mirror of
https://gitlab.winehq.org/wine/wine-gecko.git
synced 2024-09-13 09:24:08 -07:00
325 lines
9.3 KiB
C
325 lines
9.3 KiB
C
/* This Source Code Form is subject to the terms of the Mozilla Public
|
|
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
|
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
|
|
|
#include "cert.h"
|
|
#include "certt.h"
|
|
#include "secder.h"
|
|
#include "key.h"
|
|
#include "secitem.h"
|
|
#include "secasn1.h"
|
|
#include "secerr.h"
|
|
|
|
SEC_ASN1_MKSUB(SEC_AnyTemplate)
|
|
|
|
const SEC_ASN1Template CERT_AttributeTemplate[] = {
|
|
{ SEC_ASN1_SEQUENCE,
|
|
0, NULL, sizeof(CERTAttribute) },
|
|
{ SEC_ASN1_OBJECT_ID, offsetof(CERTAttribute, attrType) },
|
|
{ SEC_ASN1_SET_OF | SEC_ASN1_XTRN, offsetof(CERTAttribute, attrValue),
|
|
SEC_ASN1_SUB(SEC_AnyTemplate) },
|
|
{ 0 }
|
|
};
|
|
|
|
const SEC_ASN1Template CERT_SetOfAttributeTemplate[] = {
|
|
{ SEC_ASN1_SET_OF, 0, CERT_AttributeTemplate },
|
|
};
|
|
|
|
const SEC_ASN1Template CERT_CertificateRequestTemplate[] = {
|
|
{ SEC_ASN1_SEQUENCE,
|
|
0, NULL, sizeof(CERTCertificateRequest) },
|
|
{ SEC_ASN1_INTEGER,
|
|
offsetof(CERTCertificateRequest,version) },
|
|
{ SEC_ASN1_INLINE,
|
|
offsetof(CERTCertificateRequest,subject),
|
|
CERT_NameTemplate },
|
|
{ SEC_ASN1_INLINE,
|
|
offsetof(CERTCertificateRequest,subjectPublicKeyInfo),
|
|
CERT_SubjectPublicKeyInfoTemplate },
|
|
{ SEC_ASN1_CONSTRUCTED | SEC_ASN1_CONTEXT_SPECIFIC | 0,
|
|
offsetof(CERTCertificateRequest,attributes),
|
|
CERT_SetOfAttributeTemplate },
|
|
{ 0 }
|
|
};
|
|
|
|
SEC_ASN1_CHOOSER_IMPLEMENT(CERT_CertificateRequestTemplate)
|
|
|
|
CERTCertificate *
|
|
CERT_CreateCertificate(unsigned long serialNumber,
|
|
CERTName *issuer,
|
|
CERTValidity *validity,
|
|
CERTCertificateRequest *req)
|
|
{
|
|
CERTCertificate *c;
|
|
int rv;
|
|
PLArenaPool *arena;
|
|
|
|
arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
|
|
|
|
if ( !arena ) {
|
|
return(0);
|
|
}
|
|
|
|
c = (CERTCertificate *)PORT_ArenaZAlloc(arena, sizeof(CERTCertificate));
|
|
|
|
if (!c) {
|
|
PORT_FreeArena(arena, PR_FALSE);
|
|
return 0;
|
|
}
|
|
|
|
c->referenceCount = 1;
|
|
c->arena = arena;
|
|
|
|
/*
|
|
* Default is a plain version 1.
|
|
* If extensions are added, it will get changed as appropriate.
|
|
*/
|
|
rv = DER_SetUInteger(arena, &c->version, SEC_CERTIFICATE_VERSION_1);
|
|
if (rv) goto loser;
|
|
|
|
rv = DER_SetUInteger(arena, &c->serialNumber, serialNumber);
|
|
if (rv) goto loser;
|
|
|
|
rv = CERT_CopyName(arena, &c->issuer, issuer);
|
|
if (rv) goto loser;
|
|
|
|
rv = CERT_CopyValidity(arena, &c->validity, validity);
|
|
if (rv) goto loser;
|
|
|
|
rv = CERT_CopyName(arena, &c->subject, &req->subject);
|
|
if (rv) goto loser;
|
|
rv = SECKEY_CopySubjectPublicKeyInfo(arena, &c->subjectPublicKeyInfo,
|
|
&req->subjectPublicKeyInfo);
|
|
if (rv) goto loser;
|
|
|
|
return c;
|
|
|
|
loser:
|
|
CERT_DestroyCertificate(c);
|
|
return 0;
|
|
}
|
|
|
|
/************************************************************************/
|
|
/* It's clear from the comments that the original author of this
|
|
* function expected the template for certificate requests to treat
|
|
* the attributes as a SET OF ANY. This function expected to be
|
|
* passed an array of SECItems each of which contained an already encoded
|
|
* Attribute. But the cert request template does not treat the
|
|
* Attributes as a SET OF ANY, and AFAIK never has. Instead the template
|
|
* encodes attributes as a SET OF xxxxxxx. That is, it expects to encode
|
|
* each of the Attributes, not have them pre-encoded. Consequently an
|
|
* array of SECItems containing encoded Attributes is of no value to this
|
|
* function. But we cannot change the signature of this public function.
|
|
* It must continue to take SECItems.
|
|
*
|
|
* I have recoded this function so that each SECItem contains an
|
|
* encoded cert extension. The encoded cert extensions form the list for the
|
|
* single attribute of the cert request. In this implementation there is at most
|
|
* one attribute and it is always of type SEC_OID_PKCS9_EXTENSION_REQUEST.
|
|
*/
|
|
|
|
CERTCertificateRequest *
|
|
CERT_CreateCertificateRequest(CERTName *subject,
|
|
CERTSubjectPublicKeyInfo *spki,
|
|
SECItem **attributes)
|
|
{
|
|
CERTCertificateRequest *certreq;
|
|
PLArenaPool *arena;
|
|
CERTAttribute * attribute;
|
|
SECOidData * oidData;
|
|
SECStatus rv;
|
|
int i = 0;
|
|
|
|
arena = PORT_NewArena(DER_DEFAULT_CHUNKSIZE);
|
|
if ( arena == NULL ) {
|
|
return NULL;
|
|
}
|
|
|
|
certreq = PORT_ArenaZNew(arena, CERTCertificateRequest);
|
|
if (!certreq) {
|
|
PORT_FreeArena(arena, PR_FALSE);
|
|
return NULL;
|
|
}
|
|
/* below here it is safe to goto loser */
|
|
|
|
certreq->arena = arena;
|
|
|
|
rv = DER_SetUInteger(arena, &certreq->version,
|
|
SEC_CERTIFICATE_REQUEST_VERSION);
|
|
if (rv != SECSuccess)
|
|
goto loser;
|
|
|
|
rv = CERT_CopyName(arena, &certreq->subject, subject);
|
|
if (rv != SECSuccess)
|
|
goto loser;
|
|
|
|
rv = SECKEY_CopySubjectPublicKeyInfo(arena,
|
|
&certreq->subjectPublicKeyInfo,
|
|
spki);
|
|
if (rv != SECSuccess)
|
|
goto loser;
|
|
|
|
certreq->attributes = PORT_ArenaZNewArray(arena, CERTAttribute*, 2);
|
|
if(!certreq->attributes)
|
|
goto loser;
|
|
|
|
/* Copy over attribute information */
|
|
if (!attributes || !attributes[0]) {
|
|
/*
|
|
** Invent empty attribute information. According to the
|
|
** pkcs#10 spec, attributes has this ASN.1 type:
|
|
**
|
|
** attributes [0] IMPLICIT Attributes
|
|
**
|
|
** Which means, we should create a NULL terminated list
|
|
** with the first entry being NULL;
|
|
*/
|
|
certreq->attributes[0] = NULL;
|
|
return certreq;
|
|
}
|
|
|
|
/* allocate space for attributes */
|
|
attribute = PORT_ArenaZNew(arena, CERTAttribute);
|
|
if (!attribute)
|
|
goto loser;
|
|
|
|
oidData = SECOID_FindOIDByTag( SEC_OID_PKCS9_EXTENSION_REQUEST );
|
|
PORT_Assert(oidData);
|
|
if (!oidData)
|
|
goto loser;
|
|
rv = SECITEM_CopyItem(arena, &attribute->attrType, &oidData->oid);
|
|
if (rv != SECSuccess)
|
|
goto loser;
|
|
|
|
for (i = 0; attributes[i] != NULL ; i++)
|
|
;
|
|
attribute->attrValue = PORT_ArenaZNewArray(arena, SECItem *, i+1);
|
|
if (!attribute->attrValue)
|
|
goto loser;
|
|
|
|
/* copy attributes */
|
|
for (i = 0; attributes[i]; i++) {
|
|
/*
|
|
** Attributes are a SetOf Attribute which implies
|
|
** lexigraphical ordering. It is assumes that the
|
|
** attributes are passed in sorted. If we need to
|
|
** add functionality to sort them, there is an
|
|
** example in the PKCS 7 code.
|
|
*/
|
|
attribute->attrValue[i] = SECITEM_ArenaDupItem(arena, attributes[i]);
|
|
if(!attribute->attrValue[i])
|
|
goto loser;
|
|
}
|
|
|
|
certreq->attributes[0] = attribute;
|
|
|
|
return certreq;
|
|
|
|
loser:
|
|
CERT_DestroyCertificateRequest(certreq);
|
|
return NULL;
|
|
}
|
|
|
|
void
|
|
CERT_DestroyCertificateRequest(CERTCertificateRequest *req)
|
|
{
|
|
if (req && req->arena) {
|
|
PORT_FreeArena(req->arena, PR_FALSE);
|
|
}
|
|
return;
|
|
}
|
|
|
|
static void
|
|
setCRExt(void *o, CERTCertExtension **exts)
|
|
{
|
|
((CERTCertificateRequest *)o)->attributes = (struct CERTAttributeStr **)exts;
|
|
}
|
|
|
|
/*
|
|
** Set up to start gathering cert extensions for a cert request.
|
|
** The list is created as CertExtensions and converted to an
|
|
** attribute list by CERT_FinishCRAttributes().
|
|
*/
|
|
extern void *cert_StartExtensions(void *owner, PLArenaPool *ownerArena,
|
|
void (*setExts)(void *object, CERTCertExtension **exts));
|
|
void *
|
|
CERT_StartCertificateRequestAttributes(CERTCertificateRequest *req)
|
|
{
|
|
return (cert_StartExtensions ((void *)req, req->arena, setCRExt));
|
|
}
|
|
|
|
/*
|
|
** At entry req->attributes actually contains an list of cert extensions--
|
|
** req-attributes is overloaded until the list is DER encoded (the first
|
|
** ...EncodeItem() below).
|
|
** We turn this into an attribute list by encapsulating it
|
|
** in a PKCS 10 Attribute structure
|
|
*/
|
|
SECStatus
|
|
CERT_FinishCertificateRequestAttributes(CERTCertificateRequest *req)
|
|
{ SECItem *extlist;
|
|
SECOidData *oidrec;
|
|
CERTAttribute *attribute;
|
|
|
|
if (!req || !req->arena) {
|
|
PORT_SetError(SEC_ERROR_INVALID_ARGS);
|
|
return SECFailure;
|
|
}
|
|
if (req->attributes == NULL || req->attributes[0] == NULL)
|
|
return SECSuccess;
|
|
|
|
extlist = SEC_ASN1EncodeItem(req->arena, NULL, &req->attributes,
|
|
SEC_ASN1_GET(CERT_SequenceOfCertExtensionTemplate));
|
|
if (extlist == NULL)
|
|
return(SECFailure);
|
|
|
|
oidrec = SECOID_FindOIDByTag(SEC_OID_PKCS9_EXTENSION_REQUEST);
|
|
if (oidrec == NULL)
|
|
return SECFailure;
|
|
|
|
/* now change the list of cert extensions into a list of attributes
|
|
*/
|
|
req->attributes = PORT_ArenaZNewArray(req->arena, CERTAttribute*, 2);
|
|
|
|
attribute = PORT_ArenaZNew(req->arena, CERTAttribute);
|
|
|
|
if (req->attributes == NULL || attribute == NULL ||
|
|
SECITEM_CopyItem(req->arena, &attribute->attrType, &oidrec->oid) != 0) {
|
|
PORT_SetError(SEC_ERROR_NO_MEMORY);
|
|
return SECFailure;
|
|
}
|
|
attribute->attrValue = PORT_ArenaZNewArray(req->arena, SECItem*, 2);
|
|
|
|
if (attribute->attrValue == NULL)
|
|
return SECFailure;
|
|
|
|
attribute->attrValue[0] = extlist;
|
|
attribute->attrValue[1] = NULL;
|
|
req->attributes[0] = attribute;
|
|
req->attributes[1] = NULL;
|
|
|
|
return SECSuccess;
|
|
}
|
|
|
|
SECStatus
|
|
CERT_GetCertificateRequestExtensions(CERTCertificateRequest *req,
|
|
CERTCertExtension ***exts)
|
|
{
|
|
if (req == NULL || exts == NULL) {
|
|
PORT_SetError(SEC_ERROR_INVALID_ARGS);
|
|
return SECFailure;
|
|
}
|
|
|
|
if (req->attributes == NULL || *req->attributes == NULL)
|
|
return SECSuccess;
|
|
|
|
if ((*req->attributes)->attrValue == NULL) {
|
|
PORT_SetError(SEC_ERROR_INVALID_ARGS);
|
|
return SECFailure;
|
|
}
|
|
|
|
return(SEC_ASN1DecodeItem(req->arena, exts,
|
|
SEC_ASN1_GET(CERT_SequenceOfCertExtensionTemplate),
|
|
(*req->attributes)->attrValue[0]));
|
|
}
|