| /* This Source Code Form is subject to the terms of the Mozilla Public |
| * License, v. 2.0. If a copy of the MPL was not distributed with this |
| * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ |
| |
| /* |
| * X.509 v3 Basic Constraints Extension |
| */ |
| |
| #include "prtypes.h" |
| #include <limits.h> /* for LONG_MAX */ |
| #include "seccomon.h" |
| #include "secdert.h" |
| #include "secoidt.h" |
| #include "secasn1t.h" |
| #include "secasn1.h" |
| #include "certt.h" |
| #include "secder.h" |
| #include "prprf.h" |
| #include "secerr.h" |
| |
| typedef struct EncodedContext { |
| SECItem isCA; |
| SECItem pathLenConstraint; |
| SECItem encodedValue; |
| PLArenaPool *arena; |
| } EncodedContext; |
| |
| static const SEC_ASN1Template CERTBasicConstraintsTemplate[] = { |
| { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(EncodedContext) }, |
| { SEC_ASN1_OPTIONAL | SEC_ASN1_BOOLEAN, /* XXX DER_DEFAULT */ |
| offsetof(EncodedContext, isCA) }, |
| { SEC_ASN1_OPTIONAL | SEC_ASN1_INTEGER, |
| offsetof(EncodedContext, pathLenConstraint) }, |
| { 0 } |
| }; |
| |
| static unsigned char hexTrue = 0xff; |
| static unsigned char hexFalse = 0x00; |
| |
| #define GEN_BREAK(status) \ |
| rv = status; \ |
| break; |
| |
| SECStatus |
| CERT_EncodeBasicConstraintValue(PLArenaPool *arena, CERTBasicConstraints *value, |
| SECItem *encodedValue) |
| { |
| EncodedContext encodeContext; |
| PLArenaPool *our_pool = NULL; |
| SECStatus rv = SECSuccess; |
| |
| do { |
| PORT_Memset(&encodeContext, 0, sizeof(encodeContext)); |
| if (!value->isCA && value->pathLenConstraint >= 0) { |
| PORT_SetError(SEC_ERROR_EXTENSION_VALUE_INVALID); |
| GEN_BREAK(SECFailure); |
| } |
| |
| encodeContext.arena = arena; |
| if (value->isCA == PR_TRUE) { |
| encodeContext.isCA.data = &hexTrue; |
| encodeContext.isCA.len = 1; |
| } |
| |
| /* If the pathLenConstraint is less than 0, then it should be |
| * omitted from the encoding. |
| */ |
| if (value->isCA && value->pathLenConstraint >= 0) { |
| our_pool = PORT_NewArena(SEC_ASN1_DEFAULT_ARENA_SIZE); |
| if (our_pool == NULL) { |
| PORT_SetError(SEC_ERROR_NO_MEMORY); |
| GEN_BREAK(SECFailure); |
| } |
| if (SEC_ASN1EncodeUnsignedInteger( |
| our_pool, &encodeContext.pathLenConstraint, |
| (unsigned long)value->pathLenConstraint) == NULL) { |
| PORT_SetError(SEC_ERROR_NO_MEMORY); |
| GEN_BREAK(SECFailure); |
| } |
| } |
| if (SEC_ASN1EncodeItem(arena, encodedValue, &encodeContext, |
| CERTBasicConstraintsTemplate) == NULL) { |
| GEN_BREAK(SECFailure); |
| } |
| } while (0); |
| if (our_pool) |
| PORT_FreeArena(our_pool, PR_FALSE); |
| return (rv); |
| } |
| |
| SECStatus |
| CERT_DecodeBasicConstraintValue(CERTBasicConstraints *value, |
| const SECItem *encodedValue) |
| { |
| EncodedContext decodeContext; |
| PORTCheapArenaPool tmpArena; |
| SECStatus rv = SECSuccess; |
| |
| do { |
| PORT_Memset(&decodeContext, 0, sizeof(decodeContext)); |
| /* initialize the value just in case we got "0x30 00", or when the |
| pathLenConstraint is omitted. |
| */ |
| decodeContext.isCA.data = &hexFalse; |
| decodeContext.isCA.len = 1; |
| |
| PORT_InitCheapArena(&tmpArena, SEC_ASN1_DEFAULT_ARENA_SIZE); |
| |
| rv = SEC_QuickDERDecodeItem(&tmpArena.arena, &decodeContext, |
| CERTBasicConstraintsTemplate, encodedValue); |
| if (rv == SECFailure) |
| break; |
| |
| value->isCA = decodeContext.isCA.data |
| ? (PRBool)(decodeContext.isCA.data[0] != 0) |
| : PR_FALSE; |
| if (decodeContext.pathLenConstraint.data == NULL) { |
| /* if the pathLenConstraint is not encoded, and the current setting |
| is CA, then the pathLenConstraint should be set to a negative |
| number |
| for unlimited certificate path. |
| */ |
| if (value->isCA) |
| value->pathLenConstraint = CERT_UNLIMITED_PATH_CONSTRAINT; |
| } else if (value->isCA) { |
| long len = DER_GetInteger(&decodeContext.pathLenConstraint); |
| if (len < 0 || len == LONG_MAX) { |
| PORT_SetError(SEC_ERROR_BAD_DER); |
| GEN_BREAK(SECFailure); |
| } |
| value->pathLenConstraint = len; |
| } else { |
| /* here we get an error where the subject is not a CA, but |
| the pathLenConstraint is set */ |
| PORT_SetError(SEC_ERROR_BAD_DER); |
| GEN_BREAK(SECFailure); |
| break; |
| } |
| } while (0); |
| |
| PORT_DestroyCheapArena(&tmpArena); |
| return (rv); |
| } |