The Tor Browser / file revision

 /* This Source Code Form is subject to the terms of the Mozilla Public

  * License, v. 2.0. If a copy of the MPL was not distributed with this

  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

 /*

  * pkix_ekuchecker.c

  *

  * User Defined ExtenedKeyUsage Function Definitions

  *

  */

 #include "pkix_ekuchecker.h"

 SECOidTag ekuOidStrings[] = {

     PKIX_KEY_USAGE_SERVER_AUTH_OID,

     PKIX_KEY_USAGE_CLIENT_AUTH_OID,

     PKIX_KEY_USAGE_CODE_SIGN_OID,

     PKIX_KEY_USAGE_EMAIL_PROTECT_OID,

     PKIX_KEY_USAGE_TIME_STAMP_OID,

     PKIX_KEY_USAGE_OCSP_RESPONDER_OID,

     PKIX_UNKNOWN_OID

 };

 typedef struct pkix_EkuCheckerStruct {

     PKIX_List *requiredExtKeyUsageOids;

     PKIX_PL_OID *ekuOID;

 } pkix_EkuChecker;

 /*

  * FUNCTION: pkix_EkuChecker_Destroy

  * (see comments for PKIX_DestructorCallback in pkix_pl_system.h)

  */

 static PKIX_Error *

 pkix_EkuChecker_Destroy(

         PKIX_PL_Object *object,

         void *plContext)

 {

         pkix_EkuChecker *ekuCheckerState = NULL;

         PKIX_ENTER(EKUCHECKER, "pkix_EkuChecker_Destroy");

         PKIX_NULLCHECK_ONE(object);

         PKIX_CHECK(pkix_CheckType(object, PKIX_EKUCHECKER_TYPE, plContext),

                     PKIX_OBJECTNOTANEKUCHECKERSTATE);

         ekuCheckerState = (pkix_EkuChecker *)object;

         PKIX_DECREF(ekuCheckerState->ekuOID);

         PKIX_DECREF(ekuCheckerState->requiredExtKeyUsageOids);

 cleanup:

         PKIX_RETURN(EKUCHECKER);

 }

 /*

  * FUNCTION: pkix_EkuChecker_RegisterSelf

  *

  * DESCRIPTION:

  *  Registers PKIX_PL_HTTPCERTSTORECONTEXT_TYPE and its related

  *  functions with systemClasses[]

  *

  * THREAD SAFETY:

  *  Not Thread Safe - for performance and complexity reasons

  *

  *  Since this function is only called by PKIX_PL_Initialize, which should

  *  only be called once, it is acceptable that this function is not

  *  thread-safe.

  */

 PKIX_Error *

 pkix_EkuChecker_RegisterSelf(void *plContext)

 {

         extern pkix_ClassTable_Entry systemClasses[PKIX_NUMTYPES];

         pkix_ClassTable_Entry *entry = &systemClasses[PKIX_EKUCHECKER_TYPE];

         PKIX_ENTER(EKUCHECKER, "pkix_EkuChecker_RegisterSelf");

         entry->description = "EkuChecker";

         entry->typeObjectSize = sizeof(pkix_EkuChecker);

         entry->destructor = pkix_EkuChecker_Destroy;

         PKIX_RETURN(EKUCHECKER);

 }

 /*

  * FUNCTION: pkix_EkuChecker_Create

  * DESCRIPTION:

  *

  *  Creates a new Extend Key Usage CheckerState using "params" to retrieve

  *  application specified EKU for verification and stores it at "pState".

  *

  * PARAMETERS:

  *  "params"

  *      a PKIX_ProcessingParams links to PKIX_ComCertSelParams where a list of

  *      Extended Key Usage OIDs specified by application can be retrieved for

  *      verification.

  *  "pState"

  *      Address where state pointer will be stored. Must be non-NULL.

  *  "plContext"

  *      Platform-specific context pointer.

  * THREAD SAFETY:

  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)

  * RETURNS:

  *  Returns NULL if the function succeeds.

  *  Returns a UserDefinedModules Error if the function fails in a

  *      non-fatal way.

  *  Returns a Fatal Error if the function fails in an unrecoverable way.

  */

 static PKIX_Error *

 pkix_EkuChecker_Create(

         PKIX_ProcessingParams *params,

         pkix_EkuChecker **pState,

         void *plContext)

 {

         pkix_EkuChecker *state = NULL;

         PKIX_CertSelector *certSelector = NULL;

         PKIX_ComCertSelParams *comCertSelParams = NULL;

         PKIX_List *requiredOids = NULL;

         PKIX_ENTER(EKUCHECKER, "pkix_EkuChecker_Create");

         PKIX_NULLCHECK_TWO(params, pState);

         PKIX_CHECK(PKIX_PL_Object_Alloc

                     (PKIX_EKUCHECKER_TYPE,

                     sizeof (pkix_EkuChecker),

                     (PKIX_PL_Object **)&state,

                     plContext),

                     PKIX_COULDNOTCREATEEKUCHECKERSTATEOBJECT);

         PKIX_CHECK(PKIX_ProcessingParams_GetTargetCertConstraints

                     (params, &certSelector, plContext),

                     PKIX_PROCESSINGPARAMSGETTARGETCERTCONSTRAINTSFAILED);

         if (certSelector != NULL) {

             /* Get initial EKU OIDs from ComCertSelParams, if set */

             PKIX_CHECK(PKIX_CertSelector_GetCommonCertSelectorParams

                        (certSelector, &comCertSelParams, plContext),

                        PKIX_CERTSELECTORGETCOMMONCERTSELECTORPARAMSFAILED);

             if (comCertSelParams != NULL) {

                 PKIX_CHECK(PKIX_ComCertSelParams_GetExtendedKeyUsage

                            (comCertSelParams, &requiredOids, plContext),

                            PKIX_COMCERTSELPARAMSGETEXTENDEDKEYUSAGEFAILED);

             }

         }

         PKIX_CHECK(PKIX_PL_OID_Create

                     (PKIX_EXTENDEDKEYUSAGE_OID,

                     &state->ekuOID,

                     plContext),

                     PKIX_OIDCREATEFAILED);

         state->requiredExtKeyUsageOids = requiredOids;

         requiredOids = NULL;

         *pState = state;

         state = NULL;

 cleanup:

         PKIX_DECREF(certSelector);

         PKIX_DECREF(comCertSelParams);

         PKIX_DECREF(requiredOids);

         PKIX_DECREF(state);

         PKIX_RETURN(EKUCHECKER);

 }

 /*

  * FUNCTION: pkix_EkuChecker_Check

  * DESCRIPTION:

  *

  *  This function determines the Extended Key Usage OIDs specified by the

  *  application is included in the Extended Key Usage OIDs of this "cert".

  *

  * PARAMETERS:

  *  "checker"

  *      Address of CertChainChecker which has the state data.

  *      Must be non-NULL.

  *  "cert"

  *      Address of Certificate that is to be validated. Must be non-NULL.

  *  "unresolvedCriticalExtensions"

  *      A List OIDs. The OID for Extended Key Usage is removed.

  *  "plContext"

  *      Platform-specific context pointer.

  * THREAD SAFETY:

  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)

  * RETURNS:

  *  Returns NULL if the function succeeds.

  *  Returns a UserDefinedModules Error if the function fails in

  *      a non-fatal way.

  *  Returns a Fatal Error if the function fails in an unrecoverable way.

  */

 static PKIX_Error *

 pkix_EkuChecker_Check(

         PKIX_CertChainChecker *checker,

         PKIX_PL_Cert *cert,

         PKIX_List *unresolvedCriticalExtensions,

         void **pNBIOContext,

         void *plContext)

 {

         pkix_EkuChecker *state = NULL;

         PKIX_List *requiredExtKeyUsageList = NULL;

         PKIX_List *certExtKeyUsageList = NULL;

         PKIX_PL_OID *ekuOid = NULL;

         PKIX_Boolean isContained = PKIX_FALSE;

         PKIX_UInt32 numItems = 0;

         PKIX_UInt32 i;

         PKIX_Boolean checkResult = PKIX_TRUE;

         PKIX_ENTER(EKUCHECKER, "pkix_EkuChecker_Check");

         PKIX_NULLCHECK_THREE(checker, cert, pNBIOContext);

         *pNBIOContext = NULL; /* no non-blocking IO */

         PKIX_CHECK(

             PKIX_CertChainChecker_GetCertChainCheckerState

             (checker, (PKIX_PL_Object **)&state, plContext),

             PKIX_CERTCHAINCHECKERGETCERTCHAINCHECKERSTATEFAILED);

         requiredExtKeyUsageList = state->requiredExtKeyUsageOids;

         if (requiredExtKeyUsageList == NULL) {

             goto cleanup;

         }

         PKIX_CHECK(

             PKIX_List_GetLength(requiredExtKeyUsageList, &numItems,

                                 plContext),

             PKIX_LISTGETLENGTHFAILED);

         if (numItems == 0) {

             goto cleanup;

         }

         PKIX_CHECK(

             PKIX_PL_Cert_GetExtendedKeyUsage(cert, &certExtKeyUsageList,

                                              plContext),

             PKIX_CERTGETEXTENDEDKEYUSAGEFAILED);

         if (certExtKeyUsageList == NULL) {

             goto cleanup;

         }

         for (i = 0; i < numItems; i++) {

             PKIX_CHECK(

                 PKIX_List_GetItem(requiredExtKeyUsageList, i,

                                   (PKIX_PL_Object **)&ekuOid, plContext),

                 PKIX_LISTGETITEMFAILED);

             PKIX_CHECK(

                 pkix_List_Contains(certExtKeyUsageList,

                                    (PKIX_PL_Object *)ekuOid,

                                    &isContained,

                                    plContext),

                 PKIX_LISTCONTAINSFAILED);

             PKIX_DECREF(ekuOid);

             if (isContained != PKIX_TRUE) {

                 checkResult = PKIX_FALSE;

                 goto cleanup;

             }

         }

 cleanup:

         if (!pkixErrorResult && checkResult == PKIX_FALSE) {

             pkixErrorReceived = PKIX_TRUE;

             pkixErrorCode = PKIX_EXTENDEDKEYUSAGECHECKINGFAILED;

         }

         PKIX_DECREF(ekuOid);

         PKIX_DECREF(certExtKeyUsageList);

         PKIX_DECREF(state);

         PKIX_RETURN(EKUCHECKER);

 }

 /*

  * FUNCTION: pkix_EkuChecker_Initialize

  * (see comments in pkix_sample_modules.h)

  */

 PKIX_Error *

 PKIX_EkuChecker_Create(

         PKIX_ProcessingParams *params,

         PKIX_CertChainChecker **pEkuChecker,

         void *plContext)

 {

         pkix_EkuChecker *state = NULL;

         PKIX_List *critExtOIDsList = NULL;

         PKIX_ENTER(EKUCHECKER, "PKIX_EkuChecker_Initialize");

         PKIX_NULLCHECK_ONE(params);

         /*

          * This function and functions in this file provide an example of how

          * an application defined checker can be hooked into libpkix.

          */

         PKIX_CHECK(pkix_EkuChecker_Create

                     (params, &state, plContext),

                     PKIX_EKUCHECKERSTATECREATEFAILED);

         PKIX_CHECK(PKIX_List_Create(&critExtOIDsList, plContext),

                     PKIX_LISTCREATEFAILED);

         PKIX_CHECK(PKIX_List_AppendItem

                     (critExtOIDsList,

                     (PKIX_PL_Object *)state->ekuOID,

                     plContext),

                     PKIX_LISTAPPENDITEMFAILED);

         PKIX_CHECK(PKIX_CertChainChecker_Create

                 (pkix_EkuChecker_Check,

                 PKIX_TRUE,                 /* forwardCheckingSupported */

                 PKIX_FALSE,                /* forwardDirectionExpected */

                 critExtOIDsList,

                 (PKIX_PL_Object *) state,

                 pEkuChecker,

                 plContext),

                 PKIX_CERTCHAINCHECKERCREATEFAILED);

 cleanup:

         PKIX_DECREF(critExtOIDsList);

         PKIX_DECREF(state);

         PKIX_RETURN(EKUCHECKER);

 }