The Tor Browser: security/nss/cmd/ocspresp/ocspresp.c@141e0f1194b1 (annotated)

security/nss/cmd/ocspresp/ocspresp.c@141e0f1194b1 (annotated)

security/nss/cmd/ocspresp/ocspresp.c

Wed, 31 Dec 2014 07:16:47 +0100

author: Michael Schloh von Bennewitz <michael@schloh.com>
date: Wed, 31 Dec 2014 07:16:47 +0100
branch: TOR_BUG_9701
changeset 3: 141e0f1194b1
permissions: -rw-r--r--

Revert simplistic fix pending revisit of Mozilla integration attempt.

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /*
  * ocspresp - self test for OCSP response creation
  */
 #include "nspr.h"
 #include "secutil.h"
 #include "secpkcs7.h"
 #include "cert.h"
 #include "certdb.h"
 #include "nss.h"
 #include "pk11func.h"
 #include "cryptohi.h"
 #include "ocsp.h"
 #if defined(XP_UNIX)
 #include <unistd.h>
 #endif
 #include <stdio.h>
 #include <string.h>
 secuPWData  pwdata          = { PW_NONE, 0 };
 static PRBool
 getCaAndSubjectCert(CERTCertDBHandle *certHandle,
                     const char *caNick, const char *eeNick,
                     CERTCertificate **outCA, CERTCertificate **outCert)
 {
     *outCA = CERT_FindCertByNickname(certHandle, caNick);
     *outCert = CERT_FindCertByNickname(certHandle, eeNick);
     return *outCA && *outCert;
 }
 static SECItem *
 encode(PLArenaPool *arena, CERTOCSPCertID *cid, CERTCertificate *ca)
 {
     SECItem *response;
     PRTime now = PR_Now();
     PRTime nextUpdate;
     CERTOCSPSingleResponse **responses;
     CERTOCSPSingleResponse *sr;
     if (!arena)
         return NULL;
     nextUpdate = now + 10 * PR_USEC_PER_SEC; /* in the future */
     sr = CERT_CreateOCSPSingleResponseGood(arena, cid, now, &nextUpdate);
     /* meaning of value 2: one entry + one end marker */
     responses = PORT_ArenaNewArray(arena, CERTOCSPSingleResponse*, 2);
     if (responses == NULL)
         return NULL;
     responses[0] = sr;
     responses[1] = NULL;
     response = CERT_CreateEncodedOCSPSuccessResponse(
         arena, ca, ocspResponderID_byName, now, responses, &pwdata);
     return response;
 }
 static SECItem *
 encodeRevoked(PLArenaPool *arena, CERTOCSPCertID *cid, CERTCertificate *ca)
 {
     SECItem *response;
     PRTime now = PR_Now();
     PRTime revocationTime;
     CERTOCSPSingleResponse **responses;
     CERTOCSPSingleResponse *sr;
     if (!arena)
         return NULL;
     revocationTime = now - 10 * PR_USEC_PER_SEC; /* in the past */
     sr = CERT_CreateOCSPSingleResponseRevoked(arena, cid, now, NULL,
                                               revocationTime, NULL);
     /* meaning of value 2: one entry + one end marker */
     responses = PORT_ArenaNewArray(arena, CERTOCSPSingleResponse*, 2);
     if (responses == NULL)
         return NULL;
     responses[0] = sr;
     responses[1] = NULL;
     response = CERT_CreateEncodedOCSPSuccessResponse(
         arena, ca, ocspResponderID_byName, now, responses, &pwdata);
     return response;
 }
 int Usage(void)
 {
     PRFileDesc *pr_stderr = PR_STDERR;
     PR_fprintf (pr_stderr, "ocspresp runs an internal selftest for OCSP response creation");
     PR_fprintf (pr_stderr, "Usage:");
     PR_fprintf (pr_stderr,
                 "\tocspresp <dbdir> <CA-nick> <EE-nick> [-p <pass>] [-f <file>]\n");
     PR_fprintf (pr_stderr,
                 "\tdbdir:   Find security databases in \"dbdir\"\n");
     PR_fprintf (pr_stderr,
                 "\tCA-nick: nickname of a trusted CA certificate with private key\n");
     PR_fprintf (pr_stderr,
                 "\tEE-nick: nickname of a entity cert issued by CA\n");
     PR_fprintf (pr_stderr,
                 "\t-p:      a password for db\n");
     PR_fprintf (pr_stderr,
                 "\t-f:      a filename containing the password for db\n");
     return -1;
 }
 int
 main(int argc, char **argv)
 {
     SECStatus rv;
     int retval = -1;
     CERTCertDBHandle *certHandle = NULL;
     CERTCertificate *caCert = NULL, *cert = NULL;
     CERTOCSPCertID *cid = NULL;
     PLArenaPool *arena = NULL;
     PRTime now = PR_Now();
     SECItem *encoded = NULL;
     CERTOCSPResponse *decoded = NULL;
     SECStatus statusDecoded;
     SECItem *encodedRev = NULL;
     CERTOCSPResponse *decodedRev = NULL;
     SECStatus statusDecodedRev;
     SECItem *encodedFail = NULL;
     CERTOCSPResponse *decodedFail = NULL;
     SECStatus statusDecodedFail;
     CERTCertificate *obtainedSignerCert = NULL;
     if (argc != 4 && argc != 6) {
         return Usage();
     }
     if (argc == 6) {
         if (!strcmp(argv[4], "-p")) {
             pwdata.source = PW_PLAINTEXT;
             pwdata.data = PORT_Strdup(argv[5]);
         }
         else if (!strcmp(argv[4], "-f")) {
             pwdata.source = PW_FROMFILE;
             pwdata.data = PORT_Strdup(argv[5]);
         }
         else
             return Usage();
     }
     PR_Init(PR_SYSTEM_THREAD, PR_PRIORITY_NORMAL, 1);
     /*rv = NSS_Init(SECU_ConfigDirectory(NULL));*/
     rv = NSS_Init(argv[1]);
     if (rv != SECSuccess) {
 	SECU_PrintPRandOSError(argv[0]);
 	goto loser;
     }
     PK11_SetPasswordFunc(SECU_GetModulePassword);
     certHandle = CERT_GetDefaultCertDB();
     if (!certHandle)
 	goto loser;
     if (!getCaAndSubjectCert(certHandle, argv[2], argv[3], &caCert, &cert))
         goto loser;
     cid = CERT_CreateOCSPCertID(cert, now);
     arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
     encoded = encode(arena, cid, caCert);
     PORT_Assert(encoded);
     decoded = CERT_DecodeOCSPResponse(encoded);
     statusDecoded = CERT_GetOCSPResponseStatus(decoded);
     PORT_Assert(statusDecoded == SECSuccess);
     statusDecoded = CERT_VerifyOCSPResponseSignature(decoded, certHandle, &pwdata,
                                                 &obtainedSignerCert, caCert);
     PORT_Assert(statusDecoded == SECSuccess);
     statusDecoded = CERT_GetOCSPStatusForCertID(certHandle, decoded, cid,
                                                 obtainedSignerCert, now);
     PORT_Assert(statusDecoded == SECSuccess);
     CERT_DestroyCertificate(obtainedSignerCert);
     encodedRev = encodeRevoked(arena, cid, caCert);
     PORT_Assert(encodedRev);
     decodedRev = CERT_DecodeOCSPResponse(encodedRev);
     statusDecodedRev = CERT_GetOCSPResponseStatus(decodedRev);
     PORT_Assert(statusDecodedRev == SECSuccess);
     statusDecodedRev = CERT_VerifyOCSPResponseSignature(decodedRev, certHandle, &pwdata,
                                                         &obtainedSignerCert, caCert);
     PORT_Assert(statusDecodedRev == SECSuccess);
     statusDecodedRev = CERT_GetOCSPStatusForCertID(certHandle, decodedRev, cid,
                                                    obtainedSignerCert, now);
     PORT_Assert(statusDecodedRev == SECFailure);
     PORT_Assert(PORT_GetError() == SEC_ERROR_REVOKED_CERTIFICATE);
     CERT_DestroyCertificate(obtainedSignerCert);
     encodedFail = CERT_CreateEncodedOCSPErrorResponse(
         arena, SEC_ERROR_OCSP_TRY_SERVER_LATER);
     PORT_Assert(encodedFail);
     decodedFail = CERT_DecodeOCSPResponse(encodedFail);
     statusDecodedFail = CERT_GetOCSPResponseStatus(decodedFail);
     PORT_Assert(statusDecodedFail == SECFailure);
     PORT_Assert(PORT_GetError() == SEC_ERROR_OCSP_TRY_SERVER_LATER);
     retval = 0;
 loser:
     if (retval != 0)
         SECU_PrintError(argv[0], "tests failed");
     if (cid)
         CERT_DestroyOCSPCertID(cid);
     if (cert)
         CERT_DestroyCertificate(cert);
     if (caCert)
         CERT_DestroyCertificate(caCert);
     if (arena)
         PORT_FreeArena(arena, PR_FALSE);
     if (decoded)
         CERT_DestroyOCSPResponse(decoded);
     if (decodedRev)
         CERT_DestroyOCSPResponse(decodedRev);
     if (decodedFail)
         CERT_DestroyOCSPResponse(decodedFail);
     if (pwdata.data) {
         PORT_Free(pwdata.data);
     }
     if (NSS_Shutdown() != SECSuccess) {
         SECU_PrintError(argv[0], "NSS shutdown:");
         if (retval == 0)
             retval = -2;
     }
     return retval;
 }

The Tor Browser / annotate

security/nss/cmd/ocspresp/ocspresp.c@141e0f1194b1 (annotated)

security/nss/cmd/ocspresp/ocspresp.c