| /* This Source Code Form is subject to the terms of the Mozilla Public |
| * License, v. 2.0. If a copy of the MPL was not distributed with this |
| * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ |
| /* |
| * pkix_validate.c |
| * |
| * Top level validateChain function |
| * |
| */ |
| |
| #include "pkix_validate.h" |
| #include "pkix_pl_common.h" |
| |
| /* --Private-Functions-------------------------------------------- */ |
| |
| /* |
| * FUNCTION: pkix_AddToVerifyLog |
| * DESCRIPTION: |
| * |
| * This function returns immediately if the address for the VerifyNode tree |
| * pointed to by "pVerifyTree" is NULL. Otherwise it creates a new VerifyNode |
| * from the Cert pointed to by "cert" and the Error pointed to by "error", |
| * and inserts it at the depth in the VerifyNode tree determined by "depth". A |
| * depth of zero means that this function creates the root node of a new tree. |
| * |
| * Note: this function does not include the means of choosing among branches |
| * of a tree. It is intended for non-branching trees, that is, where each |
| * parent node has only a single child node. |
| * |
| * PARAMETERS: |
| * "cert" |
| * The address of the Cert to be included in the new VerifyNode. Must be |
| * non-NULL. |
| * "depth" |
| * The UInt32 value of the depth. |
| * "error" |
| * The address of the Error to be included in the new VerifyNode. |
| * "pVerifyTree" |
| * The address of the VerifyNode tree into which the created VerifyNode |
| * is to be inserted. The node is not created if VerifyTree is NULL. |
| * "plContext" |
| * Platform-specific context pointer. |
| * THREAD SAFETY: |
| * Thread Safe (see Thread Safety Definitions in Programmer's Guide) |
| * RETURNS: |
| * Returns NULL if the function succeeds. |
| * Returns a Validate Error if the function fails in a non-fatal way. |
| * Returns a Fatal Error if the function fails in an unrecoverable way. |
| */ |
| static PKIX_Error * |
| pkix_AddToVerifyLog( |
| PKIX_PL_Cert *cert, |
| PKIX_UInt32 depth, |
| PKIX_Error *error, |
| PKIX_VerifyNode **pVerifyTree, |
| void *plContext) |
| { |
| |
| PKIX_VerifyNode *verifyNode = NULL; |
| |
| PKIX_ENTER(VALIDATE, "pkix_AddToVerifyLog"); |
| PKIX_NULLCHECK_ONE(cert); |
| |
| if (pVerifyTree) { /* nothing to do if no address given for log */ |
| |
| PKIX_CHECK(pkix_VerifyNode_Create |
| (cert, depth, error, &verifyNode, plContext), |
| PKIX_VERIFYNODECREATEFAILED); |
| |
| if (depth == 0) { |
| /* We just created the root node */ |
| *pVerifyTree = verifyNode; |
| } else { |
| PKIX_CHECK(pkix_VerifyNode_AddToChain |
| (*pVerifyTree, verifyNode, plContext), |
| PKIX_VERIFYNODEADDTOCHAINFAILED); |
| } |
| } |
| |
| cleanup: |
| |
| PKIX_RETURN(VALIDATE); |
| |
| } |
| |
| /* |
| * FUNCTION: pkix_CheckCert |
| * DESCRIPTION: |
| * |
| * Checks whether the Cert pointed to by "cert" successfully validates |
| * using the List of CertChainCheckers pointed to by "checkers". If the |
| * certificate does not validate, an Error pointer is returned. |
| * |
| * This function should be called initially with the UInt32 pointed to by |
| * "pCheckerIndex" containing zero, and the pointer at "pNBIOContext" |
| * containing NULL. If a checker does non-blocking I/O, this function will |
| * return with the index of that checker stored at "pCheckerIndex" and a |
| * platform-dependent non-blocking I/O context stored at "pNBIOContext". |
| * A subsequent call to this function with those values intact will allow the |
| * checking to resume where it left off. This should be repeated until the |
| * function returns with NULL stored at "pNBIOContext". |
| * |
| * PARAMETERS: |
| * "cert" |
| * Address of Cert to validate. Must be non-NULL. |
| * "checkers" |
| * List of CertChainCheckers which must each validate the certificate. |
| * Must be non-NULL. |
| * "checkedExtOIDs" |
| * List of PKIX_PL_OID that has been processed. If called from building |
| * chain, it is the list of critical extension OIDs that has been |
| * processed prior to validation. May be NULL. |
| * "pCheckerIndex" |
| * Address at which is stored the the index, within the List "checkers", |
| * of a checker whose processing was interrupted by non-blocking I/O. |
| * Must be non-NULL. |
| * "pNBIOContext" |
| * Address at which is stored platform-specific non-blocking I/O context. |
| * Must be non-NULL. |
| * "plContext" |
| * Platform-specific context pointer. |
| * THREAD SAFETY: |
| * Thread Safe (see Thread Safety Definitions in Programmer's Guide) |
| * RETURNS: |
| * Returns NULL if the function succeeds. |
| * Returns a Validate Error if the function fails in a non-fatal way. |
| * Returns a Fatal Error if the function fails in an unrecoverable way. |
| */ |
| static PKIX_Error * |
| pkix_CheckCert( |
| PKIX_PL_Cert *cert, |
| PKIX_List *checkers, |
| PKIX_List *checkedExtOIDsList, |
| PKIX_UInt32 *pCheckerIndex, |
| void **pNBIOContext, |
| void *plContext) |
| { |
| PKIX_CertChainChecker_CheckCallback checkerCheck = NULL; |
| PKIX_CertChainChecker *checker = NULL; |
| PKIX_List *unresCritExtOIDs = NULL; |
| PKIX_UInt32 numCheckers; |
| PKIX_UInt32 numUnresCritExtOIDs = 0; |
| PKIX_UInt32 checkerIndex = 0; |
| void *nbioContext = NULL; |
| |
| PKIX_ENTER(VALIDATE, "pkix_CheckCert"); |
| PKIX_NULLCHECK_FOUR(cert, checkers, pCheckerIndex, pNBIOContext); |
| |
| nbioContext = *pNBIOContext; |
| *pNBIOContext = NULL; /* prepare for case of error exit */ |
| |
| PKIX_CHECK(PKIX_PL_Cert_GetCriticalExtensionOIDs |
| (cert, &unresCritExtOIDs, plContext), |
| PKIX_CERTGETCRITICALEXTENSIONOIDSFAILED); |
| |
| PKIX_CHECK(PKIX_List_GetLength(checkers, &numCheckers, plContext), |
| PKIX_LISTGETLENGTHFAILED); |
| |
| for (checkerIndex = *pCheckerIndex; |
| checkerIndex < numCheckers; |
| checkerIndex++) { |
| |
| PKIX_CHECK(PKIX_List_GetItem |
| (checkers, |
| checkerIndex, |
| (PKIX_PL_Object **)&checker, |
| plContext), |
| PKIX_LISTGETITEMFAILED); |
| |
| PKIX_CHECK(PKIX_CertChainChecker_GetCheckCallback |
| (checker, &checkerCheck, plContext), |
| PKIX_CERTCHAINCHECKERGETCHECKCALLBACKFAILED); |
| |
| PKIX_CHECK(checkerCheck(checker, cert, unresCritExtOIDs, |
| &nbioContext, plContext), |
| PKIX_CERTCHAINCHECKERCHECKFAILED); |
| |
| if (nbioContext != NULL) { |
| *pCheckerIndex = checkerIndex; |
| *pNBIOContext = nbioContext; |
| goto cleanup; |
| } |
| |
| PKIX_DECREF(checker); |
| } |
| |
| if (unresCritExtOIDs){ |
| |
| #ifdef PKIX_VALIDATEDEBUG |
| { |
| PKIX_PL_String *oidString = NULL; |
| PKIX_UInt32 length; |
| char *oidAscii = NULL; |
| PKIX_TOSTRING(unresCritExtOIDs, &oidString, plContext, |
| PKIX_LISTTOSTRINGFAILED); |
| PKIX_CHECK(PKIX_PL_String_GetEncoded |
| (oidString, |
| PKIX_ESCASCII, |
| (void **) &oidAscii, |
| &length, |
| plContext), |
| PKIX_STRINGGETENCODEDFAILED); |
| PKIX_VALIDATE_DEBUG_ARG |
| ("unrecognized critical extension OIDs:" |
| " %s\n", oidAscii); |
| PKIX_DECREF(oidString); |
| PKIX_PL_Free(oidAscii, plContext); |
| } |
| #endif |
| |
| if (checkedExtOIDsList != NULL) { |
| /* Take out OID's that had been processed, if any */ |
| PKIX_CHECK(pkix_List_RemoveItems |
| (unresCritExtOIDs, |
| checkedExtOIDsList, |
| plContext), |
| PKIX_LISTREMOVEITEMSFAILED); |
| } |
| |
| PKIX_CHECK(PKIX_List_GetLength |
| (unresCritExtOIDs, &numUnresCritExtOIDs, plContext), |
| PKIX_LISTGETLENGTHFAILED); |
| |
| if (numUnresCritExtOIDs != 0){ |
| PKIX_ERROR(PKIX_UNRECOGNIZEDCRITICALEXTENSION); |
| } |
| |
| } |
| |
| cleanup: |
| |
| PKIX_DECREF(checker); |
| PKIX_DECREF(unresCritExtOIDs); |
| |
| PKIX_RETURN(VALIDATE); |
| |
| } |
| |
| /* |
| * FUNCTION: pkix_InitializeCheckers |
| * DESCRIPTION: |
| * |
| * Creates several checkers and initializes them with values derived from the |
| * TrustAnchor pointed to by "anchor", the ProcessingParams pointed to by |
| * "procParams", and the number of Certs in the Chain, represented by |
| * "numCerts". The List of checkers is stored at "pCheckers". |
| * |
| * PARAMETERS: |
| * "anchor" |
| * Address of TrustAnchor used to initialize the SignatureChecker and |
| * NameChainingChecker. Must be non-NULL. |
| * "procParams" |
| * Address of ProcessingParams used to initialize the ExpirationChecker |
| * and TargetCertChecker. Must be non-NULL. |
| * "numCerts" |
| * Number of certificates in the CertChain. |
| * "pCheckers" |
| * Address where object pointer will be stored. Must be non-NULL. |
| * "plContext" |
| * Platform-specific context pointer. |
| * THREAD SAFETY: |
| * Thread Safe (see Thread Safety Definitions in Programmer's Guide) |
| * RETURNS: |
| * Returns NULL if the function succeeds. |
| * Returns a Validate Error if the function fails in a non-fatal way. |
| * Returns a Fatal Error if the function fails in an unrecoverable way. |
| */ |
| static PKIX_Error * |
| pkix_InitializeCheckers( |
| PKIX_TrustAnchor *anchor, |
| PKIX_ProcessingParams *procParams, |
| PKIX_UInt32 numCerts, |
| PKIX_List **pCheckers, |
| void *plContext) |
| { |
| PKIX_CertChainChecker *targetCertChecker = NULL; |
| PKIX_CertChainChecker *expirationChecker = NULL; |
| PKIX_CertChainChecker *nameChainingChecker = NULL; |
| PKIX_CertChainChecker *nameConstraintsChecker = NULL; |
| PKIX_CertChainChecker *basicConstraintsChecker = NULL; |
| PKIX_CertChainChecker *policyChecker = NULL; |
| PKIX_CertChainChecker *sigChecker = NULL; |
| PKIX_CertChainChecker *defaultCrlChecker = NULL; |
| PKIX_CertChainChecker *userChecker = NULL; |
| PKIX_PL_X500Name *trustedCAName = NULL; |
| PKIX_PL_PublicKey *trustedPubKey = NULL; |
| PKIX_List *checkers = NULL; |
| PKIX_PL_Date *testDate = NULL; |
| PKIX_CertSelector *certSelector = NULL; |
| PKIX_PL_Cert *trustedCert = NULL; |
| PKIX_PL_CertNameConstraints *trustedNC = NULL; |
| PKIX_List *initialPolicies = NULL; |
| PKIX_Boolean policyQualifiersRejected = PKIX_FALSE; |
| PKIX_Boolean initialPolicyMappingInhibit = PKIX_FALSE; |
| PKIX_Boolean initialAnyPolicyInhibit = PKIX_FALSE; |
| PKIX_Boolean initialExplicitPolicy = PKIX_FALSE; |
| PKIX_List *userCheckersList = NULL; |
| PKIX_List *certStores = NULL; |
| PKIX_UInt32 numCertCheckers = 0; |
| PKIX_UInt32 i; |
| |
| PKIX_ENTER(VALIDATE, "pkix_InitializeCheckers"); |
| PKIX_NULLCHECK_THREE(anchor, procParams, pCheckers); |
| PKIX_CHECK(PKIX_List_Create(&checkers, plContext), |
| PKIX_LISTCREATEFAILED); |
| |
| /* |
| * The TrustAnchor may have been created using CreateWithCert |
| * (in which case GetCAPublicKey and GetCAName will return NULL) |
| * or may have been created using CreateWithNameKeyPair (in which |
| * case GetTrustedCert will return NULL. So we call GetTrustedCert |
| * and populate trustedPubKey and trustedCAName accordingly. |
| */ |
| |
| PKIX_CHECK(PKIX_TrustAnchor_GetTrustedCert |
| (anchor, &trustedCert, plContext), |
| PKIX_TRUSTANCHORGETTRUSTEDCERTFAILED); |
| |
| if (trustedCert){ |
| PKIX_CHECK(PKIX_PL_Cert_GetSubjectPublicKey |
| (trustedCert, &trustedPubKey, plContext), |
| PKIX_CERTGETSUBJECTPUBLICKEYFAILED); |
| |
| PKIX_CHECK(PKIX_PL_Cert_GetSubject |
| (trustedCert, &trustedCAName, plContext), |
| PKIX_CERTGETSUBJECTFAILED); |
| } else { |
| PKIX_CHECK(PKIX_TrustAnchor_GetCAPublicKey |
| (anchor, &trustedPubKey, plContext), |
| PKIX_TRUSTANCHORGETCAPUBLICKEYFAILED); |
| |
| PKIX_CHECK(PKIX_TrustAnchor_GetCAName |
| (anchor, &trustedCAName, plContext), |
| PKIX_TRUSTANCHORGETCANAMEFAILED); |
| } |
| |
| PKIX_NULLCHECK_TWO(trustedPubKey, trustedCAName); |
| |
| PKIX_CHECK(PKIX_TrustAnchor_GetNameConstraints |
| (anchor, &trustedNC, plContext), |
| PKIX_TRUSTANCHORGETNAMECONSTRAINTSFAILED); |
| |
| PKIX_CHECK(PKIX_ProcessingParams_GetTargetCertConstraints |
| (procParams, &certSelector, plContext), |
| PKIX_PROCESSINGPARAMSGETTARGETCERTCONSTRAINTSFAILED); |
| |
| PKIX_CHECK(PKIX_ProcessingParams_GetDate |
| (procParams, &testDate, plContext), |
| PKIX_PROCESSINGPARAMSGETDATEFAILED); |
| |
| PKIX_CHECK(PKIX_ProcessingParams_GetInitialPolicies |
| (procParams, &initialPolicies, plContext), |
| PKIX_PROCESSINGPARAMSGETINITIALPOLICIESFAILED); |
| |
| PKIX_CHECK(PKIX_ProcessingParams_GetPolicyQualifiersRejected |
| (procParams, &policyQualifiersRejected, plContext), |
| PKIX_PROCESSINGPARAMSGETPOLICYQUALIFIERSREJECTEDFAILED); |
| |
| PKIX_CHECK(PKIX_ProcessingParams_IsPolicyMappingInhibited |
| (procParams, &initialPolicyMappingInhibit, plContext), |
| PKIX_PROCESSINGPARAMSISPOLICYMAPPINGINHIBITEDFAILED); |
| |
| PKIX_CHECK(PKIX_ProcessingParams_IsAnyPolicyInhibited |
| (procParams, &initialAnyPolicyInhibit, plContext), |
| PKIX_PROCESSINGPARAMSISANYPOLICYINHIBITEDFAILED); |
| |
| PKIX_CHECK(PKIX_ProcessingParams_IsExplicitPolicyRequired |
| (procParams, &initialExplicitPolicy, plContext), |
| PKIX_PROCESSINGPARAMSISEXPLICITPOLICYREQUIREDFAILED); |
| |
| PKIX_CHECK(PKIX_ProcessingParams_GetCertStores |
| (procParams, &certStores, plContext), |
| PKIX_PROCESSINGPARAMSGETCERTSTORESFAILED); |
| |
| PKIX_CHECK(PKIX_ProcessingParams_GetCertChainCheckers |
| (procParams, &userCheckersList, plContext), |
| PKIX_PROCESSINGPARAMSGETCERTCHAINCHECKERSFAILED); |
| |
| /* now, initialize all the checkers */ |
| PKIX_CHECK(pkix_TargetCertChecker_Initialize |
| (certSelector, numCerts, &targetCertChecker, plContext), |
| PKIX_TARGETCERTCHECKERINITIALIZEFAILED); |
| |
| PKIX_CHECK(pkix_ExpirationChecker_Initialize |
| (testDate, &expirationChecker, plContext), |
| PKIX_EXPIRATIONCHECKERINITIALIZEFAILED); |
| |
| PKIX_CHECK(pkix_NameChainingChecker_Initialize |
| (trustedCAName, &nameChainingChecker, plContext), |
| PKIX_NAMECHAININGCHECKERINITIALIZEFAILED); |
| |
| PKIX_CHECK(pkix_NameConstraintsChecker_Initialize |
| (trustedNC, numCerts, &nameConstraintsChecker, plContext), |
| PKIX_NAMECONSTRAINTSCHECKERINITIALIZEFAILED); |
| |
| PKIX_CHECK(pkix_BasicConstraintsChecker_Initialize |
| (numCerts, &basicConstraintsChecker, plContext), |
| PKIX_BASICCONSTRAINTSCHECKERINITIALIZEFAILED); |
| |
| PKIX_CHECK(pkix_PolicyChecker_Initialize |
| (initialPolicies, |
| policyQualifiersRejected, |
| initialPolicyMappingInhibit, |
| initialExplicitPolicy, |
| initialAnyPolicyInhibit, |
| numCerts, |
| &policyChecker, |
| plContext), |
| PKIX_POLICYCHECKERINITIALIZEFAILED); |
| |
| PKIX_CHECK(pkix_SignatureChecker_Initialize |
| (trustedPubKey, numCerts, &sigChecker, plContext), |
| PKIX_SIGNATURECHECKERINITIALIZEFAILED); |
| |
| if (userCheckersList != NULL) { |
| |
| PKIX_CHECK(PKIX_List_GetLength |
| (userCheckersList, &numCertCheckers, plContext), |
| PKIX_LISTGETLENGTHFAILED); |
| |
| for (i = 0; i < numCertCheckers; i++) { |
| |
| PKIX_CHECK(PKIX_List_GetItem |
| (userCheckersList, |
| i, |
| (PKIX_PL_Object **) &userChecker, |
| plContext), |
| PKIX_LISTGETITEMFAILED); |
| |
| PKIX_CHECK(PKIX_List_AppendItem |
| (checkers, |
| (PKIX_PL_Object *)userChecker, |
| plContext), |
| PKIX_LISTAPPENDITEMFAILED); |
| |
| PKIX_DECREF(userChecker); |
| } |
| } |
| |
| PKIX_CHECK(PKIX_List_AppendItem |
| (checkers, (PKIX_PL_Object *)targetCertChecker, plContext), |
| PKIX_LISTAPPENDITEMFAILED); |
| |
| PKIX_CHECK(PKIX_List_AppendItem |
| (checkers, (PKIX_PL_Object *)expirationChecker, plContext), |
| PKIX_LISTAPPENDITEMFAILED); |
| |
| PKIX_CHECK(PKIX_List_AppendItem |
| (checkers, (PKIX_PL_Object *)nameChainingChecker, plContext), |
| PKIX_LISTAPPENDITEMFAILED); |
| |
| PKIX_CHECK(PKIX_List_AppendItem |
| (checkers, (PKIX_PL_Object *)nameConstraintsChecker, plContext), |
| PKIX_LISTAPPENDITEMFAILED); |
| |
| PKIX_CHECK(PKIX_List_AppendItem |
| (checkers, (PKIX_PL_Object *)basicConstraintsChecker, plContext), |
| PKIX_LISTAPPENDITEMFAILED); |
| |
| PKIX_CHECK(PKIX_List_AppendItem |
| (checkers, (PKIX_PL_Object *)policyChecker, plContext), |
| PKIX_LISTAPPENDITEMFAILED); |
| |
| PKIX_CHECK(PKIX_List_AppendItem |
| (checkers, (PKIX_PL_Object *)sigChecker, plContext), |
| PKIX_LISTAPPENDITEMFAILED); |
| |
| *pCheckers = checkers; |
| |
| cleanup: |
| |
| if (PKIX_ERROR_RECEIVED){ |
| PKIX_DECREF(checkers); |
| } |
| |
| PKIX_DECREF(certSelector); |
| PKIX_DECREF(testDate); |
| PKIX_DECREF(initialPolicies); |
| PKIX_DECREF(targetCertChecker); |
| PKIX_DECREF(expirationChecker); |
| PKIX_DECREF(nameChainingChecker); |
| PKIX_DECREF(nameConstraintsChecker); |
| PKIX_DECREF(basicConstraintsChecker); |
| PKIX_DECREF(policyChecker); |
| PKIX_DECREF(sigChecker); |
| PKIX_DECREF(trustedCAName); |
| PKIX_DECREF(trustedPubKey); |
| PKIX_DECREF(trustedNC); |
| PKIX_DECREF(trustedCert); |
| PKIX_DECREF(defaultCrlChecker); |
| PKIX_DECREF(userCheckersList); |
| PKIX_DECREF(certStores); |
| PKIX_DECREF(userChecker); |
| |
| PKIX_RETURN(VALIDATE); |
| } |
| |
| /* |
| * FUNCTION: pkix_RetrieveOutputs |
| * DESCRIPTION: |
| * |
| * This function queries the respective states of the List of checkers in |
| * "checkers" to to obtain the final public key from the SignatureChecker |
| * and the policy tree from the PolicyChecker, storing those values at |
| * "pFinalSubjPubKey" and "pPolicyTree", respectively. |
| * |
| * PARAMETERS: |
| * "checkers" |
| * Address of List of checkers to be queried. Must be non-NULL. |
| * "pFinalSubjPubKey" |
| * Address where final public key will be stored. Must be non-NULL. |
| * "pPolicyTree" |
| * Address where policy tree will be stored. Must be non-NULL. |
| * "plContext" |
| * Platform-specific context pointer. |
| * THREAD SAFETY: |
| * Thread Safe (see Thread Safety Definitions in Programmer's Guide) |
| * RETURNS: |
| * Returns NULL if the function succeeds. |
| * Returns a Validate Error if the function fails in a non-fatal way. |
| * Returns a Fatal Error if the function fails in an unrecoverable way. |
| */ |
| static PKIX_Error * |
| pkix_RetrieveOutputs( |
| PKIX_List *checkers, |
| PKIX_PL_PublicKey **pFinalSubjPubKey, |
| PKIX_PolicyNode **pPolicyTree, |
| void *plContext) |
| { |
| PKIX_PL_PublicKey *finalSubjPubKey = NULL; |
| PKIX_PolicyNode *validPolicyTree = NULL; |
| PKIX_CertChainChecker *checker = NULL; |
| PKIX_PL_Object *state = NULL; |
| PKIX_UInt32 numCheckers = 0; |
| PKIX_UInt32 type; |
| PKIX_Int32 j; |
| |
| PKIX_ENTER(VALIDATE, "pkix_RetrieveOutputs"); |
| |
| PKIX_NULLCHECK_TWO(checkers, pPolicyTree); |
| |
| /* |
| * To optimize the search, we guess that the sigChecker is |
| * last in the tree and is preceded by the policyChecker. We |
| * search toward the front of the chain. Remember that List |
| * items are indexed 0..(numItems - 1). |
| */ |
| |
| PKIX_CHECK(PKIX_List_GetLength(checkers, &numCheckers, plContext), |
| PKIX_LISTGETLENGTHFAILED); |
| |
| for (j = numCheckers - 1; j >= 0; j--){ |
| PKIX_CHECK(PKIX_List_GetItem |
| (checkers, j, (PKIX_PL_Object **)&checker, plContext), |
| PKIX_LISTGETITEMFAILED); |
| |
| PKIX_CHECK(PKIX_CertChainChecker_GetCertChainCheckerState |
| (checker, &state, plContext), |
| PKIX_CERTCHAINCHECKERGETCERTCHAINCHECKERSTATEFAILED); |
| |
| /* user defined checker may have no state */ |
| if (state != NULL) { |
| |
| PKIX_CHECK(PKIX_PL_Object_GetType(state, &type, plContext), |
| PKIX_OBJECTGETTYPEFAILED); |
| |
| if (type == PKIX_SIGNATURECHECKERSTATE_TYPE){ |
| /* final pubKey will include any inherited DSA params */ |
| finalSubjPubKey = |
| ((pkix_SignatureCheckerState *)state)-> |
| prevPublicKey; |
| PKIX_INCREF(finalSubjPubKey); |
| *pFinalSubjPubKey = finalSubjPubKey; |
| } |
| |
| if (type == PKIX_CERTPOLICYCHECKERSTATE_TYPE) { |
| validPolicyTree = |
| ((PKIX_PolicyCheckerState *)state)->validPolicyTree; |
| break; |
| } |
| } |
| |
| PKIX_DECREF(checker); |
| PKIX_DECREF(state); |
| } |
| |
| PKIX_INCREF(validPolicyTree); |
| *pPolicyTree = validPolicyTree; |
| |
| cleanup: |
| |
| PKIX_DECREF(checker); |
| PKIX_DECREF(state); |
| |
| PKIX_RETURN(VALIDATE); |
| |
| } |
| |
| /* |
| * FUNCTION: pkix_CheckChain |
| * DESCRIPTION: |
| * |
| * Checks whether the List of Certs pointed to by "certs", containing |
| * "numCerts" entries, successfully validates using each CertChainChecker in |
| * the List pointed to by "checkers" and has not been revoked, according to any |
| * of the Revocation Checkers in the List pointed to by "revChecker". Checkers |
| * are expected to remove from "removeCheckedExtOIDs" and extensions that they |
| * process. Indices to the certChain and the checkerChain are obtained and |
| * returned in "pCertCheckedIndex" and "pCheckerIndex", respectively. These |
| * should be set to zero prior to the initial call, but may be changed (and |
| * must be supplied on subsequent calls) if processing is suspended for non- |
| * blocking I/O. Each time a Cert passes from being validated by one of the |
| * CertChainCheckers to being checked by a Revocation Checker, the Boolean |
| * stored at "pRevChecking" is changed from FALSE to TRUE. If the Cert is |
| * rejected by a Revocation Checker, its reason code is returned at |
| * "pReasonCode. If the List of Certs successfully validates, the public key i |
| * the final certificate is obtained and stored at "pFinalSubjPubKey" and the |
| * validPolicyTree, which could be NULL, is stored at pPolicyTree. If the List |
| * of Certs fails to validate, an Error pointer is returned. |
| * |
| * If "pVerifyTree" is non-NULL, a chain of VerifyNodes is created which |
| * tracks the results of the validation. That is, either each node in the |
| * chain has a NULL Error component, or the last node contains an Error |
| * which indicates why the validation failed. |
| * |
| * The number of Certs in the List, represented by "numCerts", is used to |
| * determine which Cert is the final Cert. |
| * |
| * PARAMETERS: |
| * "certs" |
| * Address of List of Certs to validate. Must be non-NULL. |
| * "numCerts" |
| * Number of certificates in the List of certificates. |
| * "checkers" |
| * List of CertChainCheckers which must each validate the List of |
| * certificates. Must be non-NULL. |
| * "revChecker" |
| * List of RevocationCheckers which must each not reject the List of |
| * certificates. May be empty, but must be non-NULL. |
| * "removeCheckedExtOIDs" |
| * List of PKIX_PL_OID that has been processed. If called from building |
| * chain, it is the list of critical extension OIDs that has been |
| * processed prior to validation. Extension OIDs that may be processed by |
| * user defined checker processes are also in the list. May be NULL. |
| * "procParams" |
| * Address of ProcessingParams used to initialize various checkers. Must |
| * be non-NULL. |
| * "pCertCheckedIndex" |
| * Address where Int32 index to the Cert chain is obtained and |
| * returned. Must be non-NULL. |
| * "pCheckerIndex" |
| * Address where Int32 index to the CheckerChain is obtained and |
| * returned. Must be non-NULL. |
| * "pRevChecking" |
| * Address where Boolean is obtained and returned, indicating, if FALSE, |
| * that CertChainCheckers are being called; or, if TRUE, that RevChecker |
| * are being called. Must be non-NULL. |
| * "pReasonCode" |
| * Address where UInt32 results of revocation checking are stored. Must be |
| * non-NULL. |
| * "pNBIOContext" |
| * Address where platform-dependent context is stored if checking is |
| * suspended for non-blocking I/O. Must be non-NULL. |
| * "pFinalSubjPubKey" |
| * Address where the final public key will be stored. Must be non-NULL. |
| * "pPolicyTree" |
| * Address where the final validPolicyTree is stored. Must be non-NULL. |
| * "pVerifyTree" |
| * Address where a VerifyTree is stored, if non-NULL. |
| * "plContext" |
| * Platform-specific context pointer. |
| * THREAD SAFETY: |
| * Thread Safe (see Thread Safety Definitions in Programmer's Guide) |
| * RETURNS: |
| * Returns NULL if the function succeeds. |
| * Returns a Validate Error if the function fails in a non-fatal way. |
| * Returns a Fatal Error if the function fails in an unrecoverable way. |
| */ |
| PKIX_Error * |
| pkix_CheckChain( |
| PKIX_List *certs, |
| PKIX_UInt32 numCerts, |
| PKIX_TrustAnchor *anchor, |
| PKIX_List *checkers, |
| PKIX_RevocationChecker *revChecker, |
| PKIX_List *removeCheckedExtOIDs, |
| PKIX_ProcessingParams *procParams, |
| PKIX_UInt32 *pCertCheckedIndex, |
| PKIX_UInt32 *pCheckerIndex, |
| PKIX_Boolean *pRevChecking, |
| PKIX_UInt32 *pReasonCode, |
| void **pNBIOContext, |
| PKIX_PL_PublicKey **pFinalSubjPubKey, |
| PKIX_PolicyNode **pPolicyTree, |
| PKIX_VerifyNode **pVerifyTree, |
| void *plContext) |
| { |
| PKIX_UInt32 j = 0; |
| PKIX_Boolean revChecking = PKIX_FALSE; |
| PKIX_Error *checkCertError = NULL; |
| void *nbioContext = NULL; |
| PKIX_PL_Cert *cert = NULL; |
| PKIX_PL_Cert *issuer = NULL; |
| PKIX_PL_NssContext *nssContext = NULL; |
| CERTCertList *certList = NULL; |
| const CERTChainVerifyCallback *chainVerifyCallback = NULL; |
| CERTCertificate *nssCert = NULL; |
| |
| PKIX_ENTER(VALIDATE, "pkix_CheckChain"); |
| PKIX_NULLCHECK_FOUR(certs, checkers, revChecker, pCertCheckedIndex); |
| PKIX_NULLCHECK_FOUR(pCheckerIndex, pRevChecking, pReasonCode, anchor); |
| PKIX_NULLCHECK_THREE(pNBIOContext, pFinalSubjPubKey, pPolicyTree); |
| |
| nbioContext = *pNBIOContext; |
| *pNBIOContext = NULL; |
| revChecking = *pRevChecking; |
| nssContext = (PKIX_PL_NssContext *)plContext; |
| chainVerifyCallback = &nssContext->chainVerifyCallback; |
| |
| if (chainVerifyCallback->isChainValid != NULL) { |
| PRBool chainOK = PR_FALSE; /*assume failure*/ |
| SECStatus rv; |
| |
| certList = CERT_NewCertList(); |
| if (certList == NULL) { |
| PKIX_ERROR_ALLOC_ERROR(); |
| } |
| |
| /* Add the trust anchor to the list */ |
| PKIX_CHECK(PKIX_TrustAnchor_GetTrustedCert |
| (anchor, &cert, plContext), |
| PKIX_TRUSTANCHORGETTRUSTEDCERTFAILED); |
| |
| PKIX_CHECK( |
| PKIX_PL_Cert_GetCERTCertificate(cert, &nssCert, plContext), |
| PKIX_CERTGETCERTCERTIFICATEFAILED); |
| |
| rv = CERT_AddCertToListHead(certList, nssCert); |
| if (rv != SECSuccess) { |
| PKIX_ERROR_ALLOC_ERROR(); |
| } |
| /* the certList takes ownership of nssCert on success */ |
| nssCert = NULL; |
| PKIX_DECREF(cert); |
| |
| /* Add the rest of the chain to the list */ |
| for (j = *pCertCheckedIndex; j < numCerts; j++) { |
| PKIX_CHECK(PKIX_List_GetItem( |
| certs, j, (PKIX_PL_Object **)&cert, plContext), |
| PKIX_LISTGETITEMFAILED); |
| |
| PKIX_CHECK( |
| PKIX_PL_Cert_GetCERTCertificate(cert, &nssCert, plContext), |
| PKIX_CERTGETCERTCERTIFICATEFAILED); |
| |
| rv = CERT_AddCertToListHead(certList, nssCert); |
| if (rv != SECSuccess) { |
| PKIX_ERROR_ALLOC_ERROR(); |
| } |
| /* the certList takes ownership of nssCert on success */ |
| nssCert = NULL; |
| PKIX_DECREF(cert); |
| } |
| |
| rv = (*chainVerifyCallback->isChainValid) |
| (chainVerifyCallback->isChainValidArg, certList, &chainOK); |
| if (rv != SECSuccess) { |
| PKIX_ERROR_FATAL(PKIX_CHAINVERIFYCALLBACKFAILED); |
| } |
| |
| if (!chainOK) { |
| PKIX_ERROR(PKIX_CHAINVERIFYCALLBACKFAILED); |
| } |
| |
| } |
| |
| PKIX_CHECK(PKIX_TrustAnchor_GetTrustedCert |
| (anchor, &cert, plContext), |
| PKIX_TRUSTANCHORGETTRUSTEDCERTFAILED); |
| |
| for (j = *pCertCheckedIndex; j < numCerts; j++) { |
| |
| PORT_Assert(cert); |
| PKIX_DECREF(issuer); |
| issuer = cert; |
| cert = NULL; |
| |
| PKIX_CHECK(PKIX_List_GetItem( |
| certs, j, (PKIX_PL_Object **)&cert, plContext), |
| PKIX_LISTGETITEMFAILED); |
| |
| /* check if cert pointer is valid */ |
| PORT_Assert(cert); |
| if (cert == NULL) { |
| continue; |
| } |
| |
| if (revChecking == PKIX_FALSE) { |
| |
| PKIX_CHECK(pkix_CheckCert |
| (cert, |
| checkers, |
| removeCheckedExtOIDs, |
| pCheckerIndex, |
| &nbioContext, |
| plContext), |
| PKIX_CHECKCERTFAILED); |
| |
| if (nbioContext != NULL) { |
| *pCertCheckedIndex = j; |
| *pRevChecking = revChecking; |
| *pNBIOContext = nbioContext; |
| goto cleanup; |
| } |
| |
| revChecking = PKIX_TRUE; |
| *pCheckerIndex = 0; |
| } |
| |
| if (revChecking == PKIX_TRUE) { |
| PKIX_RevocationStatus revStatus; |
| pkixErrorResult = |
| PKIX_RevocationChecker_Check( |
| cert, issuer, revChecker, |
| procParams, PKIX_TRUE, |
| (j == numCerts - 1) ? PKIX_TRUE : PKIX_FALSE, |
| &revStatus, pReasonCode, |
| &nbioContext, plContext); |
| if (nbioContext != NULL) { |
| *pCertCheckedIndex = j; |
| *pRevChecking = revChecking; |
| *pNBIOContext = nbioContext; |
| goto cleanup; |
| } |
| if (revStatus == PKIX_RevStatus_Revoked || |
| pkixErrorResult) { |
| if (!pkixErrorResult) { |
| /* if pkixErrorResult is returned then |
| * use it as it has a detailed revocation |
| * error code. Otherwise create a new error */ |
| PKIX_ERROR_CREATE(VALIDATE, |
| PKIX_CERTIFICATEREVOKED, |
| pkixErrorResult); |
| } |
| goto cleanup; |
| } |
| revChecking = PKIX_FALSE; |
| *pCheckerIndex = 0; |
| } |
| |
| PKIX_CHECK(pkix_AddToVerifyLog |
| (cert, j, NULL, pVerifyTree, plContext), |
| PKIX_ADDTOVERIFYLOGFAILED); |
| } |
| |
| PKIX_CHECK(pkix_RetrieveOutputs |
| (checkers, pFinalSubjPubKey, pPolicyTree, plContext), |
| PKIX_RETRIEVEOUTPUTSFAILED); |
| |
| *pNBIOContext = NULL; |
| |
| cleanup: |
| if (PKIX_ERROR_RECEIVED && cert) { |
| checkCertError = pkixErrorResult; |
| |
| PKIX_CHECK_FATAL( |
| pkix_AddToVerifyLog(cert, j, checkCertError, pVerifyTree, |
| plContext), |
| PKIX_ADDTOVERIFYLOGFAILED); |
| pkixErrorResult = checkCertError; |
| pkixErrorCode = pkixErrorResult->errCode; |
| checkCertError = NULL; |
| } |
| |
| fatal: |
| if (nssCert) { |
| CERT_DestroyCertificate(nssCert); |
| } |
| |
| if (certList) { |
| CERT_DestroyCertList(certList); |
| } |
| |
| PKIX_DECREF(checkCertError); |
| PKIX_DECREF(cert); |
| PKIX_DECREF(issuer); |
| |
| PKIX_RETURN(VALIDATE); |
| } |
| |
| /* |
| * FUNCTION: pkix_ExtractParameters |
| * DESCRIPTION: |
| * |
| * Extracts several parameters from the ValidateParams object pointed to by |
| * "valParams" and stores the CertChain at "pChain", the List of Certs at |
| * "pCerts", the number of Certs in the chain at "pNumCerts", the |
| * ProcessingParams object at "pProcParams", the List of TrustAnchors at |
| * "pAnchors", and the number of TrustAnchors at "pNumAnchors". |
| * |
| * PARAMETERS: |
| * "valParams" |
| * Address of ValidateParams from which the parameters are extracted. |
| * Must be non-NULL. |
| * "pCerts" |
| * Address where object pointer for List of Certs will be stored. |
| * Must be non-NULL. |
| * "pNumCerts" |
| * Address where number of Certs will be stored. Must be non-NULL. |
| * "pProcParams" |
| * Address where object pointer for ProcessingParams will be stored. |
| * Must be non-NULL. |
| * "pAnchors" |
| * Address where object pointer for List of Anchors will be stored. |
| * Must be non-NULL. |
| * "pNumAnchors" |
| * Address where number of Anchors will be stored. Must be non-NULL. |
| * "plContext" |
| * Platform-specific context pointer. |
| * THREAD SAFETY: |
| * Thread Safe (see Thread Safety Definitions in Programmer's Guide) |
| * RETURNS: |
| * Returns NULL if the function succeeds. |
| * Returns a Validate Error if the function fails in a non-fatal way. |
| * Returns a Fatal Error if the function fails in an unrecoverable way. |
| */ |
| static PKIX_Error * |
| pkix_ExtractParameters( |
| PKIX_ValidateParams *valParams, |
| PKIX_List **pCerts, |
| PKIX_UInt32 *pNumCerts, |
| PKIX_ProcessingParams **pProcParams, |
| PKIX_List **pAnchors, |
| PKIX_UInt32 *pNumAnchors, |
| void *plContext) |
| { |
| PKIX_ENTER(VALIDATE, "pkix_ExtractParameters"); |
| PKIX_NULLCHECK_THREE(valParams, pCerts, pNumCerts); |
| PKIX_NULLCHECK_THREE(pProcParams, pAnchors, pNumAnchors); |
| |
| /* extract relevant parameters from chain */ |
| PKIX_CHECK(PKIX_ValidateParams_GetCertChain |
| (valParams, pCerts, plContext), |
| PKIX_VALIDATEPARAMSGETCERTCHAINFAILED); |
| |
| PKIX_CHECK(PKIX_List_GetLength(*pCerts, pNumCerts, plContext), |
| PKIX_LISTGETLENGTHFAILED); |
| |
| /* extract relevant parameters from procParams */ |
| PKIX_CHECK(PKIX_ValidateParams_GetProcessingParams |
| (valParams, pProcParams, plContext), |
| PKIX_VALIDATEPARAMSGETPROCESSINGPARAMSFAILED); |
| |
| PKIX_CHECK(PKIX_ProcessingParams_GetTrustAnchors |
| (*pProcParams, pAnchors, plContext), |
| PKIX_PROCESSINGPARAMSGETTRUSTANCHORSFAILED); |
| |
| PKIX_CHECK(PKIX_List_GetLength(*pAnchors, pNumAnchors, plContext), |
| PKIX_LISTGETLENGTHFAILED); |
| |
| cleanup: |
| |
| PKIX_RETURN(VALIDATE); |
| } |
| |
| /* --Public-Functions--------------------------------------------- */ |
| |
| /* |
| * FUNCTION: PKIX_ValidateChain (see comments in pkix.h) |
| */ |
| PKIX_Error * |
| PKIX_ValidateChain( |
| PKIX_ValidateParams *valParams, |
| PKIX_ValidateResult **pResult, |
| PKIX_VerifyNode **pVerifyTree, |
| void *plContext) |
| { |
| PKIX_Error *chainFailed = NULL; |
| |
| PKIX_ProcessingParams *procParams = NULL; |
| PKIX_CertChainChecker *userChecker = NULL; |
| PKIX_RevocationChecker *revChecker = NULL; |
| PKIX_List *certs = NULL; |
| PKIX_List *checkers = NULL; |
| PKIX_List *anchors = NULL; |
| PKIX_List *userCheckers = NULL; |
| PKIX_List *userCheckerExtOIDs = NULL; |
| PKIX_List *validateCheckedCritExtOIDsList = NULL; |
| PKIX_TrustAnchor *anchor = NULL; |
| PKIX_ValidateResult *valResult = NULL; |
| PKIX_PL_PublicKey *finalPubKey = NULL; |
| PKIX_PolicyNode *validPolicyTree = NULL; |
| PKIX_Boolean supportForwarding = PKIX_FALSE; |
| PKIX_Boolean revChecking = PKIX_FALSE; |
| PKIX_UInt32 i, numCerts, numAnchors; |
| PKIX_UInt32 numUserCheckers = 0; |
| PKIX_UInt32 certCheckedIndex = 0; |
| PKIX_UInt32 checkerIndex = 0; |
| PKIX_UInt32 reasonCode = 0; |
| void *nbioContext = NULL; |
| |
| PKIX_ENTER(VALIDATE, "PKIX_ValidateChain"); |
| PKIX_NULLCHECK_TWO(valParams, pResult); |
| |
| /* extract various parameters from valParams */ |
| PKIX_CHECK(pkix_ExtractParameters |
| (valParams, |
| &certs, |
| &numCerts, |
| &procParams, |
| &anchors, |
| &numAnchors, |
| plContext), |
| PKIX_EXTRACTPARAMETERSFAILED); |
| |
| /* |
| * setup an extension OID list that user had defined for his checker |
| * processing. User checker is not responsible for taking out OIDs |
| * from unresolved critical extension list as the libpkix checker |
| * is doing. Here we add those user checkers' OIDs to the removal |
| * list to be taken out by CheckChain |
| */ |
| PKIX_CHECK(PKIX_ProcessingParams_GetCertChainCheckers |
| (procParams, &userCheckers, plContext), |
| PKIX_PROCESSINGPARAMSGETCERTCHAINCHECKERSFAILED); |
| |
| if (userCheckers != NULL) { |
| |
| PKIX_CHECK(PKIX_List_Create |
| (&validateCheckedCritExtOIDsList, |
| plContext), |
| PKIX_LISTCREATEFAILED); |
| |
| PKIX_CHECK(PKIX_List_GetLength |
| (userCheckers, &numUserCheckers, plContext), |
| PKIX_LISTGETLENGTHFAILED); |
| |
| for (i = 0; i < numUserCheckers; i++) { |
| |
| PKIX_CHECK(PKIX_List_GetItem |
| (userCheckers, |
| i, |
| (PKIX_PL_Object **) &userChecker, |
| plContext), |
| PKIX_LISTGETITEMFAILED); |
| |
| PKIX_CHECK |
| (PKIX_CertChainChecker_IsForwardCheckingSupported |
| (userChecker, &supportForwarding, plContext), |
| PKIX_CERTCHAINCHECKERISFORWARDCHECKINGSUPPORTEDFAILED); |
| |
| if (supportForwarding == PKIX_FALSE) { |
| |
| PKIX_CHECK |
| (PKIX_CertChainChecker_GetSupportedExtensions |
| (userChecker, &userCheckerExtOIDs, plContext), |
| PKIX_CERTCHAINCHECKERGETSUPPORTEDEXTENSIONSFAILED); |
| |
| if (userCheckerExtOIDs != NULL) { |
| PKIX_CHECK(pkix_List_AppendList |
| (validateCheckedCritExtOIDsList, |
| userCheckerExtOIDs, |
| plContext), |
| PKIX_LISTAPPENDLISTFAILED); |
| } |
| } |
| |
| PKIX_DECREF(userCheckerExtOIDs); |
| PKIX_DECREF(userChecker); |
| } |
| } |
| |
| PKIX_CHECK(PKIX_ProcessingParams_GetRevocationChecker |
| (procParams, &revChecker, plContext), |
| PKIX_PROCESSINGPARAMSGETREVOCATIONCHECKERFAILED); |
| |
| /* try to validate the chain with each anchor */ |
| for (i = 0; i < numAnchors; i++){ |
| |
| /* get trust anchor */ |
| PKIX_CHECK(PKIX_List_GetItem |
| (anchors, i, (PKIX_PL_Object **)&anchor, plContext), |
| PKIX_LISTGETITEMFAILED); |
| |
| /* initialize checkers using information from trust anchor */ |
| PKIX_CHECK(pkix_InitializeCheckers |
| (anchor, procParams, numCerts, &checkers, plContext), |
| PKIX_INITIALIZECHECKERSFAILED); |
| |
| /* |
| * Validate the chain using this trust anchor and these |
| * checkers. (WARNING: checkers that use non-blocking I/O |
| * are not currently supported.) |
| */ |
| certCheckedIndex = 0; |
| checkerIndex = 0; |
| revChecking = PKIX_FALSE; |
| chainFailed = pkix_CheckChain |
| (certs, |
| numCerts, |
| anchor, |
| checkers, |
| revChecker, |
| validateCheckedCritExtOIDsList, |
| procParams, |
| &certCheckedIndex, |
| &checkerIndex, |
| &revChecking, |
| &reasonCode, |
| &nbioContext, |
| &finalPubKey, |
| &validPolicyTree, |
| pVerifyTree, |
| plContext); |
| |
| if (chainFailed) { |
| |
| /* cert chain failed to validate */ |
| |
| PKIX_DECREF(chainFailed); |
| PKIX_DECREF(anchor); |
| PKIX_DECREF(checkers); |
| PKIX_DECREF(validPolicyTree); |
| |
| /* if last anchor, we fail; else, we try next anchor */ |
| if (i == (numAnchors - 1)) { /* last anchor */ |
| PKIX_ERROR(PKIX_VALIDATECHAINFAILED); |
| } |
| |
| } else { |
| |
| /* XXX Remove this assertion after 2014-12-31. |
| * See bug 946984. */ |
| PORT_Assert(reasonCode == 0); |
| |
| /* cert chain successfully validated! */ |
| PKIX_CHECK(pkix_ValidateResult_Create |
| (finalPubKey, |
| anchor, |
| validPolicyTree, |
| &valResult, |
| plContext), |
| PKIX_VALIDATERESULTCREATEFAILED); |
| |
| *pResult = valResult; |
| |
| /* no need to try any more anchors in the loop */ |
| goto cleanup; |
| } |
| } |
| |
| cleanup: |
| |
| PKIX_DECREF(finalPubKey); |
| PKIX_DECREF(certs); |
| PKIX_DECREF(anchors); |
| PKIX_DECREF(anchor); |
| PKIX_DECREF(checkers); |
| PKIX_DECREF(revChecker); |
| PKIX_DECREF(validPolicyTree); |
| PKIX_DECREF(chainFailed); |
| PKIX_DECREF(procParams); |
| PKIX_DECREF(userCheckers); |
| PKIX_DECREF(validateCheckedCritExtOIDsList); |
| |
| PKIX_RETURN(VALIDATE); |
| } |
| |
| /* |
| * FUNCTION: pkix_Validate_BuildUserOIDs |
| * DESCRIPTION: |
| * |
| * This function creates a List of the OIDs that are processed by the user |
| * checkers in the List pointed to by "userCheckers", storing the resulting |
| * List at "pUserCritOIDs". If the List of userCheckers is NULL, the output |
| * List will be NULL. Otherwise the output List will be non-NULL, but may be |
| * empty. |
| * |
| * PARAMETERS: |
| * "userCheckers" |
| * The address of the List of userCheckers. |
| * "pUserCritOIDs" |
| * The address at which the List is stored. Must be non-NULL. |
| * "plContext" |
| * Platform-specific context pointer. |
| * THREAD SAFETY: |
| * Thread Safe (see Thread Safety Definitions in Programmer's Guide) |
| * RETURNS: |
| * Returns NULL if the function succeeds. |
| * Returns a VALIDATE Error if the function fails in a non-fatal way. |
| * Returns a Fatal Error if the function fails in an unrecoverable way. |
| */ |
| static PKIX_Error * |
| pkix_Validate_BuildUserOIDs( |
| PKIX_List *userCheckers, |
| PKIX_List **pUserCritOIDs, |
| void *plContext) |
| { |
| PKIX_UInt32 numUserCheckers = 0; |
| PKIX_UInt32 i = 0; |
| PKIX_List *userCritOIDs = NULL; |
| PKIX_List *userCheckerExtOIDs = NULL; |
| PKIX_Boolean supportForwarding = PKIX_FALSE; |
| PKIX_CertChainChecker *userChecker = NULL; |
| |
| PKIX_ENTER(VALIDATE, "pkix_Validate_BuildUserOIDs"); |
| PKIX_NULLCHECK_ONE(pUserCritOIDs); |
| |
| if (userCheckers != NULL) { |
| PKIX_CHECK(PKIX_List_Create(&userCritOIDs, plContext), |
| PKIX_LISTCREATEFAILED); |
| |
| PKIX_CHECK(PKIX_List_GetLength |
| (userCheckers, &numUserCheckers, plContext), |
| PKIX_LISTGETLENGTHFAILED); |
| |
| for (i = 0; i < numUserCheckers; i++) { |
| PKIX_CHECK(PKIX_List_GetItem |
| (userCheckers, |
| i, |
| (PKIX_PL_Object **) &userChecker, |
| plContext), |
| PKIX_LISTGETITEMFAILED); |
| |
| PKIX_CHECK(PKIX_CertChainChecker_IsForwardCheckingSupported |
| (userChecker, &supportForwarding, plContext), |
| PKIX_CERTCHAINCHECKERISFORWARDCHECKINGSUPPORTEDFAILED); |
| |
| if (supportForwarding == PKIX_FALSE) { |
| |
| PKIX_CHECK(PKIX_CertChainChecker_GetSupportedExtensions |
| (userChecker, &userCheckerExtOIDs, plContext), |
| PKIX_CERTCHAINCHECKERGETSUPPORTEDEXTENSIONSFAILED); |
| |
| if (userCheckerExtOIDs != NULL) { |
| PKIX_CHECK(pkix_List_AppendList |
| (userCritOIDs, userCheckerExtOIDs, plContext), |
| PKIX_LISTAPPENDLISTFAILED); |
| } |
| } |
| |
| PKIX_DECREF(userCheckerExtOIDs); |
| PKIX_DECREF(userChecker); |
| } |
| } |
| |
| *pUserCritOIDs = userCritOIDs; |
| |
| cleanup: |
| |
| if (PKIX_ERROR_RECEIVED){ |
| PKIX_DECREF(userCritOIDs); |
| } |
| |
| PKIX_DECREF(userCheckerExtOIDs); |
| PKIX_DECREF(userChecker); |
| |
| PKIX_RETURN(VALIDATE); |
| } |
| |
| /* |
| * FUNCTION: PKIX_ValidateChain_nb (see comments in pkix.h) |
| */ |
| PKIX_Error * |
| PKIX_ValidateChain_NB( |
| PKIX_ValidateParams *valParams, |
| PKIX_UInt32 *pCertIndex, |
| PKIX_UInt32 *pAnchorIndex, |
| PKIX_UInt32 *pCheckerIndex, |
| PKIX_Boolean *pRevChecking, |
| PKIX_List **pCheckers, |
| void **pNBIOContext, |
| PKIX_ValidateResult **pResult, |
| PKIX_VerifyNode **pVerifyTree, |
| void *plContext) |
| { |
| PKIX_UInt32 numCerts = 0; |
| PKIX_UInt32 numAnchors = 0; |
| PKIX_UInt32 i = 0; |
| PKIX_UInt32 certIndex = 0; |
| PKIX_UInt32 anchorIndex = 0; |
| PKIX_UInt32 checkerIndex = 0; |
| PKIX_UInt32 reasonCode = 0; |
| PKIX_Boolean revChecking = PKIX_FALSE; |
| PKIX_List *certs = NULL; |
| PKIX_List *anchors = NULL; |
| PKIX_List *checkers = NULL; |
| PKIX_List *userCheckers = NULL; |
| PKIX_List *validateCheckedCritExtOIDsList = NULL; |
| PKIX_TrustAnchor *anchor = NULL; |
| PKIX_ValidateResult *valResult = NULL; |
| PKIX_PL_PublicKey *finalPubKey = NULL; |
| PKIX_PolicyNode *validPolicyTree = NULL; |
| PKIX_ProcessingParams *procParams = NULL; |
| PKIX_RevocationChecker *revChecker = NULL; |
| PKIX_Error *chainFailed = NULL; |
| void *nbioContext = NULL; |
| |
| PKIX_ENTER(VALIDATE, "PKIX_ValidateChain_NB"); |
| PKIX_NULLCHECK_FOUR |
| (valParams, pCertIndex, pAnchorIndex, pCheckerIndex); |
| PKIX_NULLCHECK_FOUR(pRevChecking, pCheckers, pNBIOContext, pResult); |
| |
| nbioContext = *pNBIOContext; |
| *pNBIOContext = NULL; |
| |
| /* extract various parameters from valParams */ |
| PKIX_CHECK(pkix_ExtractParameters |
| (valParams, |
| &certs, |
| &numCerts, |
| &procParams, |
| &anchors, |
| &numAnchors, |
| plContext), |
| PKIX_EXTRACTPARAMETERSFAILED); |
| |
| /* |
| * Create a List of the OIDs that will be processed by the user |
| * checkers. User checkers are not responsible for removing OIDs from |
| * the List of unresolved critical extensions, as libpkix checkers are. |
| * So we add those user checkers' OIDs to the removal list to be taken |
| * out by CheckChain. |
| */ |
| PKIX_CHECK(PKIX_ProcessingParams_GetCertChainCheckers |
| (procParams, &userCheckers, plContext), |
| PKIX_PROCESSINGPARAMSGETCERTCHAINCHECKERSFAILED); |
| |
| PKIX_CHECK(pkix_Validate_BuildUserOIDs |
| (userCheckers, &validateCheckedCritExtOIDsList, plContext), |
| PKIX_VALIDATEBUILDUSEROIDSFAILED); |
| |
| PKIX_CHECK(PKIX_ProcessingParams_GetRevocationChecker |
| (procParams, &revChecker, plContext), |
| PKIX_PROCESSINGPARAMSGETREVOCATIONCHECKERFAILED); |
| |
| /* Are we resuming after a WOULDBLOCK return, or starting anew ? */ |
| if (nbioContext != NULL) { |
| /* Resuming */ |
| certIndex = *pCertIndex; |
| anchorIndex = *pAnchorIndex; |
| checkerIndex = *pCheckerIndex; |
| revChecking = *pRevChecking; |
| checkers = *pCheckers; |
| *pCheckers = NULL; |
| } |
| |
| /* try to validate the chain with each anchor */ |
| for (i = anchorIndex; i < numAnchors; i++) { |
| |
| /* get trust anchor */ |
| PKIX_CHECK(PKIX_List_GetItem |
| (anchors, i, (PKIX_PL_Object **)&anchor, plContext), |
| PKIX_LISTGETITEMFAILED); |
| |
| /* initialize checkers using information from trust anchor */ |
| if (nbioContext == NULL) { |
| PKIX_CHECK(pkix_InitializeCheckers |
| (anchor, |
| procParams, |
| numCerts, |
| &checkers, |
| plContext), |
| PKIX_INITIALIZECHECKERSFAILED); |
| } |
| |
| /* |
| * Validate the chain using this trust anchor and these |
| * checkers. |
| */ |
| chainFailed = pkix_CheckChain |
| (certs, |
| numCerts, |
| anchor, |
| checkers, |
| revChecker, |
| validateCheckedCritExtOIDsList, |
| procParams, |
| &certIndex, |
| &checkerIndex, |
| &revChecking, |
| &reasonCode, |
| &nbioContext, |
| &finalPubKey, |
| &validPolicyTree, |
| pVerifyTree, |
| plContext); |
| |
| if (nbioContext != NULL) { |
| *pCertIndex = certIndex; |
| *pAnchorIndex = anchorIndex; |
| *pCheckerIndex = checkerIndex; |
| *pRevChecking = revChecking; |
| PKIX_INCREF(checkers); |
| *pCheckers = checkers; |
| *pNBIOContext = nbioContext; |
| goto cleanup; |
| } |
| |
| if (chainFailed) { |
| |
| /* cert chain failed to validate */ |
| |
| PKIX_DECREF(chainFailed); |
| PKIX_DECREF(anchor); |
| PKIX_DECREF(checkers); |
| PKIX_DECREF(validPolicyTree); |
| |
| /* if last anchor, we fail; else, we try next anchor */ |
| if (i == (numAnchors - 1)) { /* last anchor */ |
| PKIX_ERROR(PKIX_VALIDATECHAINFAILED); |
| } |
| |
| } else { |
| |
| /* XXX Remove this assertion after 2014-12-31. |
| * See bug 946984. */ |
| PORT_Assert(reasonCode == 0); |
| |
| /* cert chain successfully validated! */ |
| PKIX_CHECK(pkix_ValidateResult_Create |
| (finalPubKey, |
| anchor, |
| validPolicyTree, |
| &valResult, |
| plContext), |
| PKIX_VALIDATERESULTCREATEFAILED); |
| |
| *pResult = valResult; |
| |
| /* no need to try any more anchors in the loop */ |
| goto cleanup; |
| } |
| } |
| |
| cleanup: |
| |
| PKIX_DECREF(finalPubKey); |
| PKIX_DECREF(certs); |
| PKIX_DECREF(anchors); |
| PKIX_DECREF(anchor); |
| PKIX_DECREF(checkers); |
| PKIX_DECREF(revChecker); |
| PKIX_DECREF(validPolicyTree); |
| PKIX_DECREF(chainFailed); |
| PKIX_DECREF(procParams); |
| PKIX_DECREF(userCheckers); |
| PKIX_DECREF(validateCheckedCritExtOIDsList); |
| |
| PKIX_RETURN(VALIDATE); |
| } |
