@@ -74,7 +74,7 @@ index 2edab39..b2ac746 100644

 +++ b/lib/Makefile.w32-vc

 @@ -60,9 +60,9 @@ OPENSSL_HOME = ..\..\openssl-0.9.8a

  !endif

-

+ 

  !ifdef OPENSSL

 -OPENSSL_STATIC = libeay32.lib

 +OPENSSL_STATIC = libcrypto.lib

@@ -82,7 +82,7 @@ index 2edab39..b2ac746 100644

 -OPENSSL_DYNAMIC = libeay32.lib

 +OPENSSL_DYNAMIC = libcrypto.lib

  #OPENSSL_DYNAMIC = libeay32d.lib

-

+ 

  OPENSSL_INC=$(OPENSSL_HOME)\include

+-- 

 2.23.0.windows.1

@@ -3,7 +3,7 @@ Author: David Woodhouse <David.Woodhouse@intel.com>

 Date:   Thu Apr 30 14:58:24 2015 +0100

     Serialize to RFC7512-compliant PKCS#11 URIs

-

+    

     Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

 commit 4d5280da8df591aab701dff4493d13a835a9b29c

@@ -11,9 +11,9 @@ Author: David Woodhouse <David.Woodhouse@intel.com>

 Date:   Wed Dec 10 14:00:21 2014 +0000

     Accept RFC7512-compliant PKCS#11 URIs as serialized token/certificate IDs

-

+    

     The old format is still accepted for compatibility.

-

+    

     Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

 commit 14e09211c3d50eb06825090c9765e4382cf52f19

@@ -21,21 +21,21 @@ Author: David Woodhouse <David.Woodhouse@intel.com>

 Date:   Sun Dec 14 19:42:18 2014 +0000

     Stop _pkcs11h_util_hexToBinary() checking for trailing NUL

-

+    

     We are going to want to use this for parsing %XX hex escapes in RFC7512

     PKCS#11 URIs, where we cannot expect a trailing NUL. Since there's only

     one existing caller at the moment, it's simple just to let the caller

     have responsibility for that check.

-

+    

     Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>

 diff --git a/lib/pkcs11h-serialization.c b/lib/pkcs11h-serialization.c

 index ad275f8..1d077e4 100644

 --- a/lib/pkcs11h-serialization.c

 +++ b/lib/pkcs11h-serialization.c

 @@ -61,29 +61,127 @@

-

+ 

  #if defined(ENABLE_PKCS11H_TOKEN) || defined(ENABLE_PKCS11H_CERTIFICATE)

-

+ 

 +#define URI_SCHEME "pkcs11:"

 +

 +#define token_field_ofs(field) ((unsigned long)&(((struct pkcs11h_token_id_s *)0)->field))

@@ -147,19 +147,19 @@ index ad275f8..1d077e4 100644

 +

  CK_RV

  pkcs11h_token_serializeTokenId (

-	OUT char * const sz,

-	IN OUT size_t *max,

-	IN const pkcs11h_token_id_t token_id

+ 	OUT char * const sz,

+ 	IN OUT size_t *max,

+ 	IN const pkcs11h_token_id_t token_id

  ) {

 -	const char *sources[5];

-	CK_RV rv = CKR_FUNCTION_FAILED;

+ 	CK_RV rv = CKR_FUNCTION_FAILED;

 -	size_t n;

 -	int e;

-

-	/*_PKCS11H_ASSERT (sz!=NULL); Not required*/

-	_PKCS11H_ASSERT (max!=NULL);

-	_PKCS11H_ASSERT (token_id!=NULL);

-

+ 

+ 	/*_PKCS11H_ASSERT (sz!=NULL); Not required*/

+ 	_PKCS11H_ASSERT (max!=NULL);

+ 	_PKCS11H_ASSERT (token_id!=NULL);

+ 

 -	{ /* Must be after assert */

 -		sources[0] = token_id->manufacturerID;

 -		sources[1] = token_id->model;

@@ -168,13 +168,13 @@ index ad275f8..1d077e4 100644

 -		sources[4] = NULL;

 -	}

 -

-	_PKCS11H_DEBUG (

-		PKCS11H_LOG_DEBUG2,

-		"PKCS#11: pkcs11h_token_serializeTokenId entry sz=%p, *max="P_Z", token_id=%p",

+ 	_PKCS11H_DEBUG (

+ 		PKCS11H_LOG_DEBUG2,

+ 		"PKCS#11: pkcs11h_token_serializeTokenId entry sz=%p, *max="P_Z", token_id=%p",

 @@ -92,67 +190,161 @@ pkcs11h_token_serializeTokenId (

-		(void *)token_id

-	);

-

+ 		(void *)token_id

+ 	);

+ 

 -	n = 0;

 -	for (e=0;sources[e] != NULL;e++) {

 -		size_t t;

@@ -232,15 +232,15 @@ index ad275f8..1d077e4 100644

 +			urilen -= 2;

 +		} else {

 +			*tokstr = *uri;

-		}

+ 		}

 -		n+=t;

 +		tokstr++;

 +		uri++;

 +		toklen--;

 +		urilen--;

 +		tokstr[0] = 0;

-	}

-

+ 	}

+ 

 -	if (sz != NULL) {

 -		if (*max < n) {

 -			rv = CKR_ATTRIBUTE_VALUE_INVALID;

@@ -295,7 +295,7 @@ index ad275f8..1d077e4 100644

 +

 +				goto matched;

 +			}

-		}

+ 		}

 +		if (certificate_id && !strncmp(p, "id=", 3)) {

 +			p += 3;

 +

@@ -304,7 +304,7 @@ index ad275f8..1d077e4 100644

 +			if (rv != CKR_OK) {

 +				goto cleanup;

 +			}

-

+ 

 -		n = 0;

 -		for (e=0;sources[e] != NULL;e++) {

 -			size_t t = *max-n;

@@ -321,16 +321,16 @@ index ad275f8..1d077e4 100644

 +						     end - p + 1,

 +						     &certificate_id->attrCKA_ID_size);

 +			if (rv != CKR_OK) {

-				goto cleanup;

-			}

+ 				goto cleanup;

+ 			}

 -			n+=t;

 -			sz[n-1] = '/';

 +

 +			goto matched;

-		}

+ 		}

 -		sz[n-1] = '\x0';

 -	}

-

+ 

 -	*max = n;

 -	rv = CKR_OK;

 +		/* We don't parse object= because the match code doesn't support

@@ -338,7 +338,7 @@ index ad275f8..1d077e4 100644

 +

 +		/* Failed to parse PKCS#11 URI element. */

 +		return CKR_ATTRIBUTE_VALUE_INVALID;

-

+ 

 +		matched:

 +		    ;

 +	}

@@ -351,7 +351,7 @@ index ad275f8..1d077e4 100644

 +	    !token_id->manufacturerID[0] || !token_id->serialNumber[0]) {

 +		return CKR_ATTRIBUTE_VALUE_INVALID;

 +	}

-

+ 

 -	_PKCS11H_DEBUG (

 -		PKCS11H_LOG_DEBUG2,

 -		"PKCS#11: pkcs11h_token_serializeTokenId return rv=%lu-'%s', *max="P_Z", sz='%s'",

@@ -364,29 +364,29 @@ index ad275f8..1d077e4 100644

 +	if (certificate_id && !certificate_id->attrCKA_ID_size) {

 +		return CKR_ATTRIBUTE_VALUE_INVALID;

 +	}

-

-	return rv;

+ 

+ 	return rv;

  }

-

+ 

 +static

  CK_RV

 -pkcs11h_token_deserializeTokenId (

 -	OUT pkcs11h_token_id_t *p_token_id,

 +__pkcs11h_token_legacy_deserializeTokenId (

 +	OUT pkcs11h_token_id_t token_id,

-	IN const char * const sz

+ 	IN const char * const sz

  ) {

  #define __PKCS11H_TARGETS_NUMBER 4

 @@ -161,24 +353,11 @@ pkcs11h_token_deserializeTokenId (

-		size_t s;

-	} targets[__PKCS11H_TARGETS_NUMBER];

-

+ 		size_t s;

+ 	} targets[__PKCS11H_TARGETS_NUMBER];

+ 

 -	pkcs11h_token_id_t token_id = NULL;

-	char *p1 = NULL;

-	char *_sz = NULL;

-	int e;

-	CK_RV rv = CKR_FUNCTION_FAILED;

-

+ 	char *p1 = NULL;

+ 	char *_sz = NULL;

+ 	int e;

+ 	CK_RV rv = CKR_FUNCTION_FAILED;

+ 

 -	_PKCS11H_ASSERT (p_token_id!=NULL);

 -	_PKCS11H_ASSERT (sz!=NULL);

 -

@@ -399,24 +399,24 @@ index ad275f8..1d077e4 100644

 -

 -	*p_token_id = NULL;

 -

-	if (

-		(rv = _pkcs11h_mem_strdup (

-			(void *)&_sz,

+ 	if (

+ 		(rv = _pkcs11h_mem_strdup (

+ 			(void *)&_sz,

 @@ -190,10 +369,6 @@ pkcs11h_token_deserializeTokenId (

-

-	p1 = _sz;

-

+ 

+ 	p1 = _sz;

+ 

 -	if ((rv = _pkcs11h_token_newTokenId (&token_id)) != CKR_OK) {

 -		goto cleanup;

 -	}

 -

-	targets[0].p = token_id->manufacturerID;

-	targets[0].s = sizeof (token_id->manufacturerID);

-	targets[1].p = token_id->model;

+ 	targets[0].p = token_id->manufacturerID;

+ 	targets[0].s = sizeof (token_id->manufacturerID);

+ 	targets[1].p = token_id->model;

 @@ -252,6 +427,51 @@ pkcs11h_token_deserializeTokenId (

-		p1 = p2+1;

-	}

-

+ 		p1 = p2+1;

+ 	}

+ 

 +	rv = CKR_OK;

 +

 +cleanup:

@@ -462,43 +462,43 @@ index ad275f8..1d077e4 100644

 +		goto cleanup;

 +	}

 +

-	strncpy (

-		token_id->display,

-		token_id->label,

+ 	strncpy (

+ 		token_id->display,

+ 		token_id->label,

 @@ -264,11 +484,6 @@ pkcs11h_token_deserializeTokenId (

-	rv = CKR_OK;

-

+ 	rv = CKR_OK;

+ 

  cleanup:

 -

 -	if (_sz != NULL) {

 -		_pkcs11h_mem_free ((void *)&_sz);

 -	}

 -

-	if (token_id != NULL) {

-		pkcs11h_token_freeTokenId (token_id);

-	}

+ 	if (token_id != NULL) {

+ 		pkcs11h_token_freeTokenId (token_id);

+ 	}

 @@ -281,7 +496,6 @@ cleanup:

-	);

-

-	return rv;

+ 	);

+ 

+ 	return rv;

 -#undef __PKCS11H_TARGETS_NUMBER

  }

-

+ 

  #endif				/* ENABLE_PKCS11H_TOKEN || ENABLE_PKCS11H_CERTIFICATE */

 @@ -295,9 +509,6 @@ pkcs11h_certificate_serializeCertificateId (

-	IN const pkcs11h_certificate_id_t certificate_id

+ 	IN const pkcs11h_certificate_id_t certificate_id

  ) {

-	CK_RV rv = CKR_FUNCTION_FAILED;

+ 	CK_RV rv = CKR_FUNCTION_FAILED;

 -	size_t saved_max = 0;

 -	size_t n = 0;

 -	size_t _max = 0;

-

-	/*_PKCS11H_ASSERT (sz!=NULL); Not required */

-	_PKCS11H_ASSERT (max!=NULL);

+ 

+ 	/*_PKCS11H_ASSERT (sz!=NULL); Not required */

+ 	_PKCS11H_ASSERT (max!=NULL);

 @@ -311,42 +522,7 @@ pkcs11h_certificate_serializeCertificateId (

-		(void *)certificate_id

-	);

-

+ 		(void *)certificate_id

+ 	);

+ 

 -	if (sz != NULL) {

 -		saved_max = n = *max;

 -	}

@@ -536,25 +536,25 @@ index ad275f8..1d077e4 100644

 -

 -cleanup:

 +	rv = __generate_pkcs11_uri(sz, max, certificate_id, certificate_id->token_id);

-

-	_PKCS11H_DEBUG (

-		PKCS11H_LOG_DEBUG2,

+ 

+ 	_PKCS11H_DEBUG (

+ 		PKCS11H_LOG_DEBUG2,

 @@ -360,27 +536,16 @@ cleanup:

-	return rv;

+ 	return rv;

  }

-

+ 

 +static

  CK_RV

 -pkcs11h_certificate_deserializeCertificateId (

 -	OUT pkcs11h_certificate_id_t * const p_certificate_id,

 +__pkcs11h_certificate_legacy_deserializeCertificateId (

 +	OUT pkcs11h_certificate_id_t certificate_id,

-	IN const char * const sz

+ 	IN const char * const sz

  ) {

 -	pkcs11h_certificate_id_t certificate_id = NULL;

-	CK_RV rv = CKR_FUNCTION_FAILED;

-	char *p = NULL;

-	char *_sz = NULL;

+ 	CK_RV rv = CKR_FUNCTION_FAILED;

+ 	char *p = NULL;

+ 	char *_sz = NULL;

 -

 -	_PKCS11H_ASSERT (p_certificate_id!=NULL);

 -	_PKCS11H_ASSERT (sz!=NULL);

@@ -568,24 +568,24 @@ index ad275f8..1d077e4 100644

 -		sz

 -	);

 +	size_t id_hex_len;

-

-	if (

-		(rv = _pkcs11h_mem_strdup (

+ 

+ 	if (

+ 		(rv = _pkcs11h_mem_strdup (

 @@ -393,10 +558,6 @@ pkcs11h_certificate_deserializeCertificateId (

-

-	p = _sz;

-

+ 

+ 	p = _sz;

+ 

 -	if ((rv = _pkcs11h_certificate_newCertificateId (&certificate_id)) != CKR_OK) {

 -		goto cleanup;

 -	}

 -

-	if ((p = strrchr (_sz, '/')) == NULL) {

-		rv = CKR_ATTRIBUTE_VALUE_INVALID;

-		goto cleanup;

+ 	if ((p = strrchr (_sz, '/')) == NULL) {

+ 		rv = CKR_ATTRIBUTE_VALUE_INVALID;

+ 		goto cleanup;

 @@ -414,7 +575,12 @@ pkcs11h_certificate_deserializeCertificateId (

-		goto cleanup;

-	}

-

+ 		goto cleanup;

+ 	}

+ 

 -	certificate_id->attrCKA_ID_size = strlen (p)/2;

 +	id_hex_len = strlen (p);

 +	if (id_hex_len & 1) {

@@ -593,13 +593,13 @@ index ad275f8..1d077e4 100644

 +		goto cleanup;

 +	}

 +	certificate_id->attrCKA_ID_size = id_hex_len/2;

-

-	if (

-		(rv = _pkcs11h_mem_malloc (

+ 

+ 	if (

+ 		(rv = _pkcs11h_mem_malloc (

 @@ -430,21 +596,64 @@ pkcs11h_certificate_deserializeCertificateId (

-		goto cleanup;

-	}

-

+ 		goto cleanup;

+ 	}

+ 

 +	rv = CKR_OK;

 +

 +cleanup:

@@ -648,32 +648,32 @@ index ad275f8..1d077e4 100644

 +		goto cleanup;

 +	}

 +

-	*p_certificate_id = certificate_id;

-	certificate_id = NULL;

-	rv = CKR_OK;

-

+ 	*p_certificate_id = certificate_id;

+ 	certificate_id = NULL;

+ 	rv = CKR_OK;

+ 

  cleanup:

 -

-	if (certificate_id != NULL) {

-		pkcs11h_certificate_freeCertificateId (certificate_id);

-		certificate_id = NULL;

-	}

-

+ 	if (certificate_id != NULL) {

+ 		pkcs11h_certificate_freeCertificateId (certificate_id);

+ 		certificate_id = NULL;

+ 	}

+ 

 -	if (_sz != NULL) {

 -		_pkcs11h_mem_free ((void *)&_sz);

 -	}

 -

-	_PKCS11H_DEBUG (

-		PKCS11H_LOG_DEBUG2,

-		"PKCS#11: pkcs11h_certificate_deserializeCertificateId return rv=%lu-'%s'",

+ 	_PKCS11H_DEBUG (

+ 		PKCS11H_LOG_DEBUG2,

+ 		"PKCS#11: pkcs11h_certificate_deserializeCertificateId return rv=%lu-'%s'",

 diff --git a/lib/pkcs11h-util.c b/lib/pkcs11h-util.c

 index 0743fd1..f90e443 100644

 --- a/lib/pkcs11h-util.c

 +++ b/lib/pkcs11h-util.c

 @@ -110,12 +110,7 @@ _pkcs11h_util_hexToBinary (

-		p++;

-	}

-

+ 		p++;

+ 	}

+ 

 -	if (*p != '\x0') {

 -		return CKR_ATTRIBUTE_VALUE_INVALID;

 -	}

@@ -682,5 +682,5 @@ index 0743fd1..f90e443 100644

 -	}

 +	return CKR_OK;

  }

-

+ 

  CK_RV