PORT_FreeArena(arena, PR_FALSE);
pk11_HandleTrustObject(PK11SlotInfo *slot, CERTCertificate *cert, CERTCertTrust *trust){  PRArenaPool *arena;  CK_ATTRIBUTE tobjTemplate[] = {    { CKA_CLASS, NULL, 0 },    { CKA_CERT_SHA1_HASH, NULL, 0 },  };  CK_OBJECT_CLASS tobjc = CKO_NETSCAPE_TRUST;  CK_OBJECT_HANDLE tobjID;  unsigned char sha1_hash[SHA1_LENGTH];  CK_TRUST digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment,    keyAgreement, keyCertSign, crlSign, serverAuth, clientAuth, codeSigning,    emailProtection, ipsecEndSystem, ipsecTunnel, ipsecUser, timeStamping;  SECItem item;  PK11_HashBuf(SEC_OID_SHA1, sha1_hash, cert->derCert.data, cert->derCert.len);  PK11_SETATTRS(&tobjTemplate[0], CKA_CLASS, &tobjc, sizeof(tobjc));  PK11_SETATTRS(&tobjTemplate[1], CKA_CERT_SHA1_HASH, sha1_hash,                 SHA1_LENGTH);  tobjID = pk11_FindObjectByTemplate(slot, tobjTemplate,                                      sizeof(tobjTemplate)/sizeof(tobjTemplate[0]));  if( CK_INVALID_KEY == tobjID ) {    return PR_FALSE;  }  arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);  if( NULL == arena ) return PR_FALSE;  /* Unfortunately, it seems that PK11_GetAttributes doesn't deal   * well with nonexistant attributes.  I guess we have to check    * the trust info fields one at a time.   */  /* We could verify CKA_CERT_HASH here */  /* We could verify CKA_EXPIRES here */  /* "Usage" trust information */  /* digitalSignature = pk11_GetTrustField(slot, arena, tobjID, CKA_TRUST_DIGITAL_SIGNATURE); */  /* nonRepudiation   = pk11_GetTrustField(slot, arena, tobjID, CKA_TRUST_NON_REPUDIATION); */  /* keyEncipherment  = pk11_GetTrustField(slot, arena, tobjID, CKA_TRUST_KEY_ENCIPHERMENT); */  /* dataEncipherment = pk11_GetTrustField(slot, arena, tobjID, CKA_TRUST_DATA_ENCIPHERMENT); */  /* keyAgreement     = pk11_GetTrustField(slot, arena, tobjID, CKA_TRUST_KEY_AGREEMENT); */  /* keyCertSign      = pk11_GetTrustField(slot, arena, tobjID, CKA_TRUST_KEY_CERT_SIGN); */  /* crlSign          = pk11_GetTrustField(slot, arena, tobjID, CKA_TRUST_CRL_SIGN); */  /* "Purpose" trust information */  serverAuth       = pk11_GetTrustField(slot, arena, tobjID, CKA_TRUST_SERVER_AUTH);  /* clientAuth       = pk11_GetTrustField(slot, arena, tobjID, CKA_TRUST_CLIENT_AUTH); */  codeSigning      = pk11_GetTrustField(slot, arena, tobjID, CKA_TRUST_CODE_SIGNING);  emailProtection  = pk11_GetTrustField(slot, arena, tobjID, CKA_TRUST_EMAIL_PROTECTION);  /* ipsecEndSystem   = pk11_GetTrustField(slot, arena, tobjID, CKA_TRUST_IPSEC_END_SYSTEM); */  /* ipsecTunnel      = pk11_GetTrustField(slot, arena, tobjID, CKA_TRUST_IPSEC_TUNNEL); */  /* ipsecUser        = pk11_GetTrustField(slot, arena, tobjID, CKA_TRUST_IPSEC_USER); */  /* timeStamping     = pk11_GetTrustField(slot, arena, tobjID, CKA_TRUST_TIME_STAMPING); */  /* Here's where the fun logic happens.  We have to map back from the key usage,   * extended key usage, purpose, and possibly other trust values into the old   * trust-flags bits.   */  /* First implementation: keep it simple for testing.  We can study what other   * mappings would be appropriate and add them later.. fgmr 20000724 */  if( serverAuth & CKT_NETSCAPE_TRUSTED ) {    trust->sslFlags |= CERTDB_VALID_PEER | CERTDB_TRUSTED;  }  if( serverAuth & CKT_NETSCAPE_TRUSTED_DELEGATOR ) {    trust->sslFlags |= CERTDB_VALID_CA | CERTDB_TRUSTED_CA | CERTDB_NS_TRUSTED_CA;  }  if( emailProtection & CKT_NETSCAPE_TRUSTED ) {    trust->emailFlags |= CERTDB_VALID_PEER | CERTDB_TRUSTED;  }  if( emailProtection & CKT_NETSCAPE_TRUSTED_DELEGATOR ) {    trust->emailFlags |= CERTDB_VALID_CA | CERTDB_TRUSTED_CA | CERTDB_NS_TRUSTED_CA;  }  if( codeSigning & CKT_NETSCAPE_TRUSTED ) {    trust->objectSigningFlags |= CERTDB_VALID_PEER | CERTDB_TRUSTED;  }  if( codeSigning & CKT_NETSCAPE_TRUSTED_DELEGATOR ) {    trust->objectSigningFlags |= CERTDB_VALID_CA | CERTDB_TRUSTED_CA | CERTDB_NS_TRUSTED_CA;  }  /* There's certainly a lot more logic that can go here.. */  return PR_TRUE;}