */
  if (SSM_IsA(req->target, SSM_RESTYPE_SECADVISOR_CONTEXT))
    SSMControlConnection_SendUIEvent(req->ctrlconn, "get", 
                                     "show_followup", NULL, 
                                     result, 
                                     &((SSMResource *)req->ctrlconn)->m_clientContext,
                                     PR_TRUE);
  
  PR_FREEIF(responseKey);
done:
  if (req->target && req->target->m_UILock)
    SSM_NotifyUIEvent(req->target);
  return rv;
}

SSMStatus SSM_ShowFollowupKeywordHandler(SSMTextGenContext * cx)
{
  char * resultvalue;
  SSMStatus rv;

  PR_ASSERT(cx != NULL);
  PR_ASSERT(cx->m_request != NULL);
  PR_ASSERT(cx->m_result != NULL);
  
  rv = SSM_HTTPParamValue(cx->m_request, "result", &resultvalue);
  if (rv != SSM_SUCCESS || !resultvalue)
    goto loser;
  if (!strcmp(resultvalue, "password_success"))
    rv = SSM_GetAndExpandTextKeyedByString(cx, "set_password_success",
                                           &cx->m_result);
  else if (!strcmp(resultvalue,"password_failure"))
    rv = SSM_GetAndExpandTextKeyedByString(cx, "set_password_failure",
                                           &cx->m_result);
  else if (!strcmp(resultvalue, "no_ldap_setup"))
    rv = SSM_GetAndExpandTextKeyedByString(cx, "no_ldap_server_set",
                                           &cx->m_result);
 loser:
  return rv;
}

char *
SSM_SetPasswordHTMLParamsFromTokenName(char *tokenName)
{
    char *url = NULL;
    tokenName = SSM_ConvertStringToHTMLString(tokenName);
    url = PR_smprintf("slot=%s&mechanism=%d", tokenName, 
                      CKM_INVALID_MECHANISM);
    PR_Free(tokenName);
    return url;
}

char *
SSM_SetPasswordHTMLParams(PK11SlotInfo *slot) {
  return SSM_SetPasswordHTMLParamsFromTokenName(PK11_GetTokenName(slot));
}

char * SSM_GenerateChangePasswordURL(PK11SlotInfo *slot, SSMResource *target)
{
    PRUint32 width, height;
    char *slotHTMLName = NULL, *url = NULL, *extraParams = NULL;
    SSMStatus rv;

    if (slot) {
        slotHTMLName = 
          SSM_ConvertStringToHTMLString(PK11_GetTokenName(slot));
    } else {
        slotHTMLName = PL_strdup("all");
    }
    extraParams = SSM_SetPasswordHTMLParams(slot);
    rv = SSM_GenerateURL(target->m_connection,"get", "set_password", target, 
                         extraParams, &width, &height, &url);
    if (rv != SSM_SUCCESS) {
        goto loser;
    }
    PR_Free(slotHTMLName);
    PR_Free(extraParams);
    return url;
 loser:
    PR_FREEIF(slotHTMLName);
    PR_FREEIF(extraParams);
   
    return NULL;
}

SSMStatus SSM_SetUserPassword(PK11SlotInfo * slot, SSMResource * ct)
{
  SSMStatus rv;
  char *params = SSM_SetPasswordHTMLParams(slot);

  SSM_LockUIEvent(ct);
  rv = SSMControlConnection_SendUIEvent(ct->m_connection,
                                        "get", "set_password",
                                        ct, params,
                                        &ct->m_clientContext,
                                        PR_TRUE);
  if (rv != SSM_SUCCESS) 
    goto loser;
  SSM_WaitUIEvent(ct, PR_INTERVAL_NO_TIMEOUT);
  return rv;
loser:
  SSM_UnlockUIEvent(ct);
  return rv;
}

SSMStatus SSM_ProcessPasswordWindow(HTTPRequest * req)
{
  SSMStatus rv = SSM_FAILURE;
  SSMResource * target = NULL;
  char *slotName = NULL, *slotHTMLName = NULL;
  char *extraParams = NULL;
  
  if (!req || !req->ctrlconn) 
    goto loser;
  /*
   * The window contents aren't going to change, so just send back
   * a NO_CONTENT error which causes leave its content as is.
   */
  rv = SSM_HTTPReportError(req, HTTP_NO_CONTENT);
  target = REQ_TARGET(req);
  /* First let's figure out if there are more than one token installed,
   * if so ask the user which one to change the password on
   */
  slotName = SSM_GetSlotNameForPasswordChange(req);
  if (slotName == NULL) {
    goto loser;
  }

  extraParams = SSM_SetPasswordHTMLParamsFromTokenName(slotName);
  SSM_LockUIEvent(target);
  /* send UI event to bring up the dialog */
  rv = SSMControlConnection_SendUIEvent(req->ctrlconn, "get", 
                                        "set_password", target, 
                                        extraParams, 
                                        &target->m_clientContext,
                                        PR_TRUE);
  PR_FREEIF(extraParams);
  if (rv != SSM_SUCCESS) { 
    SSM_UnlockUIEvent(&req->ctrlconn->super.super);
    goto loser;
  }
  SSM_WaitUIEvent(target, PR_INTERVAL_NO_TIMEOUT);
 loser:
  return rv;
}