andre@3: /* This Source Code Form is subject to the terms of the Mozilla Public andre@3: * License, v. 2.0. If a copy of the MPL was not distributed with this andre@3: * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ andre@3: andre@3: /* andre@3: * Certificate handling code andre@3: */ andre@3: andre@3: #include "seccomon.h" andre@3: #include "secder.h" andre@3: #include "nssilock.h" andre@3: #include "lowkeyi.h" andre@3: #include "secasn1.h" andre@3: #include "secoid.h" andre@3: #include "secerr.h" andre@3: #include "pcert.h" andre@3: andre@3: SEC_ASN1_MKSUB(SECOID_AlgorithmIDTemplate) andre@3: andre@3: static const SEC_ASN1Template nsslowcert_SubjectPublicKeyInfoTemplate[] = { andre@3: { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(NSSLOWCERTSubjectPublicKeyInfo) }, andre@3: { SEC_ASN1_INLINE | SEC_ASN1_XTRN, andre@3: offsetof(NSSLOWCERTSubjectPublicKeyInfo,algorithm), andre@3: SEC_ASN1_SUB(SECOID_AlgorithmIDTemplate) }, andre@3: { SEC_ASN1_BIT_STRING, andre@3: offsetof(NSSLOWCERTSubjectPublicKeyInfo,subjectPublicKey), }, andre@3: { 0, } andre@3: }; andre@3: andre@3: static const SEC_ASN1Template nsslowcert_RSAPublicKeyTemplate[] = { andre@3: { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(NSSLOWKEYPublicKey) }, andre@3: { SEC_ASN1_INTEGER, offsetof(NSSLOWKEYPublicKey,u.rsa.modulus), }, andre@3: { SEC_ASN1_INTEGER, offsetof(NSSLOWKEYPublicKey,u.rsa.publicExponent), }, andre@3: { 0, } andre@3: }; andre@3: static const SEC_ASN1Template nsslowcert_DSAPublicKeyTemplate[] = { andre@3: { SEC_ASN1_INTEGER, offsetof(NSSLOWKEYPublicKey,u.dsa.publicValue), }, andre@3: { 0, } andre@3: }; andre@3: static const SEC_ASN1Template nsslowcert_DHPublicKeyTemplate[] = { andre@3: { SEC_ASN1_INTEGER, offsetof(NSSLOWKEYPublicKey,u.dh.publicValue), }, andre@3: { 0, } andre@3: }; andre@3: andre@3: /* andre@3: * See bugzilla bug 125359 andre@3: * Since NSS (via PKCS#11) wants to handle big integers as unsigned ints, andre@3: * all of the templates above that en/decode into integers must be converted andre@3: * from ASN.1's signed integer type. This is done by marking either the andre@3: * source or destination (encoding or decoding, respectively) type as andre@3: * siUnsignedInteger. andre@3: */ andre@3: andre@3: static void andre@3: prepare_low_rsa_pub_key_for_asn1(NSSLOWKEYPublicKey *pubk) andre@3: { andre@3: pubk->u.rsa.modulus.type = siUnsignedInteger; andre@3: pubk->u.rsa.publicExponent.type = siUnsignedInteger; andre@3: } andre@3: andre@3: static void andre@3: prepare_low_dsa_pub_key_for_asn1(NSSLOWKEYPublicKey *pubk) andre@3: { andre@3: pubk->u.dsa.publicValue.type = siUnsignedInteger; andre@3: pubk->u.dsa.params.prime.type = siUnsignedInteger; andre@3: pubk->u.dsa.params.subPrime.type = siUnsignedInteger; andre@3: pubk->u.dsa.params.base.type = siUnsignedInteger; andre@3: } andre@3: andre@3: static void andre@3: prepare_low_dh_pub_key_for_asn1(NSSLOWKEYPublicKey *pubk) andre@3: { andre@3: pubk->u.dh.prime.type = siUnsignedInteger; andre@3: pubk->u.dh.base.type = siUnsignedInteger; andre@3: pubk->u.dh.publicValue.type = siUnsignedInteger; andre@3: } andre@3: andre@3: /* andre@3: * simple cert decoder to avoid the cost of asn1 engine andre@3: */ andre@3: static unsigned char * andre@3: nsslowcert_dataStart(unsigned char *buf, unsigned int length, andre@3: unsigned int *data_length, PRBool includeTag, andre@3: unsigned char* rettag) { andre@3: unsigned char tag; andre@3: unsigned int used_length= 0; andre@3: andre@3: /* need at least a tag and a 1 byte length */ andre@3: if (length < 2) { andre@3: return NULL; andre@3: } andre@3: andre@3: tag = buf[used_length++]; andre@3: andre@3: if (rettag) { andre@3: *rettag = tag; andre@3: } andre@3: andre@3: /* blow out when we come to the end */ andre@3: if (tag == 0) { andre@3: return NULL; andre@3: } andre@3: andre@3: *data_length = buf[used_length++]; andre@3: andre@3: if (*data_length&0x80) { andre@3: int len_count = *data_length & 0x7f; andre@3: andre@3: if (len_count+used_length > length) { andre@3: return NULL; andre@3: } andre@3: andre@3: *data_length = 0; andre@3: andre@3: while (len_count-- > 0) { andre@3: *data_length = (*data_length << 8) | buf[used_length++]; andre@3: } andre@3: } andre@3: andre@3: if (*data_length > (length-used_length) ) { andre@3: *data_length = length-used_length; andre@3: return NULL; andre@3: } andre@3: if (includeTag) *data_length += used_length; andre@3: andre@3: return (buf + (includeTag ? 0 : used_length)); andre@3: } andre@3: andre@3: static void SetTimeType(SECItem* item, unsigned char tagtype) andre@3: { andre@3: switch (tagtype) { andre@3: case SEC_ASN1_UTC_TIME: andre@3: item->type = siUTCTime; andre@3: break; andre@3: andre@3: case SEC_ASN1_GENERALIZED_TIME: andre@3: item->type = siGeneralizedTime; andre@3: break; andre@3: andre@3: default: andre@3: PORT_Assert(0); andre@3: break; andre@3: } andre@3: } andre@3: andre@3: static int andre@3: nsslowcert_GetValidityFields(unsigned char *buf,int buf_length, andre@3: SECItem *notBefore, SECItem *notAfter) andre@3: { andre@3: unsigned char tagtype; andre@3: notBefore->data = nsslowcert_dataStart(buf,buf_length, andre@3: ¬Before->len,PR_FALSE, &tagtype); andre@3: if (notBefore->data == NULL) return SECFailure; andre@3: SetTimeType(notBefore, tagtype); andre@3: buf_length -= (notBefore->data-buf) + notBefore->len; andre@3: buf = notBefore->data + notBefore->len; andre@3: notAfter->data = nsslowcert_dataStart(buf,buf_length, andre@3: ¬After->len,PR_FALSE, &tagtype); andre@3: if (notAfter->data == NULL) return SECFailure; andre@3: SetTimeType(notAfter, tagtype); andre@3: return SECSuccess; andre@3: } andre@3: andre@3: static int andre@3: nsslowcert_GetCertFields(unsigned char *cert,int cert_length, andre@3: SECItem *issuer, SECItem *serial, SECItem *derSN, SECItem *subject, andre@3: SECItem *valid, SECItem *subjkey, SECItem *extensions) andre@3: { andre@3: unsigned char *buf; andre@3: unsigned int buf_length; andre@3: unsigned char *dummy; andre@3: unsigned int dummylen; andre@3: andre@3: /* get past the signature wrap */ andre@3: buf = nsslowcert_dataStart(cert,cert_length,&buf_length,PR_FALSE, NULL); andre@3: if (buf == NULL) return SECFailure; andre@3: /* get into the raw cert data */ andre@3: buf = nsslowcert_dataStart(buf,buf_length,&buf_length,PR_FALSE, NULL); andre@3: if (buf == NULL) return SECFailure; andre@3: /* skip past any optional version number */ andre@3: if ((buf[0] & 0xa0) == 0xa0) { andre@3: dummy = nsslowcert_dataStart(buf,buf_length,&dummylen,PR_FALSE, NULL); andre@3: if (dummy == NULL) return SECFailure; andre@3: buf_length -= (dummy-buf) + dummylen; andre@3: buf = dummy + dummylen; andre@3: } andre@3: /* serial number */ andre@3: if (derSN) { andre@3: derSN->data=nsslowcert_dataStart(buf,buf_length,&derSN->len,PR_TRUE, NULL); andre@3: /* derSN->data doesn't need to be checked because if it fails so will andre@3: * serial->data below. The only difference between the two calls is andre@3: * whether or not the tags are included in the returned buffer */ andre@3: } andre@3: serial->data = nsslowcert_dataStart(buf,buf_length,&serial->len,PR_FALSE, NULL); andre@3: if (serial->data == NULL) return SECFailure; andre@3: buf_length -= (serial->data-buf) + serial->len; andre@3: buf = serial->data + serial->len; andre@3: /* skip the OID */ andre@3: dummy = nsslowcert_dataStart(buf,buf_length,&dummylen,PR_FALSE, NULL); andre@3: if (dummy == NULL) return SECFailure; andre@3: buf_length -= (dummy-buf) + dummylen; andre@3: buf = dummy + dummylen; andre@3: /* issuer */ andre@3: issuer->data = nsslowcert_dataStart(buf,buf_length,&issuer->len,PR_TRUE, NULL); andre@3: if (issuer->data == NULL) return SECFailure; andre@3: buf_length -= (issuer->data-buf) + issuer->len; andre@3: buf = issuer->data + issuer->len; andre@3: andre@3: /* only wanted issuer/SN */ andre@3: if (valid == NULL) { andre@3: return SECSuccess; andre@3: } andre@3: /* validity */ andre@3: valid->data = nsslowcert_dataStart(buf,buf_length,&valid->len,PR_FALSE, NULL); andre@3: if (valid->data == NULL) return SECFailure; andre@3: buf_length -= (valid->data-buf) + valid->len; andre@3: buf = valid->data + valid->len; andre@3: /*subject */ andre@3: subject->data=nsslowcert_dataStart(buf,buf_length,&subject->len,PR_TRUE, NULL); andre@3: if (subject->data == NULL) return SECFailure; andre@3: buf_length -= (subject->data-buf) + subject->len; andre@3: buf = subject->data + subject->len; andre@3: /* subject key info */ andre@3: subjkey->data=nsslowcert_dataStart(buf,buf_length,&subjkey->len,PR_TRUE, NULL); andre@3: if (subjkey->data == NULL) return SECFailure; andre@3: buf_length -= (subjkey->data-buf) + subjkey->len; andre@3: buf = subjkey->data + subjkey->len; andre@3: andre@3: extensions->data = NULL; andre@3: extensions->len = 0; andre@3: while (buf_length > 0) { andre@3: /* EXTENSIONS */ andre@3: if (buf[0] == 0xa3) { andre@3: extensions->data = nsslowcert_dataStart(buf,buf_length, andre@3: &extensions->len, PR_FALSE, NULL); andre@3: /* if the DER is bad, we should fail. Previously we accepted andre@3: * bad DER here and treated the extension as missin */ andre@3: if (extensions->data == NULL || andre@3: (extensions->data - buf) + extensions->len != buf_length) andre@3: return SECFailure; andre@3: buf = extensions->data; andre@3: buf_length = extensions->len; andre@3: /* now parse the SEQUENCE holding the extensions. */ andre@3: dummy = nsslowcert_dataStart(buf,buf_length,&dummylen,PR_FALSE,NULL); andre@3: if (dummy == NULL || andre@3: (dummy - buf) + dummylen != buf_length) andre@3: return SECFailure; andre@3: buf_length -= (dummy - buf); andre@3: buf = dummy; andre@3: /* Now parse the extensions inside this sequence */ andre@3: } andre@3: dummy = nsslowcert_dataStart(buf,buf_length,&dummylen,PR_FALSE,NULL); andre@3: if (dummy == NULL) return SECFailure; andre@3: buf_length -= (dummy - buf) + dummylen; andre@3: buf = dummy + dummylen; andre@3: } andre@3: return SECSuccess; andre@3: } andre@3: andre@3: static SECStatus andre@3: nsslowcert_GetCertTimes(NSSLOWCERTCertificate *c, PRTime *notBefore, PRTime *notAfter) andre@3: { andre@3: int rv; andre@3: NSSLOWCERTValidity validity; andre@3: andre@3: rv = nsslowcert_GetValidityFields(c->validity.data,c->validity.len, andre@3: &validity.notBefore,&validity.notAfter); andre@3: if (rv != SECSuccess) { andre@3: return rv; andre@3: } andre@3: andre@3: /* convert DER not-before time */ andre@3: rv = DER_DecodeTimeChoice(notBefore, &validity.notBefore); andre@3: if (rv) { andre@3: return(SECFailure); andre@3: } andre@3: andre@3: /* convert DER not-after time */ andre@3: rv = DER_DecodeTimeChoice(notAfter, &validity.notAfter); andre@3: if (rv) { andre@3: return(SECFailure); andre@3: } andre@3: andre@3: return(SECSuccess); andre@3: } andre@3: andre@3: /* andre@3: * is certa newer than certb? If one is expired, pick the other one. andre@3: */ andre@3: PRBool andre@3: nsslowcert_IsNewer(NSSLOWCERTCertificate *certa, NSSLOWCERTCertificate *certb) andre@3: { andre@3: PRTime notBeforeA, notAfterA, notBeforeB, notAfterB, now; andre@3: SECStatus rv; andre@3: PRBool newerbefore, newerafter; andre@3: andre@3: rv = nsslowcert_GetCertTimes(certa, ¬BeforeA, ¬AfterA); andre@3: if ( rv != SECSuccess ) { andre@3: return(PR_FALSE); andre@3: } andre@3: andre@3: rv = nsslowcert_GetCertTimes(certb, ¬BeforeB, ¬AfterB); andre@3: if ( rv != SECSuccess ) { andre@3: return(PR_TRUE); andre@3: } andre@3: andre@3: newerbefore = PR_FALSE; andre@3: if ( LL_CMP(notBeforeA, >, notBeforeB) ) { andre@3: newerbefore = PR_TRUE; andre@3: } andre@3: andre@3: newerafter = PR_FALSE; andre@3: if ( LL_CMP(notAfterA, >, notAfterB) ) { andre@3: newerafter = PR_TRUE; andre@3: } andre@3: andre@3: if ( newerbefore && newerafter ) { andre@3: return(PR_TRUE); andre@3: } andre@3: andre@3: if ( ( !newerbefore ) && ( !newerafter ) ) { andre@3: return(PR_FALSE); andre@3: } andre@3: andre@3: /* get current time */ andre@3: now = PR_Now(); andre@3: andre@3: if ( newerbefore ) { andre@3: /* cert A was issued after cert B, but expires sooner */ andre@3: /* if A is expired, then pick B */ andre@3: if ( LL_CMP(notAfterA, <, now ) ) { andre@3: return(PR_FALSE); andre@3: } andre@3: return(PR_TRUE); andre@3: } else { andre@3: /* cert B was issued after cert A, but expires sooner */ andre@3: /* if B is expired, then pick A */ andre@3: if ( LL_CMP(notAfterB, <, now ) ) { andre@3: return(PR_TRUE); andre@3: } andre@3: return(PR_FALSE); andre@3: } andre@3: } andre@3: andre@3: #define SOFT_DEFAULT_CHUNKSIZE 2048 andre@3: andre@3: static SECStatus andre@3: nsslowcert_KeyFromIssuerAndSN(PLArenaPool *arena, andre@3: SECItem *issuer, SECItem *sn, SECItem *key) andre@3: { andre@3: unsigned int len = sn->len + issuer->len; andre@3: andre@3: if (!arena) { andre@3: PORT_SetError(SEC_ERROR_INVALID_ARGS); andre@3: goto loser; andre@3: } andre@3: if (len > NSS_MAX_LEGACY_DB_KEY_SIZE) { andre@3: PORT_SetError(SEC_ERROR_INPUT_LEN); andre@3: goto loser; andre@3: } andre@3: key->data = (unsigned char*)PORT_ArenaAlloc(arena, len); andre@3: if ( !key->data ) { andre@3: goto loser; andre@3: } andre@3: andre@3: key->len = len; andre@3: /* copy the serialNumber */ andre@3: PORT_Memcpy(key->data, sn->data, sn->len); andre@3: andre@3: /* copy the issuer */ andre@3: PORT_Memcpy(&key->data[sn->len], issuer->data, issuer->len); andre@3: andre@3: return(SECSuccess); andre@3: andre@3: loser: andre@3: return(SECFailure); andre@3: } andre@3: andre@3: static SECStatus andre@3: nsslowcert_KeyFromIssuerAndSNStatic(unsigned char *space, andre@3: int spaceLen, SECItem *issuer, SECItem *sn, SECItem *key) andre@3: { andre@3: unsigned int len = sn->len + issuer->len; andre@3: andre@3: key->data = pkcs11_allocStaticData(len, space, spaceLen); andre@3: if ( !key->data ) { andre@3: goto loser; andre@3: } andre@3: andre@3: key->len = len; andre@3: /* copy the serialNumber */ andre@3: PORT_Memcpy(key->data, sn->data, sn->len); andre@3: andre@3: /* copy the issuer */ andre@3: PORT_Memcpy(&key->data[sn->len], issuer->data, issuer->len); andre@3: andre@3: return(SECSuccess); andre@3: andre@3: loser: andre@3: return(SECFailure); andre@3: } andre@3: andre@3: andre@3: static char * andre@3: nsslowcert_EmailName(SECItem *derDN, char *space, unsigned int len) andre@3: { andre@3: unsigned char *buf; andre@3: unsigned int buf_length; andre@3: andre@3: /* unwrap outer sequence */ andre@3: buf=nsslowcert_dataStart(derDN->data,derDN->len,&buf_length,PR_FALSE,NULL); andre@3: if (buf == NULL) return NULL; andre@3: andre@3: /* Walk each RDN */ andre@3: while (buf_length > 0) { andre@3: unsigned char *rdn; andre@3: unsigned int rdn_length; andre@3: andre@3: /* grab next rdn */ andre@3: rdn=nsslowcert_dataStart(buf, buf_length, &rdn_length, PR_FALSE, NULL); andre@3: if (rdn == NULL) { return NULL; } andre@3: buf_length -= (rdn - buf) + rdn_length; andre@3: buf = rdn+rdn_length; andre@3: andre@3: while (rdn_length > 0) { andre@3: unsigned char *ava; andre@3: unsigned int ava_length; andre@3: unsigned char *oid; andre@3: unsigned int oid_length; andre@3: unsigned char *name; andre@3: unsigned int name_length; andre@3: SECItem oidItem; andre@3: SECOidTag type; andre@3: andre@3: /* unwrap the ava */ andre@3: ava=nsslowcert_dataStart(rdn, rdn_length, &ava_length, PR_FALSE, andre@3: NULL); andre@3: if (ava == NULL) return NULL; andre@3: rdn_length -= (ava-rdn)+ava_length; andre@3: rdn = ava + ava_length; andre@3: andre@3: oid=nsslowcert_dataStart(ava, ava_length, &oid_length, PR_FALSE, andre@3: NULL); andre@3: if (oid == NULL) { return NULL; } andre@3: ava_length -= (oid-ava)+oid_length; andre@3: ava = oid+oid_length; andre@3: andre@3: name=nsslowcert_dataStart(ava, ava_length, &name_length, PR_FALSE, andre@3: NULL); andre@3: if (oid == NULL) { return NULL; } andre@3: ava_length -= (name-ava)+name_length; andre@3: ava = name+name_length; andre@3: andre@3: oidItem.data = oid; andre@3: oidItem.len = oid_length; andre@3: type = SECOID_FindOIDTag(&oidItem); andre@3: if ((type == SEC_OID_PKCS9_EMAIL_ADDRESS) || andre@3: (type == SEC_OID_RFC1274_MAIL)) { andre@3: /* Email is supposed to be IA5String, so no andre@3: * translation necessary */ andre@3: char *emailAddr; andre@3: emailAddr = (char *)pkcs11_copyStaticData(name,name_length+1, andre@3: (unsigned char *)space,len); andre@3: if (emailAddr) { andre@3: emailAddr[name_length] = 0; andre@3: } andre@3: return emailAddr; andre@3: } andre@3: } andre@3: } andre@3: return NULL; andre@3: } andre@3: andre@3: static char * andre@3: nsslowcert_EmailAltName(NSSLOWCERTCertificate *cert, char *space, andre@3: unsigned int len) andre@3: { andre@3: unsigned char *exts; andre@3: unsigned int exts_length; andre@3: andre@3: /* unwrap the sequence */ andre@3: exts = nsslowcert_dataStart(cert->extensions.data, cert->extensions.len, andre@3: &exts_length, PR_FALSE, NULL); andre@3: /* loop through extension */ andre@3: while (exts && exts_length > 0) { andre@3: unsigned char * ext; andre@3: unsigned int ext_length; andre@3: unsigned char *oid; andre@3: unsigned int oid_length; andre@3: unsigned char *nameList; andre@3: unsigned int nameList_length; andre@3: SECItem oidItem; andre@3: SECOidTag type; andre@3: andre@3: ext = nsslowcert_dataStart(exts, exts_length, &ext_length, andre@3: PR_FALSE, NULL); andre@3: if (ext == NULL) { break; } andre@3: exts_length -= (ext - exts) + ext_length; andre@3: exts = ext+ext_length; andre@3: andre@3: oid=nsslowcert_dataStart(ext, ext_length, &oid_length, PR_FALSE, NULL); andre@3: if (oid == NULL) { break; } andre@3: ext_length -= (oid - ext) + oid_length; andre@3: ext = oid+oid_length; andre@3: oidItem.data = oid; andre@3: oidItem.len = oid_length; andre@3: type = SECOID_FindOIDTag(&oidItem); andre@3: andre@3: /* get Alt Extension */ andre@3: if (type != SEC_OID_X509_SUBJECT_ALT_NAME) { andre@3: continue; andre@3: } andre@3: andre@3: /* skip passed the critical flag */ andre@3: if (ext[0] == 0x01) { /* BOOLEAN */ andre@3: unsigned char *dummy; andre@3: unsigned int dummy_length; andre@3: dummy = nsslowcert_dataStart(ext, ext_length, &dummy_length, andre@3: PR_FALSE, NULL); andre@3: if (dummy == NULL) { break; } andre@3: ext_length -= (dummy - ext) + dummy_length; andre@3: ext = dummy+dummy_length; andre@3: } andre@3: andre@3: andre@3: /* unwrap the name list */ andre@3: nameList = nsslowcert_dataStart(ext, ext_length, &nameList_length, andre@3: PR_FALSE, NULL); andre@3: if (nameList == NULL) { break; } andre@3: ext_length -= (nameList - ext) + nameList_length; andre@3: ext = nameList+nameList_length; andre@3: nameList = nsslowcert_dataStart(nameList, nameList_length, andre@3: &nameList_length, PR_FALSE, NULL); andre@3: /* loop through the name list */ andre@3: while (nameList && nameList_length > 0) { andre@3: unsigned char *thisName; andre@3: unsigned int thisName_length; andre@3: andre@3: thisName = nsslowcert_dataStart(nameList, nameList_length, andre@3: &thisName_length, PR_FALSE, NULL); andre@3: if (thisName == NULL) { break; } andre@3: if (nameList[0] == 0xa2) { /* DNS Name */ andre@3: SECItem dn; andre@3: char *emailAddr; andre@3: andre@3: dn.data = thisName; andre@3: dn.len = thisName_length; andre@3: emailAddr = nsslowcert_EmailName(&dn, space, len); andre@3: if (emailAddr) { andre@3: return emailAddr; andre@3: } andre@3: } andre@3: if (nameList[0] == 0x81) { /* RFC 822name */ andre@3: char *emailAddr; andre@3: emailAddr = (char *)pkcs11_copyStaticData(thisName, andre@3: thisName_length+1, (unsigned char *)space,len); andre@3: if (emailAddr) { andre@3: emailAddr[thisName_length] = 0; andre@3: } andre@3: return emailAddr; andre@3: } andre@3: nameList_length -= (thisName-nameList) + thisName_length; andre@3: nameList = thisName + thisName_length; andre@3: } andre@3: break; andre@3: } andre@3: return NULL; andre@3: } andre@3: andre@3: static char * andre@3: nsslowcert_GetCertificateEmailAddress(NSSLOWCERTCertificate *cert) andre@3: { andre@3: char *emailAddr = NULL; andre@3: char *str; andre@3: andre@3: emailAddr = nsslowcert_EmailName(&cert->derSubject,cert->emailAddrSpace, andre@3: sizeof(cert->emailAddrSpace)); andre@3: /* couldn't find the email address in the DN, check the subject Alt name */ andre@3: if (!emailAddr && cert->extensions.data) { andre@3: emailAddr = nsslowcert_EmailAltName(cert, cert->emailAddrSpace, andre@3: sizeof(cert->emailAddrSpace)); andre@3: } andre@3: andre@3: andre@3: /* make it lower case */ andre@3: str = emailAddr; andre@3: while ( str && *str ) { andre@3: *str = tolower( *str ); andre@3: str++; andre@3: } andre@3: return emailAddr; andre@3: andre@3: } andre@3: andre@3: /* andre@3: * take a DER certificate and decode it into a certificate structure andre@3: */ andre@3: NSSLOWCERTCertificate * andre@3: nsslowcert_DecodeDERCertificate(SECItem *derSignedCert, char *nickname) andre@3: { andre@3: NSSLOWCERTCertificate *cert; andre@3: int rv; andre@3: andre@3: /* allocate the certificate structure */ andre@3: cert = nsslowcert_CreateCert(); andre@3: andre@3: if ( !cert ) { andre@3: goto loser; andre@3: } andre@3: andre@3: /* point to passed in DER data */ andre@3: cert->derCert = *derSignedCert; andre@3: cert->nickname = NULL; andre@3: cert->certKey.data = NULL; andre@3: cert->referenceCount = 1; andre@3: andre@3: /* decode the certificate info */ andre@3: rv = nsslowcert_GetCertFields(cert->derCert.data, cert->derCert.len, andre@3: &cert->derIssuer, &cert->serialNumber, &cert->derSN, &cert->derSubject, andre@3: &cert->validity, &cert->derSubjKeyInfo, &cert->extensions); andre@3: andre@3: if (rv != SECSuccess) { andre@3: goto loser; andre@3: } andre@3: andre@3: /* cert->subjectKeyID; x509v3 subject key identifier */ andre@3: cert->subjectKeyID.data = NULL; andre@3: cert->subjectKeyID.len = 0; andre@3: cert->dbEntry = NULL; andre@3: cert ->trust = NULL; andre@3: cert ->dbhandle = NULL; andre@3: andre@3: /* generate and save the database key for the cert */ andre@3: rv = nsslowcert_KeyFromIssuerAndSNStatic(cert->certKeySpace, andre@3: sizeof(cert->certKeySpace), &cert->derIssuer, andre@3: &cert->serialNumber, &cert->certKey); andre@3: if ( rv ) { andre@3: goto loser; andre@3: } andre@3: andre@3: /* set the nickname */ andre@3: if ( nickname == NULL ) { andre@3: cert->nickname = NULL; andre@3: } else { andre@3: /* copy and install the nickname */ andre@3: cert->nickname = pkcs11_copyNickname(nickname,cert->nicknameSpace, andre@3: sizeof(cert->nicknameSpace)); andre@3: } andre@3: andre@3: #ifdef FIXME andre@3: /* initialize the subjectKeyID */ andre@3: rv = cert_GetKeyID(cert); andre@3: if ( rv != SECSuccess ) { andre@3: goto loser; andre@3: } andre@3: #endif andre@3: andre@3: /* set the email address */ andre@3: cert->emailAddr = nsslowcert_GetCertificateEmailAddress(cert); andre@3: andre@3: andre@3: cert->referenceCount = 1; andre@3: andre@3: return(cert); andre@3: andre@3: loser: andre@3: if (cert) { andre@3: nsslowcert_DestroyCertificate(cert); andre@3: } andre@3: andre@3: return(0); andre@3: } andre@3: andre@3: char * andre@3: nsslowcert_FixupEmailAddr(char *emailAddr) andre@3: { andre@3: char *retaddr; andre@3: char *str; andre@3: andre@3: if ( emailAddr == NULL ) { andre@3: return(NULL); andre@3: } andre@3: andre@3: /* copy the string */ andre@3: str = retaddr = PORT_Strdup(emailAddr); andre@3: if ( str == NULL ) { andre@3: return(NULL); andre@3: } andre@3: andre@3: /* make it lower case */ andre@3: while ( *str ) { andre@3: *str = tolower( *str ); andre@3: str++; andre@3: } andre@3: andre@3: return(retaddr); andre@3: } andre@3: andre@3: andre@3: /* andre@3: * Generate a database key, based on serial number and issuer, from a andre@3: * DER certificate. andre@3: */ andre@3: SECStatus andre@3: nsslowcert_KeyFromDERCert(PLArenaPool *arena, SECItem *derCert, SECItem *key) andre@3: { andre@3: int rv; andre@3: NSSLOWCERTCertKey certkey; andre@3: andre@3: PORT_Memset(&certkey, 0, sizeof(NSSLOWCERTCertKey)); andre@3: andre@3: rv = nsslowcert_GetCertFields(derCert->data, derCert->len, andre@3: &certkey.derIssuer, &certkey.serialNumber, NULL, NULL, andre@3: NULL, NULL, NULL); andre@3: andre@3: if ( rv ) { andre@3: goto loser; andre@3: } andre@3: andre@3: return(nsslowcert_KeyFromIssuerAndSN(arena, &certkey.derIssuer, andre@3: &certkey.serialNumber, key)); andre@3: loser: andre@3: return(SECFailure); andre@3: } andre@3: andre@3: NSSLOWKEYPublicKey * andre@3: nsslowcert_ExtractPublicKey(NSSLOWCERTCertificate *cert) andre@3: { andre@3: NSSLOWCERTSubjectPublicKeyInfo spki; andre@3: NSSLOWKEYPublicKey *pubk; andre@3: SECItem os; andre@3: SECStatus rv; andre@3: PLArenaPool *arena; andre@3: SECOidTag tag; andre@3: SECItem newDerSubjKeyInfo; andre@3: andre@3: arena = PORT_NewArena (DER_DEFAULT_CHUNKSIZE); andre@3: if (arena == NULL) andre@3: return NULL; andre@3: andre@3: pubk = (NSSLOWKEYPublicKey *) andre@3: PORT_ArenaZAlloc(arena, sizeof(NSSLOWKEYPublicKey)); andre@3: if (pubk == NULL) { andre@3: PORT_FreeArena (arena, PR_FALSE); andre@3: return NULL; andre@3: } andre@3: andre@3: pubk->arena = arena; andre@3: PORT_Memset(&spki,0,sizeof(spki)); andre@3: andre@3: /* copy the DER into the arena, since Quick DER returns data that points andre@3: into the DER input, which may get freed by the caller */ andre@3: rv = SECITEM_CopyItem(arena, &newDerSubjKeyInfo, &cert->derSubjKeyInfo); andre@3: if ( rv != SECSuccess ) { andre@3: PORT_FreeArena (arena, PR_FALSE); andre@3: return NULL; andre@3: } andre@3: andre@3: /* we haven't bothered decoding the spki struct yet, do it now */ andre@3: rv = SEC_QuickDERDecodeItem(arena, &spki, andre@3: nsslowcert_SubjectPublicKeyInfoTemplate, &newDerSubjKeyInfo); andre@3: if (rv != SECSuccess) { andre@3: PORT_FreeArena (arena, PR_FALSE); andre@3: return NULL; andre@3: } andre@3: andre@3: /* Convert bit string length from bits to bytes */ andre@3: os = spki.subjectPublicKey; andre@3: DER_ConvertBitString (&os); andre@3: andre@3: tag = SECOID_GetAlgorithmTag(&spki.algorithm); andre@3: switch ( tag ) { andre@3: case SEC_OID_X500_RSA_ENCRYPTION: andre@3: case SEC_OID_PKCS1_RSA_ENCRYPTION: andre@3: pubk->keyType = NSSLOWKEYRSAKey; andre@3: prepare_low_rsa_pub_key_for_asn1(pubk); andre@3: rv = SEC_QuickDERDecodeItem(arena, pubk, andre@3: nsslowcert_RSAPublicKeyTemplate, &os); andre@3: if (rv == SECSuccess) andre@3: return pubk; andre@3: break; andre@3: case SEC_OID_ANSIX9_DSA_SIGNATURE: andre@3: pubk->keyType = NSSLOWKEYDSAKey; andre@3: prepare_low_dsa_pub_key_for_asn1(pubk); andre@3: rv = SEC_QuickDERDecodeItem(arena, pubk, andre@3: nsslowcert_DSAPublicKeyTemplate, &os); andre@3: if (rv == SECSuccess) return pubk; andre@3: break; andre@3: case SEC_OID_X942_DIFFIE_HELMAN_KEY: andre@3: pubk->keyType = NSSLOWKEYDHKey; andre@3: prepare_low_dh_pub_key_for_asn1(pubk); andre@3: rv = SEC_QuickDERDecodeItem(arena, pubk, andre@3: nsslowcert_DHPublicKeyTemplate, &os); andre@3: if (rv == SECSuccess) return pubk; andre@3: break; andre@3: #ifndef NSS_DISABLE_ECC andre@3: case SEC_OID_ANSIX962_EC_PUBLIC_KEY: andre@3: pubk->keyType = NSSLOWKEYECKey; andre@3: /* Since PKCS#11 directly takes the DER encoding of EC params andre@3: * and public value, we don't need any decoding here. andre@3: */ andre@3: rv = SECITEM_CopyItem(arena, &pubk->u.ec.ecParams.DEREncoding, andre@3: &spki.algorithm.parameters); andre@3: if ( rv != SECSuccess ) andre@3: break; andre@3: andre@3: /* Fill out the rest of the ecParams structure andre@3: * based on the encoded params andre@3: */ andre@3: if (LGEC_FillParams(arena, &pubk->u.ec.ecParams.DEREncoding, andre@3: &pubk->u.ec.ecParams) != SECSuccess) andre@3: break; andre@3: andre@3: rv = SECITEM_CopyItem(arena, &pubk->u.ec.publicValue, &os); andre@3: if (rv == SECSuccess) return pubk; andre@3: break; andre@3: #endif /* NSS_DISABLE_ECC */ andre@3: default: andre@3: rv = SECFailure; andre@3: break; andre@3: } andre@3: andre@3: lg_nsslowkey_DestroyPublicKey (pubk); andre@3: return NULL; andre@3: } andre@3: