fix importing the certificate and private key

If importing the certificate and private key is done separately,
they don't associate with each other, so with this you can add
the private key to the certificate that it belongs to. If the
private key is set in this way, then getPrivateKey() call doesn't
look into the database but just returns the private key stored
in the member variable.

Additionally use CERT_DecodeCertFromPackage to import the DER
certificate from the imput as CERT_DecodeDERCertificate doesn't
import a complete certificate and doesn't add it into the
certificate database.

Change-Id: I29876030f167cc5fa6b887f9bfeb0b84622c751e
Reviewed-on: https://gerrit.libreoffice.org/62271
Tested-by: Jenkins
Reviewed-by: Tomaž Vajngerl <quikee@gmail.com>

4 files changed, 92 insertions, 31 deletions

diff --git a/xmlsecurity/source/xmlsec/nss/securityenvironment_nssimpl.cxx b/xmlsecurity/source/xmlsec/nss/securityenvironment_nssimpl.cxx
index 4e31c40bf733..bdf8000d886b 100644
--- a/xmlsecurity/source/xmlsec/nss/securityenvironment_nssimpl.cxx
+++ b/xmlsecurity/source/xmlsec/nss/securityenvironment_nssimpl.cxx
@@ -432,6 +432,30 @@ Sequence< Reference < XCertificate > > SecurityEnvironment_NssImpl::buildCertifi
     return Sequence< Reference < XCertificate > >();
 }
 
+X509Certificate_NssImpl* SecurityEnvironment_NssImpl::createAndAddCertificateFromPackage(
+                                                        const css::uno::Sequence<sal_Int8>& raDERCertificate,
+                                                        OUString const & raString)
+{
+    auto pCertificateBytes = reinterpret_cast<char *>(const_cast<sal_Int8 *>(raDERCertificate.getConstArray()));
+    CERTCertificate* pCERTCertificate = CERT_DecodeCertFromPackage(pCertificateBytes, raDERCertificate.getLength());
+
+    if (!pCERTCertificate)
+        return nullptr;
+
+    OString aTrustString = OUStringToOString(raString, RTL_TEXTENCODING_ASCII_US);
+
+    CERTCertTrust aTrust;
+    if (CERT_DecodeTrustString(&aTrust, aTrustString.getStr()) != SECSuccess)
+        return nullptr;
+
+    if (CERT_ChangeCertTrust(CERT_GetDefaultCertDB(), pCERTCertificate, &aTrust) != SECSuccess)
+        return nullptr;
+
+    X509Certificate_NssImpl* pX509Certificate = new X509Certificate_NssImpl();
+    pX509Certificate->setCert(pCERTCertificate);
+    return pX509Certificate;
+}
+
 X509Certificate_NssImpl* SecurityEnvironment_NssImpl::createX509CertificateFromDER(const css::uno::Sequence<sal_Int8>& aDerCertificate)
 {
     X509Certificate_NssImpl* pX509Certificate = nullptr;
@@ -816,68 +840,71 @@ xmlSecKeysMngrPtr SecurityEnvironment_NssImpl::createKeysManager() {
     // Adopt the private key of the signing certificate, if it has any.
     if (auto pCertificate = dynamic_cast<X509Certificate_NssImpl*>(m_xSigningCertificate.get()))
     {
-        if (auto pCERTCertificate = const_cast<CERTCertificate*>(pCertificate->getNssCert()))
+        SECKEYPrivateKey* pPrivateKey = pCertificate->getPrivateKey();
+        if (pPrivateKey)
         {
-            if (pCERTCertificate && pCERTCertificate->slot)
-            {
-                SECKEYPrivateKey* pPrivateKey = PK11_FindPrivateKeyFromCert(pCERTCertificate->slot, pCERTCertificate, nullptr);
-                xmlSecKeyDataPtr pKeyData = xmlSecNssPKIAdoptKey(pPrivateKey, nullptr);
-                xmlSecKeyPtr pKey = xmlSecKeyCreate();
-                xmlSecKeySetValue(pKey, pKeyData);
-                xmlSecNssAppDefaultKeysMngrAdoptKey(pKeysMngr, pKey);
-            }
-            else
-            {
-                SAL_WARN("xmlsecurity.xmlsec", "Can't get the private key from the certificate.");
-            }
+            xmlSecKeyDataPtr pKeyData = xmlSecNssPKIAdoptKey(pPrivateKey, nullptr);
+            xmlSecKeyPtr pKey = xmlSecKeyCreate();
+            xmlSecKeySetValue(pKey, pKeyData);
+            xmlSecNssAppDefaultKeysMngrAdoptKey(pKeysMngr, pKey);
+        }
+        else
+        {
+            SAL_WARN("xmlsecurity.xmlsec", "Can't get the private key from the certificate.");
         }
     }
 
-    return pKeysMngr ;
+    return pKeysMngr;
 }
+
 void SecurityEnvironment_NssImpl::destroyKeysManager(xmlSecKeysMngrPtr pKeysMngr) {
     if( pKeysMngr != nullptr ) {
         xmlSecKeysMngrDestroy( pKeysMngr ) ;
     }
 }
 
-uno::Reference<security::XCertificate> SecurityEnvironment_NssImpl::createDERCertificateWithPrivateKey(
-        Sequence<sal_Int8> const & raDERCertificate, Sequence<sal_Int8> const & raPrivateKey)
+SECKEYPrivateKey* SecurityEnvironment_NssImpl::insertPrivateKey(css::uno::Sequence<sal_Int8> const & raPrivateKey)
 {
-    SECStatus nStatus = SECSuccess;
-
     PK11SlotInfo* pSlot = PK11_GetInternalKeySlot();
+
     if (!pSlot)
-        return uno::Reference<security::XCertificate>();
+        return nullptr;
 
     SECItem pDerPrivateKeyInfo;
     pDerPrivateKeyInfo.data = reinterpret_cast<unsigned char *>(const_cast<sal_Int8 *>(raPrivateKey.getConstArray()));
     pDerPrivateKeyInfo.len = raPrivateKey.getLength();
 
-    const unsigned int keyUsage = KU_KEY_ENCIPHERMENT | KU_DATA_ENCIPHERMENT | KU_DIGITAL_SIGNATURE;
+    const unsigned int aKeyUsage = KU_KEY_ENCIPHERMENT | KU_DATA_ENCIPHERMENT | KU_DIGITAL_SIGNATURE;
     SECKEYPrivateKey* pPrivateKey = nullptr;
 
     bool bPermanent = false;
     bool bSensitive = false;
 
-    nStatus = PK11_ImportDERPrivateKeyInfoAndReturnKey(
+    SECStatus nStatus = PK11_ImportDERPrivateKeyInfoAndReturnKey(
           pSlot, &pDerPrivateKeyInfo, nullptr, nullptr, bPermanent, bSensitive,
-          keyUsage, &pPrivateKey, nullptr);
+          aKeyUsage, &pPrivateKey, nullptr);
 
     if (nStatus != SECSuccess)
-        return uno::Reference<security::XCertificate>();
+        return nullptr;
+
+    return pPrivateKey;
+}
+
+uno::Reference<security::XCertificate> SecurityEnvironment_NssImpl::createDERCertificateWithPrivateKey(
+        Sequence<sal_Int8> const & raDERCertificate, Sequence<sal_Int8> const & raPrivateKey)
+{
+
+    SECKEYPrivateKey* pPrivateKey = insertPrivateKey(raPrivateKey);
 
     if (!pPrivateKey)
         return uno::Reference<security::XCertificate>();
 
-    X509Certificate_NssImpl* pX509Certificate = createX509CertificateFromDER(raDERCertificate);
+    X509Certificate_NssImpl* pX509Certificate = createAndAddCertificateFromPackage(raDERCertificate, "TCu,Cu,Tu");
+
     if (!pX509Certificate)
         return uno::Reference<security::XCertificate>();
 
-    addCryptoSlot(pSlot);
-
-    CERTCertificate* pCERTCertificate = const_cast<CERTCertificate*>(pX509Certificate->getNssCert());
-    pCERTCertificate->slot = pSlot;
+    pX509Certificate->setCustomPrivateKey(pPrivateKey);
 
     return pX509Certificate;
 }
diff --git a/xmlsecurity/source/xmlsec/nss/securityenvironment_nssimpl.hxx b/xmlsecurity/source/xmlsec/nss/securityenvironment_nssimpl.hxx
index 6c6160fc2009..9829c9129771 100644
--- a/xmlsecurity/source/xmlsec/nss/securityenvironment_nssimpl.hxx
+++ b/xmlsecurity/source/xmlsec/nss/securityenvironment_nssimpl.hxx
@@ -128,9 +128,15 @@ private:
         static void destroyKeysManager(xmlSecKeysMngrPtr pKeysMngr) ;
 
 private:
+
         void updateSlots();
 
-        X509Certificate_NssImpl* createX509CertificateFromDER(const css::uno::Sequence<sal_Int8>& aDerCertificate);
+        X509Certificate_NssImpl* createAndAddCertificateFromPackage(
+                                    const css::uno::Sequence<sal_Int8>& raDerCertificate,
+                                    OUString const & raString);
+        SECKEYPrivateKey* insertPrivateKey(css::uno::Sequence<sal_Int8> const & raPrivateKey);
+
+        X509Certificate_NssImpl* createX509CertificateFromDER(const css::uno::Sequence<sal_Int8>& raDerCertificate);
 
           /// @throws css::uno::Exception
           /// @throws css::uno::RuntimeException
diff --git a/xmlsecurity/source/xmlsec/nss/x509certificate_nssimpl.cxx b/xmlsecurity/source/xmlsec/nss/x509certificate_nssimpl.cxx
index 53449e9c0900..35a3e841e6f4 100644
--- a/xmlsecurity/source/xmlsec/nss/x509certificate_nssimpl.cxx
+++ b/xmlsecurity/source/xmlsec/nss/x509certificate_nssimpl.cxx
@@ -46,7 +46,8 @@ using ::com::sun::star::security::XCertificate ;
 using ::com::sun::star::util::DateTime ;
 
 X509Certificate_NssImpl::X509Certificate_NssImpl() :
-    m_pCert( nullptr )
+    m_pCert(nullptr),
+    m_pPrivateKey(nullptr)
 {
 }
 
@@ -331,6 +332,29 @@ void X509Certificate_NssImpl::setRawCert( const Sequence< sal_Int8 >& rawCert )
     m_pCert = cert ;
 }
 
+void X509Certificate_NssImpl::setCustomPrivateKey(SECKEYPrivateKey* pPrivateKey)
+{
+    m_pPrivateKey = pPrivateKey;
+}
+
+SECKEYPrivateKey* X509Certificate_NssImpl::getPrivateKey()
+{
+    if (m_pPrivateKey)
+    {
+        return m_pPrivateKey;
+    }
+    else
+    {
+        if (m_pCert && m_pCert->slot)
+        {
+            SECKEYPrivateKey* pPrivateKey = PK11_FindPrivateKeyFromCert(m_pCert->slot, m_pCert, nullptr);
+            if (pPrivateKey)
+                return pPrivateKey;
+        }
+    }
+    return nullptr;
+}
+
 /* XUnoTunnel */
 sal_Int64 SAL_CALL X509Certificate_NssImpl::getSomething( const Sequence< sal_Int8 >& aIdentifier ) {
     if( aIdentifier.getLength() == 16 && 0 == memcmp( getUnoTunnelId().getConstArray(), aIdentifier.getConstArray(), 16 ) ) {
diff --git a/xmlsecurity/source/xmlsec/nss/x509certificate_nssimpl.hxx b/xmlsecurity/source/xmlsec/nss/x509certificate_nssimpl.hxx
index 6e2b8a472068..64c76972bf83 100644
--- a/xmlsecurity/source/xmlsec/nss/x509certificate_nssimpl.hxx
+++ b/xmlsecurity/source/xmlsec/nss/x509certificate_nssimpl.hxx
@@ -40,7 +40,8 @@ class X509Certificate_NssImpl : public ::cppu::WeakImplHelper<
     css::lang::XServiceInfo > , public xmlsecurity::Certificate
 {
     private:
-        CERTCertificate* m_pCert ;
+        CERTCertificate* m_pCert;
+        SECKEYPrivateKey* m_pPrivateKey;
 
     public:
         X509Certificate_NssImpl() ;
@@ -93,8 +94,11 @@ class X509Certificate_NssImpl : public ::cppu::WeakImplHelper<
         //Helper methods
         void setCert( CERTCertificate* cert ) ;
         const CERTCertificate* getNssCert() const ;
+
         /// @throws css::uno::RuntimeException
         void setRawCert( const css::uno::Sequence< sal_Int8 >& rawCert ) ;
+        void setCustomPrivateKey(SECKEYPrivateKey* pPrivateKey);
+        SECKEYPrivateKey* getPrivateKey();
 
         // XServiceInfo
         virtual OUString SAL_CALL getImplementationName() override;