Source code
Revision control
Copy as Markdown
Other Tools
/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
/*
* pkix_trustanchor.c
*
* TrustAnchor Object Functions
*
*/
#include "pkix_trustanchor.h"
/* --Private-Functions-------------------------------------------- */
/*
* FUNCTION: pkix_TrustAnchor_Destroy
* (see comments for PKIX_PL_DestructorCallback in pkix_pl_system.h)
*/
static PKIX_Error *
pkix_TrustAnchor_Destroy(
PKIX_PL_Object *object,
void *plContext)
{
PKIX_TrustAnchor *anchor = NULL;
PKIX_ENTER(TRUSTANCHOR, "pkix_TrustAnchor_Destroy");
PKIX_NULLCHECK_ONE(object);
/* Check that this object is a trust anchor */
PKIX_CHECK(pkix_CheckType(object, PKIX_TRUSTANCHOR_TYPE, plContext),
PKIX_OBJECTNOTTRUSTANCHOR);
anchor = (PKIX_TrustAnchor *)object;
PKIX_DECREF(anchor->trustedCert);
PKIX_DECREF(anchor->caName);
PKIX_DECREF(anchor->caPubKey);
PKIX_DECREF(anchor->nameConstraints);
cleanup:
PKIX_RETURN(TRUSTANCHOR);
}
/*
* FUNCTION: pkix_TrustAnchor_Equals
* (see comments for PKIX_PL_EqualsCallback in pkix_pl_system.h)
*/
static PKIX_Error *
pkix_TrustAnchor_Equals(
PKIX_PL_Object *first,
PKIX_PL_Object *second,
PKIX_Boolean *pResult,
void *plContext)
{
PKIX_UInt32 secondType;
PKIX_Boolean cmpResult;
PKIX_TrustAnchor *firstAnchor = NULL;
PKIX_TrustAnchor *secondAnchor = NULL;
PKIX_PL_Cert *firstCert = NULL;
PKIX_PL_Cert *secondCert = NULL;
PKIX_ENTER(TRUSTANCHOR, "pkix_TrustAnchor_Equals");
PKIX_NULLCHECK_THREE(first, second, pResult);
PKIX_CHECK(pkix_CheckType(first, PKIX_TRUSTANCHOR_TYPE, plContext),
PKIX_FIRSTOBJECTNOTTRUSTANCHOR);
PKIX_CHECK(PKIX_PL_Object_GetType(second, &secondType, plContext),
PKIX_COULDNOTGETTYPEOFSECONDARGUMENT);
*pResult = PKIX_FALSE;
if (secondType != PKIX_TRUSTANCHOR_TYPE) goto cleanup;
firstAnchor = (PKIX_TrustAnchor *)first;
secondAnchor = (PKIX_TrustAnchor *)second;
firstCert = firstAnchor->trustedCert;
secondCert = secondAnchor->trustedCert;
if ((firstCert && !secondCert) || (!firstCert && secondCert)){
goto cleanup;
}
if (firstCert && secondCert){
PKIX_CHECK(PKIX_PL_Object_Equals
((PKIX_PL_Object *)firstCert,
(PKIX_PL_Object *)secondCert,
&cmpResult,
plContext),
PKIX_OBJECTEQUALSFAILED);
} else {
PKIX_CHECK(PKIX_PL_Object_Equals
((PKIX_PL_Object *)firstAnchor->caName,
(PKIX_PL_Object *)secondAnchor->caName,
&cmpResult,
plContext),
PKIX_OBJECTEQUALSFAILED);
if (!cmpResult) goto cleanup;
PKIX_CHECK(PKIX_PL_Object_Equals
((PKIX_PL_Object *)firstAnchor->caPubKey,
(PKIX_PL_Object *)secondAnchor->caPubKey,
&cmpResult,
plContext),
PKIX_OBJECTEQUALSFAILED);
if (!cmpResult) goto cleanup;
PKIX_EQUALS
(firstAnchor->nameConstraints,
secondAnchor->nameConstraints,
&cmpResult,
plContext,
PKIX_OBJECTEQUALSFAILED);
if (!cmpResult) goto cleanup;
}
*pResult = cmpResult;
cleanup:
PKIX_RETURN(TRUSTANCHOR);
}
/*
* FUNCTION: pkix_TrustAnchor_Hashcode
* (see comments for PKIX_PL_HashcodeCallback in pkix_pl_system.h)
*/
static PKIX_Error *
pkix_TrustAnchor_Hashcode(
PKIX_PL_Object *object,
PKIX_UInt32 *pHashcode,
void *plContext)
{
PKIX_TrustAnchor *anchor = NULL;
PKIX_PL_Cert *cert = NULL;
PKIX_UInt32 hash = 0;
PKIX_UInt32 certHash = 0;
PKIX_UInt32 nameHash = 0;
PKIX_UInt32 pubKeyHash = 0;
PKIX_UInt32 ncHash = 0;
PKIX_ENTER(TRUSTANCHOR, "pkix_TrustAnchor_Hashcode");
PKIX_NULLCHECK_TWO(object, pHashcode);
PKIX_CHECK(pkix_CheckType(object, PKIX_TRUSTANCHOR_TYPE, plContext),
PKIX_OBJECTNOTTRUSTANCHOR);
anchor = (PKIX_TrustAnchor*)object;
cert = anchor->trustedCert;
if (cert){
PKIX_CHECK(PKIX_PL_Object_Hashcode
((PKIX_PL_Object *)cert,
&certHash,
plContext),
PKIX_OBJECTHASHCODEFAILED);
hash = certHash;
} else {
PKIX_CHECK(PKIX_PL_Object_Hashcode
((PKIX_PL_Object *)anchor->caName,
&nameHash,
plContext),
PKIX_OBJECTHASHCODEFAILED);
PKIX_CHECK(PKIX_PL_Object_Hashcode
((PKIX_PL_Object *)anchor->caPubKey,
&pubKeyHash,
plContext),
PKIX_OBJECTHASHCODEFAILED);
PKIX_HASHCODE(anchor->nameConstraints, &ncHash, plContext,
PKIX_OBJECTHASHCODEFAILED);
hash = 31 * nameHash + pubKeyHash + ncHash;
}
*pHashcode = hash;
cleanup:
PKIX_RETURN(TRUSTANCHOR);
}
/*
* FUNCTION: pkix_TrustAnchor_ToString
* (see comments for PKIX_PL_ToStringCallback in pkix_pl_system.h)
*/
static PKIX_Error *
pkix_TrustAnchor_ToString(
PKIX_PL_Object *object,
PKIX_PL_String **pString,
void *plContext)
{
PKIX_TrustAnchor *anchor = NULL;
char *asciiFormat = NULL;
PKIX_PL_String *formatString = NULL;
PKIX_PL_String *anchorString = NULL;
PKIX_PL_String *certString = NULL;
PKIX_PL_String *nameString = NULL;
PKIX_PL_String *pubKeyString = NULL;
PKIX_PL_String *nameConstraintsString = NULL;
PKIX_ENTER(TRUSTANCHOR, "pkix_TrustAnchor_ToString");
PKIX_NULLCHECK_TWO(object, pString);
PKIX_CHECK(pkix_CheckType(object, PKIX_TRUSTANCHOR_TYPE, plContext),
PKIX_OBJECTNOTTRUSTANCHOR);
anchor = (PKIX_TrustAnchor*)object;
if (anchor->trustedCert){
asciiFormat =
"[\n"
"\tTrusted Cert: %s\n"
"]\n";
PKIX_CHECK(PKIX_PL_String_Create
(PKIX_ESCASCII,
asciiFormat,
0,
&formatString,
plContext),
PKIX_STRINGCREATEFAILED);
PKIX_CHECK(PKIX_PL_Object_ToString
((PKIX_PL_Object *)anchor->trustedCert,
&certString,
plContext),
PKIX_OBJECTTOSTRINGFAILED);
PKIX_CHECK(PKIX_PL_Sprintf
(&anchorString,
plContext,
formatString,
certString),
PKIX_SPRINTFFAILED);
} else {
asciiFormat =
"[\n"
"\tTrusted CA Name: %s\n"
"\tTrusted CA PublicKey: %s\n"
"\tInitial Name Constraints:%s\n"
"]\n";
PKIX_CHECK(PKIX_PL_String_Create
(PKIX_ESCASCII,
asciiFormat,
0,
&formatString,
plContext),
PKIX_STRINGCREATEFAILED);
PKIX_CHECK(PKIX_PL_Object_ToString
((PKIX_PL_Object *)anchor->caName,
&nameString,
plContext),
PKIX_OBJECTTOSTRINGFAILED);
PKIX_CHECK(PKIX_PL_Object_ToString
((PKIX_PL_Object *)anchor->caPubKey,
&pubKeyString,
plContext),
PKIX_OBJECTTOSTRINGFAILED);
PKIX_TOSTRING
(anchor->nameConstraints,
&nameConstraintsString,
plContext,
PKIX_OBJECTTOSTRINGFAILED);
PKIX_CHECK(PKIX_PL_Sprintf
(&anchorString,
plContext,
formatString,
nameString,
pubKeyString,
nameConstraintsString),
PKIX_SPRINTFFAILED);
}
*pString = anchorString;
cleanup:
PKIX_DECREF(formatString);
PKIX_DECREF(certString);
PKIX_DECREF(nameString);
PKIX_DECREF(pubKeyString);
PKIX_DECREF(nameConstraintsString);
PKIX_RETURN(TRUSTANCHOR);
}
/*
* FUNCTION: pkix_TrustAnchor_RegisterSelf
* DESCRIPTION:
* Registers PKIX_TRUSTANCHOR_TYPE and its related functions with
* systemClasses[]
* THREAD SAFETY:
* Not Thread Safe - for performance and complexity reasons
*
* Since this function is only called by PKIX_PL_Initialize, which should
* only be called once, it is acceptable that this function is not
* thread-safe.
*/
PKIX_Error *
pkix_TrustAnchor_RegisterSelf(void *plContext)
{
extern pkix_ClassTable_Entry systemClasses[PKIX_NUMTYPES];
pkix_ClassTable_Entry entry;
PKIX_ENTER(TRUSTANCHOR, "pkix_TrustAnchor_RegisterSelf");
entry.description = "TrustAnchor";
entry.objCounter = 0;
entry.typeObjectSize = sizeof(PKIX_TrustAnchor);
entry.destructor = pkix_TrustAnchor_Destroy;
entry.equalsFunction = pkix_TrustAnchor_Equals;
entry.hashcodeFunction = pkix_TrustAnchor_Hashcode;
entry.toStringFunction = pkix_TrustAnchor_ToString;
entry.comparator = NULL;
entry.duplicateFunction = pkix_duplicateImmutable;
systemClasses[PKIX_TRUSTANCHOR_TYPE] = entry;
PKIX_RETURN(TRUSTANCHOR);
}
/* --Public-Functions--------------------------------------------- */
/*
* FUNCTION: PKIX_TrustAnchor_CreateWithCert (see comments in pkix_params.h)
*/
PKIX_Error *
PKIX_TrustAnchor_CreateWithCert(
PKIX_PL_Cert *cert,
PKIX_TrustAnchor **pAnchor,
void *plContext)
{
PKIX_TrustAnchor *anchor = NULL;
PKIX_ENTER(TRUSTANCHOR, "PKIX_TrustAnchor_CreateWithCert");
PKIX_NULLCHECK_TWO(cert, pAnchor);
PKIX_CHECK(PKIX_PL_Object_Alloc
(PKIX_TRUSTANCHOR_TYPE,
sizeof (PKIX_TrustAnchor),
(PKIX_PL_Object **)&anchor,
plContext),
PKIX_COULDNOTCREATETRUSTANCHOROBJECT);
/* initialize fields */
PKIX_CHECK(
PKIX_PL_Cert_SetAsTrustAnchor(cert, plContext),
PKIX_CERTSETASTRUSTANCHORFAILED);
PKIX_INCREF(cert);
anchor->trustedCert = cert;
anchor->caName = NULL;
anchor->caPubKey = NULL;
PKIX_CHECK(PKIX_PL_Cert_GetNameConstraints
(anchor->trustedCert, &anchor->nameConstraints, plContext),
PKIX_CERTGETNAMECONSTRAINTSFAILED);
*pAnchor = anchor;
anchor = NULL;
cleanup:
PKIX_DECREF(anchor);
PKIX_RETURN(TRUSTANCHOR);
}
/*
* FUNCTION: PKIX_TrustAnchor_CreateWithNameKeyPair
* (see comments in pkix_params.h)
*/
PKIX_Error *
PKIX_TrustAnchor_CreateWithNameKeyPair(
PKIX_PL_X500Name *name,
PKIX_PL_PublicKey *pubKey,
PKIX_PL_CertNameConstraints *nameConstraints,
PKIX_TrustAnchor **pAnchor,
void *plContext)
{
PKIX_TrustAnchor *anchor = NULL;
PKIX_ENTER(TRUSTANCHOR, "PKIX_TrustAnchor_CreateWithNameKeyPair");
#ifndef BUILD_LIBPKIX_TESTS
/* Nss creates trust anchors by using PKIX_TrustAnchor_CreateWithCert
* function as the complete trusted cert structure, and not only cert
* public key, is required for chain building and validation processes.
* Restricting this function for been used only in libpkix unit
* tests. */
PKIX_ERROR(PKIX_FUNCTIONMUSTNOTBEUSED);
#endif
PKIX_NULLCHECK_THREE(name, pubKey, pAnchor);
PKIX_CHECK(PKIX_PL_Object_Alloc
(PKIX_TRUSTANCHOR_TYPE,
sizeof (PKIX_TrustAnchor),
(PKIX_PL_Object **)&anchor,
plContext),
PKIX_COULDNOTCREATETRUSTANCHOROBJECT);
/* initialize fields */
anchor->trustedCert = NULL;
PKIX_INCREF(name);
anchor->caName = name;
PKIX_INCREF(pubKey);
anchor->caPubKey = pubKey;
PKIX_INCREF(nameConstraints);
anchor->nameConstraints = nameConstraints;
*pAnchor = anchor;
anchor = NULL;
cleanup:
PKIX_DECREF(anchor);
PKIX_RETURN(TRUSTANCHOR);
}
/*
* FUNCTION: PKIX_TrustAnchor_GetTrustedCert (see comments in pkix_params.h)
*/
PKIX_Error *
PKIX_TrustAnchor_GetTrustedCert(
PKIX_TrustAnchor *anchor,
PKIX_PL_Cert **pCert,
void *plContext)
{
PKIX_ENTER(TRUSTANCHOR, "PKIX_TrustAnchor_GetTrustedCert");
PKIX_NULLCHECK_TWO(anchor, pCert);
PKIX_INCREF(anchor->trustedCert);
*pCert = anchor->trustedCert;
cleanup:
PKIX_RETURN(TRUSTANCHOR);
}
/*
* FUNCTION: PKIX_TrustAnchor_GetCAName (see comments in pkix_params.h)
*/
PKIX_Error *
PKIX_TrustAnchor_GetCAName(
PKIX_TrustAnchor *anchor,
PKIX_PL_X500Name **pCAName,
void *plContext)
{
PKIX_ENTER(TRUSTANCHOR, "PKIX_TrustAnchor_GetCAName");
PKIX_NULLCHECK_TWO(anchor, pCAName);
PKIX_INCREF(anchor->caName);
*pCAName = anchor->caName;
cleanup:
PKIX_RETURN(TRUSTANCHOR);
}
/*
* FUNCTION: PKIX_TrustAnchor_GetCAPublicKey (see comments in pkix_params.h)
*/
PKIX_Error *
PKIX_TrustAnchor_GetCAPublicKey(
PKIX_TrustAnchor *anchor,
PKIX_PL_PublicKey **pPubKey,
void *plContext)
{
PKIX_ENTER(TRUSTANCHOR, "PKIX_TrustAnchor_GetCAPublicKey");
PKIX_NULLCHECK_TWO(anchor, pPubKey);
PKIX_INCREF(anchor->caPubKey);
*pPubKey = anchor->caPubKey;
cleanup:
PKIX_RETURN(TRUSTANCHOR);
}
/*
* FUNCTION: PKIX_TrustAnchor_GetNameConstraints
* (see comments in pkix_params.h)
*/
PKIX_Error *
PKIX_TrustAnchor_GetNameConstraints(
PKIX_TrustAnchor *anchor,
PKIX_PL_CertNameConstraints **pNameConstraints,
void *plContext)
{
PKIX_ENTER(TRUSTANCHOR, "PKIX_TrustAnchor_GetNameConstraints");
PKIX_NULLCHECK_TWO(anchor, pNameConstraints);
PKIX_INCREF(anchor->nameConstraints);
*pNameConstraints = anchor->nameConstraints;
cleanup:
PKIX_RETURN(TRUSTANCHOR);
}