Source code
Revision control
Copy as Markdown
Other Tools
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
/****************************************************************************
* Read in a cert chain from one or more files, and verify the chain for
* some usage.
* *
* This code was modified from other code also kept in the NSS directory.
****************************************************************************/
#include <stdio.h>
#include <string.h>
#if defined(XP_UNIX)
#include <unistd.h>
#endif
#include "prerror.h"
#include "pk11func.h"
#include "seccomon.h"
#include "secutil.h"
#include "secmod.h"
#include "secitem.h"
#include "cert.h"
#include "ocsp.h"
/* #include <stdlib.h> */
/* #include <errno.h> */
/* #include <fcntl.h> */
/* #include <stdarg.h> */
#include "nspr.h"
#include "plgetopt.h"
#include "prio.h"
#include "nss.h"
/* #include "vfyutil.h" */
#define RD_BUF_SIZE (60 * 1024)
int verbose;
secuPWData pwdata = { PW_NONE, 0 };
static void
Usage(const char *progName)
{
fprintf(stderr,
"Usage: %s [options] [revocation options] certfile "
"[[options] certfile] ...\n"
"\tWhere options are:\n"
"\t-a\t\t Following certfile is base64 encoded\n"
"\t-b YYMMDDHHMMZ\t Validate date (default: now)\n"
"\t-d directory\t Database directory\n"
"\t-i number of consecutive verifications\n"
"\t-f \t\t Enable cert fetching from AIA URL\n"
"\t-o oid\t\t Set policy OID for cert validation(Format OID.1.2.3)\n"
"\t-p \t\t Use PKIX Library to validate certificate by calling:\n"
"\t\t\t * CERT_VerifyCertificate if specified once,\n"
"\t\t\t * CERT_PKIXVerifyCert if specified twice and more.\n"
"\t-r\t\t Following certfile is raw binary DER (default)\n"
"\t-t\t\t Following cert is explicitly trusted (overrides db trust).\n"
"\t-u usage \t 0=SSL client, 1=SSL server, 2=SSL StepUp, 3=SSL CA,\n"
"\t\t\t 4=Email signer, 5=Email recipient, 6=Object signer,\n"
"\t\t\t 9=ProtectedObjectSigner, 10=OCSP responder, 11=Any CA,\n"
"\t\t\t 12=IPsec\n"
"\t-T\t\t Trust both explicit trust anchors (-t) and the database.\n"
"\t\t\t (Default is to only trust certificates marked -t, if there are any,\n"
"\t\t\t or to trust the database if there are certificates marked -t.)\n"
"\t-v\t\t Verbose mode. Prints root cert subject(double the\n"
"\t\t\t argument for whole root cert info)\n"
"\t-w password\t Database password.\n"
"\t-W pwfile\t Password file.\n\n"
"\tRevocation options for PKIX API(invoked with -pp options) is a\n"
"\tcollection of the following flags:\n"
"\t\t[-g type [-h flags] [-m type [-s flags]] ...] ...\n"
"\tWhere:\n"
"\t-g test type\t Sets status checking test type. Possible values\n"
"\t\t\tare \"leaf\" or \"chain\"\n"
"\t-h test flags\t Sets revocation flags for the test type it\n"
"\t\t\tfollows. Possible flags: \"testLocalInfoFirst\" and\n"
"\t\t\t\"requireFreshInfo\".\n"
"\t-m method type\t Sets method type for the test type it follows.\n"
"\t\t\tPossible types are \"crl\" and \"ocsp\".\n"
"\t-s method flags\t Sets revocation flags for the method it follows.\n"
"\t\t\tPossible types are \"doNotUse\", \"forbidFetching\",\n"
"\t\t\t\"ignoreDefaultSrc\", \"requireInfo\" and \"failIfNoInfo\".\n",
progName);
exit(1);
}
/**************************************************************************
**
** Error and information routines.
**
**************************************************************************/
void
errWarn(char *function)
{
fprintf(stderr, "Error in function %s: %s\n",
function, SECU_Strerror(PR_GetError()));
}
void
exitErr(char *function)
{
errWarn(function);
/* Exit gracefully. */
/* ignoring return value of NSS_Shutdown as code exits with 1 anyway*/
(void)NSS_Shutdown();
PR_Cleanup();
exit(1);
}
typedef struct certMemStr {
struct certMemStr *next;
CERTCertificate *cert;
} certMem;
certMem *theCerts;
CERTCertList *trustedCertList;
void
rememberCert(CERTCertificate *cert, PRBool trusted)
{
if (trusted) {
if (!trustedCertList) {
trustedCertList = CERT_NewCertList();
}
CERT_AddCertToListTail(trustedCertList, cert);
} else {
certMem *newCertMem = PORT_ZNew(certMem);
if (newCertMem) {
newCertMem->next = theCerts;
newCertMem->cert = cert;
theCerts = newCertMem;
}
}
}
void
forgetCerts(void)
{
certMem *oldCertMem;
while (theCerts) {
oldCertMem = theCerts;
theCerts = theCerts->next;
CERT_DestroyCertificate(oldCertMem->cert);
PORT_Free(oldCertMem);
}
if (trustedCertList) {
CERT_DestroyCertList(trustedCertList);
}
}
CERTCertificate *
getCert(const char *name, PRBool isAscii, const char *progName)
{
CERTCertificate *cert;
CERTCertDBHandle *defaultDB;
PRFileDesc *fd;
SECStatus rv;
SECItem item = { 0, NULL, 0 };
defaultDB = CERT_GetDefaultCertDB();
/* First, let's try to find the cert in existing DB. */
cert = CERT_FindCertByNicknameOrEmailAddr(defaultDB, name);
if (cert) {
return cert;
}
/* Don't have a cert with name "name" in the DB. Try to
* open a file with such name and get the cert from there.*/
fd = PR_Open(name, PR_RDONLY, 0777);
if (!fd) {
PRErrorCode err = PR_GetError();
fprintf(stderr, "open of %s failed, %d = %s\n",
name, err, SECU_Strerror(err));
return cert;
}
rv = SECU_ReadDERFromFile(&item, fd, isAscii, PR_FALSE);
PR_Close(fd);
if (rv != SECSuccess) {
fprintf(stderr, "%s: SECU_ReadDERFromFile failed\n", progName);
return cert;
}
if (!item.len) { /* file was empty */
fprintf(stderr, "cert file %s was empty.\n", name);
return cert;
}
cert = CERT_NewTempCertificate(defaultDB, &item,
NULL /* nickname */,
PR_FALSE /* isPerm */,
PR_TRUE /* copyDER */);
if (!cert) {
PRErrorCode err = PR_GetError();
fprintf(stderr, "couldn't import %s, %d = %s\n",
name, err, SECU_Strerror(err));
}
PORT_Free(item.data);
return cert;
}
#define REVCONFIG_TEST_UNDEFINED 0
#define REVCONFIG_TEST_LEAF 1
#define REVCONFIG_TEST_CHAIN 2
#define REVCONFIG_METHOD_CRL 1
#define REVCONFIG_METHOD_OCSP 2
#define REVCONFIG_TEST_LEAF_STR "leaf"
#define REVCONFIG_TEST_CHAIN_STR "chain"
#define REVCONFIG_METHOD_CRL_STR "crl"
#define REVCONFIG_METHOD_OCSP_STR "ocsp"
#define REVCONFIG_TEST_TESTLOCALINFOFIRST_STR "testLocalInfoFirst"
#define REVCONFIG_TEST_REQUIREFRESHINFO_STR "requireFreshInfo"
#define REVCONFIG_METHOD_DONOTUSEMETHOD_STR "doNotUse"
#define REVCONFIG_METHOD_FORBIDNETWORKFETCHIN_STR "forbidFetching"
#define REVCONFIG_METHOD_IGNOREDEFAULTSRC_STR "ignoreDefaultSrc"
#define REVCONFIG_METHOD_REQUIREINFO_STR "requireInfo"
#define REVCONFIG_METHOD_FAILIFNOINFO_STR "failIfNoInfo"
#define REV_METHOD_INDEX_MAX 4
typedef struct RevMethodsStruct {
unsigned int testType;
char *testTypeStr;
unsigned int testFlags;
char *testFlagsStr;
unsigned int methodType;
char *methodTypeStr;
unsigned int methodFlags;
char *methodFlagsStr;
} RevMethods;
RevMethods revMethodsData[REV_METHOD_INDEX_MAX];
SECStatus
parseRevMethodsAndFlags()
{
int i;
unsigned int testType = 0;
for (i = 0; i < REV_METHOD_INDEX_MAX; i++) {
/* testType */
if (revMethodsData[i].testTypeStr) {
char *typeStr = revMethodsData[i].testTypeStr;
testType = 0;
if (!PORT_Strcmp(typeStr, REVCONFIG_TEST_LEAF_STR)) {
testType = REVCONFIG_TEST_LEAF;
} else if (!PORT_Strcmp(typeStr, REVCONFIG_TEST_CHAIN_STR)) {
testType = REVCONFIG_TEST_CHAIN;
}
}
if (!testType) {
return SECFailure;
}
revMethodsData[i].testType = testType;
/* testFlags */
if (revMethodsData[i].testFlagsStr) {
char *flagStr = revMethodsData[i].testFlagsStr;
unsigned int testFlags = 0;
if (PORT_Strstr(flagStr, REVCONFIG_TEST_TESTLOCALINFOFIRST_STR)) {
testFlags |= CERT_REV_MI_TEST_ALL_LOCAL_INFORMATION_FIRST;
}
if (PORT_Strstr(flagStr, REVCONFIG_TEST_REQUIREFRESHINFO_STR)) {
testFlags |= CERT_REV_MI_REQUIRE_SOME_FRESH_INFO_AVAILABLE;
}
revMethodsData[i].testFlags = testFlags;
}
/* method type */
if (revMethodsData[i].methodTypeStr) {
char *methodStr = revMethodsData[i].methodTypeStr;
unsigned int methodType = 0;
if (!PORT_Strcmp(methodStr, REVCONFIG_METHOD_CRL_STR)) {
methodType = REVCONFIG_METHOD_CRL;
} else if (!PORT_Strcmp(methodStr, REVCONFIG_METHOD_OCSP_STR)) {
methodType = REVCONFIG_METHOD_OCSP;
}
if (!methodType) {
return SECFailure;
}
revMethodsData[i].methodType = methodType;
}
if (!revMethodsData[i].methodType) {
revMethodsData[i].testType = REVCONFIG_TEST_UNDEFINED;
continue;
}
/* method flags */
if (revMethodsData[i].methodFlagsStr) {
char *flagStr = revMethodsData[i].methodFlagsStr;
unsigned int methodFlags = 0;
if (!PORT_Strstr(flagStr, REVCONFIG_METHOD_DONOTUSEMETHOD_STR)) {
methodFlags |= CERT_REV_M_TEST_USING_THIS_METHOD;
}
if (PORT_Strstr(flagStr,
REVCONFIG_METHOD_FORBIDNETWORKFETCHIN_STR)) {
methodFlags |= CERT_REV_M_FORBID_NETWORK_FETCHING;
}
if (PORT_Strstr(flagStr, REVCONFIG_METHOD_IGNOREDEFAULTSRC_STR)) {
methodFlags |= CERT_REV_M_IGNORE_IMPLICIT_DEFAULT_SOURCE;
}
if (PORT_Strstr(flagStr, REVCONFIG_METHOD_REQUIREINFO_STR)) {
methodFlags |= CERT_REV_M_REQUIRE_INFO_ON_MISSING_SOURCE;
}
if (PORT_Strstr(flagStr, REVCONFIG_METHOD_FAILIFNOINFO_STR)) {
methodFlags |= CERT_REV_M_FAIL_ON_MISSING_FRESH_INFO;
}
revMethodsData[i].methodFlags = methodFlags;
} else {
revMethodsData[i].methodFlags |= CERT_REV_M_TEST_USING_THIS_METHOD;
}
}
return SECSuccess;
}
SECStatus
configureRevocationParams(CERTRevocationFlags *flags)
{
int i;
unsigned int testType = REVCONFIG_TEST_UNDEFINED;
static CERTRevocationTests *revTests = NULL;
PRUint64 *revFlags = NULL;
for (i = 0; i < REV_METHOD_INDEX_MAX; i++) {
if (revMethodsData[i].testType == REVCONFIG_TEST_UNDEFINED) {
continue;
}
if (revMethodsData[i].testType != testType) {
testType = revMethodsData[i].testType;
if (testType == REVCONFIG_TEST_CHAIN) {
revTests = &flags->chainTests;
} else {
revTests = &flags->leafTests;
}
revTests->number_of_preferred_methods = 0;
revTests->preferred_methods = 0;
revFlags = revTests->cert_rev_flags_per_method;
}
/* Set the number of the methods independently to the max number of
* methods. If method flags are not set it will be ignored due to
* default DO_NOT_USE flag. */
revTests->number_of_defined_methods = cert_revocation_method_count;
revTests->cert_rev_method_independent_flags |=
revMethodsData[i].testFlags;
if (revMethodsData[i].methodType == REVCONFIG_METHOD_CRL) {
revFlags[cert_revocation_method_crl] =
revMethodsData[i].methodFlags;
} else if (revMethodsData[i].methodType == REVCONFIG_METHOD_OCSP) {
revFlags[cert_revocation_method_ocsp] =
revMethodsData[i].methodFlags;
}
}
return SECSuccess;
}
void
freeRevocationMethodData()
{
int i = 0;
for (; i < REV_METHOD_INDEX_MAX; i++) {
if (revMethodsData[i].testTypeStr) {
PORT_Free(revMethodsData[i].testTypeStr);
}
if (revMethodsData[i].testFlagsStr) {
PORT_Free(revMethodsData[i].testFlagsStr);
}
if (revMethodsData[i].methodTypeStr) {
PORT_Free(revMethodsData[i].methodTypeStr);
}
if (revMethodsData[i].methodFlagsStr) {
PORT_Free(revMethodsData[i].methodFlagsStr);
}
}
}
PRBool
isOCSPEnabled()
{
int i;
for (i = 0; i < REV_METHOD_INDEX_MAX; i++) {
if (revMethodsData[i].methodType == REVCONFIG_METHOD_OCSP) {
return PR_TRUE;
}
}
return PR_FALSE;
}
int
main(int argc, char *argv[], char *envp[])
{
char *certDir = NULL;
char *progName = NULL;
char *oidStr = NULL;
CERTCertificate *cert;
CERTCertificate *firstCert = NULL;
CERTCertificate *issuerCert = NULL;
CERTCertDBHandle *defaultDB = NULL;
PRBool isAscii = PR_FALSE;
PRBool trusted = PR_FALSE;
SECStatus secStatus;
SECCertificateUsage certUsage = certificateUsageSSLServer;
PLOptState *optstate;
PRTime time = 0;
PLOptStatus status;
int usePkix = 0;
int rv = 1;
int usage;
CERTVerifyLog log;
CERTCertList *builtChain = NULL;
PRBool certFetching = PR_FALSE;
int revDataIndex = 0;
PRBool ocsp_fetchingFailureIsAFailure = PR_TRUE;
PRBool useDefaultRevFlags = PR_TRUE;
PRBool onlyTrustAnchors = PR_TRUE;
int vfyCounts = 1;
PR_Init(PR_SYSTEM_THREAD, PR_PRIORITY_NORMAL, 1);
progName = PL_strdup(argv[0]);
optstate = PL_CreateOptState(argc, argv, "ab:c:d:efg:h:i:m:o:prs:tTu:vw:W:");
while ((status = PL_GetNextOpt(optstate)) == PL_OPT_OK) {
switch (optstate->option) {
case 0: /* positional parameter */
goto breakout;
case 'a':
isAscii = PR_TRUE;
break;
case 'b':
secStatus = DER_AsciiToTime(&time, optstate->value);
if (secStatus != SECSuccess)
Usage(progName);
break;
case 'd':
certDir = PL_strdup(optstate->value);
break;
case 'e':
ocsp_fetchingFailureIsAFailure = PR_FALSE;
break;
case 'f':
certFetching = PR_TRUE;
break;
case 'g':
if (revMethodsData[revDataIndex].testTypeStr ||
revMethodsData[revDataIndex].methodTypeStr) {
revDataIndex += 1;
if (revDataIndex == REV_METHOD_INDEX_MAX) {
fprintf(stderr, "Invalid revocation configuration"
"specified.\n");
secStatus = SECFailure;
break;
}
}
useDefaultRevFlags = PR_FALSE;
revMethodsData[revDataIndex].testTypeStr =
PL_strdup(optstate->value);
break;
case 'h':
revMethodsData[revDataIndex].testFlagsStr =
PL_strdup(optstate->value);
break;
case 'i':
vfyCounts = PORT_Atoi(optstate->value);
break;
break;
case 'm':
if (revMethodsData[revDataIndex].methodTypeStr) {
revDataIndex += 1;
if (revDataIndex == REV_METHOD_INDEX_MAX) {
fprintf(stderr, "Invalid revocation configuration"
"specified.\n");
secStatus = SECFailure;
break;
}
}
useDefaultRevFlags = PR_FALSE;
revMethodsData[revDataIndex].methodTypeStr =
PL_strdup(optstate->value);
break;
case 'o':
oidStr = PL_strdup(optstate->value);
break;
case 'p':
usePkix += 1;
break;
case 'r':
isAscii = PR_FALSE;
break;
case 's':
revMethodsData[revDataIndex].methodFlagsStr =
PL_strdup(optstate->value);
break;
case 't':
trusted = PR_TRUE;
break;
case 'T':
onlyTrustAnchors = PR_FALSE;
break;
case 'u':
usage = PORT_Atoi(optstate->value);
if (usage < 0 || usage > 62)
Usage(progName);
certUsage = ((SECCertificateUsage)1) << usage;
if (certUsage > certificateUsageHighest)
Usage(progName);
break;
case 'w':
pwdata.source = PW_PLAINTEXT;
pwdata.data = PORT_Strdup(optstate->value);
break;
case 'W':
pwdata.source = PW_FROMFILE;
pwdata.data = PORT_Strdup(optstate->value);
break;
case 'v':
verbose++;
break;
default:
Usage(progName);
break;
}
}
breakout:
if (status != PL_OPT_OK)
Usage(progName);
if (usePkix < 2) {
if (oidStr) {
fprintf(stderr, "Policy oid(-o) can be used only with"
" CERT_PKIXVerifyCert(-pp) function.\n");
Usage(progName);
}
if (trusted) {
fprintf(stderr, "Cert trust flag can be used only with"
" CERT_PKIXVerifyCert(-pp) function.\n");
Usage(progName);
}
if (!onlyTrustAnchors) {
fprintf(stderr, "Cert trust anchor exclusiveness can be"
" used only with CERT_PKIXVerifyCert(-pp)"
" function.\n");
}
}
if (!useDefaultRevFlags && parseRevMethodsAndFlags()) {
fprintf(stderr, "Invalid revocation configuration specified.\n");
goto punt;
}
/* Set our password function callback. */
PK11_SetPasswordFunc(SECU_GetModulePassword);
/* Initialize the NSS libraries. */
if (certDir) {
secStatus = NSS_Init(certDir);
} else {
secStatus = NSS_NoDB_Init(NULL);
/* load the builtins */
SECMOD_AddNewModule("Builtins", DLL_PREFIX "nssckbi." DLL_SUFFIX, 0, 0);
}
if (secStatus != SECSuccess) {
exitErr("NSS_Init");
}
SECU_RegisterDynamicOids();
if (isOCSPEnabled()) {
CERT_EnableOCSPChecking(CERT_GetDefaultCertDB());
CERT_DisableOCSPDefaultResponder(CERT_GetDefaultCertDB());
if (!ocsp_fetchingFailureIsAFailure) {
CERT_SetOCSPFailureMode(ocspMode_FailureIsNotAVerificationFailure);
}
}
while (status == PL_OPT_OK) {
switch (optstate->option) {
default:
Usage(progName);
break;
case 'a':
isAscii = PR_TRUE;
break;
case 'r':
isAscii = PR_FALSE;
break;
case 't':
trusted = PR_TRUE;
break;
case 0: /* positional parameter */
if (usePkix < 2 && trusted) {
fprintf(stderr, "Cert trust flag can be used only with"
" CERT_PKIXVerifyCert(-pp) function.\n");
Usage(progName);
}
cert = getCert(optstate->value, isAscii, progName);
if (!cert)
goto punt;
rememberCert(cert, trusted);
if (!firstCert)
firstCert = cert;
trusted = PR_FALSE;
}
status = PL_GetNextOpt(optstate);
}
PL_DestroyOptState(optstate);
if (status == PL_OPT_BAD || !firstCert)
Usage(progName);
/* Initialize log structure */
log.arena = PORT_NewArena(512);
log.head = log.tail = NULL;
log.count = 0;
do {
if (usePkix < 2) {
/* NOW, verify the cert chain. */
if (usePkix) {
/* Use old API with libpkix validation lib */
CERT_SetUsePKIXForValidation(PR_TRUE);
}
if (!time)
time = PR_Now();
defaultDB = CERT_GetDefaultCertDB();
secStatus = CERT_VerifyCertificate(defaultDB, firstCert,
PR_TRUE /* check sig */,
certUsage,
time,
&pwdata, /* wincx */
&log, /* error log */
NULL); /* returned usages */
} else
do {
static CERTValOutParam cvout[4];
static CERTValInParam cvin[7];
SECOidTag oidTag;
int inParamIndex = 0;
static PRUint64 revFlagsLeaf[2];
static PRUint64 revFlagsChain[2];
static CERTRevocationFlags rev;
if (oidStr) {
PLArenaPool *arena;
SECOidData od;
memset(&od, 0, sizeof od);
od.offset = SEC_OID_UNKNOWN;
od.desc = "User Defined Policy OID";
od.mechanism = CKM_INVALID_MECHANISM;
od.supportedExtension = INVALID_CERT_EXTENSION;
arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
if (!arena) {
fprintf(stderr, "out of memory");
goto punt;
}
secStatus = SEC_StringToOID(arena, &od.oid, oidStr, 0);
if (secStatus != SECSuccess) {
PORT_FreeArena(arena, PR_FALSE);
fprintf(stderr, "Can not encode oid: %s(%s)\n", oidStr,
SECU_Strerror(PORT_GetError()));
break;
}
oidTag = SECOID_AddEntry(&od);
PORT_FreeArena(arena, PR_FALSE);
if (oidTag == SEC_OID_UNKNOWN) {
fprintf(stderr, "Can not add new oid to the dynamic "
"table: %s\n",
oidStr);
secStatus = SECFailure;
break;
}
cvin[inParamIndex].type = cert_pi_policyOID;
cvin[inParamIndex].value.arraySize = 1;
cvin[inParamIndex].value.array.oids = &oidTag;
inParamIndex++;
}
if (trustedCertList) {
cvin[inParamIndex].type = cert_pi_trustAnchors;
cvin[inParamIndex].value.pointer.chain = trustedCertList;
inParamIndex++;
}
cvin[inParamIndex].type = cert_pi_useAIACertFetch;
cvin[inParamIndex].value.scalar.b = certFetching;
inParamIndex++;
rev.leafTests.cert_rev_flags_per_method = revFlagsLeaf;
rev.chainTests.cert_rev_flags_per_method = revFlagsChain;
secStatus = configureRevocationParams(&rev);
if (secStatus) {
fprintf(stderr, "Can not config revocation parameters ");
break;
}
cvin[inParamIndex].type = cert_pi_revocationFlags;
cvin[inParamIndex].value.pointer.revocation = &rev;
inParamIndex++;
if (time) {
cvin[inParamIndex].type = cert_pi_date;
cvin[inParamIndex].value.scalar.time = time;
inParamIndex++;
}
if (!onlyTrustAnchors) {
cvin[inParamIndex].type = cert_pi_useOnlyTrustAnchors;
cvin[inParamIndex].value.scalar.b = onlyTrustAnchors;
inParamIndex++;
}
cvin[inParamIndex].type = cert_pi_end;
cvout[0].type = cert_po_trustAnchor;
cvout[0].value.pointer.cert = NULL;
cvout[1].type = cert_po_certList;
cvout[1].value.pointer.chain = NULL;
/* setting pointer to CERTVerifyLog. Initialized structure
* will be used CERT_PKIXVerifyCert */
cvout[2].type = cert_po_errorLog;
cvout[2].value.pointer.log = &log;
cvout[3].type = cert_po_end;
secStatus = CERT_PKIXVerifyCert(firstCert, certUsage,
cvin, cvout, &pwdata);
if (secStatus != SECSuccess) {
break;
}
issuerCert = cvout[0].value.pointer.cert;
builtChain = cvout[1].value.pointer.chain;
} while (0);
/* Display validation results */
if (secStatus != SECSuccess || log.count > 0) {
CERTVerifyLogNode *node = NULL;
fprintf(stderr, "Chain is bad!\n");
SECU_displayVerifyLog(stderr, &log, verbose);
/* Have cert refs in the log only in case of failure.
* Destroy them. */
for (node = log.head; node; node = node->next) {
if (node->cert)
CERT_DestroyCertificate(node->cert);
}
log.head = log.tail = NULL;
log.count = 0;
rv = 1;
} else {
fprintf(stderr, "Chain is good!\n");
if (issuerCert) {
if (verbose > 1) {
rv = SEC_PrintCertificateAndTrust(issuerCert, "Root Certificate",
NULL);
if (rv != SECSuccess) {
SECU_PrintError(progName, "problem printing certificate");
}
} else if (verbose > 0) {
SECU_PrintName(stdout, &issuerCert->subject, "Root "
"Certificate Subject:",
0);
}
CERT_DestroyCertificate(issuerCert);
}
if (builtChain) {
CERTCertListNode *node;
int count = 0;
char buff[256];
if (verbose) {
for (node = CERT_LIST_HEAD(builtChain); !CERT_LIST_END(node, builtChain);
node = CERT_LIST_NEXT(node), count++) {
snprintf(buff, sizeof(buff), "Certificate %d Subject", count + 1);
SECU_PrintName(stdout, &node->cert->subject, buff, 0);
}
}
CERT_DestroyCertList(builtChain);
}
rv = 0;
}
} while (--vfyCounts > 0);
/* Need to destroy CERTVerifyLog arena at the end */
PORT_FreeArena(log.arena, PR_FALSE);
punt:
forgetCerts();
if (NSS_Shutdown() != SECSuccess) {
SECU_PrintError(progName, "NSS_Shutdown");
rv = 1;
}
PORT_Free(progName);
PORT_Free(certDir);
PORT_Free(oidStr);
freeRevocationMethodData();
if (pwdata.data) {
PORT_Free(pwdata.data);
}
PL_ArenaFinish();
PR_Cleanup();
return rv;
}