/* This Source Code Form is subject to the terms of the Mozilla Public

 * License, v. 2.0. If a copy of the MPL was not distributed with this

 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#ifndef PKIM_H

#include "pkim.h"

#endif /* PKIM_H */

#ifndef PKIT_H

#include "pkit.h"

#endif /* PKIT_H */

#ifndef NSSPKI_H

#include "nsspki.h"

#endif /* NSSPKI_H */

#ifndef PKI_H

#include "pki.h"

#endif /* PKI_H */

#ifndef NSSBASE_H

#include "nssbase.h"

#endif /* NSSBASE_H */

#ifndef BASE_H

#include "base.h"

#endif /* BASE_H */

#include "cert.h"

#include "dev.h"

#include "pki3hack.h"

#ifdef DEBUG_CACHE

static PRLogModuleInfo *s_log = NULL;

#endif

#ifdef DEBUG_CACHE

static void

log_item_dump(const char *msg, NSSItem *it)

{

    char buf[33];

    int i, j;

    for (i = 0; i < 10 && i < it->size; i++) {

        sprintf(&buf[2 * i], "%02X", ((PRUint8 *)it->data)[i]);

    }

    if (it->size > 10) {

        sprintf(&buf[2 * i], "..");

        i += 1;

        for (j = it->size - 1; i <= 16 && j > 10; i++, j--) {

            sprintf(&buf[2 * i], "%02X", ((PRUint8 *)it->data)[j]);

        }

    }

    PR_LOG(s_log, PR_LOG_DEBUG, ("%s: %s", msg, buf));

}

#endif

#ifdef DEBUG_CACHE

static void

log_cert_ref(const char *msg, NSSCertificate *c)

{

    PR_LOG(s_log, PR_LOG_DEBUG, ("%s: %s", msg,

                                 (c->nickname) ? c->nickname : c->email));

    log_item_dump("\tserial", &c->serial);

    log_item_dump("\tsubject", &c->subject);

}

#endif

/* Certificate cache routines */

/* XXX

 * Locking is not handled well at all.  A single, global lock with sub-locks

 * in the collection types.  Cleanup needed.

 */

/* should it live in its own arena? */

struct nssTDCertificateCacheStr {

    PZLock *lock;

    NSSArena *arena;

    nssHash *issuerAndSN;

    nssHash *subject;

    nssHash *nickname;

    nssHash *email;

};

struct cache_entry_str {

    union {

        NSSCertificate *cert;

        nssList *list;

        void *value;

    } entry;

    PRUint32 hits;

    PRTime lastHit;

    NSSArena *arena;

    NSSUTF8 *nickname;

};

typedef struct cache_entry_str cache_entry;

static cache_entry *

new_cache_entry(NSSArena *arena, void *value, PRBool ownArena)

{

    cache_entry *ce = nss_ZNEW(arena, cache_entry);

    if (ce) {

        ce->entry.value = value;

        ce->hits = 1;

        ce->lastHit = PR_Now();

        if (ownArena) {

            ce->arena = arena;

        }

        ce->nickname = NULL;

    }

    return ce;

}

/* this should not be exposed in a header, but is here to keep the above

 * types/functions static

 */

NSS_IMPLEMENT PRStatus

nssTrustDomain_InitializeCache(

    NSSTrustDomain *td,

    PRUint32 cacheSize)

{

    NSSArena *arena;

    nssTDCertificateCache *cache = td->cache;

#ifdef DEBUG_CACHE

    s_log = PR_NewLogModule("nss_cache");

    PR_ASSERT(s_log);

#endif

    PR_ASSERT(!cache);

    arena = nssArena_Create();

    if (!arena) {

        return PR_FAILURE;

    }

    cache = nss_ZNEW(arena, nssTDCertificateCache);

    if (!cache) {

        nssArena_Destroy(arena);

        return PR_FAILURE;

    }

    cache->lock = PZ_NewLock(nssILockCache);

    if (!cache->lock) {

        nssArena_Destroy(arena);

        return PR_FAILURE;

    }

    /* Create the issuer and serial DER --> certificate hash */

    cache->issuerAndSN = nssHash_CreateCertificate(arena, cacheSize);

    if (!cache->issuerAndSN) {

        goto loser;

    }

    /* Create the subject DER --> subject list hash */

    cache->subject = nssHash_CreateItem(arena, cacheSize);

    if (!cache->subject) {

        goto loser;

    }

    /* Create the nickname --> subject list hash */

    cache->nickname = nssHash_CreateString(arena, cacheSize);

    if (!cache->nickname) {

        goto loser;

    }

    /* Create the email --> list of subject lists hash */

    cache->email = nssHash_CreateString(arena, cacheSize);

    if (!cache->email) {

        goto loser;

    }

    cache->arena = arena;

    td->cache = cache;

#ifdef DEBUG_CACHE

    PR_LOG(s_log, PR_LOG_DEBUG, ("Cache initialized."));

#endif

    return PR_SUCCESS;

loser:

    PZ_DestroyLock(cache->lock);

    nssArena_Destroy(arena);

    td->cache = NULL;

#ifdef DEBUG_CACHE

    PR_LOG(s_log, PR_LOG_DEBUG, ("Cache initialization failed."));

#endif

    return PR_FAILURE;

}

/* The entries of the hashtable are currently dependent on the certificate(s)

 * that produced them.  That is, the entries will be freed when the cert is

 * released from the cache.  If there are certs in the cache at any time,

 * including shutdown, the hash table entries will hold memory.  In order for

 * clean shutdown, it is necessary for there to be no certs in the cache.

 */

extern const NSSError NSS_ERROR_INTERNAL_ERROR;

extern const NSSError NSS_ERROR_BUSY;

NSS_IMPLEMENT PRStatus

nssTrustDomain_DestroyCache(NSSTrustDomain *td)

{

    if (!td->cache) {

        nss_SetError(NSS_ERROR_INTERNAL_ERROR);

        return PR_FAILURE;

    }

    if (nssHash_Count(td->cache->issuerAndSN) > 0) {

        nss_SetError(NSS_ERROR_BUSY);

        return PR_FAILURE;

    }

    PZ_DestroyLock(td->cache->lock);

    nssHash_Destroy(td->cache->issuerAndSN);

    nssHash_Destroy(td->cache->subject);

    nssHash_Destroy(td->cache->nickname);

    nssHash_Destroy(td->cache->email);

    nssArena_Destroy(td->cache->arena);

    td->cache = NULL;

#ifdef DEBUG_CACHE

    PR_LOG(s_log, PR_LOG_DEBUG, ("Cache destroyed."));

#endif

    return PR_SUCCESS;

}

static PRStatus

remove_issuer_and_serial_entry(

    nssTDCertificateCache *cache,

    NSSCertificate *cert)

{

    /* Remove the cert from the issuer/serial hash */

    nssHash_Remove(cache->issuerAndSN, cert);

#ifdef DEBUG_CACHE

    log_cert_ref("removed issuer/sn", cert);

#endif

    return PR_SUCCESS;

}

static PRStatus

remove_subject_entry(

    nssTDCertificateCache *cache,

    NSSCertificate *cert,

    nssList **subjectList,

    NSSUTF8 **nickname,

    NSSArena **arena)

{

    PRStatus nssrv;

    cache_entry *ce;

    *subjectList = NULL;

    *arena = NULL;

    /* Get the subject list for the cert's subject */

    ce = (cache_entry *)nssHash_Lookup(cache->subject, &cert->subject);

    if (ce) {

        /* Remove the cert from the subject hash */

        nssList_Remove(ce->entry.list, cert);

        *subjectList = ce->entry.list;

        *nickname = ce->nickname;

        *arena = ce->arena;

        nssrv = PR_SUCCESS;

#ifdef DEBUG_CACHE

        log_cert_ref("removed cert", cert);

        log_item_dump("from subject list", &cert->subject);

#endif

    } else {

        nssrv = PR_FAILURE;

    }

    return nssrv;

}

static PRStatus

remove_nickname_entry(

    nssTDCertificateCache *cache,

    NSSUTF8 *nickname,

    nssList *subjectList)

{

    PRStatus nssrv;

    if (nickname) {

        nssHash_Remove(cache->nickname, nickname);

        nssrv = PR_SUCCESS;

#ifdef DEBUG_CACHE

        PR_LOG(s_log, PR_LOG_DEBUG, ("removed nickname %s", nickname));

#endif

    } else {

        nssrv = PR_FAILURE;

    }

    return nssrv;

}

static PRStatus

remove_email_entry(

    nssTDCertificateCache *cache,

    NSSCertificate *cert,

    nssList *subjectList)

{

    PRStatus nssrv = PR_FAILURE;

    cache_entry *ce;

    /* Find the subject list in the email hash */

    if (cert->email) {

        ce = (cache_entry *)nssHash_Lookup(cache->email, cert->email);

        if (ce) {

            nssList *subjects = ce->entry.list;

            /* Remove the subject list from the email hash */

            if (subjects) {

                nssList_Remove(subjects, subjectList);

#ifdef DEBUG_CACHE

                log_item_dump("removed subject list", &cert->subject);

                PR_LOG(s_log, PR_LOG_DEBUG, ("for email %s", cert->email));

#endif

                if (nssList_Count(subjects) == 0) {

                    /* No more subject lists for email, delete list and

                     * remove hash entry

                     */

                    (void)nssList_Destroy(subjects);

                    nssHash_Remove(cache->email, cert->email);

                    /* there are no entries left for this address, free space

                     * used for email entries

                     */

                    nssArena_Destroy(ce->arena);

#ifdef DEBUG_CACHE

                    PR_LOG(s_log, PR_LOG_DEBUG, ("removed email %s", cert->email));

#endif

                }

            }

            nssrv = PR_SUCCESS;

        }

    }

    return nssrv;

}

NSS_IMPLEMENT void

nssTrustDomain_RemoveCertFromCacheLOCKED(

    NSSTrustDomain *td,

    NSSCertificate *cert)

{

    nssList *subjectList;

    cache_entry *ce;

    NSSArena *arena;

    NSSUTF8 *nickname = NULL;

#ifdef DEBUG_CACHE

    log_cert_ref("attempt to remove cert", cert);

#endif

    ce = (cache_entry *)nssHash_Lookup(td->cache->issuerAndSN, cert);

    if (!ce || ce->entry.cert != cert) {

/* If it's not in the cache, or a different cert is (this is really

         * for safety reasons, though it shouldn't happen), do nothing

         */

#ifdef DEBUG_CACHE

        PR_LOG(s_log, PR_LOG_DEBUG, ("but it wasn't in the cache"));

#endif

        return;

    }

    (void)remove_issuer_and_serial_entry(td->cache, cert);

    (void)remove_subject_entry(td->cache, cert, &subjectList,

                               &nickname, &arena);

    if (nssList_Count(subjectList) == 0) {

        (void)remove_nickname_entry(td->cache, nickname, subjectList);

        (void)remove_email_entry(td->cache, cert, subjectList);

        (void)nssList_Destroy(subjectList);

        nssHash_Remove(td->cache->subject, &cert->subject);

        /* there are no entries left for this subject, free the space used

         * for both the nickname and subject entries

         */

        if (arena) {

            nssArena_Destroy(arena);

        }

    }

}

NSS_IMPLEMENT void

nssTrustDomain_LockCertCache(NSSTrustDomain *td)

{

    PZ_Lock(td->cache->lock);

}

NSS_IMPLEMENT void

nssTrustDomain_UnlockCertCache(NSSTrustDomain *td)

{

    PZ_Unlock(td->cache->lock);

}

struct token_cert_dtor {

    NSSToken *token;

    nssTDCertificateCache *cache;

    NSSCertificate **certs;

    PRUint32 numCerts, arrSize;

};

static void

remove_token_certs(const void *k, void *v, void *a)

{

    NSSCertificate *c = (NSSCertificate *)k;

    nssPKIObject *object = &c->object;

    struct token_cert_dtor *dtor = a;

    PRUint32 i;

    nssPKIObject_AddRef(object);

    nssPKIObject_Lock(object);

    for (i = 0; i < object->numInstances; i++) {

        if (object->instances[i]->token == dtor->token) {

            nssCryptokiObject_Destroy(object->instances[i]);

            object->instances[i] = object->instances[object->numInstances - 1];

            object->instances[object->numInstances - 1] = NULL;

            object->numInstances--;

            dtor->certs[dtor->numCerts++] = c;

            if (dtor->numCerts == dtor->arrSize) {

                dtor->arrSize *= 2;

                dtor->certs = nss_ZREALLOCARRAY(dtor->certs,

                                                NSSCertificate *,

                                                dtor->arrSize);

            }

            break;

        }

    }

    nssPKIObject_Unlock(object);

    nssPKIObject_Destroy(object);

    return;

}

/*

 * Remove all certs for the given token from the cache.  This is

 * needed if the token is removed.

 */

NSS_IMPLEMENT PRStatus

nssTrustDomain_RemoveTokenCertsFromCache(

    NSSTrustDomain *td,

    NSSToken *token)

{

    NSSCertificate **certs;

    PRUint32 i, arrSize = 10;

    struct token_cert_dtor dtor;

    certs = nss_ZNEWARRAY(NULL, NSSCertificate *, arrSize);

    if (!certs) {

        return PR_FAILURE;

    }

    dtor.cache = td->cache;

    dtor.token = token;

    dtor.certs = certs;

    dtor.numCerts = 0;

    dtor.arrSize = arrSize;

    PZ_Lock(td->cache->lock);

    nssHash_Iterate(td->cache->issuerAndSN, remove_token_certs, &dtor);

    for (i = 0; i < dtor.numCerts; i++) {

        if (dtor.certs[i]->object.numInstances == 0) {

            nssTrustDomain_RemoveCertFromCacheLOCKED(td, dtor.certs[i]);

            dtor.certs[i] = NULL; /* skip this cert in the second for loop */

        } else {

            /* make sure it doesn't disappear on us before we finish */

            nssCertificate_AddRef(dtor.certs[i]);

        }

    }

    PZ_Unlock(td->cache->lock);

    for (i = 0; i < dtor.numCerts; i++) {

        if (dtor.certs[i]) {

            STAN_ForceCERTCertificateUpdate(dtor.certs[i]);

            nssCertificate_Destroy(dtor.certs[i]);

        }

    }

    nss_ZFreeIf(dtor.certs);

    return PR_SUCCESS;

}

NSS_IMPLEMENT PRStatus

nssTrustDomain_UpdateCachedTokenCerts(

    NSSTrustDomain *td,

    NSSToken *token)

{

    NSSCertificate **cp, **cached = NULL;

    nssList *certList;

    PRUint32 count;

    certList = nssList_Create(NULL, PR_FALSE);

    if (!certList)

        return PR_FAILURE;

    (void)nssTrustDomain_GetCertsFromCache(td, certList);

    count = nssList_Count(certList);

    if (count > 0) {

        cached = nss_ZNEWARRAY(NULL, NSSCertificate *, count + 1);

        if (!cached) {

            nssList_Destroy(certList);

            return PR_FAILURE;

        }

        nssList_GetArray(certList, (void **)cached, count);

        for (cp = cached; *cp; cp++) {

            nssCryptokiObject *instance;

            NSSCertificate *c = *cp;

            nssTokenSearchType tokenOnly = nssTokenSearchType_TokenOnly;

            instance = nssToken_FindCertificateByIssuerAndSerialNumber(

                token,

                NULL,

                &c->issuer,

                &c->serial,

                tokenOnly,

                NULL);

            if (instance) {

                nssPKIObject_AddInstance(&c->object, instance);

                STAN_ForceCERTCertificateUpdate(c);

            }

        }

        nssCertificateArray_Destroy(cached);

    }

    nssList_Destroy(certList);

    return PR_SUCCESS;

}

static PRStatus

add_issuer_and_serial_entry(

    NSSArena *arena,

    nssTDCertificateCache *cache,

    NSSCertificate *cert)

{

    cache_entry *ce;

    ce = new_cache_entry(arena, (void *)cert, PR_FALSE);

#ifdef DEBUG_CACHE

    log_cert_ref("added to issuer/sn", cert);

#endif

    return nssHash_Add(cache->issuerAndSN, cert, (void *)ce);

}

static PRStatus

add_subject_entry(

    NSSArena *arena,

    nssTDCertificateCache *cache,

    NSSCertificate *cert,

    NSSUTF8 *nickname,

    nssList **subjectList)

{

    PRStatus nssrv;

    nssList *list;

    cache_entry *ce;

    *subjectList = NULL; /* this is only set if a new one is created */

    ce = (cache_entry *)nssHash_Lookup(cache->subject, &cert->subject);

    if (ce) {

        ce->hits++;

        ce->lastHit = PR_Now();

        /* The subject is already in, add this cert to the list */

        nssrv = nssList_AddUnique(ce->entry.list, cert);

#ifdef DEBUG_CACHE

        log_cert_ref("added to existing subject list", cert);

#endif

    } else {

        NSSDER *subject;

        /* Create a new subject list for the subject */

        list = nssList_Create(arena, PR_FALSE);

        if (!list) {

            return PR_FAILURE;

        }

        ce = new_cache_entry(arena, (void *)list, PR_TRUE);

        if (!ce) {

            return PR_FAILURE;

        }

        if (nickname) {

            ce->nickname = nssUTF8_Duplicate(nickname, arena);

        }

        nssList_SetSortFunction(list, nssCertificate_SubjectListSort);

        /* Add the cert entry to this list of subjects */

        nssrv = nssList_AddUnique(list, cert);

        if (nssrv != PR_SUCCESS) {

            return nssrv;

        }

        /* Add the subject list to the cache */

        subject = nssItem_Duplicate(&cert->subject, arena, NULL);

        if (!subject) {

            return PR_FAILURE;

        }

        nssrv = nssHash_Add(cache->subject, subject, ce);

        if (nssrv != PR_SUCCESS) {

            return nssrv;

        }

        *subjectList = list;

#ifdef DEBUG_CACHE

        log_cert_ref("created subject list", cert);

#endif

    }

    return nssrv;

}

static PRStatus

add_nickname_entry(

    NSSArena *arena,

    nssTDCertificateCache *cache,

    NSSUTF8 *certNickname,

    nssList *subjectList)

{

    PRStatus nssrv = PR_SUCCESS;

    cache_entry *ce;

    ce = (cache_entry *)nssHash_Lookup(cache->nickname, certNickname);

    if (ce) {

        /* This is a collision.  A nickname entry already exists for this

         * subject, but a subject entry didn't.  This would imply there are

         * two subjects using the same nickname, which is not allowed.

         */

        return PR_FAILURE;

    } else {

        NSSUTF8 *nickname;

        ce = new_cache_entry(arena, subjectList, PR_FALSE);

        if (!ce) {

            return PR_FAILURE;

        }

        nickname = nssUTF8_Duplicate(certNickname, arena);

        if (!nickname) {

            return PR_FAILURE;

        }

        nssrv = nssHash_Add(cache->nickname, nickname, ce);

#ifdef DEBUG_CACHE

        log_cert_ref("created nickname for", cert);

#endif

    }

    return nssrv;

}

static PRStatus

add_email_entry(

    nssTDCertificateCache *cache,

    NSSCertificate *cert,

    nssList *subjectList)

{

    PRStatus nssrv = PR_SUCCESS;

    nssList *subjects;

    cache_entry *ce;

    ce = (cache_entry *)nssHash_Lookup(cache->email, cert->email);

    if (ce) {

        /* Already have an entry for this email address, but not subject */

        subjects = ce->entry.list;

        nssrv = nssList_AddUnique(subjects, subjectList);

        ce->hits++;

        ce->lastHit = PR_Now();

#ifdef DEBUG_CACHE

        log_cert_ref("added subject to email for", cert);

#endif

    } else {

        NSSASCII7 *email;

        NSSArena *arena;

        arena = nssArena_Create();

        if (!arena) {

            return PR_FAILURE;

        }

        /* Create a new list of subject lists, add this subject */

        subjects = nssList_Create(arena, PR_TRUE);

        if (!subjects) {

            nssArena_Destroy(arena);

            return PR_FAILURE;

        }

        /* Add the new subject to the list */

        nssrv = nssList_AddUnique(subjects, subjectList);

        if (nssrv != PR_SUCCESS) {

            nssArena_Destroy(arena);

            return nssrv;

        }

        /* Add the new entry to the cache */

        ce = new_cache_entry(arena, (void *)subjects, PR_TRUE);

        if (!ce) {

            nssArena_Destroy(arena);

            return PR_FAILURE;

        }

        email = nssUTF8_Duplicate(cert->email, arena);

        if (!email) {

            nssArena_Destroy(arena);

            return PR_FAILURE;

        }

        nssrv = nssHash_Add(cache->email, email, ce);

        if (nssrv != PR_SUCCESS) {

            nssArena_Destroy(arena);

            return nssrv;

        }

#ifdef DEBUG_CACHE

        log_cert_ref("created email for", cert);

#endif

    }

    return nssrv;

}

extern const NSSError NSS_ERROR_CERTIFICATE_IN_CACHE;

static void

remove_object_instances(

    nssPKIObject *object,

    nssCryptokiObject **instances,

    int numInstances)

{

    int i;

    for (i = 0; i < numInstances; i++) {

        nssPKIObject_RemoveInstanceForToken(object, instances[i]->token);

    }

}

static SECStatus

merge_object_instances(

    nssPKIObject *to,

    nssPKIObject *from)

{

    nssCryptokiObject **instances, **ci;

    int i;

    SECStatus rv = SECSuccess;

    instances = nssPKIObject_GetInstances(from);

    if (instances == NULL) {

        return SECFailure;

    }

    for (ci = instances, i = 0; *ci; ci++, i++) {

        nssCryptokiObject *instance = nssCryptokiObject_Clone(*ci);

        if (instance) {

            if (nssPKIObject_AddInstance(to, instance) == PR_SUCCESS) {

                continue;

            }

            nssCryptokiObject_Destroy(instance);

        }

        remove_object_instances(to, instances, i);

        rv = SECFailure;

        break;

    }

    nssCryptokiObjectArray_Destroy(instances);

    return rv;

}

static NSSCertificate *

add_cert_to_cache(

    NSSTrustDomain *td,

    NSSCertificate *cert)

{

    NSSArena *arena = NULL;

    nssList *subjectList = NULL;

    PRStatus nssrv;

    PRUint32 added = 0;

    cache_entry *ce;

    NSSCertificate *rvCert = NULL;

    NSSUTF8 *certNickname = nssCertificate_GetNickname(cert, NULL);

    PZ_Lock(td->cache->lock);

    /* If it exists in the issuer/serial hash, it's already in all */

    ce = (cache_entry *)nssHash_Lookup(td->cache->issuerAndSN, cert);

    if (ce) {

        ce->hits++;

        ce->lastHit = PR_Now();

        rvCert = nssCertificate_AddRef(ce->entry.cert);

#ifdef DEBUG_CACHE

        log_cert_ref("attempted to add cert already in cache", cert);

#endif

        PZ_Unlock(td->cache->lock);

        nss_ZFreeIf(certNickname);

        /* collision - somebody else already added the cert

         * to the cache before this thread got around to it.

         */

        /* merge the instances of the cert */

        if (merge_object_instances(&rvCert->object, &cert->object) != SECSuccess) {

            nssCertificate_Destroy(rvCert);

            return NULL;

        }

        STAN_ForceCERTCertificateUpdate(rvCert);

        nssCertificate_Destroy(cert);

        return rvCert;

    }

    /* create a new cache entry for this cert within the cert's arena*/

    nssrv = add_issuer_and_serial_entry(cert->object.arena, td->cache, cert);

    if (nssrv != PR_SUCCESS) {

        goto loser;

    }

    added++;

    /* create an arena for the nickname and subject entries */

    arena = nssArena_Create();

    if (!arena) {

        goto loser;

    }

    /* create a new subject list for this cert, or add to existing */

    nssrv = add_subject_entry(arena, td->cache, cert,

                              certNickname, &subjectList);

    if (nssrv != PR_SUCCESS) {

        goto loser;

    }

    added++;

    /* If a new subject entry was created, also need nickname and/or email */

    if (subjectList != NULL) {

#ifdef nodef

        PRBool handle = PR_FALSE;

#endif

        if (certNickname) {

            nssrv = add_nickname_entry(arena, td->cache,

                                       certNickname, subjectList);

            if (nssrv != PR_SUCCESS) {

                goto loser;

            }

#ifdef nodef

            handle = PR_TRUE;

#endif

            added++;

        }

        if (cert->email) {

            nssrv = add_email_entry(td->cache, cert, subjectList);

            if (nssrv != PR_SUCCESS) {

                goto loser;

            }

#ifdef nodef

            handle = PR_TRUE;

#endif

            added += 2;

        }

#ifdef nodef

        /* I think either a nickname or email address must be associated

         * with the cert.  However, certs are passed to NewTemp without

         * either.  This worked in the old code, so it must work now.

         */

        if (!handle) {

            /* Require either nickname or email handle */

            nssrv = PR_FAILURE;

            goto loser;

        }

#endif

    } else {

        /* A new subject entry was not created.  arena is unused. */

        nssArena_Destroy(arena);

    }

    rvCert = cert;

    PZ_Unlock(td->cache->lock);

    nss_ZFreeIf(certNickname);

    return rvCert;

loser:

    nss_ZFreeIf(certNickname);

    certNickname = NULL;

    /* Remove any handles that have been created */

    subjectList = NULL;

    if (added >= 1) {

        (void)remove_issuer_and_serial_entry(td->cache, cert);

    }

    if (added >= 2) {

        (void)remove_subject_entry(td->cache, cert, &subjectList,

                                   &certNickname, &arena);

    }

    if (added == 3 || added == 5) {

        (void)remove_nickname_entry(td->cache, certNickname, subjectList);

    }

    if (added >= 4) {

        (void)remove_email_entry(td->cache, cert, subjectList);

    }

    if (subjectList) {

        nssHash_Remove(td->cache->subject, &cert->subject);

        nssList_Destroy(subjectList);

    }

    if (arena) {

        nssArena_Destroy(arena);

    }

    PZ_Unlock(td->cache->lock);

    return NULL;

}

NSS_IMPLEMENT PRStatus

nssTrustDomain_AddCertsToCache(

    NSSTrustDomain *td,

    NSSCertificate **certs,

    PRUint32 numCerts)

{

    PRUint32 i;

    NSSCertificate *c;

    for (i = 0; i < numCerts && certs[i]; i++) {

        c = add_cert_to_cache(td, certs[i]);

        if (c == NULL) {

            return PR_FAILURE;

        } else {

            certs[i] = c;

        }

    }

    return PR_SUCCESS;

}

static NSSCertificate **

collect_subject_certs(

    nssList *subjectList,

    nssList *rvCertListOpt)

{

    NSSCertificate *c;

    NSSCertificate **rvArray = NULL;

    PRUint32 count;

    nssCertificateList_AddReferences(subjectList);

    if (rvCertListOpt) {

        nssListIterator *iter = nssList_CreateIterator(subjectList);

        if (!iter) {

            return (NSSCertificate **)NULL;

        }

        for (c = (NSSCertificate *)nssListIterator_Start(iter);

             c != (NSSCertificate *)NULL;

             c = (NSSCertificate *)nssListIterator_Next(iter)) {

            nssList_Add(rvCertListOpt, c);

        }

        nssListIterator_Finish(iter);

        nssListIterator_Destroy(iter);

    } else {

        count = nssList_Count(subjectList);

        rvArray = nss_ZNEWARRAY(NULL, NSSCertificate *, count + 1);

        if (!rvArray) {

            return (NSSCertificate **)NULL;

        }

        nssList_GetArray(subjectList, (void **)rvArray, count);

    }

    return rvArray;

}

/*

 * Find all cached certs with this subject.

 */

NSS_IMPLEMENT NSSCertificate **

nssTrustDomain_GetCertsForSubjectFromCache(

    NSSTrustDomain *td,

    NSSDER *subject,

    nssList *certListOpt)

{

    NSSCertificate **rvArray = NULL;

    cache_entry *ce;

#ifdef DEBUG_CACHE

    log_item_dump("looking for cert by subject", subject);

#endif

    PZ_Lock(td->cache->lock);

    ce = (cache_entry *)nssHash_Lookup(td->cache->subject, subject);

    if (ce) {

        ce->hits++;

        ce->lastHit = PR_Now();

#ifdef DEBUG_CACHE

        PR_LOG(s_log, PR_LOG_DEBUG, ("... found, %d hits", ce->hits));

#endif

        rvArray = collect_subject_certs(ce->entry.list, certListOpt);

    }

    PZ_Unlock(td->cache->lock);

    return rvArray;

}

/*

 * Find all cached certs with this label.

 */

NSS_IMPLEMENT NSSCertificate **

nssTrustDomain_GetCertsForNicknameFromCache(

    NSSTrustDomain *td,

    const NSSUTF8 *nickname,

    nssList *certListOpt)

{

    NSSCertificate **rvArray = NULL;