The Tor Browser / annotate

security/manager/ssl/src/nsNSSCertTrust.cpp@b8a032363ba2 (annotated)

security/manager/ssl/src/nsNSSCertTrust.cpp

Thu, 22 Jan 2015 13:21:57 +0100

author
Michael Schloh von Bennewitz <michael@schloh.com>
date
Thu, 22 Jan 2015 13:21:57 +0100
branch
TOR_BUG_9701
changeset 15
b8a032363ba2
permissions
-rw-r--r--

Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6

michael@0 1 /* This Source Code Form is subject to the terms of the Mozilla Public
michael@0 2 * License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0 4
michael@0 5 #include "nsNSSCertTrust.h"
michael@0 6
michael@0 7 void
michael@0 8 nsNSSCertTrust::AddCATrust(bool ssl, bool email, bool objSign)
michael@0 9 {
michael@0 10 if (ssl) {
michael@0 11 addTrust(&mTrust.sslFlags, CERTDB_TRUSTED_CA);
michael@0 12 addTrust(&mTrust.sslFlags, CERTDB_TRUSTED_CLIENT_CA);
michael@0 13 }
michael@0 14 if (email) {
michael@0 15 addTrust(&mTrust.emailFlags, CERTDB_TRUSTED_CA);
michael@0 16 addTrust(&mTrust.emailFlags, CERTDB_TRUSTED_CLIENT_CA);
michael@0 17 }
michael@0 18 if (objSign) {
michael@0 19 addTrust(&mTrust.objectSigningFlags, CERTDB_TRUSTED_CA);
michael@0 20 addTrust(&mTrust.objectSigningFlags, CERTDB_TRUSTED_CLIENT_CA);
michael@0 21 }
michael@0 22 }
michael@0 23
michael@0 24 void
michael@0 25 nsNSSCertTrust::AddPeerTrust(bool ssl, bool email, bool objSign)
michael@0 26 {
michael@0 27 if (ssl)
michael@0 28 addTrust(&mTrust.sslFlags, CERTDB_TRUSTED);
michael@0 29 if (email)
michael@0 30 addTrust(&mTrust.emailFlags, CERTDB_TRUSTED);
michael@0 31 if (objSign)
michael@0 32 addTrust(&mTrust.objectSigningFlags, CERTDB_TRUSTED);
michael@0 33 }
michael@0 34
michael@0 35 nsNSSCertTrust::nsNSSCertTrust()
michael@0 36 {
michael@0 37 memset(&mTrust, 0, sizeof(CERTCertTrust));
michael@0 38 }
michael@0 39
michael@0 40 nsNSSCertTrust::nsNSSCertTrust(unsigned int ssl,
michael@0 41 unsigned int email,
michael@0 42 unsigned int objsign)
michael@0 43 {
michael@0 44 memset(&mTrust, 0, sizeof(CERTCertTrust));
michael@0 45 addTrust(&mTrust.sslFlags, ssl);
michael@0 46 addTrust(&mTrust.emailFlags, email);
michael@0 47 addTrust(&mTrust.objectSigningFlags, objsign);
michael@0 48 }
michael@0 49
michael@0 50 nsNSSCertTrust::nsNSSCertTrust(CERTCertTrust *t)
michael@0 51 {
michael@0 52 if (t)
michael@0 53 memcpy(&mTrust, t, sizeof(CERTCertTrust));
michael@0 54 else
michael@0 55 memset(&mTrust, 0, sizeof(CERTCertTrust));
michael@0 56 }
michael@0 57
michael@0 58 nsNSSCertTrust::~nsNSSCertTrust()
michael@0 59 {
michael@0 60 }
michael@0 61
michael@0 62 void
michael@0 63 nsNSSCertTrust::SetSSLTrust(bool peer, bool tPeer,
michael@0 64 bool ca, bool tCA, bool tClientCA,
michael@0 65 bool user, bool warn)
michael@0 66 {
michael@0 67 mTrust.sslFlags = 0;
michael@0 68 if (peer || tPeer)
michael@0 69 addTrust(&mTrust.sslFlags, CERTDB_TERMINAL_RECORD);
michael@0 70 if (tPeer)
michael@0 71 addTrust(&mTrust.sslFlags, CERTDB_TRUSTED);
michael@0 72 if (ca || tCA)
michael@0 73 addTrust(&mTrust.sslFlags, CERTDB_VALID_CA);
michael@0 74 if (tClientCA)
michael@0 75 addTrust(&mTrust.sslFlags, CERTDB_TRUSTED_CLIENT_CA);
michael@0 76 if (tCA)
michael@0 77 addTrust(&mTrust.sslFlags, CERTDB_TRUSTED_CA);
michael@0 78 if (user)
michael@0 79 addTrust(&mTrust.sslFlags, CERTDB_USER);
michael@0 80 if (warn)
michael@0 81 addTrust(&mTrust.sslFlags, CERTDB_SEND_WARN);
michael@0 82 }
michael@0 83
michael@0 84 void
michael@0 85 nsNSSCertTrust::SetEmailTrust(bool peer, bool tPeer,
michael@0 86 bool ca, bool tCA, bool tClientCA,
michael@0 87 bool user, bool warn)
michael@0 88 {
michael@0 89 mTrust.emailFlags = 0;
michael@0 90 if (peer || tPeer)
michael@0 91 addTrust(&mTrust.emailFlags, CERTDB_TERMINAL_RECORD);
michael@0 92 if (tPeer)
michael@0 93 addTrust(&mTrust.emailFlags, CERTDB_TRUSTED);
michael@0 94 if (ca || tCA)
michael@0 95 addTrust(&mTrust.emailFlags, CERTDB_VALID_CA);
michael@0 96 if (tClientCA)
michael@0 97 addTrust(&mTrust.emailFlags, CERTDB_TRUSTED_CLIENT_CA);
michael@0 98 if (tCA)
michael@0 99 addTrust(&mTrust.emailFlags, CERTDB_TRUSTED_CA);
michael@0 100 if (user)
michael@0 101 addTrust(&mTrust.emailFlags, CERTDB_USER);
michael@0 102 if (warn)
michael@0 103 addTrust(&mTrust.emailFlags, CERTDB_SEND_WARN);
michael@0 104 }
michael@0 105
michael@0 106 void
michael@0 107 nsNSSCertTrust::SetObjSignTrust(bool peer, bool tPeer,
michael@0 108 bool ca, bool tCA, bool tClientCA,
michael@0 109 bool user, bool warn)
michael@0 110 {
michael@0 111 mTrust.objectSigningFlags = 0;
michael@0 112 if (peer || tPeer)
michael@0 113 addTrust(&mTrust.objectSigningFlags, CERTDB_TERMINAL_RECORD);
michael@0 114 if (tPeer)
michael@0 115 addTrust(&mTrust.objectSigningFlags, CERTDB_TRUSTED);
michael@0 116 if (ca || tCA)
michael@0 117 addTrust(&mTrust.objectSigningFlags, CERTDB_VALID_CA);
michael@0 118 if (tClientCA)
michael@0 119 addTrust(&mTrust.objectSigningFlags, CERTDB_TRUSTED_CLIENT_CA);
michael@0 120 if (tCA)
michael@0 121 addTrust(&mTrust.objectSigningFlags, CERTDB_TRUSTED_CA);
michael@0 122 if (user)
michael@0 123 addTrust(&mTrust.objectSigningFlags, CERTDB_USER);
michael@0 124 if (warn)
michael@0 125 addTrust(&mTrust.objectSigningFlags, CERTDB_SEND_WARN);
michael@0 126 }
michael@0 127
michael@0 128 void
michael@0 129 nsNSSCertTrust::SetValidCA()
michael@0 130 {
michael@0 131 SetSSLTrust(false, false,
michael@0 132 true, false, false,
michael@0 133 false, false);
michael@0 134 SetEmailTrust(false, false,
michael@0 135 true, false, false,
michael@0 136 false, false);
michael@0 137 SetObjSignTrust(false, false,
michael@0 138 true, false, false,
michael@0 139 false, false);
michael@0 140 }
michael@0 141
michael@0 142 void
michael@0 143 nsNSSCertTrust::SetTrustedServerCA()
michael@0 144 {
michael@0 145 SetSSLTrust(false, false,
michael@0 146 true, true, false,
michael@0 147 false, false);
michael@0 148 SetEmailTrust(false, false,
michael@0 149 true, true, false,
michael@0 150 false, false);
michael@0 151 SetObjSignTrust(false, false,
michael@0 152 true, true, false,
michael@0 153 false, false);
michael@0 154 }
michael@0 155
michael@0 156 void
michael@0 157 nsNSSCertTrust::SetTrustedCA()
michael@0 158 {
michael@0 159 SetSSLTrust(false, false,
michael@0 160 true, true, true,
michael@0 161 false, false);
michael@0 162 SetEmailTrust(false, false,
michael@0 163 true, true, true,
michael@0 164 false, false);
michael@0 165 SetObjSignTrust(false, false,
michael@0 166 true, true, true,
michael@0 167 false, false);
michael@0 168 }
michael@0 169
michael@0 170 void
michael@0 171 nsNSSCertTrust::SetValidPeer()
michael@0 172 {
michael@0 173 SetSSLTrust(true, false,
michael@0 174 false, false, false,
michael@0 175 false, false);
michael@0 176 SetEmailTrust(true, false,
michael@0 177 false, false, false,
michael@0 178 false, false);
michael@0 179 SetObjSignTrust(true, false,
michael@0 180 false, false, false,
michael@0 181 false, false);
michael@0 182 }
michael@0 183
michael@0 184 void
michael@0 185 nsNSSCertTrust::SetValidServerPeer()
michael@0 186 {
michael@0 187 SetSSLTrust(true, false,
michael@0 188 false, false, false,
michael@0 189 false, false);
michael@0 190 SetEmailTrust(false, false,
michael@0 191 false, false, false,
michael@0 192 false, false);
michael@0 193 SetObjSignTrust(false, false,
michael@0 194 false, false, false,
michael@0 195 false, false);
michael@0 196 }
michael@0 197
michael@0 198 void
michael@0 199 nsNSSCertTrust::SetTrustedPeer()
michael@0 200 {
michael@0 201 SetSSLTrust(true, true,
michael@0 202 false, false, false,
michael@0 203 false, false);
michael@0 204 SetEmailTrust(true, true,
michael@0 205 false, false, false,
michael@0 206 false, false);
michael@0 207 SetObjSignTrust(true, true,
michael@0 208 false, false, false,
michael@0 209 false, false);
michael@0 210 }
michael@0 211
michael@0 212 void
michael@0 213 nsNSSCertTrust::SetUser()
michael@0 214 {
michael@0 215 SetSSLTrust(false, false,
michael@0 216 false, false, false,
michael@0 217 true, false);
michael@0 218 SetEmailTrust(false, false,
michael@0 219 false, false, false,
michael@0 220 true, false);
michael@0 221 SetObjSignTrust(false, false,
michael@0 222 false, false, false,
michael@0 223 true, false);
michael@0 224 }
michael@0 225
michael@0 226 bool
michael@0 227 nsNSSCertTrust::HasAnyCA()
michael@0 228 {
michael@0 229 if (hasTrust(mTrust.sslFlags, CERTDB_VALID_CA) ||
michael@0 230 hasTrust(mTrust.emailFlags, CERTDB_VALID_CA) ||
michael@0 231 hasTrust(mTrust.objectSigningFlags, CERTDB_VALID_CA))
michael@0 232 return true;
michael@0 233 return false;
michael@0 234 }
michael@0 235
michael@0 236 bool
michael@0 237 nsNSSCertTrust::HasCA(bool checkSSL,
michael@0 238 bool checkEmail,
michael@0 239 bool checkObjSign)
michael@0 240 {
michael@0 241 if (checkSSL && !hasTrust(mTrust.sslFlags, CERTDB_VALID_CA))
michael@0 242 return false;
michael@0 243 if (checkEmail && !hasTrust(mTrust.emailFlags, CERTDB_VALID_CA))
michael@0 244 return false;
michael@0 245 if (checkObjSign && !hasTrust(mTrust.objectSigningFlags, CERTDB_VALID_CA))
michael@0 246 return false;
michael@0 247 return true;
michael@0 248 }
michael@0 249
michael@0 250 bool
michael@0 251 nsNSSCertTrust::HasPeer(bool checkSSL,
michael@0 252 bool checkEmail,
michael@0 253 bool checkObjSign)
michael@0 254 {
michael@0 255 if (checkSSL && !hasTrust(mTrust.sslFlags, CERTDB_TERMINAL_RECORD))
michael@0 256 return false;
michael@0 257 if (checkEmail && !hasTrust(mTrust.emailFlags, CERTDB_TERMINAL_RECORD))
michael@0 258 return false;
michael@0 259 if (checkObjSign && !hasTrust(mTrust.objectSigningFlags, CERTDB_TERMINAL_RECORD))
michael@0 260 return false;
michael@0 261 return true;
michael@0 262 }
michael@0 263
michael@0 264 bool
michael@0 265 nsNSSCertTrust::HasAnyUser()
michael@0 266 {
michael@0 267 if (hasTrust(mTrust.sslFlags, CERTDB_USER) ||
michael@0 268 hasTrust(mTrust.emailFlags, CERTDB_USER) ||
michael@0 269 hasTrust(mTrust.objectSigningFlags, CERTDB_USER))
michael@0 270 return true;
michael@0 271 return false;
michael@0 272 }
michael@0 273
michael@0 274 bool
michael@0 275 nsNSSCertTrust::HasUser(bool checkSSL,
michael@0 276 bool checkEmail,
michael@0 277 bool checkObjSign)
michael@0 278 {
michael@0 279 if (checkSSL && !hasTrust(mTrust.sslFlags, CERTDB_USER))
michael@0 280 return false;
michael@0 281 if (checkEmail && !hasTrust(mTrust.emailFlags, CERTDB_USER))
michael@0 282 return false;
michael@0 283 if (checkObjSign && !hasTrust(mTrust.objectSigningFlags, CERTDB_USER))
michael@0 284 return false;
michael@0 285 return true;
michael@0 286 }
michael@0 287
michael@0 288 bool
michael@0 289 nsNSSCertTrust::HasTrustedCA(bool checkSSL,
michael@0 290 bool checkEmail,
michael@0 291 bool checkObjSign)
michael@0 292 {
michael@0 293 if (checkSSL && !(hasTrust(mTrust.sslFlags, CERTDB_TRUSTED_CA) ||
michael@0 294 hasTrust(mTrust.sslFlags, CERTDB_TRUSTED_CLIENT_CA)))
michael@0 295 return false;
michael@0 296 if (checkEmail && !(hasTrust(mTrust.emailFlags, CERTDB_TRUSTED_CA) ||
michael@0 297 hasTrust(mTrust.emailFlags, CERTDB_TRUSTED_CLIENT_CA)))
michael@0 298 return false;
michael@0 299 if (checkObjSign &&
michael@0 300 !(hasTrust(mTrust.objectSigningFlags, CERTDB_TRUSTED_CA) ||
michael@0 301 hasTrust(mTrust.objectSigningFlags, CERTDB_TRUSTED_CLIENT_CA)))
michael@0 302 return false;
michael@0 303 return true;
michael@0 304 }
michael@0 305
michael@0 306 bool
michael@0 307 nsNSSCertTrust::HasTrustedPeer(bool checkSSL,
michael@0 308 bool checkEmail,
michael@0 309 bool checkObjSign)
michael@0 310 {
michael@0 311 if (checkSSL && !(hasTrust(mTrust.sslFlags, CERTDB_TRUSTED)))
michael@0 312 return false;
michael@0 313 if (checkEmail && !(hasTrust(mTrust.emailFlags, CERTDB_TRUSTED)))
michael@0 314 return false;
michael@0 315 if (checkObjSign &&
michael@0 316 !(hasTrust(mTrust.objectSigningFlags, CERTDB_TRUSTED)))
michael@0 317 return false;
michael@0 318 return true;
michael@0 319 }
michael@0 320
michael@0 321 void
michael@0 322 nsNSSCertTrust::addTrust(unsigned int *t, unsigned int v)
michael@0 323 {
michael@0 324 *t |= v;
michael@0 325 }
michael@0 326
michael@0 327 bool
michael@0 328 nsNSSCertTrust::hasTrust(unsigned int t, unsigned int v)
michael@0 329 {
michael@0 330 return !!(t & v);
michael@0 331 }
michael@0 332

Mercurial Repository: The Tor Browser

Europalab SCM Repository Server

mercurial