The Tor Browser / file comparison
comparison: security/manager/ssl/src/nsNSSCertTrust.cpp
security/manager/ssl/src/nsNSSCertTrust.cpp
- changeset 0
- 6474c204b198
equal
deleted
inserted
replaced
| -1:000000000000 | 0:0498ab72e8da |
|---|---|
| 1 /* This Source Code Form is subject to the terms of the Mozilla Public | |
| 2 * License, v. 2.0. If a copy of the MPL was not distributed with this | |
| 3 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ | |
| 4 | |
| 5 #include "nsNSSCertTrust.h" | |
| 6 | |
| 7 void | |
| 8 nsNSSCertTrust::AddCATrust(bool ssl, bool email, bool objSign) | |
| 9 { | |
| 10 if (ssl) { | |
| 11 addTrust(&mTrust.sslFlags, CERTDB_TRUSTED_CA); | |
| 12 addTrust(&mTrust.sslFlags, CERTDB_TRUSTED_CLIENT_CA); | |
| 13 } | |
| 14 if (email) { | |
| 15 addTrust(&mTrust.emailFlags, CERTDB_TRUSTED_CA); | |
| 16 addTrust(&mTrust.emailFlags, CERTDB_TRUSTED_CLIENT_CA); | |
| 17 } | |
| 18 if (objSign) { | |
| 19 addTrust(&mTrust.objectSigningFlags, CERTDB_TRUSTED_CA); | |
| 20 addTrust(&mTrust.objectSigningFlags, CERTDB_TRUSTED_CLIENT_CA); | |
| 21 } | |
| 22 } | |
| 23 | |
| 24 void | |
| 25 nsNSSCertTrust::AddPeerTrust(bool ssl, bool email, bool objSign) | |
| 26 { | |
| 27 if (ssl) | |
| 28 addTrust(&mTrust.sslFlags, CERTDB_TRUSTED); | |
| 29 if (email) | |
| 30 addTrust(&mTrust.emailFlags, CERTDB_TRUSTED); | |
| 31 if (objSign) | |
| 32 addTrust(&mTrust.objectSigningFlags, CERTDB_TRUSTED); | |
| 33 } | |
| 34 | |
| 35 nsNSSCertTrust::nsNSSCertTrust() | |
| 36 { | |
| 37 memset(&mTrust, 0, sizeof(CERTCertTrust)); | |
| 38 } | |
| 39 | |
| 40 nsNSSCertTrust::nsNSSCertTrust(unsigned int ssl, | |
| 41 unsigned int email, | |
| 42 unsigned int objsign) | |
| 43 { | |
| 44 memset(&mTrust, 0, sizeof(CERTCertTrust)); | |
| 45 addTrust(&mTrust.sslFlags, ssl); | |
| 46 addTrust(&mTrust.emailFlags, email); | |
| 47 addTrust(&mTrust.objectSigningFlags, objsign); | |
| 48 } | |
| 49 | |
| 50 nsNSSCertTrust::nsNSSCertTrust(CERTCertTrust *t) | |
| 51 { | |
| 52 if (t) | |
| 53 memcpy(&mTrust, t, sizeof(CERTCertTrust)); | |
| 54 else | |
| 55 memset(&mTrust, 0, sizeof(CERTCertTrust)); | |
| 56 } | |
| 57 | |
| 58 nsNSSCertTrust::~nsNSSCertTrust() | |
| 59 { | |
| 60 } | |
| 61 | |
| 62 void | |
| 63 nsNSSCertTrust::SetSSLTrust(bool peer, bool tPeer, | |
| 64 bool ca, bool tCA, bool tClientCA, | |
| 65 bool user, bool warn) | |
| 66 { | |
| 67 mTrust.sslFlags = 0; | |
| 68 if (peer || tPeer) | |
| 69 addTrust(&mTrust.sslFlags, CERTDB_TERMINAL_RECORD); | |
| 70 if (tPeer) | |
| 71 addTrust(&mTrust.sslFlags, CERTDB_TRUSTED); | |
| 72 if (ca || tCA) | |
| 73 addTrust(&mTrust.sslFlags, CERTDB_VALID_CA); | |
| 74 if (tClientCA) | |
| 75 addTrust(&mTrust.sslFlags, CERTDB_TRUSTED_CLIENT_CA); | |
| 76 if (tCA) | |
| 77 addTrust(&mTrust.sslFlags, CERTDB_TRUSTED_CA); | |
| 78 if (user) | |
| 79 addTrust(&mTrust.sslFlags, CERTDB_USER); | |
| 80 if (warn) | |
| 81 addTrust(&mTrust.sslFlags, CERTDB_SEND_WARN); | |
| 82 } | |
| 83 | |
| 84 void | |
| 85 nsNSSCertTrust::SetEmailTrust(bool peer, bool tPeer, | |
| 86 bool ca, bool tCA, bool tClientCA, | |
| 87 bool user, bool warn) | |
| 88 { | |
| 89 mTrust.emailFlags = 0; | |
| 90 if (peer || tPeer) | |
| 91 addTrust(&mTrust.emailFlags, CERTDB_TERMINAL_RECORD); | |
| 92 if (tPeer) | |
| 93 addTrust(&mTrust.emailFlags, CERTDB_TRUSTED); | |
| 94 if (ca || tCA) | |
| 95 addTrust(&mTrust.emailFlags, CERTDB_VALID_CA); | |
| 96 if (tClientCA) | |
| 97 addTrust(&mTrust.emailFlags, CERTDB_TRUSTED_CLIENT_CA); | |
| 98 if (tCA) | |
| 99 addTrust(&mTrust.emailFlags, CERTDB_TRUSTED_CA); | |
| 100 if (user) | |
| 101 addTrust(&mTrust.emailFlags, CERTDB_USER); | |
| 102 if (warn) | |
| 103 addTrust(&mTrust.emailFlags, CERTDB_SEND_WARN); | |
| 104 } | |
| 105 | |
| 106 void | |
| 107 nsNSSCertTrust::SetObjSignTrust(bool peer, bool tPeer, | |
| 108 bool ca, bool tCA, bool tClientCA, | |
| 109 bool user, bool warn) | |
| 110 { | |
| 111 mTrust.objectSigningFlags = 0; | |
| 112 if (peer || tPeer) | |
| 113 addTrust(&mTrust.objectSigningFlags, CERTDB_TERMINAL_RECORD); | |
| 114 if (tPeer) | |
| 115 addTrust(&mTrust.objectSigningFlags, CERTDB_TRUSTED); | |
| 116 if (ca || tCA) | |
| 117 addTrust(&mTrust.objectSigningFlags, CERTDB_VALID_CA); | |
| 118 if (tClientCA) | |
| 119 addTrust(&mTrust.objectSigningFlags, CERTDB_TRUSTED_CLIENT_CA); | |
| 120 if (tCA) | |
| 121 addTrust(&mTrust.objectSigningFlags, CERTDB_TRUSTED_CA); | |
| 122 if (user) | |
| 123 addTrust(&mTrust.objectSigningFlags, CERTDB_USER); | |
| 124 if (warn) | |
| 125 addTrust(&mTrust.objectSigningFlags, CERTDB_SEND_WARN); | |
| 126 } | |
| 127 | |
| 128 void | |
| 129 nsNSSCertTrust::SetValidCA() | |
| 130 { | |
| 131 SetSSLTrust(false, false, | |
| 132 true, false, false, | |
| 133 false, false); | |
| 134 SetEmailTrust(false, false, | |
| 135 true, false, false, | |
| 136 false, false); | |
| 137 SetObjSignTrust(false, false, | |
| 138 true, false, false, | |
| 139 false, false); | |
| 140 } | |
| 141 | |
| 142 void | |
| 143 nsNSSCertTrust::SetTrustedServerCA() | |
| 144 { | |
| 145 SetSSLTrust(false, false, | |
| 146 true, true, false, | |
| 147 false, false); | |
| 148 SetEmailTrust(false, false, | |
| 149 true, true, false, | |
| 150 false, false); | |
| 151 SetObjSignTrust(false, false, | |
| 152 true, true, false, | |
| 153 false, false); | |
| 154 } | |
| 155 | |
| 156 void | |
| 157 nsNSSCertTrust::SetTrustedCA() | |
| 158 { | |
| 159 SetSSLTrust(false, false, | |
| 160 true, true, true, | |
| 161 false, false); | |
| 162 SetEmailTrust(false, false, | |
| 163 true, true, true, | |
| 164 false, false); | |
| 165 SetObjSignTrust(false, false, | |
| 166 true, true, true, | |
| 167 false, false); | |
| 168 } | |
| 169 | |
| 170 void | |
| 171 nsNSSCertTrust::SetValidPeer() | |
| 172 { | |
| 173 SetSSLTrust(true, false, | |
| 174 false, false, false, | |
| 175 false, false); | |
| 176 SetEmailTrust(true, false, | |
| 177 false, false, false, | |
| 178 false, false); | |
| 179 SetObjSignTrust(true, false, | |
| 180 false, false, false, | |
| 181 false, false); | |
| 182 } | |
| 183 | |
| 184 void | |
| 185 nsNSSCertTrust::SetValidServerPeer() | |
| 186 { | |
| 187 SetSSLTrust(true, false, | |
| 188 false, false, false, | |
| 189 false, false); | |
| 190 SetEmailTrust(false, false, | |
| 191 false, false, false, | |
| 192 false, false); | |
| 193 SetObjSignTrust(false, false, | |
| 194 false, false, false, | |
| 195 false, false); | |
| 196 } | |
| 197 | |
| 198 void | |
| 199 nsNSSCertTrust::SetTrustedPeer() | |
| 200 { | |
| 201 SetSSLTrust(true, true, | |
| 202 false, false, false, | |
| 203 false, false); | |
| 204 SetEmailTrust(true, true, | |
| 205 false, false, false, | |
| 206 false, false); | |
| 207 SetObjSignTrust(true, true, | |
| 208 false, false, false, | |
| 209 false, false); | |
| 210 } | |
| 211 | |
| 212 void | |
| 213 nsNSSCertTrust::SetUser() | |
| 214 { | |
| 215 SetSSLTrust(false, false, | |
| 216 false, false, false, | |
| 217 true, false); | |
| 218 SetEmailTrust(false, false, | |
| 219 false, false, false, | |
| 220 true, false); | |
| 221 SetObjSignTrust(false, false, | |
| 222 false, false, false, | |
| 223 true, false); | |
| 224 } | |
| 225 | |
| 226 bool | |
| 227 nsNSSCertTrust::HasAnyCA() | |
| 228 { | |
| 229 if (hasTrust(mTrust.sslFlags, CERTDB_VALID_CA) || | |
| 230 hasTrust(mTrust.emailFlags, CERTDB_VALID_CA) || | |
| 231 hasTrust(mTrust.objectSigningFlags, CERTDB_VALID_CA)) | |
| 232 return true; | |
| 233 return false; | |
| 234 } | |
| 235 | |
| 236 bool | |
| 237 nsNSSCertTrust::HasCA(bool checkSSL, | |
| 238 bool checkEmail, | |
| 239 bool checkObjSign) | |
| 240 { | |
| 241 if (checkSSL && !hasTrust(mTrust.sslFlags, CERTDB_VALID_CA)) | |
| 242 return false; | |
| 243 if (checkEmail && !hasTrust(mTrust.emailFlags, CERTDB_VALID_CA)) | |
| 244 return false; | |
| 245 if (checkObjSign && !hasTrust(mTrust.objectSigningFlags, CERTDB_VALID_CA)) | |
| 246 return false; | |
| 247 return true; | |
| 248 } | |
| 249 | |
| 250 bool | |
| 251 nsNSSCertTrust::HasPeer(bool checkSSL, | |
| 252 bool checkEmail, | |
| 253 bool checkObjSign) | |
| 254 { | |
| 255 if (checkSSL && !hasTrust(mTrust.sslFlags, CERTDB_TERMINAL_RECORD)) | |
| 256 return false; | |
| 257 if (checkEmail && !hasTrust(mTrust.emailFlags, CERTDB_TERMINAL_RECORD)) | |
| 258 return false; | |
| 259 if (checkObjSign && !hasTrust(mTrust.objectSigningFlags, CERTDB_TERMINAL_RECORD)) | |
| 260 return false; | |
| 261 return true; | |
| 262 } | |
| 263 | |
| 264 bool | |
| 265 nsNSSCertTrust::HasAnyUser() | |
| 266 { | |
| 267 if (hasTrust(mTrust.sslFlags, CERTDB_USER) || | |
| 268 hasTrust(mTrust.emailFlags, CERTDB_USER) || | |
| 269 hasTrust(mTrust.objectSigningFlags, CERTDB_USER)) | |
| 270 return true; | |
| 271 return false; | |
| 272 } | |
| 273 | |
| 274 bool | |
| 275 nsNSSCertTrust::HasUser(bool checkSSL, | |
| 276 bool checkEmail, | |
| 277 bool checkObjSign) | |
| 278 { | |
| 279 if (checkSSL && !hasTrust(mTrust.sslFlags, CERTDB_USER)) | |
| 280 return false; | |
| 281 if (checkEmail && !hasTrust(mTrust.emailFlags, CERTDB_USER)) | |
| 282 return false; | |
| 283 if (checkObjSign && !hasTrust(mTrust.objectSigningFlags, CERTDB_USER)) | |
| 284 return false; | |
| 285 return true; | |
| 286 } | |
| 287 | |
| 288 bool | |
| 289 nsNSSCertTrust::HasTrustedCA(bool checkSSL, | |
| 290 bool checkEmail, | |
| 291 bool checkObjSign) | |
| 292 { | |
| 293 if (checkSSL && !(hasTrust(mTrust.sslFlags, CERTDB_TRUSTED_CA) || | |
| 294 hasTrust(mTrust.sslFlags, CERTDB_TRUSTED_CLIENT_CA))) | |
| 295 return false; | |
| 296 if (checkEmail && !(hasTrust(mTrust.emailFlags, CERTDB_TRUSTED_CA) || | |
| 297 hasTrust(mTrust.emailFlags, CERTDB_TRUSTED_CLIENT_CA))) | |
| 298 return false; | |
| 299 if (checkObjSign && | |
| 300 !(hasTrust(mTrust.objectSigningFlags, CERTDB_TRUSTED_CA) || | |
| 301 hasTrust(mTrust.objectSigningFlags, CERTDB_TRUSTED_CLIENT_CA))) | |
| 302 return false; | |
| 303 return true; | |
| 304 } | |
| 305 | |
| 306 bool | |
| 307 nsNSSCertTrust::HasTrustedPeer(bool checkSSL, | |
| 308 bool checkEmail, | |
| 309 bool checkObjSign) | |
| 310 { | |
| 311 if (checkSSL && !(hasTrust(mTrust.sslFlags, CERTDB_TRUSTED))) | |
| 312 return false; | |
| 313 if (checkEmail && !(hasTrust(mTrust.emailFlags, CERTDB_TRUSTED))) | |
| 314 return false; | |
| 315 if (checkObjSign && | |
| 316 !(hasTrust(mTrust.objectSigningFlags, CERTDB_TRUSTED))) | |
| 317 return false; | |
| 318 return true; | |
| 319 } | |
| 320 | |
| 321 void | |
| 322 nsNSSCertTrust::addTrust(unsigned int *t, unsigned int v) | |
| 323 { | |
| 324 *t |= v; | |
| 325 } | |
| 326 | |
| 327 bool | |
| 328 nsNSSCertTrust::hasTrust(unsigned int t, unsigned int v) | |
| 329 { | |
| 330 return !!(t & v); | |
| 331 } | |
| 332 |
