trustbridge/nss-cmake-static: nss/lib/certhigh/certvfy.c annotate

annotate nss/lib/certhigh/certvfy.c @ 1:247cffdc9b89

Add a pesodo config file for inlcude directories and library names

author	Andre Heinecke <andre.heinecke@intevation.de>
date	Mon, 28 Jul 2014 13:00:06 +0200
parents	1e5118fa0cb1
children

rev	line source
0 1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1 /* This Source Code Form is subject to the terms of the Mozilla Public
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	2 * License, v. 2.0. If a copy of the MPL was not distributed with this
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	4 #include "nspr.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	5 #include "secerr.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	6 #include "secport.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	7 #include "seccomon.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	8 #include "secoid.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	9 #include "sslerr.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	10 #include "genname.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	11 #include "keyhi.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	12 #include "cert.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	13 #include "certdb.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	14 #include "certi.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	15 #include "cryptohi.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	16 #ifndef NSS_DISABLE_LIBPKIX
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	17 #include "pkix.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	18 /#include "pkix_sample_modules.h" /
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	19 #include "pkix_pl_cert.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	20 #endif /* NSS_DISABLE_LIBPKIX */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	21
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	22
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	23 #include "nsspki.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	24 #include "pkitm.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	25 #include "pkim.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	26 #include "pki3hack.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	27 #include "base.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	28
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	29 #ifdef NSS_DISABLE_LIBPKIX
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	30 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	31 cert_VerifyCertChainPkix(
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	32 CERTCertificate *cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	33 PRBool checkSig,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	34 SECCertUsage requiredUsage,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	35 PRTime time,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	36 void *wincx,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	37 CERTVerifyLog *log,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	38 PRBool *pSigerror,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	39 PRBool *pRevoked)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	40 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	41 PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	42 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	43 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	44
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	45 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	46 CERT_SetUsePKIXForValidation(PRBool enable)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	47 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	48 PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	49 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	50 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	51
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	52 PRBool
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	53 CERT_GetUsePKIXForValidation()
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	54 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	55 return PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	56 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	57
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	58 SECStatus CERT_PKIXVerifyCert(
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	59 CERTCertificate *cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	60 SECCertificateUsage usages,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	61 CERTValInParam *paramsIn,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	62 CERTValOutParam *paramsOut,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	63 void *wincx)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	64 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	65 PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	66 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	67 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	68 #endif /* NSS_DISABLE_LIBPKIX */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	69
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	70 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	71 * Check the validity times of a certificate
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	72 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	73 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	74 CERT_CertTimesValid(CERTCertificate *c)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	75 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	76 SECCertTimeValidity valid = CERT_CheckCertValidTimes(c, PR_Now(), PR_TRUE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	77 return (valid == secCertTimeValid) ? SECSuccess : SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	78 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	79
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	80 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	81 * verify the signature of a signed data object with the given DER publickey
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	82 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	83 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	84 CERT_VerifySignedDataWithPublicKey(const CERTSignedData *sd,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	85 SECKEYPublicKey *pubKey,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	86 void *wincx)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	87 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	88 SECStatus rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	89 SECItem sig;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	90 SECOidTag hashAlg = SEC_OID_UNKNOWN;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	91
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	92 if ( !pubKey \|\| !sd ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	93 PORT_SetError(PR_INVALID_ARGUMENT_ERROR);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	94 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	95 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	96
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	97 /* check the signature */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	98 sig = sd->signature;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	99 /* convert sig->len from bit counts to byte count. */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	100 DER_ConvertBitString(&sig);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	101
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	102 rv = VFY_VerifyDataWithAlgorithmID(sd->data.data, sd->data.len, pubKey,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	103 &sig, &sd->signatureAlgorithm, &hashAlg, wincx);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	104 if (rv == SECSuccess) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	105 /* Are we honoring signatures for this algorithm? */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	106 PRUint32 policyFlags = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	107 rv = NSS_GetAlgorithmPolicy(hashAlg, &policyFlags);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	108 if (rv == SECSuccess &&
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	109 !(policyFlags & NSS_USE_ALG_IN_CERT_SIGNATURE)) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	110 PORT_SetError(SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	111 rv = SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	112 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	113 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	114 return rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	115 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	116
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	117 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	118 * verify the signature of a signed data object with the given DER publickey
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	119 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	120 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	121 CERT_VerifySignedDataWithPublicKeyInfo(CERTSignedData *sd,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	122 CERTSubjectPublicKeyInfo *pubKeyInfo,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	123 void *wincx)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	124 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	125 SECKEYPublicKey *pubKey;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	126 SECStatus rv = SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	127
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	128 /* get cert's public key */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	129 pubKey = SECKEY_ExtractPublicKey(pubKeyInfo);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	130 if (pubKey) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	131 rv = CERT_VerifySignedDataWithPublicKey(sd, pubKey, wincx);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	132 SECKEY_DestroyPublicKey(pubKey);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	133 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	134 return rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	135 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	136
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	137 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	138 * verify the signature of a signed data object with the given certificate
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	139 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	140 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	141 CERT_VerifySignedData(CERTSignedData sd, CERTCertificate cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	142 PRTime t, void *wincx)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	143 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	144 SECKEYPublicKey *pubKey = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	145 SECStatus rv = SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	146 SECCertTimeValidity validity;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	147
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	148 /* check the certificate's validity */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	149 validity = CERT_CheckCertValidTimes(cert, t, PR_FALSE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	150 if ( validity != secCertTimeValid ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	151 return rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	152 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	153
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	154 /* get cert's public key */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	155 pubKey = CERT_ExtractPublicKey(cert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	156 if (pubKey) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	157 rv = CERT_VerifySignedDataWithPublicKey(sd, pubKey, wincx);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	158 SECKEY_DestroyPublicKey(pubKey);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	159 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	160 return rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	161 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	162
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	163
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	164 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	165 SEC_CheckCRL(CERTCertDBHandle handle,CERTCertificate cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	166 CERTCertificate caCert, PRTime t, void wincx)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	167 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	168 return CERT_CheckCRL(cert, caCert, NULL, t, wincx);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	169 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	170
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	171 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	172 * Find the issuer of a cert. Use the authorityKeyID if it exists.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	173 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	174 CERTCertificate *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	175 CERT_FindCertIssuer(CERTCertificate *cert, PRTime validTime, SECCertUsage usage)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	176 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	177 NSSCertificate *me;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	178 NSSTime *nssTime;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	179 NSSTrustDomain *td;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	180 NSSCryptoContext *cc;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	181 NSSCertificate *chain[3];
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	182 NSSUsage nssUsage;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	183 PRStatus status;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	184
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	185 me = STAN_GetNSSCertificate(cert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	186 if (!me) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	187 PORT_SetError(SEC_ERROR_NO_MEMORY);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	188 return NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	189 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	190 nssTime = NSSTime_SetPRTime(NULL, validTime);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	191 nssUsage.anyUsage = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	192 nssUsage.nss3usage = usage;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	193 nssUsage.nss3lookingForCA = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	194 memset(chain, 0, 3sizeof(NSSCertificate ));
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	195 td = STAN_GetDefaultTrustDomain();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	196 cc = STAN_GetDefaultCryptoContext();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	197 (void)NSSCertificate_BuildChain(me, nssTime, &nssUsage, NULL,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	198 chain, 2, NULL, &status, td, cc);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	199 nss_ZFreeIf(nssTime);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	200 if (status == PR_SUCCESS) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	201 PORT_Assert(me == chain[0]);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	202 /* if it's a root, the chain will only have one cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	203 if (!chain[1]) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	204 /* already has a reference from the call to BuildChain */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	205 return cert;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	206 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	207 NSSCertificate_Destroy(chain[0]); /* the first cert in the chain */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	208 return STAN_GetCERTCertificate(chain[1]); /* return the 2nd */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	209 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	210 if (chain[0]) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	211 PORT_Assert(me == chain[0]);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	212 NSSCertificate_Destroy(chain[0]); /* the first cert in the chain */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	213 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	214 PORT_SetError (SEC_ERROR_UNKNOWN_ISSUER);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	215 return NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	216 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	217
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	218 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	219 * return required trust flags for various cert usages for CAs
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	220 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	221 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	222 CERT_TrustFlagsForCACertUsage(SECCertUsage usage,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	223 unsigned int *retFlags,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	224 SECTrustType *retTrustType)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	225 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	226 unsigned int requiredFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	227 SECTrustType trustType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	228
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	229 switch ( usage ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	230 case certUsageSSLClient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	231 requiredFlags = CERTDB_TRUSTED_CLIENT_CA;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	232 trustType = trustSSL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	233 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	234 case certUsageSSLServer:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	235 case certUsageSSLCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	236 requiredFlags = CERTDB_TRUSTED_CA;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	237 trustType = trustSSL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	238 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	239 case certUsageSSLServerWithStepUp:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	240 requiredFlags = CERTDB_TRUSTED_CA \| CERTDB_GOVT_APPROVED_CA;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	241 trustType = trustSSL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	242 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	243 case certUsageEmailSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	244 case certUsageEmailRecipient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	245 requiredFlags = CERTDB_TRUSTED_CA;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	246 trustType = trustEmail;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	247 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	248 case certUsageObjectSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	249 requiredFlags = CERTDB_TRUSTED_CA;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	250 trustType = trustObjectSigning;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	251 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	252 case certUsageVerifyCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	253 case certUsageAnyCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	254 case certUsageStatusResponder:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	255 requiredFlags = CERTDB_TRUSTED_CA;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	256 trustType = trustTypeNone;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	257 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	258 default:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	259 PORT_Assert(0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	260 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	261 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	262 if ( retFlags != NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	263 *retFlags = requiredFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	264 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	265 if ( retTrustType != NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	266 *retTrustType = trustType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	267 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	268
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	269 return(SECSuccess);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	270 loser:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	271 return(SECFailure);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	272 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	273
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	274 void
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	275 cert_AddToVerifyLog(CERTVerifyLog log, CERTCertificate cert, long error,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	276 unsigned int depth, void *arg)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	277 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	278 CERTVerifyLogNode node, tnode;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	279
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	280 PORT_Assert(log != NULL);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	281
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	282 node = (CERTVerifyLogNode *)PORT_ArenaAlloc(log->arena,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	283 sizeof(CERTVerifyLogNode));
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	284 if ( node != NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	285 node->cert = CERT_DupCertificate(cert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	286 node->error = error;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	287 node->depth = depth;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	288 node->arg = arg;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	289
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	290 if ( log->tail == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	291 /* empty list */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	292 log->head = log->tail = node;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	293 node->prev = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	294 node->next = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	295 } else if ( depth >= log->tail->depth ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	296 /* add to tail */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	297 node->prev = log->tail;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	298 log->tail->next = node;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	299 log->tail = node;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	300 node->next = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	301 } else if ( depth < log->head->depth ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	302 /* add at head */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	303 node->prev = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	304 node->next = log->head;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	305 log->head->prev = node;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	306 log->head = node;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	307 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	308 /* add in middle */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	309 tnode = log->tail;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	310 while ( tnode != NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	311 if ( depth >= tnode->depth ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	312 /* insert after tnode */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	313 node->prev = tnode;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	314 node->next = tnode->next;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	315 tnode->next->prev = node;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	316 tnode->next = node;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	317 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	318 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	319
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	320 tnode = tnode->prev;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	321 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	322 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	323
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	324 log->count++;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	325 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	326 return;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	327 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	328
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	329 #define EXIT_IF_NOT_LOGGING(log) \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	330 if ( log == NULL ) { \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	331 goto loser; \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	332 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	333
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	334 #define LOG_ERROR_OR_EXIT(log,cert,depth,arg) \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	335 if ( log != NULL ) { \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	336 cert_AddToVerifyLog(log, cert, PORT_GetError(), depth, \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	337 (void *)(PRWord)arg); \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	338 } else { \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	339 goto loser; \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	340 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	341
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	342 #define LOG_ERROR(log,cert,depth,arg) \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	343 if ( log != NULL ) { \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	344 cert_AddToVerifyLog(log, cert, PORT_GetError(), depth, \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	345 (void *)(PRWord)arg); \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	346 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	347
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	348 static SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	349 cert_VerifyCertChainOld(CERTCertDBHandle handle, CERTCertificate cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	350 PRBool checkSig, PRBool* sigerror,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	351 SECCertUsage certUsage, PRTime t, void *wincx,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	352 CERTVerifyLog log, PRBool revoked)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	353 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	354 SECTrustType trustType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	355 CERTBasicConstraints basicConstraint;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	356 CERTCertificate *issuerCert = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	357 CERTCertificate *subjectCert = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	358 CERTCertificate *badCert = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	359 PRBool isca;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	360 SECStatus rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	361 SECStatus rvFinal = SECSuccess;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	362 int count;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	363 int currentPathLen = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	364 int pathLengthLimit = CERT_UNLIMITED_PATH_CONSTRAINT;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	365 unsigned int caCertType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	366 unsigned int requiredCAKeyUsage;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	367 unsigned int requiredFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	368 PLArenaPool *arena = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	369 CERTGeneralName *namesList = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	370 CERTCertificate **certsList = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	371 int certsListLen = 16;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	372 int namesCount = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	373 PRBool subjectCertIsSelfIssued;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	374 CERTCertTrust issuerTrust;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	375
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	376 if (revoked) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	377 *revoked = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	378 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	379
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	380 if (CERT_KeyUsageAndTypeForCertUsage(certUsage, PR_TRUE,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	381 &requiredCAKeyUsage,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	382 &caCertType)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	383 != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	384 PORT_Assert(0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	385 EXIT_IF_NOT_LOGGING(log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	386 requiredCAKeyUsage = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	387 caCertType = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	388 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	389
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	390 switch ( certUsage ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	391 case certUsageSSLClient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	392 case certUsageSSLServer:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	393 case certUsageSSLCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	394 case certUsageSSLServerWithStepUp:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	395 case certUsageEmailSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	396 case certUsageEmailRecipient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	397 case certUsageObjectSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	398 case certUsageVerifyCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	399 case certUsageAnyCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	400 case certUsageStatusResponder:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	401 if ( CERT_TrustFlagsForCACertUsage(certUsage, &requiredFlags,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	402 &trustType) != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	403 PORT_Assert(0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	404 EXIT_IF_NOT_LOGGING(log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	405 /* XXX continuing with requiredFlags = 0 seems wrong. It'll
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	406 * cause the following test to be true incorrectly:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	407 * flags = SEC_GET_TRUST_FLAGS(issuerCert->trust, trustType);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	408 * if (( flags & requiredFlags ) == requiredFlags) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	409 * rv = rvFinal;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	410 * goto done;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	411 * }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	412 * There are three other instances of this problem.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	413 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	414 requiredFlags = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	415 trustType = trustSSL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	416 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	417 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	418 default:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	419 PORT_Assert(0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	420 EXIT_IF_NOT_LOGGING(log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	421 requiredFlags = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	422 trustType = trustSSL;/* This used to be 0, but we need something
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	423 * that matches the enumeration type.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	424 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	425 caCertType = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	426 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	427
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	428 subjectCert = CERT_DupCertificate(cert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	429 if ( subjectCert == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	430 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	431 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	432
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	433 arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	434 if (arena == NULL) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	435 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	436 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	437
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	438 certsList = PORT_ZNewArray(CERTCertificate *, certsListLen);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	439 if (certsList == NULL)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	440 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	441
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	442 /* RFC 3280 says that the name constraints will apply to the names
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	443 ** in the leaf (EE) cert, whether it is self issued or not, so
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	444 ** we pretend that it is not.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	445 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	446 subjectCertIsSelfIssued = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	447 for ( count = 0; count < CERT_MAX_CERT_CHAIN; count++ ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	448 PRBool validCAOverride = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	449
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	450 /* Construct a list of names for the current and all previous
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	451 * certifcates (except leaf (EE) certs, root CAs, and self-issued
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	452 * intermediate CAs) to be verified against the name constraints
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	453 * extension of the issuer certificate.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	454 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	455 if (subjectCertIsSelfIssued == PR_FALSE) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	456 CERTGeneralName *subjectNameList;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	457 int subjectNameListLen;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	458 int i;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	459 PRBool getSubjectCN = (!count && certUsage == certUsageSSLServer);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	460 subjectNameList =
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	461 CERT_GetConstrainedCertificateNames(subjectCert, arena,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	462 getSubjectCN);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	463 if (!subjectNameList)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	464 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	465 subjectNameListLen = CERT_GetNamesLength(subjectNameList);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	466 if (!subjectNameListLen)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	467 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	468 if (certsListLen <= namesCount + subjectNameListLen) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	469 CERTCertificate **tmpCertsList;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	470 certsListLen = (namesCount + subjectNameListLen) * 2;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	471 tmpCertsList =
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	472 (CERTCertificate **)PORT_Realloc(certsList,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	473 certsListLen * sizeof(CERTCertificate *));
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	474 if (tmpCertsList == NULL) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	475 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	476 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	477 certsList = tmpCertsList;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	478 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	479 for (i = 0; i < subjectNameListLen; i++) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	480 certsList[namesCount + i] = subjectCert;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	481 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	482 namesCount += subjectNameListLen;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	483 namesList = cert_CombineNamesLists(namesList, subjectNameList);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	484 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	485
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	486 /* check if the cert has an unsupported critical extension */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	487 if ( subjectCert->options.bits.hasUnsupportedCriticalExt ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	488 PORT_SetError(SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	489 LOG_ERROR_OR_EXIT(log,subjectCert,count,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	490 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	491
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	492 /* find the certificate of the issuer */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	493 issuerCert = CERT_FindCertIssuer(subjectCert, t, certUsage);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	494 if ( ! issuerCert ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	495 PORT_SetError(SEC_ERROR_UNKNOWN_ISSUER);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	496 LOG_ERROR(log,subjectCert,count,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	497 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	498 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	499
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	500 /* verify the signature on the cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	501 if ( checkSig ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	502 rv = CERT_VerifySignedData(&subjectCert->signatureWrap,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	503 issuerCert, t, wincx);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	504
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	505 if ( rv != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	506 if (sigerror) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	507 *sigerror = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	508 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	509 if ( PORT_GetError() == SEC_ERROR_EXPIRED_CERTIFICATE ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	510 PORT_SetError(SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	511 LOG_ERROR_OR_EXIT(log,issuerCert,count+1,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	512 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	513 if (PORT_GetError() !=
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	514 SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	515 PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	516 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	517 LOG_ERROR_OR_EXIT(log,subjectCert,count,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	518 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	519 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	520 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	521
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	522 /* If the basicConstraint extension is included in an immediate CA
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	523 * certificate, make sure that the isCA flag is on. If the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	524 * pathLenConstraint component exists, it must be greater than the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	525 * number of CA certificates we have seen so far. If the extension
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	526 * is omitted, we will assume that this is a CA certificate with
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	527 * an unlimited pathLenConstraint (since it already passes the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	528 * netscape-cert-type extension checking).
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	529 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	530
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	531 rv = CERT_FindBasicConstraintExten(issuerCert, &basicConstraint);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	532 if ( rv != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	533 if (PORT_GetError() != SEC_ERROR_EXTENSION_NOT_FOUND) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	534 LOG_ERROR_OR_EXIT(log,issuerCert,count+1,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	535 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	536 pathLengthLimit = CERT_UNLIMITED_PATH_CONSTRAINT;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	537 /* no basic constraints found, we aren't (yet) a CA. */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	538 isca = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	539 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	540 if ( basicConstraint.isCA == PR_FALSE ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	541 PORT_SetError (SEC_ERROR_CA_CERT_INVALID);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	542 LOG_ERROR_OR_EXIT(log,issuerCert,count+1,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	543 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	544 pathLengthLimit = basicConstraint.pathLenConstraint;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	545 isca = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	546 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	547 /* make sure that the path len constraint is properly set.*/
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	548 if (pathLengthLimit >= 0 && currentPathLen > pathLengthLimit) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	549 PORT_SetError (SEC_ERROR_PATH_LEN_CONSTRAINT_INVALID);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	550 LOG_ERROR_OR_EXIT(log, issuerCert, count+1, pathLengthLimit);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	551 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	552
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	553 /* make sure that the entire chain is within the name space of the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	554 * current issuer certificate.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	555 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	556 rv = CERT_CompareNameSpace(issuerCert, namesList, certsList,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	557 arena, &badCert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	558 if (rv != SECSuccess \|\| badCert != NULL) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	559 PORT_SetError(SEC_ERROR_CERT_NOT_IN_NAME_SPACE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	560 LOG_ERROR_OR_EXIT(log, badCert, count + 1, 0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	561 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	562 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	563
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	564 /* XXX - the error logging may need to go down into CRL stuff at some
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	565 * point
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	566 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	567 /* check revoked list (issuer) */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	568 rv = SEC_CheckCRL(handle, subjectCert, issuerCert, t, wincx);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	569 if (rv == SECFailure) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	570 if (revoked) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	571 *revoked = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	572 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	573 LOG_ERROR_OR_EXIT(log,subjectCert,count,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	574 } else if (rv == SECWouldBlock) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	575 /* We found something fishy, so we intend to issue an
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	576 * error to the user, but the user may wish to continue
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	577 * processing, in which case we better make sure nothing
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	578 * worse has happened... so keep cranking the loop */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	579 rvFinal = SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	580 if (revoked) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	581 *revoked = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	582 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	583 LOG_ERROR(log,subjectCert,count,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	584 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	585
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	586 if ( CERT_GetCertTrust(issuerCert, &issuerTrust) == SECSuccess) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	587 /* we have some trust info, but this does NOT imply that this
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	588 * cert is actually trusted for any purpose. The cert may be
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	589 * explicitly UNtrusted. We won't know until we examine the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	590 * trust bits.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	591 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	592 unsigned int flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	593
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	594 if (certUsage != certUsageAnyCA &&
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	595 certUsage != certUsageStatusResponder) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	596
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	597 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	598 * XXX This choice of trustType seems arbitrary.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	599 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	600 if ( certUsage == certUsageVerifyCA ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	601 if ( subjectCert->nsCertType & NS_CERT_TYPE_EMAIL_CA ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	602 trustType = trustEmail;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	603 } else if ( subjectCert->nsCertType & NS_CERT_TYPE_SSL_CA ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	604 trustType = trustSSL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	605 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	606 trustType = trustObjectSigning;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	607 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	608 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	609
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	610 flags = SEC_GET_TRUST_FLAGS(&issuerTrust, trustType);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	611 if (( flags & requiredFlags ) == requiredFlags) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	612 /* we found a trusted one, so return */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	613 rv = rvFinal;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	614 goto done;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	615 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	616 if (flags & CERTDB_VALID_CA) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	617 validCAOverride = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	618 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	619 /* is it explicitly distrusted? */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	620 if ((flags & CERTDB_TERMINAL_RECORD) &&
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	621 ((flags & (CERTDB_TRUSTED\|CERTDB_TRUSTED_CA)) == 0)) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	622 /* untrusted -- the cert is explicitly untrusted, not
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	623 * just that it doesn't chain to a trusted cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	624 PORT_SetError(SEC_ERROR_UNTRUSTED_ISSUER);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	625 LOG_ERROR_OR_EXIT(log,issuerCert,count+1,flags);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	626 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	627 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	628 /* Check if we have any valid trust when cheching for
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	629 * certUsageAnyCA or certUsageStatusResponder. */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	630 for (trustType = trustSSL; trustType < trustTypeNone;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	631 trustType++) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	632 flags = SEC_GET_TRUST_FLAGS(&issuerTrust, trustType);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	633 if ((flags & requiredFlags) == requiredFlags) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	634 rv = rvFinal;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	635 goto done;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	636 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	637 if (flags & CERTDB_VALID_CA)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	638 validCAOverride = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	639 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	640 /* We have 2 separate loops because we want any single trust
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	641 * bit to allow this usage to return trusted. Only if none of
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	642 * the trust bits are on do we check to see if the cert is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	643 * untrusted */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	644 for (trustType = trustSSL; trustType < trustTypeNone;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	645 trustType++) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	646 flags = SEC_GET_TRUST_FLAGS(&issuerTrust, trustType);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	647 /* is it explicitly distrusted? */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	648 if ((flags & CERTDB_TERMINAL_RECORD) &&
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	649 ((flags & (CERTDB_TRUSTED\|CERTDB_TRUSTED_CA)) == 0)) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	650 /* untrusted -- the cert is explicitly untrusted, not
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	651 * just that it doesn't chain to a trusted cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	652 PORT_SetError(SEC_ERROR_UNTRUSTED_ISSUER);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	653 LOG_ERROR_OR_EXIT(log,issuerCert,count+1,flags);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	654 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	655 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	656 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	657 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	658
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	659 if (!validCAOverride) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	660 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	661 * Make sure that if this is an intermediate CA in the chain that
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	662 * it was given permission by its signer to be a CA.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	663 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	664 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	665 * if basicConstraints says it is a ca, then we check the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	666 * nsCertType. If the nsCertType has any CA bits set, then
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	667 * it must have the right one.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	668 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	669 if (!isca \|\| (issuerCert->nsCertType & NS_CERT_TYPE_CA)) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	670 isca = (issuerCert->nsCertType & caCertType) ? PR_TRUE : PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	671 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	672
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	673 if ( !isca ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	674 PORT_SetError(SEC_ERROR_CA_CERT_INVALID);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	675 LOG_ERROR_OR_EXIT(log,issuerCert,count+1,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	676 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	677
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	678 /* make sure key usage allows cert signing */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	679 if (CERT_CheckKeyUsage(issuerCert, requiredCAKeyUsage) != SECSuccess) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	680 PORT_SetError(SEC_ERROR_INADEQUATE_KEY_USAGE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	681 LOG_ERROR_OR_EXIT(log,issuerCert,count+1,requiredCAKeyUsage);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	682 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	683 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	684
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	685 /* make sure that the issuer is not self signed. If it is, then
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	686 * stop here to prevent looping.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	687 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	688 if (issuerCert->isRoot) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	689 PORT_SetError(SEC_ERROR_UNTRUSTED_ISSUER);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	690 LOG_ERROR(log, issuerCert, count+1, 0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	691 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	692 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	693 /* The issuer cert will be the subject cert in the next loop.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	694 * A cert is self-issued if its subject and issuer are equal and
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	695 * both are of non-zero length.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	696 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	697 subjectCertIsSelfIssued = (PRBool)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	698 SECITEM_ItemsAreEqual(&issuerCert->derIssuer,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	699 &issuerCert->derSubject) &&
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	700 issuerCert->derSubject.len > 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	701 if (subjectCertIsSelfIssued == PR_FALSE) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	702 /* RFC 3280 says only non-self-issued intermediate CA certs
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	703 * count in path length.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	704 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	705 ++currentPathLen;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	706 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	707
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	708 CERT_DestroyCertificate(subjectCert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	709 subjectCert = issuerCert;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	710 issuerCert = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	711 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	712
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	713 PORT_SetError(SEC_ERROR_UNKNOWN_ISSUER);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	714 LOG_ERROR(log,subjectCert,count,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	715 loser:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	716 rv = SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	717 done:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	718 if (certsList != NULL) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	719 PORT_Free(certsList);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	720 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	721 if ( issuerCert ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	722 CERT_DestroyCertificate(issuerCert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	723 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	724
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	725 if ( subjectCert ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	726 CERT_DestroyCertificate(subjectCert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	727 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	728
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	729 if ( arena != NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	730 PORT_FreeArena(arena, PR_FALSE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	731 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	732 return rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	733 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	734
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	735 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	736 cert_VerifyCertChain(CERTCertDBHandle handle, CERTCertificate cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	737 PRBool checkSig, PRBool* sigerror,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	738 SECCertUsage certUsage, PRTime t, void *wincx,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	739 CERTVerifyLog log, PRBool revoked)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	740 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	741 if (CERT_GetUsePKIXForValidation()) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	742 return cert_VerifyCertChainPkix(cert, checkSig, certUsage, t,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	743 wincx, log, sigerror, revoked);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	744 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	745 return cert_VerifyCertChainOld(handle, cert, checkSig, sigerror,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	746 certUsage, t, wincx, log, revoked);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	747 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	748
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	749 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	750 CERT_VerifyCertChain(CERTCertDBHandle handle, CERTCertificate cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	751 PRBool checkSig, SECCertUsage certUsage, PRTime t,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	752 void wincx, CERTVerifyLog log)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	753 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	754 return cert_VerifyCertChain(handle, cert, checkSig, NULL, certUsage, t,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	755 wincx, log, NULL);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	756 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	757
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	758 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	759 * verify that a CA can sign a certificate with the requested usage.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	760 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	761 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	762 CERT_VerifyCACertForUsage(CERTCertDBHandle handle, CERTCertificate cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	763 PRBool checkSig, SECCertUsage certUsage, PRTime t,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	764 void wincx, CERTVerifyLog log)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	765 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	766 SECTrustType trustType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	767 CERTBasicConstraints basicConstraint;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	768 PRBool isca;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	769 PRBool validCAOverride = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	770 SECStatus rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	771 SECStatus rvFinal = SECSuccess;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	772 unsigned int flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	773 unsigned int caCertType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	774 unsigned int requiredCAKeyUsage;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	775 unsigned int requiredFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	776 CERTCertificate *issuerCert;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	777 CERTCertTrust certTrust;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	778
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	779
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	780 if (CERT_KeyUsageAndTypeForCertUsage(certUsage, PR_TRUE,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	781 &requiredCAKeyUsage,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	782 &caCertType) != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	783 PORT_Assert(0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	784 EXIT_IF_NOT_LOGGING(log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	785 requiredCAKeyUsage = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	786 caCertType = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	787 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	788
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	789 switch ( certUsage ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	790 case certUsageSSLClient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	791 case certUsageSSLServer:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	792 case certUsageSSLCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	793 case certUsageSSLServerWithStepUp:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	794 case certUsageEmailSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	795 case certUsageEmailRecipient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	796 case certUsageObjectSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	797 case certUsageVerifyCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	798 case certUsageStatusResponder:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	799 if ( CERT_TrustFlagsForCACertUsage(certUsage, &requiredFlags,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	800 &trustType) != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	801 PORT_Assert(0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	802 EXIT_IF_NOT_LOGGING(log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	803 requiredFlags = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	804 trustType = trustSSL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	805 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	806 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	807 default:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	808 PORT_Assert(0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	809 EXIT_IF_NOT_LOGGING(log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	810 requiredFlags = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	811 trustType = trustSSL;/* This used to be 0, but we need something
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	812 * that matches the enumeration type.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	813 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	814 caCertType = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	815 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	816
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	817 /* If the basicConstraint extension is included in an intermmediate CA
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	818 * certificate, make sure that the isCA flag is on. If the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	819 * pathLenConstraint component exists, it must be greater than the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	820 * number of CA certificates we have seen so far. If the extension
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	821 * is omitted, we will assume that this is a CA certificate with
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	822 * an unlimited pathLenConstraint (since it already passes the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	823 * netscape-cert-type extension checking).
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	824 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	825
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	826 rv = CERT_FindBasicConstraintExten(cert, &basicConstraint);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	827 if ( rv != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	828 if (PORT_GetError() != SEC_ERROR_EXTENSION_NOT_FOUND) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	829 LOG_ERROR_OR_EXIT(log,cert,0,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	830 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	831 /* no basic constraints found, we aren't (yet) a CA. */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	832 isca = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	833 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	834 if ( basicConstraint.isCA == PR_FALSE ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	835 PORT_SetError (SEC_ERROR_CA_CERT_INVALID);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	836 LOG_ERROR_OR_EXIT(log,cert,0,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	837 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	838
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	839 /* can't check path length if we don't know the previous path */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	840 isca = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	841 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	842
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	843 if ( CERT_GetCertTrust(cert, &certTrust) == SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	844 /* we have some trust info, but this does NOT imply that this
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	845 * cert is actually trusted for any purpose. The cert may be
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	846 * explicitly UNtrusted. We won't know until we examine the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	847 * trust bits.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	848 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	849 if (certUsage == certUsageStatusResponder) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	850 /* Check the special case of certUsageStatusResponder */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	851 issuerCert = CERT_FindCertIssuer(cert, t, certUsage);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	852 if (issuerCert) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	853 if (SEC_CheckCRL(handle, cert, issuerCert, t, wincx)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	854 != SECSuccess) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	855 PORT_SetError(SEC_ERROR_REVOKED_CERTIFICATE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	856 CERT_DestroyCertificate(issuerCert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	857 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	858 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	859 CERT_DestroyCertificate(issuerCert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	860 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	861 /* XXX We have NOT determined that this cert is trusted.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	862 * For years, NSS has treated this as trusted,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	863 * but it seems incorrect.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	864 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	865 rv = rvFinal;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	866 goto done;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	867 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	868
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	869 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	870 * check the trust params of the issuer
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	871 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	872 flags = SEC_GET_TRUST_FLAGS(&certTrust, trustType);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	873 if ( ( flags & requiredFlags ) == requiredFlags) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	874 /* we found a trusted one, so return */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	875 rv = rvFinal;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	876 goto done;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	877 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	878 if (flags & CERTDB_VALID_CA) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	879 validCAOverride = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	880 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	881 /* is it explicitly distrusted? */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	882 if ((flags & CERTDB_TERMINAL_RECORD) &&
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	883 ((flags & (CERTDB_TRUSTED\|CERTDB_TRUSTED_CA)) == 0)) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	884 /* untrusted -- the cert is explicitly untrusted, not
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	885 * just that it doesn't chain to a trusted cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	886 PORT_SetError(SEC_ERROR_UNTRUSTED_CERT);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	887 LOG_ERROR_OR_EXIT(log,cert,0,flags);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	888 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	889 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	890 if (!validCAOverride) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	891 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	892 * Make sure that if this is an intermediate CA in the chain that
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	893 * it was given permission by its signer to be a CA.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	894 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	895 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	896 * if basicConstraints says it is a ca, then we check the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	897 * nsCertType. If the nsCertType has any CA bits set, then
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	898 * it must have the right one.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	899 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	900 if (!isca \|\| (cert->nsCertType & NS_CERT_TYPE_CA)) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	901 isca = (cert->nsCertType & caCertType) ? PR_TRUE : PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	902 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	903
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	904 if (!isca) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	905 PORT_SetError(SEC_ERROR_CA_CERT_INVALID);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	906 LOG_ERROR_OR_EXIT(log,cert,0,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	907 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	908
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	909 /* make sure key usage allows cert signing */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	910 if (CERT_CheckKeyUsage(cert, requiredCAKeyUsage) != SECSuccess) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	911 PORT_SetError(SEC_ERROR_INADEQUATE_KEY_USAGE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	912 LOG_ERROR_OR_EXIT(log,cert,0,requiredCAKeyUsage);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	913 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	914 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	915 /* make sure that the issuer is not self signed. If it is, then
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	916 * stop here to prevent looping.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	917 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	918 if (cert->isRoot) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	919 PORT_SetError(SEC_ERROR_UNTRUSTED_ISSUER);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	920 LOG_ERROR(log, cert, 0, 0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	921 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	922 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	923
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	924 return CERT_VerifyCertChain(handle, cert, checkSig, certUsage, t,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	925 wincx, log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	926 loser:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	927 rv = SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	928 done:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	929 return rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	930 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	931
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	932 #define NEXT_USAGE() { \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	933 i*=2; \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	934 certUsage++; \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	935 continue; \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	936 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	937
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	938 #define VALID_USAGE() { \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	939 NEXT_USAGE(); \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	940 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	941
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	942 #define INVALID_USAGE() { \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	943 if (returnedUsages) { \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	944 *returnedUsages &= (~i); \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	945 } \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	946 if (PR_TRUE == requiredUsage) { \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	947 valid = SECFailure; \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	948 } \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	949 NEXT_USAGE(); \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	950 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	951
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	952 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	953 * check the leaf cert against trust and usage.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	954 * returns success if the cert is not distrusted. If the cert is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	955 * trusted, then the trusted bool will be true.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	956 * returns failure if the cert is distrusted. If failure, flags
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	957 * will return the flag bits that indicated distrust.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	958 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	959 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	960 cert_CheckLeafTrust(CERTCertificate *cert, SECCertUsage certUsage,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	961 unsigned int failedFlags, PRBool trusted)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	962 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	963 unsigned int flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	964 CERTCertTrust trust;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	965
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	966 *failedFlags = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	967 *trusted = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	968
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	969 /* check trust flags to see if this cert is directly trusted */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	970 if ( CERT_GetCertTrust(cert, &trust) == SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	971 switch ( certUsage ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	972 case certUsageSSLClient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	973 case certUsageSSLServer:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	974 flags = trust.sslFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	975
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	976 /* is the cert directly trusted or not trusted ? */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	977 if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	978 * authoritative */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	979 if ( flags & CERTDB_TRUSTED ) { /* trust this cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	980 *trusted = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	981 return SECSuccess;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	982 } else { /* don't trust this cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	983 *failedFlags = flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	984 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	985 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	986 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	987 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	988 case certUsageSSLServerWithStepUp:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	989 /* XXX - step up certs can't be directly trusted, only distrust */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	990 flags = trust.sslFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	991 if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	992 * authoritative */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	993 if (( flags & CERTDB_TRUSTED ) == 0) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	994 /* don't trust this cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	995 *failedFlags = flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	996 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	997 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	998 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	999 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1000 case certUsageSSLCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1001 flags = trust.sslFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1002 if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1003 * authoritative */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1004 if (( flags & (CERTDB_TRUSTED\|CERTDB_TRUSTED_CA) ) == 0) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1005 /* don't trust this cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1006 *failedFlags = flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1007 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1008 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1009 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1010 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1011 case certUsageEmailSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1012 case certUsageEmailRecipient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1013 flags = trust.emailFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1014 if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1015 * authoritative */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1016 if ( flags & CERTDB_TRUSTED ) { /* trust this cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1017 *trusted = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1018 return SECSuccess;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1019 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1020 else { /* don't trust this cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1021 *failedFlags = flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1022 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1023 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1024 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1025
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1026 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1027 case certUsageObjectSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1028 flags = trust.objectSigningFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1029
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1030 if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1031 * authoritative */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1032 if ( flags & CERTDB_TRUSTED ) { /* trust this cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1033 *trusted = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1034 return SECSuccess;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1035 } else { /* don't trust this cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1036 *failedFlags = flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1037 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1038 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1039 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1040 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1041 case certUsageVerifyCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1042 case certUsageStatusResponder:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1043 flags = trust.sslFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1044 /* is the cert directly trusted or not trusted ? */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1045 if ( ( flags & ( CERTDB_VALID_CA \| CERTDB_TRUSTED_CA ) ) ==
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1046 ( CERTDB_VALID_CA \| CERTDB_TRUSTED_CA ) ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1047 *trusted = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1048 return SECSuccess;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1049 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1050 flags = trust.emailFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1051 /* is the cert directly trusted or not trusted ? */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1052 if ( ( flags & ( CERTDB_VALID_CA \| CERTDB_TRUSTED_CA ) ) ==
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1053 ( CERTDB_VALID_CA \| CERTDB_TRUSTED_CA ) ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1054 *trusted = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1055 return SECSuccess;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1056 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1057 flags = trust.objectSigningFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1058 /* is the cert directly trusted or not trusted ? */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1059 if ( ( flags & ( CERTDB_VALID_CA \| CERTDB_TRUSTED_CA ) ) ==
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1060 ( CERTDB_VALID_CA \| CERTDB_TRUSTED_CA ) ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1061 *trusted = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1062 return SECSuccess;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1063 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1064 /* fall through to test distrust */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1065 case certUsageAnyCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1066 case certUsageUserCertImport:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1067 /* do we distrust these certs explicitly */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1068 flags = trust.sslFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1069 if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1070 * authoritative */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1071 if ((flags & (CERTDB_TRUSTED\|CERTDB_TRUSTED_CA)) == 0) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1072 *failedFlags = flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1073 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1074 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1075 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1076 flags = trust.emailFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1077 if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1078 * authoritative */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1079 if ((flags & (CERTDB_TRUSTED\|CERTDB_TRUSTED_CA)) == 0) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1080 *failedFlags = flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1081 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1082 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1083 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1084 /* fall through */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1085 case certUsageProtectedObjectSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1086 flags = trust.objectSigningFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1087 if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1088 * authoritative */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1089 if ((flags & (CERTDB_TRUSTED\|CERTDB_TRUSTED_CA)) == 0) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1090 *failedFlags = flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1091 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1092 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1093 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1094 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1095 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1096 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1097 return SECSuccess;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1098 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1099
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1100 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1101 * verify a certificate by checking if it's valid and that we
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1102 * trust the issuer.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1103 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1104 * certificateUsage contains a bitfield of all cert usages that are
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1105 * required for verification to succeed
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1106 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1107 * a bitfield of cert usages is returned in *returnedUsages
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1108 * if requiredUsages is non-zero, the returned bitmap is only
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1109 * for those required usages, otherwise it is for all usages
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1110 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1111 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1112 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1113 CERT_VerifyCertificate(CERTCertDBHandle handle, CERTCertificate cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1114 PRBool checkSig, SECCertificateUsage requiredUsages, PRTime t,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1115 void wincx, CERTVerifyLog log, SECCertificateUsage* returnedUsages)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1116 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1117 SECStatus rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1118 SECStatus valid;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1119 unsigned int requiredKeyUsage;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1120 unsigned int requiredCertType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1121 unsigned int flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1122 unsigned int certType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1123 PRBool allowOverride;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1124 SECCertTimeValidity validity;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1125 CERTStatusConfig *statusConfig;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1126 PRInt32 i;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1127 SECCertUsage certUsage = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1128 PRBool checkedOCSP = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1129 PRBool checkAllUsages = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1130 PRBool revoked = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1131 PRBool sigerror = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1132 PRBool trusted = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1133
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1134 if (!requiredUsages) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1135 /* there are no required usages, so the user probably wants to
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1136 get status for all usages */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1137 checkAllUsages = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1138 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1139
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1140 if (returnedUsages) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1141 *returnedUsages = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1142 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1143 /* we don't have a place to return status for all usages,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1144 so we can skip checks for usages that aren't required */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1145 checkAllUsages = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1146 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1147 valid = SECSuccess ; /* start off assuming cert is valid */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1148
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1149 /* make sure that the cert is valid at time t */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1150 allowOverride = (PRBool)((requiredUsages & certificateUsageSSLServer) \|\|
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1151 (requiredUsages & certificateUsageSSLServerWithStepUp));
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1152 validity = CERT_CheckCertValidTimes(cert, t, allowOverride);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1153 if ( validity != secCertTimeValid ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1154 valid = SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1155 LOG_ERROR_OR_EXIT(log,cert,0,validity);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1156 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1157
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1158 /* check key usage and netscape cert type */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1159 cert_GetCertType(cert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1160 certType = cert->nsCertType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1161
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1162 for (i=1; i<=certificateUsageHighest &&
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1163 (SECSuccess == valid \|\| returnedUsages \|\| log) ; ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1164 PRBool requiredUsage = (i & requiredUsages) ? PR_TRUE : PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1165 if (PR_FALSE == requiredUsage && PR_FALSE == checkAllUsages) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1166 NEXT_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1167 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1168 if (returnedUsages) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1169 returnedUsages \|= i; / start off assuming this usage is valid */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1170 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1171 switch ( certUsage ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1172 case certUsageSSLClient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1173 case certUsageSSLServer:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1174 case certUsageSSLServerWithStepUp:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1175 case certUsageSSLCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1176 case certUsageEmailSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1177 case certUsageEmailRecipient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1178 case certUsageObjectSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1179 case certUsageStatusResponder:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1180 rv = CERT_KeyUsageAndTypeForCertUsage(certUsage, PR_FALSE,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1181 &requiredKeyUsage,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1182 &requiredCertType);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1183 if ( rv != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1184 PORT_Assert(0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1185 /* EXIT_IF_NOT_LOGGING(log); XXX ??? */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1186 requiredKeyUsage = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1187 requiredCertType = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1188 INVALID_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1189 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1190 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1191
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1192 case certUsageAnyCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1193 case certUsageProtectedObjectSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1194 case certUsageUserCertImport:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1195 case certUsageVerifyCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1196 /* these usages cannot be verified */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1197 NEXT_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1198
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1199 default:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1200 PORT_Assert(0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1201 requiredKeyUsage = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1202 requiredCertType = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1203 INVALID_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1204 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1205 if ( CERT_CheckKeyUsage(cert, requiredKeyUsage) != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1206 if (PR_TRUE == requiredUsage) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1207 PORT_SetError(SEC_ERROR_INADEQUATE_KEY_USAGE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1208 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1209 LOG_ERROR(log,cert,0,requiredKeyUsage);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1210 INVALID_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1211 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1212 if ( !( certType & requiredCertType ) ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1213 if (PR_TRUE == requiredUsage) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1214 PORT_SetError(SEC_ERROR_INADEQUATE_CERT_TYPE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1215 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1216 LOG_ERROR(log,cert,0,requiredCertType);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1217 INVALID_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1218 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1219
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1220 rv = cert_CheckLeafTrust(cert, certUsage, &flags, &trusted);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1221 if (rv == SECFailure) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1222 if (PR_TRUE == requiredUsage) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1223 PORT_SetError(SEC_ERROR_UNTRUSTED_CERT);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1224 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1225 LOG_ERROR(log, cert, 0, flags);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1226 INVALID_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1227 } else if (trusted) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1228 VALID_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1229 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1230
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1231 if (PR_TRUE == revoked \|\| PR_TRUE == sigerror) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1232 INVALID_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1233 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1234
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1235 rv = cert_VerifyCertChain(handle, cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1236 checkSig, &sigerror,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1237 certUsage, t, wincx, log,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1238 &revoked);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1239
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1240 if (rv != SECSuccess) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1241 /* EXIT_IF_NOT_LOGGING(log); XXX ???? */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1242 INVALID_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1243 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1244
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1245 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1246 * Check OCSP revocation status, but only if the cert we are checking
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1247 * is not a status responder itself. We only do this in the case
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1248 * where we checked the cert chain (above); explicit trust "wins"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1249 * (avoids status checking, just as it avoids CRL checking) by
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1250 * bypassing this code.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1251 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1252
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1253 if (PR_FALSE == checkedOCSP) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1254 checkedOCSP = PR_TRUE; /* only check OCSP once */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1255 statusConfig = CERT_GetStatusConfig(handle);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1256 if (requiredUsages != certificateUsageStatusResponder &&
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1257 statusConfig != NULL) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1258 if (statusConfig->statusChecker != NULL) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1259 rv = (* statusConfig->statusChecker)(handle, cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1260 t, wincx);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1261 if (rv != SECSuccess) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1262 LOG_ERROR(log,cert,0,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1263 revoked = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1264 INVALID_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1265 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1266 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1267 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1268 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1269
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1270 NEXT_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1271 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1272
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1273 loser:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1274 return(valid);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1275 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1276
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1277 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1278 CERT_VerifyCert(CERTCertDBHandle handle, CERTCertificate cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1279 PRBool checkSig, SECCertUsage certUsage, PRTime t,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1280 void wincx, CERTVerifyLog log)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1281 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1282 return cert_VerifyCertWithFlags(handle, cert, checkSig, certUsage, t,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1283 CERT_VERIFYCERT_USE_DEFAULTS, wincx, log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1284 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1285
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1286 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1287 cert_VerifyCertWithFlags(CERTCertDBHandle handle, CERTCertificate cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1288 PRBool checkSig, SECCertUsage certUsage, PRTime t,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1289 PRUint32 flags, void wincx, CERTVerifyLog log)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1290 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1291 SECStatus rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1292 unsigned int requiredKeyUsage;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1293 unsigned int requiredCertType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1294 unsigned int failedFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1295 unsigned int certType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1296 PRBool trusted;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1297 PRBool allowOverride;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1298 SECCertTimeValidity validity;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1299 CERTStatusConfig *statusConfig;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1300
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1301 #ifdef notdef
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1302 /* check if this cert is in the Evil list */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1303 rv = CERT_CheckForEvilCert(cert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1304 if ( rv != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1305 PORT_SetError(SEC_ERROR_REVOKED_CERTIFICATE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1306 LOG_ERROR_OR_EXIT(log,cert,0,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1307 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1308 #endif
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1309
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1310 /* make sure that the cert is valid at time t */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1311 allowOverride = (PRBool)((certUsage == certUsageSSLServer) \|\|
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1312 (certUsage == certUsageSSLServerWithStepUp));
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1313 validity = CERT_CheckCertValidTimes(cert, t, allowOverride);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1314 if ( validity != secCertTimeValid ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1315 LOG_ERROR_OR_EXIT(log,cert,0,validity);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1316 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1317
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1318 /* check key usage and netscape cert type */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1319 cert_GetCertType(cert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1320 certType = cert->nsCertType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1321 switch ( certUsage ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1322 case certUsageSSLClient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1323 case certUsageSSLServer:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1324 case certUsageSSLServerWithStepUp:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1325 case certUsageSSLCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1326 case certUsageEmailSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1327 case certUsageEmailRecipient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1328 case certUsageObjectSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1329 case certUsageStatusResponder:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1330 rv = CERT_KeyUsageAndTypeForCertUsage(certUsage, PR_FALSE,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1331 &requiredKeyUsage,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1332 &requiredCertType);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1333 if ( rv != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1334 PORT_Assert(0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1335 EXIT_IF_NOT_LOGGING(log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1336 requiredKeyUsage = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1337 requiredCertType = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1338 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1339 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1340 case certUsageVerifyCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1341 case certUsageAnyCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1342 requiredKeyUsage = KU_KEY_CERT_SIGN;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1343 requiredCertType = NS_CERT_TYPE_CA;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1344 if ( ! ( certType & NS_CERT_TYPE_CA ) ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1345 certType \|= NS_CERT_TYPE_CA;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1346 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1347 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1348 default:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1349 PORT_Assert(0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1350 EXIT_IF_NOT_LOGGING(log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1351 requiredKeyUsage = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1352 requiredCertType = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1353 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1354 if ( CERT_CheckKeyUsage(cert, requiredKeyUsage) != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1355 PORT_SetError(SEC_ERROR_INADEQUATE_KEY_USAGE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1356 LOG_ERROR_OR_EXIT(log,cert,0,requiredKeyUsage);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1357 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1358 if ( !( certType & requiredCertType ) ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1359 PORT_SetError(SEC_ERROR_INADEQUATE_CERT_TYPE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1360 LOG_ERROR_OR_EXIT(log,cert,0,requiredCertType);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1361 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1362
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1363 rv = cert_CheckLeafTrust(cert, certUsage, &failedFlags, &trusted);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1364 if (rv == SECFailure) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1365 PORT_SetError(SEC_ERROR_UNTRUSTED_CERT);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1366 LOG_ERROR_OR_EXIT(log, cert, 0, failedFlags);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1367 } else if (trusted) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1368 goto done;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1369 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1370
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1371
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1372 rv = CERT_VerifyCertChain(handle, cert, checkSig, certUsage,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1373 t, wincx, log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1374 if (rv != SECSuccess) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1375 EXIT_IF_NOT_LOGGING(log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1376 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1377
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1378 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1379 * Check revocation status, but only if the cert we are checking is not a
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1380 * status responder itself and the caller did not ask us to skip the check.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1381 * We only do this in the case where we checked the cert chain (above);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1382 * explicit trust "wins" (avoids status checking, just as it avoids CRL
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1383 * checking, which is all done inside VerifyCertChain) by bypassing this
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1384 * code.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1385 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1386 if (!(flags & CERT_VERIFYCERT_SKIP_OCSP) &&
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1387 certUsage != certUsageStatusResponder) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1388 statusConfig = CERT_GetStatusConfig(handle);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1389 if (statusConfig && statusConfig->statusChecker) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1390 rv = (* statusConfig->statusChecker)(handle, cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1391 t, wincx);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1392 if (rv != SECSuccess) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1393 LOG_ERROR_OR_EXIT(log,cert,0,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1394 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1395 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1396 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1397
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1398 done:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1399 if (log && log->head) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1400 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1401 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1402 return(SECSuccess);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1403
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1404 loser:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1405 rv = SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1406
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1407 return(rv);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1408 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1409
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1410 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1411 * verify a certificate by checking if its valid and that we
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1412 * trust the issuer. Verify time against now.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1413 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1414 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1415 CERT_VerifyCertificateNow(CERTCertDBHandle handle, CERTCertificate cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1416 PRBool checkSig, SECCertificateUsage requiredUsages,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1417 void wincx, SECCertificateUsage returnedUsages)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1418 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1419 return(CERT_VerifyCertificate(handle, cert, checkSig,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1420 requiredUsages, PR_Now(), wincx, NULL, returnedUsages));
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1421 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1422
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1423 /* obsolete, do not use for new code */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1424 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1425 CERT_VerifyCertNow(CERTCertDBHandle handle, CERTCertificate cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1426 PRBool checkSig, SECCertUsage certUsage, void *wincx)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1427 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1428 return(CERT_VerifyCert(handle, cert, checkSig,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1429 certUsage, PR_Now(), wincx, NULL));
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1430 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1431
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1432
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1433 /* [ FROM pcertdb.c ] */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1434 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1435 * Supported usage values and types:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1436 * certUsageSSLClient
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1437 * certUsageSSLServer
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1438 * certUsageSSLServerWithStepUp
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1439 * certUsageEmailSigner
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1440 * certUsageEmailRecipient
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1441 * certUsageObjectSigner
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1442 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1443
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1444 CERTCertificate *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1445 CERT_FindMatchingCert(CERTCertDBHandle handle, SECItem derName,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1446 CERTCertOwner owner, SECCertUsage usage,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1447 PRBool preferTrusted, PRTime validTime, PRBool validOnly)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1448 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1449 CERTCertList *certList = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1450 CERTCertificate *cert = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1451 CERTCertTrust certTrust;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1452 unsigned int requiredTrustFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1453 SECTrustType requiredTrustType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1454 unsigned int flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1455
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1456 PRBool lookingForCA = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1457 SECStatus rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1458 CERTCertListNode *node;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1459 CERTCertificate *saveUntrustedCA = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1460
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1461 /* if preferTrusted is set, must be a CA cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1462 PORT_Assert( ! ( preferTrusted && ( owner != certOwnerCA ) ) );
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1463
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1464 if ( owner == certOwnerCA ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1465 lookingForCA = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1466 if ( preferTrusted ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1467 rv = CERT_TrustFlagsForCACertUsage(usage, &requiredTrustFlags,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1468 &requiredTrustType);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1469 if ( rv != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1470 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1471 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1472 requiredTrustFlags \|= CERTDB_VALID_CA;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1473 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1474 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1475
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1476 certList = CERT_CreateSubjectCertList(NULL, handle, derName, validTime,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1477 validOnly);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1478 if ( certList != NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1479 rv = CERT_FilterCertListByUsage(certList, usage, lookingForCA);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1480 if ( rv != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1481 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1482 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1483
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1484 node = CERT_LIST_HEAD(certList);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1485
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1486 while ( !CERT_LIST_END(node, certList) ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1487 cert = node->cert;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1488
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1489 /* looking for a trusted CA cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1490 if ( ( owner == certOwnerCA ) && preferTrusted &&
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1491 ( requiredTrustType != trustTypeNone ) ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1492
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1493 if ( CERT_GetCertTrust(cert, &certTrust) != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1494 flags = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1495 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1496 flags = SEC_GET_TRUST_FLAGS(&certTrust, requiredTrustType);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1497 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1498
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1499 if ( ( flags & requiredTrustFlags ) != requiredTrustFlags ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1500 /* cert is not trusted */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1501 /* if this is the first cert to get this far, then save
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1502 * it, so we can use it if we can't find a trusted one
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1503 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1504 if ( saveUntrustedCA == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1505 saveUntrustedCA = cert;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1506 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1507 goto endloop;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1508 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1509 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1510 /* if we got this far, then this cert meets all criteria */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1511 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1512
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1513 endloop:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1514 node = CERT_LIST_NEXT(node);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1515 cert = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1516 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1517
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1518 /* use the saved one if we have it */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1519 if ( cert == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1520 cert = saveUntrustedCA;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1521 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1522
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1523 /* if we found one then bump the ref count before freeing the list */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1524 if ( cert != NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1525 /* bump the ref count */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1526 cert = CERT_DupCertificate(cert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1527 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1528
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1529 CERT_DestroyCertList(certList);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1530 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1531
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1532 return(cert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1533
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1534 loser:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1535 if ( certList != NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1536 CERT_DestroyCertList(certList);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1537 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1538
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1539 return(NULL);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1540 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1541
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1542
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1543 /* [ From certdb.c ] */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1544 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1545 * Filter a list of certificates, removing those certs that do not have
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1546 * one of the named CA certs somewhere in their cert chain.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1547 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1548 * "certList" - the list of certificates to filter
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1549 * "nCANames" - number of CA names
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1550 * "caNames" - array of CA names in string(rfc 1485) form
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1551 * "usage" - what use the certs are for, this is used when
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1552 * selecting CA certs
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1553 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1554 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1555 CERT_FilterCertListByCANames(CERTCertList *certList, int nCANames,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1556 char **caNames, SECCertUsage usage)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1557 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1558 CERTCertificate *issuerCert = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1559 CERTCertificate *subjectCert;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1560 CERTCertListNode node, freenode;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1561 CERTCertificate *cert;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1562 int n;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1563 char **names;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1564 PRBool found;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1565 PRTime time;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1566
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1567 if ( nCANames <= 0 ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1568 return(SECSuccess);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1569 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1570
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1571 time = PR_Now();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1572
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1573 node = CERT_LIST_HEAD(certList);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1574
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1575 while ( ! CERT_LIST_END(node, certList) ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1576 cert = node->cert;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1577
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1578 subjectCert = CERT_DupCertificate(cert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1579
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1580 /* traverse the CA certs for this cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1581 found = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1582 while ( subjectCert != NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1583 n = nCANames;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1584 names = caNames;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1585
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1586 if (subjectCert->issuerName != NULL) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1587 while ( n > 0 ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1588 if ( PORT_Strcmp(*names, subjectCert->issuerName) == 0 ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1589 found = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1590 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1591 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1592
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1593 n--;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1594 names++;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1595 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1596 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1597
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1598 if ( found ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1599 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1600 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1601
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1602 issuerCert = CERT_FindCertIssuer(subjectCert, time, usage);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1603 if ( issuerCert == subjectCert ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1604 CERT_DestroyCertificate(issuerCert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1605 issuerCert = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1606 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1607 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1608 CERT_DestroyCertificate(subjectCert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1609 subjectCert = issuerCert;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1610
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1611 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1612 CERT_DestroyCertificate(subjectCert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1613 if ( !found ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1614 /* CA was not found, so remove this cert from the list */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1615 freenode = node;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1616 node = CERT_LIST_NEXT(node);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1617 CERT_RemoveCertListNode(freenode);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1618 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1619 /* CA was found, so leave it in the list */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1620 node = CERT_LIST_NEXT(node);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1621 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1622 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1623
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1624 return(SECSuccess);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1625 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1626
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1627 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1628 * Given a certificate, return a string containing the nickname, and possibly
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1629 * one of the validity strings, based on the current validity state of the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1630 * certificate.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1631 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1632 * "arena" - arena to allocate returned string from. If NULL, then heap
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1633 * is used.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1634 * "cert" - the cert to get nickname from
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1635 * "expiredString" - the string to append to the nickname if the cert is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1636 * expired.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1637 * "notYetGoodString" - the string to append to the nickname if the cert is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1638 * not yet good.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1639 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1640 char *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1641 CERT_GetCertNicknameWithValidity(PLArenaPool arena, CERTCertificate cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1642 char expiredString, char notYetGoodString)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1643 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1644 SECCertTimeValidity validity;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1645 char nickname = NULL, tmpstr = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1646
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1647 validity = CERT_CheckCertValidTimes(cert, PR_Now(), PR_FALSE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1648
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1649 /* if the cert is good, then just use the nickname directly */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1650 if ( validity == secCertTimeValid ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1651 if ( arena == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1652 nickname = PORT_Strdup(cert->nickname);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1653 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1654 nickname = PORT_ArenaStrdup(arena, cert->nickname);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1655 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1656
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1657 if ( nickname == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1658 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1659 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1660 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1661
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1662 /* if the cert is not valid, then tack one of the strings on the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1663 * end
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1664 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1665 if ( validity == secCertTimeExpired ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1666 tmpstr = PR_smprintf("%s%s", cert->nickname,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1667 expiredString);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1668 } else if ( validity == secCertTimeNotValidYet ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1669 /* not yet valid */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1670 tmpstr = PR_smprintf("%s%s", cert->nickname,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1671 notYetGoodString);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1672 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1673 /* undetermined */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1674 tmpstr = PR_smprintf("%s",
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1675 "(NULL) (Validity Unknown)");
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1676 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1677
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1678 if ( tmpstr == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1679 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1680 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1681
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1682 if ( arena ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1683 /* copy the string into the arena and free the malloc'd one */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1684 nickname = PORT_ArenaStrdup(arena, tmpstr);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1685 PORT_Free(tmpstr);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1686 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1687 nickname = tmpstr;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1688 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1689 if ( nickname == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1690 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1691 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1692 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1693 return(nickname);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1694
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1695 loser:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1696 return(NULL);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1697 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1698
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1699 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1700 * Collect the nicknames from all certs in a CertList. If the cert is not
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1701 * valid, append a string to that nickname.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1702 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1703 * "certList" - the list of certificates
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1704 * "expiredString" - the string to append to the nickname of any expired cert
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1705 * "notYetGoodString" - the string to append to the nickname of any cert
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1706 * that is not yet valid
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1707 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1708 CERTCertNicknames *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1709 CERT_NicknameStringsFromCertList(CERTCertList certList, char expiredString,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1710 char *notYetGoodString)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1711 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1712 CERTCertNicknames *names;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1713 PLArenaPool *arena;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1714 CERTCertListNode *node;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1715 char **nn;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1716
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1717 /* allocate an arena */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1718 arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1719 if ( arena == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1720 return(NULL);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1721 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1722
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1723 /* allocate the structure */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1724 names = PORT_ArenaAlloc(arena, sizeof(CERTCertNicknames));
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1725 if ( names == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1726 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1727 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1728
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1729 /* init the structure */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1730 names->arena = arena;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1731 names->head = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1732 names->numnicknames = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1733 names->nicknames = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1734 names->totallen = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1735
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1736 /* count the certs in the list */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1737 node = CERT_LIST_HEAD(certList);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1738 while ( ! CERT_LIST_END(node, certList) ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1739 names->numnicknames++;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1740 node = CERT_LIST_NEXT(node);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1741 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1742
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1743 /* allocate nicknames array */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1744 names->nicknames = PORT_ArenaAlloc(arena,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1745 sizeof(char ) names->numnicknames);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1746 if ( names->nicknames == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1747 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1748 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1749
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1750 /* just in case printf can't deal with null strings */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1751 if (expiredString == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1752 expiredString = "";
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1753 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1754
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1755 if ( notYetGoodString == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1756 notYetGoodString = "";
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1757 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1758
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1759 /* traverse the list of certs and collect the nicknames */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1760 nn = names->nicknames;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1761 node = CERT_LIST_HEAD(certList);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1762 while ( ! CERT_LIST_END(node, certList) ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1763 *nn = CERT_GetCertNicknameWithValidity(arena, node->cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1764 expiredString,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1765 notYetGoodString);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1766 if ( *nn == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1767 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1768 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1769
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1770 names->totallen += PORT_Strlen(*nn);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1771
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1772 nn++;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1773 node = CERT_LIST_NEXT(node);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1774 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1775
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1776 return(names);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1777
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1778 loser:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1779 PORT_FreeArena(arena, PR_FALSE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1780 return(NULL);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1781 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1782
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1783 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1784 * Extract the nickname from a nickmake string that may have either
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1785 * expiredString or notYetGoodString appended.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1786 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1787 * Args:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1788 * "namestring" - the string containing the nickname, and possibly
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1789 * one of the validity label strings
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1790 * "expiredString" - the expired validity label string
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1791 * "notYetGoodString" - the not yet good validity label string
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1792 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1793 * Returns the raw nickname
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1794 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1795 char *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1796 CERT_ExtractNicknameString(char namestring, char expiredString,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1797 char *notYetGoodString)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1798 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1799 int explen, nyglen, namelen;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1800 int retlen;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1801 char *retstr;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1802
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1803 namelen = PORT_Strlen(namestring);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1804 explen = PORT_Strlen(expiredString);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1805 nyglen = PORT_Strlen(notYetGoodString);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1806
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1807 if ( namelen > explen ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1808 if ( PORT_Strcmp(expiredString, &namestring[namelen-explen]) == 0 ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1809 retlen = namelen - explen;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1810 retstr = (char *)PORT_Alloc(retlen+1);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1811 if ( retstr == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1812 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1813 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1814
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1815 PORT_Memcpy(retstr, namestring, retlen);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1816 retstr[retlen] = '\0';
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1817 goto done;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1818 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1819 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1820
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1821 if ( namelen > nyglen ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1822 if ( PORT_Strcmp(notYetGoodString, &namestring[namelen-nyglen]) == 0) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1823 retlen = namelen - nyglen;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1824 retstr = (char *)PORT_Alloc(retlen+1);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1825 if ( retstr == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1826 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1827 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1828
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1829 PORT_Memcpy(retstr, namestring, retlen);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1830 retstr[retlen] = '\0';
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1831 goto done;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1832 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1833 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1834
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1835 /* if name string is shorter than either invalid string, then it must
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1836 * be a raw nickname
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1837 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1838 retstr = PORT_Strdup(namestring);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1839
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1840 done:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1841 return(retstr);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1842
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1843 loser:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1844 return(NULL);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1845 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1846
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1847 CERTCertList *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1848 CERT_GetCertChainFromCert(CERTCertificate *cert, PRTime time, SECCertUsage usage)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1849 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1850 CERTCertList *chain = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1851 int count = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1852
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1853 if (NULL == cert) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1854 return NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1855 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1856
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1857 cert = CERT_DupCertificate(cert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1858 if (NULL == cert) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1859 PORT_SetError(SEC_ERROR_NO_MEMORY);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1860 return NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1861 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1862
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1863 chain = CERT_NewCertList();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1864 if (NULL == chain) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1865 PORT_SetError(SEC_ERROR_NO_MEMORY);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1866 return NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1867 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1868
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1869 while (cert != NULL && ++count <= CERT_MAX_CERT_CHAIN) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1870 if (SECSuccess != CERT_AddCertToListTail(chain, cert)) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1871 /* return partial chain */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1872 PORT_SetError(SEC_ERROR_NO_MEMORY);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1873 return chain;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1874 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1875
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1876 if (cert->isRoot) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1877 /* return complete chain */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1878 return chain;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1879 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1880
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1881 cert = CERT_FindCertIssuer(cert, time, usage);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1882 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1883
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1884 /* return partial chain */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1885 PORT_SetError(SEC_ERROR_UNKNOWN_ISSUER);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1886 return chain;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste Andre Heinecke <andre.heinecke@intevation.de> parents: diff changeset	1887 }

Mercurial > trustbridge > nss-cmake-static

annotate nss/lib/certhigh/certvfy.c @ 1:247cffdc9b89