michael@0: /* This Source Code Form is subject to the terms of the Mozilla Public
michael@0:  * License, v. 2.0. If a copy of the MPL was not distributed with this
michael@0:  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
michael@0: 
michael@0: /*
michael@0:  * CMS digesting.
michael@0:  */
michael@0: 
michael@0: #include "cmslocal.h"
michael@0: 
michael@0: #include "cert.h"
michael@0: #include "key.h"
michael@0: #include "secitem.h"
michael@0: #include "secoid.h"
michael@0: #include "pk11func.h"
michael@0: #include "prtime.h"
michael@0: #include "secerr.h"
michael@0: 
michael@0: /*  #define CMS_FIND_LEAK_MULTIPLE 1 */
michael@0: #ifdef CMS_FIND_LEAK_MULTIPLE
michael@0: static int stop_on_err = 1;
michael@0: static int global_num_digests = 0;
michael@0: #endif
michael@0: 
michael@0: struct digestPairStr { 
michael@0:     const SECHashObject * digobj;
michael@0:     void *                digcx;
michael@0: };
michael@0: typedef struct digestPairStr digestPair;
michael@0: 
michael@0: struct NSSCMSDigestContextStr {
michael@0:     PRBool		saw_contents;
michael@0:     PLArenaPool *       pool;
michael@0:     int			digcnt;
michael@0:     digestPair  *       digPairs;
michael@0: };
michael@0: 
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDigestContext_StartMultiple - start digest calculation using all the
michael@0:  *  digest algorithms in "digestalgs" in parallel.
michael@0:  */
michael@0: NSSCMSDigestContext *
michael@0: NSS_CMSDigestContext_StartMultiple(SECAlgorithmID **digestalgs)
michael@0: {
michael@0:     PLArenaPool *        pool;
michael@0:     NSSCMSDigestContext *cmsdigcx;
michael@0:     int digcnt;
michael@0:     int i;
michael@0: 
michael@0: #ifdef CMS_FIND_LEAK_MULTIPLE
michael@0:     PORT_Assert(global_num_digests == 0 || !stop_on_err);
michael@0: #endif
michael@0: 
michael@0:     digcnt = (digestalgs == NULL) ? 0 : NSS_CMSArray_Count((void **)digestalgs);
michael@0:     /* It's OK if digcnt is zero.  We have to allow this for "certs only"
michael@0:     ** messages.
michael@0:     */
michael@0:     pool = PORT_NewArena(2048);
michael@0:     if (!pool)
michael@0:     	return NULL;
michael@0: 
michael@0:     cmsdigcx = PORT_ArenaNew(pool, NSSCMSDigestContext);
michael@0:     if (cmsdigcx == NULL)
michael@0: 	goto loser;
michael@0: 
michael@0:     cmsdigcx->saw_contents = PR_FALSE;
michael@0:     cmsdigcx->pool   = pool;
michael@0:     cmsdigcx->digcnt = digcnt;
michael@0: 
michael@0:     cmsdigcx->digPairs = PORT_ArenaZNewArray(pool, digestPair, digcnt);
michael@0:     if (cmsdigcx->digPairs == NULL) {
michael@0: 	goto loser;
michael@0:     }
michael@0: 
michael@0:     /*
michael@0:      * Create a digest object context for each algorithm.
michael@0:      */
michael@0:     for (i = 0; i < digcnt; i++) {
michael@0: 	const SECHashObject *digobj;
michael@0: 	void *digcx;
michael@0: 
michael@0: 	digobj = NSS_CMSUtil_GetHashObjByAlgID(digestalgs[i]);
michael@0: 	/*
michael@0: 	 * Skip any algorithm we do not even recognize; obviously,
michael@0: 	 * this could be a problem, but if it is critical then the
michael@0: 	 * result will just be that the signature does not verify.
michael@0: 	 * We do not necessarily want to error out here, because
michael@0: 	 * the particular algorithm may not actually be important,
michael@0: 	 * but we cannot know that until later.
michael@0: 	 */
michael@0: 	if (digobj == NULL)
michael@0: 	    continue;
michael@0: 
michael@0: 	digcx = (*digobj->create)();
michael@0: 	if (digcx != NULL) {
michael@0: 	    (*digobj->begin) (digcx);
michael@0: 	    cmsdigcx->digPairs[i].digobj = digobj;
michael@0: 	    cmsdigcx->digPairs[i].digcx  = digcx;
michael@0: #ifdef CMS_FIND_LEAK_MULTIPLE
michael@0: 	    global_num_digests++;
michael@0: #endif
michael@0: 	}
michael@0:     }
michael@0:     return cmsdigcx;
michael@0: 
michael@0: loser:
michael@0:     /* no digest objects have been created, or need to be destroyed. */
michael@0:     if (pool) {
michael@0:     	PORT_FreeArena(pool, PR_FALSE);
michael@0:     }
michael@0:     return NULL;
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDigestContext_StartSingle - same as 
michael@0:  * NSS_CMSDigestContext_StartMultiple, but only one algorithm.
michael@0:  */
michael@0: NSSCMSDigestContext *
michael@0: NSS_CMSDigestContext_StartSingle(SECAlgorithmID *digestalg)
michael@0: {
michael@0:     SECAlgorithmID *digestalgs[] = { NULL, NULL };		/* fake array */
michael@0: 
michael@0:     digestalgs[0] = digestalg;
michael@0:     return NSS_CMSDigestContext_StartMultiple(digestalgs);
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDigestContext_Update - feed more data into the digest machine
michael@0:  */
michael@0: void
michael@0: NSS_CMSDigestContext_Update(NSSCMSDigestContext *cmsdigcx, 
michael@0:                             const unsigned char *data, int len)
michael@0: {
michael@0:     int i;
michael@0:     digestPair *pair = cmsdigcx->digPairs;
michael@0: 
michael@0:     cmsdigcx->saw_contents = PR_TRUE;
michael@0: 
michael@0:     for (i = 0; i < cmsdigcx->digcnt; i++, pair++) {
michael@0: 	if (pair->digcx) {
michael@0: 	    (*pair->digobj->update)(pair->digcx, data, len);
michael@0:     	}
michael@0:     }
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDigestContext_Cancel - cancel digesting operation
michael@0:  */
michael@0: void
michael@0: NSS_CMSDigestContext_Cancel(NSSCMSDigestContext *cmsdigcx)
michael@0: {
michael@0:     int i;
michael@0:     digestPair *pair = cmsdigcx->digPairs;
michael@0: 
michael@0:     for (i = 0; i < cmsdigcx->digcnt; i++, pair++) {
michael@0: 	if (pair->digcx) {
michael@0: 	    (*pair->digobj->destroy)(pair->digcx, PR_TRUE);
michael@0: #ifdef CMS_FIND_LEAK_MULTIPLE
michael@0: 	    --global_num_digests;
michael@0: #endif
michael@0:     	}
michael@0:     }
michael@0: #ifdef CMS_FIND_LEAK_MULTIPLE
michael@0:     PORT_Assert(global_num_digests == 0 || !stop_on_err);
michael@0: #endif
michael@0:     PORT_FreeArena(cmsdigcx->pool, PR_FALSE);
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDigestContext_FinishMultiple - finish the digests and put them
michael@0:  *  into an array of SECItems (allocated on poolp)
michael@0:  */
michael@0: SECStatus
michael@0: NSS_CMSDigestContext_FinishMultiple(NSSCMSDigestContext *cmsdigcx, 
michael@0:                                     PLArenaPool *poolp,
michael@0: 			            SECItem ***digestsp)
michael@0: {
michael@0:     SECItem **  digests = NULL;
michael@0:     digestPair *pair;
michael@0:     void *      mark;
michael@0:     int         i;
michael@0:     SECStatus   rv;
michael@0: 
michael@0:     /* no contents? do not finish digests */
michael@0:     if (digestsp == NULL || !cmsdigcx->saw_contents) {
michael@0: 	rv = SECSuccess;
michael@0: 	goto cleanup;
michael@0:     }
michael@0: 
michael@0:     mark = PORT_ArenaMark (poolp);
michael@0: 
michael@0:     /* allocate digest array & SECItems on arena */
michael@0:     digests = PORT_ArenaNewArray( poolp, SECItem *, cmsdigcx->digcnt + 1);
michael@0: 
michael@0:     rv = ((digests == NULL) ? SECFailure : SECSuccess);
michael@0:     pair = cmsdigcx->digPairs;
michael@0:     for (i = 0; rv == SECSuccess && i < cmsdigcx->digcnt; i++, pair++) {
michael@0: 	SECItem digest;
michael@0: 	unsigned char hash[HASH_LENGTH_MAX];
michael@0: 
michael@0: 	if (!pair->digcx) {
michael@0: 	    digests[i] = NULL;
michael@0: 	    continue;
michael@0: 	}
michael@0: 
michael@0: 	digest.type = siBuffer;
michael@0: 	digest.data = hash;
michael@0: 	digest.len  = pair->digobj->length;
michael@0: 	(* pair->digobj->end)(pair->digcx, hash, &digest.len, digest.len);
michael@0: 	digests[i] = SECITEM_ArenaDupItem(poolp, &digest);
michael@0: 	if (!digests[i]) {
michael@0: 	    rv = SECFailure;
michael@0: 	}
michael@0:     }
michael@0:     digests[i] = NULL;
michael@0:     if (rv == SECSuccess) {
michael@0: 	PORT_ArenaUnmark(poolp, mark);
michael@0:     } else
michael@0: 	PORT_ArenaRelease(poolp, mark);
michael@0: 
michael@0: cleanup:
michael@0:     NSS_CMSDigestContext_Cancel(cmsdigcx);
michael@0:     /* Don't change the caller's digests pointer if we have no digests.
michael@0:     **  NSS_CMSSignedData_Encode_AfterData depends on this behavior.
michael@0:     */
michael@0:     if (rv == SECSuccess && digestsp && digests) {
michael@0: 	*digestsp = digests;
michael@0:     }
michael@0:     return rv;
michael@0: }
michael@0: 
michael@0: /*
michael@0:  * NSS_CMSDigestContext_FinishSingle - same as 
michael@0:  * NSS_CMSDigestContext_FinishMultiple, but for one digest.
michael@0:  */
michael@0: SECStatus
michael@0: NSS_CMSDigestContext_FinishSingle(NSSCMSDigestContext *cmsdigcx, 
michael@0:                                   PLArenaPool *poolp,
michael@0: 			          SECItem *digest)
michael@0: {
michael@0:     SECStatus rv = SECFailure;
michael@0:     SECItem **dp;
michael@0:     PLArenaPool *arena = NULL;
michael@0: 
michael@0:     if ((arena = PORT_NewArena(1024)) == NULL)
michael@0: 	goto loser;
michael@0: 
michael@0:     /* get the digests into arena, then copy the first digest into poolp */
michael@0:     rv = NSS_CMSDigestContext_FinishMultiple(cmsdigcx, arena, &dp);
michael@0:     if (rv == SECSuccess) {
michael@0: 	/* now copy it into poolp */
michael@0: 	rv = SECITEM_CopyItem(poolp, digest, dp[0]);
michael@0:     }
michael@0: loser:
michael@0:     if (arena)
michael@0: 	PORT_FreeArena(arena, PR_FALSE);
michael@0: 
michael@0:     return rv;
michael@0: }