Source code
Revision control
Copy as Markdown
Other Tools
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
/*
* nss_pkix_proxy.h
*
* PKIX - NSS proxy functions
*
* NOTE: All structures, functions, data types are parts of library private
* api and are subjects to change in any following releases.
*
*/
#include "prerror.h"
#include "prprf.h"
#include "nspr.h"
#include "pk11func.h"
#include "certdb.h"
#include "cert.h"
#include "secerr.h"
#include "nssb64.h"
#include "secasn1.h"
#include "secder.h"
#include "pkit.h"
#ifndef NSS_DISABLE_LIBPKIX
#include "pkix_pl_common.h"
extern PRLogModuleInfo *pkixLog;
#ifdef PKIX_OBJECT_LEAK_TEST
extern PKIX_UInt32
pkix_pl_lifecycle_ObjectLeakCheck(int *);
extern SECStatus
pkix_pl_lifecycle_ObjectTableUpdate(int *objCountTable);
PRInt32 parallelFnInvocationCount;
#endif /* PKIX_OBJECT_LEAK_TEST */
static PRBool usePKIXValidationEngine = PR_FALSE;
#endif /* NSS_DISABLE_LIBPKIX */
/*
* FUNCTION: CERT_SetUsePKIXForValidation
* DESCRIPTION:
*
* Enables or disables use of libpkix for certificate validation
*
* PARAMETERS:
* "enable"
* PR_TRUE: enables use of libpkix for cert validation.
* PR_FALSE: disables.
* THREAD SAFETY:
* NOT Thread Safe.
* RETURNS:
* Returns SECSuccess if successfully enabled
*/
SECStatus
CERT_SetUsePKIXForValidation(PRBool enable)
{
#ifdef NSS_DISABLE_LIBPKIX
PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
return SECFailure;
#else
usePKIXValidationEngine = (enable > 0) ? PR_TRUE : PR_FALSE;
return SECSuccess;
#endif /* NSS_DISABLE_LIBPKIX */
}
/*
* FUNCTION: CERT_GetUsePKIXForValidation
* DESCRIPTION:
*
* Checks if libpkix building function should be use for certificate
* chain building.
*
* PARAMETERS:
* NONE
* THREAD SAFETY:
* NOT Thread Safe
* RETURNS:
* Returns PR_TRUE if libpkix should be used. PR_FALSE otherwise.
*/
PRBool
CERT_GetUsePKIXForValidation()
{
#ifdef NSS_DISABLE_LIBPKIX
return PR_FALSE;
#else
return usePKIXValidationEngine;
#endif /* NSS_DISABLE_LIBPKIX */
}
#ifndef NSS_DISABLE_LIBPKIX
#ifdef NOTDEF
/*
* FUNCTION: cert_NssKeyUsagesToPkix
* DESCRIPTION:
*
* Converts nss key usage bit field(PRUint32) to pkix key usage
* bit field.
*
* PARAMETERS:
* "nssKeyUsage"
* Nss key usage bit field.
* "pkixKeyUsage"
* Pkix key usage big field.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
static PKIX_Error *
cert_NssKeyUsagesToPkix(
PRUint32 nssKeyUsage,
PKIX_UInt32 *pPkixKeyUsage,
void *plContext)
{
PKIX_UInt32 pkixKeyUsage = 0;
PKIX_ENTER(CERTVFYPKIX, "cert_NssKeyUsagesToPkix");
PKIX_NULLCHECK_ONE(pPkixKeyUsage);
*pPkixKeyUsage = 0;
if (nssKeyUsage & KU_DIGITAL_SIGNATURE) {
pkixKeyUsage |= PKIX_DIGITAL_SIGNATURE;
}
if (nssKeyUsage & KU_NON_REPUDIATION) {
pkixKeyUsage |= PKIX_NON_REPUDIATION;
}
if (nssKeyUsage & KU_KEY_ENCIPHERMENT) {
pkixKeyUsage |= PKIX_KEY_ENCIPHERMENT;
}
if (nssKeyUsage & KU_DATA_ENCIPHERMENT) {
pkixKeyUsage |= PKIX_DATA_ENCIPHERMENT;
}
if (nssKeyUsage & KU_KEY_AGREEMENT) {
pkixKeyUsage |= PKIX_KEY_AGREEMENT;
}
if (nssKeyUsage & KU_KEY_CERT_SIGN) {
pkixKeyUsage |= PKIX_KEY_CERT_SIGN;
}
if (nssKeyUsage & KU_CRL_SIGN) {
pkixKeyUsage |= PKIX_CRL_SIGN;
}
if (nssKeyUsage & KU_ENCIPHER_ONLY) {
pkixKeyUsage |= PKIX_ENCIPHER_ONLY;
}
/* Not supported. XXX we should support this once it is
* fixed in NSS */
/* pkixKeyUsage |= PKIX_DECIPHER_ONLY; */
*pPkixKeyUsage = pkixKeyUsage;
PKIX_RETURN(CERTVFYPKIX);
}
extern SECOidTag ekuOidStrings[];
enum {
ekuIndexSSLServer = 0,
ekuIndexSSLClient,
ekuIndexCodeSigner,
ekuIndexEmail,
ekuIndexTimeStamp,
ekuIndexStatusResponder,
ekuIndexUnknown
} ekuIndex;
typedef struct {
SECCertUsage certUsage;
PRUint32 ekuStringIndex;
} SECCertUsageToEku;
const SECCertUsageToEku certUsageEkuStringMap[] = {
{ certUsageSSLClient, ekuIndexSSLClient },
{ certUsageSSLServer, ekuIndexSSLServer },
{ certUsageSSLCA, ekuIndexSSLServer },
{ certUsageEmailSigner, ekuIndexEmail },
{ certUsageEmailRecipient, ekuIndexEmail },
{ certUsageObjectSigner, ekuIndexCodeSigner },
{ certUsageUserCertImport, ekuIndexUnknown },
{ certUsageVerifyCA, ekuIndexUnknown },
{ certUsageProtectedObjectSigner, ekuIndexUnknown },
{ certUsageStatusResponder, ekuIndexStatusResponder },
{ certUsageAnyCA, ekuIndexUnknown },
};
/*
* FUNCTION: cert_NssCertificateUsageToPkixKUAndEKU
* DESCRIPTION:
*
* Converts nss CERTCertificateUsage bit field to pkix key and
* extended key usages.
*
* PARAMETERS:
* "cert"
* Pointer to CERTCertificate structure of validating cert.
* "requiredCertUsages"
* Required usage that will be converted to pkix eku and ku.
* "requiredKeyUsage",
* Additional key usages impose to cert.
* "isCA",
* it true, convert usages for cert that is a CA cert.
* "ppkixEKUList"
* Returned address of a list of pkix extended key usages.
* "ppkixKU"
* Returned address of pkix required key usages bit field.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Cert Verify Error if the function fails in an unrecoverable way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
static PKIX_Error *
cert_NssCertificateUsageToPkixKUAndEKU(
CERTCertificate *cert,
SECCertUsage requiredCertUsage,
PRUint32 requiredKeyUsages,
PRBool isCA,
PKIX_List **ppkixEKUList,
PKIX_UInt32 *ppkixKU,
void *plContext)
{
PKIX_List *ekuOidsList = NULL;
PKIX_PL_OID *ekuOid = NULL;
int i = 0;
int ekuIndex = ekuIndexUnknown;
PKIX_ENTER(CERTVFYPKIX, "cert_NssCertificateUsageToPkixEku");
PKIX_NULLCHECK_TWO(ppkixEKUList, ppkixKU);
PKIX_CHECK(
PKIX_List_Create(&ekuOidsList, plContext),
PKIX_LISTCREATEFAILED);
for (; i < PR_ARRAY_SIZE(certUsageEkuStringMap); i++) {
const SECCertUsageToEku *usageToEkuElem =
&certUsageEkuStringMap[i];
if (usageToEkuElem->certUsage == requiredCertUsage) {
ekuIndex = usageToEkuElem->ekuStringIndex;
break;
}
}
if (ekuIndex != ekuIndexUnknown) {
PRUint32 reqKeyUsage = 0;
PRUint32 reqCertType = 0;
CERT_KeyUsageAndTypeForCertUsage(requiredCertUsage, isCA,
&reqKeyUsage,
&reqCertType);
requiredKeyUsages |= reqKeyUsage;
PKIX_CHECK(
PKIX_PL_OID_Create(ekuOidStrings[ekuIndex], &ekuOid,
plContext),
PKIX_OIDCREATEFAILED);
PKIX_CHECK(
PKIX_List_AppendItem(ekuOidsList, (PKIX_PL_Object *)ekuOid,
plContext),
PKIX_LISTAPPENDITEMFAILED);
PKIX_DECREF(ekuOid);
}
PKIX_CHECK(
cert_NssKeyUsagesToPkix(requiredKeyUsages, ppkixKU, plContext),
PKIX_NSSCERTIFICATEUSAGETOPKIXKUANDEKUFAILED);
*ppkixEKUList = ekuOidsList;
ekuOidsList = NULL;
cleanup:
PKIX_DECREF(ekuOid);
PKIX_DECREF(ekuOidsList);
PKIX_RETURN(CERTVFYPKIX);
}
#endif
/*
* FUNCTION: cert_ProcessingParamsSetKeyAndCertUsage
* DESCRIPTION:
*
* Converts cert usage to pkix KU type and sets
* converted data into PKIX_ProcessingParams object. It also sets
* proper cert usage into nsscontext object.
*
* PARAMETERS:
* "procParams"
* Pointer to PKIX_ProcessingParams used during validation.
* "requiredCertUsage"
* Required certificate usages the certificate and chain is built and
* validated for.
* "requiredKeyUsage"
* Request additional key usages the certificate should be validated for.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Cert Verify Error if the function fails in an unrecoverable way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
static PKIX_Error *
cert_ProcessingParamsSetKeyAndCertUsage(
PKIX_ProcessingParams *procParams,
SECCertUsage requiredCertUsage,
PRUint32 requiredKeyUsages,
void *plContext)
{
PKIX_CertSelector *certSelector = NULL;
PKIX_ComCertSelParams *certSelParams = NULL;
PKIX_PL_NssContext *nssContext = (PKIX_PL_NssContext *)plContext;
PKIX_ENTER(CERTVFYPKIX, "cert_ProcessingParamsSetKeyAndCertUsage");
PKIX_NULLCHECK_TWO(procParams, nssContext);
PKIX_CHECK(
pkix_pl_NssContext_SetCertUsage(
((SECCertificateUsage)1) << requiredCertUsage, nssContext),
PKIX_NSSCONTEXTSETCERTUSAGEFAILED);
if (requiredKeyUsages) {
PKIX_CHECK(
PKIX_ProcessingParams_GetTargetCertConstraints(procParams,
&certSelector, plContext),
PKIX_PROCESSINGPARAMSGETTARGETCERTCONSTRAINTSFAILED);
PKIX_CHECK(
PKIX_CertSelector_GetCommonCertSelectorParams(certSelector,
&certSelParams, plContext),
PKIX_CERTSELECTORGETCOMMONCERTSELECTORPARAMSFAILED);
PKIX_CHECK(
PKIX_ComCertSelParams_SetKeyUsage(certSelParams, requiredKeyUsages,
plContext),
PKIX_COMCERTSELPARAMSSETKEYUSAGEFAILED);
}
cleanup:
PKIX_DECREF(certSelector);
PKIX_DECREF(certSelParams);
PKIX_RETURN(CERTVFYPKIX);
}
/*
* Unused parameters:
*
* CERTCertList *initialChain,
* CERTCertStores certStores,
* CERTCertRevCheckers certRevCheckers,
* CERTCertChainCheckers certChainCheckers,
* SECItem *initPolicies,
* PRBool policyQualifierRejected,
* PRBool anyPolicyInhibited,
* PRBool reqExplicitPolicy,
* PRBool policyMappingInhibited,
* PKIX_CertSelector certConstraints,
*/
/*
* FUNCTION: cert_CreatePkixProcessingParams
* DESCRIPTION:
*
* Creates and fills in PKIX_ProcessingParams structure to be used
* for certificate chain building.
*
* PARAMETERS:
* "cert"
* Pointer to the CERTCertificate: the leaf certificate of a chain.
* "time"
* Validity time.
* "wincx"
* Nss db password token.
* "useArena"
* Flags to use arena for data allocation during chain building process.
* "pprocParams"
* Address to return created processing parameters.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Cert Verify Error if the function fails in an unrecoverable way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
static PKIX_Error *
cert_CreatePkixProcessingParams(
CERTCertificate *cert,
PRBool checkSig,
PRTime time,
void *wincx,
PRBool useArena,
PRBool disableOCSPRemoteFetching,
PKIX_ProcessingParams **pprocParams,
void **pplContext)
{
PKIX_List *anchors = NULL;
PKIX_PL_Cert *targetCert = NULL;
PKIX_PL_Date *date = NULL;
PKIX_ProcessingParams *procParams = NULL;
PKIX_CertSelector *certSelector = NULL;
PKIX_ComCertSelParams *certSelParams = NULL;
PKIX_CertStore *certStore = NULL;
PKIX_List *certStores = NULL;
PKIX_RevocationChecker *revChecker = NULL;
PKIX_UInt32 methodFlags = 0;
void *plContext = NULL;
CERTStatusConfig *statusConfig = NULL;
PKIX_ENTER(CERTVFYPKIX, "cert_CreatePkixProcessingParams");
PKIX_NULLCHECK_TWO(cert, pprocParams);
PKIX_CHECK(
PKIX_PL_NssContext_Create(0, useArena, wincx, &plContext),
PKIX_NSSCONTEXTCREATEFAILED);
*pplContext = plContext;
/* Functions should be implemented in patch for 390532 */
PKIX_CHECK(
pkix_pl_NssContext_SetCertSignatureCheck(checkSig,
(PKIX_PL_NssContext *)plContext),
PKIX_NSSCONTEXTSETCERTSIGNCHECKFAILED);
PKIX_CHECK(
PKIX_ProcessingParams_Create(&procParams, plContext),
PKIX_PROCESSINGPARAMSCREATEFAILED);
PKIX_CHECK(
PKIX_ComCertSelParams_Create(&certSelParams, plContext),
PKIX_COMCERTSELPARAMSCREATEFAILED);
PKIX_CHECK(
PKIX_PL_Cert_CreateFromCERTCertificate(cert, &targetCert, plContext),
PKIX_CERTCREATEWITHNSSCERTFAILED);
PKIX_CHECK(
PKIX_ComCertSelParams_SetCertificate(certSelParams,
targetCert, plContext),
PKIX_COMCERTSELPARAMSSETCERTIFICATEFAILED);
PKIX_CHECK(
PKIX_CertSelector_Create(NULL, NULL, &certSelector, plContext),
PKIX_COULDNOTCREATECERTSELECTOROBJECT);
PKIX_CHECK(
PKIX_CertSelector_SetCommonCertSelectorParams(certSelector,
certSelParams, plContext),
PKIX_CERTSELECTORSETCOMMONCERTSELECTORPARAMSFAILED);
PKIX_CHECK(
PKIX_ProcessingParams_SetTargetCertConstraints(procParams,
certSelector, plContext),
PKIX_PROCESSINGPARAMSSETTARGETCERTCONSTRAINTSFAILED);
/* Turn off quialification of target cert since leaf cert is
* already check for date validity, key usages and extended
* key usages. */
PKIX_CHECK(
PKIX_ProcessingParams_SetQualifyTargetCert(procParams, PKIX_FALSE,
plContext),
PKIX_PROCESSINGPARAMSSETQUALIFYTARGETCERTFLAGFAILED);
PKIX_CHECK(
PKIX_PL_Pk11CertStore_Create(&certStore, plContext),
PKIX_PK11CERTSTORECREATEFAILED);
PKIX_CHECK(
PKIX_List_Create(&certStores, plContext),
PKIX_UNABLETOCREATELIST);
PKIX_CHECK(
PKIX_List_AppendItem(certStores, (PKIX_PL_Object *)certStore,
plContext),
PKIX_LISTAPPENDITEMFAILED);
PKIX_CHECK(
PKIX_ProcessingParams_SetCertStores(procParams, certStores,
plContext),
PKIX_PROCESSINGPARAMSADDCERTSTOREFAILED);
PKIX_CHECK(
PKIX_PL_Date_CreateFromPRTime(time, &date, plContext),
PKIX_DATECREATEFROMPRTIMEFAILED);
PKIX_CHECK(
PKIX_ProcessingParams_SetDate(procParams, date, plContext),
PKIX_PROCESSINGPARAMSSETDATEFAILED);
PKIX_CHECK(
PKIX_RevocationChecker_Create(
PKIX_REV_MI_TEST_ALL_LOCAL_INFORMATION_FIRST |
PKIX_REV_MI_NO_OVERALL_INFO_REQUIREMENT,
PKIX_REV_MI_TEST_ALL_LOCAL_INFORMATION_FIRST |
PKIX_REV_MI_NO_OVERALL_INFO_REQUIREMENT,
&revChecker, plContext),
PKIX_REVOCATIONCHECKERCREATEFAILED);
PKIX_CHECK(
PKIX_ProcessingParams_SetRevocationChecker(procParams, revChecker,
plContext),
PKIX_PROCESSINGPARAMSSETREVOCATIONCHECKERFAILED);
/* CRL method flags */
methodFlags =
PKIX_REV_M_TEST_USING_THIS_METHOD |
PKIX_REV_M_FORBID_NETWORK_FETCHING |
PKIX_REV_M_SKIP_TEST_ON_MISSING_SOURCE | /* 0 */
PKIX_REV_M_IGNORE_MISSING_FRESH_INFO | /* 0 */
PKIX_REV_M_CONTINUE_TESTING_ON_FRESH_INFO;
/* add CRL revocation method to check the leaf certificate */
PKIX_CHECK(
PKIX_RevocationChecker_CreateAndAddMethod(revChecker, procParams,
PKIX_RevocationMethod_CRL, methodFlags,
0, NULL, PKIX_TRUE, plContext),
PKIX_REVOCATIONCHECKERADDMETHODFAILED);
/* add CRL revocation method for other certs in the chain. */
PKIX_CHECK(
PKIX_RevocationChecker_CreateAndAddMethod(revChecker, procParams,
PKIX_RevocationMethod_CRL, methodFlags,
0, NULL, PKIX_FALSE, plContext),
PKIX_REVOCATIONCHECKERADDMETHODFAILED);
/* For compatibility with the old code, need to check that
* statusConfig is set in the db handle and status checker
* is defined befor allow ocsp status check on the leaf cert.*/
statusConfig = CERT_GetStatusConfig(CERT_GetDefaultCertDB());
if (statusConfig != NULL && statusConfig->statusChecker != NULL) {
/* Enable OCSP revocation checking for the leaf cert. */
/* OCSP method flags */
methodFlags =
PKIX_REV_M_TEST_USING_THIS_METHOD |
PKIX_REV_M_ALLOW_NETWORK_FETCHING | /* 0 */
PKIX_REV_M_ALLOW_IMPLICIT_DEFAULT_SOURCE | /* 0 */
PKIX_REV_M_SKIP_TEST_ON_MISSING_SOURCE | /* 0 */
PKIX_REV_M_IGNORE_MISSING_FRESH_INFO | /* 0 */
PKIX_REV_M_CONTINUE_TESTING_ON_FRESH_INFO;
/* Disabling ocsp fetching when checking the status
* of ocsp response signer. Here and in the next if,
* adjust flags for ocsp signer cert validation case. */
if (disableOCSPRemoteFetching) {
methodFlags |= PKIX_REV_M_FORBID_NETWORK_FETCHING;
}
if (ocsp_FetchingFailureIsVerificationFailure() &&
!disableOCSPRemoteFetching) {
methodFlags |=
PKIX_REV_M_FAIL_ON_MISSING_FRESH_INFO;
}
/* add OCSP revocation method to check only the leaf certificate.*/
PKIX_CHECK(
PKIX_RevocationChecker_CreateAndAddMethod(revChecker, procParams,
PKIX_RevocationMethod_OCSP, methodFlags,
1, NULL, PKIX_TRUE, plContext),
PKIX_REVOCATIONCHECKERADDMETHODFAILED);
}
PKIX_CHECK(
PKIX_ProcessingParams_SetAnyPolicyInhibited(procParams, PR_FALSE,
plContext),
PKIX_PROCESSINGPARAMSSETANYPOLICYINHIBITED);
PKIX_CHECK(
PKIX_ProcessingParams_SetExplicitPolicyRequired(procParams, PR_FALSE,
plContext),
PKIX_PROCESSINGPARAMSSETEXPLICITPOLICYREQUIRED);
PKIX_CHECK(
PKIX_ProcessingParams_SetPolicyMappingInhibited(procParams, PR_FALSE,
plContext),
PKIX_PROCESSINGPARAMSSETPOLICYMAPPINGINHIBITED);
*pprocParams = procParams;
procParams = NULL;
cleanup:
PKIX_DECREF(anchors);
PKIX_DECREF(targetCert);
PKIX_DECREF(date);
PKIX_DECREF(certSelector);
PKIX_DECREF(certSelParams);
PKIX_DECREF(certStore);
PKIX_DECREF(certStores);
PKIX_DECREF(procParams);
PKIX_DECREF(revChecker);
PKIX_RETURN(CERTVFYPKIX);
}
/*
* FUNCTION: cert_PkixToNssCertsChain
* DESCRIPTION:
*
* Converts pkix cert list into nss cert list.
*
* PARAMETERS:
* "pkixCertChain"
* Pkix certificate list.
* "pvalidChain"
* An address of returned nss certificate list.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Cert Verify Error if the function fails in an unrecoverable way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
static PKIX_Error *
cert_PkixToNssCertsChain(
PKIX_List *pkixCertChain,
CERTCertList **pvalidChain,
void *plContext)
{
PLArenaPool *arena = NULL;
CERTCertificate *nssCert = NULL;
CERTCertList *validChain = NULL;
PKIX_PL_Object *certItem = NULL;
PKIX_UInt32 length = 0;
PKIX_UInt32 i = 0;
PKIX_ENTER(CERTVFYPKIX, "cert_PkixToNssCertsChain");
PKIX_NULLCHECK_ONE(pvalidChain);
if (pkixCertChain == NULL) {
goto cleanup;
}
arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
if (arena == NULL) {
PKIX_ERROR(PKIX_OUTOFMEMORY);
}
validChain = (CERTCertList *)PORT_ArenaZAlloc(arena, sizeof(CERTCertList));
if (validChain == NULL) {
PKIX_ERROR(PKIX_PORTARENAALLOCFAILED);
}
PR_INIT_CLIST(&validChain->list);
validChain->arena = arena;
arena = NULL;
PKIX_CHECK(
PKIX_List_GetLength(pkixCertChain, &length, plContext),
PKIX_LISTGETLENGTHFAILED);
for (i = 0; i < length; i++) {
CERTCertListNode *node = NULL;
PKIX_CHECK(
PKIX_List_GetItem(pkixCertChain, i, &certItem, plContext),
PKIX_LISTGETITEMFAILED);
PKIX_CHECK(
PKIX_PL_Cert_GetCERTCertificate((PKIX_PL_Cert *)certItem, &nssCert,
plContext),
PKIX_CERTGETCERTCERTIFICATEFAILED);
node =
(CERTCertListNode *)PORT_ArenaZAlloc(validChain->arena,
sizeof(CERTCertListNode));
if (node == NULL) {
PKIX_ERROR(PKIX_PORTARENAALLOCFAILED);
}
PR_INSERT_BEFORE(&node->links, &validChain->list);
node->cert = nssCert;
nssCert = NULL;
PKIX_DECREF(certItem);
}
*pvalidChain = validChain;
cleanup:
if (PKIX_ERROR_RECEIVED) {
if (validChain) {
CERT_DestroyCertList(validChain);
} else if (arena) {
PORT_FreeArena(arena, PR_FALSE);
}
if (nssCert) {
CERT_DestroyCertificate(nssCert);
}
}
PKIX_DECREF(certItem);
PKIX_RETURN(CERTVFYPKIX);
}
/*
* FUNCTION: cert_BuildAndValidateChain
* DESCRIPTION:
*
* The function builds and validates a cert chain based on certificate
* selection criterias from procParams. This function call PKIX_BuildChain
* to accomplish chain building. If PKIX_BuildChain returns with incomplete
* IO, the function waits with PR_Poll until the blocking IO is finished and
* return control back to PKIX_BuildChain.
*
* PARAMETERS:
* "procParams"
* Processing parameters to be used during chain building.
* "pResult"
* Returned build result.
* "pVerifyNode"
* Returned pointed to verify node structure: the tree-like structure
* that reports points of chain building failures.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Cert Verify Error if the function fails in an unrecoverable way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
static PKIX_Error *
cert_BuildAndValidateChain(
PKIX_ProcessingParams *procParams,
PKIX_BuildResult **pResult,
PKIX_VerifyNode **pVerifyNode,
void *plContext)
{
PKIX_BuildResult *result = NULL;
PKIX_VerifyNode *verifyNode = NULL;
void *nbioContext = NULL;
void *state = NULL;
PKIX_ENTER(CERTVFYPKIX, "cert_BuildAndVerifyChain");
PKIX_NULLCHECK_TWO(procParams, pResult);
do {
if (nbioContext && state) {
/* PKIX-XXX: need to test functionality of NBIO handling in libPkix.
PRInt32 filesReady = 0;
PRPollDesc *pollDesc = (PRPollDesc *)nbioContext;
filesReady = PR_Poll(pollDesc, 1, PR_INTERVAL_NO_TIMEOUT);
if (filesReady <= 0) {
PKIX_ERROR(PKIX_PRPOLLRETBADFILENUM);
}
}
PKIX_CHECK(
PKIX_BuildChain(procParams, &nbioContext, &state,
&result, &verifyNode, plContext),
PKIX_UNABLETOBUILDCHAIN);
} while (nbioContext && state);
*pResult = result;
cleanup:
if (pVerifyNode) {
*pVerifyNode = verifyNode;
}
PKIX_RETURN(CERTVFYPKIX);
}
/*
* FUNCTION: cert_PkixErrorToNssCode
* DESCRIPTION:
*
* Converts pkix error(PKIX_Error) structure to PR error codes.
*
* PKIX-XXX to be implemented. See 391183.
*
* PARAMETERS:
* "error"
* Pkix error that will be converted.
* "nssCode"
* Corresponding nss error code.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Cert Verify Error if the function fails in an unrecoverable way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
static PKIX_Error *
cert_PkixErrorToNssCode(
PKIX_Error *error,
SECErrorCodes *pNssErr,
void *plContext)
{
int errLevel = 0;
PKIX_Int32 nssErr = 0;
PKIX_Error *errPtr = error;
PKIX_ENTER(CERTVFYPKIX, "cert_PkixErrorToNssCode");
PKIX_NULLCHECK_TWO(error, pNssErr);
/* Loop until we find at least one error with non-null
* plErr code, that is going to be nss error code. */
while (errPtr) {
if (errPtr->plErr && !nssErr) {
nssErr = errPtr->plErr;
if (!pkixLog)
break;
}
if (pkixLog) {
#ifdef PKIX_ERROR_DESCRIPTION
PR_LOG(pkixLog, 2, ("Error at level %d: %s\n", errLevel, PKIX_ErrorText[errPtr->errCode]));
#else
PR_LOG(pkixLog, 2, ("Error at level %d: Error code %d\n", errLevel, errPtr->errCode));
#endif /* PKIX_ERROR_DESCRIPTION */
}
errPtr = errPtr->cause;
errLevel += 1;
}
PORT_Assert(nssErr);
if (!nssErr) {
*pNssErr = SEC_ERROR_LIBPKIX_INTERNAL;
} else {
*pNssErr = nssErr;
}
PKIX_RETURN(CERTVFYPKIX);
}
/*
* FUNCTION: cert_GetLogFromVerifyNode
* DESCRIPTION:
*
* Recursive function that converts verify node tree-like set of structures
* to CERTVerifyLog.
*
* PARAMETERS:
* "log"
* Pointed to already allocated CERTVerifyLog structure.
* "node"
* A node of PKIX_VerifyNode tree.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Cert Verify Error if the function fails in an unrecoverable way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
static PKIX_Error *
cert_GetLogFromVerifyNode(
CERTVerifyLog *log,
PKIX_VerifyNode *node,
void *plContext)
{
PKIX_List *children = NULL;
PKIX_VerifyNode *childNode = NULL;
PKIX_ENTER(CERTVFYPKIX, "cert_GetLogFromVerifyNode");
children = node->children;
if (children == NULL) {
PKIX_ERRORCODE errCode = PKIX_ANCHORDIDNOTCHAINTOCERT;
if (node->error && node->error->errCode != errCode) {
if (log != NULL) {
SECErrorCodes nssErrorCode = 0;
CERTCertificate *cert = NULL;
cert = node->verifyCert->nssCert;
PKIX_CHECK(
cert_PkixErrorToNssCode(node->error, &nssErrorCode,
plContext),
PKIX_GETPKIXERRORCODEFAILED);
cert_AddToVerifyLog(log, cert, nssErrorCode, node->depth, NULL);
}
}
PKIX_RETURN(CERTVFYPKIX);
} else {
PRUint32 i = 0;
PKIX_UInt32 length = 0;
PKIX_CHECK(
PKIX_List_GetLength(children, &length, plContext),
PKIX_LISTGETLENGTHFAILED);
for (i = 0; i < length; i++) {
PKIX_CHECK(
PKIX_List_GetItem(children, i, (PKIX_PL_Object **)&childNode,
plContext),
PKIX_LISTGETITEMFAILED);
PKIX_CHECK(
cert_GetLogFromVerifyNode(log, childNode, plContext),
PKIX_ERRORINRECURSIVEEQUALSCALL);
PKIX_DECREF(childNode);
}
}
cleanup:
PKIX_DECREF(childNode);
PKIX_RETURN(CERTVFYPKIX);
}
/*
* FUNCTION: cert_GetBuildResults
* DESCRIPTION:
*
* Converts pkix build results to nss results. This function is called
* regardless of build result.
*
* If it called after chain was successfully constructed, then it will
* convert:
* * pkix cert list that represent the chain to nss cert list
* * trusted root the chain was anchored to nss certificate.
*
* In case of failure it will convert:
* * pkix error to PR error code(will set it with PORT_SetError)
* * pkix validation log to nss CERTVerifyLog
*
* PARAMETERS:
* "buildResult"
* Build results returned by PKIX_BuildChain.
* "verifyNode"
* Tree-like structure of chain building/validation failures
* returned by PKIX_BuildChain. Ignored in case of success.
* "error"
* Final error returned by PKIX_BuildChain. Should be NULL in
* case of success.
* "log"
* Address of pre-allocated(if not NULL) CERTVerifyLog structure.
* "ptrustedRoot"
* Address of returned trusted root the chain was anchored to.
* "pvalidChain"
* Address of returned valid chain.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a Cert Verify Error if the function fails in an unrecoverable way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
static PKIX_Error *
cert_GetBuildResults(
PKIX_BuildResult *buildResult,
PKIX_VerifyNode *verifyNode,
PKIX_Error *error,
CERTVerifyLog *log,
CERTCertificate **ptrustedRoot,
CERTCertList **pvalidChain,
void *plContext)
{
PKIX_ValidateResult *validResult = NULL;
CERTCertList *validChain = NULL;
CERTCertificate *trustedRoot = NULL;
PKIX_TrustAnchor *trustAnchor = NULL;
PKIX_PL_Cert *trustedCert = NULL;
PKIX_List *pkixCertChain = NULL;
PKIX_ENTER(CERTVFYPKIX, "cert_GetBuildResults");
if (buildResult == NULL && error == NULL) {
PKIX_ERROR(PKIX_NULLARGUMENT);
}
if (error) {
SECErrorCodes nssErrorCode = 0;
if (verifyNode) {
PKIX_Error *tmpError =
cert_GetLogFromVerifyNode(log, verifyNode, plContext);
if (tmpError) {
PKIX_PL_Object_DecRef((PKIX_PL_Object *)tmpError, plContext);
}
}
cert_PkixErrorToNssCode(error, &nssErrorCode, plContext);
PORT_SetError(nssErrorCode);
goto cleanup;
}
if (pvalidChain) {
PKIX_CHECK(
PKIX_BuildResult_GetCertChain(buildResult, &pkixCertChain,
plContext),
PKIX_BUILDRESULTGETCERTCHAINFAILED);
PKIX_CHECK(
cert_PkixToNssCertsChain(pkixCertChain, &validChain, plContext),
PKIX_CERTCHAINTONSSCHAINFAILED);
}
if (ptrustedRoot) {
PKIX_CHECK(
PKIX_BuildResult_GetValidateResult(buildResult, &validResult,
plContext),
PKIX_BUILDRESULTGETVALIDATERESULTFAILED);
PKIX_CHECK(
PKIX_ValidateResult_GetTrustAnchor(validResult, &trustAnchor,
plContext),
PKIX_VALIDATERESULTGETTRUSTANCHORFAILED);
PKIX_CHECK(
PKIX_TrustAnchor_GetTrustedCert(trustAnchor, &trustedCert,
plContext),
PKIX_TRUSTANCHORGETTRUSTEDCERTFAILED);
PKIX_CHECK(
PKIX_PL_Cert_GetCERTCertificate(trustedCert, &trustedRoot,
plContext),
PKIX_CERTGETCERTCERTIFICATEFAILED);
}
PORT_Assert(!PKIX_ERROR_RECEIVED);
if (trustedRoot) {
*ptrustedRoot = trustedRoot;
}
if (validChain) {
*pvalidChain = validChain;
}
cleanup:
if (PKIX_ERROR_RECEIVED) {
if (trustedRoot) {
CERT_DestroyCertificate(trustedRoot);
}
if (validChain) {
CERT_DestroyCertList(validChain);
}
}
PKIX_DECREF(trustAnchor);
PKIX_DECREF(trustedCert);
PKIX_DECREF(pkixCertChain);
PKIX_DECREF(validResult);
PKIX_DECREF(error);
PKIX_DECREF(verifyNode);
PKIX_DECREF(buildResult);
PKIX_RETURN(CERTVFYPKIX);
}
#endif /* NSS_DISABLE_LIBPKIX */
/*
* FUNCTION: cert_VerifyCertChainPkix
* DESCRIPTION:
*
* The main wrapper function that is called from CERT_VerifyCert and
* CERT_VerifyCACertForUsage functions to validate cert with libpkix.
*
* PARAMETERS:
* "cert"
* Leaf certificate of a chain we want to build.
* "checkSig"
* Certificate signatures will not be verified if this
* flag is set to PR_FALSE.
* "requiredUsage"
* Required usage for certificate and chain.
* "time"
* Validity time.
* "wincx"
* Nss database password token.
* "log"
* Address of already allocated CERTVerifyLog structure. Not
* used if NULL;
* "pSigerror"
* Address of PRBool. If not NULL, returns true is cert chain
* was invalidated because of bad certificate signature.
* "pRevoked"
* Address of PRBool. If not NULL, returns true is cert chain
* was invalidated because a revoked certificate was found in
* the chain.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* SECFailure is chain building process has failed. SECSuccess otherwise.
*/
SECStatus
cert_VerifyCertChainPkix(
CERTCertificate *cert,
PRBool checkSig,
SECCertUsage requiredUsage,
PRTime time,
void *wincx,
CERTVerifyLog *log,
PRBool *pSigerror,
PRBool *pRevoked)
{
#ifdef NSS_DISABLE_LIBPKIX
PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
return SECFailure;
#else
PKIX_ProcessingParams *procParams = NULL;
PKIX_BuildResult *result = NULL;
PKIX_VerifyNode *verifyNode = NULL;
PKIX_Error *error = NULL;
SECStatus rv = SECFailure;
void *plContext = NULL;
#ifdef PKIX_OBJECT_LEAK_TEST
int leakedObjNum = 0;
int memLeakLoopCount = 0;
int objCountTable[PKIX_NUMTYPES];
int fnInvLocalCount = 0;
PKIX_Boolean savedUsePkixEngFlag = usePKIXValidationEngine;
if (usePKIXValidationEngine) {
/* current memory leak testing implementation does not allow
* to run simultaneous tests one the same or a different threads.
* Setting the variable to false, to make additional chain
* validations be handled by old nss. */
usePKIXValidationEngine = PR_FALSE;
}
testStartFnStackPosition = 2;
fnStackNameArr[0] = "cert_VerifyCertChainPkix";
fnStackInvCountArr[0] = 0;
PKIX_Boolean abortOnLeak =
(PR_GetEnvSecure("PKIX_OBJECT_LEAK_TEST_ABORT_ON_LEAK") == NULL) ? PKIX_FALSE
: PKIX_TRUE;
runningLeakTest = PKIX_TRUE;
/* Prevent multi-threaded run of object leak test */
fnInvLocalCount = PR_ATOMIC_INCREMENT(¶llelFnInvocationCount);
PORT_Assert(fnInvLocalCount == 1);
do {
rv = SECFailure;
plContext = NULL;
procParams = NULL;
result = NULL;
verifyNode = NULL;
error = NULL;
errorGenerated = PKIX_FALSE;
stackPosition = 0;
if (leakedObjNum) {
pkix_pl_lifecycle_ObjectTableUpdate(objCountTable);
}
memLeakLoopCount += 1;
#endif /* PKIX_OBJECT_LEAK_TEST */
error =
cert_CreatePkixProcessingParams(cert, checkSig, time, wincx,
PR_FALSE /*use arena*/,
requiredUsage == certUsageStatusResponder,
&procParams, &plContext);
if (error) {
goto cleanup;
}
error =
cert_ProcessingParamsSetKeyAndCertUsage(procParams, requiredUsage, 0,
plContext);
if (error) {
goto cleanup;
}
error =
cert_BuildAndValidateChain(procParams, &result, &verifyNode, plContext);
if (error) {
goto cleanup;
}
if (pRevoked) {
/* Currently always PR_FALSE. Will be fixed as a part of 394077 */
*pRevoked = PR_FALSE;
}
if (pSigerror) {
/* Currently always PR_FALSE. Will be fixed as a part of 394077 */
*pSigerror = PR_FALSE;
}
rv = SECSuccess;
cleanup:
error = cert_GetBuildResults(result, verifyNode, error, log, NULL, NULL,
plContext);
if (error) {
PKIX_PL_Object_DecRef((PKIX_PL_Object *)error, plContext);
}
if (procParams) {
PKIX_PL_Object_DecRef((PKIX_PL_Object *)procParams, plContext);
}
if (plContext) {
PKIX_PL_NssContext_Destroy(plContext);
}
#ifdef PKIX_OBJECT_LEAK_TEST
leakedObjNum =
pkix_pl_lifecycle_ObjectLeakCheck(leakedObjNum ? objCountTable : NULL);
if (pkixLog && leakedObjNum) {
PR_LOG(pkixLog, 1, ("The generated error caused an object leaks. Loop %d."
"Stack %s\n",
memLeakLoopCount, errorFnStackString));
}
PR_Free(errorFnStackString);
errorFnStackString = NULL;
if (abortOnLeak) {
PORT_Assert(leakedObjNum == 0);
}
} while (errorGenerated);
runningLeakTest = PKIX_FALSE;
PR_ATOMIC_DECREMENT(¶llelFnInvocationCount);
usePKIXValidationEngine = savedUsePkixEngFlag;
#endif /* PKIX_OBJECT_LEAK_TEST */
return rv;
#endif /* NSS_DISABLE_LIBPKIX */
}
#ifndef NSS_DISABLE_LIBPKIX
PKIX_CertSelector *
cert_GetTargetCertConstraints(CERTCertificate *target, void *plContext)
{
PKIX_ComCertSelParams *certSelParams = NULL;
PKIX_CertSelector *certSelector = NULL;
PKIX_CertSelector *r = NULL;
PKIX_PL_Cert *eeCert = NULL;
PKIX_Error *error = NULL;
error = PKIX_PL_Cert_CreateFromCERTCertificate(target, &eeCert, plContext);
if (error != NULL)
goto cleanup;
error = PKIX_CertSelector_Create(NULL, NULL, &certSelector, plContext);
if (error != NULL)
goto cleanup;
error = PKIX_ComCertSelParams_Create(&certSelParams, plContext);
if (error != NULL)
goto cleanup;
error = PKIX_ComCertSelParams_SetCertificate(
certSelParams, eeCert, plContext);
if (error != NULL)
goto cleanup;
error = PKIX_CertSelector_SetCommonCertSelectorParams(certSelector, certSelParams, plContext);
if (error != NULL)
goto cleanup;
error = PKIX_PL_Object_IncRef((PKIX_PL_Object *)certSelector, plContext);
if (error == NULL)
r = certSelector;
cleanup:
if (certSelParams != NULL)
PKIX_PL_Object_DecRef((PKIX_PL_Object *)certSelParams, plContext);
if (eeCert != NULL)
PKIX_PL_Object_DecRef((PKIX_PL_Object *)eeCert, plContext);
if (certSelector != NULL)
PKIX_PL_Object_DecRef((PKIX_PL_Object *)certSelector, plContext);
if (error != NULL) {
SECErrorCodes nssErr;
cert_PkixErrorToNssCode(error, &nssErr, plContext);
PKIX_PL_Object_DecRef((PKIX_PL_Object *)error, plContext);
PORT_SetError(nssErr);
}
return r;
}
static PKIX_List *
cert_GetCertStores(void *plContext)
{
PKIX_CertStore *certStore = NULL;
PKIX_List *certStores = NULL;
PKIX_List *r = NULL;
PKIX_Error *error = NULL;
error = PKIX_PL_Pk11CertStore_Create(&certStore, plContext);
if (error != NULL)
goto cleanup;
error = PKIX_List_Create(&certStores, plContext);
if (error != NULL)
goto cleanup;
error = PKIX_List_AppendItem(certStores,
(PKIX_PL_Object *)certStore, plContext);
if (error != NULL)
goto cleanup;
error = PKIX_PL_Object_IncRef((PKIX_PL_Object *)certStores, plContext);
if (error == NULL)
r = certStores;
cleanup:
if (certStores != NULL)
PKIX_PL_Object_DecRef((PKIX_PL_Object *)certStores, plContext);
if (certStore != NULL)
PKIX_PL_Object_DecRef((PKIX_PL_Object *)certStore, plContext);
if (error != NULL) {
SECErrorCodes nssErr;
cert_PkixErrorToNssCode(error, &nssErr, plContext);
PKIX_PL_Object_DecRef((PKIX_PL_Object *)error, plContext);
PORT_SetError(nssErr);
}
return r;
}
struct fake_PKIX_PL_CertStruct {
CERTCertificate *nssCert;
};
/* This needs to be part of the PKIX_PL_* */
/* This definitely needs to go away, and be replaced with
a real accessor function in PKIX */
static CERTCertificate *
cert_NSSCertFromPKIXCert(const PKIX_PL_Cert *pkix_cert)
{
struct fake_PKIX_PL_CertStruct *fcert = NULL;
fcert = (struct fake_PKIX_PL_CertStruct *)pkix_cert;
return CERT_DupCertificate(fcert->nssCert);
}
PKIX_List *
cert_PKIXMakeOIDList(const SECOidTag *oids, int oidCount, void *plContext)
{
PKIX_List *r = NULL;
PKIX_List *policyList = NULL;
PKIX_PL_OID *policyOID = NULL;
PKIX_Error *error = NULL;
int i;
error = PKIX_List_Create(&policyList, plContext);
if (error != NULL) {
goto cleanup;
}
for (i = 0; i < oidCount; i++) {
error = PKIX_PL_OID_Create(oids[i], &policyOID, plContext);
if (error) {
goto cleanup;
}
error = PKIX_List_AppendItem(policyList,
(PKIX_PL_Object *)policyOID, plContext);
if (error != NULL) {
goto cleanup;
}
PKIX_PL_Object_DecRef((PKIX_PL_Object *)policyOID, plContext);
policyOID = NULL;
}
error = PKIX_List_SetImmutable(policyList, plContext);
if (error != NULL)
goto cleanup;
error = PKIX_PL_Object_IncRef((PKIX_PL_Object *)policyList, plContext);
if (error == NULL)
r = policyList;
cleanup:
if (policyOID != NULL) {
PKIX_PL_Object_DecRef((PKIX_PL_Object *)policyOID, plContext);
}
if (policyList != NULL) {
PKIX_PL_Object_DecRef((PKIX_PL_Object *)policyList, plContext);
}
if (error != NULL) {
PKIX_PL_Object_DecRef((PKIX_PL_Object *)error, plContext);
}
return r;
}
CERTValOutParam *
cert_pkix_FindOutputParam(CERTValOutParam *params, const CERTValParamOutType t)
{
CERTValOutParam *i;
if (params == NULL) {
return NULL;
}
for (i = params; i->type != cert_po_end; i++) {
if (i->type == t) {
return i;
}
}
return NULL;
}
static PKIX_Error *
setRevocationMethod(PKIX_RevocationChecker *revChecker,
PKIX_ProcessingParams *procParams,
const CERTRevocationTests *revTest,
CERTRevocationMethodIndex certRevMethod,
PKIX_RevocationMethodType pkixRevMethod,
PKIX_Boolean verifyResponderUsages,
PKIX_Boolean isLeafTest,
void *plContext)
{
PKIX_UInt32 methodFlags = 0;
PKIX_Error *error = NULL;
PKIX_UInt32 priority = 0;
if (revTest->number_of_defined_methods <= (PRUint32)certRevMethod) {
return NULL;
}
if (revTest->preferred_methods) {
unsigned int i = 0;
for (; i < revTest->number_of_preferred_methods; i++) {
if (revTest->preferred_methods[i] == certRevMethod)
break;
}
priority = i;
}
methodFlags = revTest->cert_rev_flags_per_method[certRevMethod];
if (verifyResponderUsages &&
pkixRevMethod == PKIX_RevocationMethod_OCSP) {
methodFlags |= PKIX_REV_M_FORBID_NETWORK_FETCHING;
}
error =
PKIX_RevocationChecker_CreateAndAddMethod(revChecker, procParams,
pkixRevMethod, methodFlags,
priority, NULL,
isLeafTest, plContext);
return error;
}
SECStatus
cert_pkixSetParam(PKIX_ProcessingParams *procParams,
const CERTValInParam *param, void *plContext)
{
PKIX_Error *error = NULL;
SECStatus r = SECSuccess;
PKIX_PL_Date *date = NULL;
PKIX_List *policyOIDList = NULL;
PKIX_List *certListPkix = NULL;
const CERTRevocationFlags *flags;
SECErrorCodes errCode = SEC_ERROR_INVALID_ARGS;
const CERTCertList *certList = NULL;
CERTCertListNode *node;
PKIX_PL_Cert *certPkix = NULL;
PKIX_TrustAnchor *trustAnchor = NULL;
PKIX_RevocationChecker *revChecker = NULL;
PKIX_PL_NssContext *nssContext = (PKIX_PL_NssContext *)plContext;
/* XXX we need a way to map generic PKIX error to generic NSS errors */
switch (param->type) {
case cert_pi_policyOID:
/* needed? */
error = PKIX_ProcessingParams_SetExplicitPolicyRequired(
procParams, PKIX_TRUE, plContext);
if (error != NULL) {
break;
}
policyOIDList = cert_PKIXMakeOIDList(param->value.array.oids,
param->value.arraySize, plContext);
if (policyOIDList == NULL) {
r = SECFailure;
PORT_SetError(SEC_ERROR_INVALID_ARGS);
break;
}
error = PKIX_ProcessingParams_SetInitialPolicies(
procParams, policyOIDList, plContext);
break;
case cert_pi_date:
if (param->value.scalar.time == 0) {
error = PKIX_PL_Date_Create_UTCTime(NULL, &date, plContext);
if (error != NULL) {
errCode = SEC_ERROR_INVALID_TIME;
break;
}
} else {
error = pkix_pl_Date_CreateFromPRTime(param->value.scalar.time,
&date, plContext);
if (error != NULL) {
errCode = SEC_ERROR_INVALID_TIME;
break;
}
}
error = PKIX_ProcessingParams_SetDate(procParams, date, plContext);
if (error != NULL) {
errCode = SEC_ERROR_INVALID_TIME;
}
break;
case cert_pi_revocationFlags: {
PKIX_UInt32 leafIMFlags = 0;
PKIX_UInt32 chainIMFlags = 0;
PKIX_Boolean validatingResponderCert = PKIX_FALSE;
flags = param->value.pointer.revocation;
if (!flags) {
PORT_SetError(errCode);
r = SECFailure;
break;
}
leafIMFlags =
flags->leafTests.cert_rev_method_independent_flags;
chainIMFlags =
flags->chainTests.cert_rev_method_independent_flags;
error =
PKIX_RevocationChecker_Create(leafIMFlags, chainIMFlags,
&revChecker, plContext);
if (error) {
break;
}
error =
PKIX_ProcessingParams_SetRevocationChecker(procParams,
revChecker, plContext);
if (error) {
break;
}
if (((PKIX_PL_NssContext *)plContext)->certificateUsage &
certificateUsageStatusResponder) {
validatingResponderCert = PKIX_TRUE;
}
error = setRevocationMethod(revChecker,
procParams, &flags->leafTests,
cert_revocation_method_crl,
PKIX_RevocationMethod_CRL,
validatingResponderCert,
PKIX_TRUE, plContext);
if (error) {
break;
}
error = setRevocationMethod(revChecker,
procParams, &flags->leafTests,
cert_revocation_method_ocsp,
PKIX_RevocationMethod_OCSP,
validatingResponderCert,
PKIX_TRUE, plContext);
if (error) {
break;
}
error = setRevocationMethod(revChecker,
procParams, &flags->chainTests,
cert_revocation_method_crl,
PKIX_RevocationMethod_CRL,
validatingResponderCert,
PKIX_FALSE, plContext);
if (error) {
break;
}
error = setRevocationMethod(revChecker,
procParams, &flags->chainTests,
cert_revocation_method_ocsp,
PKIX_RevocationMethod_OCSP,
validatingResponderCert,
PKIX_FALSE, plContext);
if (error) {
break;
}
} break;
case cert_pi_trustAnchors:
certList = param->value.pointer.chain;
if (!certList) {
PORT_SetError(errCode);
r = SECFailure;
break;
}
error = PKIX_List_Create(&certListPkix, plContext);
if (error != NULL) {
break;
}
for (node = CERT_LIST_HEAD(certList); !CERT_LIST_END(node, certList);
node = CERT_LIST_NEXT(node)) {
error = PKIX_PL_Cert_CreateFromCERTCertificate(node->cert,
&certPkix, plContext);
if (error) {
break;
}
error = PKIX_TrustAnchor_CreateWithCert(certPkix, &trustAnchor,
plContext);
if (error) {
break;
}
error = PKIX_List_AppendItem(certListPkix,
(PKIX_PL_Object *)trustAnchor, plContext);
if (error) {
break;
}
PKIX_PL_Object_DecRef((PKIX_PL_Object *)trustAnchor, plContext);
trustAnchor = NULL;
PKIX_PL_Object_DecRef((PKIX_PL_Object *)certPkix, plContext);
certPkix = NULL;
}
error =
PKIX_ProcessingParams_SetTrustAnchors(procParams, certListPkix,
plContext);
break;
case cert_pi_useAIACertFetch:
error =
PKIX_ProcessingParams_SetUseAIAForCertFetching(procParams,
(PRBool)(param->value.scalar.b !=
0),
plContext);
break;
case cert_pi_chainVerifyCallback: {
const CERTChainVerifyCallback *chainVerifyCallback =
param->value.pointer.chainVerifyCallback;
if (!chainVerifyCallback || !chainVerifyCallback->isChainValid) {
PORT_SetError(errCode);
r = SECFailure;
break;
}
nssContext->chainVerifyCallback = *chainVerifyCallback;
} break;
case cert_pi_useOnlyTrustAnchors:
error =
PKIX_ProcessingParams_SetUseOnlyTrustAnchors(procParams,
(PRBool)(param->value.scalar.b !=
0),
plContext);
break;
default:
PORT_SetError(errCode);
r = SECFailure;
break;
}
if (policyOIDList != NULL)
PKIX_PL_Object_DecRef((PKIX_PL_Object *)policyOIDList, plContext);
if (date != NULL)
PKIX_PL_Object_DecRef((PKIX_PL_Object *)date, plContext);
if (revChecker != NULL)
PKIX_PL_Object_DecRef((PKIX_PL_Object *)revChecker, plContext);
if (certListPkix)
PKIX_PL_Object_DecRef((PKIX_PL_Object *)certListPkix, plContext);
if (trustAnchor)
PKIX_PL_Object_DecRef((PKIX_PL_Object *)trustAnchor, plContext);
if (certPkix)
PKIX_PL_Object_DecRef((PKIX_PL_Object *)certPkix, plContext);
if (error != NULL) {
PKIX_PL_Object_DecRef((PKIX_PL_Object *)error, plContext);
PORT_SetError(errCode);
r = SECFailure;
}
return r;
}
void
cert_pkixDestroyValOutParam(CERTValOutParam *params)
{
CERTValOutParam *i;
if (params == NULL) {
return;
}
for (i = params; i->type != cert_po_end; i++) {
switch (i->type) {
case cert_po_trustAnchor:
if (i->value.pointer.cert) {
CERT_DestroyCertificate(i->value.pointer.cert);
i->value.pointer.cert = NULL;
}
break;
case cert_po_certList:
if (i->value.pointer.chain) {
CERT_DestroyCertList(i->value.pointer.chain);
i->value.pointer.chain = NULL;
}
break;
default:
break;
}
}
}
static PRUint64 certRev_NSS_3_11_Ocsp_Enabled_Soft_Policy_LeafFlags[2] = {
/* crl */
CERT_REV_M_TEST_USING_THIS_METHOD |
CERT_REV_M_FORBID_NETWORK_FETCHING |
CERT_REV_M_CONTINUE_TESTING_ON_FRESH_INFO,
/* ocsp */
CERT_REV_M_TEST_USING_THIS_METHOD
};
static PRUint64 certRev_NSS_3_11_Ocsp_Enabled_Soft_Policy_ChainFlags[2] = {
/* crl */
CERT_REV_M_TEST_USING_THIS_METHOD |
CERT_REV_M_FORBID_NETWORK_FETCHING |
CERT_REV_M_CONTINUE_TESTING_ON_FRESH_INFO,
/* ocsp */
0
};
static CERTRevocationMethodIndex
certRev_NSS_3_11_Ocsp_Enabled_Soft_Policy_Method_Preference = {
cert_revocation_method_crl
};
static const CERTRevocationFlags certRev_NSS_3_11_Ocsp_Enabled_Soft_Policy = {
{ /* leafTests */
2,
certRev_NSS_3_11_Ocsp_Enabled_Soft_Policy_LeafFlags,
1,
&certRev_NSS_3_11_Ocsp_Enabled_Soft_Policy_Method_Preference,
0 },
{ /* chainTests */
2,
certRev_NSS_3_11_Ocsp_Enabled_Soft_Policy_ChainFlags,
0,
0,
0 }
};
#endif /* NSS_DISABLE_LIBPKIX */
extern const CERTRevocationFlags *
CERT_GetClassicOCSPEnabledSoftFailurePolicy()
{
#ifdef NSS_DISABLE_LIBPKIX
PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
return NULL;
#else
return &certRev_NSS_3_11_Ocsp_Enabled_Soft_Policy;
#endif /* NSS_DISABLE_LIBPKIX */
}
#ifndef NSS_DISABLE_LIBPKIX
static PRUint64 certRev_NSS_3_11_Ocsp_Enabled_Hard_Policy_LeafFlags[2] = {
/* crl */
CERT_REV_M_TEST_USING_THIS_METHOD |
CERT_REV_M_FORBID_NETWORK_FETCHING |
CERT_REV_M_CONTINUE_TESTING_ON_FRESH_INFO,
/* ocsp */
CERT_REV_M_TEST_USING_THIS_METHOD |
CERT_REV_M_FAIL_ON_MISSING_FRESH_INFO
};
static PRUint64 certRev_NSS_3_11_Ocsp_Enabled_Hard_Policy_ChainFlags[2] = {
/* crl */
CERT_REV_M_TEST_USING_THIS_METHOD |
CERT_REV_M_FORBID_NETWORK_FETCHING |
CERT_REV_M_CONTINUE_TESTING_ON_FRESH_INFO,
/* ocsp */
0
};
static CERTRevocationMethodIndex
certRev_NSS_3_11_Ocsp_Enabled_Hard_Policy_Method_Preference = {
cert_revocation_method_crl
};
static const CERTRevocationFlags certRev_NSS_3_11_Ocsp_Enabled_Hard_Policy = {
{ /* leafTests */
2,
certRev_NSS_3_11_Ocsp_Enabled_Hard_Policy_LeafFlags,
1,
&certRev_NSS_3_11_Ocsp_Enabled_Hard_Policy_Method_Preference,
0 },
{ /* chainTests */
2,
certRev_NSS_3_11_Ocsp_Enabled_Hard_Policy_ChainFlags,
0,
0,
0 }
};
#endif /* NSS_DISABLE_LIBPKIX */
extern const CERTRevocationFlags *
CERT_GetClassicOCSPEnabledHardFailurePolicy()
{
#ifdef NSS_DISABLE_LIBPKIX
PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
return NULL;
#else
return &certRev_NSS_3_11_Ocsp_Enabled_Hard_Policy;
#endif /* NSS_DISABLE_LIBPKIX */
}
#ifndef NSS_DISABLE_LIBPKIX
static PRUint64 certRev_NSS_3_11_Ocsp_Disabled_Policy_LeafFlags[2] = {
/* crl */
CERT_REV_M_TEST_USING_THIS_METHOD |
CERT_REV_M_FORBID_NETWORK_FETCHING |
CERT_REV_M_CONTINUE_TESTING_ON_FRESH_INFO,
/* ocsp */
0
};
static PRUint64 certRev_NSS_3_11_Ocsp_Disabled_Policy_ChainFlags[2] = {
/* crl */
CERT_REV_M_TEST_USING_THIS_METHOD |
CERT_REV_M_FORBID_NETWORK_FETCHING |
CERT_REV_M_CONTINUE_TESTING_ON_FRESH_INFO,
/* ocsp */
0
};
static const CERTRevocationFlags certRev_NSS_3_11_Ocsp_Disabled_Policy = {
{ /* leafTests */
2,
certRev_NSS_3_11_Ocsp_Disabled_Policy_LeafFlags,
0,
0,
0 },
{ /* chainTests */
2,
certRev_NSS_3_11_Ocsp_Disabled_Policy_ChainFlags,
0,
0,
0 }
};
#endif /* NSS_DISABLE_LIBPKIX */
extern const CERTRevocationFlags *
CERT_GetClassicOCSPDisabledPolicy()
{
#ifdef NSS_DISABLE_LIBPKIX
PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
return NULL;
#else
return &certRev_NSS_3_11_Ocsp_Disabled_Policy;
#endif /* NSS_DISABLE_LIBPKIX */
}
#ifndef NSS_DISABLE_LIBPKIX
static PRUint64 certRev_PKIX_Verify_Nist_Policy_LeafFlags[2] = {
/* crl */
CERT_REV_M_TEST_USING_THIS_METHOD |
CERT_REV_M_FAIL_ON_MISSING_FRESH_INFO |
CERT_REV_M_REQUIRE_INFO_ON_MISSING_SOURCE,
/* ocsp */
0
};
static PRUint64 certRev_PKIX_Verify_Nist_Policy_ChainFlags[2] = {
/* crl */
CERT_REV_M_TEST_USING_THIS_METHOD |
CERT_REV_M_FAIL_ON_MISSING_FRESH_INFO |
CERT_REV_M_REQUIRE_INFO_ON_MISSING_SOURCE,
/* ocsp */
0
};
static const CERTRevocationFlags certRev_PKIX_Verify_Nist_Policy = {
{ /* leafTests */
2,
certRev_PKIX_Verify_Nist_Policy_LeafFlags,
0,
0,
0 },
{ /* chainTests */
2,
certRev_PKIX_Verify_Nist_Policy_ChainFlags,
0,
0,
0 }
};
#endif /* NSS_DISABLE_LIBPKIX */
extern const CERTRevocationFlags *
CERT_GetPKIXVerifyNistRevocationPolicy()
{
#ifdef NSS_DISABLE_LIBPKIX
PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
return NULL;
#else
return &certRev_PKIX_Verify_Nist_Policy;
#endif /* NSS_DISABLE_LIBPKIX */
}
CERTRevocationFlags *
CERT_AllocCERTRevocationFlags(
PRUint32 number_leaf_methods, PRUint32 number_leaf_pref_methods,
PRUint32 number_chain_methods, PRUint32 number_chain_pref_methods)
{
#ifdef NSS_DISABLE_LIBPKIX
PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
return NULL;
#else
CERTRevocationFlags *flags;
flags = PORT_New(CERTRevocationFlags);
if (!flags)
return (NULL);
flags->leafTests.number_of_defined_methods = number_leaf_methods;
flags->leafTests.cert_rev_flags_per_method =
PORT_NewArray(PRUint64, number_leaf_methods);
flags->leafTests.number_of_preferred_methods = number_leaf_pref_methods;
flags->leafTests.preferred_methods =
PORT_NewArray(CERTRevocationMethodIndex, number_leaf_pref_methods);
flags->chainTests.number_of_defined_methods = number_chain_methods;
flags->chainTests.cert_rev_flags_per_method =
PORT_NewArray(PRUint64, number_chain_methods);
flags->chainTests.number_of_preferred_methods = number_chain_pref_methods;
flags->chainTests.preferred_methods =
PORT_NewArray(CERTRevocationMethodIndex, number_chain_pref_methods);
if (!flags->leafTests.cert_rev_flags_per_method ||
!flags->leafTests.preferred_methods ||
!flags->chainTests.cert_rev_flags_per_method ||
!flags->chainTests.preferred_methods) {
CERT_DestroyCERTRevocationFlags(flags);
return (NULL);
}
return flags;
#endif /* NSS_DISABLE_LIBPKIX */
}
void
CERT_DestroyCERTRevocationFlags(CERTRevocationFlags *flags)
{
#ifdef NSS_DISABLE_LIBPKIX
PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
return;
#else
if (!flags)
return;
if (flags->leafTests.cert_rev_flags_per_method)
PORT_Free(flags->leafTests.cert_rev_flags_per_method);
if (flags->leafTests.preferred_methods)
PORT_Free(flags->leafTests.preferred_methods);
if (flags->chainTests.cert_rev_flags_per_method)
PORT_Free(flags->chainTests.cert_rev_flags_per_method);
if (flags->chainTests.preferred_methods)
PORT_Free(flags->chainTests.preferred_methods);
PORT_Free(flags);
#endif /* NSS_DISABLE_LIBPKIX */
}
/*
* CERT_PKIXVerifyCert
*
* Verify a Certificate using the PKIX library.
*
* Parameters:
* cert - the target certificate to verify. Must be non-null
* params - an array of type/value parameters which can be
* used to modify the behavior of the validation
* algorithm, or supply additional constraints.
*
* outputTrustAnchor - the trust anchor which the certificate
* chains to. The caller is responsible
* for freeing this.
*
* Example Usage:
* CERTValParam args[3];
* args[0].type = cvpt_policyOID;
* args[0].value.si = oid;
* args[1].type = revCheckRequired;
* args[1].value.b = PR_TRUE;
* args[2].type = cvpt_end;
*
* CERT_PKIXVerifyCert(cert, &output, args
*/
SECStatus
CERT_PKIXVerifyCert(
CERTCertificate *cert,
SECCertificateUsage usages,
CERTValInParam *paramsIn,
CERTValOutParam *paramsOut,
void *wincx)
{
#ifdef NSS_DISABLE_LIBPKIX
PORT_SetError(PR_NOT_IMPLEMENTED_ERROR);
return SECFailure;
#else
SECStatus r = SECFailure;
PKIX_Error *error = NULL;
PKIX_ProcessingParams *procParams = NULL;
PKIX_BuildResult *buildResult = NULL;
void *nbioContext = NULL; /* for non-blocking IO */
void *buildState = NULL; /* for non-blocking IO */
PKIX_CertSelector *certSelector = NULL;
PKIX_List *certStores = NULL;
PKIX_ValidateResult *valResult = NULL;
PKIX_VerifyNode *verifyNode = NULL;
PKIX_TrustAnchor *trustAnchor = NULL;
PKIX_PL_Cert *trustAnchorCert = NULL;
PKIX_List *builtCertList = NULL;
CERTValOutParam *oparam = NULL;
int i = 0;
void *plContext = NULL;
#ifdef PKIX_OBJECT_LEAK_TEST
int leakedObjNum = 0;
int memLeakLoopCount = 0;
int objCountTable[PKIX_NUMTYPES];
int fnInvLocalCount = 0;
PKIX_Boolean savedUsePkixEngFlag = usePKIXValidationEngine;
if (usePKIXValidationEngine) {
/* current memory leak testing implementation does not allow
* to run simultaneous tests one the same or a different threads.
* Setting the variable to false, to make additional chain
* validations be handled by old nss. */
usePKIXValidationEngine = PR_FALSE;
}
testStartFnStackPosition = 1;
fnStackNameArr[0] = "CERT_PKIXVerifyCert";
fnStackInvCountArr[0] = 0;
PKIX_Boolean abortOnLeak =
(PR_GetEnvSecure("PKIX_OBJECT_LEAK_TEST_ABORT_ON_LEAK") == NULL) ? PKIX_FALSE
: PKIX_TRUE;
runningLeakTest = PKIX_TRUE;
/* Prevent multi-threaded run of object leak test */
fnInvLocalCount = PR_ATOMIC_INCREMENT(¶llelFnInvocationCount);
PORT_Assert(fnInvLocalCount == 1);
do {
r = SECFailure;
error = NULL;
procParams = NULL;
buildResult = NULL;
nbioContext = NULL; /* for non-blocking IO */
buildState = NULL; /* for non-blocking IO */
certSelector = NULL;
certStores = NULL;
valResult = NULL;
verifyNode = NULL;
trustAnchor = NULL;
trustAnchorCert = NULL;
builtCertList = NULL;
oparam = NULL;
i = 0;
errorGenerated = PKIX_FALSE;
stackPosition = 0;
if (leakedObjNum) {
pkix_pl_lifecycle_ObjectTableUpdate(objCountTable);
}
memLeakLoopCount += 1;
#endif /* PKIX_OBJECT_LEAK_TEST */
error = PKIX_PL_NssContext_Create(
0, PR_FALSE /*use arena*/, wincx, &plContext);
if (error != NULL) { /* need pkix->nss error map */
PORT_SetError(SEC_ERROR_CERT_NOT_VALID);
goto cleanup;
}
error = pkix_pl_NssContext_SetCertUsage(usages, plContext);
if (error != NULL) {
PORT_SetError(SEC_ERROR_INVALID_ARGS);
goto cleanup;
}
error = PKIX_ProcessingParams_Create(&procParams, plContext);
if (error != NULL) { /* need pkix->nss error map */
PORT_SetError(SEC_ERROR_CERT_NOT_VALID);
goto cleanup;
}
/* local cert store should be set into procParams before
* filling in revocation settings. */
certStores = cert_GetCertStores(plContext);
if (certStores == NULL) {
goto cleanup;
}
error = PKIX_ProcessingParams_SetCertStores(procParams, certStores, plContext);
if (error != NULL) {
goto cleanup;
}
/* now process the extensible input parameters structure */
if (paramsIn != NULL) {
i = 0;
while (paramsIn[i].type != cert_pi_end) {
if (paramsIn[i].type >= cert_pi_max) {
PORT_SetError(SEC_ERROR_INVALID_ARGS);
goto cleanup;
}
if (cert_pkixSetParam(procParams,
¶msIn[i], plContext) !=
SECSuccess) {
PORT_SetError(SEC_ERROR_INVALID_ARGS);
goto cleanup;
}
i++;
}
}
certSelector = cert_GetTargetCertConstraints(cert, plContext);
if (certSelector == NULL) {
goto cleanup;
}
error = PKIX_ProcessingParams_SetTargetCertConstraints(procParams, certSelector, plContext);
if (error != NULL) {
goto cleanup;
}
error = PKIX_BuildChain(procParams, &nbioContext,
&buildState, &buildResult, &verifyNode,
plContext);
if (error != NULL) {
goto cleanup;
}
error = PKIX_BuildResult_GetValidateResult(buildResult, &valResult,
plContext);
if (error != NULL) {
goto cleanup;
}
error = PKIX_ValidateResult_GetTrustAnchor(valResult, &trustAnchor,
plContext);
if (error != NULL) {
goto cleanup;
}
if (trustAnchor != NULL) {
error = PKIX_TrustAnchor_GetTrustedCert(trustAnchor, &trustAnchorCert,
plContext);
if (error != NULL) {
goto cleanup;
}
}
#ifdef PKIX_OBJECT_LEAK_TEST
/* Can not continue if error was generated but not returned.
* Jumping to cleanup. */
if (errorGenerated)
goto cleanup;
#endif /* PKIX_OBJECT_LEAK_TEST */
oparam = cert_pkix_FindOutputParam(paramsOut, cert_po_trustAnchor);
if (oparam != NULL) {
if (trustAnchorCert != NULL) {
oparam->value.pointer.cert =
cert_NSSCertFromPKIXCert(trustAnchorCert);
} else {
oparam->value.pointer.cert = NULL;
}
}
error = PKIX_BuildResult_GetCertChain(buildResult, &builtCertList,
plContext);
if (error != NULL) {
goto cleanup;
}
oparam = cert_pkix_FindOutputParam(paramsOut, cert_po_certList);
if (oparam != NULL) {
error = cert_PkixToNssCertsChain(builtCertList,
&oparam->value.pointer.chain,
plContext);
if (error)
goto cleanup;
}
r = SECSuccess;
cleanup:
if (verifyNode) {
/* Return validation log only upon error. */
oparam = cert_pkix_FindOutputParam(paramsOut, cert_po_errorLog);
#ifdef PKIX_OBJECT_LEAK_TEST
if (!errorGenerated)
#endif /* PKIX_OBJECT_LEAK_TEST */
if (r && oparam != NULL) {
PKIX_Error *tmpError =
cert_GetLogFromVerifyNode(oparam->value.pointer.log,
verifyNode, plContext);
if (tmpError) {
PKIX_PL_Object_DecRef((PKIX_PL_Object *)tmpError, plContext);
}
}
PKIX_PL_Object_DecRef((PKIX_PL_Object *)verifyNode, plContext);
}
if (procParams != NULL)
PKIX_PL_Object_DecRef((PKIX_PL_Object *)procParams, plContext);
if (trustAnchorCert != NULL)
PKIX_PL_Object_DecRef((PKIX_PL_Object *)trustAnchorCert, plContext);
if (trustAnchor != NULL)
PKIX_PL_Object_DecRef((PKIX_PL_Object *)trustAnchor, plContext);
if (valResult != NULL)
PKIX_PL_Object_DecRef((PKIX_PL_Object *)valResult, plContext);
if (buildResult != NULL)
PKIX_PL_Object_DecRef((PKIX_PL_Object *)buildResult, plContext);
if (certStores != NULL)
PKIX_PL_Object_DecRef((PKIX_PL_Object *)certStores, plContext);
if (certSelector != NULL)
PKIX_PL_Object_DecRef((PKIX_PL_Object *)certSelector, plContext);
if (builtCertList != NULL)
PKIX_PL_Object_DecRef((PKIX_PL_Object *)builtCertList, plContext);
if (error != NULL) {
SECErrorCodes nssErrorCode = 0;
cert_PkixErrorToNssCode(error, &nssErrorCode, plContext);
cert_pkixDestroyValOutParam(paramsOut);
PORT_SetError(nssErrorCode);
PKIX_PL_Object_DecRef((PKIX_PL_Object *)error, plContext);
}
PKIX_PL_NssContext_Destroy(plContext);
#ifdef PKIX_OBJECT_LEAK_TEST
leakedObjNum =
pkix_pl_lifecycle_ObjectLeakCheck(leakedObjNum ? objCountTable : NULL);
if (pkixLog && leakedObjNum) {
PR_LOG(pkixLog, 1, ("The generated error caused an object leaks. Loop %d."
"Stack %s\n",
memLeakLoopCount, errorFnStackString));
}
PR_Free(errorFnStackString);
errorFnStackString = NULL;
if (abortOnLeak) {
PORT_Assert(leakedObjNum == 0);
}
} while (errorGenerated);
runningLeakTest = PKIX_FALSE;
PR_ATOMIC_DECREMENT(¶llelFnInvocationCount);
usePKIXValidationEngine = savedUsePkixEngFlag;
#endif /* PKIX_OBJECT_LEAK_TEST */
return r;
#endif /* NSS_DISABLE_LIBPKIX */
}