The Tor Browser: security/nss/cmd/lib/pppolicy.c@141e0f1194b1 (annotated)

security/nss/cmd/lib/pppolicy.c@141e0f1194b1 (annotated)

security/nss/cmd/lib/pppolicy.c

Wed, 31 Dec 2014 07:16:47 +0100

author: Michael Schloh von Bennewitz <michael@schloh.com>
date: Wed, 31 Dec 2014 07:16:47 +0100
branch: TOR_BUG_9701
changeset 3: 141e0f1194b1
permissions: -rw-r--r--

Revert simplistic fix pending revisit of Mozilla integration attempt.

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /*
  * Support for various policy related extensions
  */
 #include "seccomon.h"
 #include "secport.h"
 #include "secder.h"
 #include "cert.h"
 #include "secoid.h"
 #include "secasn1.h"
 #include "secerr.h"
 #include "nspr.h"
 #include "secutil.h"
 /* This implementation is derived from the one in nss/lib/certdb/policyxtn.c .
 ** The chief difference is the addition of the OPTIONAL flag to many
 ** parts.  The idea is to be able to parse and print as much of the
 ** policy extension as possible, even if some parts are invalid.
 **
 ** If this approach still is unable to decode policy extensions that
 ** contain invalid parts, then the next approach will be to parse
 ** the PolicyInfos as a SEQUENCE of ANYs, and then parse each of them
 ** as PolicyInfos, with the PolicyQualifiers being ANYs, and finally
 ** parse each of the PolicyQualifiers.
 */
 static const SEC_ASN1Template secu_PolicyQualifierTemplate[] = {
     { SEC_ASN1_SEQUENCE,
 , NULL, sizeof(CERTPolicyQualifier) },
     { SEC_ASN1_OBJECT_ID,
 	  offsetof(CERTPolicyQualifier, qualifierID) },
     { SEC_ASN1_ANY | SEC_ASN1_OPTIONAL,
 	  offsetof(CERTPolicyQualifier, qualifierValue) },
     { 0 }
 };
 static const SEC_ASN1Template secu_PolicyInfoTemplate[] = {
     { SEC_ASN1_SEQUENCE,
 , NULL, sizeof(CERTPolicyInfo) },
     { SEC_ASN1_OBJECT_ID,
 	  offsetof(CERTPolicyInfo, policyID) },
     { SEC_ASN1_SEQUENCE_OF | SEC_ASN1_OPTIONAL,
 	  offsetof(CERTPolicyInfo, policyQualifiers),
 	  secu_PolicyQualifierTemplate },
     { 0 }
 };
 static const SEC_ASN1Template secu_CertificatePoliciesTemplate[] = {
     { SEC_ASN1_SEQUENCE_OF,
 	  offsetof(CERTCertificatePolicies, policyInfos),
 	  secu_PolicyInfoTemplate, sizeof(CERTCertificatePolicies)  }
 };
 static CERTCertificatePolicies *
 secu_DecodeCertificatePoliciesExtension(SECItem *extnValue)
 {
     PLArenaPool *arena = NULL;
     SECStatus rv;
     CERTCertificatePolicies *policies;
     CERTPolicyInfo **policyInfos, *policyInfo;
     CERTPolicyQualifier **policyQualifiers, *policyQualifier;
     SECItem newExtnValue;
     /* make a new arena */
     arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
     if ( !arena ) {
 	goto loser;
     }
     /* allocate the certifiate policies structure */
     policies = PORT_ArenaZNew(arena, CERTCertificatePolicies);
     if ( policies == NULL ) {
 	goto loser;
     }
     policies->arena = arena;
     /* copy the DER into the arena, since Quick DER returns data that points
        into the DER input, which may get freed by the caller */
     rv = SECITEM_CopyItem(arena, &newExtnValue, extnValue);
     if ( rv != SECSuccess ) {
 	goto loser;
     }
     /* decode the policy info */
     rv = SEC_QuickDERDecodeItem(arena, policies,
                                 secu_CertificatePoliciesTemplate,
 			        &newExtnValue);
     if ( rv != SECSuccess ) {
 	goto loser;
     }
     /* initialize the oid tags */
     policyInfos = policies->policyInfos;
     while (policyInfos != NULL && *policyInfos != NULL ) {
 	policyInfo = *policyInfos;
 	policyInfo->oid = SECOID_FindOIDTag(&policyInfo->policyID);
 	policyQualifiers = policyInfo->policyQualifiers;
 	while ( policyQualifiers && *policyQualifiers != NULL ) {
 	    policyQualifier = *policyQualifiers;
 	    policyQualifier->oid =
 		SECOID_FindOIDTag(&policyQualifier->qualifierID);
 	    policyQualifiers++;
 	}
 	policyInfos++;
     }
     return(policies);
 loser:
     if ( arena != NULL ) {
 	PORT_FreeArena(arena, PR_FALSE);
     }
     return(NULL);
 }
 static char *
 itemToString(SECItem *item)
 {
     char *string;
     string = PORT_ZAlloc(item->len+1);
     if (string == NULL) return NULL;
     PORT_Memcpy(string,item->data,item->len);
     string[item->len] = 0;
     return string;
 }
 static SECStatus
 secu_PrintUserNoticeQualifier(FILE *out, SECItem * qualifierValue,
                               char *msg, int level)
 {
     CERTUserNotice *userNotice = NULL;
     if (qualifierValue)
 	userNotice = CERT_DecodeUserNotice(qualifierValue);
     if (userNotice) {
 	if (userNotice->noticeReference.organization.len != 0) {
             char *string =
 	            itemToString(&userNotice->noticeReference.organization);
             SECItem **itemList = userNotice->noticeReference.noticeNumbers;
 	    while (itemList && *itemList) {
 		SECU_PrintInteger(out,*itemList,string,level+1);
 	        itemList++;
 	    }
 	    PORT_Free(string);
 	}
 	if (userNotice->displayText.len != 0) {
 	    SECU_PrintString(out,&userNotice->displayText,
 			     "Display Text", level+1);
 	}
 	CERT_DestroyUserNotice(userNotice);
 	return SECSuccess;
     }
     return SECFailure;	/* caller will print this value */
 }
 static SECStatus
 secu_PrintPolicyQualifier(FILE *out,CERTPolicyQualifier *policyQualifier,
 			  char *msg,int level)
 {
    SECStatus rv;
    SECItem * qualifierValue = &policyQualifier->qualifierValue;
    SECU_PrintObjectID(out, &policyQualifier->qualifierID ,
 					"Policy Qualifier Name", level);
    if (!qualifierValue->data) {
 	SECU_Indent(out, level);
 	fprintf(out,"Error: missing qualifier\n");
    } else
    switch (policyQualifier->oid) {
    case SEC_OID_PKIX_USER_NOTICE_QUALIFIER:
        rv = secu_PrintUserNoticeQualifier(out, qualifierValue, msg, level);
        if (SECSuccess == rv)
 	   break;
        /* fall through on error */
    case SEC_OID_PKIX_CPS_POINTER_QUALIFIER:
    default:
 	SECU_PrintAny(out, qualifierValue, "Policy Qualifier Data", level);
 	break;
    }
    return SECSuccess;
 }
 static SECStatus
 secu_PrintPolicyInfo(FILE *out,CERTPolicyInfo *policyInfo,char *msg,int level)
 {
    CERTPolicyQualifier **policyQualifiers;
    policyQualifiers = policyInfo->policyQualifiers;
    SECU_PrintObjectID(out, &policyInfo->policyID , "Policy Name", level);
    while (policyQualifiers && *policyQualifiers != NULL) {
 	secu_PrintPolicyQualifier(out,*policyQualifiers,"",level+1);
 	policyQualifiers++;
    }
    return SECSuccess;
 }
 void
 SECU_PrintPolicy(FILE *out, SECItem *value, char *msg, int level)
 {
    CERTCertificatePolicies *policies = NULL;
    CERTPolicyInfo **policyInfos;
    if (msg) {
 	SECU_Indent(out, level);
 	fprintf(out,"%s: \n",msg);
 	level++;
    }
    policies = secu_DecodeCertificatePoliciesExtension(value);
    if (policies == NULL) {
 	SECU_PrintAny(out, value, "Invalid Policy Data", level);
 	return;
    }
    policyInfos = policies->policyInfos;
    while (policyInfos && *policyInfos != NULL) {
 	secu_PrintPolicyInfo(out,*policyInfos,"",level);
 	policyInfos++;
    }
    CERT_DestroyCertificatePoliciesExtension(policies);
 }
 void
 SECU_PrintPrivKeyUsagePeriodExtension(FILE *out, SECItem *value,
 			              char *msg, int level)
 {
     CERTPrivKeyUsagePeriod * prd;
     PLArenaPool * arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
     if ( !arena ) {
 	goto loser;
     }
     prd = CERT_DecodePrivKeyUsagePeriodExtension(arena, value);
     if (!prd) {
 	goto loser;
     }
     if (prd->notBefore.data) {
 	SECU_PrintGeneralizedTime(out, &prd->notBefore, "Not Before", level);
     }
     if (prd->notAfter.data) {
 	SECU_PrintGeneralizedTime(out, &prd->notAfter,  "Not After ", level);
     }
     if (!prd->notBefore.data && !prd->notAfter.data) {
 	SECU_Indent(out, level);
 	fprintf(out, "Error: notBefore or notAfter MUST be present.\n");
 loser:
 	SECU_PrintAny(out, value, msg, level);
     }
     if (arena) {
 	PORT_FreeArena(arena, PR_FALSE);
     }
 }

The Tor Browser / annotate

security/nss/cmd/lib/pppolicy.c@141e0f1194b1 (annotated)

security/nss/cmd/lib/pppolicy.c