Mercurial > trustbridge > nss-cmake-static

annotate nss/lib/certhigh/certvfy.c @ 4:b513267f632f tip

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Build DBM module
author Andre Heinecke <andre.heinecke@intevation.de>
date Tue, 05 Aug 2014 18:58:03 +0200
parents 1e5118fa0cb1
children
rev   line source
0
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1 /* This Source Code Form is subject to the terms of the Mozilla Public
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
2 * License, v. 2.0. If a copy of the MPL was not distributed with this
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
4 #include "nspr.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
5 #include "secerr.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
6 #include "secport.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
7 #include "seccomon.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
8 #include "secoid.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
9 #include "sslerr.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
10 #include "genname.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
11 #include "keyhi.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
12 #include "cert.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
13 #include "certdb.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
14 #include "certi.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
15 #include "cryptohi.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
16 #ifndef NSS_DISABLE_LIBPKIX
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
17 #include "pkix.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
18 /*#include "pkix_sample_modules.h" */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
19 #include "pkix_pl_cert.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
20 #endif /* NSS_DISABLE_LIBPKIX */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
21
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
22
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
23 #include "nsspki.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
24 #include "pkitm.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
25 #include "pkim.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
26 #include "pki3hack.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
27 #include "base.h"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
28
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
29 #ifdef NSS_DISABLE_LIBPKIX
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
30 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
31 cert_VerifyCertChainPkix(
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
32 CERTCertificate *cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
33 PRBool checkSig,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
34 SECCertUsage requiredUsage,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
35 PRTime time,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
36 void *wincx,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
37 CERTVerifyLog *log,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
38 PRBool *pSigerror,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
39 PRBool *pRevoked)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
40 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
41 PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
42 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
43 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
44
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
45 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
46 CERT_SetUsePKIXForValidation(PRBool enable)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
47 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
48 PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
49 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
50 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
51
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
52 PRBool
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
53 CERT_GetUsePKIXForValidation()
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
54 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
55 return PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
56 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
57
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
58 SECStatus CERT_PKIXVerifyCert(
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
59 CERTCertificate *cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
60 SECCertificateUsage usages,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
61 CERTValInParam *paramsIn,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
62 CERTValOutParam *paramsOut,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
63 void *wincx)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
64 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
65 PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
66 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
67 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
68 #endif /* NSS_DISABLE_LIBPKIX */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
69
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
70 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
71 * Check the validity times of a certificate
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
72 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
73 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
74 CERT_CertTimesValid(CERTCertificate *c)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
75 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
76 SECCertTimeValidity valid = CERT_CheckCertValidTimes(c, PR_Now(), PR_TRUE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
77 return (valid == secCertTimeValid) ? SECSuccess : SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
78 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
79
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
80 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
81 * verify the signature of a signed data object with the given DER publickey
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
82 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
83 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
84 CERT_VerifySignedDataWithPublicKey(const CERTSignedData *sd,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
85 SECKEYPublicKey *pubKey,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
86 void *wincx)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
87 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
88 SECStatus rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
89 SECItem sig;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
90 SECOidTag hashAlg = SEC_OID_UNKNOWN;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
91
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
92 if ( !pubKey || !sd ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
93 PORT_SetError(PR_INVALID_ARGUMENT_ERROR);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
94 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
95 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
96
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
97 /* check the signature */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
98 sig = sd->signature;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
99 /* convert sig->len from bit counts to byte count. */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
100 DER_ConvertBitString(&sig);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
101
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
102 rv = VFY_VerifyDataWithAlgorithmID(sd->data.data, sd->data.len, pubKey,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
103 &sig, &sd->signatureAlgorithm, &hashAlg, wincx);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
104 if (rv == SECSuccess) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
105 /* Are we honoring signatures for this algorithm? */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
106 PRUint32 policyFlags = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
107 rv = NSS_GetAlgorithmPolicy(hashAlg, &policyFlags);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
108 if (rv == SECSuccess &&
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
109 !(policyFlags & NSS_USE_ALG_IN_CERT_SIGNATURE)) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
110 PORT_SetError(SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
111 rv = SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
112 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
113 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
114 return rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
115 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
116
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
117 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
118 * verify the signature of a signed data object with the given DER publickey
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
119 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
120 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
121 CERT_VerifySignedDataWithPublicKeyInfo(CERTSignedData *sd,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
122 CERTSubjectPublicKeyInfo *pubKeyInfo,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
123 void *wincx)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
124 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
125 SECKEYPublicKey *pubKey;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
126 SECStatus rv = SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
127
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
128 /* get cert's public key */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
129 pubKey = SECKEY_ExtractPublicKey(pubKeyInfo);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
130 if (pubKey) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
131 rv = CERT_VerifySignedDataWithPublicKey(sd, pubKey, wincx);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
132 SECKEY_DestroyPublicKey(pubKey);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
133 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
134 return rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
135 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
136
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
137 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
138 * verify the signature of a signed data object with the given certificate
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
139 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
140 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
141 CERT_VerifySignedData(CERTSignedData *sd, CERTCertificate *cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
142 PRTime t, void *wincx)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
143 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
144 SECKEYPublicKey *pubKey = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
145 SECStatus rv = SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
146 SECCertTimeValidity validity;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
147
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
148 /* check the certificate's validity */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
149 validity = CERT_CheckCertValidTimes(cert, t, PR_FALSE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
150 if ( validity != secCertTimeValid ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
151 return rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
152 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
153
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
154 /* get cert's public key */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
155 pubKey = CERT_ExtractPublicKey(cert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
156 if (pubKey) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
157 rv = CERT_VerifySignedDataWithPublicKey(sd, pubKey, wincx);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
158 SECKEY_DestroyPublicKey(pubKey);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
159 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
160 return rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
161 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
162
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
163
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
164 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
165 SEC_CheckCRL(CERTCertDBHandle *handle,CERTCertificate *cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
166 CERTCertificate *caCert, PRTime t, void * wincx)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
167 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
168 return CERT_CheckCRL(cert, caCert, NULL, t, wincx);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
169 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
170
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
171 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
172 * Find the issuer of a cert. Use the authorityKeyID if it exists.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
173 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
174 CERTCertificate *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
175 CERT_FindCertIssuer(CERTCertificate *cert, PRTime validTime, SECCertUsage usage)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
176 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
177 NSSCertificate *me;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
178 NSSTime *nssTime;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
179 NSSTrustDomain *td;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
180 NSSCryptoContext *cc;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
181 NSSCertificate *chain[3];
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
182 NSSUsage nssUsage;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
183 PRStatus status;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
184
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
185 me = STAN_GetNSSCertificate(cert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
186 if (!me) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
187 PORT_SetError(SEC_ERROR_NO_MEMORY);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
188 return NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
189 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
190 nssTime = NSSTime_SetPRTime(NULL, validTime);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
191 nssUsage.anyUsage = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
192 nssUsage.nss3usage = usage;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
193 nssUsage.nss3lookingForCA = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
194 memset(chain, 0, 3*sizeof(NSSCertificate *));
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
195 td = STAN_GetDefaultTrustDomain();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
196 cc = STAN_GetDefaultCryptoContext();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
197 (void)NSSCertificate_BuildChain(me, nssTime, &nssUsage, NULL,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
198 chain, 2, NULL, &status, td, cc);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
199 nss_ZFreeIf(nssTime);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
200 if (status == PR_SUCCESS) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
201 PORT_Assert(me == chain[0]);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
202 /* if it's a root, the chain will only have one cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
203 if (!chain[1]) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
204 /* already has a reference from the call to BuildChain */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
205 return cert;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
206 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
207 NSSCertificate_Destroy(chain[0]); /* the first cert in the chain */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
208 return STAN_GetCERTCertificate(chain[1]); /* return the 2nd */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
209 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
210 if (chain[0]) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
211 PORT_Assert(me == chain[0]);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
212 NSSCertificate_Destroy(chain[0]); /* the first cert in the chain */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
213 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
214 PORT_SetError (SEC_ERROR_UNKNOWN_ISSUER);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
215 return NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
216 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
217
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
218 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
219 * return required trust flags for various cert usages for CAs
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
220 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
221 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
222 CERT_TrustFlagsForCACertUsage(SECCertUsage usage,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
223 unsigned int *retFlags,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
224 SECTrustType *retTrustType)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
225 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
226 unsigned int requiredFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
227 SECTrustType trustType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
228
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
229 switch ( usage ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
230 case certUsageSSLClient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
231 requiredFlags = CERTDB_TRUSTED_CLIENT_CA;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
232 trustType = trustSSL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
233 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
234 case certUsageSSLServer:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
235 case certUsageSSLCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
236 requiredFlags = CERTDB_TRUSTED_CA;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
237 trustType = trustSSL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
238 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
239 case certUsageSSLServerWithStepUp:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
240 requiredFlags = CERTDB_TRUSTED_CA | CERTDB_GOVT_APPROVED_CA;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
241 trustType = trustSSL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
242 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
243 case certUsageEmailSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
244 case certUsageEmailRecipient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
245 requiredFlags = CERTDB_TRUSTED_CA;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
246 trustType = trustEmail;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
247 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
248 case certUsageObjectSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
249 requiredFlags = CERTDB_TRUSTED_CA;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
250 trustType = trustObjectSigning;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
251 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
252 case certUsageVerifyCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
253 case certUsageAnyCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
254 case certUsageStatusResponder:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
255 requiredFlags = CERTDB_TRUSTED_CA;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
256 trustType = trustTypeNone;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
257 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
258 default:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
259 PORT_Assert(0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
260 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
261 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
262 if ( retFlags != NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
263 *retFlags = requiredFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
264 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
265 if ( retTrustType != NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
266 *retTrustType = trustType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
267 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
268
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
269 return(SECSuccess);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
270 loser:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
271 return(SECFailure);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
272 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
273
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
274 void
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
275 cert_AddToVerifyLog(CERTVerifyLog *log, CERTCertificate *cert, long error,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
276 unsigned int depth, void *arg)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
277 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
278 CERTVerifyLogNode *node, *tnode;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
279
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
280 PORT_Assert(log != NULL);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
281
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
282 node = (CERTVerifyLogNode *)PORT_ArenaAlloc(log->arena,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
283 sizeof(CERTVerifyLogNode));
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
284 if ( node != NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
285 node->cert = CERT_DupCertificate(cert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
286 node->error = error;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
287 node->depth = depth;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
288 node->arg = arg;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
289
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
290 if ( log->tail == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
291 /* empty list */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
292 log->head = log->tail = node;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
293 node->prev = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
294 node->next = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
295 } else if ( depth >= log->tail->depth ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
296 /* add to tail */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
297 node->prev = log->tail;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
298 log->tail->next = node;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
299 log->tail = node;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
300 node->next = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
301 } else if ( depth < log->head->depth ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
302 /* add at head */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
303 node->prev = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
304 node->next = log->head;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
305 log->head->prev = node;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
306 log->head = node;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
307 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
308 /* add in middle */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
309 tnode = log->tail;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
310 while ( tnode != NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
311 if ( depth >= tnode->depth ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
312 /* insert after tnode */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
313 node->prev = tnode;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
314 node->next = tnode->next;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
315 tnode->next->prev = node;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
316 tnode->next = node;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
317 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
318 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
319
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
320 tnode = tnode->prev;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
321 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
322 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
323
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
324 log->count++;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
325 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
326 return;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
327 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
328
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
329 #define EXIT_IF_NOT_LOGGING(log) \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
330 if ( log == NULL ) { \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
331 goto loser; \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
332 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
333
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
334 #define LOG_ERROR_OR_EXIT(log,cert,depth,arg) \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
335 if ( log != NULL ) { \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
336 cert_AddToVerifyLog(log, cert, PORT_GetError(), depth, \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
337 (void *)(PRWord)arg); \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
338 } else { \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
339 goto loser; \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
340 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
341
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
342 #define LOG_ERROR(log,cert,depth,arg) \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
343 if ( log != NULL ) { \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
344 cert_AddToVerifyLog(log, cert, PORT_GetError(), depth, \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
345 (void *)(PRWord)arg); \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
346 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
347
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
348 static SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
349 cert_VerifyCertChainOld(CERTCertDBHandle *handle, CERTCertificate *cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
350 PRBool checkSig, PRBool* sigerror,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
351 SECCertUsage certUsage, PRTime t, void *wincx,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
352 CERTVerifyLog *log, PRBool* revoked)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
353 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
354 SECTrustType trustType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
355 CERTBasicConstraints basicConstraint;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
356 CERTCertificate *issuerCert = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
357 CERTCertificate *subjectCert = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
358 CERTCertificate *badCert = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
359 PRBool isca;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
360 SECStatus rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
361 SECStatus rvFinal = SECSuccess;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
362 int count;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
363 int currentPathLen = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
364 int pathLengthLimit = CERT_UNLIMITED_PATH_CONSTRAINT;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
365 unsigned int caCertType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
366 unsigned int requiredCAKeyUsage;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
367 unsigned int requiredFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
368 PLArenaPool *arena = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
369 CERTGeneralName *namesList = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
370 CERTCertificate **certsList = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
371 int certsListLen = 16;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
372 int namesCount = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
373 PRBool subjectCertIsSelfIssued;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
374 CERTCertTrust issuerTrust;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
375
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
376 if (revoked) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
377 *revoked = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
378 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
379
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
380 if (CERT_KeyUsageAndTypeForCertUsage(certUsage, PR_TRUE,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
381 &requiredCAKeyUsage,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
382 &caCertType)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
383 != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
384 PORT_Assert(0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
385 EXIT_IF_NOT_LOGGING(log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
386 requiredCAKeyUsage = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
387 caCertType = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
388 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
389
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
390 switch ( certUsage ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
391 case certUsageSSLClient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
392 case certUsageSSLServer:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
393 case certUsageSSLCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
394 case certUsageSSLServerWithStepUp:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
395 case certUsageEmailSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
396 case certUsageEmailRecipient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
397 case certUsageObjectSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
398 case certUsageVerifyCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
399 case certUsageAnyCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
400 case certUsageStatusResponder:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
401 if ( CERT_TrustFlagsForCACertUsage(certUsage, &requiredFlags,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
402 &trustType) != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
403 PORT_Assert(0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
404 EXIT_IF_NOT_LOGGING(log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
405 /* XXX continuing with requiredFlags = 0 seems wrong. It'll
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
406 * cause the following test to be true incorrectly:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
407 * flags = SEC_GET_TRUST_FLAGS(issuerCert->trust, trustType);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
408 * if (( flags & requiredFlags ) == requiredFlags) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
409 * rv = rvFinal;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
410 * goto done;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
411 * }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
412 * There are three other instances of this problem.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
413 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
414 requiredFlags = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
415 trustType = trustSSL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
416 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
417 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
418 default:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
419 PORT_Assert(0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
420 EXIT_IF_NOT_LOGGING(log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
421 requiredFlags = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
422 trustType = trustSSL;/* This used to be 0, but we need something
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
423 * that matches the enumeration type.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
424 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
425 caCertType = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
426 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
427
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
428 subjectCert = CERT_DupCertificate(cert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
429 if ( subjectCert == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
430 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
431 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
432
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
433 arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
434 if (arena == NULL) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
435 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
436 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
437
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
438 certsList = PORT_ZNewArray(CERTCertificate *, certsListLen);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
439 if (certsList == NULL)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
440 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
441
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
442 /* RFC 3280 says that the name constraints will apply to the names
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
443 ** in the leaf (EE) cert, whether it is self issued or not, so
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
444 ** we pretend that it is not.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
445 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
446 subjectCertIsSelfIssued = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
447 for ( count = 0; count < CERT_MAX_CERT_CHAIN; count++ ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
448 PRBool validCAOverride = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
449
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
450 /* Construct a list of names for the current and all previous
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
451 * certifcates (except leaf (EE) certs, root CAs, and self-issued
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
452 * intermediate CAs) to be verified against the name constraints
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
453 * extension of the issuer certificate.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
454 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
455 if (subjectCertIsSelfIssued == PR_FALSE) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
456 CERTGeneralName *subjectNameList;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
457 int subjectNameListLen;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
458 int i;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
459 PRBool getSubjectCN = (!count && certUsage == certUsageSSLServer);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
460 subjectNameList =
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
461 CERT_GetConstrainedCertificateNames(subjectCert, arena,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
462 getSubjectCN);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
463 if (!subjectNameList)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
464 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
465 subjectNameListLen = CERT_GetNamesLength(subjectNameList);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
466 if (!subjectNameListLen)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
467 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
468 if (certsListLen <= namesCount + subjectNameListLen) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
469 CERTCertificate **tmpCertsList;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
470 certsListLen = (namesCount + subjectNameListLen) * 2;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
471 tmpCertsList =
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
472 (CERTCertificate **)PORT_Realloc(certsList,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
473 certsListLen * sizeof(CERTCertificate *));
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
474 if (tmpCertsList == NULL) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
475 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
476 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
477 certsList = tmpCertsList;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
478 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
479 for (i = 0; i < subjectNameListLen; i++) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
480 certsList[namesCount + i] = subjectCert;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
481 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
482 namesCount += subjectNameListLen;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
483 namesList = cert_CombineNamesLists(namesList, subjectNameList);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
484 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
485
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
486 /* check if the cert has an unsupported critical extension */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
487 if ( subjectCert->options.bits.hasUnsupportedCriticalExt ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
488 PORT_SetError(SEC_ERROR_UNKNOWN_CRITICAL_EXTENSION);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
489 LOG_ERROR_OR_EXIT(log,subjectCert,count,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
490 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
491
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
492 /* find the certificate of the issuer */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
493 issuerCert = CERT_FindCertIssuer(subjectCert, t, certUsage);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
494 if ( ! issuerCert ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
495 PORT_SetError(SEC_ERROR_UNKNOWN_ISSUER);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
496 LOG_ERROR(log,subjectCert,count,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
497 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
498 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
499
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
500 /* verify the signature on the cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
501 if ( checkSig ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
502 rv = CERT_VerifySignedData(&subjectCert->signatureWrap,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
503 issuerCert, t, wincx);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
504
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
505 if ( rv != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
506 if (sigerror) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
507 *sigerror = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
508 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
509 if ( PORT_GetError() == SEC_ERROR_EXPIRED_CERTIFICATE ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
510 PORT_SetError(SEC_ERROR_EXPIRED_ISSUER_CERTIFICATE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
511 LOG_ERROR_OR_EXIT(log,issuerCert,count+1,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
512 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
513 if (PORT_GetError() !=
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
514 SEC_ERROR_CERT_SIGNATURE_ALGORITHM_DISABLED) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
515 PORT_SetError(SEC_ERROR_BAD_SIGNATURE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
516 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
517 LOG_ERROR_OR_EXIT(log,subjectCert,count,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
518 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
519 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
520 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
521
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
522 /* If the basicConstraint extension is included in an immediate CA
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
523 * certificate, make sure that the isCA flag is on. If the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
524 * pathLenConstraint component exists, it must be greater than the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
525 * number of CA certificates we have seen so far. If the extension
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
526 * is omitted, we will assume that this is a CA certificate with
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
527 * an unlimited pathLenConstraint (since it already passes the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
528 * netscape-cert-type extension checking).
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
529 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
530
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
531 rv = CERT_FindBasicConstraintExten(issuerCert, &basicConstraint);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
532 if ( rv != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
533 if (PORT_GetError() != SEC_ERROR_EXTENSION_NOT_FOUND) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
534 LOG_ERROR_OR_EXIT(log,issuerCert,count+1,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
535 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
536 pathLengthLimit = CERT_UNLIMITED_PATH_CONSTRAINT;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
537 /* no basic constraints found, we aren't (yet) a CA. */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
538 isca = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
539 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
540 if ( basicConstraint.isCA == PR_FALSE ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
541 PORT_SetError (SEC_ERROR_CA_CERT_INVALID);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
542 LOG_ERROR_OR_EXIT(log,issuerCert,count+1,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
543 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
544 pathLengthLimit = basicConstraint.pathLenConstraint;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
545 isca = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
546 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
547 /* make sure that the path len constraint is properly set.*/
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
548 if (pathLengthLimit >= 0 && currentPathLen > pathLengthLimit) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
549 PORT_SetError (SEC_ERROR_PATH_LEN_CONSTRAINT_INVALID);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
550 LOG_ERROR_OR_EXIT(log, issuerCert, count+1, pathLengthLimit);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
551 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
552
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
553 /* make sure that the entire chain is within the name space of the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
554 * current issuer certificate.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
555 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
556 rv = CERT_CompareNameSpace(issuerCert, namesList, certsList,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
557 arena, &badCert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
558 if (rv != SECSuccess || badCert != NULL) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
559 PORT_SetError(SEC_ERROR_CERT_NOT_IN_NAME_SPACE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
560 LOG_ERROR_OR_EXIT(log, badCert, count + 1, 0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
561 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
562 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
563
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
564 /* XXX - the error logging may need to go down into CRL stuff at some
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
565 * point
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
566 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
567 /* check revoked list (issuer) */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
568 rv = SEC_CheckCRL(handle, subjectCert, issuerCert, t, wincx);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
569 if (rv == SECFailure) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
570 if (revoked) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
571 *revoked = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
572 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
573 LOG_ERROR_OR_EXIT(log,subjectCert,count,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
574 } else if (rv == SECWouldBlock) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
575 /* We found something fishy, so we intend to issue an
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
576 * error to the user, but the user may wish to continue
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
577 * processing, in which case we better make sure nothing
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
578 * worse has happened... so keep cranking the loop */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
579 rvFinal = SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
580 if (revoked) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
581 *revoked = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
582 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
583 LOG_ERROR(log,subjectCert,count,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
584 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
585
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
586 if ( CERT_GetCertTrust(issuerCert, &issuerTrust) == SECSuccess) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
587 /* we have some trust info, but this does NOT imply that this
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
588 * cert is actually trusted for any purpose. The cert may be
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
589 * explicitly UNtrusted. We won't know until we examine the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
590 * trust bits.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
591 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
592 unsigned int flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
593
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
594 if (certUsage != certUsageAnyCA &&
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
595 certUsage != certUsageStatusResponder) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
596
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
597 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
598 * XXX This choice of trustType seems arbitrary.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
599 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
600 if ( certUsage == certUsageVerifyCA ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
601 if ( subjectCert->nsCertType & NS_CERT_TYPE_EMAIL_CA ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
602 trustType = trustEmail;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
603 } else if ( subjectCert->nsCertType & NS_CERT_TYPE_SSL_CA ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
604 trustType = trustSSL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
605 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
606 trustType = trustObjectSigning;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
607 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
608 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
609
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
610 flags = SEC_GET_TRUST_FLAGS(&issuerTrust, trustType);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
611 if (( flags & requiredFlags ) == requiredFlags) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
612 /* we found a trusted one, so return */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
613 rv = rvFinal;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
614 goto done;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
615 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
616 if (flags & CERTDB_VALID_CA) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
617 validCAOverride = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
618 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
619 /* is it explicitly distrusted? */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
620 if ((flags & CERTDB_TERMINAL_RECORD) &&
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
621 ((flags & (CERTDB_TRUSTED|CERTDB_TRUSTED_CA)) == 0)) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
622 /* untrusted -- the cert is explicitly untrusted, not
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
623 * just that it doesn't chain to a trusted cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
624 PORT_SetError(SEC_ERROR_UNTRUSTED_ISSUER);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
625 LOG_ERROR_OR_EXIT(log,issuerCert,count+1,flags);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
626 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
627 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
628 /* Check if we have any valid trust when cheching for
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
629 * certUsageAnyCA or certUsageStatusResponder. */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
630 for (trustType = trustSSL; trustType < trustTypeNone;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
631 trustType++) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
632 flags = SEC_GET_TRUST_FLAGS(&issuerTrust, trustType);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
633 if ((flags & requiredFlags) == requiredFlags) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
634 rv = rvFinal;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
635 goto done;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
636 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
637 if (flags & CERTDB_VALID_CA)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
638 validCAOverride = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
639 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
640 /* We have 2 separate loops because we want any single trust
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
641 * bit to allow this usage to return trusted. Only if none of
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
642 * the trust bits are on do we check to see if the cert is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
643 * untrusted */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
644 for (trustType = trustSSL; trustType < trustTypeNone;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
645 trustType++) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
646 flags = SEC_GET_TRUST_FLAGS(&issuerTrust, trustType);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
647 /* is it explicitly distrusted? */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
648 if ((flags & CERTDB_TERMINAL_RECORD) &&
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
649 ((flags & (CERTDB_TRUSTED|CERTDB_TRUSTED_CA)) == 0)) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
650 /* untrusted -- the cert is explicitly untrusted, not
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
651 * just that it doesn't chain to a trusted cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
652 PORT_SetError(SEC_ERROR_UNTRUSTED_ISSUER);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
653 LOG_ERROR_OR_EXIT(log,issuerCert,count+1,flags);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
654 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
655 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
656 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
657 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
658
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
659 if (!validCAOverride) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
660 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
661 * Make sure that if this is an intermediate CA in the chain that
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
662 * it was given permission by its signer to be a CA.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
663 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
664 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
665 * if basicConstraints says it is a ca, then we check the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
666 * nsCertType. If the nsCertType has any CA bits set, then
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
667 * it must have the right one.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
668 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
669 if (!isca || (issuerCert->nsCertType & NS_CERT_TYPE_CA)) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
670 isca = (issuerCert->nsCertType & caCertType) ? PR_TRUE : PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
671 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
672
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
673 if ( !isca ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
674 PORT_SetError(SEC_ERROR_CA_CERT_INVALID);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
675 LOG_ERROR_OR_EXIT(log,issuerCert,count+1,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
676 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
677
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
678 /* make sure key usage allows cert signing */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
679 if (CERT_CheckKeyUsage(issuerCert, requiredCAKeyUsage) != SECSuccess) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
680 PORT_SetError(SEC_ERROR_INADEQUATE_KEY_USAGE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
681 LOG_ERROR_OR_EXIT(log,issuerCert,count+1,requiredCAKeyUsage);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
682 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
683 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
684
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
685 /* make sure that the issuer is not self signed. If it is, then
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
686 * stop here to prevent looping.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
687 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
688 if (issuerCert->isRoot) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
689 PORT_SetError(SEC_ERROR_UNTRUSTED_ISSUER);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
690 LOG_ERROR(log, issuerCert, count+1, 0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
691 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
692 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
693 /* The issuer cert will be the subject cert in the next loop.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
694 * A cert is self-issued if its subject and issuer are equal and
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
695 * both are of non-zero length.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
696 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
697 subjectCertIsSelfIssued = (PRBool)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
698 SECITEM_ItemsAreEqual(&issuerCert->derIssuer,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
699 &issuerCert->derSubject) &&
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
700 issuerCert->derSubject.len > 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
701 if (subjectCertIsSelfIssued == PR_FALSE) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
702 /* RFC 3280 says only non-self-issued intermediate CA certs
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
703 * count in path length.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
704 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
705 ++currentPathLen;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
706 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
707
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
708 CERT_DestroyCertificate(subjectCert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
709 subjectCert = issuerCert;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
710 issuerCert = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
711 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
712
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
713 PORT_SetError(SEC_ERROR_UNKNOWN_ISSUER);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
714 LOG_ERROR(log,subjectCert,count,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
715 loser:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
716 rv = SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
717 done:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
718 if (certsList != NULL) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
719 PORT_Free(certsList);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
720 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
721 if ( issuerCert ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
722 CERT_DestroyCertificate(issuerCert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
723 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
724
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
725 if ( subjectCert ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
726 CERT_DestroyCertificate(subjectCert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
727 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
728
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
729 if ( arena != NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
730 PORT_FreeArena(arena, PR_FALSE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
731 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
732 return rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
733 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
734
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
735 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
736 cert_VerifyCertChain(CERTCertDBHandle *handle, CERTCertificate *cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
737 PRBool checkSig, PRBool* sigerror,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
738 SECCertUsage certUsage, PRTime t, void *wincx,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
739 CERTVerifyLog *log, PRBool* revoked)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
740 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
741 if (CERT_GetUsePKIXForValidation()) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
742 return cert_VerifyCertChainPkix(cert, checkSig, certUsage, t,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
743 wincx, log, sigerror, revoked);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
744 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
745 return cert_VerifyCertChainOld(handle, cert, checkSig, sigerror,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
746 certUsage, t, wincx, log, revoked);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
747 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
748
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
749 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
750 CERT_VerifyCertChain(CERTCertDBHandle *handle, CERTCertificate *cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
751 PRBool checkSig, SECCertUsage certUsage, PRTime t,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
752 void *wincx, CERTVerifyLog *log)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
753 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
754 return cert_VerifyCertChain(handle, cert, checkSig, NULL, certUsage, t,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
755 wincx, log, NULL);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
756 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
757
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
758 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
759 * verify that a CA can sign a certificate with the requested usage.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
760 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
761 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
762 CERT_VerifyCACertForUsage(CERTCertDBHandle *handle, CERTCertificate *cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
763 PRBool checkSig, SECCertUsage certUsage, PRTime t,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
764 void *wincx, CERTVerifyLog *log)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
765 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
766 SECTrustType trustType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
767 CERTBasicConstraints basicConstraint;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
768 PRBool isca;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
769 PRBool validCAOverride = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
770 SECStatus rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
771 SECStatus rvFinal = SECSuccess;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
772 unsigned int flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
773 unsigned int caCertType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
774 unsigned int requiredCAKeyUsage;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
775 unsigned int requiredFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
776 CERTCertificate *issuerCert;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
777 CERTCertTrust certTrust;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
778
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
779
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
780 if (CERT_KeyUsageAndTypeForCertUsage(certUsage, PR_TRUE,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
781 &requiredCAKeyUsage,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
782 &caCertType) != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
783 PORT_Assert(0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
784 EXIT_IF_NOT_LOGGING(log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
785 requiredCAKeyUsage = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
786 caCertType = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
787 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
788
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
789 switch ( certUsage ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
790 case certUsageSSLClient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
791 case certUsageSSLServer:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
792 case certUsageSSLCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
793 case certUsageSSLServerWithStepUp:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
794 case certUsageEmailSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
795 case certUsageEmailRecipient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
796 case certUsageObjectSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
797 case certUsageVerifyCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
798 case certUsageStatusResponder:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
799 if ( CERT_TrustFlagsForCACertUsage(certUsage, &requiredFlags,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
800 &trustType) != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
801 PORT_Assert(0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
802 EXIT_IF_NOT_LOGGING(log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
803 requiredFlags = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
804 trustType = trustSSL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
805 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
806 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
807 default:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
808 PORT_Assert(0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
809 EXIT_IF_NOT_LOGGING(log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
810 requiredFlags = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
811 trustType = trustSSL;/* This used to be 0, but we need something
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
812 * that matches the enumeration type.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
813 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
814 caCertType = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
815 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
816
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
817 /* If the basicConstraint extension is included in an intermmediate CA
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
818 * certificate, make sure that the isCA flag is on. If the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
819 * pathLenConstraint component exists, it must be greater than the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
820 * number of CA certificates we have seen so far. If the extension
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
821 * is omitted, we will assume that this is a CA certificate with
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
822 * an unlimited pathLenConstraint (since it already passes the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
823 * netscape-cert-type extension checking).
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
824 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
825
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
826 rv = CERT_FindBasicConstraintExten(cert, &basicConstraint);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
827 if ( rv != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
828 if (PORT_GetError() != SEC_ERROR_EXTENSION_NOT_FOUND) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
829 LOG_ERROR_OR_EXIT(log,cert,0,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
830 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
831 /* no basic constraints found, we aren't (yet) a CA. */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
832 isca = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
833 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
834 if ( basicConstraint.isCA == PR_FALSE ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
835 PORT_SetError (SEC_ERROR_CA_CERT_INVALID);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
836 LOG_ERROR_OR_EXIT(log,cert,0,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
837 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
838
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
839 /* can't check path length if we don't know the previous path */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
840 isca = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
841 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
842
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
843 if ( CERT_GetCertTrust(cert, &certTrust) == SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
844 /* we have some trust info, but this does NOT imply that this
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
845 * cert is actually trusted for any purpose. The cert may be
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
846 * explicitly UNtrusted. We won't know until we examine the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
847 * trust bits.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
848 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
849 if (certUsage == certUsageStatusResponder) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
850 /* Check the special case of certUsageStatusResponder */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
851 issuerCert = CERT_FindCertIssuer(cert, t, certUsage);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
852 if (issuerCert) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
853 if (SEC_CheckCRL(handle, cert, issuerCert, t, wincx)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
854 != SECSuccess) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
855 PORT_SetError(SEC_ERROR_REVOKED_CERTIFICATE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
856 CERT_DestroyCertificate(issuerCert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
857 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
858 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
859 CERT_DestroyCertificate(issuerCert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
860 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
861 /* XXX We have NOT determined that this cert is trusted.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
862 * For years, NSS has treated this as trusted,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
863 * but it seems incorrect.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
864 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
865 rv = rvFinal;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
866 goto done;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
867 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
868
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
869 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
870 * check the trust params of the issuer
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
871 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
872 flags = SEC_GET_TRUST_FLAGS(&certTrust, trustType);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
873 if ( ( flags & requiredFlags ) == requiredFlags) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
874 /* we found a trusted one, so return */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
875 rv = rvFinal;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
876 goto done;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
877 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
878 if (flags & CERTDB_VALID_CA) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
879 validCAOverride = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
880 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
881 /* is it explicitly distrusted? */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
882 if ((flags & CERTDB_TERMINAL_RECORD) &&
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
883 ((flags & (CERTDB_TRUSTED|CERTDB_TRUSTED_CA)) == 0)) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
884 /* untrusted -- the cert is explicitly untrusted, not
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
885 * just that it doesn't chain to a trusted cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
886 PORT_SetError(SEC_ERROR_UNTRUSTED_CERT);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
887 LOG_ERROR_OR_EXIT(log,cert,0,flags);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
888 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
889 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
890 if (!validCAOverride) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
891 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
892 * Make sure that if this is an intermediate CA in the chain that
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
893 * it was given permission by its signer to be a CA.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
894 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
895 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
896 * if basicConstraints says it is a ca, then we check the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
897 * nsCertType. If the nsCertType has any CA bits set, then
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
898 * it must have the right one.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
899 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
900 if (!isca || (cert->nsCertType & NS_CERT_TYPE_CA)) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
901 isca = (cert->nsCertType & caCertType) ? PR_TRUE : PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
902 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
903
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
904 if (!isca) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
905 PORT_SetError(SEC_ERROR_CA_CERT_INVALID);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
906 LOG_ERROR_OR_EXIT(log,cert,0,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
907 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
908
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
909 /* make sure key usage allows cert signing */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
910 if (CERT_CheckKeyUsage(cert, requiredCAKeyUsage) != SECSuccess) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
911 PORT_SetError(SEC_ERROR_INADEQUATE_KEY_USAGE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
912 LOG_ERROR_OR_EXIT(log,cert,0,requiredCAKeyUsage);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
913 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
914 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
915 /* make sure that the issuer is not self signed. If it is, then
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
916 * stop here to prevent looping.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
917 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
918 if (cert->isRoot) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
919 PORT_SetError(SEC_ERROR_UNTRUSTED_ISSUER);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
920 LOG_ERROR(log, cert, 0, 0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
921 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
922 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
923
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
924 return CERT_VerifyCertChain(handle, cert, checkSig, certUsage, t,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
925 wincx, log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
926 loser:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
927 rv = SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
928 done:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
929 return rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
930 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
931
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
932 #define NEXT_USAGE() { \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
933 i*=2; \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
934 certUsage++; \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
935 continue; \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
936 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
937
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
938 #define VALID_USAGE() { \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
939 NEXT_USAGE(); \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
940 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
941
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
942 #define INVALID_USAGE() { \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
943 if (returnedUsages) { \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
944 *returnedUsages &= (~i); \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
945 } \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
946 if (PR_TRUE == requiredUsage) { \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
947 valid = SECFailure; \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
948 } \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
949 NEXT_USAGE(); \
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
950 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
951
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
952 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
953 * check the leaf cert against trust and usage.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
954 * returns success if the cert is not distrusted. If the cert is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
955 * trusted, then the trusted bool will be true.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
956 * returns failure if the cert is distrusted. If failure, flags
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
957 * will return the flag bits that indicated distrust.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
958 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
959 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
960 cert_CheckLeafTrust(CERTCertificate *cert, SECCertUsage certUsage,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
961 unsigned int *failedFlags, PRBool *trusted)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
962 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
963 unsigned int flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
964 CERTCertTrust trust;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
965
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
966 *failedFlags = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
967 *trusted = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
968
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
969 /* check trust flags to see if this cert is directly trusted */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
970 if ( CERT_GetCertTrust(cert, &trust) == SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
971 switch ( certUsage ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
972 case certUsageSSLClient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
973 case certUsageSSLServer:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
974 flags = trust.sslFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
975
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
976 /* is the cert directly trusted or not trusted ? */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
977 if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
978 * authoritative */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
979 if ( flags & CERTDB_TRUSTED ) { /* trust this cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
980 *trusted = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
981 return SECSuccess;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
982 } else { /* don't trust this cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
983 *failedFlags = flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
984 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
985 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
986 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
987 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
988 case certUsageSSLServerWithStepUp:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
989 /* XXX - step up certs can't be directly trusted, only distrust */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
990 flags = trust.sslFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
991 if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
992 * authoritative */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
993 if (( flags & CERTDB_TRUSTED ) == 0) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
994 /* don't trust this cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
995 *failedFlags = flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
996 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
997 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
998 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
999 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1000 case certUsageSSLCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1001 flags = trust.sslFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1002 if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1003 * authoritative */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1004 if (( flags & (CERTDB_TRUSTED|CERTDB_TRUSTED_CA) ) == 0) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1005 /* don't trust this cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1006 *failedFlags = flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1007 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1008 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1009 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1010 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1011 case certUsageEmailSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1012 case certUsageEmailRecipient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1013 flags = trust.emailFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1014 if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1015 * authoritative */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1016 if ( flags & CERTDB_TRUSTED ) { /* trust this cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1017 *trusted = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1018 return SECSuccess;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1019 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1020 else { /* don't trust this cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1021 *failedFlags = flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1022 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1023 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1024 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1025
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1026 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1027 case certUsageObjectSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1028 flags = trust.objectSigningFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1029
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1030 if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1031 * authoritative */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1032 if ( flags & CERTDB_TRUSTED ) { /* trust this cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1033 *trusted = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1034 return SECSuccess;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1035 } else { /* don't trust this cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1036 *failedFlags = flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1037 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1038 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1039 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1040 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1041 case certUsageVerifyCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1042 case certUsageStatusResponder:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1043 flags = trust.sslFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1044 /* is the cert directly trusted or not trusted ? */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1045 if ( ( flags & ( CERTDB_VALID_CA | CERTDB_TRUSTED_CA ) ) ==
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1046 ( CERTDB_VALID_CA | CERTDB_TRUSTED_CA ) ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1047 *trusted = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1048 return SECSuccess;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1049 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1050 flags = trust.emailFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1051 /* is the cert directly trusted or not trusted ? */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1052 if ( ( flags & ( CERTDB_VALID_CA | CERTDB_TRUSTED_CA ) ) ==
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1053 ( CERTDB_VALID_CA | CERTDB_TRUSTED_CA ) ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1054 *trusted = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1055 return SECSuccess;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1056 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1057 flags = trust.objectSigningFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1058 /* is the cert directly trusted or not trusted ? */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1059 if ( ( flags & ( CERTDB_VALID_CA | CERTDB_TRUSTED_CA ) ) ==
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1060 ( CERTDB_VALID_CA | CERTDB_TRUSTED_CA ) ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1061 *trusted = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1062 return SECSuccess;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1063 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1064 /* fall through to test distrust */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1065 case certUsageAnyCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1066 case certUsageUserCertImport:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1067 /* do we distrust these certs explicitly */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1068 flags = trust.sslFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1069 if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1070 * authoritative */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1071 if ((flags & (CERTDB_TRUSTED|CERTDB_TRUSTED_CA)) == 0) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1072 *failedFlags = flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1073 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1074 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1075 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1076 flags = trust.emailFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1077 if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1078 * authoritative */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1079 if ((flags & (CERTDB_TRUSTED|CERTDB_TRUSTED_CA)) == 0) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1080 *failedFlags = flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1081 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1082 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1083 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1084 /* fall through */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1085 case certUsageProtectedObjectSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1086 flags = trust.objectSigningFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1087 if ( flags & CERTDB_TERMINAL_RECORD) { /* the trust record is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1088 * authoritative */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1089 if ((flags & (CERTDB_TRUSTED|CERTDB_TRUSTED_CA)) == 0) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1090 *failedFlags = flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1091 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1092 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1093 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1094 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1095 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1096 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1097 return SECSuccess;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1098 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1099
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1100 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1101 * verify a certificate by checking if it's valid and that we
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1102 * trust the issuer.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1103 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1104 * certificateUsage contains a bitfield of all cert usages that are
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1105 * required for verification to succeed
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1106 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1107 * a bitfield of cert usages is returned in *returnedUsages
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1108 * if requiredUsages is non-zero, the returned bitmap is only
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1109 * for those required usages, otherwise it is for all usages
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1110 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1111 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1112 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1113 CERT_VerifyCertificate(CERTCertDBHandle *handle, CERTCertificate *cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1114 PRBool checkSig, SECCertificateUsage requiredUsages, PRTime t,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1115 void *wincx, CERTVerifyLog *log, SECCertificateUsage* returnedUsages)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1116 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1117 SECStatus rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1118 SECStatus valid;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1119 unsigned int requiredKeyUsage;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1120 unsigned int requiredCertType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1121 unsigned int flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1122 unsigned int certType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1123 PRBool allowOverride;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1124 SECCertTimeValidity validity;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1125 CERTStatusConfig *statusConfig;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1126 PRInt32 i;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1127 SECCertUsage certUsage = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1128 PRBool checkedOCSP = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1129 PRBool checkAllUsages = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1130 PRBool revoked = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1131 PRBool sigerror = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1132 PRBool trusted = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1133
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1134 if (!requiredUsages) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1135 /* there are no required usages, so the user probably wants to
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1136 get status for all usages */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1137 checkAllUsages = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1138 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1139
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1140 if (returnedUsages) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1141 *returnedUsages = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1142 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1143 /* we don't have a place to return status for all usages,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1144 so we can skip checks for usages that aren't required */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1145 checkAllUsages = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1146 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1147 valid = SECSuccess ; /* start off assuming cert is valid */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1148
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1149 /* make sure that the cert is valid at time t */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1150 allowOverride = (PRBool)((requiredUsages & certificateUsageSSLServer) ||
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1151 (requiredUsages & certificateUsageSSLServerWithStepUp));
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1152 validity = CERT_CheckCertValidTimes(cert, t, allowOverride);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1153 if ( validity != secCertTimeValid ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1154 valid = SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1155 LOG_ERROR_OR_EXIT(log,cert,0,validity);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1156 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1157
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1158 /* check key usage and netscape cert type */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1159 cert_GetCertType(cert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1160 certType = cert->nsCertType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1161
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1162 for (i=1; i<=certificateUsageHighest &&
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1163 (SECSuccess == valid || returnedUsages || log) ; ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1164 PRBool requiredUsage = (i & requiredUsages) ? PR_TRUE : PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1165 if (PR_FALSE == requiredUsage && PR_FALSE == checkAllUsages) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1166 NEXT_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1167 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1168 if (returnedUsages) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1169 *returnedUsages |= i; /* start off assuming this usage is valid */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1170 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1171 switch ( certUsage ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1172 case certUsageSSLClient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1173 case certUsageSSLServer:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1174 case certUsageSSLServerWithStepUp:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1175 case certUsageSSLCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1176 case certUsageEmailSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1177 case certUsageEmailRecipient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1178 case certUsageObjectSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1179 case certUsageStatusResponder:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1180 rv = CERT_KeyUsageAndTypeForCertUsage(certUsage, PR_FALSE,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1181 &requiredKeyUsage,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1182 &requiredCertType);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1183 if ( rv != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1184 PORT_Assert(0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1185 /* EXIT_IF_NOT_LOGGING(log); XXX ??? */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1186 requiredKeyUsage = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1187 requiredCertType = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1188 INVALID_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1189 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1190 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1191
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1192 case certUsageAnyCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1193 case certUsageProtectedObjectSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1194 case certUsageUserCertImport:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1195 case certUsageVerifyCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1196 /* these usages cannot be verified */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1197 NEXT_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1198
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1199 default:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1200 PORT_Assert(0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1201 requiredKeyUsage = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1202 requiredCertType = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1203 INVALID_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1204 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1205 if ( CERT_CheckKeyUsage(cert, requiredKeyUsage) != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1206 if (PR_TRUE == requiredUsage) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1207 PORT_SetError(SEC_ERROR_INADEQUATE_KEY_USAGE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1208 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1209 LOG_ERROR(log,cert,0,requiredKeyUsage);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1210 INVALID_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1211 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1212 if ( !( certType & requiredCertType ) ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1213 if (PR_TRUE == requiredUsage) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1214 PORT_SetError(SEC_ERROR_INADEQUATE_CERT_TYPE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1215 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1216 LOG_ERROR(log,cert,0,requiredCertType);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1217 INVALID_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1218 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1219
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1220 rv = cert_CheckLeafTrust(cert, certUsage, &flags, &trusted);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1221 if (rv == SECFailure) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1222 if (PR_TRUE == requiredUsage) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1223 PORT_SetError(SEC_ERROR_UNTRUSTED_CERT);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1224 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1225 LOG_ERROR(log, cert, 0, flags);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1226 INVALID_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1227 } else if (trusted) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1228 VALID_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1229 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1230
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1231 if (PR_TRUE == revoked || PR_TRUE == sigerror) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1232 INVALID_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1233 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1234
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1235 rv = cert_VerifyCertChain(handle, cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1236 checkSig, &sigerror,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1237 certUsage, t, wincx, log,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1238 &revoked);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1239
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1240 if (rv != SECSuccess) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1241 /* EXIT_IF_NOT_LOGGING(log); XXX ???? */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1242 INVALID_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1243 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1244
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1245 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1246 * Check OCSP revocation status, but only if the cert we are checking
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1247 * is not a status responder itself. We only do this in the case
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1248 * where we checked the cert chain (above); explicit trust "wins"
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1249 * (avoids status checking, just as it avoids CRL checking) by
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1250 * bypassing this code.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1251 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1252
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1253 if (PR_FALSE == checkedOCSP) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1254 checkedOCSP = PR_TRUE; /* only check OCSP once */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1255 statusConfig = CERT_GetStatusConfig(handle);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1256 if (requiredUsages != certificateUsageStatusResponder &&
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1257 statusConfig != NULL) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1258 if (statusConfig->statusChecker != NULL) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1259 rv = (* statusConfig->statusChecker)(handle, cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1260 t, wincx);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1261 if (rv != SECSuccess) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1262 LOG_ERROR(log,cert,0,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1263 revoked = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1264 INVALID_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1265 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1266 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1267 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1268 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1269
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1270 NEXT_USAGE();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1271 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1272
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1273 loser:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1274 return(valid);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1275 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1276
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1277 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1278 CERT_VerifyCert(CERTCertDBHandle *handle, CERTCertificate *cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1279 PRBool checkSig, SECCertUsage certUsage, PRTime t,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1280 void *wincx, CERTVerifyLog *log)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1281 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1282 return cert_VerifyCertWithFlags(handle, cert, checkSig, certUsage, t,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1283 CERT_VERIFYCERT_USE_DEFAULTS, wincx, log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1284 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1285
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1286 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1287 cert_VerifyCertWithFlags(CERTCertDBHandle *handle, CERTCertificate *cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1288 PRBool checkSig, SECCertUsage certUsage, PRTime t,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1289 PRUint32 flags, void *wincx, CERTVerifyLog *log)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1290 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1291 SECStatus rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1292 unsigned int requiredKeyUsage;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1293 unsigned int requiredCertType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1294 unsigned int failedFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1295 unsigned int certType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1296 PRBool trusted;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1297 PRBool allowOverride;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1298 SECCertTimeValidity validity;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1299 CERTStatusConfig *statusConfig;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1300
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1301 #ifdef notdef
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1302 /* check if this cert is in the Evil list */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1303 rv = CERT_CheckForEvilCert(cert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1304 if ( rv != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1305 PORT_SetError(SEC_ERROR_REVOKED_CERTIFICATE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1306 LOG_ERROR_OR_EXIT(log,cert,0,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1307 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1308 #endif
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1309
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1310 /* make sure that the cert is valid at time t */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1311 allowOverride = (PRBool)((certUsage == certUsageSSLServer) ||
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1312 (certUsage == certUsageSSLServerWithStepUp));
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1313 validity = CERT_CheckCertValidTimes(cert, t, allowOverride);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1314 if ( validity != secCertTimeValid ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1315 LOG_ERROR_OR_EXIT(log,cert,0,validity);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1316 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1317
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1318 /* check key usage and netscape cert type */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1319 cert_GetCertType(cert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1320 certType = cert->nsCertType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1321 switch ( certUsage ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1322 case certUsageSSLClient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1323 case certUsageSSLServer:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1324 case certUsageSSLServerWithStepUp:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1325 case certUsageSSLCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1326 case certUsageEmailSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1327 case certUsageEmailRecipient:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1328 case certUsageObjectSigner:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1329 case certUsageStatusResponder:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1330 rv = CERT_KeyUsageAndTypeForCertUsage(certUsage, PR_FALSE,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1331 &requiredKeyUsage,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1332 &requiredCertType);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1333 if ( rv != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1334 PORT_Assert(0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1335 EXIT_IF_NOT_LOGGING(log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1336 requiredKeyUsage = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1337 requiredCertType = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1338 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1339 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1340 case certUsageVerifyCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1341 case certUsageAnyCA:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1342 requiredKeyUsage = KU_KEY_CERT_SIGN;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1343 requiredCertType = NS_CERT_TYPE_CA;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1344 if ( ! ( certType & NS_CERT_TYPE_CA ) ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1345 certType |= NS_CERT_TYPE_CA;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1346 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1347 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1348 default:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1349 PORT_Assert(0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1350 EXIT_IF_NOT_LOGGING(log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1351 requiredKeyUsage = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1352 requiredCertType = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1353 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1354 if ( CERT_CheckKeyUsage(cert, requiredKeyUsage) != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1355 PORT_SetError(SEC_ERROR_INADEQUATE_KEY_USAGE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1356 LOG_ERROR_OR_EXIT(log,cert,0,requiredKeyUsage);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1357 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1358 if ( !( certType & requiredCertType ) ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1359 PORT_SetError(SEC_ERROR_INADEQUATE_CERT_TYPE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1360 LOG_ERROR_OR_EXIT(log,cert,0,requiredCertType);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1361 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1362
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1363 rv = cert_CheckLeafTrust(cert, certUsage, &failedFlags, &trusted);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1364 if (rv == SECFailure) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1365 PORT_SetError(SEC_ERROR_UNTRUSTED_CERT);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1366 LOG_ERROR_OR_EXIT(log, cert, 0, failedFlags);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1367 } else if (trusted) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1368 goto done;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1369 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1370
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1371
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1372 rv = CERT_VerifyCertChain(handle, cert, checkSig, certUsage,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1373 t, wincx, log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1374 if (rv != SECSuccess) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1375 EXIT_IF_NOT_LOGGING(log);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1376 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1377
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1378 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1379 * Check revocation status, but only if the cert we are checking is not a
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1380 * status responder itself and the caller did not ask us to skip the check.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1381 * We only do this in the case where we checked the cert chain (above);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1382 * explicit trust "wins" (avoids status checking, just as it avoids CRL
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1383 * checking, which is all done inside VerifyCertChain) by bypassing this
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1384 * code.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1385 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1386 if (!(flags & CERT_VERIFYCERT_SKIP_OCSP) &&
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1387 certUsage != certUsageStatusResponder) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1388 statusConfig = CERT_GetStatusConfig(handle);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1389 if (statusConfig && statusConfig->statusChecker) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1390 rv = (* statusConfig->statusChecker)(handle, cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1391 t, wincx);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1392 if (rv != SECSuccess) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1393 LOG_ERROR_OR_EXIT(log,cert,0,0);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1394 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1395 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1396 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1397
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1398 done:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1399 if (log && log->head) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1400 return SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1401 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1402 return(SECSuccess);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1403
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1404 loser:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1405 rv = SECFailure;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1406
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1407 return(rv);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1408 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1409
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1410 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1411 * verify a certificate by checking if its valid and that we
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1412 * trust the issuer. Verify time against now.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1413 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1414 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1415 CERT_VerifyCertificateNow(CERTCertDBHandle *handle, CERTCertificate *cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1416 PRBool checkSig, SECCertificateUsage requiredUsages,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1417 void *wincx, SECCertificateUsage* returnedUsages)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1418 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1419 return(CERT_VerifyCertificate(handle, cert, checkSig,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1420 requiredUsages, PR_Now(), wincx, NULL, returnedUsages));
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1421 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1422
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1423 /* obsolete, do not use for new code */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1424 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1425 CERT_VerifyCertNow(CERTCertDBHandle *handle, CERTCertificate *cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1426 PRBool checkSig, SECCertUsage certUsage, void *wincx)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1427 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1428 return(CERT_VerifyCert(handle, cert, checkSig,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1429 certUsage, PR_Now(), wincx, NULL));
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1430 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1431
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1432
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1433 /* [ FROM pcertdb.c ] */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1434 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1435 * Supported usage values and types:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1436 * certUsageSSLClient
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1437 * certUsageSSLServer
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1438 * certUsageSSLServerWithStepUp
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1439 * certUsageEmailSigner
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1440 * certUsageEmailRecipient
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1441 * certUsageObjectSigner
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1442 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1443
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1444 CERTCertificate *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1445 CERT_FindMatchingCert(CERTCertDBHandle *handle, SECItem *derName,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1446 CERTCertOwner owner, SECCertUsage usage,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1447 PRBool preferTrusted, PRTime validTime, PRBool validOnly)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1448 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1449 CERTCertList *certList = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1450 CERTCertificate *cert = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1451 CERTCertTrust certTrust;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1452 unsigned int requiredTrustFlags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1453 SECTrustType requiredTrustType;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1454 unsigned int flags;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1455
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1456 PRBool lookingForCA = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1457 SECStatus rv;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1458 CERTCertListNode *node;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1459 CERTCertificate *saveUntrustedCA = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1460
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1461 /* if preferTrusted is set, must be a CA cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1462 PORT_Assert( ! ( preferTrusted && ( owner != certOwnerCA ) ) );
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1463
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1464 if ( owner == certOwnerCA ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1465 lookingForCA = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1466 if ( preferTrusted ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1467 rv = CERT_TrustFlagsForCACertUsage(usage, &requiredTrustFlags,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1468 &requiredTrustType);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1469 if ( rv != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1470 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1471 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1472 requiredTrustFlags |= CERTDB_VALID_CA;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1473 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1474 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1475
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1476 certList = CERT_CreateSubjectCertList(NULL, handle, derName, validTime,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1477 validOnly);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1478 if ( certList != NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1479 rv = CERT_FilterCertListByUsage(certList, usage, lookingForCA);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1480 if ( rv != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1481 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1482 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1483
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1484 node = CERT_LIST_HEAD(certList);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1485
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1486 while ( !CERT_LIST_END(node, certList) ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1487 cert = node->cert;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1488
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1489 /* looking for a trusted CA cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1490 if ( ( owner == certOwnerCA ) && preferTrusted &&
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1491 ( requiredTrustType != trustTypeNone ) ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1492
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1493 if ( CERT_GetCertTrust(cert, &certTrust) != SECSuccess ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1494 flags = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1495 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1496 flags = SEC_GET_TRUST_FLAGS(&certTrust, requiredTrustType);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1497 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1498
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1499 if ( ( flags & requiredTrustFlags ) != requiredTrustFlags ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1500 /* cert is not trusted */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1501 /* if this is the first cert to get this far, then save
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1502 * it, so we can use it if we can't find a trusted one
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1503 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1504 if ( saveUntrustedCA == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1505 saveUntrustedCA = cert;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1506 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1507 goto endloop;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1508 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1509 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1510 /* if we got this far, then this cert meets all criteria */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1511 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1512
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1513 endloop:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1514 node = CERT_LIST_NEXT(node);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1515 cert = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1516 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1517
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1518 /* use the saved one if we have it */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1519 if ( cert == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1520 cert = saveUntrustedCA;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1521 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1522
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1523 /* if we found one then bump the ref count before freeing the list */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1524 if ( cert != NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1525 /* bump the ref count */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1526 cert = CERT_DupCertificate(cert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1527 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1528
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1529 CERT_DestroyCertList(certList);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1530 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1531
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1532 return(cert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1533
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1534 loser:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1535 if ( certList != NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1536 CERT_DestroyCertList(certList);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1537 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1538
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1539 return(NULL);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1540 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1541
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1542
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1543 /* [ From certdb.c ] */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1544 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1545 * Filter a list of certificates, removing those certs that do not have
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1546 * one of the named CA certs somewhere in their cert chain.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1547 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1548 * "certList" - the list of certificates to filter
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1549 * "nCANames" - number of CA names
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1550 * "caNames" - array of CA names in string(rfc 1485) form
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1551 * "usage" - what use the certs are for, this is used when
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1552 * selecting CA certs
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1553 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1554 SECStatus
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1555 CERT_FilterCertListByCANames(CERTCertList *certList, int nCANames,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1556 char **caNames, SECCertUsage usage)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1557 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1558 CERTCertificate *issuerCert = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1559 CERTCertificate *subjectCert;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1560 CERTCertListNode *node, *freenode;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1561 CERTCertificate *cert;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1562 int n;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1563 char **names;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1564 PRBool found;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1565 PRTime time;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1566
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1567 if ( nCANames <= 0 ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1568 return(SECSuccess);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1569 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1570
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1571 time = PR_Now();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1572
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1573 node = CERT_LIST_HEAD(certList);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1574
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1575 while ( ! CERT_LIST_END(node, certList) ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1576 cert = node->cert;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1577
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1578 subjectCert = CERT_DupCertificate(cert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1579
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1580 /* traverse the CA certs for this cert */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1581 found = PR_FALSE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1582 while ( subjectCert != NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1583 n = nCANames;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1584 names = caNames;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1585
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1586 if (subjectCert->issuerName != NULL) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1587 while ( n > 0 ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1588 if ( PORT_Strcmp(*names, subjectCert->issuerName) == 0 ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1589 found = PR_TRUE;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1590 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1591 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1592
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1593 n--;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1594 names++;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1595 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1596 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1597
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1598 if ( found ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1599 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1600 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1601
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1602 issuerCert = CERT_FindCertIssuer(subjectCert, time, usage);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1603 if ( issuerCert == subjectCert ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1604 CERT_DestroyCertificate(issuerCert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1605 issuerCert = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1606 break;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1607 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1608 CERT_DestroyCertificate(subjectCert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1609 subjectCert = issuerCert;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1610
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1611 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1612 CERT_DestroyCertificate(subjectCert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1613 if ( !found ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1614 /* CA was not found, so remove this cert from the list */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1615 freenode = node;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1616 node = CERT_LIST_NEXT(node);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1617 CERT_RemoveCertListNode(freenode);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1618 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1619 /* CA was found, so leave it in the list */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1620 node = CERT_LIST_NEXT(node);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1621 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1622 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1623
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1624 return(SECSuccess);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1625 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1626
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1627 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1628 * Given a certificate, return a string containing the nickname, and possibly
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1629 * one of the validity strings, based on the current validity state of the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1630 * certificate.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1631 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1632 * "arena" - arena to allocate returned string from. If NULL, then heap
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1633 * is used.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1634 * "cert" - the cert to get nickname from
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1635 * "expiredString" - the string to append to the nickname if the cert is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1636 * expired.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1637 * "notYetGoodString" - the string to append to the nickname if the cert is
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1638 * not yet good.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1639 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1640 char *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1641 CERT_GetCertNicknameWithValidity(PLArenaPool *arena, CERTCertificate *cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1642 char *expiredString, char *notYetGoodString)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1643 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1644 SECCertTimeValidity validity;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1645 char *nickname = NULL, *tmpstr = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1646
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1647 validity = CERT_CheckCertValidTimes(cert, PR_Now(), PR_FALSE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1648
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1649 /* if the cert is good, then just use the nickname directly */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1650 if ( validity == secCertTimeValid ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1651 if ( arena == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1652 nickname = PORT_Strdup(cert->nickname);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1653 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1654 nickname = PORT_ArenaStrdup(arena, cert->nickname);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1655 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1656
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1657 if ( nickname == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1658 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1659 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1660 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1661
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1662 /* if the cert is not valid, then tack one of the strings on the
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1663 * end
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1664 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1665 if ( validity == secCertTimeExpired ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1666 tmpstr = PR_smprintf("%s%s", cert->nickname,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1667 expiredString);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1668 } else if ( validity == secCertTimeNotValidYet ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1669 /* not yet valid */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1670 tmpstr = PR_smprintf("%s%s", cert->nickname,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1671 notYetGoodString);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1672 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1673 /* undetermined */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1674 tmpstr = PR_smprintf("%s",
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1675 "(NULL) (Validity Unknown)");
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1676 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1677
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1678 if ( tmpstr == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1679 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1680 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1681
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1682 if ( arena ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1683 /* copy the string into the arena and free the malloc'd one */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1684 nickname = PORT_ArenaStrdup(arena, tmpstr);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1685 PORT_Free(tmpstr);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1686 } else {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1687 nickname = tmpstr;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1688 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1689 if ( nickname == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1690 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1691 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1692 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1693 return(nickname);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1694
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1695 loser:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1696 return(NULL);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1697 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1698
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1699 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1700 * Collect the nicknames from all certs in a CertList. If the cert is not
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1701 * valid, append a string to that nickname.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1702 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1703 * "certList" - the list of certificates
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1704 * "expiredString" - the string to append to the nickname of any expired cert
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1705 * "notYetGoodString" - the string to append to the nickname of any cert
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1706 * that is not yet valid
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1707 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1708 CERTCertNicknames *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1709 CERT_NicknameStringsFromCertList(CERTCertList *certList, char *expiredString,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1710 char *notYetGoodString)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1711 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1712 CERTCertNicknames *names;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1713 PLArenaPool *arena;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1714 CERTCertListNode *node;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1715 char **nn;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1716
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1717 /* allocate an arena */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1718 arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1719 if ( arena == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1720 return(NULL);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1721 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1722
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1723 /* allocate the structure */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1724 names = PORT_ArenaAlloc(arena, sizeof(CERTCertNicknames));
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1725 if ( names == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1726 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1727 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1728
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1729 /* init the structure */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1730 names->arena = arena;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1731 names->head = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1732 names->numnicknames = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1733 names->nicknames = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1734 names->totallen = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1735
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1736 /* count the certs in the list */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1737 node = CERT_LIST_HEAD(certList);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1738 while ( ! CERT_LIST_END(node, certList) ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1739 names->numnicknames++;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1740 node = CERT_LIST_NEXT(node);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1741 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1742
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1743 /* allocate nicknames array */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1744 names->nicknames = PORT_ArenaAlloc(arena,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1745 sizeof(char *) * names->numnicknames);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1746 if ( names->nicknames == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1747 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1748 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1749
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1750 /* just in case printf can't deal with null strings */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1751 if (expiredString == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1752 expiredString = "";
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1753 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1754
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1755 if ( notYetGoodString == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1756 notYetGoodString = "";
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1757 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1758
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1759 /* traverse the list of certs and collect the nicknames */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1760 nn = names->nicknames;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1761 node = CERT_LIST_HEAD(certList);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1762 while ( ! CERT_LIST_END(node, certList) ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1763 *nn = CERT_GetCertNicknameWithValidity(arena, node->cert,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1764 expiredString,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1765 notYetGoodString);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1766 if ( *nn == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1767 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1768 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1769
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1770 names->totallen += PORT_Strlen(*nn);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1771
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1772 nn++;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1773 node = CERT_LIST_NEXT(node);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1774 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1775
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1776 return(names);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1777
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1778 loser:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1779 PORT_FreeArena(arena, PR_FALSE);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1780 return(NULL);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1781 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1782
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1783 /*
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1784 * Extract the nickname from a nickmake string that may have either
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1785 * expiredString or notYetGoodString appended.
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1786 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1787 * Args:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1788 * "namestring" - the string containing the nickname, and possibly
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1789 * one of the validity label strings
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1790 * "expiredString" - the expired validity label string
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1791 * "notYetGoodString" - the not yet good validity label string
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1792 *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1793 * Returns the raw nickname
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1794 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1795 char *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1796 CERT_ExtractNicknameString(char *namestring, char *expiredString,
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1797 char *notYetGoodString)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1798 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1799 int explen, nyglen, namelen;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1800 int retlen;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1801 char *retstr;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1802
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1803 namelen = PORT_Strlen(namestring);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1804 explen = PORT_Strlen(expiredString);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1805 nyglen = PORT_Strlen(notYetGoodString);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1806
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1807 if ( namelen > explen ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1808 if ( PORT_Strcmp(expiredString, &namestring[namelen-explen]) == 0 ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1809 retlen = namelen - explen;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1810 retstr = (char *)PORT_Alloc(retlen+1);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1811 if ( retstr == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1812 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1813 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1814
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1815 PORT_Memcpy(retstr, namestring, retlen);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1816 retstr[retlen] = '\0';
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1817 goto done;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1818 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1819 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1820
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1821 if ( namelen > nyglen ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1822 if ( PORT_Strcmp(notYetGoodString, &namestring[namelen-nyglen]) == 0) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1823 retlen = namelen - nyglen;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1824 retstr = (char *)PORT_Alloc(retlen+1);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1825 if ( retstr == NULL ) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1826 goto loser;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1827 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1828
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1829 PORT_Memcpy(retstr, namestring, retlen);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1830 retstr[retlen] = '\0';
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1831 goto done;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1832 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1833 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1834
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1835 /* if name string is shorter than either invalid string, then it must
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1836 * be a raw nickname
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1837 */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1838 retstr = PORT_Strdup(namestring);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1839
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1840 done:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1841 return(retstr);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1842
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1843 loser:
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1844 return(NULL);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1845 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1846
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1847 CERTCertList *
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1848 CERT_GetCertChainFromCert(CERTCertificate *cert, PRTime time, SECCertUsage usage)
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1849 {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1850 CERTCertList *chain = NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1851 int count = 0;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1852
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1853 if (NULL == cert) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1854 return NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1855 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1856
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1857 cert = CERT_DupCertificate(cert);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1858 if (NULL == cert) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1859 PORT_SetError(SEC_ERROR_NO_MEMORY);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1860 return NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1861 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1862
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1863 chain = CERT_NewCertList();
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1864 if (NULL == chain) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1865 PORT_SetError(SEC_ERROR_NO_MEMORY);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1866 return NULL;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1867 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1868
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1869 while (cert != NULL && ++count <= CERT_MAX_CERT_CHAIN) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1870 if (SECSuccess != CERT_AddCertToListTail(chain, cert)) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1871 /* return partial chain */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1872 PORT_SetError(SEC_ERROR_NO_MEMORY);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1873 return chain;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1874 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1875
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1876 if (cert->isRoot) {
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1877 /* return complete chain */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1878 return chain;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1879 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1880
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1881 cert = CERT_FindCertIssuer(cert, time, usage);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1882 }
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1883
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1884 /* return partial chain */
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1885 PORT_SetError(SEC_ERROR_UNKNOWN_ISSUER);
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1886 return chain;
1e5118fa0cb1 This is NSS with a Cmake Buildsyste
Andre Heinecke <andre.heinecke@intevation.de>
parents:
diff changeset
1887 }
This site is hosted by Intevation GmbH (Datenschutzerklärung und Impressum | Privacy Policy and Imprint)