rv = CERT_VerifyCert(&certhandle, cert, PR_TRUE, certUsageSSLServer,
rv = CERT_VerifyCert(certhandle, cert, PR_TRUE, certUsageSSLServer,
main(int argc, char ** argv){    FORTSignedSWFile * swfile;    int size;    SECItem file;    char *progname = *argv++;    char *filename = NULL;    char *outname = NULL;    char *cp;    int verbose = 0;    int force = 0;    CERTCertDBHandle certhandle = { 0 };    CERTCertificate *cert;    CERTCertTrust *trust;    char * pass;    SECStatus rv;    int i;    SECMODModule *module;    int64 now; /* XXXX */    char *issuer;    char *transport_pass = NULL;    char *user_pass = NULL;    SECItem *outItem = NULL;    PRFileDesc *fd;    PRFileInfo info;    PRStatus prv;       /* put better argument parsing here */    while ((cp = *argv++) != NULL) {	if (*cp == '-') {	    while (*++cp) {		switch (*cp) {		/* verbose mode */		case 'v':		    verbose++;		    break;		/* explicitly set the target */		case 'o':		    outname = *argv++;		    break;		case 'f':		/* skip errors in signatures without prompts */		    force++;		    break;		case 't':		/* provide password on command line */		    transport_pass = *argv++;		    break;		case 'u':		/* provide user password on command line */		    user_pass = *argv++;		    break;		default:		    usage(progname);		    break;		}	    }	} else if (filename) {	    usage(progname);	} else {	    filename = cp;	}    }    if (filename == NULL) usage(progname);    if (outname == NULL) outname = getDefaultTarget();    now = PR_Now();    /* read the file in */     fd = PR_Open(filename,PR_RDONLY,0);    if (fd == NULL) { 	fprintf(stderr,"%s: couldn't open file \"%s\".\n",progname,filename); 	exit(1);    }    prv = PR_GetOpenFileInfo(fd,&info);    if (prv != PR_SUCCESS) {	fprintf(stderr,"%s: couldn't get info on file \"%s\".\n",							progname,filename); 	exit(1);    }    size = info.size;    file.data = malloc(size);    file.len = size;    file.len = PR_Read(fd,file.data,file.len);    if (file.len < 0) { 	fprintf(stderr,"%s: couldn't read file \"%s\".\n",progname, filename); 	exit(1);    }    PR_Close(fd);    /* Parse the file */    swfile = FORT_GetSWFile(&file);    if (swfile == NULL) {	fprintf(stderr,	   "%s: File \"%s\" not a valid FORTEZZA initialization file.\n",		progname,filename);	exit(1);    }    issuer = formatDERIssuer(&swfile->file,&swfile->file.derIssuer);    if (issuer == NULL) {	issuer = "<Invalid Issuer DER>";    }    if (verbose) {	printf("Processing file %s ....\n",filename);	printf("  Version %d\n",DER_GetInteger(&swfile->file.version));	printf("  Issuer: %s\n",issuer);	printf("  Serial Number: ");	for (i=0; i < (int)swfile->file.serialID.len; i++) {	    printf(" %02x",swfile->file.serialID.data[i]);	}	printf("\n");    }    /* Check the Initalization phrase and save Kinit */    if (!transport_pass) {    	pass = SECU_GetPasswordString(NULL,"Enter the Initialization Memphrase:");	transport_pass = pass;    }    rv = FORT_CheckInitPhrase(swfile,transport_pass);    if (rv != SECSuccess) {	fprintf(stderr,		"%s: Invalid Initialization Memphrase for file \"%s\".\n",		progname,filename);	exit(1);    }    /* Check the user or init phrase and save Ks, use Kinit to unwrap the     * remaining data. */    if (!user_pass) {    	pass = SECU_GetPasswordString(NULL,"Enter the User Memphrase or the User PIN:");	user_pass = pass;    }    rv = FORT_CheckUserPhrase(swfile,user_pass);    if (rv != SECSuccess) {	fprintf(stderr,"%s: Invalid User Memphrase or PIN for file \"%s\".\n",		progname,filename);	exit(1);    }    NSS_NoDB_Init(NULL);    sec_SetCheckKRLState(1);    /* now dump the certs into the temparary data base */    for (i=0; swfile->file.slotEntries[i]; i++) {	int trusted = 0;    	SECItem *derCert = FORT_GetDERCert(swfile,			swfile->file.slotEntries[i]->certIndex);	if (derCert == NULL) {	    if (verbose) {	       printf(" Cert %02d: %s \"%s\" \n",		swfile->file.slotEntries[i]->certIndex,			"untrusted", "Couldn't decrypt Cert");	    }	    continue;	}	cert = CERT_NewTempCertificate(&certhandle,derCert, NULL, 							PR_FALSE, PR_TRUE);	if (cert == NULL) {	    if (verbose) {	       printf(" Cert %02d: %s \"%s\" \n",		swfile->file.slotEntries[i]->certIndex,			"untrusted", "Couldn't decode Cert");	    }	    continue;	}	if (swfile->file.slotEntries[i]->trusted.data[0]) {	    /* Add TRUST */	    trust = PORT_ArenaAlloc(cert->arena,sizeof(CERTCertTrust));	    if (trust != NULL) {	        trust->sslFlags = CERTDB_VALID_CA|CERTDB_TRUSTED_CA;	        trust->emailFlags = CERTDB_VALID_CA|CERTDB_TRUSTED_CA;	        trust->objectSigningFlags = CERTDB_VALID_CA|CERTDB_TRUSTED_CA;	        cert->trust = trust;		trusted++;	    }	}	if (verbose) {	    printf(" Cert %02d: %s \"%s\" \n",		swfile->file.slotEntries[i]->certIndex,		trusted?" trusted ":"untrusted",			CERT_NameToAscii(&cert->subject));	}    }    fflush(stdout);    cert = CERT_FindCertByName(&certhandle,&swfile->file.derIssuer);    if (cert == NULL) {	fprintf(stderr,"%s: Couldn't find signer certificate \"%s\".\n",		progname,issuer);	rv = SECFailure;	goto noverify;    }    rv = CERT_VerifySignedData(&swfile->signatureWrap,cert, now, NULL);    if (rv != SECSuccess) {	fprintf(stderr,	  "%s: Couldn't verify the signature on file \"%s\" with certificate \"%s\".\n",		progname,filename,issuer);	goto noverify;    }    rv = CERT_VerifyCert(&certhandle, cert, PR_TRUE, certUsageSSLServer,								now ,NULL,NULL);    /* not an normal cert, see if it's a CA? */    if (rv != SECSuccess) {	rv = CERT_VerifyCert(&certhandle, cert, PR_TRUE, certUsageAnyCA,								now ,NULL,NULL);    }    if (rv != SECSuccess) {	fprintf(stderr,"%s: Couldn't verify the signer certificate \"%s\".\n",		progname,issuer);	goto noverify;    }noverify:    if (rv != SECSuccess) {	if (!force) {	    pass = GetUserInput(	       "Signature verify failed, continue without verification? ");	    if (!(pass && ((*pass == 'Y') || (*pass == 'y')))) {		exit(1);            }	}    }    /* now write out the modified init file for future use */    outItem = FORT_PutSWFile(swfile);    if (outItem == NULL) {	fprintf(stderr,"%s: Couldn't format target init file.\n",		progname);	goto noverify;    }    if (verbose) {	printf("writing modified file out to \"%s\".\n",outname);    }    /* now write it out */    fd = PR_Open(outname,PR_WRONLY|PR_CREATE_FILE|PR_TRUNCATE,0700);    if (fd == NULL) { 	fprintf(stderr,"%s: couldn't open file \"%s\".\n",progname,outname); 	exit(1);    }    file.len = PR_Write(fd,outItem->data,outItem->len);    if (file.len < 0) { 	fprintf(stderr,"%s: couldn't read file \"%s\".\n",progname, filename); 	exit(1);    }    PR_Close(fd);        exit(0);    return (0);}