mirror of
https://github.com/classilla/tenfourfox.git
synced 2024-09-14 22:58:08 +00:00
1275 lines
43 KiB
C
1275 lines
43 KiB
C
|
/* This Source Code Form is subject to the terms of the Mozilla Public
|
||
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||
|
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
||
|
/*
|
||
|
* pkix_pl_nameconstraints.c
|
||
|
*
|
||
|
* Name Constraints Object Functions Definitions
|
||
|
*
|
||
|
*/
|
||
|
|
||
|
#include "pkix_pl_nameconstraints.h"
|
||
|
|
||
|
|
||
|
/* --Private-NameConstraints-Functions----------------------------- */
|
||
|
|
||
|
/*
|
||
|
* FUNCTION: pkix_pl_CertNameConstraints_GetPermitted
|
||
|
* DESCRIPTION:
|
||
|
*
|
||
|
* This function retrieve name constraints permitted list from NSS
|
||
|
* data in "nameConstraints" and returns a PKIX_PL_GeneralName list
|
||
|
* in "pPermittedList".
|
||
|
*
|
||
|
* PARAMETERS
|
||
|
* "nameConstraints"
|
||
|
* Address of CertNameConstraints which has a pointer to
|
||
|
* CERTNameConstraints data. Must be non-NULL.
|
||
|
* "pPermittedList"
|
||
|
* Address where returned permitted name list is stored. Must be non-NULL.
|
||
|
* "plContext" - Platform-specific context pointer.
|
||
|
* THREAD SAFETY:
|
||
|
* Conditionally Thread Safe
|
||
|
* (see Thread Safety Definitions in Programmer's Guide)
|
||
|
* RETURNS:
|
||
|
* Returns NULL if the function succeeds.
|
||
|
* Returns a NameConstraints Error if the function fails in a
|
||
|
* non-fatal way.
|
||
|
* Returns a Fatal Error if the function fails in an unrecoverable way.
|
||
|
*/
|
||
|
static PKIX_Error *
|
||
|
pkix_pl_CertNameConstraints_GetPermitted(
|
||
|
PKIX_PL_CertNameConstraints *nameConstraints,
|
||
|
PKIX_List **pPermittedList,
|
||
|
void *plContext)
|
||
|
{
|
||
|
CERTNameConstraints *nssNameConstraints = NULL;
|
||
|
CERTNameConstraints **nssNameConstraintsList = NULL;
|
||
|
CERTNameConstraint *nssPermitted = NULL;
|
||
|
CERTNameConstraint *firstPermitted = NULL;
|
||
|
PKIX_List *permittedList = NULL;
|
||
|
PKIX_PL_GeneralName *name = NULL;
|
||
|
PKIX_UInt32 numItems = 0;
|
||
|
PKIX_UInt32 i;
|
||
|
|
||
|
PKIX_ENTER(CERTNAMECONSTRAINTS,
|
||
|
"pkix_pl_CertNameConstraints_GetPermitted");
|
||
|
PKIX_NULLCHECK_TWO(nameConstraints, pPermittedList);
|
||
|
|
||
|
/*
|
||
|
* nssNameConstraints is an array of CERTNameConstraints
|
||
|
* pointers where CERTNameConstraints keep its permitted and excluded
|
||
|
* lists as pointer array of CERTNameConstraint.
|
||
|
*/
|
||
|
|
||
|
if (nameConstraints->permittedList == NULL) {
|
||
|
|
||
|
PKIX_OBJECT_LOCK(nameConstraints);
|
||
|
|
||
|
if (nameConstraints->permittedList == NULL) {
|
||
|
|
||
|
PKIX_CHECK(PKIX_List_Create(&permittedList, plContext),
|
||
|
PKIX_LISTCREATEFAILED);
|
||
|
|
||
|
numItems = nameConstraints->numNssNameConstraints;
|
||
|
nssNameConstraintsList =
|
||
|
nameConstraints->nssNameConstraintsList;
|
||
|
|
||
|
for (i = 0; i < numItems; i++) {
|
||
|
|
||
|
PKIX_NULLCHECK_ONE(nssNameConstraintsList);
|
||
|
nssNameConstraints = *(nssNameConstraintsList + i);
|
||
|
PKIX_NULLCHECK_ONE(nssNameConstraints);
|
||
|
|
||
|
if (nssNameConstraints->permited != NULL) {
|
||
|
|
||
|
nssPermitted = nssNameConstraints->permited;
|
||
|
firstPermitted = nssPermitted;
|
||
|
|
||
|
do {
|
||
|
|
||
|
PKIX_CHECK(pkix_pl_GeneralName_Create
|
||
|
(&nssPermitted->name, &name, plContext),
|
||
|
PKIX_GENERALNAMECREATEFAILED);
|
||
|
|
||
|
PKIX_CHECK(PKIX_List_AppendItem
|
||
|
(permittedList,
|
||
|
(PKIX_PL_Object *)name,
|
||
|
plContext),
|
||
|
PKIX_LISTAPPENDITEMFAILED);
|
||
|
|
||
|
PKIX_DECREF(name);
|
||
|
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG
|
||
|
("\t\tCalling CERT_GetNextNameConstraint\n");
|
||
|
nssPermitted = CERT_GetNextNameConstraint
|
||
|
(nssPermitted);
|
||
|
|
||
|
} while (nssPermitted != firstPermitted);
|
||
|
|
||
|
}
|
||
|
}
|
||
|
|
||
|
PKIX_CHECK(PKIX_List_SetImmutable(permittedList, plContext),
|
||
|
PKIX_LISTSETIMMUTABLEFAILED);
|
||
|
|
||
|
nameConstraints->permittedList = permittedList;
|
||
|
|
||
|
}
|
||
|
|
||
|
PKIX_OBJECT_UNLOCK(nameConstraints);
|
||
|
|
||
|
}
|
||
|
|
||
|
PKIX_INCREF(nameConstraints->permittedList);
|
||
|
|
||
|
*pPermittedList = nameConstraints->permittedList;
|
||
|
|
||
|
cleanup:
|
||
|
|
||
|
PKIX_RETURN(CERTNAMECONSTRAINTS);
|
||
|
}
|
||
|
|
||
|
/*
|
||
|
* FUNCTION: pkix_pl_CertNameConstraints_GetExcluded
|
||
|
* DESCRIPTION:
|
||
|
*
|
||
|
* This function retrieve name constraints excluded list from NSS
|
||
|
* data in "nameConstraints" and returns a PKIX_PL_GeneralName list
|
||
|
* in "pExcludedList".
|
||
|
*
|
||
|
* PARAMETERS
|
||
|
* "nameConstraints"
|
||
|
* Address of CertNameConstraints which has a pointer to NSS data.
|
||
|
* Must be non-NULL.
|
||
|
* "pPermittedList"
|
||
|
* Address where returned excluded name list is stored. Must be non-NULL.
|
||
|
* "plContext" - Platform-specific context pointer.
|
||
|
* THREAD SAFETY:
|
||
|
* Conditionally Thread Safe
|
||
|
* (see Thread Safety Definitions in Programmer's Guide)
|
||
|
* RETURNS:
|
||
|
* Returns NULL if the function succeeds.
|
||
|
* Returns a NameConstraints Error if the function fails in a
|
||
|
* non-fatal way.
|
||
|
* Returns a Fatal Error if the function fails in an unrecoverable way.
|
||
|
*/
|
||
|
static PKIX_Error *
|
||
|
pkix_pl_CertNameConstraints_GetExcluded(
|
||
|
PKIX_PL_CertNameConstraints *nameConstraints,
|
||
|
PKIX_List **pExcludedList,
|
||
|
void *plContext)
|
||
|
{
|
||
|
CERTNameConstraints *nssNameConstraints = NULL;
|
||
|
CERTNameConstraints **nssNameConstraintsList = NULL;
|
||
|
CERTNameConstraint *nssExcluded = NULL;
|
||
|
CERTNameConstraint *firstExcluded = NULL;
|
||
|
PKIX_List *excludedList = NULL;
|
||
|
PKIX_PL_GeneralName *name = NULL;
|
||
|
PKIX_UInt32 numItems = 0;
|
||
|
PKIX_UInt32 i;
|
||
|
|
||
|
PKIX_ENTER(CERTNAMECONSTRAINTS,
|
||
|
"pkix_pl_CertNameConstraints_GetExcluded");
|
||
|
PKIX_NULLCHECK_TWO(nameConstraints, pExcludedList);
|
||
|
|
||
|
if (nameConstraints->excludedList == NULL) {
|
||
|
|
||
|
PKIX_OBJECT_LOCK(nameConstraints);
|
||
|
|
||
|
if (nameConstraints->excludedList == NULL) {
|
||
|
|
||
|
PKIX_CHECK(PKIX_List_Create(&excludedList, plContext),
|
||
|
PKIX_LISTCREATEFAILED);
|
||
|
|
||
|
numItems = nameConstraints->numNssNameConstraints;
|
||
|
nssNameConstraintsList =
|
||
|
nameConstraints->nssNameConstraintsList;
|
||
|
|
||
|
for (i = 0; i < numItems; i++) {
|
||
|
|
||
|
PKIX_NULLCHECK_ONE(nssNameConstraintsList);
|
||
|
nssNameConstraints = *(nssNameConstraintsList + i);
|
||
|
PKIX_NULLCHECK_ONE(nssNameConstraints);
|
||
|
|
||
|
if (nssNameConstraints->excluded != NULL) {
|
||
|
|
||
|
nssExcluded = nssNameConstraints->excluded;
|
||
|
firstExcluded = nssExcluded;
|
||
|
|
||
|
do {
|
||
|
|
||
|
PKIX_CHECK(pkix_pl_GeneralName_Create
|
||
|
(&nssExcluded->name, &name, plContext),
|
||
|
PKIX_GENERALNAMECREATEFAILED);
|
||
|
|
||
|
PKIX_CHECK(PKIX_List_AppendItem
|
||
|
(excludedList,
|
||
|
(PKIX_PL_Object *)name,
|
||
|
plContext),
|
||
|
PKIX_LISTAPPENDITEMFAILED);
|
||
|
|
||
|
PKIX_DECREF(name);
|
||
|
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG
|
||
|
("\t\tCalling CERT_GetNextNameConstraint\n");
|
||
|
nssExcluded = CERT_GetNextNameConstraint
|
||
|
(nssExcluded);
|
||
|
|
||
|
} while (nssExcluded != firstExcluded);
|
||
|
|
||
|
}
|
||
|
|
||
|
}
|
||
|
PKIX_CHECK(PKIX_List_SetImmutable(excludedList, plContext),
|
||
|
PKIX_LISTSETIMMUTABLEFAILED);
|
||
|
|
||
|
nameConstraints->excludedList = excludedList;
|
||
|
|
||
|
}
|
||
|
|
||
|
PKIX_OBJECT_UNLOCK(nameConstraints);
|
||
|
}
|
||
|
|
||
|
PKIX_INCREF(nameConstraints->excludedList);
|
||
|
|
||
|
*pExcludedList = nameConstraints->excludedList;
|
||
|
|
||
|
cleanup:
|
||
|
|
||
|
PKIX_RETURN(CERTNAMECONSTRAINTS);
|
||
|
}
|
||
|
|
||
|
/*
|
||
|
* FUNCTION: pkix_pl_CertNameConstraints_CheckNameSpaceNssNames
|
||
|
* DESCRIPTION:
|
||
|
*
|
||
|
* This function checks if CERTGeneralNames in "nssSubjectNames" comply
|
||
|
* with the permitted and excluded names in "nameConstraints". It returns
|
||
|
* PKIX_TRUE in "pCheckPass", if the Names satify the name space of the
|
||
|
* permitted list and if the Names are not in the excluded list. Otherwise,
|
||
|
* it returns PKIX_FALSE.
|
||
|
*
|
||
|
* PARAMETERS
|
||
|
* "nssSubjectNames"
|
||
|
* List of CERTGeneralName that nameConstraints verification is based on.
|
||
|
* "nameConstraints"
|
||
|
* Address of CertNameConstraints that provides lists of permitted
|
||
|
* and excluded names. Must be non-NULL.
|
||
|
* "pCheckPass"
|
||
|
* Address where PKIX_TRUE is returned if the all names in "nameList" are
|
||
|
* valid.
|
||
|
* "plContext" - Platform-specific context pointer.
|
||
|
* THREAD SAFETY:
|
||
|
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
|
||
|
* RETURNS:
|
||
|
* Returns NULL if the function succeeds.
|
||
|
* Returns a NameConstraints Error if the function fails in a
|
||
|
* non-fatal way.
|
||
|
* Returns a Fatal Error if the function fails in an unrecoverable way.
|
||
|
*/
|
||
|
PKIX_Error *
|
||
|
pkix_pl_CertNameConstraints_CheckNameSpaceNssNames(
|
||
|
CERTGeneralName *nssSubjectNames,
|
||
|
PKIX_PL_CertNameConstraints *nameConstraints,
|
||
|
PKIX_Boolean *pCheckPass,
|
||
|
void *plContext)
|
||
|
{
|
||
|
CERTNameConstraints **nssNameConstraintsList = NULL;
|
||
|
CERTNameConstraints *nssNameConstraints = NULL;
|
||
|
CERTGeneralName *nssMatchName = NULL;
|
||
|
PLArenaPool *arena = NULL;
|
||
|
PKIX_UInt32 numItems = 0;
|
||
|
PKIX_UInt32 i;
|
||
|
SECStatus status = SECSuccess;
|
||
|
|
||
|
PKIX_ENTER(CERTNAMECONSTRAINTS,
|
||
|
"pkix_pl_CertNameConstraints_CheckNameSpaceNssNames");
|
||
|
PKIX_NULLCHECK_THREE(nssSubjectNames, nameConstraints, pCheckPass);
|
||
|
|
||
|
*pCheckPass = PKIX_TRUE;
|
||
|
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG("\t\tCalling PORT_NewArena\n");
|
||
|
arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
|
||
|
if (arena == NULL) {
|
||
|
PKIX_ERROR(PKIX_OUTOFMEMORY);
|
||
|
}
|
||
|
|
||
|
nssMatchName = nssSubjectNames;
|
||
|
nssNameConstraintsList = nameConstraints->nssNameConstraintsList;
|
||
|
|
||
|
/*
|
||
|
* CERTNameConstraint items in each permitted or excluded list
|
||
|
* is verified as OR condition. That means, if one item matched,
|
||
|
* then the checking on the remaining items on the list is skipped.
|
||
|
* (see NSS cert_CompareNameWithConstraints(...)).
|
||
|
* Items on PKIX_PL_NameConstraint's nssNameConstraints are verified
|
||
|
* as AND condition. PKIX_PL_NameConstraint keeps an array of pointers
|
||
|
* of CERTNameConstraints resulting from merging multiple
|
||
|
* PKIX_PL_NameConstraints. Since each CERTNameConstraint are created
|
||
|
* for different entity, a union condition of these entities then is
|
||
|
* performed.
|
||
|
*/
|
||
|
|
||
|
do {
|
||
|
|
||
|
numItems = nameConstraints->numNssNameConstraints;
|
||
|
|
||
|
for (i = 0; i < numItems; i++) {
|
||
|
|
||
|
PKIX_NULLCHECK_ONE(nssNameConstraintsList);
|
||
|
nssNameConstraints = *(nssNameConstraintsList + i);
|
||
|
PKIX_NULLCHECK_ONE(nssNameConstraints);
|
||
|
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG
|
||
|
("\t\tCalling CERT_CheckNameSpace\n");
|
||
|
status = CERT_CheckNameSpace
|
||
|
(arena, nssNameConstraints, nssMatchName);
|
||
|
if (status != SECSuccess) {
|
||
|
break;
|
||
|
}
|
||
|
|
||
|
}
|
||
|
|
||
|
if (status != SECSuccess) {
|
||
|
break;
|
||
|
}
|
||
|
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG
|
||
|
("\t\tCalling CERT_GetNextGeneralName\n");
|
||
|
nssMatchName = CERT_GetNextGeneralName(nssMatchName);
|
||
|
|
||
|
} while (nssMatchName != nssSubjectNames);
|
||
|
|
||
|
if (status == SECFailure) {
|
||
|
|
||
|
*pCheckPass = PKIX_FALSE;
|
||
|
}
|
||
|
|
||
|
cleanup:
|
||
|
|
||
|
if (arena){
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG
|
||
|
("\t\tCalling PORT_FreeArena).\n");
|
||
|
PORT_FreeArena(arena, PR_FALSE);
|
||
|
}
|
||
|
|
||
|
PKIX_RETURN(CERTNAMECONSTRAINTS);
|
||
|
}
|
||
|
|
||
|
/*
|
||
|
* FUNCTION: pkix_pl_NameConstraints_Destroy
|
||
|
* (see comments for PKIX_PL_DestructorCallback in pkix_pl_system.h)
|
||
|
*/
|
||
|
static PKIX_Error *
|
||
|
pkix_pl_CertNameConstraints_Destroy(
|
||
|
PKIX_PL_Object *object,
|
||
|
void *plContext)
|
||
|
{
|
||
|
PKIX_PL_CertNameConstraints *nameConstraints = NULL;
|
||
|
|
||
|
PKIX_ENTER(CERTNAMECONSTRAINTS, "pkix_pl_CertNameConstraints_Destroy");
|
||
|
PKIX_NULLCHECK_ONE(object);
|
||
|
|
||
|
PKIX_CHECK(pkix_CheckType
|
||
|
(object, PKIX_CERTNAMECONSTRAINTS_TYPE, plContext),
|
||
|
PKIX_OBJECTNOTCERTNAMECONSTRAINTS);
|
||
|
|
||
|
nameConstraints = (PKIX_PL_CertNameConstraints *)object;
|
||
|
|
||
|
PKIX_CHECK(PKIX_PL_Free
|
||
|
(nameConstraints->nssNameConstraintsList, plContext),
|
||
|
PKIX_FREEFAILED);
|
||
|
|
||
|
if (nameConstraints->arena){
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG
|
||
|
("\t\tCalling PORT_FreeArena).\n");
|
||
|
PORT_FreeArena(nameConstraints->arena, PR_FALSE);
|
||
|
nameConstraints->arena = NULL;
|
||
|
}
|
||
|
|
||
|
PKIX_DECREF(nameConstraints->permittedList);
|
||
|
PKIX_DECREF(nameConstraints->excludedList);
|
||
|
|
||
|
cleanup:
|
||
|
|
||
|
PKIX_RETURN(CERTNAMECONSTRAINTS);
|
||
|
}
|
||
|
|
||
|
/*
|
||
|
* FUNCTION: pkix_pl_CertNameConstraints_ToString_Helper
|
||
|
* DESCRIPTION:
|
||
|
*
|
||
|
* Helper function that creates a string representation of the object
|
||
|
* NameConstraints and stores it at "pString".
|
||
|
*
|
||
|
* PARAMETERS
|
||
|
* "nameConstraints"
|
||
|
* Address of CertNameConstraints whose string representation is
|
||
|
* desired. Must be non-NULL.
|
||
|
* "pString"
|
||
|
* Address where string object pointer will be stored. Must be non-NULL.
|
||
|
* "plContext" - Platform-specific context pointer.
|
||
|
* THREAD SAFETY:
|
||
|
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
|
||
|
* RETURNS:
|
||
|
* Returns NULL if the function succeeds.
|
||
|
* Returns a NameConstraints Error if the function fails in a
|
||
|
* non-fatal way.
|
||
|
* Returns a Fatal Error if the function fails in an unrecoverable way.
|
||
|
*/
|
||
|
static PKIX_Error *
|
||
|
pkix_pl_CertNameConstraints_ToString_Helper(
|
||
|
PKIX_PL_CertNameConstraints *nameConstraints,
|
||
|
PKIX_PL_String **pString,
|
||
|
void *plContext)
|
||
|
{
|
||
|
char *asciiFormat = NULL;
|
||
|
PKIX_PL_String *formatString = NULL;
|
||
|
PKIX_List *permittedList = NULL;
|
||
|
PKIX_List *excludedList = NULL;
|
||
|
PKIX_PL_String *permittedListString = NULL;
|
||
|
PKIX_PL_String *excludedListString = NULL;
|
||
|
PKIX_PL_String *nameConstraintsString = NULL;
|
||
|
|
||
|
PKIX_ENTER(CERTNAMECONSTRAINTS,
|
||
|
"pkix_pl_CertNameConstraints_ToString_Helper");
|
||
|
PKIX_NULLCHECK_TWO(nameConstraints, pString);
|
||
|
|
||
|
asciiFormat =
|
||
|
"[\n"
|
||
|
"\t\tPermitted Name: %s\n"
|
||
|
"\t\tExcluded Name: %s\n"
|
||
|
"\t]\n";
|
||
|
|
||
|
PKIX_CHECK(PKIX_PL_String_Create
|
||
|
(PKIX_ESCASCII,
|
||
|
asciiFormat,
|
||
|
0,
|
||
|
&formatString,
|
||
|
plContext),
|
||
|
PKIX_STRINGCREATEFAILED);
|
||
|
|
||
|
PKIX_CHECK(pkix_pl_CertNameConstraints_GetPermitted
|
||
|
(nameConstraints, &permittedList, plContext),
|
||
|
PKIX_CERTNAMECONSTRAINTSGETPERMITTEDFAILED);
|
||
|
|
||
|
PKIX_TOSTRING(permittedList, &permittedListString, plContext,
|
||
|
PKIX_LISTTOSTRINGFAILED);
|
||
|
|
||
|
PKIX_CHECK(pkix_pl_CertNameConstraints_GetExcluded
|
||
|
(nameConstraints, &excludedList, plContext),
|
||
|
PKIX_CERTNAMECONSTRAINTSGETEXCLUDEDFAILED);
|
||
|
|
||
|
PKIX_TOSTRING(excludedList, &excludedListString, plContext,
|
||
|
PKIX_LISTTOSTRINGFAILED);
|
||
|
|
||
|
PKIX_CHECK(PKIX_PL_Sprintf
|
||
|
(&nameConstraintsString,
|
||
|
plContext,
|
||
|
formatString,
|
||
|
permittedListString,
|
||
|
excludedListString),
|
||
|
PKIX_SPRINTFFAILED);
|
||
|
|
||
|
*pString = nameConstraintsString;
|
||
|
|
||
|
cleanup:
|
||
|
|
||
|
PKIX_DECREF(formatString);
|
||
|
PKIX_DECREF(permittedList);
|
||
|
PKIX_DECREF(excludedList);
|
||
|
PKIX_DECREF(permittedListString);
|
||
|
PKIX_DECREF(excludedListString);
|
||
|
|
||
|
PKIX_RETURN(CERTNAMECONSTRAINTS);
|
||
|
}
|
||
|
|
||
|
/*
|
||
|
* FUNCTION: pkix_pl_CertNameConstraints_ToString
|
||
|
* (see comments for PKIX_PL_ToStringCallback in pkix_pl_system.h)
|
||
|
*/
|
||
|
static PKIX_Error *
|
||
|
pkix_pl_CertNameConstraints_ToString(
|
||
|
PKIX_PL_Object *object,
|
||
|
PKIX_PL_String **pString,
|
||
|
void *plContext)
|
||
|
{
|
||
|
PKIX_PL_String *nameConstraintsString = NULL;
|
||
|
PKIX_PL_CertNameConstraints *nameConstraints = NULL;
|
||
|
|
||
|
PKIX_ENTER(CERTNAMECONSTRAINTS, "pkix_pl_CertNameConstraints_ToString");
|
||
|
PKIX_NULLCHECK_TWO(object, pString);
|
||
|
|
||
|
PKIX_CHECK(pkix_CheckType(
|
||
|
object, PKIX_CERTNAMECONSTRAINTS_TYPE, plContext),
|
||
|
PKIX_OBJECTNOTCERTNAMECONSTRAINTS);
|
||
|
|
||
|
nameConstraints = (PKIX_PL_CertNameConstraints *)object;
|
||
|
|
||
|
PKIX_CHECK(pkix_pl_CertNameConstraints_ToString_Helper
|
||
|
(nameConstraints, &nameConstraintsString, plContext),
|
||
|
PKIX_CERTNAMECONSTRAINTSTOSTRINGHELPERFAILED);
|
||
|
|
||
|
*pString = nameConstraintsString;
|
||
|
|
||
|
cleanup:
|
||
|
|
||
|
PKIX_RETURN(CERTNAMECONSTRAINTS);
|
||
|
}
|
||
|
|
||
|
/*
|
||
|
* FUNCTION: pkix_pl_CertNameConstraints_Hashcode
|
||
|
* (see comments for PKIX_PL_HashcodeCallback in pkix_pl_system.h)
|
||
|
*/
|
||
|
static PKIX_Error *
|
||
|
pkix_pl_CertNameConstraints_Hashcode(
|
||
|
PKIX_PL_Object *object,
|
||
|
PKIX_UInt32 *pHashcode,
|
||
|
void *plContext)
|
||
|
{
|
||
|
PKIX_PL_CertNameConstraints *nameConstraints = NULL;
|
||
|
PKIX_List *permittedList = NULL;
|
||
|
PKIX_List *excludedList = NULL;
|
||
|
PKIX_UInt32 permitHash = 0;
|
||
|
PKIX_UInt32 excludeHash = 0;
|
||
|
|
||
|
PKIX_ENTER(CERTNAMECONSTRAINTS, "pkix_pl_CertNameConstraints_Hashcode");
|
||
|
PKIX_NULLCHECK_TWO(object, pHashcode);
|
||
|
|
||
|
PKIX_CHECK(pkix_CheckType
|
||
|
(object, PKIX_CERTNAMECONSTRAINTS_TYPE, plContext),
|
||
|
PKIX_OBJECTNOTCERTNAMECONSTRAINTS);
|
||
|
|
||
|
nameConstraints = (PKIX_PL_CertNameConstraints *)object;
|
||
|
|
||
|
PKIX_CHECK(pkix_pl_CertNameConstraints_GetPermitted
|
||
|
(nameConstraints, &permittedList, plContext),
|
||
|
PKIX_CERTNAMECONSTRAINTSGETPERMITTEDFAILED);
|
||
|
|
||
|
PKIX_HASHCODE(permittedList, &permitHash, plContext,
|
||
|
PKIX_OBJECTHASHCODEFAILED);
|
||
|
|
||
|
PKIX_CHECK(pkix_pl_CertNameConstraints_GetExcluded
|
||
|
(nameConstraints, &excludedList, plContext),
|
||
|
PKIX_CERTNAMECONSTRAINTSGETEXCLUDEDFAILED);
|
||
|
|
||
|
PKIX_HASHCODE(excludedList, &excludeHash, plContext,
|
||
|
PKIX_OBJECTHASHCODEFAILED);
|
||
|
|
||
|
*pHashcode = (((permitHash << 7) + excludeHash) << 7) +
|
||
|
nameConstraints->numNssNameConstraints;
|
||
|
|
||
|
cleanup:
|
||
|
|
||
|
PKIX_DECREF(permittedList);
|
||
|
PKIX_DECREF(excludedList);
|
||
|
PKIX_RETURN(CERTNAMECONSTRAINTS);
|
||
|
}
|
||
|
|
||
|
/*
|
||
|
* FUNCTION: pkix_pl_CertNameConstraints_Equals
|
||
|
* (see comments for PKIX_PL_Equals_Callback in pkix_pl_system.h)
|
||
|
*/
|
||
|
static PKIX_Error *
|
||
|
pkix_pl_CertNameConstraints_Equals(
|
||
|
PKIX_PL_Object *firstObject,
|
||
|
PKIX_PL_Object *secondObject,
|
||
|
PKIX_Boolean *pResult,
|
||
|
void *plContext)
|
||
|
{
|
||
|
PKIX_PL_CertNameConstraints *firstNC = NULL;
|
||
|
PKIX_PL_CertNameConstraints *secondNC = NULL;
|
||
|
PKIX_List *firstPermittedList = NULL;
|
||
|
PKIX_List *secondPermittedList = NULL;
|
||
|
PKIX_List *firstExcludedList = NULL;
|
||
|
PKIX_List *secondExcludedList = NULL;
|
||
|
PKIX_UInt32 secondType;
|
||
|
PKIX_Boolean cmpResult = PKIX_FALSE;
|
||
|
|
||
|
PKIX_ENTER(CERTNAMECONSTRAINTS, "pkix_pl_CertNameConstraints_Equals");
|
||
|
PKIX_NULLCHECK_THREE(firstObject, secondObject, pResult);
|
||
|
|
||
|
/* test that firstObject is a CertNameConstraints */
|
||
|
PKIX_CHECK(pkix_CheckType
|
||
|
(firstObject, PKIX_CERTNAMECONSTRAINTS_TYPE, plContext),
|
||
|
PKIX_FIRSTOBJECTNOTCERTNAMECONSTRAINTS);
|
||
|
|
||
|
firstNC = (PKIX_PL_CertNameConstraints *)firstObject;
|
||
|
secondNC = (PKIX_PL_CertNameConstraints *)secondObject;
|
||
|
|
||
|
/*
|
||
|
* Since we know firstObject is a CertNameConstraints, if both
|
||
|
* references are identical, they must be equal
|
||
|
*/
|
||
|
if (firstNC == secondNC){
|
||
|
*pResult = PKIX_TRUE;
|
||
|
goto cleanup;
|
||
|
}
|
||
|
|
||
|
/*
|
||
|
* If secondNC isn't a CertNameConstraints, we don't throw an error.
|
||
|
* We simply return a Boolean result of FALSE
|
||
|
*/
|
||
|
*pResult = PKIX_FALSE;
|
||
|
|
||
|
PKIX_CHECK(PKIX_PL_Object_GetType
|
||
|
((PKIX_PL_Object *)secondNC, &secondType, plContext),
|
||
|
PKIX_COULDNOTGETTYPEOFSECONDARGUMENT);
|
||
|
|
||
|
if (secondType != PKIX_CERTNAMECONSTRAINTS_TYPE) {
|
||
|
goto cleanup;
|
||
|
}
|
||
|
|
||
|
PKIX_CHECK(pkix_pl_CertNameConstraints_GetPermitted
|
||
|
(firstNC, &firstPermittedList, plContext),
|
||
|
PKIX_CERTNAMECONSTRAINTSGETPERMITTEDFAILED);
|
||
|
|
||
|
PKIX_CHECK(pkix_pl_CertNameConstraints_GetPermitted
|
||
|
(secondNC, &secondPermittedList, plContext),
|
||
|
PKIX_CERTNAMECONSTRAINTSGETPERMITTEDFAILED);
|
||
|
|
||
|
PKIX_EQUALS
|
||
|
(firstPermittedList, secondPermittedList, &cmpResult, plContext,
|
||
|
PKIX_OBJECTEQUALSFAILED);
|
||
|
|
||
|
if (cmpResult != PKIX_TRUE) {
|
||
|
goto cleanup;
|
||
|
}
|
||
|
|
||
|
PKIX_CHECK(pkix_pl_CertNameConstraints_GetExcluded
|
||
|
(firstNC, &firstExcludedList, plContext),
|
||
|
PKIX_CERTNAMECONSTRAINTSGETEXCLUDEDFAILED);
|
||
|
|
||
|
PKIX_CHECK(pkix_pl_CertNameConstraints_GetExcluded
|
||
|
(secondNC, &secondExcludedList, plContext),
|
||
|
PKIX_CERTNAMECONSTRAINTSGETEXCLUDEDFAILED);
|
||
|
|
||
|
PKIX_EQUALS
|
||
|
(firstExcludedList, secondExcludedList, &cmpResult, plContext,
|
||
|
PKIX_OBJECTEQUALSFAILED);
|
||
|
|
||
|
if (cmpResult != PKIX_TRUE) {
|
||
|
goto cleanup;
|
||
|
}
|
||
|
|
||
|
/*
|
||
|
* numNssNameConstraints is not checked because it is basically a
|
||
|
* merge count, it cannot determine the data equality.
|
||
|
*/
|
||
|
|
||
|
*pResult = PKIX_TRUE;
|
||
|
|
||
|
cleanup:
|
||
|
|
||
|
PKIX_DECREF(firstPermittedList);
|
||
|
PKIX_DECREF(secondPermittedList);
|
||
|
PKIX_DECREF(firstExcludedList);
|
||
|
PKIX_DECREF(secondExcludedList);
|
||
|
|
||
|
PKIX_RETURN(CERTNAMECONSTRAINTS);
|
||
|
}
|
||
|
|
||
|
/*
|
||
|
* FUNCTION: pkix_pl_CertNameConstraints_RegisterSelf
|
||
|
* DESCRIPTION:
|
||
|
* Registers PKIX_CERTNAMECONSTRAINTS_TYPE and its related functions with
|
||
|
* systemClasses[]
|
||
|
* THREAD SAFETY:
|
||
|
* Not Thread Safe - for performance and complexity reasons
|
||
|
*
|
||
|
* Since this function is only called by PKIX_PL_Initialize, which should
|
||
|
* only be called once, it is acceptable that this function is not
|
||
|
* thread-safe.
|
||
|
*/
|
||
|
PKIX_Error *
|
||
|
pkix_pl_CertNameConstraints_RegisterSelf(void *plContext)
|
||
|
{
|
||
|
extern pkix_ClassTable_Entry systemClasses[PKIX_NUMTYPES];
|
||
|
pkix_ClassTable_Entry entry;
|
||
|
|
||
|
PKIX_ENTER(CERTNAMECONSTRAINTS,
|
||
|
"pkix_pl_CertNameConstraints_RegisterSelf");
|
||
|
|
||
|
entry.description = "CertNameConstraints";
|
||
|
entry.objCounter = 0;
|
||
|
entry.typeObjectSize = sizeof(PKIX_PL_CertNameConstraints);
|
||
|
entry.destructor = pkix_pl_CertNameConstraints_Destroy;
|
||
|
entry.equalsFunction = pkix_pl_CertNameConstraints_Equals;
|
||
|
entry.hashcodeFunction = pkix_pl_CertNameConstraints_Hashcode;
|
||
|
entry.toStringFunction = pkix_pl_CertNameConstraints_ToString;
|
||
|
entry.comparator = NULL;
|
||
|
entry.duplicateFunction = pkix_duplicateImmutable;
|
||
|
|
||
|
systemClasses[PKIX_CERTNAMECONSTRAINTS_TYPE] = entry;
|
||
|
|
||
|
PKIX_RETURN(CERTNAMECONSTRAINTS);
|
||
|
}
|
||
|
|
||
|
/*
|
||
|
* FUNCTION: pkix_pl_CertNameConstraints_Create_Helper
|
||
|
*
|
||
|
* DESCRIPTION:
|
||
|
* This function retrieves name constraints in "nssNameConstraints",
|
||
|
* converts and stores the result in a PKIX_PL_CertNameConstraints object.
|
||
|
*
|
||
|
* PARAMETERS
|
||
|
* "nssNameConstraints"
|
||
|
* Address of CERTNameConstraints that contains this object's data.
|
||
|
* Must be non-NULL.
|
||
|
* "pNameConstraints"
|
||
|
* Address where object pointer will be stored. Must be non-NULL.
|
||
|
* A NULL value will be returned if there is no Name Constraints extension.
|
||
|
* "plContext" - Platform-specific context pointer.
|
||
|
*
|
||
|
* THREAD SAFETY:
|
||
|
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
|
||
|
*
|
||
|
* RETURNS:
|
||
|
* Returns NULL if the function succeeds.
|
||
|
* Returns a NameConstraints Error if the function fails in a non-fatal way.
|
||
|
* Returns a Fatal Error if the function fails in an unrecoverable way.
|
||
|
*/
|
||
|
static PKIX_Error *
|
||
|
pkix_pl_CertNameConstraints_Create_Helper(
|
||
|
CERTNameConstraints *nssNameConstraints,
|
||
|
PKIX_PL_CertNameConstraints **pNameConstraints,
|
||
|
void *plContext)
|
||
|
{
|
||
|
PKIX_PL_CertNameConstraints *nameConstraints = NULL;
|
||
|
CERTNameConstraints **nssNameConstraintPtr = NULL;
|
||
|
|
||
|
PKIX_ENTER(CERTNAMECONSTRAINTS,
|
||
|
"pkix_pl_CertNameConstraints_Create_Helper");
|
||
|
PKIX_NULLCHECK_TWO(nssNameConstraints, pNameConstraints);
|
||
|
|
||
|
PKIX_CHECK(PKIX_PL_Object_Alloc
|
||
|
(PKIX_CERTNAMECONSTRAINTS_TYPE,
|
||
|
sizeof (PKIX_PL_CertNameConstraints),
|
||
|
(PKIX_PL_Object **)&nameConstraints,
|
||
|
plContext),
|
||
|
PKIX_COULDNOTCREATECERTNAMECONSTRAINTSOBJECT);
|
||
|
|
||
|
PKIX_CHECK(PKIX_PL_Malloc
|
||
|
(sizeof (CERTNameConstraint *),
|
||
|
(void *)&nssNameConstraintPtr,
|
||
|
plContext),
|
||
|
PKIX_MALLOCFAILED);
|
||
|
|
||
|
nameConstraints->numNssNameConstraints = 1;
|
||
|
nameConstraints->nssNameConstraintsList = nssNameConstraintPtr;
|
||
|
*nssNameConstraintPtr = nssNameConstraints;
|
||
|
|
||
|
nameConstraints->permittedList = NULL;
|
||
|
nameConstraints->excludedList = NULL;
|
||
|
nameConstraints->arena = NULL;
|
||
|
|
||
|
*pNameConstraints = nameConstraints;
|
||
|
|
||
|
cleanup:
|
||
|
|
||
|
if (PKIX_ERROR_RECEIVED){
|
||
|
PKIX_DECREF(nameConstraints);
|
||
|
}
|
||
|
|
||
|
PKIX_RETURN(CERTNAMECONSTRAINTS);
|
||
|
}
|
||
|
|
||
|
/*
|
||
|
* FUNCTION: pkix_pl_CertNameConstraints_Create
|
||
|
*
|
||
|
* DESCRIPTION:
|
||
|
* function that allocates and initialize the object CertNameConstraints.
|
||
|
*
|
||
|
* PARAMETERS
|
||
|
* "nssCert"
|
||
|
* Address of CERT that contains this object's data.
|
||
|
* Must be non-NULL.
|
||
|
* "pNameConstraints"
|
||
|
* Address where object pointer will be stored. Must be non-NULL.
|
||
|
* A NULL value will be returned if there is no Name Constraints extension.
|
||
|
* "plContext" - Platform-specific context pointer.
|
||
|
*
|
||
|
* THREAD SAFETY:
|
||
|
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
|
||
|
*
|
||
|
* RETURNS:
|
||
|
* Returns NULL if the function succeeds.
|
||
|
* Returns a NameConstraints Error if the function fails in a non-fatal way.
|
||
|
* Returns a Fatal Error if the function fails in an unrecoverable way.
|
||
|
*/
|
||
|
PKIX_Error *
|
||
|
pkix_pl_CertNameConstraints_Create(
|
||
|
CERTCertificate *nssCert,
|
||
|
PKIX_PL_CertNameConstraints **pNameConstraints,
|
||
|
void *plContext)
|
||
|
{
|
||
|
PKIX_PL_CertNameConstraints *nameConstraints = NULL;
|
||
|
CERTNameConstraints *nssNameConstraints = NULL;
|
||
|
PLArenaPool *arena = NULL;
|
||
|
SECStatus status;
|
||
|
|
||
|
PKIX_ENTER(CERTNAMECONSTRAINTS, "pkix_pl_CertNameConstraints_Create");
|
||
|
PKIX_NULLCHECK_THREE(nssCert, pNameConstraints, nssCert->arena);
|
||
|
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG("\t\tCalling PORT_NewArena).\n");
|
||
|
arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
|
||
|
if (arena == NULL) {
|
||
|
PKIX_ERROR(PKIX_OUTOFMEMORY);
|
||
|
}
|
||
|
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG
|
||
|
("\t\tCalling CERT_FindNameConstraintsExten\n");
|
||
|
status = CERT_FindNameConstraintsExten
|
||
|
(arena, nssCert, &nssNameConstraints);
|
||
|
|
||
|
if (status != SECSuccess) {
|
||
|
PKIX_ERROR(PKIX_DECODINGCERTNAMECONSTRAINTSFAILED);
|
||
|
}
|
||
|
|
||
|
if (nssNameConstraints == NULL) {
|
||
|
*pNameConstraints = NULL;
|
||
|
if (arena){
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG
|
||
|
("\t\tCalling PORT_FreeArena).\n");
|
||
|
PORT_FreeArena(arena, PR_FALSE);
|
||
|
}
|
||
|
goto cleanup;
|
||
|
}
|
||
|
|
||
|
PKIX_CHECK(pkix_pl_CertNameConstraints_Create_Helper
|
||
|
(nssNameConstraints, &nameConstraints, plContext),
|
||
|
PKIX_CERTNAMECONSTRAINTSCREATEHELPERFAILED);
|
||
|
|
||
|
nameConstraints->arena = arena;
|
||
|
|
||
|
*pNameConstraints = nameConstraints;
|
||
|
|
||
|
cleanup:
|
||
|
|
||
|
if (PKIX_ERROR_RECEIVED){
|
||
|
if (arena){
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG
|
||
|
("\t\tCalling PORT_FreeArena).\n");
|
||
|
PORT_FreeArena(arena, PR_FALSE);
|
||
|
}
|
||
|
}
|
||
|
|
||
|
PKIX_RETURN(CERTNAMECONSTRAINTS);
|
||
|
}
|
||
|
|
||
|
/*
|
||
|
* FUNCTION: pkix_pl_CertNameConstraints_CreateByMerge
|
||
|
*
|
||
|
* DESCRIPTION:
|
||
|
*
|
||
|
* This function allocates and creates a PKIX_PL_NameConstraint object
|
||
|
* for merging. It also allocates CERTNameConstraints data space for the
|
||
|
* merged NSS NameConstraints data.
|
||
|
*
|
||
|
* PARAMETERS
|
||
|
* "pNameConstraints"
|
||
|
* Address where object pointer will be stored and returned.
|
||
|
* Must be non-NULL.
|
||
|
* "plContext" - Platform-specific context pointer.
|
||
|
*
|
||
|
* THREAD SAFETY:
|
||
|
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
|
||
|
*
|
||
|
* RETURNS:
|
||
|
* Returns NULL if the function succeeds.
|
||
|
* Returns a NameConstraints Error if the function fails in a non-fatal way.
|
||
|
* Returns a Fatal Error if the function fails in an unrecoverable way.
|
||
|
*/
|
||
|
static PKIX_Error *
|
||
|
pkix_pl_CertNameConstraints_CreateByMerge(
|
||
|
PKIX_PL_CertNameConstraints **pNameConstraints,
|
||
|
void *plContext)
|
||
|
{
|
||
|
PKIX_PL_CertNameConstraints *nameConstraints = NULL;
|
||
|
CERTNameConstraints *nssNameConstraints = NULL;
|
||
|
PLArenaPool *arena = NULL;
|
||
|
|
||
|
PKIX_ENTER(CERTNAMECONSTRAINTS,
|
||
|
"pkix_pl_CertNameConstraints_CreateByMerge");
|
||
|
PKIX_NULLCHECK_ONE(pNameConstraints);
|
||
|
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG("\t\tCalling PORT_NewArena).\n");
|
||
|
arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
|
||
|
if (arena == NULL) {
|
||
|
PKIX_ERROR(PKIX_OUTOFMEMORY);
|
||
|
}
|
||
|
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG("\t\tCalling PORT_ArenaZNew).\n");
|
||
|
nssNameConstraints = PORT_ArenaZNew(arena, CERTNameConstraints);
|
||
|
if (nssNameConstraints == NULL) {
|
||
|
PKIX_ERROR(PKIX_PORTARENAALLOCFAILED);
|
||
|
}
|
||
|
|
||
|
nssNameConstraints->permited = NULL;
|
||
|
nssNameConstraints->excluded = NULL;
|
||
|
nssNameConstraints->DERPermited = NULL;
|
||
|
nssNameConstraints->DERExcluded = NULL;
|
||
|
|
||
|
PKIX_CHECK(pkix_pl_CertNameConstraints_Create_Helper
|
||
|
(nssNameConstraints, &nameConstraints, plContext),
|
||
|
PKIX_CERTNAMECONSTRAINTSCREATEHELPERFAILED);
|
||
|
|
||
|
nameConstraints->arena = arena;
|
||
|
|
||
|
*pNameConstraints = nameConstraints;
|
||
|
|
||
|
cleanup:
|
||
|
|
||
|
if (PKIX_ERROR_RECEIVED){
|
||
|
if (arena){
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG
|
||
|
("\t\tCalling PORT_FreeArena).\n");
|
||
|
PORT_FreeArena(arena, PR_FALSE);
|
||
|
}
|
||
|
}
|
||
|
|
||
|
PKIX_RETURN(CERTNAMECONSTRAINTS);
|
||
|
}
|
||
|
|
||
|
/*
|
||
|
* FUNCTION: pkix_pl_CertNameConstraints_CopyNssNameConstraints
|
||
|
*
|
||
|
* DESCRIPTION:
|
||
|
*
|
||
|
* This function allocates and copies data to a NSS CERTNameConstraints from
|
||
|
* the NameConstraints given by "srcNC" and stores the result at "pDestNC". It
|
||
|
* copies items on both the permitted and excluded lists, but not the
|
||
|
* DERPermited and DERExcluded.
|
||
|
*
|
||
|
* PARAMETERS
|
||
|
* "arena"
|
||
|
* Memory pool where object data is allocated from. Must be non-NULL.
|
||
|
* "srcNC"
|
||
|
* Address of the NameConstraints to copy from. Must be non-NULL.
|
||
|
* "pDestNC"
|
||
|
* Address where new copied object is stored and returned.
|
||
|
* Must be non-NULL.
|
||
|
* "plContext" - Platform-specific context pointer.
|
||
|
*
|
||
|
* THREAD SAFETY:
|
||
|
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
|
||
|
*
|
||
|
* RETURNS:
|
||
|
* Returns NULL if the function succeeds.
|
||
|
* Returns a NameConstraints Error if the function fails in a non-fatal way.
|
||
|
* Returns a Fatal Error if the function fails in an unrecoverable way.
|
||
|
*/
|
||
|
static PKIX_Error *
|
||
|
pkix_pl_CertNameConstraints_CopyNssNameConstraints(
|
||
|
PLArenaPool *arena,
|
||
|
CERTNameConstraints *srcNC,
|
||
|
CERTNameConstraints **pDestNC,
|
||
|
void *plContext)
|
||
|
{
|
||
|
CERTNameConstraints *nssNameConstraints = NULL;
|
||
|
CERTNameConstraint *nssNameConstraintHead = NULL;
|
||
|
CERTNameConstraint *nssCurrent = NULL;
|
||
|
CERTNameConstraint *nssCopyTo = NULL;
|
||
|
CERTNameConstraint *nssCopyFrom = NULL;
|
||
|
|
||
|
PKIX_ENTER(CERTNAMECONSTRAINTS,
|
||
|
"pkix_pl_CertNameConstraints_CopyNssNameConstraints");
|
||
|
PKIX_NULLCHECK_THREE(arena, srcNC, pDestNC);
|
||
|
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG("\t\tCalling PORT_ArenaZNew).\n");
|
||
|
nssNameConstraints = PORT_ArenaZNew(arena, CERTNameConstraints);
|
||
|
if (nssNameConstraints == NULL) {
|
||
|
PKIX_ERROR(PKIX_PORTARENAALLOCFAILED);
|
||
|
}
|
||
|
|
||
|
if (srcNC->permited) {
|
||
|
|
||
|
nssCopyFrom = srcNC->permited;
|
||
|
|
||
|
do {
|
||
|
|
||
|
nssCopyTo = NULL;
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG
|
||
|
("\t\tCalling CERT_CopyNameConstraint).\n");
|
||
|
nssCopyTo = CERT_CopyNameConstraint
|
||
|
(arena, nssCopyTo, nssCopyFrom);
|
||
|
if (nssCopyTo == NULL) {
|
||
|
PKIX_ERROR(PKIX_CERTCOPYNAMECONSTRAINTFAILED);
|
||
|
}
|
||
|
if (nssCurrent == NULL) {
|
||
|
nssCurrent = nssNameConstraintHead = nssCopyTo;
|
||
|
} else {
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG
|
||
|
("\t\tCalling CERT_AddNameConstraint).\n");
|
||
|
nssCurrent = CERT_AddNameConstraint
|
||
|
(nssCurrent, nssCopyTo);
|
||
|
}
|
||
|
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG
|
||
|
("\t\tCalling CERT_GetNextNameConstrain).\n");
|
||
|
nssCopyFrom = CERT_GetNextNameConstraint(nssCopyFrom);
|
||
|
|
||
|
} while (nssCopyFrom != srcNC->permited);
|
||
|
|
||
|
nssNameConstraints->permited = nssNameConstraintHead;
|
||
|
}
|
||
|
|
||
|
if (srcNC->excluded) {
|
||
|
|
||
|
nssCurrent = NULL;
|
||
|
nssCopyFrom = srcNC->excluded;
|
||
|
|
||
|
do {
|
||
|
|
||
|
/*
|
||
|
* Cannot use CERT_DupGeneralNameList, which just increments
|
||
|
* refcount. We need our own copy since arena is for each
|
||
|
* PKIX_PL_NameConstraints. Perhaps contribute this code
|
||
|
* as CERT_CopyGeneralNameList (in the future).
|
||
|
*/
|
||
|
nssCopyTo = NULL;
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG
|
||
|
("\t\tCalling CERT_CopyNameConstraint).\n");
|
||
|
nssCopyTo = CERT_CopyNameConstraint
|
||
|
(arena, nssCopyTo, nssCopyFrom);
|
||
|
if (nssCopyTo == NULL) {
|
||
|
PKIX_ERROR(PKIX_CERTCOPYNAMECONSTRAINTFAILED);
|
||
|
}
|
||
|
if (nssCurrent == NULL) {
|
||
|
nssCurrent = nssNameConstraintHead = nssCopyTo;
|
||
|
} else {
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG
|
||
|
("\t\tCalling CERT_AddNameConstraint).\n");
|
||
|
nssCurrent = CERT_AddNameConstraint
|
||
|
(nssCurrent, nssCopyTo);
|
||
|
}
|
||
|
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG
|
||
|
("\t\tCalling CERT_GetNextNameConstrain).\n");
|
||
|
nssCopyFrom = CERT_GetNextNameConstraint(nssCopyFrom);
|
||
|
|
||
|
} while (nssCopyFrom != srcNC->excluded);
|
||
|
|
||
|
nssNameConstraints->excluded = nssNameConstraintHead;
|
||
|
}
|
||
|
|
||
|
*pDestNC = nssNameConstraints;
|
||
|
|
||
|
cleanup:
|
||
|
|
||
|
PKIX_RETURN(CERTNAMECONSTRAINTS);
|
||
|
}
|
||
|
|
||
|
/*
|
||
|
* FUNCTION: pkix_pl_CertNameConstraints_Merge
|
||
|
*
|
||
|
* DESCRIPTION:
|
||
|
*
|
||
|
* This function merges two NameConstraints pointed to by "firstNC" and
|
||
|
* "secondNC" and stores the result in "pMergedNC".
|
||
|
*
|
||
|
* PARAMETERS
|
||
|
* "firstNC"
|
||
|
* Address of the first NameConstraints to be merged. Must be non-NULL.
|
||
|
* "secondNC"
|
||
|
* Address of the second NameConstraints to be merged. Must be non-NULL.
|
||
|
* "pMergedNC"
|
||
|
* Address where the merge result is stored and returned. Must be non-NULL.
|
||
|
* "plContext" - Platform-specific context pointer.
|
||
|
*
|
||
|
* THREAD SAFETY:
|
||
|
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
|
||
|
*
|
||
|
* RETURNS:
|
||
|
* Returns NULL if the function succeeds.
|
||
|
* Returns a NameConstraints Error if the function fails in a non-fatal way.
|
||
|
* Returns a Fatal Error if the function fails in an unrecoverable way.
|
||
|
*/
|
||
|
PKIX_Error *
|
||
|
pkix_pl_CertNameConstraints_Merge(
|
||
|
PKIX_PL_CertNameConstraints *firstNC,
|
||
|
PKIX_PL_CertNameConstraints *secondNC,
|
||
|
PKIX_PL_CertNameConstraints **pMergedNC,
|
||
|
void *plContext)
|
||
|
{
|
||
|
PKIX_PL_CertNameConstraints *nameConstraints = NULL;
|
||
|
CERTNameConstraints **nssNCto = NULL;
|
||
|
CERTNameConstraints **nssNCfrom = NULL;
|
||
|
CERTNameConstraints *nssNameConstraints = NULL;
|
||
|
PKIX_UInt32 numNssItems = 0;
|
||
|
PKIX_UInt32 i;
|
||
|
|
||
|
PKIX_ENTER(CERTNAMECONSTRAINTS, "pkix_pl_CertNameConstraints_Merge");
|
||
|
PKIX_NULLCHECK_THREE(firstNC, secondNC, pMergedNC);
|
||
|
|
||
|
PKIX_CHECK(pkix_pl_CertNameConstraints_CreateByMerge
|
||
|
(&nameConstraints, plContext),
|
||
|
PKIX_CERTNAMECONSTRAINTSCREATEBYMERGEFAILED);
|
||
|
|
||
|
/* Merge NSSCertConstraint lists */
|
||
|
|
||
|
numNssItems = firstNC->numNssNameConstraints +
|
||
|
secondNC->numNssNameConstraints;
|
||
|
|
||
|
/* Free the default space (only one entry) allocated by create */
|
||
|
PKIX_CHECK(PKIX_PL_Free
|
||
|
(nameConstraints->nssNameConstraintsList, plContext),
|
||
|
PKIX_FREEFAILED);
|
||
|
|
||
|
/* Reallocate the size we need */
|
||
|
PKIX_CHECK(PKIX_PL_Malloc
|
||
|
(numNssItems * sizeof (CERTNameConstraint *),
|
||
|
(void *)&nssNCto,
|
||
|
plContext),
|
||
|
PKIX_MALLOCFAILED);
|
||
|
|
||
|
nameConstraints->nssNameConstraintsList = nssNCto;
|
||
|
|
||
|
nssNCfrom = firstNC->nssNameConstraintsList;
|
||
|
|
||
|
for (i = 0; i < firstNC->numNssNameConstraints; i++) {
|
||
|
|
||
|
PKIX_CHECK(pkix_pl_CertNameConstraints_CopyNssNameConstraints
|
||
|
(nameConstraints->arena,
|
||
|
*nssNCfrom,
|
||
|
&nssNameConstraints,
|
||
|
plContext),
|
||
|
PKIX_CERTNAMECONSTRAINTSCOPYNSSNAMECONSTRAINTSFAILED);
|
||
|
|
||
|
*nssNCto = nssNameConstraints;
|
||
|
|
||
|
nssNCto++;
|
||
|
nssNCfrom++;
|
||
|
}
|
||
|
|
||
|
nssNCfrom = secondNC->nssNameConstraintsList;
|
||
|
|
||
|
for (i = 0; i < secondNC->numNssNameConstraints; i++) {
|
||
|
|
||
|
PKIX_CHECK(pkix_pl_CertNameConstraints_CopyNssNameConstraints
|
||
|
(nameConstraints->arena,
|
||
|
*nssNCfrom,
|
||
|
&nssNameConstraints,
|
||
|
plContext),
|
||
|
PKIX_CERTNAMECONSTRAINTSCOPYNSSNAMECONSTRAINTSFAILED);
|
||
|
|
||
|
*nssNCto = nssNameConstraints;
|
||
|
|
||
|
nssNCto++;
|
||
|
nssNCfrom++;
|
||
|
}
|
||
|
|
||
|
nameConstraints->numNssNameConstraints = numNssItems;
|
||
|
nameConstraints->permittedList = NULL;
|
||
|
nameConstraints->excludedList = NULL;
|
||
|
|
||
|
*pMergedNC = nameConstraints;
|
||
|
|
||
|
cleanup:
|
||
|
|
||
|
if (PKIX_ERROR_RECEIVED){
|
||
|
PKIX_DECREF(nameConstraints);
|
||
|
}
|
||
|
|
||
|
PKIX_RETURN(CERTNAMECONSTRAINTS);
|
||
|
}
|
||
|
|
||
|
/* --Public-NameConstraints-Functions-------------------------------- */
|
||
|
|
||
|
/*
|
||
|
* FUNCTION: PKIX_PL_CertNameConstraints_CheckNamesInNameSpace
|
||
|
* (see comments in pkix_pl_system.h)
|
||
|
*/
|
||
|
PKIX_Error *
|
||
|
PKIX_PL_CertNameConstraints_CheckNamesInNameSpace(
|
||
|
PKIX_List *nameList, /* List of PKIX_PL_GeneralName */
|
||
|
PKIX_PL_CertNameConstraints *nameConstraints,
|
||
|
PKIX_Boolean *pCheckPass,
|
||
|
void *plContext)
|
||
|
{
|
||
|
CERTNameConstraints **nssNameConstraintsList = NULL;
|
||
|
CERTNameConstraints *nssNameConstraints = NULL;
|
||
|
CERTGeneralName *nssMatchName = NULL;
|
||
|
PLArenaPool *arena = NULL;
|
||
|
PKIX_PL_GeneralName *name = NULL;
|
||
|
PKIX_UInt32 numNameItems = 0;
|
||
|
PKIX_UInt32 numNCItems = 0;
|
||
|
PKIX_UInt32 i, j;
|
||
|
SECStatus status = SECSuccess;
|
||
|
|
||
|
PKIX_ENTER(CERTNAMECONSTRAINTS,
|
||
|
"PKIX_PL_CertNameConstraints_CheckNamesInNameSpace");
|
||
|
PKIX_NULLCHECK_TWO(nameConstraints, pCheckPass);
|
||
|
|
||
|
*pCheckPass = PKIX_TRUE;
|
||
|
|
||
|
if (nameList != NULL) {
|
||
|
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG("\t\tCalling PORT_NewArena\n");
|
||
|
arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
|
||
|
if (arena == NULL) {
|
||
|
PKIX_ERROR(PKIX_OUTOFMEMORY);
|
||
|
}
|
||
|
|
||
|
nssNameConstraintsList =
|
||
|
nameConstraints->nssNameConstraintsList;
|
||
|
PKIX_NULLCHECK_ONE(nssNameConstraintsList);
|
||
|
numNCItems = nameConstraints->numNssNameConstraints;
|
||
|
|
||
|
PKIX_CHECK(PKIX_List_GetLength
|
||
|
(nameList, &numNameItems, plContext),
|
||
|
PKIX_LISTGETLENGTHFAILED);
|
||
|
|
||
|
for (i = 0; i < numNameItems; i++) {
|
||
|
|
||
|
PKIX_CHECK(PKIX_List_GetItem
|
||
|
(nameList,
|
||
|
i,
|
||
|
(PKIX_PL_Object **) &name,
|
||
|
plContext),
|
||
|
PKIX_LISTGETITEMFAILED);
|
||
|
|
||
|
PKIX_CHECK(pkix_pl_GeneralName_GetNssGeneralName
|
||
|
(name, &nssMatchName, plContext),
|
||
|
PKIX_GENERALNAMEGETNSSGENERALNAMEFAILED);
|
||
|
|
||
|
PKIX_DECREF(name);
|
||
|
|
||
|
for (j = 0; j < numNCItems; j++) {
|
||
|
|
||
|
nssNameConstraints = *(nssNameConstraintsList + j);
|
||
|
PKIX_NULLCHECK_ONE(nssNameConstraints);
|
||
|
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG
|
||
|
("\t\tCalling CERT_CheckNameSpace\n");
|
||
|
status = CERT_CheckNameSpace
|
||
|
(arena, nssNameConstraints, nssMatchName);
|
||
|
if (status != SECSuccess) {
|
||
|
break;
|
||
|
}
|
||
|
|
||
|
}
|
||
|
|
||
|
if (status != SECSuccess) {
|
||
|
break;
|
||
|
}
|
||
|
|
||
|
}
|
||
|
}
|
||
|
|
||
|
if (status == SECFailure) {
|
||
|
*pCheckPass = PKIX_FALSE;
|
||
|
}
|
||
|
|
||
|
cleanup:
|
||
|
|
||
|
if (arena){
|
||
|
PKIX_CERTNAMECONSTRAINTS_DEBUG
|
||
|
("\t\tCalling PORT_FreeArena).\n");
|
||
|
PORT_FreeArena(arena, PR_FALSE);
|
||
|
}
|
||
|
|
||
|
PKIX_RETURN(CERTNAMECONSTRAINTS);
|
||
|
}
|