| /* This Source Code Form is subject to the terms of the Mozilla Public |
| * License, v. 2.0. If a copy of the MPL was not distributed with this |
| * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ |
| /* |
| * pkix_policychecker.c |
| * |
| * Functions for Policy Checker |
| * |
| */ |
| #include "pkix_policychecker.h" |
| |
| /* --Forward declarations----------------------------------------------- */ |
| |
| static PKIX_Error * |
| pkix_PolicyChecker_MakeSingleton( |
| PKIX_PL_Object *listItem, |
| PKIX_Boolean immutability, |
| PKIX_List **pList, |
| void *plContext); |
| |
| /* --Private-PolicyCheckerState-Functions---------------------------------- */ |
| |
| /* |
| * FUNCTION:pkix_PolicyCheckerState_Destroy |
| * (see comments for PKIX_PL_DestructorCallback in pkix_pl_system.h) |
| */ |
| static PKIX_Error * |
| pkix_PolicyCheckerState_Destroy( |
| PKIX_PL_Object *object, |
| void *plContext) |
| { |
| PKIX_PolicyCheckerState *checkerState = NULL; |
| |
| PKIX_ENTER(CERTPOLICYCHECKERSTATE, "pkix_PolicyCheckerState_Destroy"); |
| PKIX_NULLCHECK_ONE(object); |
| |
| PKIX_CHECK(pkix_CheckType |
| (object, PKIX_CERTPOLICYCHECKERSTATE_TYPE, plContext), |
| PKIX_OBJECTNOTPOLICYCHECKERSTATE); |
| |
| checkerState = (PKIX_PolicyCheckerState *)object; |
| |
| PKIX_DECREF(checkerState->certPoliciesExtension); |
| PKIX_DECREF(checkerState->policyMappingsExtension); |
| PKIX_DECREF(checkerState->policyConstraintsExtension); |
| PKIX_DECREF(checkerState->inhibitAnyPolicyExtension); |
| PKIX_DECREF(checkerState->anyPolicyOID); |
| PKIX_DECREF(checkerState->validPolicyTree); |
| PKIX_DECREF(checkerState->userInitialPolicySet); |
| PKIX_DECREF(checkerState->mappedUserInitialPolicySet); |
| |
| checkerState->policyQualifiersRejected = PKIX_FALSE; |
| checkerState->explicitPolicy = 0; |
| checkerState->inhibitAnyPolicy = 0; |
| checkerState->policyMapping = 0; |
| checkerState->numCerts = 0; |
| checkerState->certsProcessed = 0; |
| checkerState->certPoliciesCritical = PKIX_FALSE; |
| |
| PKIX_DECREF(checkerState->anyPolicyNodeAtBottom); |
| PKIX_DECREF(checkerState->newAnyPolicyNode); |
| PKIX_DECREF(checkerState->mappedPolicyOIDs); |
| |
| cleanup: |
| |
| PKIX_RETURN(CERTPOLICYCHECKERSTATE); |
| } |
| |
| /* |
| * FUNCTION: pkix_PolicyCheckerState_ToString |
| * (see comments for PKIX_PL_ToStringCallback in pkix_pl_system.h) |
| */ |
| static PKIX_Error * |
| pkix_PolicyCheckerState_ToString( |
| PKIX_PL_Object *object, |
| PKIX_PL_String **pCheckerStateString, |
| void *plContext) |
| { |
| PKIX_PolicyCheckerState *state = NULL; |
| PKIX_PL_String *resultString = NULL; |
| PKIX_PL_String *policiesExtOIDString = NULL; |
| PKIX_PL_String *policyMapOIDString = NULL; |
| PKIX_PL_String *policyConstrOIDString = NULL; |
| PKIX_PL_String *inhAnyPolOIDString = NULL; |
| PKIX_PL_String *anyPolicyOIDString = NULL; |
| PKIX_PL_String *validPolicyTreeString = NULL; |
| PKIX_PL_String *userInitialPolicySetString = NULL; |
| PKIX_PL_String *mappedUserPolicySetString = NULL; |
| PKIX_PL_String *mappedPolicyOIDsString = NULL; |
| PKIX_PL_String *anyAtBottomString = NULL; |
| PKIX_PL_String *newAnyPolicyString = NULL; |
| PKIX_PL_String *formatString = NULL; |
| PKIX_PL_String *trueString = NULL; |
| PKIX_PL_String *falseString = NULL; |
| PKIX_PL_String *nullString = NULL; |
| PKIX_Boolean initialPolicyMappingInhibit = PKIX_FALSE; |
| PKIX_Boolean initialExplicitPolicy = PKIX_FALSE; |
| PKIX_Boolean initialAnyPolicyInhibit = PKIX_FALSE; |
| PKIX_Boolean initialIsAnyPolicy = PKIX_FALSE; |
| PKIX_Boolean policyQualifiersRejected = PKIX_FALSE; |
| PKIX_Boolean certPoliciesCritical = PKIX_FALSE; |
| char *asciiFormat = |
| "{\n" |
| "\tcertPoliciesExtension: \t%s\n" |
| "\tpolicyMappingsExtension: \t%s\n" |
| "\tpolicyConstraintsExtension:\t%s\n" |
| "\tinhibitAnyPolicyExtension:\t%s\n" |
| "\tanyPolicyOID: \t%s\n" |
| "\tinitialIsAnyPolicy: \t%s\n" |
| "\tvalidPolicyTree: \t%s\n" |
| "\tuserInitialPolicySet: \t%s\n" |
| "\tmappedUserPolicySet: \t%s\n" |
| "\tpolicyQualifiersRejected: \t%s\n" |
| "\tinitialPolMappingInhibit: \t%s\n" |
| "\tinitialExplicitPolicy: \t%s\n" |
| "\tinitialAnyPolicyInhibit: \t%s\n" |
| "\texplicitPolicy: \t%d\n" |
| "\tinhibitAnyPolicy: \t%d\n" |
| "\tpolicyMapping: \t%d\n" |
| "\tnumCerts: \t%d\n" |
| "\tcertsProcessed: \t%d\n" |
| "\tanyPolicyNodeAtBottom: \t%s\n" |
| "\tnewAnyPolicyNode: \t%s\n" |
| "\tcertPoliciesCritical: \t%s\n" |
| "\tmappedPolicyOIDs: \t%s\n" |
| "}"; |
| |
| PKIX_ENTER(CERTPOLICYCHECKERSTATE, "pkix_PolicyCheckerState_ToString"); |
| |
| PKIX_NULLCHECK_TWO(object, pCheckerStateString); |
| |
| PKIX_CHECK(pkix_CheckType |
| (object, PKIX_CERTPOLICYCHECKERSTATE_TYPE, plContext), |
| PKIX_OBJECTNOTPOLICYCHECKERSTATE); |
| |
| state = (PKIX_PolicyCheckerState *)object; |
| PKIX_NULLCHECK_THREE |
| (state->certPoliciesExtension, |
| state->policyMappingsExtension, |
| state->policyConstraintsExtension); |
| PKIX_NULLCHECK_THREE |
| (state->inhibitAnyPolicyExtension, |
| state->anyPolicyOID, |
| state->userInitialPolicySet); |
| |
| PKIX_CHECK(PKIX_PL_String_Create |
| (PKIX_ESCASCII, asciiFormat, 0, &formatString, plContext), |
| PKIX_STRINGCREATEFAILED); |
| /* |
| * Create TRUE, FALSE, and "NULL" PKIX_PL_Strings. But creating a |
| * PKIX_PL_String is complicated enough, it's worth checking, for |
| * each, to make sure the string is needed. |
| */ |
| initialPolicyMappingInhibit = state->initialPolicyMappingInhibit; |
| initialExplicitPolicy = state->initialExplicitPolicy; |
| initialAnyPolicyInhibit = state->initialAnyPolicyInhibit; |
| initialIsAnyPolicy = state->initialIsAnyPolicy; |
| policyQualifiersRejected = state->policyQualifiersRejected; |
| certPoliciesCritical = state->certPoliciesCritical; |
| |
| if (initialPolicyMappingInhibit || initialExplicitPolicy || |
| initialAnyPolicyInhibit || initialIsAnyPolicy || |
| policyQualifiersRejected || certPoliciesCritical) { |
| PKIX_CHECK(PKIX_PL_String_Create |
| (PKIX_ESCASCII, "TRUE", 0, &trueString, plContext), |
| PKIX_STRINGCREATEFAILED); |
| } |
| if (!initialPolicyMappingInhibit || !initialExplicitPolicy || |
| !initialAnyPolicyInhibit || !initialIsAnyPolicy || |
| !policyQualifiersRejected || !certPoliciesCritical) { |
| PKIX_CHECK(PKIX_PL_String_Create |
| (PKIX_ESCASCII, "FALSE", 0, &falseString, plContext), |
| PKIX_STRINGCREATEFAILED); |
| } |
| if (!(state->anyPolicyNodeAtBottom) || !(state->newAnyPolicyNode)) { |
| PKIX_CHECK(PKIX_PL_String_Create |
| (PKIX_ESCASCII, "(null)", 0, &nullString, plContext), |
| PKIX_STRINGCREATEFAILED); |
| } |
| |
| PKIX_TOSTRING |
| (state->certPoliciesExtension, &policiesExtOIDString, plContext, |
| PKIX_OBJECTTOSTRINGFAILED); |
| |
| PKIX_TOSTRING |
| (state->policyMappingsExtension, |
| &policyMapOIDString, |
| plContext, |
| PKIX_OBJECTTOSTRINGFAILED); |
| |
| PKIX_TOSTRING |
| (state->policyConstraintsExtension, |
| &policyConstrOIDString, |
| plContext, |
| PKIX_OBJECTTOSTRINGFAILED); |
| |
| PKIX_TOSTRING |
| (state->inhibitAnyPolicyExtension, |
| &inhAnyPolOIDString, |
| plContext, |
| PKIX_OBJECTTOSTRINGFAILED); |
| |
| PKIX_TOSTRING(state->anyPolicyOID, &anyPolicyOIDString, plContext, |
| PKIX_OBJECTTOSTRINGFAILED); |
| |
| PKIX_TOSTRING(state->validPolicyTree, &validPolicyTreeString, plContext, |
| PKIX_OBJECTTOSTRINGFAILED); |
| |
| PKIX_TOSTRING |
| (state->userInitialPolicySet, |
| &userInitialPolicySetString, |
| plContext, |
| PKIX_OBJECTTOSTRINGFAILED); |
| |
| PKIX_TOSTRING |
| (state->mappedUserInitialPolicySet, |
| &mappedUserPolicySetString, |
| plContext, |
| PKIX_OBJECTTOSTRINGFAILED); |
| |
| if (state->anyPolicyNodeAtBottom) { |
| PKIX_CHECK(pkix_SinglePolicyNode_ToString |
| (state->anyPolicyNodeAtBottom, |
| &anyAtBottomString, |
| plContext), |
| PKIX_SINGLEPOLICYNODETOSTRINGFAILED); |
| } else { |
| PKIX_INCREF(nullString); |
| anyAtBottomString = nullString; |
| } |
| |
| if (state->newAnyPolicyNode) { |
| PKIX_CHECK(pkix_SinglePolicyNode_ToString |
| (state->newAnyPolicyNode, |
| &newAnyPolicyString, |
| plContext), |
| PKIX_SINGLEPOLICYNODETOSTRINGFAILED); |
| } else { |
| PKIX_INCREF(nullString); |
| newAnyPolicyString = nullString; |
| } |
| |
| PKIX_TOSTRING |
| (state->mappedPolicyOIDs, |
| &mappedPolicyOIDsString, |
| plContext, |
| PKIX_OBJECTTOSTRINGFAILED); |
| |
| PKIX_CHECK(PKIX_PL_Sprintf |
| (&resultString, |
| plContext, |
| formatString, |
| policiesExtOIDString, |
| policyMapOIDString, |
| policyConstrOIDString, |
| inhAnyPolOIDString, |
| anyPolicyOIDString, |
| initialIsAnyPolicy?trueString:falseString, |
| validPolicyTreeString, |
| userInitialPolicySetString, |
| mappedUserPolicySetString, |
| policyQualifiersRejected?trueString:falseString, |
| initialPolicyMappingInhibit?trueString:falseString, |
| initialExplicitPolicy?trueString:falseString, |
| initialAnyPolicyInhibit?trueString:falseString, |
| state->explicitPolicy, |
| state->inhibitAnyPolicy, |
| state->policyMapping, |
| state->numCerts, |
| state->certsProcessed, |
| anyAtBottomString, |
| newAnyPolicyString, |
| certPoliciesCritical?trueString:falseString, |
| mappedPolicyOIDsString), |
| PKIX_SPRINTFFAILED); |
| |
| *pCheckerStateString = resultString; |
| |
| cleanup: |
| PKIX_DECREF(policiesExtOIDString); |
| PKIX_DECREF(policyMapOIDString); |
| PKIX_DECREF(policyConstrOIDString); |
| PKIX_DECREF(inhAnyPolOIDString); |
| PKIX_DECREF(anyPolicyOIDString); |
| PKIX_DECREF(validPolicyTreeString); |
| PKIX_DECREF(userInitialPolicySetString); |
| PKIX_DECREF(mappedUserPolicySetString); |
| PKIX_DECREF(anyAtBottomString); |
| PKIX_DECREF(newAnyPolicyString); |
| PKIX_DECREF(mappedPolicyOIDsString); |
| PKIX_DECREF(formatString); |
| PKIX_DECREF(trueString); |
| PKIX_DECREF(falseString); |
| PKIX_DECREF(nullString); |
| |
| PKIX_RETURN(CERTPOLICYCHECKERSTATE); |
| } |
| |
| /* |
| * FUNCTION: pkix_PolicyCheckerState_RegisterSelf |
| * DESCRIPTION: |
| * |
| * Registers PKIX_POLICYCHECKERSTATE_TYPE and its related functions |
| * with systemClasses[] |
| * |
| * PARAMETERS: |
| * "plContext" |
| * Platform-specific context pointer. |
| * THREAD SAFETY: |
| * Not Thread Safe - for performance and complexity reasons |
| * |
| * Since this function is only called by PKIX_PL_Initialize, which should |
| * only be called once, it is acceptable that this function is not |
| * thread-safe. |
| */ |
| PKIX_Error * |
| pkix_PolicyCheckerState_RegisterSelf(void *plContext) |
| { |
| extern pkix_ClassTable_Entry systemClasses[PKIX_NUMTYPES]; |
| pkix_ClassTable_Entry entry; |
| |
| PKIX_ENTER |
| (CERTPOLICYCHECKERSTATE, |
| "pkix_PolicyCheckerState_RegisterSelf"); |
| |
| entry.description = "PolicyCheckerState"; |
| entry.objCounter = 0; |
| entry.typeObjectSize = sizeof(PKIX_PolicyCheckerState); |
| entry.destructor = pkix_PolicyCheckerState_Destroy; |
| entry.equalsFunction = NULL; |
| entry.hashcodeFunction = NULL; |
| entry.toStringFunction = pkix_PolicyCheckerState_ToString; |
| entry.comparator = NULL; |
| entry.duplicateFunction = NULL; |
| |
| systemClasses[PKIX_CERTPOLICYCHECKERSTATE_TYPE] = entry; |
| |
| PKIX_RETURN(CERTPOLICYCHECKERSTATE); |
| } |
| |
| /* |
| * FUNCTION:pkix_PolicyCheckerState_Create |
| * DESCRIPTION: |
| * |
| * Creates a PolicyCheckerState Object, using the List pointed to |
| * by "initialPolicies" for the user-initial-policy-set, the Boolean value |
| * of "policyQualifiersRejected" for the policyQualifiersRejected parameter, |
| * the Boolean value of "initialPolicyMappingInhibit" for the |
| * inhibitPolicyMappings parameter, the Boolean value of |
| * "initialExplicitPolicy" for the initialExplicitPolicy parameter, the |
| * Boolean value of "initialAnyPolicyInhibit" for the inhibitAnyPolicy |
| * parameter, and the UInt32 value of "numCerts" as the number of |
| * certificates in the chain; and stores the Object at "pCheckerState". |
| * |
| * PARAMETERS: |
| * "initialPolicies" |
| * Address of List of OIDs comprising the user-initial-policy-set; the List |
| * may be empty, but must be non-NULL |
| * "policyQualifiersRejected" |
| * Boolean value of the policyQualifiersRejected parameter |
| * "initialPolicyMappingInhibit" |
| * Boolean value of the inhibitPolicyMappings parameter |
| * "initialExplicitPolicy" |
| * Boolean value of the initialExplicitPolicy parameter |
| * "initialAnyPolicyInhibit" |
| * Boolean value of the inhibitAnyPolicy parameter |
| * "numCerts" |
| * Number of certificates in the chain to be validated |
| * "pCheckerState" |
| * Address where PolicyCheckerState will be stored. Must be non-NULL. |
| * "plContext" |
| * Platform-specific context pointer. |
| * THREAD SAFETY: |
| * Thread Safe (see Thread Safety Definitions in Programmer's Guide) |
| * RETURNS: |
| * Returns NULL if the function succeeds |
| * Returns a CertPolicyCheckerState Error if the functions fails in a |
| * non-fatal way |
| * Returns a Fatal Error if the function fails in an unrecoverable way |
| */ |
| static PKIX_Error * |
| pkix_PolicyCheckerState_Create( |
| PKIX_List *initialPolicies, |
| PKIX_Boolean policyQualifiersRejected, |
| PKIX_Boolean initialPolicyMappingInhibit, |
| PKIX_Boolean initialExplicitPolicy, |
| PKIX_Boolean initialAnyPolicyInhibit, |
| PKIX_UInt32 numCerts, |
| PKIX_PolicyCheckerState **pCheckerState, |
| void *plContext) |
| { |
| PKIX_PolicyCheckerState *checkerState = NULL; |
| PKIX_PolicyNode *policyNode = NULL; |
| PKIX_List *anyPolicyList = NULL; |
| PKIX_Boolean initialPoliciesIsEmpty = PKIX_FALSE; |
| |
| PKIX_ENTER(CERTPOLICYCHECKERSTATE, "pkix_PolicyCheckerState_Create"); |
| PKIX_NULLCHECK_TWO(initialPolicies, pCheckerState); |
| |
| PKIX_CHECK(PKIX_PL_Object_Alloc |
| (PKIX_CERTPOLICYCHECKERSTATE_TYPE, |
| sizeof (PKIX_PolicyCheckerState), |
| (PKIX_PL_Object **)&checkerState, |
| plContext), |
| PKIX_COULDNOTCREATEPOLICYCHECKERSTATEOBJECT); |
| |
| /* Create constant PKIX_PL_OIDs: */ |
| |
| PKIX_CHECK(PKIX_PL_OID_Create |
| (PKIX_CERTIFICATEPOLICIES_OID, |
| &(checkerState->certPoliciesExtension), |
| plContext), |
| PKIX_OIDCREATEFAILED); |
| |
| PKIX_CHECK(PKIX_PL_OID_Create |
| (PKIX_POLICYMAPPINGS_OID, |
| &(checkerState->policyMappingsExtension), |
| plContext), |
| PKIX_OIDCREATEFAILED); |
| |
| PKIX_CHECK(PKIX_PL_OID_Create |
| (PKIX_POLICYCONSTRAINTS_OID, |
| &(checkerState->policyConstraintsExtension), |
| plContext), |
| PKIX_OIDCREATEFAILED); |
| |
| PKIX_CHECK(PKIX_PL_OID_Create |
| (PKIX_INHIBITANYPOLICY_OID, |
| &(checkerState->inhibitAnyPolicyExtension), |
| plContext), |
| PKIX_OIDCREATEFAILED); |
| |
| PKIX_CHECK(PKIX_PL_OID_Create |
| (PKIX_CERTIFICATEPOLICIES_ANYPOLICY_OID, |
| &(checkerState->anyPolicyOID), |
| plContext), |
| PKIX_OIDCREATEFAILED); |
| |
| /* Create an initial policy set from argument supplied */ |
| PKIX_INCREF(initialPolicies); |
| checkerState->userInitialPolicySet = initialPolicies; |
| PKIX_INCREF(initialPolicies); |
| checkerState->mappedUserInitialPolicySet = initialPolicies; |
| |
| PKIX_CHECK(PKIX_List_IsEmpty |
| (initialPolicies, |
| &initialPoliciesIsEmpty, |
| plContext), |
| PKIX_LISTISEMPTYFAILED); |
| if (initialPoliciesIsEmpty) { |
| checkerState->initialIsAnyPolicy = PKIX_TRUE; |
| } else { |
| PKIX_CHECK(pkix_List_Contains |
| (initialPolicies, |
| (PKIX_PL_Object *)(checkerState->anyPolicyOID), |
| &(checkerState->initialIsAnyPolicy), |
| plContext), |
| PKIX_LISTCONTAINSFAILED); |
| } |
| |
| checkerState->policyQualifiersRejected = |
| policyQualifiersRejected; |
| checkerState->initialExplicitPolicy = initialExplicitPolicy; |
| checkerState->explicitPolicy = |
| (initialExplicitPolicy? 0: numCerts + 1); |
| checkerState->initialAnyPolicyInhibit = initialAnyPolicyInhibit; |
| checkerState->inhibitAnyPolicy = |
| (initialAnyPolicyInhibit? 0: numCerts + 1); |
| checkerState->initialPolicyMappingInhibit = initialPolicyMappingInhibit; |
| checkerState->policyMapping = |
| (initialPolicyMappingInhibit? 0: numCerts + 1); |
| ; |
| checkerState->numCerts = numCerts; |
| checkerState->certsProcessed = 0; |
| checkerState->certPoliciesCritical = PKIX_FALSE; |
| |
| /* Create a valid_policy_tree as in RFC3280 6.1.2(a) */ |
| PKIX_CHECK(pkix_PolicyChecker_MakeSingleton |
| ((PKIX_PL_Object *)(checkerState->anyPolicyOID), |
| PKIX_TRUE, |
| &anyPolicyList, |
| plContext), |
| PKIX_POLICYCHECKERMAKESINGLETONFAILED); |
| |
| PKIX_CHECK(pkix_PolicyNode_Create |
| (checkerState->anyPolicyOID, /* validPolicy */ |
| NULL, /* qualifier set */ |
| PKIX_FALSE, /* criticality */ |
| anyPolicyList, /* expectedPolicySet */ |
| &policyNode, |
| plContext), |
| PKIX_POLICYNODECREATEFAILED); |
| checkerState->validPolicyTree = policyNode; |
| |
| /* |
| * Since the initial validPolicyTree specifies |
| * ANY_POLICY, begin with a pointer to the root node. |
| */ |
| PKIX_INCREF(policyNode); |
| checkerState->anyPolicyNodeAtBottom = policyNode; |
| |
| checkerState->newAnyPolicyNode = NULL; |
| |
| checkerState->mappedPolicyOIDs = NULL; |
| |
| *pCheckerState = checkerState; |
| checkerState = NULL; |
| |
| cleanup: |
| |
| PKIX_DECREF(checkerState); |
| |
| PKIX_DECREF(anyPolicyList); |
| |
| PKIX_RETURN(CERTPOLICYCHECKERSTATE); |
| } |
| |
| /* --Private-PolicyChecker-Functions--------------------------------------- */ |
| |
| /* |
| * FUNCTION: pkix_PolicyChecker_MapContains |
| * DESCRIPTION: |
| * |
| * Checks the List of CertPolicyMaps pointed to by "certPolicyMaps", to |
| * determine whether the OID pointed to by "policy" is among the |
| * issuerDomainPolicies or subjectDomainPolicies of "certPolicyMaps", and |
| * stores the result in "pFound". |
| * |
| * This function is intended to allow an efficient check that the proscription |
| * against anyPolicy being mapped, described in RFC3280 Section 6.1.4(a), is |
| * not violated. |
| * |
| * PARAMETERS: |
| * "certPolicyMaps" |
| * Address of List of CertPolicyMaps to be searched. May be empty, but |
| * must be non-NULL |
| * "policy" |
| * Address of OID to be checked for. Must be non-NULL |
| * "pFound" |
| * Address where the result of the search will be stored. Must be non-NULL. |
| * "plContext" |
| * platform-specific context pointer |
| * THREAD SAFETY: |
| * Thread Safe (see Thread Safety Definitions in Programmer's Guide) |
| * RETURNS: |
| * Returns NULL if the function succeeds |
| * Returns a CertChainChecker Error if the function fails in a non-fatal way. |
| * Returns a Fatal Error if the function fails in an unrecoverable way |
| */ |
| PKIX_Error * |
| pkix_PolicyChecker_MapContains( |
| PKIX_List *certPolicyMaps, |
| PKIX_PL_OID *policy, |
| PKIX_Boolean *pFound, |
| void *plContext) |
| { |
| PKIX_PL_CertPolicyMap *map = NULL; |
| PKIX_UInt32 numEntries = 0; |
| PKIX_UInt32 index = 0; |
| PKIX_Boolean match = PKIX_FALSE; |
| PKIX_PL_OID *issuerDomainPolicy = NULL; |
| PKIX_PL_OID *subjectDomainPolicy = NULL; |
| |
| PKIX_ENTER(CERTCHAINCHECKER, "pkix_PolicyChecker_MapContains"); |
| PKIX_NULLCHECK_THREE(certPolicyMaps, policy, pFound); |
| |
| PKIX_CHECK(PKIX_List_GetLength(certPolicyMaps, &numEntries, plContext), |
| PKIX_LISTGETLENGTHFAILED); |
| |
| for (index = 0; (!match) && (index < numEntries); index++) { |
| PKIX_CHECK(PKIX_List_GetItem |
| (certPolicyMaps, index, (PKIX_PL_Object **)&map, plContext), |
| PKIX_LISTGETITEMFAILED); |
| |
| PKIX_NULLCHECK_ONE(map); |
| |
| PKIX_CHECK(PKIX_PL_CertPolicyMap_GetIssuerDomainPolicy |
| (map, &issuerDomainPolicy, plContext), |
| PKIX_CERTPOLICYMAPGETISSUERDOMAINPOLICYFAILED); |
| |
| PKIX_EQUALS |
| (policy, issuerDomainPolicy, &match, plContext, |
| PKIX_OBJECTEQUALSFAILED); |
| |
| if (!match) { |
| PKIX_CHECK(PKIX_PL_CertPolicyMap_GetSubjectDomainPolicy |
| (map, &subjectDomainPolicy, plContext), |
| PKIX_CERTPOLICYMAPGETSUBJECTDOMAINPOLICYFAILED); |
| |
| PKIX_EQUALS |
| (policy, subjectDomainPolicy, &match, plContext, |
| PKIX_OBJECTEQUALSFAILED); |
| } |
| |
| PKIX_DECREF(map); |
| PKIX_DECREF(issuerDomainPolicy); |
| PKIX_DECREF(subjectDomainPolicy); |
| } |
| |
| *pFound = match; |
| |
| cleanup: |
| |
| PKIX_DECREF(map); |
| PKIX_DECREF(issuerDomainPolicy); |
| PKIX_DECREF(subjectDomainPolicy); |
| PKIX_RETURN(CERTCHAINCHECKER); |
| } |
| |
| /* |
| * FUNCTION: pkix_PolicyChecker_MapGetSubjectDomainPolicies |
| * DESCRIPTION: |
| * |
| * Checks the List of CertPolicyMaps pointed to by "certPolicyMaps", to create |
| * a list of all SubjectDomainPolicies for which the IssuerDomainPolicy is the |
| * policy pointed to by "policy", and stores the result in |
| * "pSubjectDomainPolicies". |
| * |
| * If the List of CertPolicyMaps provided in "certPolicyMaps" is NULL, the |
| * resulting List will be NULL. If there are CertPolicyMaps, but none that |
| * include "policy" as an IssuerDomainPolicy, the returned List pointer will |
| * be NULL. Otherwise, the returned List will contain the SubjectDomainPolicies |
| * of all CertPolicyMaps for which "policy" is the IssuerDomainPolicy. If a |
| * List is returned it will be immutable. |
| * |
| * PARAMETERS: |
| * "certPolicyMaps" |
| * Address of List of CertPolicyMaps to be searched. May be empty or NULL. |
| * "policy" |
| * Address of OID to be checked for. Must be non-NULL |
| * "pSubjectDomainPolicies" |
| * Address where the result of the search will be stored. Must be non-NULL. |
| * "plContext" |
| * platform-specific context pointer |
| * THREAD SAFETY: |
| * Thread Safe (see Thread Safety Definitions in Programmer's Guide) |
| * RETURNS: |
| * Returns NULL if the function succeeds |
| * Returns a CertChainChecker Error if the function fails in a non-fatal way. |
| * Returns a Fatal Error if the function fails in an unrecoverable way |
| */ |
| PKIX_Error * |
| pkix_PolicyChecker_MapGetSubjectDomainPolicies( |
| PKIX_List *certPolicyMaps, |
| PKIX_PL_OID *policy, |
| PKIX_List **pSubjectDomainPolicies, |
| void *plContext) |
| { |
| PKIX_PL_CertPolicyMap *map = NULL; |
| PKIX_List *subjectList = NULL; |
| PKIX_UInt32 numEntries = 0; |
| PKIX_UInt32 index = 0; |
| PKIX_Boolean match = PKIX_FALSE; |
| PKIX_PL_OID *issuerDomainPolicy = NULL; |
| PKIX_PL_OID *subjectDomainPolicy = NULL; |
| |
| PKIX_ENTER |
| (CERTCHAINCHECKER, |
| "pkix_PolicyChecker_MapGetSubjectDomainPolicies"); |
| PKIX_NULLCHECK_TWO(policy, pSubjectDomainPolicies); |
| |
| if (certPolicyMaps) { |
| PKIX_CHECK(PKIX_List_GetLength |
| (certPolicyMaps, |
| &numEntries, |
| plContext), |
| PKIX_LISTGETLENGTHFAILED); |
| } |
| |
| for (index = 0; index < numEntries; index++) { |
| PKIX_CHECK(PKIX_List_GetItem |
| (certPolicyMaps, index, (PKIX_PL_Object **)&map, plContext), |
| PKIX_LISTGETITEMFAILED); |
| |
| PKIX_NULLCHECK_ONE(map); |
| |
| PKIX_CHECK(PKIX_PL_CertPolicyMap_GetIssuerDomainPolicy |
| (map, &issuerDomainPolicy, plContext), |
| PKIX_CERTPOLICYMAPGETISSUERDOMAINPOLICYFAILED); |
| |
| PKIX_EQUALS |
| (policy, issuerDomainPolicy, &match, plContext, |
| PKIX_OBJECTEQUALSFAILED); |
| |
| if (match) { |
| if (!subjectList) { |
| PKIX_CHECK(PKIX_List_Create(&subjectList, plContext), |
| PKIX_LISTCREATEFAILED); |
| } |
| |
| PKIX_CHECK(PKIX_PL_CertPolicyMap_GetSubjectDomainPolicy |
| (map, &subjectDomainPolicy, plContext), |
| PKIX_CERTPOLICYMAPGETSUBJECTDOMAINPOLICYFAILED); |
| |
| PKIX_CHECK(PKIX_List_AppendItem |
| (subjectList, |
| (PKIX_PL_Object *)subjectDomainPolicy, |
| plContext), |
| PKIX_LISTAPPENDITEMFAILED); |
| } |
| |
| PKIX_DECREF(map); |
| PKIX_DECREF(issuerDomainPolicy); |
| PKIX_DECREF(subjectDomainPolicy); |
| } |
| |
| if (subjectList) { |
| PKIX_CHECK(PKIX_List_SetImmutable(subjectList, plContext), |
| PKIX_LISTSETIMMUTABLEFAILED); |
| } |
| |
| *pSubjectDomainPolicies = subjectList; |
| |
| cleanup: |
| |
| if (PKIX_ERROR_RECEIVED) { |
| PKIX_DECREF(subjectList); |
| } |
| |
| PKIX_DECREF(map); |
| PKIX_DECREF(issuerDomainPolicy); |
| PKIX_DECREF(subjectDomainPolicy); |
| |
| PKIX_RETURN(CERTCHAINCHECKER); |
| } |
| |
| /* |
| * FUNCTION: pkix_PolicyChecker_MapGetMappedPolicies |
| * DESCRIPTION: |
| * |
| * Checks the List of CertPolicyMaps pointed to by "certPolicyMaps" to create a |
| * List of all IssuerDomainPolicies, and stores the result in |
| * "pMappedPolicies". |
| * |
| * The caller may not rely on the IssuerDomainPolicies to be in any particular |
| * order. IssuerDomainPolicies that appear in more than one CertPolicyMap will |
| * only appear once in "pMappedPolicies". If "certPolicyMaps" is empty the |
| * result will be an empty List. The created List is mutable. |
| * |
| * PARAMETERS: |
| * "certPolicyMaps" |
| * Address of List of CertPolicyMaps to be searched. May be empty, but |
| * must be non-NULL. |
| * "pMappedPolicies" |
| * Address where the result will be stored. Must be non-NULL. |
| * "plContext" |
| * platform-specific context pointer |
| * THREAD SAFETY: |
| * Thread Safe (see Thread Safety Definitions in Programmer's Guide) |
| * RETURNS: |
| * Returns NULL if the function succeeds |
| * Returns a CertChainChecker Error if the functions fails in a non-fatal way |
| * Returns a Fatal Error if the function fails in an unrecoverable way |
| */ |
| PKIX_Error * |
| pkix_PolicyChecker_MapGetMappedPolicies( |
| PKIX_List *certPolicyMaps, |
| PKIX_List **pMappedPolicies, |
| void *plContext) |
| { |
| PKIX_PL_CertPolicyMap *map = NULL; |
| PKIX_List *mappedList = NULL; |
| PKIX_UInt32 numEntries = 0; |
| PKIX_UInt32 index = 0; |
| PKIX_Boolean isContained = PKIX_FALSE; |
| PKIX_PL_OID *issuerDomainPolicy = NULL; |
| |
| PKIX_ENTER |
| (CERTCHAINCHECKER, "pkix_PolicyChecker_MapGetMappedPolicies"); |
| PKIX_NULLCHECK_TWO(certPolicyMaps, pMappedPolicies); |
| |
| PKIX_CHECK(PKIX_List_Create(&mappedList, plContext), |
| PKIX_LISTCREATEFAILED); |
| |
| PKIX_CHECK(PKIX_List_GetLength(certPolicyMaps, &numEntries, plContext), |
| PKIX_LISTGETLENGTHFAILED); |
| |
| for (index = 0; index < numEntries; index++) { |
| PKIX_CHECK(PKIX_List_GetItem |
| (certPolicyMaps, index, (PKIX_PL_Object **)&map, plContext), |
| PKIX_LISTGETITEMFAILED); |
| |
| PKIX_NULLCHECK_ONE(map); |
| |
| PKIX_CHECK(PKIX_PL_CertPolicyMap_GetIssuerDomainPolicy |
| (map, &issuerDomainPolicy, plContext), |
| PKIX_CERTPOLICYMAPGETISSUERDOMAINPOLICYFAILED); |
| |
| PKIX_CHECK(pkix_List_Contains |
| (mappedList, |
| (PKIX_PL_Object *)issuerDomainPolicy, |
| &isContained, |
| plContext), |
| PKIX_LISTCONTAINSFAILED); |
| |
| if (isContained == PKIX_FALSE) { |
| PKIX_CHECK(PKIX_List_AppendItem |
| (mappedList, |
| (PKIX_PL_Object *)issuerDomainPolicy, |
| plContext), |
| PKIX_LISTAPPENDITEMFAILED); |
| } |
| |
| PKIX_DECREF(map); |
| PKIX_DECREF(issuerDomainPolicy); |
| } |
| |
| *pMappedPolicies = mappedList; |
| |
| cleanup: |
| |
| if (PKIX_ERROR_RECEIVED) { |
| PKIX_DECREF(mappedList); |
| } |
| |
| PKIX_DECREF(map); |
| PKIX_DECREF(issuerDomainPolicy); |
| |
| PKIX_RETURN(CERTCHAINCHECKER); |
| } |
| |
| /* |
| * FUNCTION: pkix_PolicyChecker_MakeMutableCopy |
| * DESCRIPTION: |
| * |
| * Creates a mutable copy of the List pointed to by "list", which may or may |
| * not be immutable, and stores the address at "pMutableCopy". |
| * |
| * PARAMETERS: |
| * "list" |
| * Address of List to be copied. Must be non-NULL. |
| * "pMutableCopy" |
| * Address where mutable copy will be stored. Must be non-NULL. |
| * "plContext" |
| * Platform-specific context pointer. |
| * THREAD SAFETY: |
| * Thread Safe (see Thread Safety Definitions in Programmer's Guide) |
| * RETURNS: |
| * Returns NULL if the function succeeds |
| * Returns a CertChainChecker Error if the functions fails in a non-fatal way |
| * Returns a Fatal Error if the function fails in an unrecoverable way |
| */ |
| static PKIX_Error * |
| pkix_PolicyChecker_MakeMutableCopy( |
| PKIX_List *list, |
| PKIX_List **pMutableCopy, |
| void *plContext) |
| { |
| PKIX_List *newList = NULL; |
| PKIX_UInt32 listLen = 0; |
| PKIX_UInt32 listIx = 0; |
| PKIX_PL_Object *object = NULL; |
| |
| PKIX_ENTER(CERTCHAINCHECKER, "pkix_PolicyChecker_MakeMutableCopy"); |
| PKIX_NULLCHECK_TWO(list, pMutableCopy); |
| |
| PKIX_CHECK(PKIX_List_Create(&newList, plContext), |
| PKIX_LISTCREATEFAILED); |
| |
| PKIX_CHECK(PKIX_List_GetLength(list, &listLen, plContext), |
| PKIX_LISTGETLENGTHFAILED); |
| |
| for (listIx = 0; listIx < listLen; listIx++) { |
| |
| PKIX_CHECK(PKIX_List_GetItem(list, listIx, &object, plContext), |
| PKIX_LISTGETITEMFAILED); |
| |
| PKIX_CHECK(PKIX_List_AppendItem(newList, object, plContext), |
| PKIX_LISTAPPENDITEMFAILED); |
| |
| PKIX_DECREF(object); |
| } |
| |
| *pMutableCopy = newList; |
| newList = NULL; |
| |
| cleanup: |
| PKIX_DECREF(newList); |
| PKIX_DECREF(object); |
| |
| PKIX_RETURN(CERTCHAINCHECKER); |
| } |
| |
| /* |
| * FUNCTION: pkix_PolicyChecker_MakeSingleton |
| * DESCRIPTION: |
| * |
| * Creates a new List containing the Object pointed to by "listItem", using |
| * the Boolean value of "immutability" to determine whether to set the List |
| * immutable, and stores the address at "pList". |
| * |
| * PARAMETERS: |
| * "listItem" |
| * Address of Object to be inserted into the new List. Must be non-NULL. |
| * "immutability" |
| * Boolean value indicating whether new List is to be immutable |
| * "pList" |
| * Address where List will be stored. Must be non-NULL. |
| * "plContext" |
| * Platform-specific context pointer. |
| * THREAD SAFETY: |
| * Thread Safe (see Thread Safety Definitions in Programmer's Guide) |
| * RETURNS: |
| * Returns NULL if the function succeeds |
| * Returns a CertChainChecker Error if the functions fails in a non-fatal way |
| * Returns a Fatal Error if the function fails in an unrecoverable way |
| */ |
| static PKIX_Error * |
| pkix_PolicyChecker_MakeSingleton( |
| PKIX_PL_Object *listItem, |
| PKIX_Boolean immutability, |
| PKIX_List **pList, |
| void *plContext) |
| { |
| PKIX_List *newList = NULL; |
| |
| PKIX_ENTER(CERTCHAINCHECKER, "pkix_PolicyChecker_MakeSingleton"); |
| PKIX_NULLCHECK_TWO(listItem, pList); |
| |
| PKIX_CHECK(PKIX_List_Create(&newList, plContext), |
| PKIX_LISTCREATEFAILED); |
| |
| PKIX_CHECK(PKIX_List_AppendItem |
| (newList, (PKIX_PL_Object *)listItem, plContext), |
| PKIX_LISTAPPENDITEMFAILED); |
| |
| if (immutability) { |
| PKIX_CHECK(PKIX_List_SetImmutable(newList, plContext), |
| PKIX_LISTSETIMMUTABLEFAILED); |
| } |
| |
| *pList = newList; |
| |
| cleanup: |
| if (PKIX_ERROR_RECEIVED) { |
| PKIX_DECREF(newList); |
| } |
| |
| PKIX_RETURN(CERTCHAINCHECKER); |
| } |
| |
| /* |
| * FUNCTION: pkix_PolicyChecker_Spawn |
| * DESCRIPTION: |
| * |
| * Creates a new childNode for the parent pointed to by "parent", using |
| * the OID pointed to by "policyOID", the List of CertPolicyQualifiers |
| * pointed to by "qualifiers", the List of OIDs pointed to by |
| * "subjectDomainPolicies", and the PolicyCheckerState pointed to by |
| * "state". The new node will be added to "parent". |
| * |
| * The validPolicy of the new node is set from the OID pointed to by |
| * "policyOID". The policy qualifiers for the new node is set from the |
| * List of qualifiers pointed to by "qualifiers", and may be NULL or |
| * empty if the argument provided was NULL or empty. The criticality is |
| * set according to the criticality obtained from the PolicyCheckerState. |
| * If "subjectDomainPolicies" is NULL, the expectedPolicySet of the |
| * child is set to contain the same policy as the validPolicy. If |
| * "subjectDomainPolicies" is not NULL, it is used as the value for |
| * the expectedPolicySet. |
| * |
| * The PolicyCheckerState also contains a constant, anyPolicy, which is |
| * compared to "policyOID". If they match, the address of the childNode |
| * is saved in the state's newAnyPolicyNode. |
| * |
| * PARAMETERS: |
| * "parent" |
| * Address of PolicyNode to which the child will be linked. Must be |
| * non-NULL. |
| * "policyOID" |
| * Address of OID of the new child's validPolicy and also, if |
| * subjectDomainPolicies is NULL, of the new child's expectedPolicySet. |
| * Must be non-NULL. |
| * "qualifiers" |
| * Address of List of CertPolicyQualifiers. May be NULL or empty. |
| * "subjectDomainPolicies" |
| * Address of List of OIDs indicating the policies to which "policy" is |
| * mapped. May be empty or NULL. |
| * "state" |
| * Address of the current PKIX_PolicyCheckerState. Must be non-NULL.. |
| * "plContext" |
| * Platform-specific context pointer. |
| * THREAD SAFETY: |
| * Not Thread Safe (see Thread Safety Definitions in Programmer's Guide) |
| * RETURNS: |
| * Returns NULL if the function succeeds |
| * Returns a CertChainChecker Error if the functions fails in a non-fatal way |
| * Returns a Fatal Error if the function fails in an unrecoverable way |
| */ |
| static PKIX_Error * |
| pkix_PolicyChecker_Spawn( |
| PKIX_PolicyNode *parent, |
| PKIX_PL_OID *policyOID, |
| PKIX_List *qualifiers, /* CertPolicyQualifiers */ |
| PKIX_List *subjectDomainPolicies, |
| PKIX_PolicyCheckerState *state, |
| void *plContext) |
| { |
| PKIX_List *expectedSet = NULL; /* OIDs */ |
| PKIX_PolicyNode *childNode = NULL; |
| PKIX_Boolean match = PKIX_FALSE; |
| |
| PKIX_ENTER(CERTCHAINCHECKER, "pkix_PolicyChecker_Spawn"); |
| PKIX_NULLCHECK_THREE(policyOID, parent, state); |
| |
| if (subjectDomainPolicies) { |
| |
| PKIX_INCREF(subjectDomainPolicies); |
| expectedSet = subjectDomainPolicies; |
| |
| } else { |
| /* Create the child's ExpectedPolicy Set */ |
| PKIX_CHECK(pkix_PolicyChecker_MakeSingleton |
| ((PKIX_PL_Object *)policyOID, |
| PKIX_TRUE, /* make expectedPolicySet immutable */ |
| &expectedSet, |
| plContext), |
| PKIX_POLICYCHECKERMAKESINGLETONFAILED); |
| } |
| |
| PKIX_CHECK(pkix_PolicyNode_Create |
| (policyOID, |
| qualifiers, |
| state->certPoliciesCritical, |
| expectedSet, |
| &childNode, |
| plContext), |
| PKIX_POLICYNODECREATEFAILED); |
| |
| /* |
| * If we had a non-empty mapping, we know the new node could not |
| * have been created with a validPolicy of anyPolicy. Otherwise, |
| * check whether we just created a new node with anyPolicy, because |
| * in that case we want to save the child pointer in newAnyPolicyNode. |
| */ |
| if (!subjectDomainPolicies) { |
| PKIX_EQUALS(policyOID, state->anyPolicyOID, &match, plContext, |
| PKIX_OBJECTEQUALSFAILED); |
| |
| if (match) { |
| PKIX_DECREF(state->newAnyPolicyNode); |
| PKIX_INCREF(childNode); |
| state->newAnyPolicyNode = childNode; |
| } |
| } |
| |
| PKIX_CHECK(pkix_PolicyNode_AddToParent(parent, childNode, plContext), |
| PKIX_POLICYNODEADDTOPARENTFAILED); |
| |
| PKIX_CHECK(PKIX_PL_Object_InvalidateCache |
| ((PKIX_PL_Object *)state, plContext), |
| PKIX_OBJECTINVALIDATECACHEFAILED); |
| |
| cleanup: |
| PKIX_DECREF(childNode); |
| PKIX_DECREF(expectedSet); |
| PKIX_RETURN(CERTCHAINCHECKER); |
| } |
| |
| /* |
| * FUNCTION: pkix_PolicyChecker_CheckPolicyRecursive |
| * DESCRIPTION: |
| * |
| * Performs policy processing for the policy whose OID is pointed to by |
| * "policyOID" and whose List of CertPolicyQualifiers is pointed to by |
| * "policyQualifiers", using the List of policy OIDs pointed to by |
| * "subjectDomainPolicies" and the PolicyNode pointed to by "currentNode", |
| * in accordance with the current PolicyCheckerState pointed to by "state", |
| * and setting "pChildNodeCreated" to TRUE if a new childNode is created. |
| * Note: "pChildNodeCreated" is not set to FALSE if no childNode is created. |
| * The intent of the design is that the caller can set a variable to FALSE |
| * initially, prior to a recursive set of calls. At the end, the variable |
| * can be tested to see whether *any* of the calls created a child node. |
| * |
| * If the currentNode is not at the bottom of the tree, this function |
| * calls itself recursively for each child of currentNode. At the bottom of |
| * the tree, it creates new child nodes as appropriate. This function will |
| * never be called with policy = anyPolicy. |
| * |
| * This function implements the processing described in RFC3280 |
| * Section 6.1.3(d)(1)(i). |
| * |
| * PARAMETERS: |
| * "policyOID" |
| * Address of OID of the policy to be checked for. Must be non-NULL. |
| * "policyQualifiers" |
| * Address of List of CertPolicyQualifiers of the policy to be checked for. |
| * May be empty or NULL. |
| * "subjectDomainPolicies" |
| * Address of List of OIDs indicating the policies to which "policy" is |
| * mapped. May be empty or NULL. |
| * "currentNode" |
| * Address of PolicyNode whose descendants will be checked, if not at the |
| * bottom of the tree; or whose expectedPolicySet will be compared to |
| * "policy", if at the bottom. Must be non-NULL. |
| * "state" |
| * Address of PolicyCheckerState of the current PolicyChecker. Must be |
| * non-NULL. |
| * "pChildNodeCreated" |
| * Address of the Boolean that will be set TRUE if this function |
| * creates a child node. Must be non-NULL. |
| * "plContext" |
| * Platform-specific context pointer. |
| * THREAD SAFETY: |
| * Not Thread Safe (see Thread Safety Definitions in Programmer's Guide) |
| * RETURNS: |
| * Returns NULL if the function succeeds |
| * Returns a CertChainChecker Error if the functions fails in a non-fatal way |
| * Returns a Fatal Error if the function fails in an unrecoverable way |
| */ |
| static PKIX_Error * |
| pkix_PolicyChecker_CheckPolicyRecursive( |
| PKIX_PL_OID *policyOID, |
| PKIX_List *policyQualifiers, |
| PKIX_List *subjectDomainPolicies, |
| PKIX_PolicyNode *currentNode, |
| PKIX_PolicyCheckerState *state, |
| PKIX_Boolean *pChildNodeCreated, |
| void *plContext) |
| { |
| PKIX_UInt32 depth = 0; |
| PKIX_UInt32 numChildren = 0; |
| PKIX_UInt32 childIx = 0; |
| PKIX_Boolean isIncluded = PKIX_FALSE; |
| PKIX_List *children = NULL; /* PolicyNodes */ |
| PKIX_PolicyNode *childNode = NULL; |
| PKIX_List *expectedPolicies = NULL; /* OIDs */ |
| |
| PKIX_ENTER |
| (CERTCHAINCHECKER, |
| "pkix_PolicyChecker_CheckPolicyRecursive"); |
| PKIX_NULLCHECK_FOUR(policyOID, currentNode, state, pChildNodeCreated); |
| |
| /* if not at the bottom of the tree */ |
| PKIX_CHECK(PKIX_PolicyNode_GetDepth |
| (currentNode, &depth, plContext), |
| PKIX_POLICYNODEGETDEPTHFAILED); |
| |
| if (depth < (state->certsProcessed)) { |
| PKIX_CHECK(pkix_PolicyNode_GetChildrenMutable |
| (currentNode, &children, plContext), |
| PKIX_POLICYNODEGETCHILDRENMUTABLEFAILED); |
| |
| if (children) { |
| PKIX_CHECK(PKIX_List_GetLength |
| (children, &numChildren, plContext), |
| PKIX_LISTGETLENGTHFAILED); |
| } |
| |
| for (childIx = 0; childIx < numChildren; childIx++) { |
| |
| PKIX_CHECK(PKIX_List_GetItem |
| (children, |
| childIx, |
| (PKIX_PL_Object **)&childNode, |
| plContext), |
| PKIX_LISTGETITEMFAILED); |
| |
| PKIX_CHECK(pkix_PolicyChecker_CheckPolicyRecursive |
| (policyOID, |
| policyQualifiers, |
| subjectDomainPolicies, |
| childNode, |
| state, |
| pChildNodeCreated, |
| plContext), |
| PKIX_POLICYCHECKERCHECKPOLICYRECURSIVEFAILED); |
| |
| PKIX_DECREF(childNode); |
| } |
| } else { /* if at the bottom of the tree */ |
| |
| /* Check whether policy is in this node's expectedPolicySet */ |
| PKIX_CHECK(PKIX_PolicyNode_GetExpectedPolicies |
| (currentNode, &expectedPolicies, plContext), |
| PKIX_POLICYNODEGETEXPECTEDPOLICIESFAILED); |
| |
| PKIX_NULLCHECK_ONE(expectedPolicies); |
| |
| PKIX_CHECK(pkix_List_Contains |
| (expectedPolicies, |
| (PKIX_PL_Object *)policyOID, |
| &isIncluded, |
| plContext), |
| PKIX_LISTCONTAINSFAILED); |
| |
| if (isIncluded) { |
| PKIX_CHECK(pkix_PolicyChecker_Spawn |
| (currentNode, |
| policyOID, |
| policyQualifiers, |
| subjectDomainPolicies, |
| state, |
| plContext), |
| PKIX_POLICYCHECKERSPAWNFAILED); |
| |
| *pChildNodeCreated = PKIX_TRUE; |
| } |
| } |
| |
| cleanup: |
| |
| PKIX_DECREF(children); |
| PKIX_DECREF(childNode); |
| PKIX_DECREF(expectedPolicies); |
| |
| PKIX_RETURN(CERTCHAINCHECKER); |
| } |
| |
| /* |
| * FUNCTION: pkix_PolicyChecker_CheckPolicy |
| * DESCRIPTION: |
| * |
| * Performs the non-recursive portion of the policy processing for the policy |
| * whose OID is pointed to by "policyOID" and whose List of |
| * CertPolicyQualifiers is pointed to by "policyQualifiers", for the |
| * Certificate pointed to by "cert" with the List of CertPolicyMaps pointed |
| * to by "maps", in accordance with the current PolicyCheckerState pointed |
| * to by "state". |
| * |
| * This function implements the processing described in RFC3280 |
| * Section 6.1.3(d)(1)(i). |
| * |
| * PARAMETERS: |
| * "policyOID" |
| * Address of OID of the policy to be checked for. Must be non-NULL. |
| * "policyQualifiers" |
| * Address of List of CertPolicyQualifiers of the policy to be checked for. |
| * May be empty or NULL. |
| * "cert" |
| * Address of the current certificate. Must be non-NULL. |
| * "maps" |
| * Address of List of CertPolicyMaps for the current certificate |
| * "state" |
| * Address of PolicyCheckerState of the current PolicyChecker. Must be |
| * non-NULL. |
| * "plContext" |
| * Platform-specific context pointer. |
| * THREAD SAFETY: |
| * Not Thread Safe (see Thread Safety Definitions in Programmer's Guide) |
| * RETURNS: |
| * Returns NULL if the function succeeds |
| * Returns a CertChainChecker Error if the functions fails in a non-fatal way |
| * Returns a Fatal Error if the function fails in an unrecoverable way |
| */ |
| static PKIX_Error * |
| pkix_PolicyChecker_CheckPolicy( |
| PKIX_PL_OID *policyOID, |
| PKIX_List *policyQualifiers, |
| PKIX_PL_Cert *cert, |
| PKIX_List *maps, |
| PKIX_PolicyCheckerState *state, |
| void *plContext) |
| { |
| PKIX_Boolean childNodeCreated = PKIX_FALSE; |
| PKIX_Boolean okToSpawn = PKIX_FALSE; |
| PKIX_Boolean found = PKIX_FALSE; |
| PKIX_List *subjectDomainPolicies = NULL; |
| |
| PKIX_ENTER(CERTCHAINCHECKER, "pkix_PolicyChecker_CheckPolicy"); |
| PKIX_NULLCHECK_THREE(policyOID, cert, state); |
| |
| /* |
| * If this is not the last certificate, get the set of |
| * subjectDomainPolicies that "policy" maps to, according to the |
| * current cert's policy mapping extension. That set will be NULL |
| * if the current cert does not have a policy mapping extension, |
| * or if the current policy is not mapped. |
| */ |
| if (state->certsProcessed != (state->numCerts - 1)) { |
| PKIX_CHECK(pkix_PolicyChecker_MapGetSubjectDomainPolicies |
| (maps, policyOID, &subjectDomainPolicies, plContext), |
| PKIX_POLICYCHECKERMAPGETSUBJECTDOMAINPOLICIESFAILED); |
| } |
| |
| /* |
| * Section 6.1.4(b)(2) tells us that if policyMapping is zero, we |
| * will have to delete any nodes created with validPolicies equal to |
| * policies that appear as issuerDomainPolicies in a policy mapping |
| * extension. Let's avoid creating any such nodes. |
| */ |
| if ((state->policyMapping) == 0) { |
| if (subjectDomainPolicies) { |
| goto cleanup; |
| } |
| } |
| |
| PKIX_CHECK(pkix_PolicyChecker_CheckPolicyRecursive |
| (policyOID, |
| policyQualifiers, |
| subjectDomainPolicies, |
| state->validPolicyTree, |
| state, |
| &childNodeCreated, |
| plContext), |
| PKIX_POLICYCHECKERCHECKPOLICYRECURSIVEFAILED); |
| |
| if (!childNodeCreated) { |
| /* |
| * Section 6.1.3(d)(1)(ii) |
| * There was no match. If there was a node at |
| * depth i-1 with valid policy anyPolicy, |
| * generate a node subordinate to that. |
| * |
| * But that means this created node would be in |
| * the valid-policy-node-set, and will be |
| * pruned in 6.1.5(g)(iii)(2) unless it is in |
| * the user-initial-policy-set or the user- |
| * initial-policy-set is {anyPolicy}. So check, |
| * and don't create it if it will be pruned. |
| */ |
| if (state->anyPolicyNodeAtBottom) { |
| if (state->initialIsAnyPolicy) { |
| okToSpawn = PKIX_TRUE; |
| } else { |
| PKIX_CHECK(pkix_List_Contains |
| (state->mappedUserInitialPolicySet, |
| (PKIX_PL_Object *)policyOID, |
| &okToSpawn, |
| plContext), |
| PKIX_LISTCONTAINSFAILED); |
| } |
| if (okToSpawn) { |
| PKIX_CHECK(pkix_PolicyChecker_Spawn |
| (state->anyPolicyNodeAtBottom, |
| policyOID, |
| policyQualifiers, |
| subjectDomainPolicies, |
| state, |
| plContext), |
| PKIX_POLICYCHECKERSPAWNFAILED); |
| childNodeCreated = PKIX_TRUE; |
| } |
| } |
| } |
| |
| if (childNodeCreated) { |
| /* |
| * If this policy had qualifiers, and the certificate policies |
| * extension was marked critical, and the user cannot deal with |
| * policy qualifiers, throw an error. |
| */ |
| if (policyQualifiers && |
| state->certPoliciesCritical && |
| state->policyQualifiersRejected) { |
| PKIX_ERROR |
| (PKIX_QUALIFIERSINCRITICALCERTIFICATEPOLICYEXTENSION); |
| } |
| /* |
| * If the policy we just propagated was in the list of mapped |
| * policies, remove it from the list. That list is used, at the |
| * end, to determine policies that have not been propagated. |
| */ |
| if (state->mappedPolicyOIDs) { |
| PKIX_CHECK(pkix_List_Contains |
| (state->mappedPolicyOIDs, |
| (PKIX_PL_Object *)policyOID, |
| &found, |
| plContext), |
| PKIX_LISTCONTAINSFAILED); |
| if (found) { |
| PKIX_CHECK(pkix_List_Remove |
| (state->mappedPolicyOIDs, |
| (PKIX_PL_Object *)policyOID, |
| plContext), |
| PKIX_LISTREMOVEFAILED); |
| } |
| } |
| } |
| |
| cleanup: |
| |
| PKIX_DECREF(subjectDomainPolicies); |
| |
| PKIX_RETURN(CERTCHAINCHECKER); |
| } |
| |
| /* |
| * FUNCTION: pkix_PolicyChecker_CheckAny |
| * DESCRIPTION: |
| * Performs the creation of PolicyNodes, for the PolicyNode pointed to by |
| * "currentNode" and PolicyNodes subordinate to it, using the List of |
| * qualifiers pointed to by "qualsOfAny", in accordance with the current |
| * certificate's PolicyMaps pointed to by "policyMaps" and the current |
| * PolicyCheckerState pointed to by "state". |
| * |
| * If the currentNode is not just above the bottom of the validPolicyTree, this |
| * function calls itself recursively for each child of currentNode. At the |
| * level just above the bottom, for each policy in the currentNode's |
| * expectedPolicySet not already present in a child node, it creates a new |
| * child node. The validPolicy of the child created, and its expectedPolicySet, |
| * will be the policy from the currentNode's expectedPolicySet. The policy |
| * qualifiers will be the qualifiers from the current certificate's anyPolicy, |
| * the "qualsOfAny" parameter. If the currentNode's expectedSet includes |
| * anyPolicy, a childNode will be created with a policy of anyPolicy. This is |
| * the only way such a node can be created. |
| * |
| * This function is called only when anyPolicy is one of the current |
| * certificate's policies. This function implements the processing described |
| * in RFC3280 Section 6.1.3(d)(2). |
| * |
| * PARAMETERS: |
| * "currentNode" |
| * Address of PolicyNode whose descendants will be checked, if not at the |
| * bottom of the tree; or whose expectedPolicySet will be compared to those |
| * in "alreadyPresent", if at the bottom. Must be non-NULL. |
| * "qualsOfAny" |
| * Address of List of qualifiers of the anyPolicy in the current |
| * certificate. May be empty or NULL. |
| * "policyMaps" |
| * Address of the List of PolicyMaps of the current certificate. May be |
| * empty or NULL. |
| * "state" |
| * Address of the current state of the PKIX_PolicyChecker. |
| * Must be non-NULL. |
| * "plContext" |
| * Platform-specific context pointer. |
| * THREAD SAFETY: |
| * Not Thread Safe (see Thread Safety Definitions in Programmer's Guide) |
| * RETURNS: |
| * Returns NULL if the function succeeds |
| * Returns a CertChainChecker Error if the functions fails in a non-fatal way |
| * Returns a Fatal Error if the function fails in an unrecoverable way |
| */ |
| static PKIX_Error * |
| pkix_PolicyChecker_CheckAny( |
| PKIX_PolicyNode *currentNode, |
| PKIX_List *qualsOfAny, /* CertPolicyQualifiers */ |
| PKIX_List *policyMaps, /* CertPolicyMaps */ |
| PKIX_PolicyCheckerState *state, |
| void *plContext) |
| { |
| PKIX_UInt32 depth = 0; |
| PKIX_UInt32 numChildren = 0; |
| PKIX_UInt32 childIx = 0; |
| PKIX_UInt32 numPolicies = 0; |
| PKIX_UInt32 polx = 0; |
| PKIX_Boolean isIncluded = PKIX_FALSE; |
| PKIX_List *children = NULL; /* PolicyNodes */ |
| PKIX_PolicyNode *childNode = NULL; |
| PKIX_List *expectedPolicies = NULL; /* OIDs */ |
| PKIX_PL_OID *policyOID = NULL; |
| PKIX_PL_OID *childPolicy = NULL; |
| PKIX_List *subjectDomainPolicies = NULL; /* OIDs */ |
| |
| PKIX_ENTER(CERTCHAINCHECKER, "pkix_PolicyChecker_CheckAny"); |
| PKIX_NULLCHECK_TWO(currentNode, state); |
| |
| PKIX_CHECK(PKIX_PolicyNode_GetDepth |
| (currentNode, &depth, plContext), |
| PKIX_POLICYNODEGETDEPTHFAILED); |
| |
| PKIX_CHECK(pkix_PolicyNode_GetChildrenMutable |
| (currentNode, &children, plContext), |
| PKIX_POLICYNODEGETCHILDRENMUTABLEFAILED); |
| |
| if (children) { |
| PKIX_CHECK(PKIX_List_GetLength |
| (children, &numChildren, plContext), |
| PKIX_LISTGETLENGTHFAILED); |
| } |
| |
| if (depth < (state->certsProcessed)) { |
| for (childIx = 0; childIx < numChildren; childIx++) { |
| |
| PKIX_CHECK(PKIX_List_GetItem |
| (children, |
| childIx, |
| (PKIX_PL_Object **)&childNode, |
| plContext), |
| PKIX_LISTGETITEMFAILED); |
| |
| PKIX_NULLCHECK_ONE(childNode); |
| PKIX_CHECK(pkix_PolicyChecker_CheckAny |
| (childNode, |
| qualsOfAny, |
| policyMaps, |
| state, |
| plContext), |
| PKIX_POLICYCHECKERCHECKANYFAILED); |
| |
| PKIX_DECREF(childNode); |
| } |
| } else { /* if at the bottom of the tree */ |
| |
| PKIX_CHECK(PKIX_PolicyNode_GetExpectedPolicies |
| (currentNode, &expectedPolicies, plContext), |
| PKIX_POLICYNODEGETEXPECTEDPOLICIESFAILED); |
| |
| /* Expected Policy Set is not allowed to be NULL */ |
| PKIX_NULLCHECK_ONE(expectedPolicies); |
| |
| PKIX_CHECK(PKIX_List_GetLength |
| (expectedPolicies, &numPolicies, plContext), |
| PKIX_LISTGETLENGTHFAILED); |
| |
| for (polx = 0; polx < numPolicies; polx++) { |
| PKIX_CHECK(PKIX_List_GetItem |
| (expectedPolicies, |
| polx, |
| (PKIX_PL_Object **)&policyOID, |
| plContext), |
| PKIX_LISTGETITEMFAILED); |
| |
| PKIX_NULLCHECK_ONE(policyOID); |
| |
| isIncluded = PKIX_FALSE; |
| |
| for (childIx = 0; |
| (!isIncluded && (childIx < numChildren)); |
| childIx++) { |
| |
| PKIX_CHECK(PKIX_List_GetItem |
| (children, |
| childIx, |
| (PKIX_PL_Object **)&childNode, |
| plContext), |
| PKIX_LISTGETITEMFAILED); |
| |
| PKIX_NULLCHECK_ONE(childNode); |
| |
| PKIX_CHECK(PKIX_PolicyNode_GetValidPolicy |
| (childNode, &childPolicy, plContext), |
| PKIX_POLICYNODEGETVALIDPOLICYFAILED); |
| |
| PKIX_NULLCHECK_ONE(childPolicy); |
| |
| PKIX_EQUALS(policyOID, childPolicy, &isIncluded, plContext, |
| PKIX_OBJECTEQUALSFAILED); |
| |
| PKIX_DECREF(childNode); |
| PKIX_DECREF(childPolicy); |
| } |
| |
| if (!isIncluded) { |
| if (policyMaps) { |
| PKIX_CHECK |
| (pkix_PolicyChecker_MapGetSubjectDomainPolicies |
| (policyMaps, |
| policyOID, |
| &subjectDomainPolicies, |
| plContext), |
| PKIX_POLICYCHECKERMAPGETSUBJECTDOMAINPOLICIESFAILED); |
| } |
| PKIX_CHECK(pkix_PolicyChecker_Spawn |
| (currentNode, |
| policyOID, |
| qualsOfAny, |
| subjectDomainPolicies, |
| state, |
| plContext), |
| PKIX_POLICYCHECKERSPAWNFAILED); |
| PKIX_DECREF(subjectDomainPolicies); |
| } |
| |
| PKIX_DECREF(policyOID); |
| } |
| } |
| |
| cleanup: |
| |
| PKIX_DECREF(children); |
| PKIX_DECREF(childNode); |
| PKIX_DECREF(expectedPolicies); |
| PKIX_DECREF(policyOID); |
| PKIX_DECREF(childPolicy); |
| PKIX_DECREF(subjectDomainPolicies); |
| |
| PKIX_RETURN(CERTCHAINCHECKER); |
| |
| } |
| |
| /* |
| * FUNCTION: pkix_PolicyChecker_CalculateIntersection |
| * DESCRIPTION: |
| * |
| * Processes the PolicyNode pointed to by "currentNode", and its descendants, |
| * using the PolicyCheckerState pointed to by "state", using the List at |
| * the address pointed to by "nominees" the OIDs of policies that are in the |
| * user-initial-policy-set but are not represented among the nodes at the |
| * bottom of the tree, and storing at "pShouldBePruned" the value TRUE if |
| * currentNode is childless at the end of this processing, FALSE if it has |
| * children or is at the bottom of the tree. |
| * |
| * When this function is called at the top level, "nominees" should be the List |
| * of all policies in the user-initial-policy-set. Policies that are |
| * represented in the valid-policy-node-set are removed from this List. As a |
| * result when nodes are created according to 6.1.5.(g)(iii)(3)(b), a node will |
| * be created for each policy remaining in this List. |
| * |
| * This function implements the calculation of the intersection of the |
| * validPolicyTree with the user-initial-policy-set, as described in |
| * RFC 3280 6.1.5(g)(iii). |
| * |
| * PARAMETERS: |
| * "currentNode" |
| * Address of PolicyNode whose descendants will be processed as described. |
| * Must be non-NULL. |
| * "state" |
| * Address of the current state of the PKIX_PolicyChecker. Must be non-NULL |
| * "nominees" |
| * Address of List of the OIDs for which nodes should be created to replace |
| * anyPolicy nodes. Must be non-NULL but may be empty. |
| * "pShouldBePruned" |
| * Address where Boolean return value, set to TRUE if this PolicyNode |
| * should be deleted, is stored. Must be non-NULL. |
| * "plContext" |
| * Platform-specific context pointer. |
| * THREAD SAFETY: |
| * Not Thread Safe (see Thread Safety Definitions in Programmer's Guide) |
| * RETURNS: |
| * Returns NULL if the function succeeds |
| * Returns a CertChainChecker Error if the functions fails in a non-fatal way |
| * Returns a Fatal Error if the function fails in an unrecoverable way |
| */ |
| static PKIX_Error * |
| pkix_PolicyChecker_CalculateIntersection( |
| PKIX_PolicyNode *currentNode, |
| PKIX_PolicyCheckerState *state, |
| PKIX_List *nominees, /* OIDs */ |
| PKIX_Boolean *pShouldBePruned, |
| void *plContext) |
| { |
| PKIX_Boolean currentPolicyIsAny = PKIX_FALSE; |
| PKIX_Boolean parentPolicyIsAny = PKIX_FALSE; |
| PKIX_Boolean currentPolicyIsValid = PKIX_FALSE; |
| PKIX_Boolean shouldBePruned = PKIX_FALSE; |
| PKIX_Boolean priorCriticality = PKIX_FALSE; |
| PKIX_UInt32 depth = 0; |
| PKIX_UInt32 numChildren = 0; |
| PKIX_UInt32 childIndex = 0; |
| PKIX_UInt32 numNominees = 0; |
| PKIX_UInt32 polIx = 0; |
| PKIX_PL_OID *currentPolicy = NULL; |
| PKIX_PL_OID *parentPolicy = NULL; |
| PKIX_PL_OID *substPolicy = NULL; |
| PKIX_PolicyNode *parent = NULL; |
| PKIX_PolicyNode *child = NULL; |
| PKIX_List *children = NULL; /* PolicyNodes */ |
| PKIX_List *policyQualifiers = NULL; |
| |
| PKIX_ENTER |
| (CERTCHAINCHECKER, |
| "pkix_PolicyChecker_CalculateIntersection"); |
| |
| /* |
| * We call this function if the valid_policy_tree is not NULL and |
| * the user-initial-policy-set is not any-policy. |
| */ |
| if (!state->validPolicyTree || state->initialIsAnyPolicy) { |
| PKIX_ERROR(PKIX_PRECONDITIONFAILED); |
| } |
| |
| PKIX_NULLCHECK_FOUR(currentNode, state, nominees, pShouldBePruned); |
| |
| PKIX_CHECK(PKIX_PolicyNode_GetValidPolicy |
| (currentNode, ¤tPolicy, plContext), |
| PKIX_POLICYNODEGETVALIDPOLICYFAILED); |
| |
| PKIX_NULLCHECK_TWO(state->anyPolicyOID, currentPolicy); |
| |
| PKIX_EQUALS |
| (state->anyPolicyOID, |
| currentPolicy, |
| ¤tPolicyIsAny, |
| plContext, |
| PKIX_OBJECTEQUALSFAILED); |
| |
| PKIX_CHECK(PKIX_PolicyNode_GetParent(currentNode, &parent, plContext), |
| PKIX_POLICYNODEGETPARENTFAILED); |
| |
| if (currentPolicyIsAny == PKIX_FALSE) { |
| |
| /* |
| * If we are at the top of the tree, or if our |
| * parent's validPolicy is anyPolicy, we are in |
| * the valid policy node set. |
| */ |
| if (parent) { |
| PKIX_CHECK(PKIX_PolicyNode_GetValidPolicy |
| (parent, &parentPolicy, plContext), |
| PKIX_POLICYNODEGETVALIDPOLICYFAILED); |
| |
| PKIX_NULLCHECK_ONE(parentPolicy); |
| |
| PKIX_EQUALS |
| (state->anyPolicyOID, |
| parentPolicy, |
| &parentPolicyIsAny, |
| plContext, |
| PKIX_OBJECTEQUALSFAILED); |
| } |
| |
| /* |
| * Section 6.1.5(g)(iii)(2) |
| * If this node's policy is not in the user-initial-policy-set, |
| * it is not in the intersection. Prune it. |
| */ |
| if (!parent || parentPolicyIsAny) { |
| PKIX_CHECK(pkix_List_Contains |
| (state->userInitialPolicySet, |
| (PKIX_PL_Object *)currentPolicy, |
| ¤tPolicyIsValid, |
| plContext), |
| PKIX_LISTCONTAINSFAILED); |
| if (!currentPolicyIsValid) { |
| *pShouldBePruned = PKIX_TRUE; |
| goto cleanup; |
| } |
| |
| /* |
| * If this node's policy is in the user-initial-policy- |
| * set, it will propagate that policy into the next |
| * level of the tree. Remove the policy from the list |
| * of policies that an anyPolicy will spawn. |
| */ |
| PKIX_CHECK(pkix_List_Remove |
| (nominees, |
| (PKIX_PL_Object *)currentPolicy, |
| plContext), |
| PKIX_LISTREMOVEFAILED); |
| } |
| } |
| |
| |
| /* Are we at the bottom of the tree? */ |
| |
| PKIX_CHECK(PKIX_PolicyNode_GetDepth |
| (currentNode, &depth, plContext), |
| PKIX_POLICYNODEGETDEPTHFAILED); |
| |
| if (depth == (state->numCerts)) { |
| /* |
| * Section 6.1.5(g)(iii)(3) |
| * Replace anyPolicy nodes... |
| */ |
| if (currentPolicyIsAny == PKIX_TRUE) { |
| |
| /* replace this node */ |
| |
| PKIX_CHECK(PKIX_List_GetLength |
| (nominees, &numNominees, plContext), |
| PKIX_LISTGETLENGTHFAILED); |
| |
| if (numNominees) { |
| |
| PKIX_CHECK(PKIX_PolicyNode_GetPolicyQualifiers |
| (currentNode, |
| &policyQualifiers, |
| plContext), |
| PKIX_POLICYNODEGETPOLICYQUALIFIERSFAILED); |
| |
| PKIX_CHECK(PKIX_PolicyNode_IsCritical |
| (currentNode, &priorCriticality, plContext), |
| PKIX_POLICYNODEISCRITICALFAILED); |
| } |
| |
| PKIX_NULLCHECK_ONE(parent); |
| |
| for (polIx = 0; polIx < numNominees; polIx++) { |
| |
| PKIX_CHECK(PKIX_List_GetItem |
| (nominees, |
| polIx, |
| (PKIX_PL_Object **)&substPolicy, |
| plContext), |
| PKIX_LISTGETITEMFAILED); |
| |
| PKIX_CHECK(pkix_PolicyChecker_Spawn |
| (parent, |
| substPolicy, |
| policyQualifiers, |
| NULL, |
| state, |
| plContext), |
| PKIX_POLICYCHECKERSPAWNFAILED); |
| |
| PKIX_DECREF(substPolicy); |
| |
| } |
| /* remove currentNode from parent */ |
| *pShouldBePruned = PKIX_TRUE; |
| /* |
| * We can get away with augmenting the parent's List |
| * of children because we started at the end and went |
| * toward the beginning. New nodes are added at the end. |
| */ |
| } |
| } else { |
| /* |
| * Section 6.1.5(g)(iii)(4) |
| * Prune any childless nodes above the bottom level |
| */ |
| PKIX_CHECK(pkix_PolicyNode_GetChildrenMutable |
| (currentNode, &children, plContext), |
| PKIX_POLICYNODEGETCHILDRENMUTABLEFAILED); |
| |
| /* CurrentNode should have been pruned if childless. */ |
| PKIX_NULLCHECK_ONE(children); |
| |
| PKIX_CHECK(PKIX_List_GetLength |
| (children, &numChildren, plContext), |
| PKIX_LISTGETLENGTHFAILED); |
| |
| for (childIndex = numChildren; childIndex > 0; childIndex--) { |
| |
| PKIX_CHECK(PKIX_List_GetItem |
| (children, |
| childIndex - 1, |
| (PKIX_PL_Object **)&child, |
| plContext), |
| PKIX_LISTGETITEMFAILED); |
| |
| PKIX_CHECK(pkix_PolicyChecker_CalculateIntersection |
| (child, state, nominees, &shouldBePruned, plContext), |
| PKIX_POLICYCHECKERCALCULATEINTERSECTIONFAILED); |
| |
| if (PKIX_TRUE == shouldBePruned) { |
| |
| PKIX_CHECK(PKIX_List_DeleteItem |
| (children, childIndex - 1, plContext), |
| PKIX_LISTDELETEITEMFAILED); |
| PKIX_CHECK(PKIX_PL_Object_InvalidateCache |
| ((PKIX_PL_Object *)state, plContext), |
| PKIX_OBJECTINVALIDATECACHEFAILED); |
| } |
| |
| PKIX_DECREF(child); |
| } |
| |
| PKIX_CHECK(PKIX_List_GetLength |
| (children, &numChildren, plContext), |
| PKIX_LISTGETLENGTHFAILED); |
| |
| if (numChildren == 0) { |
| *pShouldBePruned = PKIX_TRUE; |
| } |
| } |
| cleanup: |
| PKIX_DECREF(currentPolicy); |
| PKIX_DECREF(parentPolicy); |
| PKIX_DECREF(substPolicy); |
| PKIX_DECREF(parent); |
| PKIX_DECREF(child); |
| PKIX_DECREF(children); |
| PKIX_DECREF(policyQualifiers); |
| |
| PKIX_RETURN(CERTCHAINCHECKER); |
| |
| } |
| |
| /* |
| * FUNCTION: pkix_PolicyChecker_PolicyMapProcessing |
| * DESCRIPTION: |
| * |
| * Performs the processing of Policies in the List of CertPolicyMaps pointed |
| * to by "policyMaps", using and updating the PolicyCheckerState pointed to by |
| * "state". |
| * |
| * This function implements the policyMap processing described in RFC3280 |
| * Section 6.1.4(b)(1), after certificate i has been processed, in preparation |
| * for certificate i+1. Section references are to that document. |
| * |
| * PARAMETERS: |
| * "policyMaps" |
| * Address of the List of CertPolicyMaps presented by certificate i. |
| * Must be non-NULL. |
| * "certPoliciesIncludeAny" |
| * Boolean value which is PKIX_TRUE if the current certificate asserts |
| * anyPolicy, PKIX_FALSE otherwise. |
| * "qualsOfAny" |
| * Address of List of qualifiers of the anyPolicy in the current |
| * certificate. May be empty or NULL. |
| * "state" |
| * Address of the current state of the PKIX_PolicyChecker. |
| * Must be non-NULL. |
| * "plContext" |
| * Platform-specific context pointer. |
| * THREAD SAFETY: |
| * Not Thread Safe (see Thread Safety Definitions in Programmer's Guide) |
| * RETURNS: |
| * Returns NULL if the function succeeds |
| * Returns a CertChainChecker Error if the functions fails in a non-fatal way |
| * Returns a Fatal Error if the function fails in an unrecoverable way |
| */ |
| static PKIX_Error * |
| pkix_PolicyChecker_PolicyMapProcessing( |
| PKIX_List *policyMaps, /* CertPolicyMaps */ |
| PKIX_Boolean certPoliciesIncludeAny, |
| PKIX_List *qualsOfAny, |
| PKIX_PolicyCheckerState *state, |
| void *plContext) |
| { |
| PKIX_UInt32 numPolicies = 0; |
| PKIX_UInt32 polX = 0; |
| PKIX_PL_OID *policyOID = NULL; |
| PKIX_List *newMappedPolicies = NULL; /* OIDs */ |
| PKIX_List *subjectDomainPolicies = NULL; /* OIDs */ |
| |
| PKIX_ENTER |
| (CERTCHAINCHECKER, |
| "pkix_PolicyChecker_PolicyMapProcessing"); |
| PKIX_NULLCHECK_THREE |
| (policyMaps, |
| state, |
| state->mappedUserInitialPolicySet); |
| |
| /* |
| * For each policy in mappedUserInitialPolicySet, if it is not mapped, |
| * append it to new policySet; if it is mapped, append its |
| * subjectDomainPolicies to new policySet. When done, this new |
| * policySet will replace mappedUserInitialPolicySet. |
| */ |
| PKIX_CHECK(PKIX_List_Create |
| (&newMappedPolicies, plContext), |
| PKIX_LISTCREATEFAILED); |
| |
| PKIX_CHECK(PKIX_List_GetLength |
| (state->mappedUserInitialPolicySet, |
| &numPolicies, |
| plContext), |
| PKIX_LISTGETLENGTHFAILED); |
| |
| for (polX = 0; polX < numPolicies; polX++) { |
| |
| PKIX_CHECK(PKIX_List_GetItem |
| (state->mappedUserInitialPolicySet, |
| polX, |
| (PKIX_PL_Object **)&policyOID, |
| plContext), |
| PKIX_LISTGETITEMFAILED); |
| |
| PKIX_CHECK(pkix_PolicyChecker_MapGetSubjectDomainPolicies |
| (policyMaps, |
| policyOID, |
| &subjectDomainPolicies, |
| plContext), |
| PKIX_POLICYCHECKERMAPGETSUBJECTDOMAINPOLICIESFAILED); |
| |
| if (subjectDomainPolicies) { |
| |
| PKIX_CHECK(pkix_List_AppendUnique |
| (newMappedPolicies, |
| subjectDomainPolicies, |
| plContext), |
| PKIX_LISTAPPENDUNIQUEFAILED); |
| |
| PKIX_DECREF(subjectDomainPolicies); |
| |
| } else { |
| PKIX_CHECK(PKIX_List_AppendItem |
| (newMappedPolicies, |
| (PKIX_PL_Object *)policyOID, |
| plContext), |
| PKIX_LISTAPPENDITEMFAILED); |
| } |
| PKIX_DECREF(policyOID); |
| } |
| |
| /* |
| * For each policy ID-P remaining in mappedPolicyOIDs, it has not been |
| * propagated to the bottom of the tree (depth i). If policyMapping |
| * is greater than zero and this cert contains anyPolicy and the tree |
| * contains an anyPolicy node at depth i-1, then we must create a node |
| * with validPolicy ID-P, the policy qualifiers of anyPolicy in |
| * this certificate, and expectedPolicySet the subjectDomainPolicies |
| * that ID-P maps to. We also then add those subjectDomainPolicies to |
| * the list of policies that will be accepted in the next certificate, |
| * the mappedUserInitialPolicySet. |
| */ |
| |
| if ((state->policyMapping > 0) && (certPoliciesIncludeAny) && |
| (state->anyPolicyNodeAtBottom) && (state->mappedPolicyOIDs)) { |
| |
| PKIX_CHECK(PKIX_List_GetLength |
| (state->mappedPolicyOIDs, |
| &numPolicies, |
| plContext), |
| PKIX_LISTGETLENGTHFAILED); |
| |
| for (polX = 0; polX < numPolicies; polX++) { |
| |
| PKIX_CHECK(PKIX_List_GetItem |
| (state->mappedPolicyOIDs, |
| polX, |
| (PKIX_PL_Object **)&policyOID, |
| plContext), |
| PKIX_LISTGETITEMFAILED); |
| |
| PKIX_CHECK(pkix_PolicyChecker_MapGetSubjectDomainPolicies |
| (policyMaps, |
| policyOID, |
| &subjectDomainPolicies, |
| plContext), |
| PKIX_POLICYCHECKERMAPGETSUBJECTDOMAINPOLICIESFAILED); |
| |
| PKIX_CHECK(pkix_PolicyChecker_Spawn |
| (state->anyPolicyNodeAtBottom, |
| policyOID, |
| qualsOfAny, |
| subjectDomainPolicies, |
| state, |
| plContext), |
| PKIX_POLICYCHECKERSPAWNFAILED); |
| |
| PKIX_CHECK(pkix_List_AppendUnique |
| (newMappedPolicies, |
| subjectDomainPolicies, |
| plContext), |
| PKIX_LISTAPPENDUNIQUEFAILED); |
| |
| PKIX_DECREF(subjectDomainPolicies); |
| PKIX_DECREF(policyOID); |
| } |
| } |
| |
| PKIX_CHECK(PKIX_List_SetImmutable(newMappedPolicies, plContext), |
| PKIX_LISTSETIMMUTABLEFAILED); |
| |
| PKIX_DECREF(state->mappedUserInitialPolicySet); |
| PKIX_INCREF(newMappedPolicies); |
| |
| state->mappedUserInitialPolicySet = newMappedPolicies; |
| |
| cleanup: |
| |
| PKIX_DECREF(policyOID); |
| PKIX_DECREF(newMappedPolicies); |
| PKIX_DECREF(subjectDomainPolicies); |
| |
| PKIX_RETURN(CERTCHAINCHECKER); |
| } |
| |
| /* |
| * FUNCTION: pkix_PolicyChecker_WrapUpProcessing |
| * DESCRIPTION: |
| * |
| * Performs the wrap-up processing for the Cert pointed to by "cert", |
| * using and updating the PolicyCheckerState pointed to by "state". |
| * |
| * This function implements the wrap-up processing described in RFC3280 |
| * Section 6.1.5, after the final certificate has been processed. Section |
| * references in the comments are to that document. |
| * |
| * PARAMETERS: |
| * "cert" |
| * Address of the current (presumably the end entity) certificate. |
| * Must be non-NULL. |
| * "state" |
| * Address of the current state of the PKIX_PolicyChecker. |
| * Must be non-NULL. |
| * "plContext" |
| * Platform-specific context pointer. |
| * THREAD SAFETY: |
| * Not Thread Safe (see Thread Safety Definitions in Programmer's Guide) |
| * RETURNS: |
| * Returns NULL if the function succeeds |
| * Returns a CertChainChecker Error if the functions fails in a non-fatal way |
| * Returns a Fatal Error if the function fails in an unrecoverable way |
| */ |
| static PKIX_Error * |
| pkix_PolicyChecker_WrapUpProcessing( |
| PKIX_PL_Cert *cert, |
| PKIX_PolicyCheckerState *state, |
| void *plContext) |
| { |
| PKIX_Int32 explicitPolicySkipCerts = 0; |
| PKIX_Boolean isSelfIssued = PKIX_FALSE; |
| PKIX_Boolean shouldBePruned = PKIX_FALSE; |
| PKIX_List *nominees = NULL; /* OIDs */ |
| #if PKIX_CERTPOLICYCHECKERSTATEDEBUG |
| PKIX_PL_String *stateString = NULL; |
| char *stateAscii = NULL; |
| PKIX_UInt32 length; |
| #endif |
| |
| PKIX_ENTER |
| (CERTCHAINCHECKER, |
| "pkix_PolicyChecker_WrapUpProcessing"); |
| PKIX_NULLCHECK_THREE(cert, state, state->userInitialPolicySet); |
| |
| #if PKIX_CERTPOLICYCHECKERSTATEDEBUG |
| PKIX_CHECK(PKIX_PL_Object_ToString |
| ((PKIX_PL_Object*)state, &stateString, plContext), |
| PKIX_OBJECTTOSTRINGFAILED); |
| |
| PKIX_CHECK(PKIX_PL_String_GetEncoded |
| (stateString, |
| PKIX_ESCASCII, |
| (void **)&stateAscii, |
| &length, |
| plContext), |
| PKIX_STRINGGETENCODEDFAILED); |
| |
| PKIX_DEBUG_ARG("%s\n", stateAscii); |
| |
| PKIX_FREE(stateAscii); |
| PKIX_DECREF(stateString); |
| #endif |
| |
| /* Section 6.1.5(a) ... */ |
| PKIX_CHECK(pkix_IsCertSelfIssued |
| (cert, &isSelfIssued, plContext), |
| PKIX_ISCERTSELFISSUEDFAILED); |
| |
| if (!isSelfIssued) { |
| if (state->explicitPolicy > 0) { |
| |
| state->explicitPolicy--; |
| |
| PKIX_CHECK(PKIX_PL_Object_InvalidateCache |
| ((PKIX_PL_Object *)state, plContext), |
| PKIX_OBJECTINVALIDATECACHEFAILED); |
| } |
| } |
| |
| /* Section 6.1.5(b) ... */ |
| PKIX_CHECK(PKIX_PL_Cert_GetRequireExplicitPolicy |
| (cert, &explicitPolicySkipCerts, plContext), |
| PKIX_CERTGETREQUIREEXPLICITPOLICYFAILED); |
| |
| if (explicitPolicySkipCerts == 0) { |
| state->explicitPolicy = 0; |
| } |
| |
| /* Section 6.1.5(g)(i) ... */ |
| |
| if (!(state->validPolicyTree)) { |
| goto cleanup; |
| } |
| |
| /* Section 6.1.5(g)(ii) ... */ |
| |
| if (state->initialIsAnyPolicy) { |
| goto cleanup; |
| } |
| |
| /* |
| * Section 6.1.5(g)(iii) ... |
| * Create a list of policies which could be substituted for anyPolicy. |
| * Start with a (mutable) copy of user-initial-policy-set. |
| */ |
| PKIX_CHECK(pkix_PolicyChecker_MakeMutableCopy |
| (state->userInitialPolicySet, &nominees, plContext), |
| PKIX_POLICYCHECKERMAKEMUTABLECOPYFAILED); |
| |
| PKIX_CHECK(pkix_PolicyChecker_CalculateIntersection |
| (state->validPolicyTree, /* node at top of tree */ |
| state, |
| nominees, |
| &shouldBePruned, |
| plContext), |
| PKIX_POLICYCHECKERCALCULATEINTERSECTIONFAILED); |
| |
| if (PKIX_TRUE == shouldBePruned) { |
| PKIX_DECREF(state->validPolicyTree); |
| } |
| |
| if (state->validPolicyTree) { |
| PKIX_CHECK(PKIX_PL_Object_InvalidateCache |
| ((PKIX_PL_Object *)state->validPolicyTree, plContext), |
| PKIX_OBJECTINVALIDATECACHEFAILED); |
| } |
| |
| PKIX_CHECK(PKIX_PL_Object_InvalidateCache |
| ((PKIX_PL_Object *)state, plContext), |
| PKIX_OBJECTINVALIDATECACHEFAILED); |
| |
| #if PKIX_CERTPOLICYCHECKERSTATEDEBUG |
| if (state->validPolicyTree) { |
| PKIX_CHECK(PKIX_PL_Object_ToString |
| ((PKIX_PL_Object*)state, &stateString, plContext), |
| PKIX_OBJECTTOSTRINGFAILED); |
| |
| PKIX_CHECK(PKIX_PL_String_GetEncoded |
| (stateString, |
| PKIX_ESCASCII, |
| (void **)&stateAscii, |
| &length, |
| plContext), |
| PKIX_STRINGGETENCODEDFAILED); |
| |
| PKIX_DEBUG_ARG |
| ("After CalculateIntersection:\n%s\n", stateAscii); |
| |
| PKIX_FREE(stateAscii); |
| PKIX_DECREF(stateString); |
| } else { |
| PKIX_DEBUG("validPolicyTree is NULL\n"); |
| } |
| #endif |
| |
| /* Section 6.1.5(g)(iii)(4) ... */ |
| |
| if (state->validPolicyTree) { |
| |
| PKIX_CHECK(pkix_PolicyNode_Prune |
| (state->validPolicyTree, |
| state->numCerts, |
| &shouldBePruned, |
| plContext), |
| PKIX_POLICYNODEPRUNEFAILED); |
| |
| if (shouldBePruned) { |
| PKIX_DECREF(state->validPolicyTree); |
| } |
| } |
| |
| if (state->validPolicyTree) { |
| PKIX_CHECK(PKIX_PL_Object_InvalidateCache |
| ((PKIX_PL_Object *)state->validPolicyTree, plContext), |
| PKIX_OBJECTINVALIDATECACHEFAILED); |
| } |
| |
| PKIX_CHECK(PKIX_PL_Object_InvalidateCache |
| ((PKIX_PL_Object *)state, plContext), |
| PKIX_OBJECTINVALIDATECACHEFAILED); |
| |
| #if PKIX_CERTPOLICYCHECKERSTATEDEBUG |
| PKIX_CHECK(PKIX_PL_Object_ToString |
| ((PKIX_PL_Object*)state, &stateString, plContext), |
| PKIX_OBJECTTOSTRINGFAILED); |
| PKIX_CHECK(PKIX_PL_String_GetEncoded |
| (stateString, |
| PKIX_ESCASCII, |
| (void **)&stateAscii, |
| &length, |
| plContext), |
| PKIX_STRINGGETENCODEDFAILED); |
| PKIX_DEBUG_ARG("%s\n", stateAscii); |
| |
| PKIX_FREE(stateAscii); |
| PKIX_DECREF(stateString); |
| #endif |
| |
| cleanup: |
| |
| PKIX_DECREF(nominees); |
| |
| PKIX_RETURN(CERTCHAINCHECKER); |
| } |
| |
| |
| /* |
| * FUNCTION: pkix_PolicyChecker_Check |
| * (see comments in pkix_checker.h for PKIX_CertChainChecker_CheckCallback) |
| * |
| * Labels referring to sections, such as "Section 6.1.3(d)", refer to |
| * sections of RFC3280, Section 6.1.3 Basic Certificate Processing. |
| * |
| * If a non-fatal error occurs, it is unlikely that policy processing can |
| * continue. But it is still possible that chain validation could succeed if |
| * policy processing is non-critical. So if this function receives a non-fatal |
| * error from a lower level routine, it aborts policy processing by setting |
| * the validPolicyTree to NULL and tries to continue. |
| * |
| */ |
| static PKIX_Error * |
| pkix_PolicyChecker_Check( |
| PKIX_CertChainChecker *checker, |
| PKIX_PL_Cert *cert, |
| PKIX_List *unresolvedCriticals, /* OIDs */ |
| void **pNBIOContext, |
| void *plContext) |
| { |
| PKIX_UInt32 numPolicies = 0; |
| PKIX_UInt32 polX = 0; |
| PKIX_Boolean result = PKIX_FALSE; |
| PKIX_Int32 inhibitMappingSkipCerts = 0; |
| PKIX_Int32 explicitPolicySkipCerts = 0; |
| PKIX_Int32 inhibitAnyPolicySkipCerts = 0; |
| PKIX_Boolean shouldBePruned = PKIX_FALSE; |
| PKIX_Boolean isSelfIssued = PKIX_FALSE; |
| PKIX_Boolean certPoliciesIncludeAny = PKIX_FALSE; |
| PKIX_Boolean doAnyPolicyProcessing = PKIX_FALSE; |
| |
| PKIX_PolicyCheckerState *state = NULL; |
| PKIX_List *certPolicyInfos = NULL; /* CertPolicyInfos */ |
| PKIX_PL_CertPolicyInfo *policy = NULL; |
| PKIX_PL_OID *policyOID = NULL; |
| PKIX_List *qualsOfAny = NULL; /* CertPolicyQualifiers */ |
| PKIX_List *policyQualifiers = NULL; /* CertPolicyQualifiers */ |
| PKIX_List *policyMaps = NULL; /* CertPolicyMaps */ |
| PKIX_List *mappedPolicies = NULL; /* OIDs */ |
| PKIX_Error *subroutineErr = NULL; |
| #if PKIX_CERTPOLICYCHECKERSTATEDEBUG |
| PKIX_PL_String *stateString = NULL; |
| char *stateAscii = NULL; |
| PKIX_PL_String *certString = NULL; |
| char *certAscii = NULL; |
| PKIX_UInt32 length; |
| #endif |
| |
| PKIX_ENTER(CERTCHAINCHECKER, "pkix_PolicyChecker_Check"); |
| PKIX_NULLCHECK_FOUR(checker, cert, unresolvedCriticals, pNBIOContext); |
| |
| *pNBIOContext = NULL; /* we never block on pending I/O */ |
| |
| PKIX_CHECK(PKIX_CertChainChecker_GetCertChainCheckerState |
| (checker, (PKIX_PL_Object **)&state, plContext), |
| PKIX_CERTCHAINCHECKERGETCERTCHAINCHECKERSTATEFAILED); |
| |
| PKIX_NULLCHECK_TWO(state, state->certPoliciesExtension); |
| |
| #if PKIX_CERTPOLICYCHECKERSTATEDEBUG |
| PKIX_CHECK(PKIX_PL_Object_ToString |
| ((PKIX_PL_Object*)state, &stateString, plContext), |
| PKIX_OBJECTTOSTRINGFAILED); |
| PKIX_CHECK(PKIX_PL_String_GetEncoded |
| (stateString, |
| PKIX_ESCASCII, |
| (void **)&stateAscii, |
| &length, |
| plContext), |
| PKIX_STRINGGETENCODEDFAILED); |
| PKIX_DEBUG_ARG("On entry %s\n", stateAscii); |
| PKIX_FREE(stateAscii); |
| PKIX_DECREF(stateString); |
| #endif |
| |
| /* |
| * Section 6.1.4(a) |
| * If this is not the last certificate, and if |
| * policyMapping extension is present, check that no |
| * issuerDomainPolicy or subjectDomainPolicy is equal to the |
| * special policy anyPolicy. |
| */ |
| if (state->certsProcessed != (state->numCerts - 1)) { |
| PKIX_CHECK(PKIX_PL_Cert_GetPolicyMappings |
| (cert, &policyMaps, plContext), |
| PKIX_CERTGETPOLICYMAPPINGSFAILED); |
| } |
| |
| if (policyMaps) { |
| |
| PKIX_CHECK(pkix_PolicyChecker_MapContains |
| (policyMaps, state->anyPolicyOID, &result, plContext), |
| PKIX_POLICYCHECKERMAPCONTAINSFAILED); |
| |
| if (result) { |
| PKIX_ERROR(PKIX_INVALIDPOLICYMAPPINGINCLUDESANYPOLICY); |
| } |
| |
| PKIX_CHECK(pkix_PolicyChecker_MapGetMappedPolicies |
| (policyMaps, &mappedPolicies, plContext), |
| PKIX_POLICYCHECKERMAPGETMAPPEDPOLICIESFAILED); |
| |
| PKIX_DECREF(state->mappedPolicyOIDs); |
| PKIX_INCREF(mappedPolicies); |
| state->mappedPolicyOIDs = mappedPolicies; |
| } |
| |
| /* Section 6.1.3(d) */ |
| if (state->validPolicyTree) { |
| |
| PKIX_CHECK(PKIX_PL_Cert_GetPolicyInformation |
| (cert, &certPolicyInfos, plContext), |
| PKIX_CERTGETPOLICYINFORMATIONFAILED); |
| |
| if (certPolicyInfos) { |
| PKIX_CHECK(PKIX_List_GetLength |
| (certPolicyInfos, &numPolicies, plContext), |
| PKIX_LISTGETLENGTHFAILED); |
| } |
| |
| if (numPolicies > 0) { |
| |
| PKIX_CHECK(PKIX_PL_Cert_AreCertPoliciesCritical |
| (cert, &(state->certPoliciesCritical), plContext), |
| PKIX_CERTARECERTPOLICIESCRITICALFAILED); |
| |
| /* Section 6.1.3(d)(1) For each policy not equal to anyPolicy */ |
| for (polX = 0; polX < numPolicies; polX++) { |
| |
| PKIX_CHECK(PKIX_List_GetItem |
| (certPolicyInfos, |
| polX, |
| (PKIX_PL_Object **)&policy, |
| plContext), |
| PKIX_LISTGETITEMFAILED); |
| |
| PKIX_CHECK(PKIX_PL_CertPolicyInfo_GetPolicyId |
| (policy, &policyOID, plContext), |
| PKIX_CERTPOLICYINFOGETPOLICYIDFAILED); |
| |
| PKIX_CHECK(PKIX_PL_CertPolicyInfo_GetPolQualifiers |
| (policy, &policyQualifiers, plContext), |
| PKIX_CERTPOLICYINFOGETPOLQUALIFIERSFAILED); |
| |
| PKIX_EQUALS |
| (state->anyPolicyOID, |
| policyOID, |
| &result, |
| plContext, |
| PKIX_OIDEQUALFAILED); |
| |
| if (result == PKIX_FALSE) { |
| |
| /* Section 6.1.3(d)(1)(i) */ |
| subroutineErr = pkix_PolicyChecker_CheckPolicy |
| (policyOID, |
| policyQualifiers, |
| cert, |
| policyMaps, |
| state, |
| plContext); |
| if (subroutineErr) { |
| goto subrErrorCleanup; |
| } |
| |
| } else { |
| /* |
| * No descent (yet) for anyPolicy, but we will need |
| * the policyQualifiers for anyPolicy in 6.1.3(d)(2) |
| */ |
| PKIX_DECREF(qualsOfAny); |
| PKIX_INCREF(policyQualifiers); |
| qualsOfAny = policyQualifiers; |
| certPoliciesIncludeAny = PKIX_TRUE; |
| } |
| PKIX_DECREF(policy); |
| PKIX_DECREF(policyOID); |
| PKIX_DECREF(policyQualifiers); |
| } |
| |
| /* Section 6.1.3(d)(2) */ |
| if (certPoliciesIncludeAny == PKIX_TRUE) { |
| if (state->inhibitAnyPolicy > 0) { |
| doAnyPolicyProcessing = PKIX_TRUE; |
| } else { |
| /* We haven't yet counted the current cert */ |
| if (((state->certsProcessed) + 1) < |
| (state->numCerts)) { |
| |
| PKIX_CHECK(pkix_IsCertSelfIssued |
| (cert, |
| &doAnyPolicyProcessing, |
| plContext), |
| PKIX_ISCERTSELFISSUEDFAILED); |
| } |
| } |
| if (doAnyPolicyProcessing) { |
| subroutineErr = pkix_PolicyChecker_CheckAny |
| (state->validPolicyTree, |
| qualsOfAny, |
| policyMaps, |
| state, |
| plContext); |
| if (subroutineErr) { |
| goto subrErrorCleanup; |
| } |
| } |
| } |
| |
| /* Section 6.1.3(d)(3) */ |
| if (state->validPolicyTree) { |
| subroutineErr = pkix_PolicyNode_Prune |
| (state->validPolicyTree, |
| state->certsProcessed + 1, |
| &shouldBePruned, |
| plContext); |
| if (subroutineErr) { |
| goto subrErrorCleanup; |
| } |
| if (shouldBePruned) { |
| PKIX_DECREF(state->validPolicyTree); |
| PKIX_DECREF(state->anyPolicyNodeAtBottom); |
| } |
| } |
| |
| PKIX_CHECK(PKIX_PL_Object_InvalidateCache |
| ((PKIX_PL_Object *)state, plContext), |
| PKIX_OBJECTINVALIDATECACHEFAILED); |
| |
| } else { |
| /* Section 6.1.3(e) */ |
| PKIX_DECREF(state->validPolicyTree); |
| PKIX_DECREF(state->anyPolicyNodeAtBottom); |
| PKIX_DECREF(state->newAnyPolicyNode); |
| |
| PKIX_CHECK(PKIX_PL_Object_InvalidateCache |
| ((PKIX_PL_Object *)state, plContext), |
| PKIX_OBJECTINVALIDATECACHEFAILED); |
| } |
| } |
| |
| /* Section 6.1.3(f) */ |
| if ((0 == state->explicitPolicy) && (!state->validPolicyTree)) { |
| PKIX_ERROR(PKIX_CERTCHAINFAILSCERTIFICATEPOLICYVALIDATION); |
| } |
| |
| /* |
| * Remove Policy OIDs from list of unresolved critical |
| * extensions, if present. |
| */ |
| PKIX_CHECK(pkix_List_Remove |
| (unresolvedCriticals, |
| (PKIX_PL_Object *)state->certPoliciesExtension, |
| plContext), |
| PKIX_LISTREMOVEFAILED); |
| |
| PKIX_CHECK(pkix_List_Remove |
| (unresolvedCriticals, |
| (PKIX_PL_Object *)state->policyMappingsExtension, |
| plContext), |
| PKIX_LISTREMOVEFAILED); |
| |
| PKIX_CHECK(pkix_List_Remove |
| (unresolvedCriticals, |
| (PKIX_PL_Object *)state->policyConstraintsExtension, |
| plContext), |
| PKIX_LISTREMOVEFAILED); |
| |
| PKIX_CHECK(pkix_List_Remove |
| (unresolvedCriticals, |
| (PKIX_PL_Object *)state->inhibitAnyPolicyExtension, |
| plContext), |
| PKIX_LISTREMOVEFAILED); |
| |
| state->certsProcessed++; |
| |
| /* If this was not the last certificate, do next-cert preparation */ |
| if (state->certsProcessed != state->numCerts) { |
| |
| if (policyMaps) { |
| subroutineErr = pkix_PolicyChecker_PolicyMapProcessing |
| (policyMaps, |
| certPoliciesIncludeAny, |
| qualsOfAny, |
| state, |
| plContext); |
| if (subroutineErr) { |
| goto subrErrorCleanup; |
| } |
| } |
| |
| /* update anyPolicyNodeAtBottom pointer */ |
| PKIX_DECREF(state->anyPolicyNodeAtBottom); |
| state->anyPolicyNodeAtBottom = state->newAnyPolicyNode; |
| state->newAnyPolicyNode = NULL; |
| |
| /* Section 6.1.4(h) */ |
| PKIX_CHECK(pkix_IsCertSelfIssued |
| (cert, &isSelfIssued, plContext), |
| PKIX_ISCERTSELFISSUEDFAILED); |
| |
| if (!isSelfIssued) { |
| if (state->explicitPolicy > 0) { |
| state->explicitPolicy--; |
| } |
| if (state->policyMapping > 0) { |
| state->policyMapping--; |
| } |
| if (state->inhibitAnyPolicy > 0) { |
| state->inhibitAnyPolicy--; |
| } |
| } |
| |
| /* Section 6.1.4(i) */ |
| PKIX_CHECK(PKIX_PL_Cert_GetRequireExplicitPolicy |
| (cert, &explicitPolicySkipCerts, plContext), |
| PKIX_CERTGETREQUIREEXPLICITPOLICYFAILED); |
| |
| if (explicitPolicySkipCerts != -1) { |
| if (((PKIX_UInt32)explicitPolicySkipCerts) < |
| (state->explicitPolicy)) { |
| state->explicitPolicy = |
| ((PKIX_UInt32) explicitPolicySkipCerts); |
| } |
| } |
| |
| PKIX_CHECK(PKIX_PL_Cert_GetPolicyMappingInhibited |
| (cert, &inhibitMappingSkipCerts, plContext), |
| PKIX_CERTGETPOLICYMAPPINGINHIBITEDFAILED); |
| |
| if (inhibitMappingSkipCerts != -1) { |
| if (((PKIX_UInt32)inhibitMappingSkipCerts) < |
| (state->policyMapping)) { |
| state->policyMapping = |
| ((PKIX_UInt32)inhibitMappingSkipCerts); |
| } |
| } |
| |
| PKIX_CHECK(PKIX_PL_Cert_GetInhibitAnyPolicy |
| (cert, &inhibitAnyPolicySkipCerts, plContext), |
| PKIX_CERTGETINHIBITANYPOLICYFAILED); |
| |
| if (inhibitAnyPolicySkipCerts != -1) { |
| if (((PKIX_UInt32)inhibitAnyPolicySkipCerts) < |
| (state->inhibitAnyPolicy)) { |
| state->inhibitAnyPolicy = |
| ((PKIX_UInt32)inhibitAnyPolicySkipCerts); |
| } |
| } |
| |
| PKIX_CHECK(PKIX_PL_Object_InvalidateCache |
| ((PKIX_PL_Object *)state, plContext), |
| PKIX_OBJECTINVALIDATECACHEFAILED); |
| |
| } else { /* If this was the last certificate, do wrap-up processing */ |
| |
| /* Section 6.1.5 */ |
| subroutineErr = pkix_PolicyChecker_WrapUpProcessing |
| (cert, state, plContext); |
| if (subroutineErr) { |
| goto subrErrorCleanup; |
| } |
| |
| if ((0 == state->explicitPolicy) && (!state->validPolicyTree)) { |
| PKIX_ERROR(PKIX_CERTCHAINFAILSCERTIFICATEPOLICYVALIDATION); |
| } |
| |
| PKIX_DECREF(state->anyPolicyNodeAtBottom); |
| PKIX_DECREF(state->newAnyPolicyNode); |
| } |
| |
| |
| if (subroutineErr) { |
| |
| subrErrorCleanup: |
| /* We had an error. Was it a fatal error? */ |
| pkixErrorClass = subroutineErr->errClass; |
| if (pkixErrorClass == PKIX_FATAL_ERROR) { |
| pkixErrorResult = subroutineErr; |
| subroutineErr = NULL; |
| goto cleanup; |
| } |
| /* |
| * Abort policy processing, and then determine whether |
| * we can continue without policy processing. |
| */ |
| PKIX_DECREF(state->validPolicyTree); |
| PKIX_DECREF(state->anyPolicyNodeAtBottom); |
| PKIX_DECREF(state->newAnyPolicyNode); |
| if (state->explicitPolicy == 0) { |
| PKIX_ERROR |
| (PKIX_CERTCHAINFAILSCERTIFICATEPOLICYVALIDATION); |
| } |
| } |
| |
| /* Checking is complete. Save state for the next certificate. */ |
| PKIX_CHECK(PKIX_CertChainChecker_SetCertChainCheckerState |
| (checker, (PKIX_PL_Object *)state, plContext), |
| PKIX_CERTCHAINCHECKERSETCERTCHAINCHECKERSTATEFAILED); |
| |
| cleanup: |
| |
| #if PKIX_CERTPOLICYCHECKERSTATEDEBUG |
| if (cert) { |
| PKIX_CHECK(PKIX_PL_Object_ToString |
| ((PKIX_PL_Object*)cert, &certString, plContext), |
| PKIX_OBJECTTOSTRINGFAILED); |
| PKIX_CHECK(PKIX_PL_String_GetEncoded |
| (certString, |
| PKIX_ESCASCII, |
| (void **)&certAscii, |
| &length, |
| plContext), |
| PKIX_STRINGGETENCODEDFAILED); |
| PKIX_DEBUG_ARG("Cert was %s\n", certAscii); |
| PKIX_FREE(certAscii); |
| PKIX_DECREF(certString); |
| } |
| if (state) { |
| PKIX_CHECK(PKIX_PL_Object_ToString |
| ((PKIX_PL_Object*)state, &stateString, plContext), |
| PKIX_OBJECTTOSTRINGFAILED); |
| PKIX_CHECK(PKIX_PL_String_GetEncoded |
| (stateString, |
| PKIX_ESCASCII, |
| (void **)&stateAscii, |
| &length, |
| plContext), |
| PKIX_STRINGGETENCODEDFAILED); |
| PKIX_DEBUG_ARG("On exit %s\n", stateAscii); |
| PKIX_FREE(stateAscii); |
| PKIX_DECREF(stateString); |
| } |
| #endif |
| |
| PKIX_DECREF(state); |
| PKIX_DECREF(certPolicyInfos); |
| PKIX_DECREF(policy); |
| PKIX_DECREF(qualsOfAny); |
| PKIX_DECREF(policyQualifiers); |
| PKIX_DECREF(policyOID); |
| PKIX_DECREF(subroutineErr); |
| PKIX_DECREF(policyMaps); |
| PKIX_DECREF(mappedPolicies); |
| |
| PKIX_RETURN(CERTCHAINCHECKER); |
| } |
| |
| /* |
| * FUNCTION: pkix_PolicyChecker_Initialize |
| * DESCRIPTION: |
| * |
| * Creates and initializes a PolicyChecker, using the List pointed to |
| * by "initialPolicies" for the user-initial-policy-set, the Boolean value |
| * of "policyQualifiersRejected" for the policyQualifiersRejected parameter, |
| * the Boolean value of "initialPolicyMappingInhibit" for the |
| * inhibitPolicyMappings parameter, the Boolean value of |
| * "initialExplicitPolicy" for the initialExplicitPolicy parameter, the |
| * Boolean value of "initialAnyPolicyInhibit" for the inhibitAnyPolicy |
| * parameter, and the UInt32 value of "numCerts" as the number of |
| * certificates in the chain; and stores the Checker at "pChecker". |
| * |
| * PARAMETERS: |
| * "initialPolicies" |
| * Address of List of OIDs comprising the user-initial-policy-set; the List |
| * may be empty or NULL |
| * "policyQualifiersRejected" |
| * Boolean value of the policyQualifiersRejected parameter |
| * "initialPolicyMappingInhibit" |
| * Boolean value of the inhibitPolicyMappings parameter |
| * "initialExplicitPolicy" |
| * Boolean value of the initialExplicitPolicy parameter |
| * "initialAnyPolicyInhibit" |
| * Boolean value of the inhibitAnyPolicy parameter |
| * "numCerts" |
| * Number of certificates in the chain to be validated |
| * "pChecker" |
| * Address to store the created PolicyChecker. Must be non-NULL. |
| * "plContext" |
| * Platform-specific context pointer. |
| * THREAD SAFETY: |
| * Thread Safe (see Thread Safety Definitions in Programmer's Guide) |
| * RETURNS: |
| * Returns NULL if the function succeeds |
| * Returns a CertChainChecker Error if the functions fails in a non-fatal way |
| * Returns a Fatal Error if the function fails in an unrecoverable way |
| */ |
| PKIX_Error * |
| pkix_PolicyChecker_Initialize( |
| PKIX_List *initialPolicies, |
| PKIX_Boolean policyQualifiersRejected, |
| PKIX_Boolean initialPolicyMappingInhibit, |
| PKIX_Boolean initialExplicitPolicy, |
| PKIX_Boolean initialAnyPolicyInhibit, |
| PKIX_UInt32 numCerts, |
| PKIX_CertChainChecker **pChecker, |
| void *plContext) |
| { |
| PKIX_PolicyCheckerState *polCheckerState = NULL; |
| PKIX_List *policyExtensions = NULL; /* OIDs */ |
| PKIX_ENTER(CERTCHAINCHECKER, "pkix_PolicyChecker_Initialize"); |
| PKIX_NULLCHECK_ONE(pChecker); |
| |
| PKIX_CHECK(pkix_PolicyCheckerState_Create |
| (initialPolicies, |
| policyQualifiersRejected, |
| initialPolicyMappingInhibit, |
| initialExplicitPolicy, |
| initialAnyPolicyInhibit, |
| numCerts, |
| &polCheckerState, |
| plContext), |
| PKIX_POLICYCHECKERSTATECREATEFAILED); |
| |
| /* Create the list of extensions that we handle */ |
| PKIX_CHECK(pkix_PolicyChecker_MakeSingleton |
| ((PKIX_PL_Object *)(polCheckerState->certPoliciesExtension), |
| PKIX_TRUE, |
| &policyExtensions, |
| plContext), |
| PKIX_POLICYCHECKERMAKESINGLETONFAILED); |
| |
| PKIX_CHECK(PKIX_CertChainChecker_Create |
| (pkix_PolicyChecker_Check, |
| PKIX_FALSE, /* forwardCheckingSupported */ |
| PKIX_FALSE, |
| policyExtensions, |
| (PKIX_PL_Object *)polCheckerState, |
| pChecker, |
| plContext), |
| PKIX_CERTCHAINCHECKERCREATEFAILED); |
| |
| cleanup: |
| PKIX_DECREF(polCheckerState); |
| PKIX_DECREF(policyExtensions); |
| PKIX_RETURN(CERTCHAINCHECKER); |
| |
| } |
