andre@0: /* This Source Code Form is subject to the terms of the Mozilla Public
andre@0:  * License, v. 2.0. If a copy of the MPL was not distributed with this
andre@0:  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
andre@0: /*
andre@0:  * pkix_tools.c
andre@0:  *
andre@0:  * Private Utility Functions
andre@0:  *
andre@0:  */
andre@0: 
andre@0: #include "pkix_tools.h"
andre@0: 
andre@0: #define CACHE_ITEM_PERIOD_SECONDS  (3600)  /* one hour */
andre@0: 
andre@0: /*
andre@0:  * This cahce period is only for CertCache. A Cert from a trusted CertStore
andre@0:  * should be checked more frequently for update new arrival, etc.
andre@0:  */
andre@0: #define CACHE_TRUST_ITEM_PERIOD_SECONDS  (CACHE_ITEM_PERIOD_SECONDS/10)
andre@0: 
andre@0: extern PKIX_PL_HashTable *cachedCertChainTable;
andre@0: extern PKIX_PL_HashTable *cachedCertTable;
andre@0: extern PKIX_PL_HashTable *cachedCrlEntryTable;
andre@0: 
andre@0: /* Following variables are used to checked cache hits - can be taken out */
andre@0: extern int pkix_ccAddCount;
andre@0: extern int pkix_ccLookupCount;
andre@0: extern int pkix_ccRemoveCount;
andre@0: extern int pkix_cAddCount;
andre@0: extern int pkix_cLookupCount;
andre@0: extern int pkix_cRemoveCount;
andre@0: extern int pkix_ceAddCount;
andre@0: extern int pkix_ceLookupCount;
andre@0: 
andre@0: #ifdef PKIX_OBJECT_LEAK_TEST
andre@0: /* Following variables are used for object leak test */
andre@0: char *nonNullValue = "Non Empty Value";
andre@0: PKIX_Boolean noErrorState = PKIX_TRUE;
andre@0: PKIX_Boolean runningLeakTest;
andre@0: PKIX_Boolean errorGenerated;
andre@0: PKIX_UInt32 stackPosition;
andre@0: PKIX_UInt32 *fnStackInvCountArr;
andre@0: char **fnStackNameArr;
andre@0: PLHashTable *fnInvTable;
andre@0: PKIX_UInt32 testStartFnStackPosition;
andre@0: char *errorFnStackString;
andre@0: #endif /* PKIX_OBJECT_LEAK_TEST */
andre@0: 
andre@0: /* --Private-Functions-------------------------------------------- */
andre@0: 
andre@0: #ifdef PKIX_OBJECT_LEAK_TEST
andre@0: /*
andre@0:  * FUNCTION: pkix_ErrorGen_Hash
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  * Hash function to be used in object leak test hash table.
andre@0:  *
andre@0:  */
andre@0: PLHashNumber PR_CALLBACK
andre@0: pkix_ErrorGen_Hash (const void *key)
andre@0: {
andre@0:     char *str = NULL;
andre@0:     PLHashNumber rv = (*(PRUint8*)key) << 5;
andre@0:     PRUint32 i, counter = 0;
andre@0:     PRUint8 *rvc = (PRUint8 *)&rv;
andre@0: 
andre@0:     while ((str = fnStackNameArr[counter++]) != NULL) {
andre@0:         PRUint32 len = strlen(str);
andre@0:         for( i = 0; i < len; i++ ) {
andre@0:             rvc[ i % sizeof(rv) ] ^= *str;
andre@0:             str++;
andre@0:         }
andre@0:     }
andre@0: 
andre@0:     return rv;
andre@0: }
andre@0: 
andre@0: #endif /* PKIX_OBJECT_LEAK_TEST */
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: pkix_IsCertSelfIssued
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Checks whether the Cert pointed to by "cert" is self-issued and stores the
andre@0:  *  Boolean result at "pSelfIssued". A Cert is considered self-issued if the
andre@0:  *  Cert's issuer matches the Cert's subject. If the subject or issuer is
andre@0:  *  not specified, a PKIX_FALSE is returned.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "cert"
andre@0:  *      Address of Cert used to determine whether Cert is self-issued.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pSelfIssued"
andre@0:  *      Address where Boolean will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Cert Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: pkix_IsCertSelfIssued(
andre@0:         PKIX_PL_Cert *cert,
andre@0:         PKIX_Boolean *pSelfIssued,
andre@0:         void *plContext)
andre@0: {
andre@0:         PKIX_PL_X500Name *subject = NULL;
andre@0:         PKIX_PL_X500Name *issuer = NULL;
andre@0: 
andre@0:         PKIX_ENTER(CERT, "pkix_IsCertSelfIssued");
andre@0:         PKIX_NULLCHECK_TWO(cert, pSelfIssued);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_PL_Cert_GetSubject(cert, &subject, plContext),
andre@0:                     PKIX_CERTGETSUBJECTFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_PL_Cert_GetIssuer(cert, &issuer, plContext),
andre@0:                     PKIX_CERTGETISSUERFAILED);
andre@0: 
andre@0:         if (subject == NULL || issuer == NULL) {
andre@0:                 *pSelfIssued = PKIX_FALSE;
andre@0:         } else {
andre@0: 
andre@0:                 PKIX_CHECK(PKIX_PL_X500Name_Match
andre@0:                     (subject, issuer, pSelfIssued, plContext),
andre@0:                     PKIX_X500NAMEMATCHFAILED);
andre@0:         }
andre@0: 
andre@0: cleanup:
andre@0:         PKIX_DECREF(subject);
andre@0:         PKIX_DECREF(issuer);
andre@0: 
andre@0:         PKIX_RETURN(CERT);
andre@0: }
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: pkix_Throw
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Creates an Error using the value of "errorCode", the character array
andre@0:  *  pointed to by "funcName", the character array pointed to by "errorText",
andre@0:  *  and the Error pointed to by "cause" (if any), and stores it at "pError".
andre@0:  *
andre@0:  *  If "cause" is not NULL and has an errorCode of "PKIX_FATAL_ERROR",
andre@0:  *  then there is no point creating a new Error object. Rather, we simply
andre@0:  *  store "cause" at "pError".
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "errorCode"
andre@0:  *      Value of error code.
andre@0:  *  "funcName"
andre@0:  *      Address of EscASCII array representing name of function throwing error.
andre@0:  *      Must be non-NULL.
andre@0:  *  "errnum"
andre@0:  *      PKIX_ERRMSGNUM of error description for new error.
andre@0:  *  "cause"
andre@0:  *      Address of Error representing error's cause.
andre@0:  *  "pError"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns an Error Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: pkix_Throw(
andre@0:         PKIX_ERRORCLASS errorClass,
andre@0:         const char *funcName,
andre@0:         PKIX_ERRORCODE errorCode,
andre@0:         PKIX_ERRORCLASS overrideClass,
andre@0:         PKIX_Error *cause,
andre@0:         PKIX_Error **pError,
andre@0:         void *plContext)
andre@0: {
andre@0:         PKIX_Error *error = NULL;
andre@0: 
andre@0:         PKIX_ENTER(ERROR, "pkix_Throw");
andre@0:         PKIX_NULLCHECK_TWO(funcName, pError);
andre@0: 
andre@0:         *pError = NULL;
andre@0: 
andre@0: #ifdef PKIX_OBJECT_LEAK_TEST        
andre@0:         noErrorState = PKIX_TRUE;
andre@0:         if (pkixLog) {
andre@0: #ifdef PKIX_ERROR_DESCRIPTION            
andre@0:             PR_LOG(pkixLog, 4, ("Error in function \"%s\":\"%s\" with cause \"%s\"\n",
andre@0:                                 funcName, PKIX_ErrorText[errorCode],
andre@0:                                 (cause ? PKIX_ErrorText[cause->errCode] : "null")));
andre@0: #else
andre@0:             PR_LOG(pkixLog, 4, ("Error in function \"%s\": error code \"%d\"\n",
andre@0:                                 funcName, errorCode));
andre@0: #endif /* PKIX_ERROR_DESCRIPTION */
andre@0:             PORT_Assert(strcmp(funcName, "PKIX_PL_Object_DecRef"));
andre@0:         }
andre@0: #endif /* PKIX_OBJECT_LEAK_TEST */
andre@0: 
andre@0:         /* if cause has error class of PKIX_FATAL_ERROR, return immediately */
andre@0:         if (cause) {
andre@0:                 if (cause->errClass == PKIX_FATAL_ERROR){
andre@0:                         PKIX_INCREF(cause);
andre@0:                         *pError = cause;
andre@0:                         goto cleanup;
andre@0:                 }
andre@0:         }
andre@0:         
andre@0:         if (overrideClass == PKIX_FATAL_ERROR){
andre@0:                 errorClass = overrideClass;
andre@0:         }
andre@0: 
andre@0:        pkixTempResult = PKIX_Error_Create(errorClass, cause, NULL,
andre@0:                                            errorCode, &error, plContext);
andre@0:        
andre@0:        if (!pkixTempResult) {
andre@0:            /* Setting plErr error code:
andre@0:             *    get it from PORT_GetError if it is a leaf error and
andre@0:             *    default error code does not exist(eq 0)               */
andre@0:            if (!cause && !error->plErr) {
andre@0:                error->plErr = PKIX_PL_GetPLErrorCode();
andre@0:            }
andre@0:        }
andre@0: 
andre@0:        *pError = error;
andre@0: 
andre@0: cleanup:
andre@0: 
andre@0:         PKIX_DEBUG_EXIT(ERROR);
andre@0:         pkixErrorClass = 0;
andre@0: #ifdef PKIX_OBJECT_LEAK_TEST        
andre@0:         noErrorState = PKIX_FALSE;
andre@0: 
andre@0:         if (runningLeakTest && fnStackNameArr) {
andre@0:             PR_LOG(pkixLog, 5,
andre@0:                    ("%s%*s<- %s(%d) - %s\n", (errorGenerated ? "*" : " "),
andre@0:                     stackPosition, " ", fnStackNameArr[stackPosition],
andre@0:                     stackPosition, myFuncName));
andre@0:             fnStackNameArr[stackPosition--] = NULL;
andre@0:         }
andre@0: #endif /* PKIX_OBJECT_LEAK_TEST */
andre@0:         return (pkixTempResult);
andre@0: }
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: pkix_CheckTypes
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Checks that the types of the Object pointed to by "first" and the Object
andre@0:  *  pointed to by "second" are both equal to the value of "type". If they
andre@0:  *  are not equal, a PKIX_Error is returned.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "first"
andre@0:  *      Address of first Object. Must be non-NULL.
andre@0:  *  "second"
andre@0:  *      Address of second Object. Must be non-NULL.
andre@0:  *  "type"
andre@0:  *      Value of type to check against.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns an Error Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: pkix_CheckTypes(
andre@0:         PKIX_PL_Object *first,
andre@0:         PKIX_PL_Object *second,
andre@0:         PKIX_UInt32 type,
andre@0:         void *plContext)
andre@0: {
andre@0:         PKIX_UInt32 firstType, secondType;
andre@0: 
andre@0:         PKIX_ENTER(OBJECT, "pkix_CheckTypes");
andre@0:         PKIX_NULLCHECK_TWO(first, second);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_PL_Object_GetType(first, &firstType, plContext),
andre@0:                     PKIX_COULDNOTGETFIRSTOBJECTTYPE);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_PL_Object_GetType(second, &secondType, plContext),
andre@0:                     PKIX_COULDNOTGETSECONDOBJECTTYPE);
andre@0: 
andre@0:         if ((firstType != type)||(firstType != secondType)) {
andre@0:                 PKIX_ERROR(PKIX_OBJECTTYPESDONOTMATCH);
andre@0:         }
andre@0: 
andre@0: cleanup:
andre@0: 
andre@0:         PKIX_RETURN(OBJECT);
andre@0: }
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: pkix_CheckType
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Checks that the type of the Object pointed to by "object" is equal to the
andre@0:  *  value of "type". If it is not equal, a PKIX_Error is returned.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "object"
andre@0:  *      Address of Object. Must be non-NULL.
andre@0:  *  "type"
andre@0:  *      Value of type to check against.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns an Error Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: pkix_CheckType(
andre@0:         PKIX_PL_Object *object,
andre@0:         PKIX_UInt32 type,
andre@0:         void *plContext)
andre@0: {
andre@0:         return (pkix_CheckTypes(object, object, type, plContext));
andre@0: }
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: pkix_hash
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Computes a hash value for "length" bytes starting at the array of bytes
andre@0:  *  pointed to by "bytes" and stores the result at "pHash".
andre@0:  *
andre@0:  *  XXX To speed this up, we could probably read 32 bits at a time from
andre@0:  *  bytes (maybe even 64 bits on some platforms)
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "bytes"
andre@0:  *      Address of array of bytes to hash. Must be non-NULL.
andre@0:  *  "length"
andre@0:  *      Number of bytes to hash.
andre@0:  *  "pHash"
andre@0:  *      Address where object pointer will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: pkix_hash(
andre@0:         const unsigned char *bytes,
andre@0:         PKIX_UInt32 length,
andre@0:         PKIX_UInt32 *pHash,
andre@0:         void *plContext)
andre@0: {
andre@0:         PKIX_UInt32 i;
andre@0:         PKIX_UInt32 hash;
andre@0: 
andre@0:         PKIX_ENTER(OBJECT, "pkix_hash");
andre@0:         if (length != 0) {
andre@0:                 PKIX_NULLCHECK_ONE(bytes);
andre@0:         }
andre@0:         PKIX_NULLCHECK_ONE(pHash);
andre@0: 
andre@0:         hash = 0;
andre@0:         for (i = 0; i < length; i++) {
andre@0:                 /* hash = 31 * hash + bytes[i]; */
andre@0:                 hash = (hash << 5) - hash + bytes[i];
andre@0:         }
andre@0: 
andre@0:         *pHash = hash;
andre@0: 
andre@0:         PKIX_RETURN(OBJECT);
andre@0: }
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: pkix_countArray
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Counts the number of elements in the  null-terminated array of pointers
andre@0:  *  pointed to by "array" and returns the result.
andre@0:  *
andre@0:  * PARAMETERS
andre@0:  *  "array"
andre@0:  *      Address of null-terminated array of pointers.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns the number of elements in the array.
andre@0:  */
andre@0: PKIX_UInt32
andre@0: pkix_countArray(void **array)
andre@0: {
andre@0:         PKIX_UInt32 count = 0;
andre@0: 
andre@0:         if (array) {
andre@0:                 while (*array++) {
andre@0:                         count++;
andre@0:                 }
andre@0:         }
andre@0:         return (count);
andre@0: }
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: pkix_duplicateImmutable
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Convenience callback function used for duplicating immutable objects.
andre@0:  *  Since the objects can not be modified, this function simply increments the
andre@0:  *  reference count on the object, and returns a reference to that object.
andre@0:  *
andre@0:  *  (see comments for PKIX_PL_DuplicateCallback in pkix_pl_system.h)
andre@0:  */
andre@0: PKIX_Error *
andre@0: pkix_duplicateImmutable(
andre@0:         PKIX_PL_Object *object,
andre@0:         PKIX_PL_Object **pNewObject,
andre@0:         void *plContext)
andre@0: {
andre@0:         PKIX_ENTER(OBJECT, "pkix_duplicateImmutable");
andre@0:         PKIX_NULLCHECK_TWO(object, pNewObject);
andre@0: 
andre@0:         PKIX_INCREF(object);
andre@0: 
andre@0:         *pNewObject = object;
andre@0: 
andre@0: cleanup:
andre@0:         PKIX_RETURN(OBJECT);
andre@0: }
andre@0: 
andre@0: /* --String-Encoding-Conversion-Functions------------------------ */
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: pkix_hex2i
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Converts hexadecimal character "c" to its integer value and returns result.
andre@0:  *
andre@0:  * PARAMETERS
andre@0:  *  "c"
andre@0:  *      Character to convert to a hex value.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  The hexadecimal value of "c". Otherwise -1. (Unsigned 0xFFFFFFFF).
andre@0:  */
andre@0: PKIX_UInt32
andre@0: pkix_hex2i(char c)
andre@0: {
andre@0:         if ((c >= '0')&&(c <= '9'))
andre@0:                 return (c-'0');
andre@0:         else if ((c >= 'a')&&(c <= 'f'))
andre@0:                 return (c-'a'+10);
andre@0:         else if ((c >= 'A')&&(c <= 'F'))
andre@0:                 return (c-'A'+10);
andre@0:         else
andre@0:                 return ((PKIX_UInt32)(-1));
andre@0: }
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: pkix_i2hex
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Converts integer value "digit" to its ASCII hex value
andre@0:  *
andre@0:  * PARAMETERS
andre@0:  *  "digit"
andre@0:  *      Value of integer to convert to ASCII hex value. Must be 0-15.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  The ASCII hexadecimal value of "digit".
andre@0:  */
andre@0: char
andre@0: pkix_i2hex(char digit)
andre@0: {
andre@0:         if ((digit >= 0)&&(digit <= 9))
andre@0:                 return (digit+'0');
andre@0:         else if ((digit >= 0xa)&&(digit <= 0xf))
andre@0:                 return (digit - 10 + 'a');
andre@0:         else
andre@0:                 return (-1);
andre@0: }
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: pkix_isPlaintext
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Returns whether character "c" is plaintext using EscASCII or EscASCII_Debug
andre@0:  *  depending on the value of "debug".
andre@0:  *
andre@0:  *  In EscASCII, [01, 7E] except '&' are plaintext.
andre@0:  *  In EscASCII_Debug [20, 7E] except '&' are plaintext.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "c"
andre@0:  *      Character to check.
andre@0:  *  "debug"
andre@0:  *      Value of debug flag.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  True if "c" is plaintext.
andre@0:  */
andre@0: PKIX_Boolean
andre@0: pkix_isPlaintext(unsigned char c, PKIX_Boolean debug) {
andre@0:         return ((c >= 0x01)&&(c <= 0x7E)&&(c != '&')&&(!debug || (c >= 20)));
andre@0: }
andre@0: 
andre@0: /* --Cache-Functions------------------------ */
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: pkix_CacheCertChain_Lookup
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Look up CertChain Hash Table for a cached BuildResult based on "targetCert"
andre@0:  *  and "anchors" as the hash keys. If there is no item to match the key,
andre@0:  *  PKIX_FALSE is stored at "pFound". If an item is found, its cache time is
andre@0:  *  compared to "testDate". If expired, the item is removed and PKIX_FALSE is
andre@0:  *  stored at "pFound". Otherwise, PKIX_TRUE is stored at "pFound" and the 
andre@0:  *  BuildResult is stored at "pBuildResult".
andre@0:  *  The hashtable is maintained in the following ways:
andre@0:  *  1) When creating the hashtable, maximum bucket size can be specified (0 for
andre@0:  *     unlimited). If items in a bucket reaches its full size, an new addition
andre@0:  *     will trigger the removal of the old as FIFO sequence.
andre@0:  *  2) A PKIX_PL_Date created with current time offset by constant 
andre@0:  *     CACHE_ITEM_PERIOD_SECONDS is attached to each item in the Hash Table.
andre@0:  *     When an item is retrieved, this date is compared against "testDate" for
andre@0:  *     validity. If comparison indicates this item is expired, the item is
andre@0:  *     removed from the bucket.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "targetCert"
andre@0:  *      Address of Target Cert as key to retrieve this CertChain. Must be 
andre@0:  *      non-NULL.
andre@0:  *  "anchors"
andre@0:  *      Address of PKIX_List of "anchors" is used as key to retrive CertChain.
andre@0:  *      Must be non-NULL.
andre@0:  *  "testDate"
andre@0:  *      Address of PKIX_PL_Date for verifying time validity and cache validity.
andre@0:  *      May be NULL. If testDate is NULL, this cache item will not be out-dated.
andre@0:  *  "pFound"
andre@0:  *      Address of PKIX_Boolean indicating valid data is found.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pBuildResult"
andre@0:  *      Address where BuildResult will be stored. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns an Error Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: pkix_CacheCertChain_Lookup(
andre@0:         PKIX_PL_Cert* targetCert,
andre@0:         PKIX_List* anchors,
andre@0:         PKIX_PL_Date *testDate,
andre@0:         PKIX_Boolean *pFound,
andre@0:         PKIX_BuildResult **pBuildResult,
andre@0:         void *plContext)
andre@0: {
andre@0:         PKIX_List *cachedValues = NULL;
andre@0:         PKIX_List *cachedKeys = NULL;
andre@0:         PKIX_Error *cachedCertChainError = NULL;
andre@0:         PKIX_PL_Date *cacheValidUntilDate = NULL;
andre@0:         PKIX_PL_Date *validityDate = NULL;
andre@0:         PKIX_Int32 cmpValidTimeResult = 0;
andre@0:         PKIX_Int32 cmpCacheTimeResult = 0;
andre@0: 
andre@0:         PKIX_ENTER(BUILD, "pkix_CacheCertChain_Lookup");
andre@0: 
andre@0:         PKIX_NULLCHECK_FOUR(targetCert, anchors, pFound, pBuildResult);
andre@0: 
andre@0:         *pFound = PKIX_FALSE;
andre@0: 
andre@0:         /* use trust anchors and target cert as hash key */
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_Create(&cachedKeys, plContext),
andre@0:                     PKIX_LISTCREATEFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_AppendItem
andre@0:                     (cachedKeys,
andre@0:                     (PKIX_PL_Object *)targetCert,
andre@0:                     plContext),
andre@0:                     PKIX_LISTAPPENDITEMFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_AppendItem
andre@0:                     (cachedKeys,
andre@0:                     (PKIX_PL_Object *)anchors,
andre@0:                     plContext),
andre@0:                     PKIX_LISTAPPENDITEMFAILED);
andre@0: 
andre@0:         cachedCertChainError = PKIX_PL_HashTable_Lookup
andre@0:                     (cachedCertChainTable,
andre@0:                     (PKIX_PL_Object *) cachedKeys,
andre@0:                     (PKIX_PL_Object **) &cachedValues,
andre@0:                     plContext);
andre@0: 
andre@0:         pkix_ccLookupCount++;
andre@0: 
andre@0:         /* retrieve data from hashed value list */
andre@0: 
andre@0:         if (cachedValues != NULL && cachedCertChainError == NULL) {
andre@0: 
andre@0:             PKIX_CHECK(PKIX_List_GetItem
andre@0:                     (cachedValues,
andre@0:                     0,
andre@0:                     (PKIX_PL_Object **) &cacheValidUntilDate,
andre@0:                     plContext),
andre@0:                     PKIX_LISTGETITEMFAILED);
andre@0: 
andre@0:             /* check validity time and cache age time */
andre@0:             PKIX_CHECK(PKIX_List_GetItem
andre@0:                     (cachedValues,
andre@0:                     1,
andre@0:                     (PKIX_PL_Object **) &validityDate,
andre@0:                     plContext),
andre@0:                     PKIX_LISTGETITEMFAILED);
andre@0: 
andre@0:             /* if testDate is not set, this cache item is not out-dated */
andre@0:             if (testDate) {
andre@0: 
andre@0:                 PKIX_CHECK(PKIX_PL_Object_Compare
andre@0:                      ((PKIX_PL_Object *)testDate,
andre@0:                      (PKIX_PL_Object *)cacheValidUntilDate,
andre@0:                      &cmpCacheTimeResult,
andre@0:                      plContext),
andre@0:                      PKIX_OBJECTCOMPARATORFAILED);
andre@0: 
andre@0:                 PKIX_CHECK(PKIX_PL_Object_Compare
andre@0:                      ((PKIX_PL_Object *)testDate,
andre@0:                      (PKIX_PL_Object *)validityDate,
andre@0:                      &cmpValidTimeResult,
andre@0:                      plContext),
andre@0:                      PKIX_OBJECTCOMPARATORFAILED);
andre@0:             }
andre@0: 
andre@0:             /* certs' date are all valid and cache item is not old */
andre@0:             if (cmpValidTimeResult <= 0 && cmpCacheTimeResult <=0) {
andre@0: 
andre@0:                 PKIX_CHECK(PKIX_List_GetItem
andre@0:                     (cachedValues,
andre@0:                     2,
andre@0:                     (PKIX_PL_Object **) pBuildResult,
andre@0:                     plContext),
andre@0:                     PKIX_LISTGETITEMFAILED);
andre@0: 
andre@0:                 *pFound = PKIX_TRUE;
andre@0: 
andre@0:             } else {
andre@0: 
andre@0:                 pkix_ccRemoveCount++;
andre@0:                 *pFound = PKIX_FALSE;
andre@0: 
andre@0:                 /* out-dated item, remove it from cache */
andre@0:                 PKIX_CHECK(PKIX_PL_HashTable_Remove
andre@0:                     (cachedCertChainTable,
andre@0:                     (PKIX_PL_Object *) cachedKeys,
andre@0:                     plContext),
andre@0:                     PKIX_HASHTABLEREMOVEFAILED);
andre@0:             }
andre@0:         }
andre@0: 
andre@0: cleanup:
andre@0: 
andre@0:         PKIX_DECREF(cachedValues);
andre@0:         PKIX_DECREF(cachedKeys);
andre@0:         PKIX_DECREF(cachedCertChainError);
andre@0:         PKIX_DECREF(cacheValidUntilDate);
andre@0:         PKIX_DECREF(validityDate);
andre@0: 
andre@0:         PKIX_RETURN(BUILD);
andre@0: 
andre@0: }
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: pkix_CacheCertChain_Remove
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Remove CertChain Hash Table entry based on "targetCert" and "anchors"
andre@0:  *  as the hash keys. If there is no item to match the key, no action is
andre@0:  *  taken.
andre@0:  *  The hashtable is maintained in the following ways:
andre@0:  *  1) When creating the hashtable, maximum bucket size can be specified (0 for
andre@0:  *     unlimited). If items in a bucket reaches its full size, an new addition
andre@0:  *     will trigger the removal of the old as FIFO sequence.
andre@0:  *  2) A PKIX_PL_Date created with current time offset by constant 
andre@0:  *     CACHE_ITEM_PERIOD_SECONDS is attached to each item in the Hash Table.
andre@0:  *     When an item is retrieved, this date is compared against "testDate" for
andre@0:  *     validity. If comparison indicates this item is expired, the item is
andre@0:  *     removed from the bucket.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "targetCert"
andre@0:  *      Address of Target Cert as key to retrieve this CertChain. Must be 
andre@0:  *      non-NULL.
andre@0:  *  "anchors"
andre@0:  *      Address of PKIX_List of "anchors" is used as key to retrive CertChain.
andre@0:  *      Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns an Error Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: pkix_CacheCertChain_Remove(
andre@0:         PKIX_PL_Cert* targetCert,
andre@0:         PKIX_List* anchors,
andre@0:         void *plContext)
andre@0: {
andre@0:         PKIX_List *cachedKeys = NULL;
andre@0: 
andre@0:         PKIX_ENTER(BUILD, "pkix_CacheCertChain_Remove");
andre@0:         PKIX_NULLCHECK_TWO(targetCert, anchors);
andre@0: 
andre@0:         /* use trust anchors and target cert as hash key */
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_Create(&cachedKeys, plContext),
andre@0:                     PKIX_LISTCREATEFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_AppendItem
andre@0:                     (cachedKeys,
andre@0:                     (PKIX_PL_Object *)targetCert,
andre@0:                     plContext),
andre@0:                     PKIX_LISTAPPENDITEMFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_AppendItem
andre@0:                     (cachedKeys,
andre@0:                     (PKIX_PL_Object *)anchors,
andre@0:                     plContext),
andre@0:                     PKIX_LISTAPPENDITEMFAILED);
andre@0: 
andre@0:         PKIX_CHECK_ONLY_FATAL(PKIX_PL_HashTable_Remove
andre@0:                     (cachedCertChainTable,
andre@0:                     (PKIX_PL_Object *) cachedKeys,
andre@0:                     plContext),
andre@0:                     PKIX_HASHTABLEREMOVEFAILED);
andre@0: 
andre@0:         pkix_ccRemoveCount++;
andre@0: 
andre@0: cleanup:
andre@0: 
andre@0:         PKIX_DECREF(cachedKeys);
andre@0: 
andre@0:         PKIX_RETURN(BUILD);
andre@0: 
andre@0: }
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: pkix_CacheCertChain_Add
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Add a BuildResult to the CertChain Hash Table for a "buildResult" with
andre@0:  *  "targetCert" and "anchors" as the hash keys.
andre@0:  *  "validityDate" is the most restricted notAfter date of all Certs in
andre@0:  *  this CertChain and is verified when this BuildChain is retrieved.
andre@0:  *  The hashtable is maintained in the following ways:
andre@0:  *  1) When creating the hashtable, maximum bucket size can be specified (0 for
andre@0:  *     unlimited). If items in a bucket reaches its full size, an new addition
andre@0:  *     will trigger the removal of the old as FIFO sequence.
andre@0:  *  2) A PKIX_PL_Date created with current time offset by constant 
andre@0:  *     CACHE_ITEM_PERIOD_SECONDS is attached to each item in the Hash Table.
andre@0:  *     When an item is retrieved, this date is compared against "testDate" for
andre@0:  *     validity. If comparison indicates this item is expired, the item is
andre@0:  *     removed from the bucket.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "targetCert"
andre@0:  *      Address of Target Cert as key to retrieve this CertChain. Must be 
andre@0:  *      non-NULL.
andre@0:  *  "anchors"
andre@0:  *      Address of PKIX_List of "anchors" is used as key to retrive CertChain.
andre@0:  *      Must be non-NULL.
andre@0:  *  "validityDate"
andre@0:  *      Address of PKIX_PL_Date contains the most restriced notAfter time of
andre@0:  *      all "certs". Must be non-NULL.
andre@0:  *      Address of PKIX_Boolean indicating valid data is found.
andre@0:  *      Must be non-NULL.
andre@0:  *  "buildResult"
andre@0:  *      Address of BuildResult to be cached. Must be non-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns an Error Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: pkix_CacheCertChain_Add(
andre@0:         PKIX_PL_Cert* targetCert,
andre@0:         PKIX_List* anchors,
andre@0:         PKIX_PL_Date *validityDate,
andre@0:         PKIX_BuildResult *buildResult,
andre@0:         void *plContext)
andre@0: {
andre@0:         PKIX_List *cachedValues = NULL;
andre@0:         PKIX_List *cachedKeys = NULL;
andre@0:         PKIX_Error *cachedCertChainError = NULL;
andre@0:         PKIX_PL_Date *cacheValidUntilDate = NULL;
andre@0: 
andre@0:         PKIX_ENTER(BUILD, "pkix_CacheCertChain_Add");
andre@0: 
andre@0:         PKIX_NULLCHECK_FOUR(targetCert, anchors, validityDate, buildResult);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_Create(&cachedKeys, plContext),
andre@0:                 PKIX_LISTCREATEFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_AppendItem
andre@0:                 (cachedKeys, (PKIX_PL_Object *)targetCert, plContext),
andre@0:                 PKIX_LISTAPPENDITEMFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_AppendItem
andre@0:                 (cachedKeys, (PKIX_PL_Object *)anchors, plContext),
andre@0:                 PKIX_LISTAPPENDITEMFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_Create(&cachedValues, plContext),
andre@0:                 PKIX_LISTCREATEFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_PL_Date_Create_CurrentOffBySeconds
andre@0:                 (CACHE_ITEM_PERIOD_SECONDS,
andre@0:                 &cacheValidUntilDate,
andre@0:                 plContext),
andre@0:                PKIX_DATECREATECURRENTOFFBYSECONDSFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_AppendItem
andre@0:                 (cachedValues,
andre@0:                 (PKIX_PL_Object *)cacheValidUntilDate,
andre@0:                 plContext),
andre@0:                 PKIX_LISTAPPENDITEMFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_AppendItem
andre@0:                 (cachedValues, (PKIX_PL_Object *)validityDate, plContext),
andre@0:                 PKIX_LISTAPPENDITEMFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_AppendItem
andre@0:                 (cachedValues, (PKIX_PL_Object *)buildResult, plContext),
andre@0:                 PKIX_LISTAPPENDITEMFAILED);
andre@0: 
andre@0:         cachedCertChainError = PKIX_PL_HashTable_Add
andre@0:                 (cachedCertChainTable,
andre@0:                 (PKIX_PL_Object *) cachedKeys,
andre@0:                 (PKIX_PL_Object *) cachedValues,
andre@0:                 plContext);
andre@0: 
andre@0:         pkix_ccAddCount++;
andre@0: 
andre@0:         if (cachedCertChainError != NULL) {
andre@0:                 PKIX_DEBUG("PKIX_PL_HashTable_Add for CertChain skipped: "
andre@0:                         "entry existed\n");
andre@0:         }
andre@0: 
andre@0: cleanup:
andre@0: 
andre@0:         PKIX_DECREF(cachedValues);
andre@0:         PKIX_DECREF(cachedKeys);
andre@0:         PKIX_DECREF(cachedCertChainError);
andre@0:         PKIX_DECREF(cacheValidUntilDate);
andre@0: 
andre@0:         PKIX_RETURN(BUILD);
andre@0: }
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: pkix_CacheCert_Lookup
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Look up Cert Hash Table for a cached item based on "store" and Subject in
andre@0:  *  "certSelParams" as the hash keys and returns values Certs in "pCerts".
andre@0:  *  If there isn't an item to match the key, a PKIX_FALSE is returned at
andre@0:  *  "pFound". The item's cache time is verified with "testDate". If out-dated,
andre@0:  *  this item is removed and PKIX_FALSE is returned at "pFound".
andre@0:  *  This hashtable is maintained in the following ways:
andre@0:  *  1) When creating the hashtable, maximum bucket size can be specified (0 for
andre@0:  *     unlimited). If items in a bucket reaches its full size, an new addition
andre@0:  *     will trigger the removal of the old as FIFO sequence.
andre@0:  *  2) A PKIX_PL_Date created with current time offset by constant 
andre@0:  *     CACHE_ITEM_PERIOD_SECONDS is attached to each item in the Hash Table.
andre@0:  *     If the CertStore this Cert is from is a trusted one, the cache period is
andre@0:  *     shorter so cache can be updated more frequently.
andre@0:  *     When an item is retrieved, this date is compared against "testDate" for
andre@0:  *     validity. If comparison indicates this item is expired, the item is
andre@0:  *     removed from the bucket.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "store"
andre@0:  *      Address of CertStore as key to retrieve this CertChain. Must be 
andre@0:  *      non-NULL.
andre@0:  *  "certSelParams"
andre@0:  *      Address of ComCertSelParams that its subject is used as key to retrieve
andre@0:  *      this CertChain. Must be non-NULL.
andre@0:  *  "testDate"
andre@0:  *      Address of PKIX_PL_Date for verifying time cache validity.
andre@0:  *      Must be non-NULL. If testDate is NULL, this cache item won't be out
andre@0:  *      dated.
andre@0:  *  "pFound"
andre@0:  *      Address of KPKIX_Boolean indicating valid data is found.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pCerts"
andre@0:  *      Address PKIX_List where the CertChain will be stored. Must be no-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns an Error Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: pkix_CacheCert_Lookup(
andre@0:         PKIX_CertStore *store,
andre@0:         PKIX_ComCertSelParams *certSelParams,
andre@0:         PKIX_PL_Date *testDate,
andre@0:         PKIX_Boolean *pFound,
andre@0:         PKIX_List** pCerts,
andre@0:         void *plContext)
andre@0: {
andre@0:         PKIX_PL_Cert *cert = NULL;
andre@0:         PKIX_List *cachedKeys = NULL;
andre@0:         PKIX_List *cachedValues = NULL;
andre@0:         PKIX_List *cachedCertList = NULL;
andre@0:         PKIX_List *selCertList = NULL;
andre@0:         PKIX_PL_X500Name *subject = NULL;
andre@0:         PKIX_PL_Date *invalidAfterDate = NULL;
andre@0:         PKIX_PL_Date *cacheValidUntilDate = NULL;
andre@0:         PKIX_CertSelector *certSel = NULL;
andre@0:         PKIX_Error *cachedCertError = NULL;
andre@0:         PKIX_Error *selectorError = NULL;
andre@0:         PKIX_CertSelector_MatchCallback selectorMatch = NULL;
andre@0:         PKIX_Int32 cmpValidTimeResult = PKIX_FALSE;
andre@0:         PKIX_Int32 cmpCacheTimeResult = 0;
andre@0:         PKIX_UInt32 numItems = 0;
andre@0:         PKIX_UInt32 i;
andre@0: 
andre@0:         PKIX_ENTER(BUILD, "pkix_CacheCert_Lookup");
andre@0:         PKIX_NULLCHECK_TWO(store, certSelParams);
andre@0:         PKIX_NULLCHECK_TWO(pFound, pCerts);
andre@0: 
andre@0:         *pFound = PKIX_FALSE;
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_Create(&cachedKeys, plContext),
andre@0:                 PKIX_LISTCREATEFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_AppendItem
andre@0:                 (cachedKeys, (PKIX_PL_Object *)store, plContext),
andre@0:                 PKIX_LISTAPPENDITEMFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_ComCertSelParams_GetSubject
andre@0:                 (certSelParams, &subject, plContext),
andre@0:                 PKIX_COMCERTSELPARAMSGETSUBJECTFAILED);
andre@0: 
andre@0:         PKIX_NULLCHECK_ONE(subject);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_AppendItem
andre@0:                 (cachedKeys, (PKIX_PL_Object *)subject, plContext),
andre@0:                 PKIX_LISTAPPENDITEMFAILED);
andre@0: 
andre@0:         cachedCertError = PKIX_PL_HashTable_Lookup
andre@0:                     (cachedCertTable,
andre@0:                     (PKIX_PL_Object *) cachedKeys,
andre@0:                     (PKIX_PL_Object **) &cachedValues,
andre@0:                     plContext);
andre@0:         pkix_cLookupCount++;
andre@0: 
andre@0:         if (cachedValues != NULL && cachedCertError == NULL) {
andre@0: 
andre@0:                 PKIX_CHECK(PKIX_List_GetItem
andre@0:                         (cachedValues,
andre@0:                         0,
andre@0:                         (PKIX_PL_Object **) &cacheValidUntilDate,
andre@0:                         plContext),
andre@0:                         PKIX_LISTGETITEMFAILED);
andre@0: 
andre@0:                 if (testDate) {
andre@0:                     PKIX_CHECK(PKIX_PL_Object_Compare
andre@0:                          ((PKIX_PL_Object *)testDate,
andre@0:                          (PKIX_PL_Object *)cacheValidUntilDate,
andre@0:                          &cmpCacheTimeResult,
andre@0:                          plContext),
andre@0:                          PKIX_OBJECTCOMPARATORFAILED);
andre@0:                 }
andre@0: 
andre@0:                 if (cmpCacheTimeResult <= 0) {
andre@0: 
andre@0:                     PKIX_CHECK(PKIX_List_GetItem
andre@0:                         (cachedValues,
andre@0:                         1,
andre@0:                         (PKIX_PL_Object **) &cachedCertList,
andre@0:                         plContext),
andre@0:                         PKIX_LISTGETITEMFAILED);
andre@0: 
andre@0:                     /*
andre@0:                      * Certs put on cache satifies only for Subject,
andre@0:                      * user selector and ComCertSelParams to filter.
andre@0:                      */
andre@0:                     PKIX_CHECK(PKIX_CertSelector_Create
andre@0:                           (NULL, NULL, &certSel, plContext),
andre@0:                           PKIX_CERTSELECTORCREATEFAILED);
andre@0: 
andre@0:                     PKIX_CHECK(PKIX_CertSelector_SetCommonCertSelectorParams
andre@0:                           (certSel, certSelParams, plContext),
andre@0:                           PKIX_CERTSELECTORSETCOMMONCERTSELECTORPARAMSFAILED);
andre@0: 
andre@0:                     PKIX_CHECK(PKIX_CertSelector_GetMatchCallback
andre@0:                           (certSel, &selectorMatch, plContext),
andre@0:                           PKIX_CERTSELECTORGETMATCHCALLBACKFAILED);
andre@0: 
andre@0:                     PKIX_CHECK(PKIX_List_Create(&selCertList, plContext),
andre@0:                             PKIX_LISTCREATEFAILED);
andre@0: 
andre@0:                     /* 
andre@0:                      * If any of the Cert on the list is out-dated, invalidate
andre@0:                      * this cache item.
andre@0:                      */
andre@0:                     PKIX_CHECK(PKIX_List_GetLength
andre@0:                         (cachedCertList, &numItems, plContext),
andre@0:                         PKIX_LISTGETLENGTHFAILED);
andre@0: 
andre@0:                     for (i = 0; i < numItems; i++){
andre@0: 
andre@0:                         PKIX_CHECK(PKIX_List_GetItem
andre@0:                             (cachedCertList,
andre@0:                             i,
andre@0:                             (PKIX_PL_Object **)&cert,
andre@0:                             plContext),
andre@0:                             PKIX_LISTGETITEMFAILED);
andre@0: 
andre@0:                         PKIX_CHECK(PKIX_PL_Cert_GetValidityNotAfter
andre@0:                             (cert, &invalidAfterDate, plContext),
andre@0:                             PKIX_CERTGETVALIDITYNOTAFTERFAILED);
andre@0: 
andre@0:                         if (testDate) {
andre@0:                             PKIX_CHECK(PKIX_PL_Object_Compare
andre@0:                                 ((PKIX_PL_Object *)invalidAfterDate,
andre@0:                                 (PKIX_PL_Object *)testDate,
andre@0:                                 &cmpValidTimeResult,
andre@0:                                 plContext),
andre@0:                                 PKIX_OBJECTCOMPARATORFAILED);
andre@0:                         }
andre@0: 
andre@0:                         if (cmpValidTimeResult < 0) {
andre@0: 
andre@0:                             pkix_cRemoveCount++;
andre@0:                             *pFound = PKIX_FALSE;
andre@0: 
andre@0:                             /* one cert is out-dated, remove item from cache */
andre@0:                             PKIX_CHECK(PKIX_PL_HashTable_Remove
andre@0:                                     (cachedCertTable,
andre@0:                                     (PKIX_PL_Object *) cachedKeys,
andre@0:                                     plContext),
andre@0:                                     PKIX_HASHTABLEREMOVEFAILED);
andre@0:                             goto cleanup;
andre@0:                         }
andre@0: 
andre@0:                         selectorError = selectorMatch(certSel, cert, plContext);
andre@0:                         if (!selectorError){
andre@0:                             /* put on the return list */
andre@0:                             PKIX_CHECK(PKIX_List_AppendItem
andre@0:                                    (selCertList,
andre@0:                                    (PKIX_PL_Object *)cert,
andre@0:                                    plContext),
andre@0:                                   PKIX_LISTAPPENDITEMFAILED);
andre@0:                         } else {
andre@0:                             PKIX_DECREF(selectorError);
andre@0:                         }
andre@0: 
andre@0:                         PKIX_DECREF(cert);
andre@0:                         PKIX_DECREF(invalidAfterDate);
andre@0: 
andre@0:                     }
andre@0: 
andre@0:                     if (*pFound) {
andre@0:                         PKIX_INCREF(selCertList);
andre@0:                         *pCerts = selCertList;
andre@0:                     }
andre@0: 
andre@0:                 } else {
andre@0: 
andre@0:                     pkix_cRemoveCount++;
andre@0:                     *pFound = PKIX_FALSE;
andre@0:                     /* cache item is out-dated, remove it from cache */
andre@0:                     PKIX_CHECK(PKIX_PL_HashTable_Remove
andre@0:                                 (cachedCertTable,
andre@0:                                 (PKIX_PL_Object *) cachedKeys,
andre@0:                                 plContext),
andre@0:                                 PKIX_HASHTABLEREMOVEFAILED);
andre@0:                 }
andre@0: 
andre@0:         } 
andre@0: 
andre@0: cleanup:
andre@0: 
andre@0:         PKIX_DECREF(subject);
andre@0:         PKIX_DECREF(certSel);
andre@0:         PKIX_DECREF(cachedKeys);
andre@0:         PKIX_DECREF(cachedValues);
andre@0:         PKIX_DECREF(cacheValidUntilDate);
andre@0:         PKIX_DECREF(cert);
andre@0:         PKIX_DECREF(cachedCertList);
andre@0:         PKIX_DECREF(selCertList);
andre@0:         PKIX_DECREF(invalidAfterDate);
andre@0:         PKIX_DECREF(cachedCertError);
andre@0:         PKIX_DECREF(selectorError);
andre@0: 
andre@0:         PKIX_RETURN(BUILD);
andre@0: }
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: pkix_CacheCert_Add
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Add Cert Hash Table for a cached item based on "store" and Subject in
andre@0:  *  "certSelParams" as the hash keys and have "certs" as the key value.
andre@0:  *  This hashtable is maintained in the following ways:
andre@0:  *  1) When creating the hashtable, maximum bucket size can be specified (0 for
andre@0:  *     unlimited). If items in a bucket reaches its full size, an new addition
andre@0:  *     will trigger the removal of the old as FIFO sequence.
andre@0:  *  2) A PKIX_PL_Date created with current time offset by constant 
andre@0:  *     CACHE_ITEM_PERIOD_SECONDS is attached to each item in the Hash Table.
andre@0:  *     If the CertStore this Cert is from is a trusted one, the cache period is
andre@0:  *     shorter so cache can be updated more frequently.
andre@0:  *     When an item is retrieved, this date is compared against "testDate" for
andre@0:  *     validity. If comparison indicates this item is expired, the item is
andre@0:  *     removed from the bucket.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "store"
andre@0:  *      Address of CertStore as key to retrieve this CertChain. Must be 
andre@0:  *      non-NULL.
andre@0:  *  "certSelParams"
andre@0:  *      Address of ComCertSelParams that its subject is used as key to retrieve
andre@0:  *      this CertChain. Must be non-NULL.
andre@0:  *  "certs"
andre@0:  *      Address PKIX_List of Certs will be stored. Must be no-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns an Error Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: pkix_CacheCert_Add(
andre@0:         PKIX_CertStore *store,
andre@0:         PKIX_ComCertSelParams *certSelParams,
andre@0:         PKIX_List* certs,
andre@0:         void *plContext)
andre@0: {
andre@0:         PKIX_List *cachedKeys = NULL;
andre@0:         PKIX_List *cachedValues = NULL;
andre@0:         PKIX_PL_Date *cacheValidUntilDate = NULL;
andre@0:         PKIX_PL_X500Name *subject = NULL;
andre@0:         PKIX_Error *cachedCertError = NULL;
andre@0:         PKIX_CertStore_CheckTrustCallback trustCallback = NULL;
andre@0:         PKIX_UInt32 cachePeriod = CACHE_ITEM_PERIOD_SECONDS;
andre@0:         PKIX_UInt32 numCerts = 0;
andre@0: 
andre@0:         PKIX_ENTER(BUILD, "pkix_CacheCert_Add");
andre@0:         PKIX_NULLCHECK_THREE(store, certSelParams, certs);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_GetLength(certs, &numCerts,
andre@0:                                        plContext),
andre@0:                    PKIX_LISTGETLENGTHFAILED);
andre@0:         if (numCerts == 0) {
andre@0:             /* Don't want to add an empty list. */
andre@0:             goto cleanup;
andre@0:         }
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_Create(&cachedKeys, plContext),
andre@0:                 PKIX_LISTCREATEFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_AppendItem
andre@0:                 (cachedKeys, (PKIX_PL_Object *)store, plContext),
andre@0:                 PKIX_LISTAPPENDITEMFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_ComCertSelParams_GetSubject
andre@0:                 (certSelParams, &subject, plContext),
andre@0:                 PKIX_COMCERTSELPARAMSGETSUBJECTFAILED);
andre@0: 
andre@0:         PKIX_NULLCHECK_ONE(subject);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_AppendItem
andre@0:                 (cachedKeys, (PKIX_PL_Object *)subject, plContext),
andre@0:                 PKIX_LISTAPPENDITEMFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_Create(&cachedValues, plContext),
andre@0:                 PKIX_LISTCREATEFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_CertStore_GetTrustCallback
andre@0:                 (store, &trustCallback, plContext),
andre@0:                 PKIX_CERTSTOREGETTRUSTCALLBACKFAILED);
andre@0: 
andre@0:         if (trustCallback) {
andre@0:                 cachePeriod = CACHE_TRUST_ITEM_PERIOD_SECONDS;
andre@0:         }
andre@0: 
andre@0:         PKIX_CHECK(PKIX_PL_Date_Create_CurrentOffBySeconds
andre@0:                (cachePeriod, &cacheValidUntilDate, plContext),
andre@0:                PKIX_DATECREATECURRENTOFFBYSECONDSFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_AppendItem
andre@0:                 (cachedValues,
andre@0:                 (PKIX_PL_Object *)cacheValidUntilDate,
andre@0:                 plContext),
andre@0:                 PKIX_LISTAPPENDITEMFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_AppendItem
andre@0:                 (cachedValues,
andre@0:                 (PKIX_PL_Object *)certs,
andre@0:                 plContext),
andre@0:                 PKIX_LISTAPPENDITEMFAILED);
andre@0: 
andre@0:         cachedCertError = PKIX_PL_HashTable_Add
andre@0:                     (cachedCertTable,
andre@0:                     (PKIX_PL_Object *) cachedKeys,
andre@0:                     (PKIX_PL_Object *) cachedValues,
andre@0:                     plContext);
andre@0: 
andre@0:         pkix_cAddCount++;
andre@0: 
andre@0:         if (cachedCertError != NULL) {
andre@0:                 PKIX_DEBUG("PKIX_PL_HashTable_Add for Certs skipped: "
andre@0:                         "entry existed\n");
andre@0:         }
andre@0: 
andre@0: cleanup:
andre@0: 
andre@0:         PKIX_DECREF(subject);
andre@0:         PKIX_DECREF(cachedKeys);
andre@0:         PKIX_DECREF(cachedValues);
andre@0:         PKIX_DECREF(cacheValidUntilDate);
andre@0:         PKIX_DECREF(cachedCertError);
andre@0: 
andre@0:         PKIX_RETURN(BUILD);
andre@0: }
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: pkix_CacheCrlEntry_Lookup
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Look up CrlEntry Hash Table for a cached item based on "store",
andre@0:  *  "certIssuer" and "certSerialNumber" as the hash keys and returns values
andre@0:  *  "pCrls". If there isn't an item to match the key, a PKIX_FALSE is
andre@0:  *  returned at "pFound".
andre@0:  *  This hashtable is maintained in the following way:
andre@0:  *  1) When creating the hashtable, maximum bucket size can be specified (0 for
andre@0:  *     unlimited). If items in a bucket reaches its full size, an new addition
andre@0:  *     will trigger the removal of the old as FIFO sequence.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "store"
andre@0:  *      Address of CertStore as key to retrieve this CertChain. Must be 
andre@0:  *      non-NULL.
andre@0:  *  "certIssuer"
andre@0:  *      Address of X500Name that is used as key to retrieve the CRLEntries.
andre@0:  *      Must be non-NULL.
andre@0:  *  "certSerialNumber"
andre@0:  *      Address of BigInt that is used as key to retrieve the CRLEntries.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pFound"
andre@0:  *      Address of KPKIX_Boolean indicating valid data is found.
andre@0:  *      Must be non-NULL.
andre@0:  *  "pCrls"
andre@0:  *      Address PKIX_List where the CRLEntry will be stored. Must be no-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns an Error Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: pkix_CacheCrlEntry_Lookup(
andre@0:         PKIX_CertStore *store,
andre@0:         PKIX_PL_X500Name *certIssuer,
andre@0:         PKIX_PL_BigInt *certSerialNumber,
andre@0:         PKIX_Boolean *pFound,
andre@0:         PKIX_List** pCrls,
andre@0:         void *plContext)
andre@0: {
andre@0:         PKIX_List *cachedKeys = NULL;
andre@0:         PKIX_List *cachedCrlEntryList = NULL;
andre@0:         PKIX_Error *cachedCrlEntryError = NULL;
andre@0: 
andre@0:         PKIX_ENTER(BUILD, "pkix_CacheCrlEntry_Lookup");
andre@0:         PKIX_NULLCHECK_THREE(store, certIssuer, certSerialNumber);
andre@0:         PKIX_NULLCHECK_TWO(pFound, pCrls);
andre@0: 
andre@0:         *pFound = PKIX_FALSE;
andre@0: 
andre@0:         /* Find CrlEntry(s) by issuer and serial number */
andre@0:          
andre@0:         PKIX_CHECK(PKIX_List_Create(&cachedKeys, plContext),
andre@0:                     PKIX_LISTCREATEFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_AppendItem
andre@0:                     (cachedKeys, (PKIX_PL_Object *)store, plContext),
andre@0:                     PKIX_LISTAPPENDITEMFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_AppendItem
andre@0:                     (cachedKeys, (PKIX_PL_Object *)certIssuer, plContext),
andre@0:                     PKIX_LISTAPPENDITEMFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_AppendItem
andre@0:                     (cachedKeys,
andre@0:                     (PKIX_PL_Object *)certSerialNumber,
andre@0:                     plContext),
andre@0:                     PKIX_LISTAPPENDITEMFAILED);
andre@0: 
andre@0:         cachedCrlEntryError = PKIX_PL_HashTable_Lookup
andre@0:                     (cachedCrlEntryTable,
andre@0:                     (PKIX_PL_Object *) cachedKeys,
andre@0:                     (PKIX_PL_Object **) &cachedCrlEntryList,
andre@0:                     plContext);
andre@0:         pkix_ceLookupCount++;
andre@0: 
andre@0:         /* 
andre@0:          * We don't need check Date to invalidate this cache item,
andre@0:          * the item is uniquely defined and won't be reverted. Let
andre@0:          * the FIFO for cleaning up.
andre@0:          */
andre@0: 
andre@0:         if (cachedCrlEntryList != NULL && cachedCrlEntryError == NULL ) {
andre@0: 
andre@0:                 PKIX_INCREF(cachedCrlEntryList);
andre@0:                 *pCrls = cachedCrlEntryList;
andre@0: 
andre@0:                 *pFound = PKIX_TRUE;
andre@0: 
andre@0:         } else {
andre@0: 
andre@0:                 *pFound = PKIX_FALSE;
andre@0:         }
andre@0: 
andre@0: cleanup:
andre@0: 
andre@0:         PKIX_DECREF(cachedKeys);
andre@0:         PKIX_DECREF(cachedCrlEntryList);
andre@0:         PKIX_DECREF(cachedCrlEntryError);
andre@0: 
andre@0:         PKIX_RETURN(BUILD);
andre@0: }
andre@0: 
andre@0: /*
andre@0:  * FUNCTION: pkix_CacheCrlEntry_Add
andre@0:  * DESCRIPTION:
andre@0:  *
andre@0:  *  Look up CrlEntry Hash Table for a cached item based on "store",
andre@0:  *  "certIssuer" and "certSerialNumber" as the hash keys and have "pCrls" as
andre@0:  *  the hash value. If there isn't an item to match the key, a PKIX_FALSE is
andre@0:  *  returned at "pFound".
andre@0:  *  This hashtable is maintained in the following way:
andre@0:  *  1) When creating the hashtable, maximum bucket size can be specified (0 for
andre@0:  *     unlimited). If items in a bucket reaches its full size, an new addition
andre@0:  *     will trigger the removal of the old as FIFO sequence.
andre@0:  *
andre@0:  * PARAMETERS:
andre@0:  *  "store"
andre@0:  *      Address of CertStore as key to retrieve this CertChain. Must be 
andre@0:  *      non-NULL.
andre@0:  *  "certIssuer"
andre@0:  *      Address of X500Name that is used as key to retrieve the CRLEntries.
andre@0:  *      Must be non-NULL.
andre@0:  *  "certSerialNumber"
andre@0:  *      Address of BigInt that is used as key to retrieve the CRLEntries.
andre@0:  *      Must be non-NULL.
andre@0:  *  "crls"
andre@0:  *      Address PKIX_List where the CRLEntry is stored. Must be no-NULL.
andre@0:  *  "plContext"
andre@0:  *      Platform-specific context pointer.
andre@0:  * THREAD SAFETY:
andre@0:  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
andre@0:  * RETURNS:
andre@0:  *  Returns NULL if the function succeeds.
andre@0:  *  Returns an Error Error if the function fails in a non-fatal way.
andre@0:  *  Returns a Fatal Error if the function fails in an unrecoverable way.
andre@0:  */
andre@0: PKIX_Error *
andre@0: pkix_CacheCrlEntry_Add(
andre@0:         PKIX_CertStore *store,
andre@0:         PKIX_PL_X500Name *certIssuer,
andre@0:         PKIX_PL_BigInt *certSerialNumber,
andre@0:         PKIX_List* crls,
andre@0:         void *plContext)
andre@0: {
andre@0:         PKIX_List *cachedKeys = NULL;
andre@0:         PKIX_Error *cachedCrlEntryError = NULL;
andre@0: 
andre@0:         PKIX_ENTER(BUILD, "pkix_CacheCrlEntry_Add");
andre@0:         PKIX_NULLCHECK_THREE(store, certIssuer, certSerialNumber);
andre@0:         PKIX_NULLCHECK_ONE(crls);
andre@0: 
andre@0:         /* Add CrlEntry(s) by issuer and serial number */
andre@0:          
andre@0:         PKIX_CHECK(PKIX_List_Create(&cachedKeys, plContext),
andre@0:                     PKIX_LISTCREATEFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_AppendItem
andre@0:                     (cachedKeys, (PKIX_PL_Object *)store, plContext),
andre@0:                     PKIX_LISTAPPENDITEMFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_AppendItem
andre@0:                     (cachedKeys, (PKIX_PL_Object *)certIssuer, plContext),
andre@0:                     PKIX_LISTAPPENDITEMFAILED);
andre@0: 
andre@0:         PKIX_CHECK(PKIX_List_AppendItem
andre@0:                     (cachedKeys,
andre@0:                     (PKIX_PL_Object *)certSerialNumber,
andre@0:                     plContext),
andre@0:                     PKIX_LISTAPPENDITEMFAILED);
andre@0: 
andre@0:         cachedCrlEntryError = PKIX_PL_HashTable_Add
andre@0:                     (cachedCrlEntryTable,
andre@0:                     (PKIX_PL_Object *) cachedKeys,
andre@0:                     (PKIX_PL_Object *) crls,
andre@0:                     plContext);
andre@0:         pkix_ceAddCount++;
andre@0: 
andre@0: cleanup:
andre@0: 
andre@0:         PKIX_DECREF(cachedKeys);
andre@0:         PKIX_DECREF(cachedCrlEntryError);
andre@0: 
andre@0:         PKIX_RETURN(BUILD);
andre@0: }
andre@0: 
andre@0: #ifdef PKIX_OBJECT_LEAK_TEST
andre@0: 
andre@0: /* TEST_START_FN and testStartFnStackPosition define at what state
andre@0:  * of the stack the object leak testing should begin. The condition
andre@0:  * in pkix_CheckForGeneratedError works the following way: do leak
andre@0:  * testing if at position testStartFnStackPosition in stack array
andre@0:  * (fnStackNameArr) we have called function TEST_START_FN.
andre@0:  * Note, that stack array get filled only when executing libpkix
andre@0:  * functions.
andre@0:  * */
andre@0: #define TEST_START_FN "PKIX_BuildChain"
andre@0: 
andre@0: PKIX_Error*
andre@0: pkix_CheckForGeneratedError(PKIX_StdVars * stdVars, 
andre@0:                             PKIX_ERRORCLASS errClass, 
andre@0:                             char * fnName,
andre@0:                             PKIX_Boolean *errSetFlag,
andre@0:                             void * plContext)
andre@0: {
andre@0:     PKIX_Error *genErr = NULL;
andre@0:     PKIX_UInt32 pos = 0;
andre@0:     PKIX_UInt32 strLen = 0;
andre@0: 
andre@0:     if (fnName) { 
andre@0:         if (fnStackNameArr[testStartFnStackPosition] == NULL ||
andre@0:             strcmp(fnStackNameArr[testStartFnStackPosition], TEST_START_FN)
andre@0:             ) {
andre@0:             /* return with out error if not with in boundary */
andre@0:             return NULL;
andre@0:         }
andre@0:         if (!strcmp(fnName, TEST_START_FN)) {
andre@0:             *errSetFlag = PKIX_TRUE;
andre@0:             noErrorState = PKIX_FALSE;
andre@0:             errorGenerated = PKIX_FALSE;
andre@0:         }
andre@0:     }   
andre@0: 
andre@0:     if (noErrorState || errorGenerated)  return NULL;
andre@0: 
andre@0:     if (fnName && (
andre@0:         !strcmp(fnName, "PKIX_PL_Object_DecRef") ||
andre@0:         !strcmp(fnName, "PKIX_PL_Object_Unlock") ||
andre@0:         !strcmp(fnName, "pkix_UnlockObject") ||
andre@0:         !strcmp(fnName, "pkix_Throw") ||
andre@0:         !strcmp(fnName, "pkix_trace_dump_cert") ||
andre@0:         !strcmp(fnName, "PKIX_PL_Free"))) {
andre@0:         /* do not generate error for this functions */
andre@0:         noErrorState = PKIX_TRUE;
andre@0:         *errSetFlag = PKIX_TRUE;
andre@0:         return NULL;
andre@0:     }
andre@0: 
andre@0:     if (PL_HashTableLookup(fnInvTable, &fnStackInvCountArr[stackPosition - 1])) {
andre@0:         return NULL;
andre@0:     }
andre@0: 
andre@0:     PL_HashTableAdd(fnInvTable, &fnStackInvCountArr[stackPosition - 1], nonNullValue);
andre@0:     errorGenerated = PKIX_TRUE;
andre@0:     noErrorState = PKIX_TRUE;
andre@0:     genErr = PKIX_DoThrow(stdVars, errClass, PKIX_MEMLEAKGENERATEDERROR,
andre@0:                           errClass, plContext);
andre@0:     while(fnStackNameArr[pos]) {
andre@0:         strLen += PORT_Strlen(fnStackNameArr[pos++]) + 1;
andre@0:     }
andre@0:     strLen += 1; /* end of line. */
andre@0:     pos = 0;
andre@0:     errorFnStackString = PORT_ZAlloc(strLen);
andre@0:     while(fnStackNameArr[pos]) {
andre@0:         strcat(errorFnStackString, "/");
andre@0:         strcat(errorFnStackString, fnStackNameArr[pos++]);
andre@0:     }
andre@0:     noErrorState = PKIX_FALSE;
andre@0:     
andre@0:     return genErr;
andre@0: }
andre@0: #endif /* PKIX_OBJECT_LEAK_TEST */