Quelle  pkix_trustanchor.c   Sprache: C

/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
/*
 * pkix_trustanchor.c
 *
 * TrustAnchor Object Functions
 *
 */

#include "pkix_trustanchor.h"

/* --Private-Functions-------------------------------------------- */

/*
 * FUNCTION: pkix_TrustAnchor_Destroy
 * (see comments for PKIX_PL_DestructorCallback in pkix_pl_system.h)
 */
static PKIX_Error *
pkix_TrustAnchor_Destroy(
        PKIX_PL_Object *object,
        void *plContext)
{
        PKIX_TrustAnchor *anchor = NULL;

        PKIX_ENTER(TRUSTANCHOR, "pkix_TrustAnchor_Destroy");
        PKIX_NULLCHECK_ONE(object);

        /* Check that this object is a trust anchor */
        PKIX_CHECK(pkix_CheckType(object, PKIX_TRUSTANCHOR_TYPE, plContext),
                    PKIX_OBJECTNOTTRUSTANCHOR);

        anchor = (PKIX_TrustAnchor *)object;

        PKIX_DECREF(anchor->trustedCert);
        PKIX_DECREF(anchor->caName);
        PKIX_DECREF(anchor->caPubKey);
        PKIX_DECREF(anchor->nameConstraints);

cleanup:

        PKIX_RETURN(TRUSTANCHOR);
}

/*
 * FUNCTION: pkix_TrustAnchor_Equals
 * (see comments for PKIX_PL_EqualsCallback in pkix_pl_system.h)
 */
static PKIX_Error *
pkix_TrustAnchor_Equals(
        PKIX_PL_Object *first,
        PKIX_PL_Object *second,
        PKIX_Boolean *pResult,
        void *plContext)
{
        PKIX_UInt32 secondType;
        PKIX_Boolean cmpResult;
        PKIX_TrustAnchor *firstAnchor = NULL;
        PKIX_TrustAnchor *secondAnchor = NULL;
        PKIX_PL_Cert *firstCert = NULL;
        PKIX_PL_Cert *secondCert = NULL;

        PKIX_ENTER(TRUSTANCHOR, "pkix_TrustAnchor_Equals");
        PKIX_NULLCHECK_THREE(first, second, pResult);

        PKIX_CHECK(pkix_CheckType(first, PKIX_TRUSTANCHOR_TYPE, plContext),
                    PKIX_FIRSTOBJECTNOTTRUSTANCHOR);

        PKIX_CHECK(PKIX_PL_Object_GetType(second, &secondType, plContext),
                    PKIX_COULDNOTGETTYPEOFSECONDARGUMENT);

        *pResult = PKIX_FALSE;

        if (secondType != PKIX_TRUSTANCHOR_TYPE) goto cleanup;

        firstAnchor = (PKIX_TrustAnchor *)first;
        secondAnchor = (PKIX_TrustAnchor *)second;

        firstCert = firstAnchor->trustedCert;
        secondCert = secondAnchor->trustedCert;

        if ((firstCert && !secondCert) || (!firstCert && secondCert)){
                goto cleanup;
        }

        if (firstCert && secondCert){
                PKIX_CHECK(PKIX_PL_Object_Equals
                            ((PKIX_PL_Object *)firstCert,
                            (PKIX_PL_Object *)secondCert,
                            &cmpResult,
                            plContext),
                            PKIX_OBJECTEQUALSFAILED);
        } else {
                PKIX_CHECK(PKIX_PL_Object_Equals
                            ((PKIX_PL_Object *)firstAnchor->caName,
                            (PKIX_PL_Object *)secondAnchor->caName,
                            &cmpResult,
                            plContext),
                            PKIX_OBJECTEQUALSFAILED);

                if (!cmpResult) goto cleanup;

                PKIX_CHECK(PKIX_PL_Object_Equals
                            ((PKIX_PL_Object *)firstAnchor->caPubKey,
                            (PKIX_PL_Object *)secondAnchor->caPubKey,
                            &cmpResult,
                            plContext),
                            PKIX_OBJECTEQUALSFAILED);

                if (!cmpResult) goto cleanup;

                PKIX_EQUALS
                        (firstAnchor->nameConstraints,
                        secondAnchor->nameConstraints,
                        &cmpResult,
                        plContext,
                        PKIX_OBJECTEQUALSFAILED);

                if (!cmpResult) goto cleanup;

        }

        *pResult = cmpResult;

cleanup:

        PKIX_RETURN(TRUSTANCHOR);
}

/*
 * FUNCTION: pkix_TrustAnchor_Hashcode
 * (see comments for PKIX_PL_HashcodeCallback in pkix_pl_system.h)
 */
static PKIX_Error *
pkix_TrustAnchor_Hashcode(
        PKIX_PL_Object *object,
        PKIX_UInt32 *pHashcode,
        void *plContext)
{
        PKIX_TrustAnchor *anchor = NULL;
        PKIX_PL_Cert *cert = NULL;
        PKIX_UInt32 hash = 0;
        PKIX_UInt32 certHash = 0;
        PKIX_UInt32 nameHash = 0;
        PKIX_UInt32 pubKeyHash = 0;
        PKIX_UInt32 ncHash = 0;

        PKIX_ENTER(TRUSTANCHOR, "pkix_TrustAnchor_Hashcode");
        PKIX_NULLCHECK_TWO(object, pHashcode);

        PKIX_CHECK(pkix_CheckType(object, PKIX_TRUSTANCHOR_TYPE, plContext),
                    PKIX_OBJECTNOTTRUSTANCHOR);

        anchor = (PKIX_TrustAnchor*)object;
        cert = anchor->trustedCert;

        if (cert){
                PKIX_CHECK(PKIX_PL_Object_Hashcode
                            ((PKIX_PL_Object *)cert,
                            &certHash,
                            plContext),
                            PKIX_OBJECTHASHCODEFAILED);

                hash = certHash;

        } else {
                PKIX_CHECK(PKIX_PL_Object_Hashcode
                            ((PKIX_PL_Object *)anchor->caName,
                            &nameHash,
                            plContext),
                            PKIX_OBJECTHASHCODEFAILED);

                PKIX_CHECK(PKIX_PL_Object_Hashcode
                            ((PKIX_PL_Object *)anchor->caPubKey,
                            &pubKeyHash,
                            plContext),
                            PKIX_OBJECTHASHCODEFAILED);

                PKIX_HASHCODE(anchor->nameConstraints, &ncHash, plContext,
                        PKIX_OBJECTHASHCODEFAILED);

                hash = 31 * nameHash + pubKeyHash + ncHash;

        }

        *pHashcode = hash;

cleanup:

        PKIX_RETURN(TRUSTANCHOR);
}

/*
 * FUNCTION: pkix_TrustAnchor_ToString
 * (see comments for PKIX_PL_ToStringCallback in pkix_pl_system.h)
 */
static PKIX_Error *
pkix_TrustAnchor_ToString(
        PKIX_PL_Object *object,
        PKIX_PL_String **pString,
        void *plContext)
{
        PKIX_TrustAnchor *anchor = NULL;
        char *asciiFormat = NULL;
        PKIX_PL_String *formatString = NULL;
        PKIX_PL_String *anchorString = NULL;
        PKIX_PL_String *certString = NULL;
        PKIX_PL_String *nameString = NULL;
        PKIX_PL_String *pubKeyString = NULL;
        PKIX_PL_String *nameConstraintsString = NULL;

        PKIX_ENTER(TRUSTANCHOR, "pkix_TrustAnchor_ToString");
        PKIX_NULLCHECK_TWO(object, pString);

        PKIX_CHECK(pkix_CheckType(object, PKIX_TRUSTANCHOR_TYPE, plContext),
                    PKIX_OBJECTNOTTRUSTANCHOR);

        anchor = (PKIX_TrustAnchor*)object;

        if (anchor->trustedCert){
                asciiFormat =
                        "[\n"
                        "\tTrusted Cert: %s\n"
                        "]\n";

                PKIX_CHECK(PKIX_PL_String_Create
                            (PKIX_ESCASCII,
                            asciiFormat,
                            0,
                            &formatString,
                            plContext),
                            PKIX_STRINGCREATEFAILED);

                PKIX_CHECK(PKIX_PL_Object_ToString
                            ((PKIX_PL_Object *)anchor->trustedCert,
                            &certString,
                            plContext),
                            PKIX_OBJECTTOSTRINGFAILED);

                PKIX_CHECK(PKIX_PL_Sprintf
                            (&anchorString,
                            plContext,
                            formatString,
                            certString),
                            PKIX_SPRINTFFAILED);
        } else {
                asciiFormat =
                        "[\n"
                        "\tTrusted CA Name: %s\n"
                        "\tTrusted CA PublicKey: %s\n"
                        "\tInitial Name Constraints:%s\n"
                        "]\n";

                PKIX_CHECK(PKIX_PL_String_Create
                            (PKIX_ESCASCII,
                            asciiFormat,
                            0,
                            &formatString,
                            plContext),
                            PKIX_STRINGCREATEFAILED);

                PKIX_CHECK(PKIX_PL_Object_ToString
                            ((PKIX_PL_Object *)anchor->caName,
                            &nameString,
                            plContext),
                            PKIX_OBJECTTOSTRINGFAILED);

                PKIX_CHECK(PKIX_PL_Object_ToString
                            ((PKIX_PL_Object *)anchor->caPubKey,
                            &pubKeyString,
                            plContext),
                            PKIX_OBJECTTOSTRINGFAILED);

                PKIX_TOSTRING
                        (anchor->nameConstraints,
                        &nameConstraintsString,
                        plContext,
                        PKIX_OBJECTTOSTRINGFAILED);

                PKIX_CHECK(PKIX_PL_Sprintf
                            (&anchorString,
                            plContext,
                            formatString,
                            nameString,
                            pubKeyString,
                            nameConstraintsString),
                            PKIX_SPRINTFFAILED);
        }

        *pString = anchorString;

cleanup:

        PKIX_DECREF(formatString);
        PKIX_DECREF(certString);
        PKIX_DECREF(nameString);
        PKIX_DECREF(pubKeyString);
        PKIX_DECREF(nameConstraintsString);

        PKIX_RETURN(TRUSTANCHOR);
}

/*
 * FUNCTION: pkix_TrustAnchor_RegisterSelf
 * DESCRIPTION:
 *  Registers PKIX_TRUSTANCHOR_TYPE and its related functions with
 *  systemClasses[]
 * THREAD SAFETY:
 *  Not Thread Safe - for performance and complexity reasons
 *
 *  Since this function is only called by PKIX_PL_Initialize, which should
 *  only be called once, it is acceptable that this function is not
 *  thread-safe.
 */
PKIX_Error *
pkix_TrustAnchor_RegisterSelf(void *plContext)
{
        extern pkix_ClassTable_Entry systemClasses[PKIX_NUMTYPES];
        pkix_ClassTable_Entry entry;

        PKIX_ENTER(TRUSTANCHOR, "pkix_TrustAnchor_RegisterSelf");

        entry.description = "TrustAnchor";
        entry.objCounter = 0;
        entry.typeObjectSize = sizeof(PKIX_TrustAnchor);
        entry.destructor = pkix_TrustAnchor_Destroy;
        entry.equalsFunction = pkix_TrustAnchor_Equals;
        entry.hashcodeFunction = pkix_TrustAnchor_Hashcode;
        entry.toStringFunction = pkix_TrustAnchor_ToString;
        entry.comparator = NULL;
        entry.duplicateFunction = pkix_duplicateImmutable;

        systemClasses[PKIX_TRUSTANCHOR_TYPE] = entry;

        PKIX_RETURN(TRUSTANCHOR);
}

/* --Public-Functions--------------------------------------------- */


/*
 * FUNCTION: PKIX_TrustAnchor_CreateWithCert (see comments in pkix_params.h)
 */
PKIX_Error *
PKIX_TrustAnchor_CreateWithCert(
        PKIX_PL_Cert *cert,
        PKIX_TrustAnchor **pAnchor,
        void *plContext)
{
        PKIX_TrustAnchor *anchor = NULL;

        PKIX_ENTER(TRUSTANCHOR, "PKIX_TrustAnchor_CreateWithCert");
        PKIX_NULLCHECK_TWO(cert, pAnchor);

        PKIX_CHECK(PKIX_PL_Object_Alloc
                    (PKIX_TRUSTANCHOR_TYPE,
                    sizeof (PKIX_TrustAnchor),
                    (PKIX_PL_Object **)&anchor,
                    plContext),
                    PKIX_COULDNOTCREATETRUSTANCHOROBJECT);

        /* initialize fields */
        PKIX_CHECK(
            PKIX_PL_Cert_SetAsTrustAnchor(cert, plContext),
            PKIX_CERTSETASTRUSTANCHORFAILED);

        PKIX_INCREF(cert);
        anchor->trustedCert = cert;

        anchor->caName = NULL;
        anchor->caPubKey = NULL;

        PKIX_CHECK(PKIX_PL_Cert_GetNameConstraints
                    (anchor->trustedCert, &anchor->nameConstraints, plContext),
                    PKIX_CERTGETNAMECONSTRAINTSFAILED);


        *pAnchor = anchor;
        anchor = NULL;

cleanup:

        PKIX_DECREF(anchor);

        PKIX_RETURN(TRUSTANCHOR);

}

/*
 * FUNCTION: PKIX_TrustAnchor_CreateWithNameKeyPair
 *      (see comments in pkix_params.h)
 */
PKIX_Error *
PKIX_TrustAnchor_CreateWithNameKeyPair(
        PKIX_PL_X500Name *name,
        PKIX_PL_PublicKey *pubKey,
        PKIX_PL_CertNameConstraints *nameConstraints,
        PKIX_TrustAnchor **pAnchor,
        void *plContext)
{
        PKIX_TrustAnchor *anchor = NULL;

        PKIX_ENTER(TRUSTANCHOR, "PKIX_TrustAnchor_CreateWithNameKeyPair");

#ifndef BUILD_LIBPKIX_TESTS
        /* Nss creates trust anchors by using PKIX_TrustAnchor_CreateWithCert
         * function as the complete trusted cert structure, and not only cert
         * public key, is required for chain building and validation processes. 
         * Restricting this function for been used only in libpkix unit
         * tests. */
        PKIX_ERROR(PKIX_FUNCTIONMUSTNOTBEUSED);
#endif

        PKIX_NULLCHECK_THREE(name, pubKey, pAnchor);

        PKIX_CHECK(PKIX_PL_Object_Alloc
                    (PKIX_TRUSTANCHOR_TYPE,
                    sizeof (PKIX_TrustAnchor),
                    (PKIX_PL_Object **)&anchor,
                    plContext),
                    PKIX_COULDNOTCREATETRUSTANCHOROBJECT);

        /* initialize fields */
        anchor->trustedCert = NULL;

        PKIX_INCREF(name);
        anchor->caName = name;

        PKIX_INCREF(pubKey);
        anchor->caPubKey = pubKey;

        PKIX_INCREF(nameConstraints);
        anchor->nameConstraints = nameConstraints;

        *pAnchor = anchor;
        anchor = NULL;
cleanup:

        PKIX_DECREF(anchor);

        PKIX_RETURN(TRUSTANCHOR);
}

/*
 * FUNCTION: PKIX_TrustAnchor_GetTrustedCert (see comments in pkix_params.h)
 */
PKIX_Error *
PKIX_TrustAnchor_GetTrustedCert(
        PKIX_TrustAnchor *anchor,
        PKIX_PL_Cert **pCert,
        void *plContext)
{
        PKIX_ENTER(TRUSTANCHOR, "PKIX_TrustAnchor_GetTrustedCert");
        PKIX_NULLCHECK_TWO(anchor, pCert);

        PKIX_INCREF(anchor->trustedCert);

        *pCert = anchor->trustedCert;

cleanup:
        PKIX_RETURN(TRUSTANCHOR);

}

/*
 * FUNCTION: PKIX_TrustAnchor_GetCAName (see comments in pkix_params.h)
 */
PKIX_Error *
PKIX_TrustAnchor_GetCAName(
        PKIX_TrustAnchor *anchor,
        PKIX_PL_X500Name **pCAName,
        void *plContext)
{
        PKIX_ENTER(TRUSTANCHOR, "PKIX_TrustAnchor_GetCAName");
        PKIX_NULLCHECK_TWO(anchor, pCAName);

        PKIX_INCREF(anchor->caName);

        *pCAName = anchor->caName;

cleanup:
        PKIX_RETURN(TRUSTANCHOR);

}

/*
 * FUNCTION: PKIX_TrustAnchor_GetCAPublicKey (see comments in pkix_params.h)
 */
PKIX_Error *
PKIX_TrustAnchor_GetCAPublicKey(
        PKIX_TrustAnchor *anchor,
        PKIX_PL_PublicKey **pPubKey,
        void *plContext)
{
        PKIX_ENTER(TRUSTANCHOR, "PKIX_TrustAnchor_GetCAPublicKey");
        PKIX_NULLCHECK_TWO(anchor, pPubKey);

        PKIX_INCREF(anchor->caPubKey);

        *pPubKey = anchor->caPubKey;

cleanup:
        PKIX_RETURN(TRUSTANCHOR);
}

/*
 * FUNCTION: PKIX_TrustAnchor_GetNameConstraints
 *      (see comments in pkix_params.h)
 */
PKIX_Error *
PKIX_TrustAnchor_GetNameConstraints(
        PKIX_TrustAnchor *anchor,
        PKIX_PL_CertNameConstraints **pNameConstraints,
        void *plContext)
{
        PKIX_ENTER(TRUSTANCHOR, "PKIX_TrustAnchor_GetNameConstraints");
        PKIX_NULLCHECK_TWO(anchor, pNameConstraints);

        PKIX_INCREF(anchor->nameConstraints);

        *pNameConstraints = anchor->nameConstraints;

cleanup:
        PKIX_RETURN(TRUSTANCHOR);
}