tor-browser

xcrldist.c (7572B)

---

/* This Source Code Form is subject to the terms of the Mozilla Public
* License, v. 2.0. If a copy of the MPL was not distributed with this
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */

/*
* Code for dealing with x.509 v3 CRL Distribution Point extension.
*/
#include "genname.h"
#include "certt.h"
#include "secerr.h"

SEC_ASN1_MKSUB(SEC_AnyTemplate)
SEC_ASN1_MKSUB(SEC_BitStringTemplate)

extern void PrepareBitStringForEncoding(SECItem *bitMap, SECItem *value);

static const SEC_ASN1Template FullNameTemplate[] = {
   { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | 0,
     offsetof(CRLDistributionPoint, derFullName),
     CERT_GeneralNamesTemplate }
};

static const SEC_ASN1Template RelativeNameTemplate[] = {
   { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | 1,
     offsetof(CRLDistributionPoint, distPoint.relativeName),
     CERT_RDNTemplate }
};

static const SEC_ASN1Template DistributionPointNameTemplate[] = {
   { SEC_ASN1_CHOICE,
     offsetof(CRLDistributionPoint, distPointType), NULL,
     sizeof(CRLDistributionPoint) },
   { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | 0,
     offsetof(CRLDistributionPoint, derFullName),
     CERT_GeneralNamesTemplate, generalName },
   { SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_CONSTRUCTED | 1,
     offsetof(CRLDistributionPoint, distPoint.relativeName),
     CERT_RDNTemplate, relativeDistinguishedName },
   { 0 }
};

static const SEC_ASN1Template CRLDistributionPointTemplate[] = {
   { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(CRLDistributionPoint) },
   { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC |
         SEC_ASN1_CONSTRUCTED | SEC_ASN1_EXPLICIT | SEC_ASN1_XTRN | 0,
     offsetof(CRLDistributionPoint, derDistPoint),
     SEC_ASN1_SUB(SEC_AnyTemplate) },
   { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC | SEC_ASN1_XTRN | 1,
     offsetof(CRLDistributionPoint, bitsmap),
     SEC_ASN1_SUB(SEC_BitStringTemplate) },
   { SEC_ASN1_OPTIONAL | SEC_ASN1_CONTEXT_SPECIFIC |
         SEC_ASN1_CONSTRUCTED | 2,
     offsetof(CRLDistributionPoint, derCrlIssuer),
     CERT_GeneralNamesTemplate },
   { 0 }
};

const SEC_ASN1Template CERTCRLDistributionPointsTemplate[] = {
   { SEC_ASN1_SEQUENCE_OF, 0, CRLDistributionPointTemplate }
};

SECStatus
CERT_EncodeCRLDistributionPoints(PLArenaPool *arena,
                                CERTCrlDistributionPoints *value,
                                SECItem *derValue)
{
   CRLDistributionPoint **pointList, *point;
   PLArenaPool *ourPool = NULL;
   SECStatus rv = SECSuccess;

   PORT_Assert(derValue);
   PORT_Assert(value && value->distPoints);

   do {
       ourPool = PORT_NewArena(SEC_ASN1_DEFAULT_ARENA_SIZE);
       if (ourPool == NULL) {
           rv = SECFailure;
           break;
       }

       pointList = value->distPoints;
       while (*pointList) {
           point = *pointList;
           point->derFullName = NULL;
           point->derDistPoint.data = NULL;

           switch (point->distPointType) {
               case generalName:
                   point->derFullName = cert_EncodeGeneralNames(ourPool, point->distPoint.fullName);

                   if (!point->derFullName ||
                       !SEC_ASN1EncodeItem(ourPool, &point->derDistPoint,
                                           point, FullNameTemplate))
                       rv = SECFailure;
                   break;

               case relativeDistinguishedName:
                   if (!SEC_ASN1EncodeItem(ourPool, &point->derDistPoint,
                                           point, RelativeNameTemplate))
                       rv = SECFailure;
                   break;

               default:
                   PORT_SetError(SEC_ERROR_EXTENSION_VALUE_INVALID);
                   rv = SECFailure;
                   break;
           }

           if (rv != SECSuccess)
               break;

           if (point->reasons.data)
               PrepareBitStringForEncoding(&point->bitsmap, &point->reasons);

           if (point->crlIssuer) {
               point->derCrlIssuer = cert_EncodeGeneralNames(ourPool, point->crlIssuer);
               if (!point->derCrlIssuer) {
                   rv = SECFailure;
                   break;
               }
           }
           ++pointList;
       }
       if (rv != SECSuccess)
           break;
       if (!SEC_ASN1EncodeItem(arena, derValue, value,
                               CERTCRLDistributionPointsTemplate)) {
           rv = SECFailure;
           break;
       }
   } while (0);
   PORT_FreeArena(ourPool, PR_FALSE);
   return rv;
}

CERTCrlDistributionPoints *
CERT_DecodeCRLDistributionPoints(PLArenaPool *arena, SECItem *encodedValue)
{
   CERTCrlDistributionPoints *value = NULL;
   CRLDistributionPoint **pointList, *point;
   SECStatus rv = SECSuccess;
   SECItem newEncodedValue;

   PORT_Assert(arena);
   do {
       value = PORT_ArenaZNew(arena, CERTCrlDistributionPoints);
       if (value == NULL) {
           rv = SECFailure;
           break;
       }

       /* copy the DER into the arena, since Quick DER returns data that points
          into the DER input, which may get freed by the caller */
       rv = SECITEM_CopyItem(arena, &newEncodedValue, encodedValue);
       if (rv != SECSuccess)
           break;

       rv = SEC_QuickDERDecodeItem(arena, &value->distPoints,
                                   CERTCRLDistributionPointsTemplate, &newEncodedValue);
       if (rv != SECSuccess)
           break;

       pointList = value->distPoints;
       while (NULL != (point = *pointList)) {

           /* get the data if the distributionPointName is not omitted */
           if (point->derDistPoint.data != NULL) {
               rv = SEC_QuickDERDecodeItem(arena, point,
                                           DistributionPointNameTemplate, &(point->derDistPoint));
               if (rv != SECSuccess)
                   break;

               switch (point->distPointType) {
                   case generalName:
                       point->distPoint.fullName =
                           cert_DecodeGeneralNames(arena, point->derFullName);
                       rv = point->distPoint.fullName ? SECSuccess : SECFailure;
                       break;

                   case relativeDistinguishedName:
                       break;

                   default:
                       PORT_SetError(SEC_ERROR_EXTENSION_VALUE_INVALID);
                       rv = SECFailure;
                       break;
               } /* end switch */
               if (rv != SECSuccess)
                   break;
           } /* end if */

           /* Get the reason code if it's not omitted in the encoding */
           if (point->bitsmap.data != NULL) {
               SECItem bitsmap = point->bitsmap;
               DER_ConvertBitString(&bitsmap);
               rv = SECITEM_CopyItem(arena, &point->reasons, &bitsmap);
               if (rv != SECSuccess)
                   break;
           }

           /* Get the crl issuer name if it's not omitted in the encoding */
           if (point->derCrlIssuer != NULL) {
               point->crlIssuer = cert_DecodeGeneralNames(arena,
                                                          point->derCrlIssuer);
               if (!point->crlIssuer)
                   break;
           }
           ++pointList;
       } /* end while points remain */
   } while (0);
   return (rv == SECSuccess ? value : NULL);
}