The Tor Browser / file revision

 /* This Source Code Form is subject to the terms of the Mozilla Public

  * License, v. 2.0. If a copy of the MPL was not distributed with this

  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

 /*

  * pkix_tools.c

  *

  * Private Utility Functions

  *

  */

 #include "pkix_tools.h"

 #define CACHE_ITEM_PERIOD_SECONDS  (3600)  /* one hour */

 /*

  * This cahce period is only for CertCache. A Cert from a trusted CertStore

  * should be checked more frequently for update new arrival, etc.

  */

 #define CACHE_TRUST_ITEM_PERIOD_SECONDS  (CACHE_ITEM_PERIOD_SECONDS/10)

 extern PKIX_PL_HashTable *cachedCertChainTable;

 extern PKIX_PL_HashTable *cachedCertTable;

 extern PKIX_PL_HashTable *cachedCrlEntryTable;

 /* Following variables are used to checked cache hits - can be taken out */

 extern int pkix_ccAddCount;

 extern int pkix_ccLookupCount;

 extern int pkix_ccRemoveCount;

 extern int pkix_cAddCount;

 extern int pkix_cLookupCount;

 extern int pkix_cRemoveCount;

 extern int pkix_ceAddCount;

 extern int pkix_ceLookupCount;

 #ifdef PKIX_OBJECT_LEAK_TEST

 /* Following variables are used for object leak test */

 char *nonNullValue = "Non Empty Value";

 PKIX_Boolean noErrorState = PKIX_TRUE;

 PKIX_Boolean runningLeakTest;

 PKIX_Boolean errorGenerated;

 PKIX_UInt32 stackPosition;

 PKIX_UInt32 *fnStackInvCountArr;

 char **fnStackNameArr;

 PLHashTable *fnInvTable;

 PKIX_UInt32 testStartFnStackPosition;

 char *errorFnStackString;

 #endif /* PKIX_OBJECT_LEAK_TEST */

 /* --Private-Functions-------------------------------------------- */

 #ifdef PKIX_OBJECT_LEAK_TEST

 /*

  * FUNCTION: pkix_ErrorGen_Hash

  * DESCRIPTION:

  *

  * Hash function to be used in object leak test hash table.

  *

  */

 PLHashNumber PR_CALLBACK

 pkix_ErrorGen_Hash (const void *key)

 {

     char *str = NULL;

     PLHashNumber rv = (*(PRUint8*)key) << 5;

     PRUint32 i, counter = 0;

     PRUint8 *rvc = (PRUint8 *)&rv;

     while ((str = fnStackNameArr[counter++]) != NULL) {

         PRUint32 len = strlen(str);

         for( i = 0; i < len; i++ ) {

             rvc[ i % sizeof(rv) ] ^= *str;

             str++;

         }

     }

     return rv;

 }

 #endif /* PKIX_OBJECT_LEAK_TEST */

 /*

  * FUNCTION: pkix_IsCertSelfIssued

  * DESCRIPTION:

  *

  *  Checks whether the Cert pointed to by "cert" is self-issued and stores the

  *  Boolean result at "pSelfIssued". A Cert is considered self-issued if the

  *  Cert's issuer matches the Cert's subject. If the subject or issuer is

  *  not specified, a PKIX_FALSE is returned.

  *

  * PARAMETERS:

  *  "cert"

  *      Address of Cert used to determine whether Cert is self-issued.

  *      Must be non-NULL.

  *  "pSelfIssued"

  *      Address where Boolean will be stored. Must be non-NULL.

  *  "plContext"

  *      Platform-specific context pointer.

  * THREAD SAFETY:

  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)

  * RETURNS:

  *  Returns NULL if the function succeeds.

  *  Returns a Cert Error if the function fails in a non-fatal way.

  *  Returns a Fatal Error if the function fails in an unrecoverable way.

  */

 PKIX_Error *

 pkix_IsCertSelfIssued(

         PKIX_PL_Cert *cert,

         PKIX_Boolean *pSelfIssued,

         void *plContext)

 {

         PKIX_PL_X500Name *subject = NULL;

         PKIX_PL_X500Name *issuer = NULL;

         PKIX_ENTER(CERT, "pkix_IsCertSelfIssued");

         PKIX_NULLCHECK_TWO(cert, pSelfIssued);

         PKIX_CHECK(PKIX_PL_Cert_GetSubject(cert, &subject, plContext),

                     PKIX_CERTGETSUBJECTFAILED);

         PKIX_CHECK(PKIX_PL_Cert_GetIssuer(cert, &issuer, plContext),

                     PKIX_CERTGETISSUERFAILED);

         if (subject == NULL || issuer == NULL) {

                 *pSelfIssued = PKIX_FALSE;

         } else {

                 PKIX_CHECK(PKIX_PL_X500Name_Match

                     (subject, issuer, pSelfIssued, plContext),

                     PKIX_X500NAMEMATCHFAILED);

         }

 cleanup:

         PKIX_DECREF(subject);

         PKIX_DECREF(issuer);

         PKIX_RETURN(CERT);

 }

 /*

  * FUNCTION: pkix_Throw

  * DESCRIPTION:

  *

  *  Creates an Error using the value of "errorCode", the character array

  *  pointed to by "funcName", the character array pointed to by "errorText",

  *  and the Error pointed to by "cause" (if any), and stores it at "pError".

  *

  *  If "cause" is not NULL and has an errorCode of "PKIX_FATAL_ERROR",

  *  then there is no point creating a new Error object. Rather, we simply

  *  store "cause" at "pError".

  *

  * PARAMETERS:

  *  "errorCode"

  *      Value of error code.

  *  "funcName"

  *      Address of EscASCII array representing name of function throwing error.

  *      Must be non-NULL.

  *  "errnum"

  *      PKIX_ERRMSGNUM of error description for new error.

  *  "cause"

  *      Address of Error representing error's cause.

  *  "pError"

  *      Address where object pointer will be stored. Must be non-NULL.

  *  "plContext"

  *      Platform-specific context pointer.

  * THREAD SAFETY:

  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)

  * RETURNS:

  *  Returns NULL if the function succeeds.

  *  Returns an Error Error if the function fails in a non-fatal way.

  *  Returns a Fatal Error if the function fails in an unrecoverable way.

  */

 PKIX_Error *

 pkix_Throw(

         PKIX_ERRORCLASS errorClass,

         const char *funcName,

         PKIX_ERRORCODE errorCode,

         PKIX_ERRORCLASS overrideClass,

         PKIX_Error *cause,

         PKIX_Error **pError,

         void *plContext)

 {

         PKIX_Error *error = NULL;

         PKIX_ENTER(ERROR, "pkix_Throw");

         PKIX_NULLCHECK_TWO(funcName, pError);

         *pError = NULL;

 #ifdef PKIX_OBJECT_LEAK_TEST        

         noErrorState = PKIX_TRUE;

         if (pkixLog) {

 #ifdef PKIX_ERROR_DESCRIPTION            

             PR_LOG(pkixLog, 4, ("Error in function \"%s\":\"%s\" with cause \"%s\"\n",

                                 funcName, PKIX_ErrorText[errorCode],

                                 (cause ? PKIX_ErrorText[cause->errCode] : "null")));

 #else

             PR_LOG(pkixLog, 4, ("Error in function \"%s\": error code \"%d\"\n",

                                 funcName, errorCode));

 #endif /* PKIX_ERROR_DESCRIPTION */

             PORT_Assert(strcmp(funcName, "PKIX_PL_Object_DecRef"));

         }

 #endif /* PKIX_OBJECT_LEAK_TEST */

         /* if cause has error class of PKIX_FATAL_ERROR, return immediately */

         if (cause) {

                 if (cause->errClass == PKIX_FATAL_ERROR){

                         PKIX_INCREF(cause);

                         *pError = cause;

                         goto cleanup;

                 }

         }

         if (overrideClass == PKIX_FATAL_ERROR){

                 errorClass = overrideClass;

         }

        pkixTempResult = PKIX_Error_Create(errorClass, cause, NULL,

                                            errorCode, &error, plContext);

        if (!pkixTempResult) {

            /* Setting plErr error code:

             *    get it from PORT_GetError if it is a leaf error and

             *    default error code does not exist(eq 0)               */

            if (!cause && !error->plErr) {

                error->plErr = PKIX_PL_GetPLErrorCode();

            }

        }

        *pError = error;

 cleanup:

         PKIX_DEBUG_EXIT(ERROR);

         pkixErrorClass = 0;

 #ifdef PKIX_OBJECT_LEAK_TEST        

         noErrorState = PKIX_FALSE;

         if (runningLeakTest && fnStackNameArr) {

             PR_LOG(pkixLog, 5,

                    ("%s%*s<- %s(%d) - %s\n", (errorGenerated ? "*" : " "),

                     stackPosition, " ", fnStackNameArr[stackPosition],

                     stackPosition, myFuncName));

             fnStackNameArr[stackPosition--] = NULL;

         }

 #endif /* PKIX_OBJECT_LEAK_TEST */

         return (pkixTempResult);

 }

 /*

  * FUNCTION: pkix_CheckTypes

  * DESCRIPTION:

  *

  *  Checks that the types of the Object pointed to by "first" and the Object

  *  pointed to by "second" are both equal to the value of "type". If they

  *  are not equal, a PKIX_Error is returned.

  *

  * PARAMETERS:

  *  "first"

  *      Address of first Object. Must be non-NULL.

  *  "second"

  *      Address of second Object. Must be non-NULL.

  *  "type"

  *      Value of type to check against.

  *  "plContext"

  *      Platform-specific context pointer.

  * THREAD SAFETY:

  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)

  * RETURNS:

  *  Returns NULL if the function succeeds.

  *  Returns an Error Error if the function fails in a non-fatal way.

  *  Returns a Fatal Error if the function fails in an unrecoverable way.

  */

 PKIX_Error *

 pkix_CheckTypes(

         PKIX_PL_Object *first,

         PKIX_PL_Object *second,

         PKIX_UInt32 type,

         void *plContext)

 {

         PKIX_UInt32 firstType, secondType;

         PKIX_ENTER(OBJECT, "pkix_CheckTypes");

         PKIX_NULLCHECK_TWO(first, second);

         PKIX_CHECK(PKIX_PL_Object_GetType(first, &firstType, plContext),

                     PKIX_COULDNOTGETFIRSTOBJECTTYPE);

         PKIX_CHECK(PKIX_PL_Object_GetType(second, &secondType, plContext),

                     PKIX_COULDNOTGETSECONDOBJECTTYPE);

         if ((firstType != type)||(firstType != secondType)) {

                 PKIX_ERROR(PKIX_OBJECTTYPESDONOTMATCH);

         }

 cleanup:

         PKIX_RETURN(OBJECT);

 }

 /*

  * FUNCTION: pkix_CheckType

  * DESCRIPTION:

  *

  *  Checks that the type of the Object pointed to by "object" is equal to the

  *  value of "type". If it is not equal, a PKIX_Error is returned.

  *

  * PARAMETERS:

  *  "object"

  *      Address of Object. Must be non-NULL.

  *  "type"

  *      Value of type to check against.

  *  "plContext"

  *      Platform-specific context pointer.

  * THREAD SAFETY:

  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)

  * RETURNS:

  *  Returns NULL if the function succeeds.

  *  Returns an Error Error if the function fails in a non-fatal way.

  *  Returns a Fatal Error if the function fails in an unrecoverable way.

  */

 PKIX_Error *

 pkix_CheckType(

         PKIX_PL_Object *object,

         PKIX_UInt32 type,

         void *plContext)

 {

         return (pkix_CheckTypes(object, object, type, plContext));

 }

 /*

  * FUNCTION: pkix_hash

  * DESCRIPTION:

  *

  *  Computes a hash value for "length" bytes starting at the array of bytes

  *  pointed to by "bytes" and stores the result at "pHash".

  *

  *  XXX To speed this up, we could probably read 32 bits at a time from

  *  bytes (maybe even 64 bits on some platforms)

  *

  * PARAMETERS:

  *  "bytes"

  *      Address of array of bytes to hash. Must be non-NULL.

  *  "length"

  *      Number of bytes to hash.

  *  "pHash"

  *      Address where object pointer will be stored. Must be non-NULL.

  *  "plContext"

  *      Platform-specific context pointer.

  * THREAD SAFETY:

  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)

  * RETURNS:

  *  Returns NULL if the function succeeds.

  *  Returns a Fatal Error if the function fails in an unrecoverable way.

  */

 PKIX_Error *

 pkix_hash(

         const unsigned char *bytes,

         PKIX_UInt32 length,

         PKIX_UInt32 *pHash,

         void *plContext)

 {

         PKIX_UInt32 i;

         PKIX_UInt32 hash;

         PKIX_ENTER(OBJECT, "pkix_hash");

         if (length != 0) {

                 PKIX_NULLCHECK_ONE(bytes);

         }

         PKIX_NULLCHECK_ONE(pHash);

         hash = 0;

         for (i = 0; i < length; i++) {

                 /* hash = 31 * hash + bytes[i]; */

                 hash = (hash << 5) - hash + bytes[i];

         }

         *pHash = hash;

         PKIX_RETURN(OBJECT);

 }

 /*

  * FUNCTION: pkix_countArray

  * DESCRIPTION:

  *

  *  Counts the number of elements in the  null-terminated array of pointers

  *  pointed to by "array" and returns the result.

  *

  * PARAMETERS

  *  "array"

  *      Address of null-terminated array of pointers.

  * THREAD SAFETY:

  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)

  * RETURNS:

  *  Returns the number of elements in the array.

  */

 PKIX_UInt32

 pkix_countArray(void **array)

 {

         PKIX_UInt32 count = 0;

         if (array) {

                 while (*array++) {

                         count++;

                 }

         }

         return (count);

 }

 /*

  * FUNCTION: pkix_duplicateImmutable

  * DESCRIPTION:

  *

  *  Convenience callback function used for duplicating immutable objects.

  *  Since the objects can not be modified, this function simply increments the

  *  reference count on the object, and returns a reference to that object.

  *

  *  (see comments for PKIX_PL_DuplicateCallback in pkix_pl_system.h)

  */

 PKIX_Error *

 pkix_duplicateImmutable(

         PKIX_PL_Object *object,

         PKIX_PL_Object **pNewObject,

         void *plContext)

 {

         PKIX_ENTER(OBJECT, "pkix_duplicateImmutable");

         PKIX_NULLCHECK_TWO(object, pNewObject);

         PKIX_INCREF(object);

         *pNewObject = object;

 cleanup:

         PKIX_RETURN(OBJECT);

 }

 /* --String-Encoding-Conversion-Functions------------------------ */

 /*

  * FUNCTION: pkix_hex2i

  * DESCRIPTION:

  *

  *  Converts hexadecimal character "c" to its integer value and returns result.

  *

  * PARAMETERS

  *  "c"

  *      Character to convert to a hex value.

  * THREAD SAFETY:

  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)

  * RETURNS:

  *  The hexadecimal value of "c". Otherwise -1. (Unsigned 0xFFFFFFFF).

  */

 PKIX_UInt32

 pkix_hex2i(char c)

 {

         if ((c >= '0')&&(c <= '9'))

                 return (c-'0');

         else if ((c >= 'a')&&(c <= 'f'))

                 return (c-'a'+10);

         else if ((c >= 'A')&&(c <= 'F'))

                 return (c-'A'+10);

         else

                 return ((PKIX_UInt32)(-1));

 }

 /*

  * FUNCTION: pkix_i2hex

  * DESCRIPTION:

  *

  *  Converts integer value "digit" to its ASCII hex value

  *

  * PARAMETERS

  *  "digit"

  *      Value of integer to convert to ASCII hex value. Must be 0-15.

  * THREAD SAFETY:

  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)

  * RETURNS:

  *  The ASCII hexadecimal value of "digit".

  */

 char

 pkix_i2hex(char digit)

 {

         if ((digit >= 0)&&(digit <= 9))

                 return (digit+'0');

         else if ((digit >= 0xa)&&(digit <= 0xf))

                 return (digit - 10 + 'a');

         else

                 return (-1);

 }

 /*

  * FUNCTION: pkix_isPlaintext

  * DESCRIPTION:

  *

  *  Returns whether character "c" is plaintext using EscASCII or EscASCII_Debug

  *  depending on the value of "debug".

  *

  *  In EscASCII, [01, 7E] except '&' are plaintext.

  *  In EscASCII_Debug [20, 7E] except '&' are plaintext.

  *

  * PARAMETERS:

  *  "c"

  *      Character to check.

  *  "debug"

  *      Value of debug flag.

  * THREAD SAFETY:

  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)

  * RETURNS:

  *  True if "c" is plaintext.

  */

 PKIX_Boolean

 pkix_isPlaintext(unsigned char c, PKIX_Boolean debug) {

         return ((c >= 0x01)&&(c <= 0x7E)&&(c != '&')&&(!debug || (c >= 20)));

 }

 /* --Cache-Functions------------------------ */

 /*

  * FUNCTION: pkix_CacheCertChain_Lookup

  * DESCRIPTION:

  *

  *  Look up CertChain Hash Table for a cached BuildResult based on "targetCert"

  *  and "anchors" as the hash keys. If there is no item to match the key,

  *  PKIX_FALSE is stored at "pFound". If an item is found, its cache time is

  *  compared to "testDate". If expired, the item is removed and PKIX_FALSE is

  *  stored at "pFound". Otherwise, PKIX_TRUE is stored at "pFound" and the 

  *  BuildResult is stored at "pBuildResult".

  *  The hashtable is maintained in the following ways:

  *  1) When creating the hashtable, maximum bucket size can be specified (0 for

  *     unlimited). If items in a bucket reaches its full size, an new addition

  *     will trigger the removal of the old as FIFO sequence.

  *  2) A PKIX_PL_Date created with current time offset by constant 

  *     CACHE_ITEM_PERIOD_SECONDS is attached to each item in the Hash Table.

  *     When an item is retrieved, this date is compared against "testDate" for

  *     validity. If comparison indicates this item is expired, the item is

  *     removed from the bucket.

  *

  * PARAMETERS:

  *  "targetCert"

  *      Address of Target Cert as key to retrieve this CertChain. Must be 

  *      non-NULL.

  *  "anchors"

  *      Address of PKIX_List of "anchors" is used as key to retrive CertChain.

  *      Must be non-NULL.

  *  "testDate"

  *      Address of PKIX_PL_Date for verifying time validity and cache validity.

  *      May be NULL. If testDate is NULL, this cache item will not be out-dated.

  *  "pFound"

  *      Address of PKIX_Boolean indicating valid data is found.

  *      Must be non-NULL.

  *  "pBuildResult"

  *      Address where BuildResult will be stored. Must be non-NULL.

  *  "plContext"

  *      Platform-specific context pointer.

  * THREAD SAFETY:

  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)

  * RETURNS:

  *  Returns NULL if the function succeeds.

  *  Returns an Error Error if the function fails in a non-fatal way.

  *  Returns a Fatal Error if the function fails in an unrecoverable way.

  */

 PKIX_Error *

 pkix_CacheCertChain_Lookup(

         PKIX_PL_Cert* targetCert,

         PKIX_List* anchors,

         PKIX_PL_Date *testDate,

         PKIX_Boolean *pFound,

         PKIX_BuildResult **pBuildResult,

         void *plContext)

 {

         PKIX_List *cachedValues = NULL;

         PKIX_List *cachedKeys = NULL;

         PKIX_Error *cachedCertChainError = NULL;

         PKIX_PL_Date *cacheValidUntilDate = NULL;

         PKIX_PL_Date *validityDate = NULL;

         PKIX_Int32 cmpValidTimeResult = 0;

         PKIX_Int32 cmpCacheTimeResult = 0;

         PKIX_ENTER(BUILD, "pkix_CacheCertChain_Lookup");

         PKIX_NULLCHECK_FOUR(targetCert, anchors, pFound, pBuildResult);

         *pFound = PKIX_FALSE;

         /* use trust anchors and target cert as hash key */

         PKIX_CHECK(PKIX_List_Create(&cachedKeys, plContext),

                     PKIX_LISTCREATEFAILED);

         PKIX_CHECK(PKIX_List_AppendItem

                     (cachedKeys,

                     (PKIX_PL_Object *)targetCert,

                     plContext),

                     PKIX_LISTAPPENDITEMFAILED);

         PKIX_CHECK(PKIX_List_AppendItem

                     (cachedKeys,

                     (PKIX_PL_Object *)anchors,

                     plContext),

                     PKIX_LISTAPPENDITEMFAILED);

         cachedCertChainError = PKIX_PL_HashTable_Lookup

                     (cachedCertChainTable,

                     (PKIX_PL_Object *) cachedKeys,

                     (PKIX_PL_Object **) &cachedValues,

                     plContext);

         pkix_ccLookupCount++;

         /* retrieve data from hashed value list */

         if (cachedValues != NULL && cachedCertChainError == NULL) {

             PKIX_CHECK(PKIX_List_GetItem

                     (cachedValues,

                     0,

                     (PKIX_PL_Object **) &cacheValidUntilDate,

                     plContext),

                     PKIX_LISTGETITEMFAILED);

             /* check validity time and cache age time */

             PKIX_CHECK(PKIX_List_GetItem

                     (cachedValues,

                     1,

                     (PKIX_PL_Object **) &validityDate,

                     plContext),

                     PKIX_LISTGETITEMFAILED);

             /* if testDate is not set, this cache item is not out-dated */

             if (testDate) {

                 PKIX_CHECK(PKIX_PL_Object_Compare

                      ((PKIX_PL_Object *)testDate,

                      (PKIX_PL_Object *)cacheValidUntilDate,

                      &cmpCacheTimeResult,

                      plContext),

                      PKIX_OBJECTCOMPARATORFAILED);

                 PKIX_CHECK(PKIX_PL_Object_Compare

                      ((PKIX_PL_Object *)testDate,

                      (PKIX_PL_Object *)validityDate,

                      &cmpValidTimeResult,

                      plContext),

                      PKIX_OBJECTCOMPARATORFAILED);

             }

             /* certs' date are all valid and cache item is not old */

             if (cmpValidTimeResult <= 0 && cmpCacheTimeResult <=0) {

                 PKIX_CHECK(PKIX_List_GetItem

                     (cachedValues,

                     2,

                     (PKIX_PL_Object **) pBuildResult,

                     plContext),

                     PKIX_LISTGETITEMFAILED);

                 *pFound = PKIX_TRUE;

             } else {

                 pkix_ccRemoveCount++;

                 *pFound = PKIX_FALSE;

                 /* out-dated item, remove it from cache */

                 PKIX_CHECK(PKIX_PL_HashTable_Remove

                     (cachedCertChainTable,

                     (PKIX_PL_Object *) cachedKeys,

                     plContext),

                     PKIX_HASHTABLEREMOVEFAILED);

             }

         }

 cleanup:

         PKIX_DECREF(cachedValues);

         PKIX_DECREF(cachedKeys);

         PKIX_DECREF(cachedCertChainError);

         PKIX_DECREF(cacheValidUntilDate);

         PKIX_DECREF(validityDate);

         PKIX_RETURN(BUILD);

 }

 /*

  * FUNCTION: pkix_CacheCertChain_Remove

  * DESCRIPTION:

  *

  *  Remove CertChain Hash Table entry based on "targetCert" and "anchors"

  *  as the hash keys. If there is no item to match the key, no action is

  *  taken.

  *  The hashtable is maintained in the following ways:

  *  1) When creating the hashtable, maximum bucket size can be specified (0 for

  *     unlimited). If items in a bucket reaches its full size, an new addition

  *     will trigger the removal of the old as FIFO sequence.

  *  2) A PKIX_PL_Date created with current time offset by constant 

  *     CACHE_ITEM_PERIOD_SECONDS is attached to each item in the Hash Table.

  *     When an item is retrieved, this date is compared against "testDate" for

  *     validity. If comparison indicates this item is expired, the item is

  *     removed from the bucket.

  *

  * PARAMETERS:

  *  "targetCert"

  *      Address of Target Cert as key to retrieve this CertChain. Must be 

  *      non-NULL.

  *  "anchors"

  *      Address of PKIX_List of "anchors" is used as key to retrive CertChain.

  *      Must be non-NULL.

  *  "plContext"

  *      Platform-specific context pointer.

  * THREAD SAFETY:

  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)

  * RETURNS:

  *  Returns NULL if the function succeeds.

  *  Returns an Error Error if the function fails in a non-fatal way.

  *  Returns a Fatal Error if the function fails in an unrecoverable way.

  */

 PKIX_Error *

 pkix_CacheCertChain_Remove(

         PKIX_PL_Cert* targetCert,

         PKIX_List* anchors,

         void *plContext)

 {

         PKIX_List *cachedKeys = NULL;

         PKIX_ENTER(BUILD, "pkix_CacheCertChain_Remove");

         PKIX_NULLCHECK_TWO(targetCert, anchors);

         /* use trust anchors and target cert as hash key */

         PKIX_CHECK(PKIX_List_Create(&cachedKeys, plContext),

                     PKIX_LISTCREATEFAILED);

         PKIX_CHECK(PKIX_List_AppendItem

                     (cachedKeys,

                     (PKIX_PL_Object *)targetCert,

                     plContext),

                     PKIX_LISTAPPENDITEMFAILED);

         PKIX_CHECK(PKIX_List_AppendItem

                     (cachedKeys,

                     (PKIX_PL_Object *)anchors,

                     plContext),

                     PKIX_LISTAPPENDITEMFAILED);

         PKIX_CHECK_ONLY_FATAL(PKIX_PL_HashTable_Remove

                     (cachedCertChainTable,

                     (PKIX_PL_Object *) cachedKeys,

                     plContext),

                     PKIX_HASHTABLEREMOVEFAILED);

         pkix_ccRemoveCount++;

 cleanup:

         PKIX_DECREF(cachedKeys);

         PKIX_RETURN(BUILD);

 }

 /*

  * FUNCTION: pkix_CacheCertChain_Add

  * DESCRIPTION:

  *

  *  Add a BuildResult to the CertChain Hash Table for a "buildResult" with

  *  "targetCert" and "anchors" as the hash keys.

  *  "validityDate" is the most restricted notAfter date of all Certs in

  *  this CertChain and is verified when this BuildChain is retrieved.

  *  The hashtable is maintained in the following ways:

  *  1) When creating the hashtable, maximum bucket size can be specified (0 for

  *     unlimited). If items in a bucket reaches its full size, an new addition

  *     will trigger the removal of the old as FIFO sequence.

  *  2) A PKIX_PL_Date created with current time offset by constant 

  *     CACHE_ITEM_PERIOD_SECONDS is attached to each item in the Hash Table.

  *     When an item is retrieved, this date is compared against "testDate" for

  *     validity. If comparison indicates this item is expired, the item is

  *     removed from the bucket.

  *

  * PARAMETERS:

  *  "targetCert"

  *      Address of Target Cert as key to retrieve this CertChain. Must be 

  *      non-NULL.

  *  "anchors"

  *      Address of PKIX_List of "anchors" is used as key to retrive CertChain.

  *      Must be non-NULL.

  *  "validityDate"

  *      Address of PKIX_PL_Date contains the most restriced notAfter time of

  *      all "certs". Must be non-NULL.

  *      Address of PKIX_Boolean indicating valid data is found.

  *      Must be non-NULL.

  *  "buildResult"

  *      Address of BuildResult to be cached. Must be non-NULL.

  *  "plContext"

  *      Platform-specific context pointer.

  * THREAD SAFETY:

  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)

  * RETURNS:

  *  Returns NULL if the function succeeds.

  *  Returns an Error Error if the function fails in a non-fatal way.

  *  Returns a Fatal Error if the function fails in an unrecoverable way.

  */

 PKIX_Error *

 pkix_CacheCertChain_Add(

         PKIX_PL_Cert* targetCert,

         PKIX_List* anchors,

         PKIX_PL_Date *validityDate,

         PKIX_BuildResult *buildResult,

         void *plContext)

 {

         PKIX_List *cachedValues = NULL;

         PKIX_List *cachedKeys = NULL;

         PKIX_Error *cachedCertChainError = NULL;

         PKIX_PL_Date *cacheValidUntilDate = NULL;

         PKIX_ENTER(BUILD, "pkix_CacheCertChain_Add");

         PKIX_NULLCHECK_FOUR(targetCert, anchors, validityDate, buildResult);

         PKIX_CHECK(PKIX_List_Create(&cachedKeys, plContext),

                 PKIX_LISTCREATEFAILED);

         PKIX_CHECK(PKIX_List_AppendItem

                 (cachedKeys, (PKIX_PL_Object *)targetCert, plContext),

                 PKIX_LISTAPPENDITEMFAILED);

         PKIX_CHECK(PKIX_List_AppendItem

                 (cachedKeys, (PKIX_PL_Object *)anchors, plContext),

                 PKIX_LISTAPPENDITEMFAILED);

         PKIX_CHECK(PKIX_List_Create(&cachedValues, plContext),

                 PKIX_LISTCREATEFAILED);

         PKIX_CHECK(PKIX_PL_Date_Create_CurrentOffBySeconds

                 (CACHE_ITEM_PERIOD_SECONDS,

                 &cacheValidUntilDate,

                 plContext),

                PKIX_DATECREATECURRENTOFFBYSECONDSFAILED);

         PKIX_CHECK(PKIX_List_AppendItem

                 (cachedValues,

                 (PKIX_PL_Object *)cacheValidUntilDate,

                 plContext),

                 PKIX_LISTAPPENDITEMFAILED);

         PKIX_CHECK(PKIX_List_AppendItem

                 (cachedValues, (PKIX_PL_Object *)validityDate, plContext),

                 PKIX_LISTAPPENDITEMFAILED);

         PKIX_CHECK(PKIX_List_AppendItem

                 (cachedValues, (PKIX_PL_Object *)buildResult, plContext),

                 PKIX_LISTAPPENDITEMFAILED);

         cachedCertChainError = PKIX_PL_HashTable_Add

                 (cachedCertChainTable,

                 (PKIX_PL_Object *) cachedKeys,

                 (PKIX_PL_Object *) cachedValues,

                 plContext);

         pkix_ccAddCount++;

         if (cachedCertChainError != NULL) {

                 PKIX_DEBUG("PKIX_PL_HashTable_Add for CertChain skipped: "

                         "entry existed\n");

         }

 cleanup:

         PKIX_DECREF(cachedValues);

         PKIX_DECREF(cachedKeys);

         PKIX_DECREF(cachedCertChainError);

         PKIX_DECREF(cacheValidUntilDate);

         PKIX_RETURN(BUILD);

 }

 /*

  * FUNCTION: pkix_CacheCert_Lookup

  * DESCRIPTION:

  *

  *  Look up Cert Hash Table for a cached item based on "store" and Subject in

  *  "certSelParams" as the hash keys and returns values Certs in "pCerts".

  *  If there isn't an item to match the key, a PKIX_FALSE is returned at

  *  "pFound". The item's cache time is verified with "testDate". If out-dated,

  *  this item is removed and PKIX_FALSE is returned at "pFound".

  *  This hashtable is maintained in the following ways:

  *  1) When creating the hashtable, maximum bucket size can be specified (0 for

  *     unlimited). If items in a bucket reaches its full size, an new addition

  *     will trigger the removal of the old as FIFO sequence.

  *  2) A PKIX_PL_Date created with current time offset by constant 

  *     CACHE_ITEM_PERIOD_SECONDS is attached to each item in the Hash Table.

  *     If the CertStore this Cert is from is a trusted one, the cache period is

  *     shorter so cache can be updated more frequently.

  *     When an item is retrieved, this date is compared against "testDate" for

  *     validity. If comparison indicates this item is expired, the item is

  *     removed from the bucket.

  *

  * PARAMETERS:

  *  "store"

  *      Address of CertStore as key to retrieve this CertChain. Must be 

  *      non-NULL.

  *  "certSelParams"

  *      Address of ComCertSelParams that its subject is used as key to retrieve

  *      this CertChain. Must be non-NULL.

  *  "testDate"

  *      Address of PKIX_PL_Date for verifying time cache validity.

  *      Must be non-NULL. If testDate is NULL, this cache item won't be out

  *      dated.

  *  "pFound"

  *      Address of KPKIX_Boolean indicating valid data is found.

  *      Must be non-NULL.

  *  "pCerts"

  *      Address PKIX_List where the CertChain will be stored. Must be no-NULL.

  *  "plContext"

  *      Platform-specific context pointer.

  * THREAD SAFETY:

  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)

  * RETURNS:

  *  Returns NULL if the function succeeds.

  *  Returns an Error Error if the function fails in a non-fatal way.

  *  Returns a Fatal Error if the function fails in an unrecoverable way.

  */

 PKIX_Error *

 pkix_CacheCert_Lookup(

         PKIX_CertStore *store,

         PKIX_ComCertSelParams *certSelParams,

         PKIX_PL_Date *testDate,

         PKIX_Boolean *pFound,

         PKIX_List** pCerts,

         void *plContext)

 {

         PKIX_PL_Cert *cert = NULL;

         PKIX_List *cachedKeys = NULL;

         PKIX_List *cachedValues = NULL;

         PKIX_List *cachedCertList = NULL;

         PKIX_List *selCertList = NULL;

         PKIX_PL_X500Name *subject = NULL;

         PKIX_PL_Date *invalidAfterDate = NULL;

         PKIX_PL_Date *cacheValidUntilDate = NULL;

         PKIX_CertSelector *certSel = NULL;

         PKIX_Error *cachedCertError = NULL;

         PKIX_Error *selectorError = NULL;

         PKIX_CertSelector_MatchCallback selectorMatch = NULL;

         PKIX_Int32 cmpValidTimeResult = PKIX_FALSE;

         PKIX_Int32 cmpCacheTimeResult = 0;

         PKIX_UInt32 numItems = 0;

         PKIX_UInt32 i;

         PKIX_ENTER(BUILD, "pkix_CacheCert_Lookup");

         PKIX_NULLCHECK_TWO(store, certSelParams);

         PKIX_NULLCHECK_TWO(pFound, pCerts);

         *pFound = PKIX_FALSE;

         PKIX_CHECK(PKIX_List_Create(&cachedKeys, plContext),

                 PKIX_LISTCREATEFAILED);

         PKIX_CHECK(PKIX_List_AppendItem

                 (cachedKeys, (PKIX_PL_Object *)store, plContext),

                 PKIX_LISTAPPENDITEMFAILED);

         PKIX_CHECK(PKIX_ComCertSelParams_GetSubject

                 (certSelParams, &subject, plContext),

                 PKIX_COMCERTSELPARAMSGETSUBJECTFAILED);

         PKIX_NULLCHECK_ONE(subject);

         PKIX_CHECK(PKIX_List_AppendItem

                 (cachedKeys, (PKIX_PL_Object *)subject, plContext),

                 PKIX_LISTAPPENDITEMFAILED);

         cachedCertError = PKIX_PL_HashTable_Lookup

                     (cachedCertTable,

                     (PKIX_PL_Object *) cachedKeys,

                     (PKIX_PL_Object **) &cachedValues,

                     plContext);

         pkix_cLookupCount++;

         if (cachedValues != NULL && cachedCertError == NULL) {

                 PKIX_CHECK(PKIX_List_GetItem

                         (cachedValues,

                         0,

                         (PKIX_PL_Object **) &cacheValidUntilDate,

                         plContext),

                         PKIX_LISTGETITEMFAILED);

                 if (testDate) {

                     PKIX_CHECK(PKIX_PL_Object_Compare

                          ((PKIX_PL_Object *)testDate,

                          (PKIX_PL_Object *)cacheValidUntilDate,

                          &cmpCacheTimeResult,

                          plContext),

                          PKIX_OBJECTCOMPARATORFAILED);

                 }

                 if (cmpCacheTimeResult <= 0) {

                     PKIX_CHECK(PKIX_List_GetItem

                         (cachedValues,

                         1,

                         (PKIX_PL_Object **) &cachedCertList,

                         plContext),

                         PKIX_LISTGETITEMFAILED);

                     /*

                      * Certs put on cache satifies only for Subject,

                      * user selector and ComCertSelParams to filter.

                      */

                     PKIX_CHECK(PKIX_CertSelector_Create

                           (NULL, NULL, &certSel, plContext),

                           PKIX_CERTSELECTORCREATEFAILED);

                     PKIX_CHECK(PKIX_CertSelector_SetCommonCertSelectorParams

                           (certSel, certSelParams, plContext),

                           PKIX_CERTSELECTORSETCOMMONCERTSELECTORPARAMSFAILED);

                     PKIX_CHECK(PKIX_CertSelector_GetMatchCallback

                           (certSel, &selectorMatch, plContext),

                           PKIX_CERTSELECTORGETMATCHCALLBACKFAILED);

                     PKIX_CHECK(PKIX_List_Create(&selCertList, plContext),

                             PKIX_LISTCREATEFAILED);

                     /* 

                      * If any of the Cert on the list is out-dated, invalidate

                      * this cache item.

                      */

                     PKIX_CHECK(PKIX_List_GetLength

                         (cachedCertList, &numItems, plContext),

                         PKIX_LISTGETLENGTHFAILED);

                     for (i = 0; i < numItems; i++){

                         PKIX_CHECK(PKIX_List_GetItem

                             (cachedCertList,

                             i,

                             (PKIX_PL_Object **)&cert,

                             plContext),

                             PKIX_LISTGETITEMFAILED);

                         PKIX_CHECK(PKIX_PL_Cert_GetValidityNotAfter

                             (cert, &invalidAfterDate, plContext),

                             PKIX_CERTGETVALIDITYNOTAFTERFAILED);

                         if (testDate) {

                             PKIX_CHECK(PKIX_PL_Object_Compare

                                 ((PKIX_PL_Object *)invalidAfterDate,

                                 (PKIX_PL_Object *)testDate,

                                 &cmpValidTimeResult,

                                 plContext),

                                 PKIX_OBJECTCOMPARATORFAILED);

                         }

                         if (cmpValidTimeResult < 0) {

                             pkix_cRemoveCount++;

                             *pFound = PKIX_FALSE;

                             /* one cert is out-dated, remove item from cache */

                             PKIX_CHECK(PKIX_PL_HashTable_Remove

                                     (cachedCertTable,

                                     (PKIX_PL_Object *) cachedKeys,

                                     plContext),

                                     PKIX_HASHTABLEREMOVEFAILED);

                             goto cleanup;

                         }

                         selectorError = selectorMatch(certSel, cert, plContext);

                         if (!selectorError){

                             /* put on the return list */

                             PKIX_CHECK(PKIX_List_AppendItem

                                    (selCertList,

                                    (PKIX_PL_Object *)cert,

                                    plContext),

                                   PKIX_LISTAPPENDITEMFAILED);

                         } else {

                             PKIX_DECREF(selectorError);

                         }

                         PKIX_DECREF(cert);

                         PKIX_DECREF(invalidAfterDate);

                     }

                     if (*pFound) {

                         PKIX_INCREF(selCertList);

                         *pCerts = selCertList;

                     }

                 } else {

                     pkix_cRemoveCount++;

                     *pFound = PKIX_FALSE;

                     /* cache item is out-dated, remove it from cache */

                     PKIX_CHECK(PKIX_PL_HashTable_Remove

                                 (cachedCertTable,

                                 (PKIX_PL_Object *) cachedKeys,

                                 plContext),

                                 PKIX_HASHTABLEREMOVEFAILED);

                 }

         } 

 cleanup:

         PKIX_DECREF(subject);

         PKIX_DECREF(certSel);

         PKIX_DECREF(cachedKeys);

         PKIX_DECREF(cachedValues);

         PKIX_DECREF(cacheValidUntilDate);

         PKIX_DECREF(cert);

         PKIX_DECREF(cachedCertList);

         PKIX_DECREF(selCertList);

         PKIX_DECREF(invalidAfterDate);

         PKIX_DECREF(cachedCertError);

         PKIX_DECREF(selectorError);

         PKIX_RETURN(BUILD);

 }

 /*

  * FUNCTION: pkix_CacheCert_Add

  * DESCRIPTION:

  *

  *  Add Cert Hash Table for a cached item based on "store" and Subject in

  *  "certSelParams" as the hash keys and have "certs" as the key value.

  *  This hashtable is maintained in the following ways:

  *  1) When creating the hashtable, maximum bucket size can be specified (0 for

  *     unlimited). If items in a bucket reaches its full size, an new addition

  *     will trigger the removal of the old as FIFO sequence.

  *  2) A PKIX_PL_Date created with current time offset by constant 

  *     CACHE_ITEM_PERIOD_SECONDS is attached to each item in the Hash Table.

  *     If the CertStore this Cert is from is a trusted one, the cache period is

  *     shorter so cache can be updated more frequently.

  *     When an item is retrieved, this date is compared against "testDate" for

  *     validity. If comparison indicates this item is expired, the item is

  *     removed from the bucket.

  *

  * PARAMETERS:

  *  "store"

  *      Address of CertStore as key to retrieve this CertChain. Must be 

  *      non-NULL.

  *  "certSelParams"

  *      Address of ComCertSelParams that its subject is used as key to retrieve

  *      this CertChain. Must be non-NULL.

  *  "certs"

  *      Address PKIX_List of Certs will be stored. Must be no-NULL.

  *  "plContext"

  *      Platform-specific context pointer.

  * THREAD SAFETY:

  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)

  * RETURNS:

  *  Returns NULL if the function succeeds.

  *  Returns an Error Error if the function fails in a non-fatal way.

  *  Returns a Fatal Error if the function fails in an unrecoverable way.

  */

 PKIX_Error *

 pkix_CacheCert_Add(

         PKIX_CertStore *store,

         PKIX_ComCertSelParams *certSelParams,

         PKIX_List* certs,

         void *plContext)

 {

         PKIX_List *cachedKeys = NULL;

         PKIX_List *cachedValues = NULL;

         PKIX_PL_Date *cacheValidUntilDate = NULL;

         PKIX_PL_X500Name *subject = NULL;

         PKIX_Error *cachedCertError = NULL;

         PKIX_CertStore_CheckTrustCallback trustCallback = NULL;

         PKIX_UInt32 cachePeriod = CACHE_ITEM_PERIOD_SECONDS;

         PKIX_UInt32 numCerts = 0;

         PKIX_ENTER(BUILD, "pkix_CacheCert_Add");

         PKIX_NULLCHECK_THREE(store, certSelParams, certs);

         PKIX_CHECK(PKIX_List_GetLength(certs, &numCerts,

                                        plContext),

                    PKIX_LISTGETLENGTHFAILED);

         if (numCerts == 0) {

             /* Don't want to add an empty list. */

             goto cleanup;

         }

         PKIX_CHECK(PKIX_List_Create(&cachedKeys, plContext),

                 PKIX_LISTCREATEFAILED);

         PKIX_CHECK(PKIX_List_AppendItem

                 (cachedKeys, (PKIX_PL_Object *)store, plContext),

                 PKIX_LISTAPPENDITEMFAILED);

         PKIX_CHECK(PKIX_ComCertSelParams_GetSubject

                 (certSelParams, &subject, plContext),

                 PKIX_COMCERTSELPARAMSGETSUBJECTFAILED);

         PKIX_NULLCHECK_ONE(subject);

         PKIX_CHECK(PKIX_List_AppendItem

                 (cachedKeys, (PKIX_PL_Object *)subject, plContext),

                 PKIX_LISTAPPENDITEMFAILED);

         PKIX_CHECK(PKIX_List_Create(&cachedValues, plContext),

                 PKIX_LISTCREATEFAILED);

         PKIX_CHECK(PKIX_CertStore_GetTrustCallback

                 (store, &trustCallback, plContext),

                 PKIX_CERTSTOREGETTRUSTCALLBACKFAILED);

         if (trustCallback) {

                 cachePeriod = CACHE_TRUST_ITEM_PERIOD_SECONDS;

         }

         PKIX_CHECK(PKIX_PL_Date_Create_CurrentOffBySeconds

                (cachePeriod, &cacheValidUntilDate, plContext),

                PKIX_DATECREATECURRENTOFFBYSECONDSFAILED);

         PKIX_CHECK(PKIX_List_AppendItem

                 (cachedValues,

                 (PKIX_PL_Object *)cacheValidUntilDate,

                 plContext),

                 PKIX_LISTAPPENDITEMFAILED);

         PKIX_CHECK(PKIX_List_AppendItem

                 (cachedValues,

                 (PKIX_PL_Object *)certs,

                 plContext),

                 PKIX_LISTAPPENDITEMFAILED);

         cachedCertError = PKIX_PL_HashTable_Add

                     (cachedCertTable,

                     (PKIX_PL_Object *) cachedKeys,

                     (PKIX_PL_Object *) cachedValues,

                     plContext);

         pkix_cAddCount++;

         if (cachedCertError != NULL) {

                 PKIX_DEBUG("PKIX_PL_HashTable_Add for Certs skipped: "

                         "entry existed\n");

         }

 cleanup:

         PKIX_DECREF(subject);

         PKIX_DECREF(cachedKeys);

         PKIX_DECREF(cachedValues);

         PKIX_DECREF(cacheValidUntilDate);

         PKIX_DECREF(cachedCertError);

         PKIX_RETURN(BUILD);

 }

 /*

  * FUNCTION: pkix_CacheCrlEntry_Lookup

  * DESCRIPTION:

  *

  *  Look up CrlEntry Hash Table for a cached item based on "store",

  *  "certIssuer" and "certSerialNumber" as the hash keys and returns values

  *  "pCrls". If there isn't an item to match the key, a PKIX_FALSE is

  *  returned at "pFound".

  *  This hashtable is maintained in the following way:

  *  1) When creating the hashtable, maximum bucket size can be specified (0 for

  *     unlimited). If items in a bucket reaches its full size, an new addition

  *     will trigger the removal of the old as FIFO sequence.

  *

  * PARAMETERS:

  *  "store"

  *      Address of CertStore as key to retrieve this CertChain. Must be 

  *      non-NULL.

  *  "certIssuer"

  *      Address of X500Name that is used as key to retrieve the CRLEntries.

  *      Must be non-NULL.

  *  "certSerialNumber"

  *      Address of BigInt that is used as key to retrieve the CRLEntries.

  *      Must be non-NULL.

  *  "pFound"

  *      Address of KPKIX_Boolean indicating valid data is found.

  *      Must be non-NULL.

  *  "pCrls"

  *      Address PKIX_List where the CRLEntry will be stored. Must be no-NULL.

  *  "plContext"

  *      Platform-specific context pointer.

  * THREAD SAFETY:

  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)

  * RETURNS:

  *  Returns NULL if the function succeeds.

  *  Returns an Error Error if the function fails in a non-fatal way.

  *  Returns a Fatal Error if the function fails in an unrecoverable way.

  */

 PKIX_Error *

 pkix_CacheCrlEntry_Lookup(

         PKIX_CertStore *store,

         PKIX_PL_X500Name *certIssuer,

         PKIX_PL_BigInt *certSerialNumber,

         PKIX_Boolean *pFound,

         PKIX_List** pCrls,

         void *plContext)

 {

         PKIX_List *cachedKeys = NULL;

         PKIX_List *cachedCrlEntryList = NULL;

         PKIX_Error *cachedCrlEntryError = NULL;

         PKIX_ENTER(BUILD, "pkix_CacheCrlEntry_Lookup");

         PKIX_NULLCHECK_THREE(store, certIssuer, certSerialNumber);

         PKIX_NULLCHECK_TWO(pFound, pCrls);

         *pFound = PKIX_FALSE;

         /* Find CrlEntry(s) by issuer and serial number */

         PKIX_CHECK(PKIX_List_Create(&cachedKeys, plContext),

                     PKIX_LISTCREATEFAILED);

         PKIX_CHECK(PKIX_List_AppendItem

                     (cachedKeys, (PKIX_PL_Object *)store, plContext),

                     PKIX_LISTAPPENDITEMFAILED);

         PKIX_CHECK(PKIX_List_AppendItem

                     (cachedKeys, (PKIX_PL_Object *)certIssuer, plContext),

                     PKIX_LISTAPPENDITEMFAILED);

         PKIX_CHECK(PKIX_List_AppendItem

                     (cachedKeys,

                     (PKIX_PL_Object *)certSerialNumber,

                     plContext),

                     PKIX_LISTAPPENDITEMFAILED);

         cachedCrlEntryError = PKIX_PL_HashTable_Lookup

                     (cachedCrlEntryTable,

                     (PKIX_PL_Object *) cachedKeys,

                     (PKIX_PL_Object **) &cachedCrlEntryList,

                     plContext);

         pkix_ceLookupCount++;

         /* 

          * We don't need check Date to invalidate this cache item,

          * the item is uniquely defined and won't be reverted. Let

          * the FIFO for cleaning up.

          */

         if (cachedCrlEntryList != NULL && cachedCrlEntryError == NULL ) {

                 PKIX_INCREF(cachedCrlEntryList);

                 *pCrls = cachedCrlEntryList;

                 *pFound = PKIX_TRUE;

         } else {

                 *pFound = PKIX_FALSE;

         }

 cleanup:

         PKIX_DECREF(cachedKeys);

         PKIX_DECREF(cachedCrlEntryList);

         PKIX_DECREF(cachedCrlEntryError);

         PKIX_RETURN(BUILD);

 }

 /*

  * FUNCTION: pkix_CacheCrlEntry_Add

  * DESCRIPTION:

  *

  *  Look up CrlEntry Hash Table for a cached item based on "store",

  *  "certIssuer" and "certSerialNumber" as the hash keys and have "pCrls" as

  *  the hash value. If there isn't an item to match the key, a PKIX_FALSE is

  *  returned at "pFound".

  *  This hashtable is maintained in the following way:

  *  1) When creating the hashtable, maximum bucket size can be specified (0 for

  *     unlimited). If items in a bucket reaches its full size, an new addition

  *     will trigger the removal of the old as FIFO sequence.

  *

  * PARAMETERS:

  *  "store"

  *      Address of CertStore as key to retrieve this CertChain. Must be 

  *      non-NULL.

  *  "certIssuer"

  *      Address of X500Name that is used as key to retrieve the CRLEntries.

  *      Must be non-NULL.

  *  "certSerialNumber"

  *      Address of BigInt that is used as key to retrieve the CRLEntries.

  *      Must be non-NULL.

  *  "crls"

  *      Address PKIX_List where the CRLEntry is stored. Must be no-NULL.

  *  "plContext"

  *      Platform-specific context pointer.

  * THREAD SAFETY:

  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)

  * RETURNS:

  *  Returns NULL if the function succeeds.

  *  Returns an Error Error if the function fails in a non-fatal way.

  *  Returns a Fatal Error if the function fails in an unrecoverable way.

  */

 PKIX_Error *

 pkix_CacheCrlEntry_Add(

         PKIX_CertStore *store,

         PKIX_PL_X500Name *certIssuer,

         PKIX_PL_BigInt *certSerialNumber,

         PKIX_List* crls,

         void *plContext)

 {

         PKIX_List *cachedKeys = NULL;

         PKIX_Error *cachedCrlEntryError = NULL;

         PKIX_ENTER(BUILD, "pkix_CacheCrlEntry_Add");

         PKIX_NULLCHECK_THREE(store, certIssuer, certSerialNumber);

         PKIX_NULLCHECK_ONE(crls);

         /* Add CrlEntry(s) by issuer and serial number */

         PKIX_CHECK(PKIX_List_Create(&cachedKeys, plContext),

                     PKIX_LISTCREATEFAILED);

         PKIX_CHECK(PKIX_List_AppendItem

                     (cachedKeys, (PKIX_PL_Object *)store, plContext),

                     PKIX_LISTAPPENDITEMFAILED);

         PKIX_CHECK(PKIX_List_AppendItem

                     (cachedKeys, (PKIX_PL_Object *)certIssuer, plContext),

                     PKIX_LISTAPPENDITEMFAILED);

         PKIX_CHECK(PKIX_List_AppendItem

                     (cachedKeys,

                     (PKIX_PL_Object *)certSerialNumber,

                     plContext),

                     PKIX_LISTAPPENDITEMFAILED);

         cachedCrlEntryError = PKIX_PL_HashTable_Add

                     (cachedCrlEntryTable,

                     (PKIX_PL_Object *) cachedKeys,

                     (PKIX_PL_Object *) crls,

                     plContext);

         pkix_ceAddCount++;

 cleanup:

         PKIX_DECREF(cachedKeys);

         PKIX_DECREF(cachedCrlEntryError);

         PKIX_RETURN(BUILD);

 }

 #ifdef PKIX_OBJECT_LEAK_TEST

 /* TEST_START_FN and testStartFnStackPosition define at what state

  * of the stack the object leak testing should begin. The condition

  * in pkix_CheckForGeneratedError works the following way: do leak

  * testing if at position testStartFnStackPosition in stack array

  * (fnStackNameArr) we have called function TEST_START_FN.

  * Note, that stack array get filled only when executing libpkix

  * functions.

  * */

 #define TEST_START_FN "PKIX_BuildChain"

 PKIX_Error*

 pkix_CheckForGeneratedError(PKIX_StdVars * stdVars, 

                             PKIX_ERRORCLASS errClass, 

                             char * fnName,

                             PKIX_Boolean *errSetFlag,

                             void * plContext)

 {

     PKIX_Error *genErr = NULL;

     PKIX_UInt32 pos = 0;

     PKIX_UInt32 strLen = 0;

     if (fnName) { 

         if (fnStackNameArr[testStartFnStackPosition] == NULL ||

             strcmp(fnStackNameArr[testStartFnStackPosition], TEST_START_FN)

             ) {

             /* return with out error if not with in boundary */

             return NULL;

         }

         if (!strcmp(fnName, TEST_START_FN)) {

             *errSetFlag = PKIX_TRUE;

             noErrorState = PKIX_FALSE;

             errorGenerated = PKIX_FALSE;

         }

     }   

     if (noErrorState || errorGenerated)  return NULL;

     if (fnName && (

         !strcmp(fnName, "PKIX_PL_Object_DecRef") ||

         !strcmp(fnName, "PKIX_PL_Object_Unlock") ||

         !strcmp(fnName, "pkix_UnlockObject") ||

         !strcmp(fnName, "pkix_Throw") ||

         !strcmp(fnName, "pkix_trace_dump_cert") ||

         !strcmp(fnName, "PKIX_PL_Free"))) {

         /* do not generate error for this functions */

         noErrorState = PKIX_TRUE;

         *errSetFlag = PKIX_TRUE;

         return NULL;

     }

     if (PL_HashTableLookup(fnInvTable, &fnStackInvCountArr[stackPosition - 1])) {

         return NULL;

     }

     PL_HashTableAdd(fnInvTable, &fnStackInvCountArr[stackPosition - 1], nonNullValue);

     errorGenerated = PKIX_TRUE;

     noErrorState = PKIX_TRUE;

     genErr = PKIX_DoThrow(stdVars, errClass, PKIX_MEMLEAKGENERATEDERROR,

                           errClass, plContext);

     while(fnStackNameArr[pos]) {

         strLen += PORT_Strlen(fnStackNameArr[pos++]) + 1;

     }

     strLen += 1; /* end of line. */

     pos = 0;

     errorFnStackString = PORT_ZAlloc(strLen);

     while(fnStackNameArr[pos]) {

         strcat(errorFnStackString, "/");

         strcat(errorFnStackString, fnStackNameArr[pos++]);

     }

     noErrorState = PKIX_FALSE;

     return genErr;

 }

 #endif /* PKIX_OBJECT_LEAK_TEST */