The Tor Browser: security/nss/lib/libpkix/pkix/certsel/pkix_certselector.c@b8a032363ba2 (annotated)

security/nss/lib/libpkix/pkix/certsel/pkix_certselector.c@b8a032363ba2 (annotated)

security/nss/lib/libpkix/pkix/certsel/pkix_certselector.c

Thu, 22 Jan 2015 13:21:57 +0100

author: Michael Schloh von Bennewitz <michael@schloh.com>
date: Thu, 22 Jan 2015 13:21:57 +0100
branch: TOR_BUG_9701
changeset 15: b8a032363ba2
permissions: -rwxr-xr-x

Incorporate requested changes from Mozilla in review:
https://bugzilla.mozilla.org/show_bug.cgi?id=1123480#c6

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 /*
  * pkix_certselector.c
  *
  * CertSelector Object Functions
  *
  */
 #include "pkix_certselector.h"
 /* --Private-Functions-------------------------------------------- */
 /*
  * FUNCTION: pkix_CertSelector_Destroy
  * (see comments for PKIX_PL_DestructorCallback in pkix_pl_system.h)
  */
 static PKIX_Error *
 pkix_CertSelector_Destroy(
         PKIX_PL_Object *object,
         void *plContext)
 {
         PKIX_CertSelector *selector = NULL;
         PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Destroy");
         PKIX_NULLCHECK_ONE(object);
         /* Check that this object is a cert selector */
         PKIX_CHECK(pkix_CheckType(object, PKIX_CERTSELECTOR_TYPE, plContext),
                     PKIX_OBJECTNOTCERTSELECTOR);
         selector = (PKIX_CertSelector *)object;
         PKIX_DECREF(selector->params);
         PKIX_DECREF(selector->context);
 cleanup:
         PKIX_RETURN(CERTSELECTOR);
 }
 /*
  * FUNCTION: pkix_CertSelector_Duplicate
  * (see comments for PKIX_PL_DuplicateCallback in pkix_pl_system.h)
  */
 static PKIX_Error *
 pkix_CertSelector_Duplicate(
         PKIX_PL_Object *object,
         PKIX_PL_Object **pNewObject,
         void *plContext)
 {
         PKIX_CertSelector *certSelector = NULL;
         PKIX_CertSelector *certSelectorDuplicate = NULL;
         PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Duplicate");
         PKIX_NULLCHECK_TWO(object, pNewObject);
         PKIX_CHECK(pkix_CheckType(object, PKIX_CERTSELECTOR_TYPE, plContext),
                     PKIX_OBJECTNOTCERTSELECTOR);
         certSelector = (PKIX_CertSelector *)object;
         PKIX_CHECK(PKIX_CertSelector_Create
                     (certSelector->matchCallback,
                     certSelector->context,
                     &certSelectorDuplicate,
                     plContext),
                     PKIX_CERTSELECTORCREATEFAILED);
         PKIX_CHECK(PKIX_PL_Object_Duplicate
                     ((PKIX_PL_Object *)certSelector->params,
                     (PKIX_PL_Object **)&certSelectorDuplicate->params,
                     plContext),
                     PKIX_OBJECTDUPLICATEFAILED);
         *pNewObject = (PKIX_PL_Object *)certSelectorDuplicate;
 cleanup:
         if (PKIX_ERROR_RECEIVED){
                 PKIX_DECREF(certSelectorDuplicate);
         }
         PKIX_RETURN(CERTSELECTOR);
 }
 /*
  * FUNCTION: pkix_CertSelector_Match_BasicConstraint
  * DESCRIPTION:
  *
  *  Determines whether the Cert pointed to by "cert" matches the basic
  *  constraints criterion using the basic constraints field of the
  *  ComCertSelParams pointed to by "params". If the basic constraints field is
  *  -1, no basic constraints check is done and the Cert is considered to match
  *  the basic constraints criterion. If the Cert does not match the basic
  *  constraints criterion, an Error pointer is returned.
  *
  *  In order to match against this criterion, there are several possibilities.
  *
  *  1) If the criterion's minimum path length is greater than or equal to zero,
  *  a certificate must include a BasicConstraints extension with a pathLen of
  *  at least this value.
  *
  *  2) If the criterion's minimum path length is -2, a certificate must be an
  *  end-entity certificate.
  *
  *  3) If the criterion's minimum path length is -1, no basic constraints check
  *  is done and all certificates are considered to match this criterion.
  *
  * PARAMETERS:
  *  "params"
  *      Address of ComCertSelParams whose basic constraints field is used.
  *      Must be non-NULL.
  *  "cert"
  *      Address of Cert that is to be matched. Must be non-NULL.
  *  "pResult"
  *      Address of PKIX_Boolean that returns the match result.
  *  "plContext"
  *      Platform-specific context pointer.
  * OUTPUT PARAMETERS ON FAILURE:
  *   If the function returns a failure,
  *   the output parameters of this function are undefined.
  * THREAD SAFETY:
  *  Conditionally Thread Safe
  *      (see Thread Safety Definitions in Programmer's Guide)
  * RETURNS:
  *  Returns NULL if the function succeeds.
  *  Returns a CertSelector Error if the function fails in a non-fatal way.
  *  Returns a Fatal Error if the function fails in an unrecoverable way.
  */
 static PKIX_Error *
 pkix_CertSelector_Match_BasicConstraint(
         PKIX_ComCertSelParams *params,
         PKIX_PL_Cert *cert,
         PKIX_Boolean *pResult,
         void *plContext)
 {
         PKIX_PL_CertBasicConstraints *basicConstraints = NULL;
         PKIX_Boolean caFlag = PKIX_FALSE; /* EE Cert by default */
         PKIX_Int32 pathLength = 0;
         PKIX_Int32 minPathLength = 0;
         PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_BasicConstraint");
         PKIX_NULLCHECK_THREE(params, cert, pResult);
         *pResult = PKIX_TRUE;
         PKIX_CHECK(PKIX_ComCertSelParams_GetBasicConstraints
                 (params, &minPathLength, plContext),
                 PKIX_COMCERTSELPARAMSGETBASICCONSTRAINTSFAILED);
         /* If the minPathLength is unlimited (-1), no checking */
         if (minPathLength == PKIX_CERTSEL_ALL_MATCH_MIN_PATHLENGTH) {
                 goto cleanup;
         }
         PKIX_CHECK(PKIX_PL_Cert_GetBasicConstraints
                     (cert, &basicConstraints, plContext),
                     PKIX_CERTGETBASICCONSTRAINTSFAILED);
         if (basicConstraints != NULL) {
                 PKIX_CHECK(PKIX_PL_BasicConstraints_GetCAFlag
                             (basicConstraints, &caFlag, plContext),
                             PKIX_BASICCONSTRAINTSGETCAFLAGFAILED);
                 PKIX_CHECK(PKIX_PL_BasicConstraints_GetPathLenConstraint
                         (basicConstraints, &pathLength, plContext),
                         PKIX_BASICCONSTRAINTSGETPATHLENCONSTRAINTFAILED);
         }
         /*
          * if minPathLength >= 0, the cert must have a BasicConstraints ext and
          * the pathLength in this cert
          * BasicConstraints needs to be >= minPathLength.
          */
         if (minPathLength >= 0){
                 if ((!basicConstraints) || (caFlag == PKIX_FALSE)){
                         PKIX_ERROR(PKIX_CERTNOTALLOWEDTOSIGNCERTIFICATES);
                 } else if ((pathLength != PKIX_UNLIMITED_PATH_CONSTRAINT) &&
                             (pathLength < minPathLength)){
                         PKIX_CERTSELECTOR_DEBUG
                             ("Basic Constraints path length match failed\n");
                         *pResult = PKIX_FALSE;
                         PKIX_ERROR(PKIX_PATHLENCONSTRAINTINVALID);
                 }
         }
         /* if the minPathLength is -2, this cert must be an end-entity cert. */
         if (minPathLength == PKIX_CERTSEL_ENDENTITY_MIN_PATHLENGTH) {
                 if (caFlag == PKIX_TRUE) {
                     PKIX_CERTSELECTOR_DEBUG
                         ("Basic Constraints end-entity match failed\n");
                     *pResult = PKIX_FALSE;
                     PKIX_ERROR(PKIX_PATHLENCONSTRAINTINVALID);
                 }
         }
 cleanup:
         PKIX_DECREF(basicConstraints);
         PKIX_RETURN(CERTSELECTOR);
 }
 /*
  * FUNCTION: pkix_CertSelector_Match_Policies
  * DESCRIPTION:
  *
  *  Determines whether the Cert pointed to by "cert" matches the policy
  *  constraints specified in the ComCertsSelParams given by "params".
  *  If "params" specifies a policy constraint of NULL, all certificates
  *  match. If "params" specifies an empty list, "cert" must have at least
  *  some policy. Otherwise "cert" must include at least one of the
  *  policies in the list. See the description of PKIX_CertSelector in
  *  pkix_certsel.h for more.
  *
  * PARAMETERS:
  *  "params"
  *      Address of ComCertSelParams whose policy criterion (if any) is used.
  *      Must be non-NULL.
  *  "cert"
  *      Address of Cert that is to be matched. Must be non-NULL.
  *  "pResult"
  *      Address of PKIX_Boolean that returns the match result.
  *  "plContext"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Conditionally Thread Safe
  *      (see Thread Safety Definitions in Programmer's Guide)
  * RETURNS:
  *  Returns NULL if the function succeeds.
  *  Returns a CertSelector Error if the function fails in a non-fatal way.
  *  Returns a Fatal Error if the function fails in an unrecoverable way.
  */
 static PKIX_Error *
 pkix_CertSelector_Match_Policies(
         PKIX_ComCertSelParams *params,
         PKIX_PL_Cert *cert,
         PKIX_Boolean *pResult,
         void *plContext)
 {
         PKIX_UInt32 numConstraintPolicies = 0;
         PKIX_UInt32 numCertPolicies = 0;
         PKIX_UInt32 certPolicyIndex = 0;
         PKIX_Boolean result = PKIX_FALSE;
         PKIX_List *constraintPolicies = NULL; /* List of PKIX_PL_OID */
         PKIX_List *certPolicyInfos = NULL; /* List of PKIX_PL_CertPolicyInfo */
         PKIX_PL_CertPolicyInfo *policyInfo = NULL;
         PKIX_PL_OID *polOID = NULL;
         PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_Policies");
         PKIX_NULLCHECK_THREE(params, cert, pResult);
         PKIX_CHECK(PKIX_ComCertSelParams_GetPolicy
                 (params, &constraintPolicies, plContext),
                 PKIX_COMCERTSELPARAMSGETPOLICYFAILED);
         /* If constraintPolicies is NULL, all certificates "match" */
         if (constraintPolicies) {
             PKIX_CHECK(PKIX_PL_Cert_GetPolicyInformation
                 (cert, &certPolicyInfos, plContext),
                 PKIX_CERTGETPOLICYINFORMATIONFAILED);
             /* No hope of a match if cert has no policies */
             if (!certPolicyInfos) {
                 PKIX_CERTSELECTOR_DEBUG("Certificate has no policies\n");
                 *pResult = PKIX_FALSE;
                 PKIX_ERROR(PKIX_CERTSELECTORMATCHPOLICIESFAILED);
             }
             PKIX_CHECK(PKIX_List_GetLength
                 (constraintPolicies, &numConstraintPolicies, plContext),
                 PKIX_LISTGETLENGTHFAILED);
             if (numConstraintPolicies > 0) {
                 PKIX_CHECK(PKIX_List_GetLength
                         (certPolicyInfos, &numCertPolicies, plContext),
                         PKIX_LISTGETLENGTHFAILED);
                 for (certPolicyIndex = 0;
                         ((!result) && (certPolicyIndex < numCertPolicies));
                         certPolicyIndex++) {
                         PKIX_CHECK(PKIX_List_GetItem
                                 (certPolicyInfos,
                                 certPolicyIndex,
                                 (PKIX_PL_Object **)&policyInfo,
                                 plContext),
                                 PKIX_LISTGETELEMENTFAILED);
                         PKIX_CHECK(PKIX_PL_CertPolicyInfo_GetPolicyId
                                 (policyInfo, &polOID, plContext),
                                 PKIX_CERTPOLICYINFOGETPOLICYIDFAILED);
                         PKIX_CHECK(pkix_List_Contains
                                 (constraintPolicies,
                                 (PKIX_PL_Object *)polOID,
                                 &result,
                                 plContext),
                                 PKIX_LISTCONTAINSFAILED);
                         PKIX_DECREF(policyInfo);
                         PKIX_DECREF(polOID);
                 }
                 if (!result) {
                     *pResult = PKIX_FALSE;
                     PKIX_ERROR(PKIX_CERTSELECTORMATCHPOLICIESFAILED);
                 }
             }
         }
 cleanup:
         PKIX_DECREF(constraintPolicies);
         PKIX_DECREF(certPolicyInfos);
         PKIX_DECREF(policyInfo);
         PKIX_DECREF(polOID);
         PKIX_RETURN(CERTSELECTOR);
 }
 /*
  * FUNCTION: pkix_CertSelector_Match_CertificateValid
  * DESCRIPTION:
  *
  *  Determines whether the Cert pointed to by "cert" matches the certificate
  *  validity criterion using the CertificateValid field of the
  *  ComCertSelParams pointed to by "params". If the CertificateValid field is
  *  NULL, no validity check is done and the Cert is considered to match
  *  the CertificateValid criterion. If the CertificateValid field specifies a
  *  Date prior to the notBefore field in the Cert, or greater than the notAfter
  *  field in the Cert, an Error is returned.
  *
  * PARAMETERS:
  *  "params"
  *      Address of ComCertSelParams whose certValid field is used.
  *      Must be non-NULL.
  *  "cert"
  *      Address of Cert that is to be matched. Must be non-NULL.
  *  "pResult"
  *      Address of PKIX_Boolean that returns the match result.
  *  "plContext"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Conditionally Thread Safe
  *      (see Thread Safety Definitions in Programmer's Guide)
  * RETURNS:
  *  Returns NULL if the function succeeds.
  *  Returns a CertSelector Error if the function fails in a non-fatal way.
  *  Returns a Fatal Error if the function fails in an unrecoverable way.
  */
 static PKIX_Error *
 pkix_CertSelector_Match_CertificateValid(
         PKIX_ComCertSelParams *params,
         PKIX_PL_Cert *cert,
         PKIX_Boolean *pResult,
         void *plContext)
 {
         PKIX_PL_Date *validityTime = NULL;
         PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_CertificateValid");
         PKIX_NULLCHECK_THREE(params, cert, pResult);
         PKIX_CHECK(PKIX_ComCertSelParams_GetCertificateValid
                 (params, &validityTime, plContext),
                 PKIX_COMCERTSELPARAMSGETCERTIFICATEVALIDFAILED);
         /* If the validityTime is not set, all certificates are acceptable */
         if (validityTime) {
                 PKIX_CHECK(PKIX_PL_Cert_CheckValidity
                         (cert, validityTime, plContext),
                         PKIX_CERTCHECKVALIDITYFAILED);
         }
 cleanup:
         if (PKIX_ERROR_RECEIVED) {
             *pResult = PKIX_FALSE;
         }
         PKIX_DECREF(validityTime);
         PKIX_RETURN(CERTSELECTOR);
 }
 /*
  * FUNCTION: pkix_CertSelector_Match_NameConstraints
  * DESCRIPTION:
  *
  *  Determines whether the Cert pointed to by "cert" matches the name
  *  constraints criterion specified in the ComCertSelParams pointed to by
  *  "params". If the name constraints field is NULL, no name constraints check
  *  is done and the Cert is considered to match the name constraints criterion.
  *  If the Cert does not match the name constraints criterion, an Error pointer
  *  is returned.
  *
  * PARAMETERS:
  *  "params"
  *      Address of ComCertSelParams whose name constraints field is used.
  *      Must be non-NULL.
  *  "cert"
  *      Address of Cert that is to be matched. Must be non-NULL.
  *  "pResult"
  *      Address of PKIX_Boolean that returns the match result.
  *  "plContext"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Conditionally Thread Safe
  *      (see Thread Safety Definitions in Programmer's Guide)
  * RETURNS:
  *  Returns NULL if the function succeeds.
  *  Returns a CertSelector Error if the function fails in a non-fatal way.
  *  Returns a Fatal Error if the function fails in an unrecoverable way.
  */
 static PKIX_Error *
 pkix_CertSelector_Match_NameConstraints(
         PKIX_ComCertSelParams *params,
         PKIX_PL_Cert *cert,
         PKIX_Boolean *pResult,
         void *plContext)
 {
         PKIX_PL_CertNameConstraints *nameConstraints = NULL;
         PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_NameConstraints");
         PKIX_NULLCHECK_THREE(params, cert, pResult);
         PKIX_CHECK(PKIX_ComCertSelParams_GetNameConstraints
                 (params, &nameConstraints, plContext),
                 PKIX_COMCERTSELPARAMSGETNAMECONSTRAINTSFAILED);
         if (nameConstraints != NULL) {
                 /* As only the end-entity certificate should have
                  * the common name constrained as if it was a dNSName,
                  * do not constrain the common name when building a
                  * forward path.
                  */
                 PKIX_CHECK(PKIX_PL_Cert_CheckNameConstraints
                     (cert, nameConstraints, PKIX_FALSE, plContext),
                     PKIX_CERTCHECKNAMECONSTRAINTSFAILED);
         }
 cleanup:
         if (PKIX_ERROR_RECEIVED) {
             *pResult = PKIX_FALSE;
         }
         PKIX_DECREF(nameConstraints);
         PKIX_RETURN(CERTSELECTOR);
 }
 /*
  * FUNCTION: pkix_CertSelector_Match_PathToNames
  * DESCRIPTION:
  *
  *  Determines whether the names at pathToNames in "params" complies with the
  *  NameConstraints pointed to by "cert". If the pathToNames field is NULL
  *  or there is no name constraints for this "cert", no checking is done
  *  and the Cert is considered to match the name constraints criterion.
  *  If the Cert does not match the name constraints criterion, an Error
  *  pointer is returned.
  *
  * PARAMETERS:
  *  "params"
  *      Address of ComCertSelParams whose PathToNames field is used.
  *      Must be non-NULL.
  *  "cert"
  *      Address of Cert that is to be matched. Must be non-NULL.
  *  "pResult"
  *      Address of PKIX_Boolean that returns the match result.
  *  "plContext"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Conditionally Thread Safe
  *      (see Thread Safety Definitions in Programmer's Guide)
  * RETURNS:
  *  Returns NULL if the function succeeds.
  *  Returns a CertSelector Error if the function fails in a non-fatal way.
  *  Returns a Fatal Error if the function fails in an unrecoverable way.
  */
 static PKIX_Error *
 pkix_CertSelector_Match_PathToNames(
         PKIX_ComCertSelParams *params,
         PKIX_PL_Cert *cert,
         PKIX_Boolean *pResult,
         void *plContext)
 {
         PKIX_List *pathToNamesList = NULL;
         PKIX_Boolean passed = PKIX_FALSE;
         PKIX_PL_CertNameConstraints *nameConstraints = NULL;
         PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_PathToNames");
         PKIX_NULLCHECK_THREE(params, cert, pResult);
         PKIX_CHECK(PKIX_ComCertSelParams_GetPathToNames
                 (params, &pathToNamesList, plContext),
                 PKIX_COMCERTSELPARAMSGETPATHTONAMESFAILED);
         if (pathToNamesList != NULL) {
             PKIX_CHECK(PKIX_PL_Cert_GetNameConstraints
                     (cert, &nameConstraints, plContext),
                     PKIX_CERTGETNAMECONSTRAINTSFAILED);
             if (nameConstraints != NULL) {
                 PKIX_CHECK(PKIX_PL_CertNameConstraints_CheckNamesInNameSpace
                         (pathToNamesList, nameConstraints, &passed, plContext),
                         PKIX_CERTNAMECONSTRAINTSCHECKNAMESINNAMESPACEFAILED);
                 if (passed != PKIX_TRUE) {
                     *pResult = PKIX_FALSE;
                     PKIX_ERROR(PKIX_CERTSELECTORMATCHPATHTONAMESFAILED);
                 }
             }
         }
 cleanup:
         PKIX_DECREF(nameConstraints);
         PKIX_DECREF(pathToNamesList);
         PKIX_RETURN(CERTSELECTOR);
 }
 /*
  * FUNCTION: pkix_CertSelector_Match_SubjAltNames
  * DESCRIPTION:
  *
  *  Determines whether the names at subjAltNames in "params" match with the
  *  SubjAltNames pointed to by "cert". If the subjAltNames field is NULL,
  *  no name checking is done and the Cert is considered to match the
  *  criterion. If the Cert does not match the criterion, an Error pointer
  *  is returned.
  *
  * PARAMETERS:
  *  "params"
  *      Address of ComCertSelParams whose SubjAltNames field is used.
  *      Must be non-NULL.
  *  "cert"
  *      Address of Cert that is to be matched. Must be non-NULL.
  *  "pResult"
  *      Address of PKIX_Boolean that returns the match result.
  *  "plContext"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Conditionally Thread Safe
  *      (see Thread Safety Definitions in Programmer's Guide)
  * RETURNS:
  *  Returns NULL if the function succeeds.
  *  Returns a CertSelector Error if the function fails in a non-fatal way.
  *  Returns a Fatal Error if the function fails in an unrecoverable way.
  */
 static PKIX_Error *
 pkix_CertSelector_Match_SubjAltNames(
         PKIX_ComCertSelParams *params,
         PKIX_PL_Cert *cert,
         PKIX_Boolean *pResult,
         void *plContext)
 {
         PKIX_List *subjAltNamesList = NULL;
         PKIX_List *certSubjAltNames = NULL;
         PKIX_PL_GeneralName *name = NULL;
         PKIX_Boolean checkPassed = PKIX_FALSE;
         PKIX_Boolean matchAll = PKIX_TRUE;
         PKIX_UInt32 i, numItems;
         PKIX_UInt32 matchCount = 0;
         PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_SubjAltNames");
         PKIX_NULLCHECK_THREE(params, cert, pResult);
         PKIX_CHECK(PKIX_ComCertSelParams_GetMatchAllSubjAltNames
                     (params, &matchAll, plContext),
                     PKIX_COMCERTSELPARAMSGETMATCHALLSUBJALTNAMESFAILED);
         PKIX_CHECK(PKIX_ComCertSelParams_GetSubjAltNames
                     (params, &subjAltNamesList, plContext),
                     PKIX_COMCERTSELPARAMSGETSUBJALTNAMESFAILED);
         if (subjAltNamesList != NULL) {
             PKIX_CHECK(PKIX_PL_Cert_GetSubjectAltNames
                     (cert, &certSubjAltNames, plContext),
                     PKIX_CERTGETSUBJALTNAMESFAILED);
             if (certSubjAltNames == NULL) {
                 *pResult = PKIX_FALSE;
                 PKIX_ERROR(PKIX_CERTSELECTORMATCHSUBJALTNAMESFAILED);
             }
             PKIX_CHECK(PKIX_List_GetLength
                        (subjAltNamesList, &numItems, plContext),
                        PKIX_LISTGETLENGTHFAILED);
             for (i = 0; i < numItems; i++) {
                 PKIX_CHECK(PKIX_List_GetItem
                            (subjAltNamesList,
                             i,
                             (PKIX_PL_Object **) &name,
                             plContext),
                            PKIX_LISTGETITEMFAILED);
                 PKIX_CHECK(pkix_List_Contains
                            (certSubjAltNames,
                             (PKIX_PL_Object *) name,
                             &checkPassed,
                             plContext),
                            PKIX_LISTCONTAINSFAILED);
                 PKIX_DECREF(name);
                 if (checkPassed == PKIX_TRUE) {
                     if (matchAll == PKIX_FALSE) {
                         /* one match is good enough */
                         matchCount = numItems;
                         break;
                     } else {
                         /* else continue checking next */
                         matchCount++;
                     }
                 }
             }
             if (matchCount != numItems) {
                 *pResult = PKIX_FALSE;
                 PKIX_ERROR(PKIX_CERTSELECTORMATCHSUBJALTNAMESFAILED);
             }
         }
 cleanup:
         PKIX_DECREF(name);
         PKIX_DECREF(certSubjAltNames);
         PKIX_DECREF(subjAltNamesList);
         PKIX_RETURN(CERTSELECTOR);
 }
 /*
  * FUNCTION: pkix_CertSelector_Match_ExtendedKeyUsage
  * DESCRIPTION:
  *
  *  Determines whether the names at ExtKeyUsage in "params" matches with the
  *  ExtKeyUsage pointed to by "cert". If the ExtKeyUsage criterion or
  *  ExtKeyUsage in "cert" is NULL, no checking is done and the Cert is
  *  considered a match. If the Cert does not match, an Error pointer is
  *  returned.
  *
  * PARAMETERS:
  *  "params"
  *      Address of ComCertSelParams whose ExtKeyUsage field is used.
  *      Must be non-NULL.
  *  "cert"
  *      Address of Cert that is to be matched. Must be non-NULL.
  *  "pResult"
  *      Address of PKIX_Boolean that returns the match result.
  *  "plContext"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Conditionally Thread Safe
  *      (see Thread Safety Definitions in Programmer's Guide)
  * RETURNS:
  *  Returns NULL if the function succeeds.
  *  Returns a CertSelector Error if the function fails in a non-fatal way.
  *  Returns a Fatal Error if the function fails in an unrecoverable way.
  */
 static PKIX_Error *
 pkix_CertSelector_Match_ExtendedKeyUsage(
         PKIX_ComCertSelParams *params,
         PKIX_PL_Cert *cert,
         PKIX_Boolean *pResult,
         void *plContext)
 {
         PKIX_List *extKeyUsageList = NULL;
         PKIX_List *certExtKeyUsageList = NULL;
         PKIX_PL_OID *ekuOid = NULL;
         PKIX_Boolean isContained = PKIX_FALSE;
         PKIX_UInt32 numItems = 0;
         PKIX_UInt32 i;
         PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_ExtendedKeyUsage");
         PKIX_NULLCHECK_THREE(params, cert, pResult);
         PKIX_CHECK(PKIX_ComCertSelParams_GetExtendedKeyUsage
                     (params, &extKeyUsageList, plContext),
                     PKIX_COMCERTSELPARAMSGETEXTENDEDKEYUSAGEFAILED);
         if (extKeyUsageList == NULL) {
                 goto cleanup;
         }
         PKIX_CHECK(PKIX_PL_Cert_GetExtendedKeyUsage
                     (cert, &certExtKeyUsageList, plContext),
                     PKIX_CERTGETEXTENDEDKEYUSAGEFAILED);
         if (certExtKeyUsageList != NULL) {
             PKIX_CHECK(PKIX_List_GetLength
                     (extKeyUsageList, &numItems, plContext),
                     PKIX_LISTGETLENGTHFAILED);
             for (i = 0; i < numItems; i++) {
                 PKIX_CHECK(PKIX_List_GetItem
                     (extKeyUsageList, i, (PKIX_PL_Object **)&ekuOid, plContext),
                     PKIX_LISTGETITEMFAILED);
                 PKIX_CHECK(pkix_List_Contains
                     (certExtKeyUsageList,
                     (PKIX_PL_Object *)ekuOid,
                     &isContained,
                     plContext),
                     PKIX_LISTCONTAINSFAILED);
                 PKIX_DECREF(ekuOid);
                 if (isContained != PKIX_TRUE) {
                     *pResult = PKIX_FALSE;
                     PKIX_ERROR(PKIX_CERTSELECTORMATCHEXTENDEDKEYUSAGEFAILED);
                 }
             }
         }
 cleanup:
         PKIX_DECREF(ekuOid);
         PKIX_DECREF(extKeyUsageList);
         PKIX_DECREF(certExtKeyUsageList);
         PKIX_RETURN(CERTSELECTOR);
 }
 /*
  * FUNCTION: pkix_CertSelector_Match_KeyUsage
  * DESCRIPTION:
  *
  *  Determines whether the bits at KeyUsage in "params" matches with the
  *  KeyUsage pointed to by "cert". If the KeyUsage in params is 0
  *  no checking is done and the Cert is considered a match. If the Cert does
  *  not match, an Error pointer is returned.
  *
  * PARAMETERS:
  *  "params"
  *      Address of ComCertSelParams whose ExtKeyUsage field is used.
  *      Must be non-NULL.
  *  "cert"
  *      Address of Cert that is to be matched. Must be non-NULL.
  *  "pResult"
  *      Address of PKIX_Boolean that returns the match result.
  *  "plContext"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Conditionally Thread Safe
  *      (see Thread Safety Definitions in Programmer's Guide)
  * RETURNS:
  *  Returns NULL if the function succeeds.
  *  Returns a CertSelector Error if the function fails in a non-fatal way.
  *  Returns a Fatal Error if the function fails in an unrecoverable way.
  */
 static PKIX_Error *
 pkix_CertSelector_Match_KeyUsage(
         PKIX_ComCertSelParams *params,
         PKIX_PL_Cert *cert,
         PKIX_Boolean *pResult,
         void *plContext)
 {
         PKIX_UInt32 keyUsage = 0;
         PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_KeyUsage");
         PKIX_NULLCHECK_THREE(params, cert, pResult);
         PKIX_CHECK(PKIX_ComCertSelParams_GetKeyUsage
                     (params, &keyUsage, plContext),
                     PKIX_COMCERTSELPARAMSGETKEYUSAGEFAILED);
         if (keyUsage != 0) {
             PKIX_CHECK(PKIX_PL_Cert_VerifyKeyUsage
                         (cert, keyUsage, plContext),
                         PKIX_CERTVERIFYKEYUSAGEFAILED);
         }
 cleanup:
         if (PKIX_ERROR_RECEIVED) {
             *pResult = PKIX_FALSE;
         }
         PKIX_RETURN(CERTSELECTOR);
 }
 /*
  * FUNCTION: pkix_CertSelector_Match_SubjKeyId
  * DESCRIPTION:
  *
  *  Determines whether the bytes at subjKeyId in "params" matches with the
  *  Subject Key Identifier pointed to by "cert". If the subjKeyId in params is
  *  set to NULL or the Cert doesn't have a Subject Key Identifier, no checking
  *  is done and the Cert is considered a match. If the Cert does not match, an
  *  Error pointer is returned.
  *
  * PARAMETERS:
  *  "params"
  *      Address of ComCertSelParams whose subjKeyId field is used.
  *      Must be non-NULL.
  *  "cert"
  *      Address of Cert that is to be matched. Must be non-NULL.
  *  "pResult"
  *      Address of PKIX_Boolean that returns the match result.
  *  "plContext"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Conditionally Thread Safe
  *      (see Thread Safety Definitions in Programmer's Guide)
  * RETURNS:
  *  Returns NULL if the function succeeds.
  *  Returns a CertSelector Error if the function fails in a non-fatal way.
  *  Returns a Fatal Error if the function fails in an unrecoverable way.
  */
 static PKIX_Error *
 pkix_CertSelector_Match_SubjKeyId(
         PKIX_ComCertSelParams *params,
         PKIX_PL_Cert *cert,
         PKIX_Boolean *pResult,
         void *plContext)
 {
         PKIX_PL_ByteArray *selSubjKeyId = NULL;
         PKIX_PL_ByteArray *certSubjKeyId = NULL;
         PKIX_Boolean equals = PKIX_FALSE;
         PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_SubjKeyId");
         PKIX_NULLCHECK_THREE(params, cert, pResult);
         PKIX_CHECK(PKIX_ComCertSelParams_GetSubjKeyIdentifier
                     (params, &selSubjKeyId, plContext),
                     PKIX_COMCERTSELPARAMSGETSUBJKEYIDENTIFIERFAILED);
         if (selSubjKeyId != NULL) {
                 PKIX_CHECK(PKIX_PL_Cert_GetSubjectKeyIdentifier
                     (cert, &certSubjKeyId, plContext),
                     PKIX_CERTGETSUBJECTKEYIDENTIFIERFAILED);
                 if (certSubjKeyId == NULL) {
                     goto cleanup;
                 }
                 PKIX_CHECK(PKIX_PL_Object_Equals
                            ((PKIX_PL_Object *)selSubjKeyId,
                             (PKIX_PL_Object *)certSubjKeyId,
                             &equals,
                             plContext),
                            PKIX_OBJECTEQUALSFAILED);
                 if (equals == PKIX_FALSE) {
                     *pResult = PKIX_FALSE;
                     PKIX_ERROR(PKIX_CERTSELECTORMATCHSUBJKEYIDFAILED);
                 }
         }
 cleanup:
         PKIX_DECREF(selSubjKeyId);
         PKIX_DECREF(certSubjKeyId);
         PKIX_RETURN(CERTSELECTOR);
 }
 /*
  * FUNCTION: pkix_CertSelector_Match_AuthKeyId
  * DESCRIPTION:
  *
  *  Determines whether the bytes at authKeyId in "params" matches with the
  *  Authority Key Identifier pointed to by "cert". If the authKeyId in params
  *  is set to NULL, no checking is done and the Cert is considered a match. If
  *  the Cert does not match, an Error pointer is returned.
  *
  * PARAMETERS:
  *  "params"
  *      Address of ComCertSelParams whose authKeyId field is used.
  *      Must be non-NULL.
  *  "cert"
  *      Address of Cert that is to be matched. Must be non-NULL.
  *  "pResult"
  *      Address of PKIX_Boolean that returns the match result.
  *  "plContext"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Conditionally Thread Safe
  *      (see Thread Safety Definitions in Programmer's Guide)
  * RETURNS:
  *  Returns NULL if the function succeeds.
  *  Returns a CertSelector Error if the function fails in a non-fatal way.
  *  Returns a Fatal Error if the function fails in an unrecoverable way.
  */
 static PKIX_Error *
 pkix_CertSelector_Match_AuthKeyId(
         PKIX_ComCertSelParams *params,
         PKIX_PL_Cert *cert,
         PKIX_Boolean *pResult,
         void *plContext)
 {
         PKIX_PL_ByteArray *selAuthKeyId = NULL;
         PKIX_PL_ByteArray *certAuthKeyId = NULL;
         PKIX_Boolean equals = PKIX_FALSE;
         PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_AuthKeyId");
         PKIX_NULLCHECK_THREE(params, cert, pResult);
         PKIX_CHECK(PKIX_ComCertSelParams_GetAuthorityKeyIdentifier
                     (params, &selAuthKeyId, plContext),
                     PKIX_COMCERTSELPARAMSGETAUTHORITYKEYIDENTIFIERFAILED);
         if (selAuthKeyId != NULL) {
                 PKIX_CHECK(PKIX_PL_Cert_GetAuthorityKeyIdentifier
                     (cert, &certAuthKeyId, plContext),
                     PKIX_CERTGETAUTHORITYKEYIDENTIFIERFAILED);
                 if (certAuthKeyId == NULL) {
                     *pResult = PKIX_FALSE;
                     PKIX_ERROR(PKIX_CERTSELECTORMATCHAUTHKEYIDFAILED);
                 }
                 PKIX_CHECK(PKIX_PL_Object_Equals
                            ((PKIX_PL_Object *)selAuthKeyId,
                             (PKIX_PL_Object *)certAuthKeyId,
                             &equals,
                             plContext),
                            PKIX_OBJECTEQUALSFAILED);
                 if (equals != PKIX_TRUE) {
                     *pResult = PKIX_FALSE;
                     PKIX_ERROR(PKIX_CERTSELECTORMATCHAUTHKEYIDFAILED);
                 }
         }
 cleanup:
         PKIX_DECREF(selAuthKeyId);
         PKIX_DECREF(certAuthKeyId);
         PKIX_RETURN(CERTSELECTOR);
 }
 /*
  * FUNCTION: pkix_CertSelector_Match_SubjPKAlgId
  * DESCRIPTION:
  *
  *  Determines whether the OID at subjPKAlgId in "params" matches with the
  *  Subject Public Key Alg Id pointed to by "cert". If the subjPKAlgId in params
  *  is set to NULL, no checking is done and the Cert is considered a match. If
  *  the Cert does not match, an Error pointer is returned.
  *
  * PARAMETERS:
  *  "params"
  *      Address of ComCertSelParams whose subjPKAlgId field is used.
  *      Must be non-NULL.
  *  "cert"
  *      Address of Cert that is to be matched. Must be non-NULL.
  *  "pResult"
  *      Address of PKIX_Boolean that returns the match result.
  *  "plContext"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Conditionally Thread Safe
  *      (see Thread Safety Definitions in Programmer's Guide)
  * RETURNS:
  *  Returns NULL if the function succeeds.
  *  Returns a CertSelector Error if the function fails in a non-fatal way.
  *  Returns a Fatal Error if the function fails in an unrecoverable way.
  */
 static PKIX_Error *
 pkix_CertSelector_Match_SubjPKAlgId(
         PKIX_ComCertSelParams *params,
         PKIX_PL_Cert *cert,
         PKIX_Boolean *pResult,
         void *plContext)
 {
         PKIX_PL_OID *selPKAlgId = NULL;
         PKIX_PL_OID *certPKAlgId = NULL;
         PKIX_Boolean equals = PKIX_FALSE;
         PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_SubjPKAlgId");
         PKIX_NULLCHECK_THREE(params, cert, pResult);
         PKIX_CHECK(PKIX_ComCertSelParams_GetSubjPKAlgId
                     (params, &selPKAlgId, plContext),
                     PKIX_COMCERTSELPARAMSGETSUBJPKALGIDFAILED);
         if (selPKAlgId != NULL) {
                 PKIX_CHECK(PKIX_PL_Cert_GetSubjectPublicKeyAlgId
                     (cert, &certPKAlgId, plContext),
                     PKIX_CERTGETSUBJECTPUBLICKEYALGIDFAILED);
                 if (certPKAlgId != NULL) {
                     *pResult = PKIX_FALSE;
                     PKIX_ERROR(PKIX_CERTSELECTORMATCHSUBJPKALGIDFAILED);
                 }
                 PKIX_CHECK(PKIX_PL_Object_Equals
                            ((PKIX_PL_Object *)selPKAlgId,
                             (PKIX_PL_Object *)certPKAlgId,
                             &equals,
                             plContext),
                            PKIX_OBJECTEQUALSFAILED);
                 if (equals != PKIX_TRUE) {
                     *pResult = PKIX_FALSE;
                     PKIX_ERROR(PKIX_CERTSELECTORMATCHSUBJPKALGIDFAILED);
                 }
         }
 cleanup:
         PKIX_DECREF(selPKAlgId);
         PKIX_DECREF(certPKAlgId);
         PKIX_RETURN(CERTSELECTOR);
 }
 /*
  * FUNCTION: pkix_CertSelector_Match_SubjPubKey
  * DESCRIPTION:
  *
  *  Determines whether the key at subjPubKey in "params" matches with the
  *  Subject Public Key pointed to by "cert". If the subjPubKey in params
  *  is set to NULL, no checking is done and the Cert is considered a match. If
  *  the Cert does not match, an Error pointer is returned.
  *
  * PARAMETERS:
  *  "params"
  *      Address of ComCertSelParams whose subPubKey field is used.
  *      Must be non-NULL.
  *  "cert"
  *      Address of Cert that is to be matched. Must be non-NULL.
  *  "pResult"
  *      Address of PKIX_Boolean that returns the match result.
  *  "plContext"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Conditionally Thread Safe
  *      (see Thread Safety Definitions in Programmer's Guide)
  * RETURNS:
  *  Returns NULL if the function succeeds.
  *  Returns a CertSelector Error if the function fails in a non-fatal way.
  *  Returns a Fatal Error if the function fails in an unrecoverable way.
  */
 static PKIX_Error *
 pkix_CertSelector_Match_SubjPubKey(
         PKIX_ComCertSelParams *params,
         PKIX_PL_Cert *cert,
         PKIX_Boolean *pResult,
         void *plContext)
 {
         PKIX_PL_PublicKey *selPK = NULL;
         PKIX_PL_PublicKey *certPK = NULL;
         PKIX_Boolean equals = PKIX_FALSE;
         PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_SubjPubKey");
         PKIX_NULLCHECK_THREE(params, cert, pResult);
         PKIX_CHECK(PKIX_ComCertSelParams_GetSubjPubKey
                     (params, &selPK, plContext),
                     PKIX_COMCERTSELPARAMSGETSUBJPUBKEYFAILED);
         if (selPK != NULL) {
                 PKIX_CHECK(PKIX_PL_Cert_GetSubjectPublicKey
                     (cert, &certPK, plContext),
                     PKIX_CERTGETSUBJECTPUBLICKEYFAILED);
                 if (certPK == NULL) {
                     *pResult = PKIX_FALSE;
                     PKIX_ERROR(PKIX_CERTSELECTORMATCHSUBJPUBKEYFAILED);
                 }
                 PKIX_CHECK(PKIX_PL_Object_Equals
                            ((PKIX_PL_Object *)selPK,
                             (PKIX_PL_Object *)certPK,
                             &equals,
                             plContext),
                            PKIX_OBJECTEQUALSFAILED);
                 if (equals != PKIX_TRUE) {
                     *pResult = PKIX_FALSE;
                     PKIX_ERROR(PKIX_CERTSELECTORMATCHSUBJPUBKEYFAILED);
                 }
         }
 cleanup:
         PKIX_DECREF(selPK);
         PKIX_DECREF(certPK);
         PKIX_RETURN(CERTSELECTOR);
 }
 /*
  * FUNCTION: pkix_CertSelector_DefaultMatch
  * DESCRIPTION:
  *
  *  This default match function determines whether the specified Cert pointed
  *  to by "cert" matches the criteria of the CertSelector pointed to by
  *  "selector". If the Cert does not match the CertSelector's
  *  criteria, an error will be thrown.
  *
  *  This default match function understands how to process the most common
  *  parameters. Any common parameter that is not set is assumed to be disabled,
  *  which means this function will select all certificates without regard to
  *  that particular disabled parameter. For example, if the SerialNumber
  *  parameter is not set, this function will not filter out any certificate
  *  based on its serial number. As such, if no parameters are set, all are
  *  disabled and any certificate will match. If a parameter is disabled, its
  *  associated PKIX_ComCertSelParams_Get* function returns a default value.
  *  That value is -1 for PKIX_ComCertSelParams_GetBasicConstraints and
  *  PKIX_ComCertSelParams_GetVersion, 0 for PKIX_ComCertSelParams_GetKeyUsage,
  *  and NULL for all other Get functions.
  *
  * PARAMETERS:
  *  "selector"
  *      Address of CertSelector whose MatchCallback logic and parameters are
  *      to be used. Must be non-NULL.
  *  "cert"
  *      Address of Cert that is to be matched using "selector".
  *      Must be non-NULL.
  *  "plContext"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Conditionally Thread Safe
  *      (see Thread Safety Definitions in Programmer's Guide)
  * RETURNS:
  *  Returns NULL if the function succeeds.
  *  Returns a CertSelector Error if the function fails in a non-fatal way.
  *  Returns a Fatal Error if the function fails in an unrecoverable way.
  */
 static PKIX_Error *
 pkix_CertSelector_DefaultMatch(
         PKIX_CertSelector *selector,
         PKIX_PL_Cert *cert,
         void *plContext)
 {
         PKIX_ComCertSelParams *params = NULL;
         PKIX_PL_X500Name *certSubject = NULL;
         PKIX_PL_X500Name *selSubject = NULL;
         PKIX_PL_X500Name *certIssuer = NULL;
         PKIX_PL_X500Name *selIssuer = NULL;
         PKIX_PL_BigInt *certSerialNumber = NULL;
         PKIX_PL_BigInt *selSerialNumber = NULL;
         PKIX_PL_Cert *selCert = NULL;
         PKIX_PL_Date *selDate = NULL;
         PKIX_UInt32 selVersion = 0xFFFFFFFF;
         PKIX_UInt32 certVersion = 0;
         PKIX_Boolean result = PKIX_TRUE;
         PKIX_Boolean isLeafCert = PKIX_TRUE;
 #ifdef PKIX_BUILDDEBUG
         PKIX_PL_String *certString = NULL;
         void *certAscii = NULL;
         PKIX_UInt32 certAsciiLen;
 #endif
         PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_DefaultMatch");
         PKIX_NULLCHECK_TWO(selector, cert);
         PKIX_INCREF(selector->params);
         params = selector->params;
         /* Are we looking for CAs? */
         PKIX_CHECK(PKIX_ComCertSelParams_GetLeafCertFlag
                     (params, &isLeafCert, plContext),
                     PKIX_COMCERTSELPARAMSGETLEAFCERTFLAGFAILED);
         if (params == NULL){
                 goto cleanup;
         }
         PKIX_CHECK(PKIX_ComCertSelParams_GetVersion
                     (params, &selVersion, plContext),
                     PKIX_COMCERTSELPARAMSGETVERSIONFAILED);
         if (selVersion != 0xFFFFFFFF){
                 PKIX_CHECK(PKIX_PL_Cert_GetVersion
                             (cert, &certVersion, plContext),
                             PKIX_CERTGETVERSIONFAILED);
                 if (selVersion != certVersion) {
                         PKIX_ERROR(PKIX_CERTSELECTORMATCHCERTVERSIONFAILED);
                 }
         }
         PKIX_CHECK(PKIX_ComCertSelParams_GetSubject
                     (params, &selSubject, plContext),
                     PKIX_COMCERTSELPARAMSGETSUBJECTFAILED);
         if (selSubject){
                 PKIX_CHECK(PKIX_PL_Cert_GetSubject
                             (cert, &certSubject, plContext),
                             PKIX_CERTGETSUBJECTFAILED);
                 if (certSubject){
                         PKIX_CHECK(PKIX_PL_X500Name_Match
                             (selSubject, certSubject, &result, plContext),
                             PKIX_X500NAMEMATCHFAILED);
                         if (result == PKIX_FALSE){
                             PKIX_ERROR(PKIX_CERTSELECTORMATCHCERTSUBJECTFAILED);
                         }
                 } else { /* cert has no subject */
                         PKIX_ERROR(PKIX_CERTSELECTORMATCHCERTSUBJECTFAILED);
                 }
         }
         PKIX_CHECK(PKIX_ComCertSelParams_GetIssuer
                     (params, &selIssuer, plContext),
                     PKIX_COMCERTSELPARAMSGETISSUERFAILED);
         if (selIssuer){
                 PKIX_CHECK(PKIX_PL_Cert_GetIssuer
                             (cert, &certIssuer, plContext),
                             PKIX_CERTGETISSUERFAILED);
                 PKIX_CHECK(PKIX_PL_X500Name_Match
                             (selIssuer, certIssuer, &result, plContext),
                             PKIX_X500NAMEMATCHFAILED);
                 if (result == PKIX_FALSE){
                         PKIX_ERROR(PKIX_CERTSELECTORMATCHCERTISSUERFAILED);
                 }
         }
         PKIX_CHECK(PKIX_ComCertSelParams_GetSerialNumber
                     (params, &selSerialNumber, plContext),
                     PKIX_COMCERTSELPARAMSGETSERIALNUMBERFAILED);
         if (selSerialNumber){
                 PKIX_CHECK(PKIX_PL_Cert_GetSerialNumber
                             (cert, &certSerialNumber, plContext),
                             PKIX_CERTGETSERIALNUMBERFAILED);
                 PKIX_CHECK(PKIX_PL_Object_Equals
                             ((PKIX_PL_Object *)selSerialNumber,
                             (PKIX_PL_Object *)certSerialNumber,
                             &result,
                             plContext),
                             PKIX_OBJECTEQUALSFAILED);
                 if (result == PKIX_FALSE){
                         PKIX_ERROR(PKIX_CERTSELECTORMATCHCERTSERIALNUMFAILED);
                 }
         }
         PKIX_CHECK(PKIX_ComCertSelParams_GetCertificate
                     (params, &selCert, plContext),
                     PKIX_COMCERTSELPARAMSGETCERTIFICATEFAILED);
         if (selCert){
                 PKIX_CHECK(PKIX_PL_Object_Equals
                             ((PKIX_PL_Object *) selCert,
                             (PKIX_PL_Object *) cert,
                             &result,
                             plContext),
                             PKIX_OBJECTEQUALSFAILED);
                 if (result == PKIX_FALSE){
                         PKIX_ERROR(PKIX_CERTSELECTORMATCHCERTOBJECTFAILED);
                 }
         }
         PKIX_CHECK(PKIX_ComCertSelParams_GetCertificateValid
                     (params, &selDate, plContext),
                     PKIX_COMCERTSELPARAMSGETCERTIFICATEVALIDFAILED);
         if (selDate){
                 PKIX_CHECK(PKIX_PL_Cert_CheckValidity
                             (cert, selDate, plContext),
                             PKIX_CERTCHECKVALIDITYFAILED);
         }
         PKIX_CHECK(pkix_CertSelector_Match_BasicConstraint
                     (params, cert, &result, plContext),
                     PKIX_CERTSELECTORMATCHBASICCONSTRAINTFAILED);
         PKIX_CHECK(pkix_CertSelector_Match_Policies
                     (params, cert, &result, plContext),
                     PKIX_CERTSELECTORMATCHPOLICIESFAILED);
         PKIX_CHECK(pkix_CertSelector_Match_CertificateValid
                     (params, cert, &result, plContext),
                     PKIX_CERTSELECTORMATCHCERTIFICATEVALIDFAILED);
         PKIX_CHECK(pkix_CertSelector_Match_NameConstraints
                     (params, cert, &result, plContext),
                     PKIX_CERTSELECTORMATCHNAMECONSTRAINTSFAILED);
         PKIX_CHECK(pkix_CertSelector_Match_PathToNames
                     (params, cert, &result, plContext),
                     PKIX_CERTSELECTORMATCHPATHTONAMESFAILED);
         PKIX_CHECK(pkix_CertSelector_Match_SubjAltNames
                     (params, cert, &result, plContext),
                     PKIX_CERTSELECTORMATCHSUBJALTNAMESFAILED);
         /* Check key usage and cert type based on certificate usage. */
         PKIX_CHECK(PKIX_PL_Cert_VerifyCertAndKeyType(cert, !isLeafCert,
                                                      plContext),
                    PKIX_CERTVERIFYCERTTYPEFAILED);
         /* Next two check are for user supplied additional KU and EKU. */
         PKIX_CHECK(pkix_CertSelector_Match_ExtendedKeyUsage
                     (params, cert, &result, plContext),
                     PKIX_CERTSELECTORMATCHEXTENDEDKEYUSAGEFAILED);
         PKIX_CHECK(pkix_CertSelector_Match_KeyUsage
                     (params, cert, &result, plContext),
                     PKIX_CERTSELECTORMATCHKEYUSAGEFAILED);
         PKIX_CHECK(pkix_CertSelector_Match_SubjKeyId
                     (params, cert, &result, plContext),
                     PKIX_CERTSELECTORMATCHSUBJKEYIDFAILED);
         PKIX_CHECK(pkix_CertSelector_Match_AuthKeyId
                     (params, cert, &result, plContext),
                     PKIX_CERTSELECTORMATCHAUTHKEYIDFAILED);
         PKIX_CHECK(pkix_CertSelector_Match_SubjPKAlgId
                     (params, cert, &result, plContext),
                     PKIX_CERTSELECTORMATCHSUBJPKALGIDFAILED);
         PKIX_CHECK(pkix_CertSelector_Match_SubjPubKey
                     (params, cert, &result, plContext),
                     PKIX_CERTSELECTORMATCHSUBJPUBKEYFAILED);
         /* if we reach here, the cert has successfully matched criteria */
 #ifdef PKIX_BUILDDEBUG
         PKIX_CHECK(pkix_pl_Cert_ToString_Helper
                     (cert, PKIX_TRUE, &certString, plContext),
                     PKIX_CERTTOSTRINGHELPERFAILED);
         PKIX_CHECK(PKIX_PL_String_GetEncoded
                 (certString,
                 PKIX_ESCASCII,
                 &certAscii,
                 &certAsciiLen,
                 plContext),
                 PKIX_STRINGGETENCODEDFAILED);
         PKIX_CERTSELECTOR_DEBUG_ARG("Cert Selected:\n%s\n", certAscii);
 #endif
 cleanup:
 #ifdef PKIX_BUILDDEBUG
         PKIX_DECREF(certString);
         PKIX_FREE(certAscii);
 #endif
         PKIX_DECREF(certSubject);
         PKIX_DECREF(selSubject);
         PKIX_DECREF(certIssuer);
         PKIX_DECREF(selIssuer);
         PKIX_DECREF(certSerialNumber);
         PKIX_DECREF(selSerialNumber);
         PKIX_DECREF(selCert);
         PKIX_DECREF(selDate);
         PKIX_DECREF(params);
         PKIX_RETURN(CERTSELECTOR);
 }
 /*
  * FUNCTION: pkix_CertSelector_RegisterSelf
  * DESCRIPTION:
  *  Registers PKIX_CERTSELECTOR_TYPE and its related functions with
  *  systemClasses[]
  * THREAD SAFETY:
  *  Not Thread Safe - for performance and complexity reasons
  *
  *  Since this function is only called by PKIX_PL_Initialize, which should
  *  only be called once, it is acceptable that this function is not
  *  thread-safe.
  */
 PKIX_Error *
 pkix_CertSelector_RegisterSelf(void *plContext)
 {
         extern pkix_ClassTable_Entry systemClasses[PKIX_NUMTYPES];
         pkix_ClassTable_Entry entry;
         PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_RegisterSelf");
         entry.description = "CertSelector";
         entry.objCounter = 0;
         entry.typeObjectSize = sizeof(PKIX_CertSelector);
         entry.destructor = pkix_CertSelector_Destroy;
         entry.equalsFunction = NULL;
         entry.hashcodeFunction = NULL;
         entry.toStringFunction = NULL;
         entry.comparator = NULL;
         entry.duplicateFunction = pkix_CertSelector_Duplicate;
         systemClasses[PKIX_CERTSELECTOR_TYPE] = entry;
         PKIX_RETURN(CERTSELECTOR);
 }
 /* --Public-Functions--------------------------------------------- */
 /*
  * FUNCTION: PKIX_CertSelector_Create (see comments in pkix_certsel.h)
  */
 PKIX_Error *
 PKIX_CertSelector_Create(
         PKIX_CertSelector_MatchCallback callback,
         PKIX_PL_Object *certSelectorContext,
         PKIX_CertSelector **pSelector,
         void *plContext)
 {
         PKIX_CertSelector *selector = NULL;
         PKIX_ENTER(CERTSELECTOR, "PKIX_CertSelector_Create");
         PKIX_NULLCHECK_ONE(pSelector);
         PKIX_CHECK(PKIX_PL_Object_Alloc
                     (PKIX_CERTSELECTOR_TYPE,
                     sizeof (PKIX_CertSelector),
                     (PKIX_PL_Object **)&selector,
                     plContext),
                     PKIX_COULDNOTCREATECERTSELECTOROBJECT);
         /*
          * if user specified a particular match callback, we use that one.
          * otherwise, we use the default match implementation which
          * understands how to process PKIX_ComCertSelParams
          */
         if (callback){
                 selector->matchCallback = callback;
         } else {
                 selector->matchCallback = pkix_CertSelector_DefaultMatch;
         }
         /* initialize other fields */
         selector->params = NULL;
         PKIX_INCREF(certSelectorContext);
         selector->context = certSelectorContext;
         *pSelector = selector;
 cleanup:
         PKIX_RETURN(CERTSELECTOR);
 }
 /*
  * FUNCTION: PKIX_CertSelector_GetMatchCallback
  *      (see comments in pkix_certsel.h)
  */
 PKIX_Error *
 PKIX_CertSelector_GetMatchCallback(
         PKIX_CertSelector *selector,
         PKIX_CertSelector_MatchCallback *pCallback,
         void *plContext)
 {
         PKIX_ENTER(CERTSELECTOR, "PKIX_CertSelector_GetMatchCallback");
         PKIX_NULLCHECK_TWO(selector, pCallback);
         *pCallback = selector->matchCallback;
         PKIX_RETURN(CERTSELECTOR);
 }
 /*
  * FUNCTION: PKIX_CertSelector_GetCertSelectorContext
  *      (see comments in pkix_certsel.h)
  */
 PKIX_Error *
 PKIX_CertSelector_GetCertSelectorContext(
         PKIX_CertSelector *selector,
         PKIX_PL_Object **pCertSelectorContext,
         void *plContext)
 {
         PKIX_ENTER(CERTSELECTOR, "PKIX_CertSelector_GetCertSelectorContext");
         PKIX_NULLCHECK_TWO(selector, pCertSelectorContext);
         PKIX_INCREF(selector->context);
         *pCertSelectorContext = selector->context;
 cleanup:
         PKIX_RETURN(CERTSELECTOR);
 }
 /*
  * FUNCTION: PKIX_CertSelector_GetCommonCertSelectorParams
  *      (see comments in pkix_certsel.h)
  */
 PKIX_Error *
 PKIX_CertSelector_GetCommonCertSelectorParams(
         PKIX_CertSelector *selector,
         PKIX_ComCertSelParams **pParams,
         void *plContext)
 {
         PKIX_ENTER(CERTSELECTOR,
                     "PKIX_CertSelector_GetCommonCertSelectorParams");
         PKIX_NULLCHECK_TWO(selector, pParams);
         PKIX_INCREF(selector->params);
         *pParams = selector->params;
 cleanup:
         PKIX_RETURN(CERTSELECTOR);
 }
 /*
  * FUNCTION: PKIX_CertSelector_SetCommonCertSelectorParams
  *      (see comments in pkix_certsel.h)
  */
 PKIX_Error *
 PKIX_CertSelector_SetCommonCertSelectorParams(
         PKIX_CertSelector *selector,
         PKIX_ComCertSelParams *params,
         void *plContext)
 {
         PKIX_ENTER(CERTSELECTOR,
                     "PKIX_CertSelector_SetCommonCertSelectorParams");
         PKIX_NULLCHECK_ONE(selector);
         PKIX_DECREF(selector->params);
         PKIX_INCREF(params);
         selector->params = params;
         PKIX_CHECK(PKIX_PL_Object_InvalidateCache
                     ((PKIX_PL_Object *)selector, plContext),
                     PKIX_OBJECTINVALIDATECACHEFAILED);
 cleanup:
         PKIX_RETURN(CERTSELECTOR);
 }
 /*
  * FUNCTION: pkix_CertSelector_Select
  * DESCRIPTION:
  *
  *  This function applies the selector pointed to by "selector" to each Cert,
  *  in turn, in the List pointed to by "before", and creates a List containing
  *  all the Certs that matched, or passed the selection process, storing that
  *  List at "pAfter". If no Certs match, an empty List is stored at "pAfter".
  *
  *  The List returned in "pAfter" is immutable.
  *
  * PARAMETERS:
  *  "selector"
  *      Address of CertSelelector to be applied to the List. Must be non-NULL.
  *  "before"
  *      Address of List that is to be filtered. Must be non-NULL.
  *  "pAfter"
  *      Address at which resulting List, possibly empty, is stored. Must be
  *      non-NULL.
  *  "plContext"
  *      Platform-specific context pointer.
  * THREAD SAFETY:
  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
  * RETURNS:
  *  Returns NULL if the function succeeds.
  *  Returns a CertSelector Error if the function fails in a non-fatal way.
  *  Returns a Fatal Error if the function fails in an unrecoverable way.
  */
 PKIX_Error *
 pkix_CertSelector_Select(
 	PKIX_CertSelector *selector,
 	PKIX_List *before,
 	PKIX_List **pAfter,
 	void *plContext)
 {
 	PKIX_UInt32 numBefore = 0;
 	PKIX_UInt32 i = 0;
 	PKIX_List *filtered = NULL;
 	PKIX_PL_Cert *candidate = NULL;
         PKIX_ENTER(CERTSELECTOR, "PKIX_CertSelector_Select");
         PKIX_NULLCHECK_THREE(selector, before, pAfter);
         PKIX_CHECK(PKIX_List_Create(&filtered, plContext),
                 PKIX_LISTCREATEFAILED);
         PKIX_CHECK(PKIX_List_GetLength(before, &numBefore, plContext),
                 PKIX_LISTGETLENGTHFAILED);
         for (i = 0; i < numBefore; i++) {
                 PKIX_CHECK(PKIX_List_GetItem
                         (before, i, (PKIX_PL_Object **)&candidate, plContext),
                         PKIX_LISTGETITEMFAILED);
                 PKIX_CHECK_ONLY_FATAL(selector->matchCallback
                         (selector, candidate, plContext),
                         PKIX_CERTSELECTORMATCHCALLBACKFAILED);
                 if (!(PKIX_ERROR_RECEIVED)) {
                         PKIX_CHECK_ONLY_FATAL(PKIX_List_AppendItem
                                 (filtered,
                                 (PKIX_PL_Object *)candidate,
                                 plContext),
                                 PKIX_LISTAPPENDITEMFAILED);
                 }
                 pkixTempErrorReceived = PKIX_FALSE;
                 PKIX_DECREF(candidate);
         }
         PKIX_CHECK(PKIX_List_SetImmutable(filtered, plContext),
                 PKIX_LISTSETIMMUTABLEFAILED);
         /* Don't throw away the list if one Cert was bad! */
         pkixTempErrorReceived = PKIX_FALSE;
         *pAfter = filtered;
         filtered = NULL;
 cleanup:
         PKIX_DECREF(filtered);
         PKIX_DECREF(candidate);
         PKIX_RETURN(CERTSELECTOR);
 }

The Tor Browser / annotate

security/nss/lib/libpkix/pkix/certsel/pkix_certselector.c@b8a032363ba2 (annotated)

security/nss/lib/libpkix/pkix/certsel/pkix_certselector.c