Source code
Revision control
Copy as Markdown
Other Tools
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
/*
* pkix_certselector.c
*
* CertSelector Object Functions
*
*/
#include "pkix_certselector.h"
/* --Private-Functions-------------------------------------------- */
/*
* FUNCTION: pkix_CertSelector_Destroy
* (see comments for PKIX_PL_DestructorCallback in pkix_pl_system.h)
*/
static PKIX_Error *
pkix_CertSelector_Destroy(
PKIX_PL_Object *object,
void *plContext)
{
PKIX_CertSelector *selector = NULL;
PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Destroy");
PKIX_NULLCHECK_ONE(object);
/* Check that this object is a cert selector */
PKIX_CHECK(pkix_CheckType(object, PKIX_CERTSELECTOR_TYPE, plContext),
PKIX_OBJECTNOTCERTSELECTOR);
selector = (PKIX_CertSelector *)object;
PKIX_DECREF(selector->params);
PKIX_DECREF(selector->context);
cleanup:
PKIX_RETURN(CERTSELECTOR);
}
/*
* FUNCTION: pkix_CertSelector_Duplicate
* (see comments for PKIX_PL_DuplicateCallback in pkix_pl_system.h)
*/
static PKIX_Error *
pkix_CertSelector_Duplicate(
PKIX_PL_Object *object,
PKIX_PL_Object **pNewObject,
void *plContext)
{
PKIX_CertSelector *certSelector = NULL;
PKIX_CertSelector *certSelectorDuplicate = NULL;
PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Duplicate");
PKIX_NULLCHECK_TWO(object, pNewObject);
PKIX_CHECK(pkix_CheckType(object, PKIX_CERTSELECTOR_TYPE, plContext),
PKIX_OBJECTNOTCERTSELECTOR);
certSelector = (PKIX_CertSelector *)object;
PKIX_CHECK(PKIX_CertSelector_Create
(certSelector->matchCallback,
certSelector->context,
&certSelectorDuplicate,
plContext),
PKIX_CERTSELECTORCREATEFAILED);
PKIX_CHECK(PKIX_PL_Object_Duplicate
((PKIX_PL_Object *)certSelector->params,
(PKIX_PL_Object **)&certSelectorDuplicate->params,
plContext),
PKIX_OBJECTDUPLICATEFAILED);
*pNewObject = (PKIX_PL_Object *)certSelectorDuplicate;
cleanup:
if (PKIX_ERROR_RECEIVED){
PKIX_DECREF(certSelectorDuplicate);
}
PKIX_RETURN(CERTSELECTOR);
}
/*
* FUNCTION: pkix_CertSelector_Match_BasicConstraint
* DESCRIPTION:
*
* Determines whether the Cert pointed to by "cert" matches the basic
* constraints criterion using the basic constraints field of the
* ComCertSelParams pointed to by "params". If the basic constraints field is
* -1, no basic constraints check is done and the Cert is considered to match
* the basic constraints criterion. If the Cert does not match the basic
* constraints criterion, an Error pointer is returned.
*
* In order to match against this criterion, there are several possibilities.
*
* 1) If the criterion's minimum path length is greater than or equal to zero,
* a certificate must include a BasicConstraints extension with a pathLen of
* at least this value.
*
* 2) If the criterion's minimum path length is -2, a certificate must be an
* end-entity certificate.
*
* 3) If the criterion's minimum path length is -1, no basic constraints check
* is done and all certificates are considered to match this criterion.
*
* PARAMETERS:
* "params"
* Address of ComCertSelParams whose basic constraints field is used.
* Must be non-NULL.
* "cert"
* Address of Cert that is to be matched. Must be non-NULL.
* "pResult"
* Address of PKIX_Boolean that returns the match result.
* "plContext"
* Platform-specific context pointer.
* OUTPUT PARAMETERS ON FAILURE:
* If the function returns a failure,
* the output parameters of this function are undefined.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
static PKIX_Error *
pkix_CertSelector_Match_BasicConstraint(
PKIX_ComCertSelParams *params,
PKIX_PL_Cert *cert,
PKIX_Boolean *pResult,
void *plContext)
{
PKIX_PL_CertBasicConstraints *basicConstraints = NULL;
PKIX_Boolean caFlag = PKIX_FALSE; /* EE Cert by default */
PKIX_Int32 pathLength = 0;
PKIX_Int32 minPathLength = 0;
PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_BasicConstraint");
PKIX_NULLCHECK_THREE(params, cert, pResult);
*pResult = PKIX_TRUE;
PKIX_CHECK(PKIX_ComCertSelParams_GetBasicConstraints
(params, &minPathLength, plContext),
PKIX_COMCERTSELPARAMSGETBASICCONSTRAINTSFAILED);
/* If the minPathLength is unlimited (-1), no checking */
if (minPathLength == PKIX_CERTSEL_ALL_MATCH_MIN_PATHLENGTH) {
goto cleanup;
}
PKIX_CHECK(PKIX_PL_Cert_GetBasicConstraints
(cert, &basicConstraints, plContext),
PKIX_CERTGETBASICCONSTRAINTSFAILED);
if (basicConstraints != NULL) {
PKIX_CHECK(PKIX_PL_BasicConstraints_GetCAFlag
(basicConstraints, &caFlag, plContext),
PKIX_BASICCONSTRAINTSGETCAFLAGFAILED);
PKIX_CHECK(PKIX_PL_BasicConstraints_GetPathLenConstraint
(basicConstraints, &pathLength, plContext),
PKIX_BASICCONSTRAINTSGETPATHLENCONSTRAINTFAILED);
}
/*
* if minPathLength >= 0, the cert must have a BasicConstraints ext and
* the pathLength in this cert
* BasicConstraints needs to be >= minPathLength.
*/
if (minPathLength >= 0){
if ((!basicConstraints) || (caFlag == PKIX_FALSE)){
PKIX_ERROR(PKIX_CERTNOTALLOWEDTOSIGNCERTIFICATES);
} else if ((pathLength != PKIX_UNLIMITED_PATH_CONSTRAINT) &&
(pathLength < minPathLength)){
PKIX_CERTSELECTOR_DEBUG
("Basic Constraints path length match failed\n");
*pResult = PKIX_FALSE;
PKIX_ERROR(PKIX_PATHLENCONSTRAINTINVALID);
}
}
/* if the minPathLength is -2, this cert must be an end-entity cert. */
if (minPathLength == PKIX_CERTSEL_ENDENTITY_MIN_PATHLENGTH) {
if (caFlag == PKIX_TRUE) {
PKIX_CERTSELECTOR_DEBUG
("Basic Constraints end-entity match failed\n");
*pResult = PKIX_FALSE;
PKIX_ERROR(PKIX_PATHLENCONSTRAINTINVALID);
}
}
cleanup:
PKIX_DECREF(basicConstraints);
PKIX_RETURN(CERTSELECTOR);
}
/*
* FUNCTION: pkix_CertSelector_Match_Policies
* DESCRIPTION:
*
* Determines whether the Cert pointed to by "cert" matches the policy
* constraints specified in the ComCertsSelParams given by "params".
* If "params" specifies a policy constraint of NULL, all certificates
* match. If "params" specifies an empty list, "cert" must have at least
* some policy. Otherwise "cert" must include at least one of the
* policies in the list. See the description of PKIX_CertSelector in
* pkix_certsel.h for more.
*
* PARAMETERS:
* "params"
* Address of ComCertSelParams whose policy criterion (if any) is used.
* Must be non-NULL.
* "cert"
* Address of Cert that is to be matched. Must be non-NULL.
* "pResult"
* Address of PKIX_Boolean that returns the match result.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
static PKIX_Error *
pkix_CertSelector_Match_Policies(
PKIX_ComCertSelParams *params,
PKIX_PL_Cert *cert,
PKIX_Boolean *pResult,
void *plContext)
{
PKIX_UInt32 numConstraintPolicies = 0;
PKIX_UInt32 numCertPolicies = 0;
PKIX_UInt32 certPolicyIndex = 0;
PKIX_Boolean result = PKIX_FALSE;
PKIX_List *constraintPolicies = NULL; /* List of PKIX_PL_OID */
PKIX_List *certPolicyInfos = NULL; /* List of PKIX_PL_CertPolicyInfo */
PKIX_PL_CertPolicyInfo *policyInfo = NULL;
PKIX_PL_OID *polOID = NULL;
PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_Policies");
PKIX_NULLCHECK_THREE(params, cert, pResult);
PKIX_CHECK(PKIX_ComCertSelParams_GetPolicy
(params, &constraintPolicies, plContext),
PKIX_COMCERTSELPARAMSGETPOLICYFAILED);
/* If constraintPolicies is NULL, all certificates "match" */
if (constraintPolicies) {
PKIX_CHECK(PKIX_PL_Cert_GetPolicyInformation
(cert, &certPolicyInfos, plContext),
PKIX_CERTGETPOLICYINFORMATIONFAILED);
/* No hope of a match if cert has no policies */
if (!certPolicyInfos) {
PKIX_CERTSELECTOR_DEBUG("Certificate has no policies\n");
*pResult = PKIX_FALSE;
PKIX_ERROR(PKIX_CERTSELECTORMATCHPOLICIESFAILED);
}
PKIX_CHECK(PKIX_List_GetLength
(constraintPolicies, &numConstraintPolicies, plContext),
PKIX_LISTGETLENGTHFAILED);
if (numConstraintPolicies > 0) {
PKIX_CHECK(PKIX_List_GetLength
(certPolicyInfos, &numCertPolicies, plContext),
PKIX_LISTGETLENGTHFAILED);
for (certPolicyIndex = 0;
((!result) && (certPolicyIndex < numCertPolicies));
certPolicyIndex++) {
PKIX_CHECK(PKIX_List_GetItem
(certPolicyInfos,
certPolicyIndex,
(PKIX_PL_Object **)&policyInfo,
plContext),
PKIX_LISTGETELEMENTFAILED);
PKIX_CHECK(PKIX_PL_CertPolicyInfo_GetPolicyId
(policyInfo, &polOID, plContext),
PKIX_CERTPOLICYINFOGETPOLICYIDFAILED);
PKIX_CHECK(pkix_List_Contains
(constraintPolicies,
(PKIX_PL_Object *)polOID,
&result,
plContext),
PKIX_LISTCONTAINSFAILED);
PKIX_DECREF(policyInfo);
PKIX_DECREF(polOID);
}
if (!result) {
*pResult = PKIX_FALSE;
PKIX_ERROR(PKIX_CERTSELECTORMATCHPOLICIESFAILED);
}
}
}
cleanup:
PKIX_DECREF(constraintPolicies);
PKIX_DECREF(certPolicyInfos);
PKIX_DECREF(policyInfo);
PKIX_DECREF(polOID);
PKIX_RETURN(CERTSELECTOR);
}
/*
* FUNCTION: pkix_CertSelector_Match_CertificateValid
* DESCRIPTION:
*
* Determines whether the Cert pointed to by "cert" matches the certificate
* validity criterion using the CertificateValid field of the
* ComCertSelParams pointed to by "params". If the CertificateValid field is
* NULL, no validity check is done and the Cert is considered to match
* the CertificateValid criterion. If the CertificateValid field specifies a
* Date prior to the notBefore field in the Cert, or greater than the notAfter
* field in the Cert, an Error is returned.
*
* PARAMETERS:
* "params"
* Address of ComCertSelParams whose certValid field is used.
* Must be non-NULL.
* "cert"
* Address of Cert that is to be matched. Must be non-NULL.
* "pResult"
* Address of PKIX_Boolean that returns the match result.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
static PKIX_Error *
pkix_CertSelector_Match_CertificateValid(
PKIX_ComCertSelParams *params,
PKIX_PL_Cert *cert,
PKIX_Boolean *pResult,
void *plContext)
{
PKIX_PL_Date *validityTime = NULL;
PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_CertificateValid");
PKIX_NULLCHECK_THREE(params, cert, pResult);
PKIX_CHECK(PKIX_ComCertSelParams_GetCertificateValid
(params, &validityTime, plContext),
PKIX_COMCERTSELPARAMSGETCERTIFICATEVALIDFAILED);
/* If the validityTime is not set, all certificates are acceptable */
if (validityTime) {
PKIX_CHECK(PKIX_PL_Cert_CheckValidity
(cert, validityTime, plContext),
PKIX_CERTCHECKVALIDITYFAILED);
}
cleanup:
if (PKIX_ERROR_RECEIVED) {
*pResult = PKIX_FALSE;
}
PKIX_DECREF(validityTime);
PKIX_RETURN(CERTSELECTOR);
}
/*
* FUNCTION: pkix_CertSelector_Match_NameConstraints
* DESCRIPTION:
*
* Determines whether the Cert pointed to by "cert" matches the name
* constraints criterion specified in the ComCertSelParams pointed to by
* "params". If the name constraints field is NULL, no name constraints check
* is done and the Cert is considered to match the name constraints criterion.
* If the Cert does not match the name constraints criterion, an Error pointer
* is returned.
*
* PARAMETERS:
* "params"
* Address of ComCertSelParams whose name constraints field is used.
* Must be non-NULL.
* "cert"
* Address of Cert that is to be matched. Must be non-NULL.
* "pResult"
* Address of PKIX_Boolean that returns the match result.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
static PKIX_Error *
pkix_CertSelector_Match_NameConstraints(
PKIX_ComCertSelParams *params,
PKIX_PL_Cert *cert,
PKIX_Boolean *pResult,
void *plContext)
{
PKIX_PL_CertNameConstraints *nameConstraints = NULL;
PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_NameConstraints");
PKIX_NULLCHECK_THREE(params, cert, pResult);
PKIX_CHECK(PKIX_ComCertSelParams_GetNameConstraints
(params, &nameConstraints, plContext),
PKIX_COMCERTSELPARAMSGETNAMECONSTRAINTSFAILED);
if (nameConstraints != NULL) {
/* As only the end-entity certificate should have
* the common name constrained as if it was a dNSName,
* do not constrain the common name when building a
* forward path.
*/
PKIX_CHECK(PKIX_PL_Cert_CheckNameConstraints
(cert, nameConstraints, PKIX_FALSE, plContext),
PKIX_CERTCHECKNAMECONSTRAINTSFAILED);
}
cleanup:
if (PKIX_ERROR_RECEIVED) {
*pResult = PKIX_FALSE;
}
PKIX_DECREF(nameConstraints);
PKIX_RETURN(CERTSELECTOR);
}
/*
* FUNCTION: pkix_CertSelector_Match_PathToNames
* DESCRIPTION:
*
* Determines whether the names at pathToNames in "params" complies with the
* NameConstraints pointed to by "cert". If the pathToNames field is NULL
* or there is no name constraints for this "cert", no checking is done
* and the Cert is considered to match the name constraints criterion.
* If the Cert does not match the name constraints criterion, an Error
* pointer is returned.
*
* PARAMETERS:
* "params"
* Address of ComCertSelParams whose PathToNames field is used.
* Must be non-NULL.
* "cert"
* Address of Cert that is to be matched. Must be non-NULL.
* "pResult"
* Address of PKIX_Boolean that returns the match result.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
static PKIX_Error *
pkix_CertSelector_Match_PathToNames(
PKIX_ComCertSelParams *params,
PKIX_PL_Cert *cert,
PKIX_Boolean *pResult,
void *plContext)
{
PKIX_List *pathToNamesList = NULL;
PKIX_Boolean passed = PKIX_FALSE;
PKIX_PL_CertNameConstraints *nameConstraints = NULL;
PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_PathToNames");
PKIX_NULLCHECK_THREE(params, cert, pResult);
PKIX_CHECK(PKIX_ComCertSelParams_GetPathToNames
(params, &pathToNamesList, plContext),
PKIX_COMCERTSELPARAMSGETPATHTONAMESFAILED);
if (pathToNamesList != NULL) {
PKIX_CHECK(PKIX_PL_Cert_GetNameConstraints
(cert, &nameConstraints, plContext),
PKIX_CERTGETNAMECONSTRAINTSFAILED);
if (nameConstraints != NULL) {
PKIX_CHECK(PKIX_PL_CertNameConstraints_CheckNamesInNameSpace
(pathToNamesList, nameConstraints, &passed, plContext),
PKIX_CERTNAMECONSTRAINTSCHECKNAMESINNAMESPACEFAILED);
if (passed != PKIX_TRUE) {
*pResult = PKIX_FALSE;
PKIX_ERROR(PKIX_CERTSELECTORMATCHPATHTONAMESFAILED);
}
}
}
cleanup:
PKIX_DECREF(nameConstraints);
PKIX_DECREF(pathToNamesList);
PKIX_RETURN(CERTSELECTOR);
}
/*
* FUNCTION: pkix_CertSelector_Match_SubjAltNames
* DESCRIPTION:
*
* Determines whether the names at subjAltNames in "params" match with the
* SubjAltNames pointed to by "cert". If the subjAltNames field is NULL,
* no name checking is done and the Cert is considered to match the
* criterion. If the Cert does not match the criterion, an Error pointer
* is returned.
*
* PARAMETERS:
* "params"
* Address of ComCertSelParams whose SubjAltNames field is used.
* Must be non-NULL.
* "cert"
* Address of Cert that is to be matched. Must be non-NULL.
* "pResult"
* Address of PKIX_Boolean that returns the match result.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
static PKIX_Error *
pkix_CertSelector_Match_SubjAltNames(
PKIX_ComCertSelParams *params,
PKIX_PL_Cert *cert,
PKIX_Boolean *pResult,
void *plContext)
{
PKIX_List *subjAltNamesList = NULL;
PKIX_List *certSubjAltNames = NULL;
PKIX_PL_GeneralName *name = NULL;
PKIX_Boolean checkPassed = PKIX_FALSE;
PKIX_Boolean matchAll = PKIX_TRUE;
PKIX_UInt32 i, numItems;
PKIX_UInt32 matchCount = 0;
PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_SubjAltNames");
PKIX_NULLCHECK_THREE(params, cert, pResult);
PKIX_CHECK(PKIX_ComCertSelParams_GetMatchAllSubjAltNames
(params, &matchAll, plContext),
PKIX_COMCERTSELPARAMSGETMATCHALLSUBJALTNAMESFAILED);
PKIX_CHECK(PKIX_ComCertSelParams_GetSubjAltNames
(params, &subjAltNamesList, plContext),
PKIX_COMCERTSELPARAMSGETSUBJALTNAMESFAILED);
if (subjAltNamesList != NULL) {
PKIX_CHECK(PKIX_PL_Cert_GetSubjectAltNames
(cert, &certSubjAltNames, plContext),
PKIX_CERTGETSUBJALTNAMESFAILED);
if (certSubjAltNames == NULL) {
*pResult = PKIX_FALSE;
PKIX_ERROR(PKIX_CERTSELECTORMATCHSUBJALTNAMESFAILED);
}
PKIX_CHECK(PKIX_List_GetLength
(subjAltNamesList, &numItems, plContext),
PKIX_LISTGETLENGTHFAILED);
for (i = 0; i < numItems; i++) {
PKIX_CHECK(PKIX_List_GetItem
(subjAltNamesList,
i,
(PKIX_PL_Object **) &name,
plContext),
PKIX_LISTGETITEMFAILED);
PKIX_CHECK(pkix_List_Contains
(certSubjAltNames,
(PKIX_PL_Object *) name,
&checkPassed,
plContext),
PKIX_LISTCONTAINSFAILED);
PKIX_DECREF(name);
if (checkPassed == PKIX_TRUE) {
if (matchAll == PKIX_FALSE) {
/* one match is good enough */
matchCount = numItems;
break;
} else {
/* else continue checking next */
matchCount++;
}
}
}
if (matchCount != numItems) {
*pResult = PKIX_FALSE;
PKIX_ERROR(PKIX_CERTSELECTORMATCHSUBJALTNAMESFAILED);
}
}
cleanup:
PKIX_DECREF(name);
PKIX_DECREF(certSubjAltNames);
PKIX_DECREF(subjAltNamesList);
PKIX_RETURN(CERTSELECTOR);
}
/*
* FUNCTION: pkix_CertSelector_Match_ExtendedKeyUsage
* DESCRIPTION:
*
* Determines whether the names at ExtKeyUsage in "params" matches with the
* ExtKeyUsage pointed to by "cert". If the ExtKeyUsage criterion or
* ExtKeyUsage in "cert" is NULL, no checking is done and the Cert is
* considered a match. If the Cert does not match, an Error pointer is
* returned.
*
* PARAMETERS:
* "params"
* Address of ComCertSelParams whose ExtKeyUsage field is used.
* Must be non-NULL.
* "cert"
* Address of Cert that is to be matched. Must be non-NULL.
* "pResult"
* Address of PKIX_Boolean that returns the match result.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
static PKIX_Error *
pkix_CertSelector_Match_ExtendedKeyUsage(
PKIX_ComCertSelParams *params,
PKIX_PL_Cert *cert,
PKIX_Boolean *pResult,
void *plContext)
{
PKIX_List *extKeyUsageList = NULL;
PKIX_List *certExtKeyUsageList = NULL;
PKIX_PL_OID *ekuOid = NULL;
PKIX_Boolean isContained = PKIX_FALSE;
PKIX_UInt32 numItems = 0;
PKIX_UInt32 i;
PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_ExtendedKeyUsage");
PKIX_NULLCHECK_THREE(params, cert, pResult);
PKIX_CHECK(PKIX_ComCertSelParams_GetExtendedKeyUsage
(params, &extKeyUsageList, plContext),
PKIX_COMCERTSELPARAMSGETEXTENDEDKEYUSAGEFAILED);
if (extKeyUsageList == NULL) {
goto cleanup;
}
PKIX_CHECK(PKIX_PL_Cert_GetExtendedKeyUsage
(cert, &certExtKeyUsageList, plContext),
PKIX_CERTGETEXTENDEDKEYUSAGEFAILED);
if (certExtKeyUsageList != NULL) {
PKIX_CHECK(PKIX_List_GetLength
(extKeyUsageList, &numItems, plContext),
PKIX_LISTGETLENGTHFAILED);
for (i = 0; i < numItems; i++) {
PKIX_CHECK(PKIX_List_GetItem
(extKeyUsageList, i, (PKIX_PL_Object **)&ekuOid, plContext),
PKIX_LISTGETITEMFAILED);
PKIX_CHECK(pkix_List_Contains
(certExtKeyUsageList,
(PKIX_PL_Object *)ekuOid,
&isContained,
plContext),
PKIX_LISTCONTAINSFAILED);
PKIX_DECREF(ekuOid);
if (isContained != PKIX_TRUE) {
*pResult = PKIX_FALSE;
PKIX_ERROR(PKIX_CERTSELECTORMATCHEXTENDEDKEYUSAGEFAILED);
}
}
}
cleanup:
PKIX_DECREF(ekuOid);
PKIX_DECREF(extKeyUsageList);
PKIX_DECREF(certExtKeyUsageList);
PKIX_RETURN(CERTSELECTOR);
}
/*
* FUNCTION: pkix_CertSelector_Match_KeyUsage
* DESCRIPTION:
*
* Determines whether the bits at KeyUsage in "params" matches with the
* KeyUsage pointed to by "cert". If the KeyUsage in params is 0
* no checking is done and the Cert is considered a match. If the Cert does
* not match, an Error pointer is returned.
*
* PARAMETERS:
* "params"
* Address of ComCertSelParams whose ExtKeyUsage field is used.
* Must be non-NULL.
* "cert"
* Address of Cert that is to be matched. Must be non-NULL.
* "pResult"
* Address of PKIX_Boolean that returns the match result.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
static PKIX_Error *
pkix_CertSelector_Match_KeyUsage(
PKIX_ComCertSelParams *params,
PKIX_PL_Cert *cert,
PKIX_Boolean *pResult,
void *plContext)
{
PKIX_UInt32 keyUsage = 0;
PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_KeyUsage");
PKIX_NULLCHECK_THREE(params, cert, pResult);
PKIX_CHECK(PKIX_ComCertSelParams_GetKeyUsage
(params, &keyUsage, plContext),
PKIX_COMCERTSELPARAMSGETKEYUSAGEFAILED);
if (keyUsage != 0) {
PKIX_CHECK(PKIX_PL_Cert_VerifyKeyUsage
(cert, keyUsage, plContext),
PKIX_CERTVERIFYKEYUSAGEFAILED);
}
cleanup:
if (PKIX_ERROR_RECEIVED) {
*pResult = PKIX_FALSE;
}
PKIX_RETURN(CERTSELECTOR);
}
/*
* FUNCTION: pkix_CertSelector_Match_SubjKeyId
* DESCRIPTION:
*
* Determines whether the bytes at subjKeyId in "params" matches with the
* Subject Key Identifier pointed to by "cert". If the subjKeyId in params is
* set to NULL or the Cert doesn't have a Subject Key Identifier, no checking
* is done and the Cert is considered a match. If the Cert does not match, an
* Error pointer is returned.
*
* PARAMETERS:
* "params"
* Address of ComCertSelParams whose subjKeyId field is used.
* Must be non-NULL.
* "cert"
* Address of Cert that is to be matched. Must be non-NULL.
* "pResult"
* Address of PKIX_Boolean that returns the match result.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
static PKIX_Error *
pkix_CertSelector_Match_SubjKeyId(
PKIX_ComCertSelParams *params,
PKIX_PL_Cert *cert,
PKIX_Boolean *pResult,
void *plContext)
{
PKIX_PL_ByteArray *selSubjKeyId = NULL;
PKIX_PL_ByteArray *certSubjKeyId = NULL;
PKIX_Boolean equals = PKIX_FALSE;
PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_SubjKeyId");
PKIX_NULLCHECK_THREE(params, cert, pResult);
PKIX_CHECK(PKIX_ComCertSelParams_GetSubjKeyIdentifier
(params, &selSubjKeyId, plContext),
PKIX_COMCERTSELPARAMSGETSUBJKEYIDENTIFIERFAILED);
if (selSubjKeyId != NULL) {
PKIX_CHECK(PKIX_PL_Cert_GetSubjectKeyIdentifier
(cert, &certSubjKeyId, plContext),
PKIX_CERTGETSUBJECTKEYIDENTIFIERFAILED);
if (certSubjKeyId == NULL) {
goto cleanup;
}
PKIX_CHECK(PKIX_PL_Object_Equals
((PKIX_PL_Object *)selSubjKeyId,
(PKIX_PL_Object *)certSubjKeyId,
&equals,
plContext),
PKIX_OBJECTEQUALSFAILED);
if (equals == PKIX_FALSE) {
*pResult = PKIX_FALSE;
PKIX_ERROR(PKIX_CERTSELECTORMATCHSUBJKEYIDFAILED);
}
}
cleanup:
PKIX_DECREF(selSubjKeyId);
PKIX_DECREF(certSubjKeyId);
PKIX_RETURN(CERTSELECTOR);
}
/*
* FUNCTION: pkix_CertSelector_Match_AuthKeyId
* DESCRIPTION:
*
* Determines whether the bytes at authKeyId in "params" matches with the
* Authority Key Identifier pointed to by "cert". If the authKeyId in params
* is set to NULL, no checking is done and the Cert is considered a match. If
* the Cert does not match, an Error pointer is returned.
*
* PARAMETERS:
* "params"
* Address of ComCertSelParams whose authKeyId field is used.
* Must be non-NULL.
* "cert"
* Address of Cert that is to be matched. Must be non-NULL.
* "pResult"
* Address of PKIX_Boolean that returns the match result.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
static PKIX_Error *
pkix_CertSelector_Match_AuthKeyId(
PKIX_ComCertSelParams *params,
PKIX_PL_Cert *cert,
PKIX_Boolean *pResult,
void *plContext)
{
PKIX_PL_ByteArray *selAuthKeyId = NULL;
PKIX_PL_ByteArray *certAuthKeyId = NULL;
PKIX_Boolean equals = PKIX_FALSE;
PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_AuthKeyId");
PKIX_NULLCHECK_THREE(params, cert, pResult);
PKIX_CHECK(PKIX_ComCertSelParams_GetAuthorityKeyIdentifier
(params, &selAuthKeyId, plContext),
PKIX_COMCERTSELPARAMSGETAUTHORITYKEYIDENTIFIERFAILED);
if (selAuthKeyId != NULL) {
PKIX_CHECK(PKIX_PL_Cert_GetAuthorityKeyIdentifier
(cert, &certAuthKeyId, plContext),
PKIX_CERTGETAUTHORITYKEYIDENTIFIERFAILED);
if (certAuthKeyId == NULL) {
*pResult = PKIX_FALSE;
PKIX_ERROR(PKIX_CERTSELECTORMATCHAUTHKEYIDFAILED);
}
PKIX_CHECK(PKIX_PL_Object_Equals
((PKIX_PL_Object *)selAuthKeyId,
(PKIX_PL_Object *)certAuthKeyId,
&equals,
plContext),
PKIX_OBJECTEQUALSFAILED);
if (equals != PKIX_TRUE) {
*pResult = PKIX_FALSE;
PKIX_ERROR(PKIX_CERTSELECTORMATCHAUTHKEYIDFAILED);
}
}
cleanup:
PKIX_DECREF(selAuthKeyId);
PKIX_DECREF(certAuthKeyId);
PKIX_RETURN(CERTSELECTOR);
}
/*
* FUNCTION: pkix_CertSelector_Match_SubjPKAlgId
* DESCRIPTION:
*
* Determines whether the OID at subjPKAlgId in "params" matches with the
* Subject Public Key Alg Id pointed to by "cert". If the subjPKAlgId in params
* is set to NULL, no checking is done and the Cert is considered a match. If
* the Cert does not match, an Error pointer is returned.
*
* PARAMETERS:
* "params"
* Address of ComCertSelParams whose subjPKAlgId field is used.
* Must be non-NULL.
* "cert"
* Address of Cert that is to be matched. Must be non-NULL.
* "pResult"
* Address of PKIX_Boolean that returns the match result.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
static PKIX_Error *
pkix_CertSelector_Match_SubjPKAlgId(
PKIX_ComCertSelParams *params,
PKIX_PL_Cert *cert,
PKIX_Boolean *pResult,
void *plContext)
{
PKIX_PL_OID *selPKAlgId = NULL;
PKIX_PL_OID *certPKAlgId = NULL;
PKIX_Boolean equals = PKIX_FALSE;
PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_SubjPKAlgId");
PKIX_NULLCHECK_THREE(params, cert, pResult);
PKIX_CHECK(PKIX_ComCertSelParams_GetSubjPKAlgId
(params, &selPKAlgId, plContext),
PKIX_COMCERTSELPARAMSGETSUBJPKALGIDFAILED);
if (selPKAlgId != NULL) {
PKIX_CHECK(PKIX_PL_Cert_GetSubjectPublicKeyAlgId
(cert, &certPKAlgId, plContext),
PKIX_CERTGETSUBJECTPUBLICKEYALGIDFAILED);
if (certPKAlgId != NULL) {
*pResult = PKIX_FALSE;
PKIX_ERROR(PKIX_CERTSELECTORMATCHSUBJPKALGIDFAILED);
}
PKIX_CHECK(PKIX_PL_Object_Equals
((PKIX_PL_Object *)selPKAlgId,
(PKIX_PL_Object *)certPKAlgId,
&equals,
plContext),
PKIX_OBJECTEQUALSFAILED);
if (equals != PKIX_TRUE) {
*pResult = PKIX_FALSE;
PKIX_ERROR(PKIX_CERTSELECTORMATCHSUBJPKALGIDFAILED);
}
}
cleanup:
PKIX_DECREF(selPKAlgId);
PKIX_DECREF(certPKAlgId);
PKIX_RETURN(CERTSELECTOR);
}
/*
* FUNCTION: pkix_CertSelector_Match_SubjPubKey
* DESCRIPTION:
*
* Determines whether the key at subjPubKey in "params" matches with the
* Subject Public Key pointed to by "cert". If the subjPubKey in params
* is set to NULL, no checking is done and the Cert is considered a match. If
* the Cert does not match, an Error pointer is returned.
*
* PARAMETERS:
* "params"
* Address of ComCertSelParams whose subPubKey field is used.
* Must be non-NULL.
* "cert"
* Address of Cert that is to be matched. Must be non-NULL.
* "pResult"
* Address of PKIX_Boolean that returns the match result.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
static PKIX_Error *
pkix_CertSelector_Match_SubjPubKey(
PKIX_ComCertSelParams *params,
PKIX_PL_Cert *cert,
PKIX_Boolean *pResult,
void *plContext)
{
PKIX_PL_PublicKey *selPK = NULL;
PKIX_PL_PublicKey *certPK = NULL;
PKIX_Boolean equals = PKIX_FALSE;
PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_Match_SubjPubKey");
PKIX_NULLCHECK_THREE(params, cert, pResult);
PKIX_CHECK(PKIX_ComCertSelParams_GetSubjPubKey
(params, &selPK, plContext),
PKIX_COMCERTSELPARAMSGETSUBJPUBKEYFAILED);
if (selPK != NULL) {
PKIX_CHECK(PKIX_PL_Cert_GetSubjectPublicKey
(cert, &certPK, plContext),
PKIX_CERTGETSUBJECTPUBLICKEYFAILED);
if (certPK == NULL) {
*pResult = PKIX_FALSE;
PKIX_ERROR(PKIX_CERTSELECTORMATCHSUBJPUBKEYFAILED);
}
PKIX_CHECK(PKIX_PL_Object_Equals
((PKIX_PL_Object *)selPK,
(PKIX_PL_Object *)certPK,
&equals,
plContext),
PKIX_OBJECTEQUALSFAILED);
if (equals != PKIX_TRUE) {
*pResult = PKIX_FALSE;
PKIX_ERROR(PKIX_CERTSELECTORMATCHSUBJPUBKEYFAILED);
}
}
cleanup:
PKIX_DECREF(selPK);
PKIX_DECREF(certPK);
PKIX_RETURN(CERTSELECTOR);
}
/*
* FUNCTION: pkix_CertSelector_DefaultMatch
* DESCRIPTION:
*
* This default match function determines whether the specified Cert pointed
* to by "cert" matches the criteria of the CertSelector pointed to by
* "selector". If the Cert does not match the CertSelector's
* criteria, an error will be thrown.
*
* This default match function understands how to process the most common
* parameters. Any common parameter that is not set is assumed to be disabled,
* which means this function will select all certificates without regard to
* that particular disabled parameter. For example, if the SerialNumber
* parameter is not set, this function will not filter out any certificate
* based on its serial number. As such, if no parameters are set, all are
* disabled and any certificate will match. If a parameter is disabled, its
* associated PKIX_ComCertSelParams_Get* function returns a default value.
* That value is -1 for PKIX_ComCertSelParams_GetBasicConstraints and
* PKIX_ComCertSelParams_GetVersion, 0 for PKIX_ComCertSelParams_GetKeyUsage,
* and NULL for all other Get functions.
*
* PARAMETERS:
* "selector"
* Address of CertSelector whose MatchCallback logic and parameters are
* to be used. Must be non-NULL.
* "cert"
* Address of Cert that is to be matched using "selector".
* Must be non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Conditionally Thread Safe
* (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
static PKIX_Error *
pkix_CertSelector_DefaultMatch(
PKIX_CertSelector *selector,
PKIX_PL_Cert *cert,
void *plContext)
{
PKIX_ComCertSelParams *params = NULL;
PKIX_PL_X500Name *certSubject = NULL;
PKIX_PL_X500Name *selSubject = NULL;
PKIX_PL_X500Name *certIssuer = NULL;
PKIX_PL_X500Name *selIssuer = NULL;
PKIX_PL_BigInt *certSerialNumber = NULL;
PKIX_PL_BigInt *selSerialNumber = NULL;
PKIX_PL_Cert *selCert = NULL;
PKIX_PL_Date *selDate = NULL;
PKIX_UInt32 selVersion = 0xFFFFFFFF;
PKIX_UInt32 certVersion = 0;
PKIX_Boolean result = PKIX_TRUE;
PKIX_Boolean isLeafCert = PKIX_TRUE;
#ifdef PKIX_BUILDDEBUG
PKIX_PL_String *certString = NULL;
void *certAscii = NULL;
PKIX_UInt32 certAsciiLen;
#endif
PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_DefaultMatch");
PKIX_NULLCHECK_TWO(selector, cert);
PKIX_INCREF(selector->params);
params = selector->params;
/* Are we looking for CAs? */
PKIX_CHECK(PKIX_ComCertSelParams_GetLeafCertFlag
(params, &isLeafCert, plContext),
PKIX_COMCERTSELPARAMSGETLEAFCERTFLAGFAILED);
if (params == NULL){
goto cleanup;
}
PKIX_CHECK(PKIX_ComCertSelParams_GetVersion
(params, &selVersion, plContext),
PKIX_COMCERTSELPARAMSGETVERSIONFAILED);
if (selVersion != 0xFFFFFFFF){
PKIX_CHECK(PKIX_PL_Cert_GetVersion
(cert, &certVersion, plContext),
PKIX_CERTGETVERSIONFAILED);
if (selVersion != certVersion) {
PKIX_ERROR(PKIX_CERTSELECTORMATCHCERTVERSIONFAILED);
}
}
PKIX_CHECK(PKIX_ComCertSelParams_GetSubject
(params, &selSubject, plContext),
PKIX_COMCERTSELPARAMSGETSUBJECTFAILED);
if (selSubject){
PKIX_CHECK(PKIX_PL_Cert_GetSubject
(cert, &certSubject, plContext),
PKIX_CERTGETSUBJECTFAILED);
if (certSubject){
PKIX_CHECK(PKIX_PL_X500Name_Match
(selSubject, certSubject, &result, plContext),
PKIX_X500NAMEMATCHFAILED);
if (result == PKIX_FALSE){
PKIX_ERROR(PKIX_CERTSELECTORMATCHCERTSUBJECTFAILED);
}
} else { /* cert has no subject */
PKIX_ERROR(PKIX_CERTSELECTORMATCHCERTSUBJECTFAILED);
}
}
PKIX_CHECK(PKIX_ComCertSelParams_GetIssuer
(params, &selIssuer, plContext),
PKIX_COMCERTSELPARAMSGETISSUERFAILED);
if (selIssuer){
PKIX_CHECK(PKIX_PL_Cert_GetIssuer
(cert, &certIssuer, plContext),
PKIX_CERTGETISSUERFAILED);
PKIX_CHECK(PKIX_PL_X500Name_Match
(selIssuer, certIssuer, &result, plContext),
PKIX_X500NAMEMATCHFAILED);
if (result == PKIX_FALSE){
PKIX_ERROR(PKIX_CERTSELECTORMATCHCERTISSUERFAILED);
}
}
PKIX_CHECK(PKIX_ComCertSelParams_GetSerialNumber
(params, &selSerialNumber, plContext),
PKIX_COMCERTSELPARAMSGETSERIALNUMBERFAILED);
if (selSerialNumber){
PKIX_CHECK(PKIX_PL_Cert_GetSerialNumber
(cert, &certSerialNumber, plContext),
PKIX_CERTGETSERIALNUMBERFAILED);
PKIX_CHECK(PKIX_PL_Object_Equals
((PKIX_PL_Object *)selSerialNumber,
(PKIX_PL_Object *)certSerialNumber,
&result,
plContext),
PKIX_OBJECTEQUALSFAILED);
if (result == PKIX_FALSE){
PKIX_ERROR(PKIX_CERTSELECTORMATCHCERTSERIALNUMFAILED);
}
}
PKIX_CHECK(PKIX_ComCertSelParams_GetCertificate
(params, &selCert, plContext),
PKIX_COMCERTSELPARAMSGETCERTIFICATEFAILED);
if (selCert){
PKIX_CHECK(PKIX_PL_Object_Equals
((PKIX_PL_Object *) selCert,
(PKIX_PL_Object *) cert,
&result,
plContext),
PKIX_OBJECTEQUALSFAILED);
if (result == PKIX_FALSE){
PKIX_ERROR(PKIX_CERTSELECTORMATCHCERTOBJECTFAILED);
}
}
PKIX_CHECK(PKIX_ComCertSelParams_GetCertificateValid
(params, &selDate, plContext),
PKIX_COMCERTSELPARAMSGETCERTIFICATEVALIDFAILED);
if (selDate){
PKIX_CHECK(PKIX_PL_Cert_CheckValidity
(cert, selDate, plContext),
PKIX_CERTCHECKVALIDITYFAILED);
}
PKIX_CHECK(pkix_CertSelector_Match_BasicConstraint
(params, cert, &result, plContext),
PKIX_CERTSELECTORMATCHBASICCONSTRAINTFAILED);
PKIX_CHECK(pkix_CertSelector_Match_Policies
(params, cert, &result, plContext),
PKIX_CERTSELECTORMATCHPOLICIESFAILED);
PKIX_CHECK(pkix_CertSelector_Match_CertificateValid
(params, cert, &result, plContext),
PKIX_CERTSELECTORMATCHCERTIFICATEVALIDFAILED);
PKIX_CHECK(pkix_CertSelector_Match_NameConstraints
(params, cert, &result, plContext),
PKIX_CERTSELECTORMATCHNAMECONSTRAINTSFAILED);
PKIX_CHECK(pkix_CertSelector_Match_PathToNames
(params, cert, &result, plContext),
PKIX_CERTSELECTORMATCHPATHTONAMESFAILED);
PKIX_CHECK(pkix_CertSelector_Match_SubjAltNames
(params, cert, &result, plContext),
PKIX_CERTSELECTORMATCHSUBJALTNAMESFAILED);
/* Check key usage and cert type based on certificate usage. */
PKIX_CHECK(PKIX_PL_Cert_VerifyCertAndKeyType(cert, !isLeafCert,
plContext),
PKIX_CERTVERIFYCERTTYPEFAILED);
/* Next two check are for user supplied additional KU and EKU. */
PKIX_CHECK(pkix_CertSelector_Match_ExtendedKeyUsage
(params, cert, &result, plContext),
PKIX_CERTSELECTORMATCHEXTENDEDKEYUSAGEFAILED);
PKIX_CHECK(pkix_CertSelector_Match_KeyUsage
(params, cert, &result, plContext),
PKIX_CERTSELECTORMATCHKEYUSAGEFAILED);
PKIX_CHECK(pkix_CertSelector_Match_SubjKeyId
(params, cert, &result, plContext),
PKIX_CERTSELECTORMATCHSUBJKEYIDFAILED);
PKIX_CHECK(pkix_CertSelector_Match_AuthKeyId
(params, cert, &result, plContext),
PKIX_CERTSELECTORMATCHAUTHKEYIDFAILED);
PKIX_CHECK(pkix_CertSelector_Match_SubjPKAlgId
(params, cert, &result, plContext),
PKIX_CERTSELECTORMATCHSUBJPKALGIDFAILED);
PKIX_CHECK(pkix_CertSelector_Match_SubjPubKey
(params, cert, &result, plContext),
PKIX_CERTSELECTORMATCHSUBJPUBKEYFAILED);
/* if we reach here, the cert has successfully matched criteria */
#ifdef PKIX_BUILDDEBUG
PKIX_CHECK(pkix_pl_Cert_ToString_Helper
(cert, PKIX_TRUE, &certString, plContext),
PKIX_CERTTOSTRINGHELPERFAILED);
PKIX_CHECK(PKIX_PL_String_GetEncoded
(certString,
PKIX_ESCASCII,
&certAscii,
&certAsciiLen,
plContext),
PKIX_STRINGGETENCODEDFAILED);
PKIX_CERTSELECTOR_DEBUG_ARG("Cert Selected:\n%s\n", certAscii);
#endif
cleanup:
#ifdef PKIX_BUILDDEBUG
PKIX_DECREF(certString);
PKIX_FREE(certAscii);
#endif
PKIX_DECREF(certSubject);
PKIX_DECREF(selSubject);
PKIX_DECREF(certIssuer);
PKIX_DECREF(selIssuer);
PKIX_DECREF(certSerialNumber);
PKIX_DECREF(selSerialNumber);
PKIX_DECREF(selCert);
PKIX_DECREF(selDate);
PKIX_DECREF(params);
PKIX_RETURN(CERTSELECTOR);
}
/*
* FUNCTION: pkix_CertSelector_RegisterSelf
* DESCRIPTION:
* Registers PKIX_CERTSELECTOR_TYPE and its related functions with
* systemClasses[]
* THREAD SAFETY:
* Not Thread Safe - for performance and complexity reasons
*
* Since this function is only called by PKIX_PL_Initialize, which should
* only be called once, it is acceptable that this function is not
* thread-safe.
*/
PKIX_Error *
pkix_CertSelector_RegisterSelf(void *plContext)
{
extern pkix_ClassTable_Entry systemClasses[PKIX_NUMTYPES];
pkix_ClassTable_Entry entry;
PKIX_ENTER(CERTSELECTOR, "pkix_CertSelector_RegisterSelf");
entry.description = "CertSelector";
entry.objCounter = 0;
entry.typeObjectSize = sizeof(PKIX_CertSelector);
entry.destructor = pkix_CertSelector_Destroy;
entry.equalsFunction = NULL;
entry.hashcodeFunction = NULL;
entry.toStringFunction = NULL;
entry.comparator = NULL;
entry.duplicateFunction = pkix_CertSelector_Duplicate;
systemClasses[PKIX_CERTSELECTOR_TYPE] = entry;
PKIX_RETURN(CERTSELECTOR);
}
/* --Public-Functions--------------------------------------------- */
/*
* FUNCTION: PKIX_CertSelector_Create (see comments in pkix_certsel.h)
*/
PKIX_Error *
PKIX_CertSelector_Create(
PKIX_CertSelector_MatchCallback callback,
PKIX_PL_Object *certSelectorContext,
PKIX_CertSelector **pSelector,
void *plContext)
{
PKIX_CertSelector *selector = NULL;
PKIX_ENTER(CERTSELECTOR, "PKIX_CertSelector_Create");
PKIX_NULLCHECK_ONE(pSelector);
PKIX_CHECK(PKIX_PL_Object_Alloc
(PKIX_CERTSELECTOR_TYPE,
sizeof (PKIX_CertSelector),
(PKIX_PL_Object **)&selector,
plContext),
PKIX_COULDNOTCREATECERTSELECTOROBJECT);
/*
* if user specified a particular match callback, we use that one.
* otherwise, we use the default match implementation which
* understands how to process PKIX_ComCertSelParams
*/
if (callback){
selector->matchCallback = callback;
} else {
selector->matchCallback = pkix_CertSelector_DefaultMatch;
}
/* initialize other fields */
selector->params = NULL;
PKIX_INCREF(certSelectorContext);
selector->context = certSelectorContext;
*pSelector = selector;
cleanup:
PKIX_RETURN(CERTSELECTOR);
}
/*
* FUNCTION: PKIX_CertSelector_GetMatchCallback
* (see comments in pkix_certsel.h)
*/
PKIX_Error *
PKIX_CertSelector_GetMatchCallback(
PKIX_CertSelector *selector,
PKIX_CertSelector_MatchCallback *pCallback,
void *plContext)
{
PKIX_ENTER(CERTSELECTOR, "PKIX_CertSelector_GetMatchCallback");
PKIX_NULLCHECK_TWO(selector, pCallback);
*pCallback = selector->matchCallback;
PKIX_RETURN(CERTSELECTOR);
}
/*
* FUNCTION: PKIX_CertSelector_GetCertSelectorContext
* (see comments in pkix_certsel.h)
*/
PKIX_Error *
PKIX_CertSelector_GetCertSelectorContext(
PKIX_CertSelector *selector,
PKIX_PL_Object **pCertSelectorContext,
void *plContext)
{
PKIX_ENTER(CERTSELECTOR, "PKIX_CertSelector_GetCertSelectorContext");
PKIX_NULLCHECK_TWO(selector, pCertSelectorContext);
PKIX_INCREF(selector->context);
*pCertSelectorContext = selector->context;
cleanup:
PKIX_RETURN(CERTSELECTOR);
}
/*
* FUNCTION: PKIX_CertSelector_GetCommonCertSelectorParams
* (see comments in pkix_certsel.h)
*/
PKIX_Error *
PKIX_CertSelector_GetCommonCertSelectorParams(
PKIX_CertSelector *selector,
PKIX_ComCertSelParams **pParams,
void *plContext)
{
PKIX_ENTER(CERTSELECTOR,
"PKIX_CertSelector_GetCommonCertSelectorParams");
PKIX_NULLCHECK_TWO(selector, pParams);
PKIX_INCREF(selector->params);
*pParams = selector->params;
cleanup:
PKIX_RETURN(CERTSELECTOR);
}
/*
* FUNCTION: PKIX_CertSelector_SetCommonCertSelectorParams
* (see comments in pkix_certsel.h)
*/
PKIX_Error *
PKIX_CertSelector_SetCommonCertSelectorParams(
PKIX_CertSelector *selector,
PKIX_ComCertSelParams *params,
void *plContext)
{
PKIX_ENTER(CERTSELECTOR,
"PKIX_CertSelector_SetCommonCertSelectorParams");
PKIX_NULLCHECK_ONE(selector);
PKIX_DECREF(selector->params);
PKIX_INCREF(params);
selector->params = params;
PKIX_CHECK(PKIX_PL_Object_InvalidateCache
((PKIX_PL_Object *)selector, plContext),
PKIX_OBJECTINVALIDATECACHEFAILED);
cleanup:
PKIX_RETURN(CERTSELECTOR);
}
/*
* FUNCTION: pkix_CertSelector_Select
* DESCRIPTION:
*
* This function applies the selector pointed to by "selector" to each Cert,
* in turn, in the List pointed to by "before", and creates a List containing
* all the Certs that matched, or passed the selection process, storing that
* List at "pAfter". If no Certs match, an empty List is stored at "pAfter".
*
* The List returned in "pAfter" is immutable.
*
* PARAMETERS:
* "selector"
* Address of CertSelelector to be applied to the List. Must be non-NULL.
* "before"
* Address of List that is to be filtered. Must be non-NULL.
* "pAfter"
* Address at which resulting List, possibly empty, is stored. Must be
* non-NULL.
* "plContext"
* Platform-specific context pointer.
* THREAD SAFETY:
* Thread Safe (see Thread Safety Definitions in Programmer's Guide)
* RETURNS:
* Returns NULL if the function succeeds.
* Returns a CertSelector Error if the function fails in a non-fatal way.
* Returns a Fatal Error if the function fails in an unrecoverable way.
*/
PKIX_Error *
pkix_CertSelector_Select(
PKIX_CertSelector *selector,
PKIX_List *before,
PKIX_List **pAfter,
void *plContext)
{
PKIX_UInt32 numBefore = 0;
PKIX_UInt32 i = 0;
PKIX_List *filtered = NULL;
PKIX_PL_Cert *candidate = NULL;
PKIX_ENTER(CERTSELECTOR, "PKIX_CertSelector_Select");
PKIX_NULLCHECK_THREE(selector, before, pAfter);
PKIX_CHECK(PKIX_List_Create(&filtered, plContext),
PKIX_LISTCREATEFAILED);
PKIX_CHECK(PKIX_List_GetLength(before, &numBefore, plContext),
PKIX_LISTGETLENGTHFAILED);
for (i = 0; i < numBefore; i++) {
PKIX_CHECK(PKIX_List_GetItem
(before, i, (PKIX_PL_Object **)&candidate, plContext),
PKIX_LISTGETITEMFAILED);
PKIX_CHECK_ONLY_FATAL(selector->matchCallback
(selector, candidate, plContext),
PKIX_CERTSELECTORMATCHCALLBACKFAILED);
if (!(PKIX_ERROR_RECEIVED)) {
PKIX_CHECK_ONLY_FATAL(PKIX_List_AppendItem
(filtered,
(PKIX_PL_Object *)candidate,
plContext),
PKIX_LISTAPPENDITEMFAILED);
}
pkixTempErrorReceived = PKIX_FALSE;
PKIX_DECREF(candidate);
}
PKIX_CHECK(PKIX_List_SetImmutable(filtered, plContext),
PKIX_LISTSETIMMUTABLEFAILED);
/* Don't throw away the list if one Cert was bad! */
pkixTempErrorReceived = PKIX_FALSE;
*pAfter = filtered;
filtered = NULL;
cleanup:
PKIX_DECREF(filtered);
PKIX_DECREF(candidate);
PKIX_RETURN(CERTSELECTOR);
}