CHECK_RETVAL_BOOL \
BOOLEAN pgpCheckAlgo( IN_ALGO const CRYPT_ALGO_TYPE cryptAlgo,
IN_MODE_OPT const CRYPT_MODE_TYPE cryptMode )
{
int dummy;
REQUIRES_B( cryptAlgo > CRYPT_ALGO_NONE && \
cryptAlgo < CRYPT_ALGO_LAST_EXTERNAL );
REQUIRES_B( ( cryptMode == CRYPT_MODE_NONE ) || \
( cryptMode > CRYPT_MODE_NONE && \
cryptMode < CRYPT_MODE_LAST ) );
if( cryptStatusError( cryptlibToPgpAlgo( cryptAlgo, &dummy ) ) )
return( FALSE );
if( isConvAlgo( cryptAlgo ) )
{
if( cryptMode != CRYPT_MODE_CFB )
return( FALSE );
}
else
{
if( cryptMode != CRYPT_MODE_NONE )
return( FALSE );
}
return( TRUE );
}
static BOOLEAN formatErrorString( OUT ERROR_INFO *errorInfoPtr,
IN_STRING const char *format,
IN va_list argPtr )
{
assert( isWritePtr( errorInfoPtr, sizeof( ERROR_INFO ) ) );
assert( isReadPtr( format, 4 ) );
REQUIRES_B( verifyVAList( argPtr ) );
/* Clear return value */
memset( errorInfoPtr, 0, sizeof( ERROR_INFO ) );
/* This function is a bit tricky to deal with because of the
braindamaged behaviour of some of the underlying functions that it
may be mapped to. Specifically, (v)snprintf() returns the number of
bytes it *could* have written had it felt like it rather than how
many it actually wrote on non-Windows systems and an error indicator
with no guarantee of null-termination on Windows systems. The latter
isn't a problem because we both catch the error and don't require
null termination, the former is more problematic because it can lead
to a length indication that's larger than the actual buffer. To
handle this we explicitly check for an overflow as well as an
error/underflow */
errorInfoPtr->errorStringLength = \
vsprintf_s( errorInfoPtr->errorString, MAX_ERRMSG_SIZE,
format, argPtr );
if( errorInfoPtr->errorStringLength <= 0 || \
errorInfoPtr->errorStringLength > MAX_ERRMSG_SIZE )
{
DEBUG_DIAG(( "Invalid error string data" ));
assert( DEBUG_WARN );
setErrorString( errorInfoPtr,
"(Couldn't record error information)", 35 );
return( FALSE );
}
return( TRUE );
}
BOOLEAN checkAttributesConsistent( INOUT SESSION_INFO *sessionInfoPtr,
IN_ATTRIBUTE const CRYPT_ATTRIBUTE_TYPE attribute )
{
static const MAP_TABLE excludedAttrTbl[] = {
{ CRYPT_SESSINFO_REQUEST,
CHECK_ATTR_REQUEST | CHECK_ATTR_PRIVKEY | CHECK_ATTR_PRIVKEYSET },
{ CRYPT_SESSINFO_PRIVATEKEY,
CHECK_ATTR_PRIVKEY | CHECK_ATTR_PRIVKEYSET },
{ CRYPT_SESSINFO_CACERTIFICATE,
CHECK_ATTR_CACERT | CHECK_ATTR_FINGERPRINT },
{ CRYPT_SESSINFO_SERVER_FINGERPRINT_SHA1,
CHECK_ATTR_FINGERPRINT | CHECK_ATTR_CACERT },
{ CRYPT_ERROR, 0 }, { CRYPT_ERROR, 0 }
};
int flags = 0, status;
assert( isWritePtr( sessionInfoPtr, sizeof( SESSION_INFO ) ) );
REQUIRES_B( attribute == CRYPT_SESSINFO_REQUEST || \
attribute == CRYPT_SESSINFO_PRIVATEKEY || \
attribute == CRYPT_SESSINFO_CACERTIFICATE || \
attribute == CRYPT_SESSINFO_SERVER_FINGERPRINT_SHA1 );
/* Find the excluded-attribute information for this attribute */
status = mapValue( attribute, &flags, excludedAttrTbl,
FAILSAFE_ARRAYSIZE( excludedAttrTbl, MAP_TABLE ) );
ENSURES( cryptStatusOK( status ) );
/* Make sure that none of the excluded attributes are present */
if( ( flags & CHECK_ATTR_REQUEST ) && \
sessionInfoPtr->iCertRequest != CRYPT_ERROR )
{
setErrorInfo( sessionInfoPtr, CRYPT_SESSINFO_REQUEST,
CRYPT_ERRTYPE_ATTR_PRESENT );
return( FALSE );
}
if( ( flags & CHECK_ATTR_PRIVKEYSET ) && \
sessionInfoPtr->privKeyset != CRYPT_ERROR )
{
setErrorInfo( sessionInfoPtr, CRYPT_SESSINFO_CMP_PRIVKEYSET,
CRYPT_ERRTYPE_ATTR_PRESENT );
return( FALSE );
}
if( ( flags & CHECK_ATTR_CACERT ) && \
sessionInfoPtr->iAuthInContext != CRYPT_ERROR )
{
setErrorInfo( sessionInfoPtr, CRYPT_SESSINFO_CACERTIFICATE,
CRYPT_ERRTYPE_ATTR_PRESENT );
return( FALSE );
}
if( ( flags & CHECK_ATTR_FINGERPRINT ) && \
findSessionInfo( sessionInfoPtr->attributeList,
CRYPT_SESSINFO_SERVER_FINGERPRINT_SHA1 ) != NULL )
{
setErrorInfo( sessionInfoPtr, CRYPT_SESSINFO_SERVER_FINGERPRINT_SHA1,
CRYPT_ERRTYPE_ATTR_PRESENT );
return( FALSE );
}
return( TRUE );
}
CHECK_RETVAL_BOOL \
BOOLEAN isGeneralNameSelectionComponent( IN_ATTRIBUTE \
const CRYPT_ATTRIBUTE_TYPE certInfoType )
{
static const CRYPT_ATTRIBUTE_TYPE certGeneralNameTbl[] = {
CRYPT_CERTINFO_AUTHORITYINFO_RTCS,
CRYPT_CERTINFO_AUTHORITYINFO_OCSP,
CRYPT_CERTINFO_AUTHORITYINFO_CAISSUERS,
CRYPT_CERTINFO_AUTHORITYINFO_CERTSTORE,
CRYPT_CERTINFO_AUTHORITYINFO_CRLS,
CRYPT_CERTINFO_QCSTATEMENT_REGISTRATIONAUTHORITY,
CRYPT_CERTINFO_SUBJECTINFO_TIMESTAMPING,
CRYPT_CERTINFO_SUBJECTINFO_CAREPOSITORY,
CRYPT_CERTINFO_SUBJECTINFO_SIGNEDOBJECTREPOSITORY,
CRYPT_CERTINFO_SUBJECTINFO_RPKIMANIFEST,
CRYPT_CERTINFO_SUBJECTINFO_SIGNEDOBJECT,
CRYPT_CERTINFO_SIGG_PROCURE_SIGNINGFOR,
CRYPT_CERTINFO_SIGG_ADMISSIONS_AUTHORITY,
CRYPT_CERTINFO_SUBJECTALTNAME,
CRYPT_CERTINFO_ISSUERALTNAME,
CRYPT_CERTINFO_ISSUINGDIST_FULLNAME,
CRYPT_CERTINFO_CERTIFICATEISSUER,
CRYPT_CERTINFO_PERMITTEDSUBTREES,
CRYPT_CERTINFO_EXCLUDEDSUBTREES,
CRYPT_CERTINFO_CRLDIST_FULLNAME,
CRYPT_CERTINFO_CRLDIST_CRLISSUER,
CRYPT_CERTINFO_AUTHORITY_CERTISSUER,
CRYPT_CERTINFO_FRESHESTCRL_FULLNAME,
CRYPT_CERTINFO_FRESHESTCRL_CRLISSUER,
CRYPT_CERTINFO_DELTAINFO_LOCATION,
CRYPT_CERTINFO_TOBEREVOKED_CERTISSUER,
CRYPT_CERTINFO_REVOKEDGROUPS_CERTISSUER,
CRYPT_CERTINFO_AAISSUINGDIST_FULLNAME,
CRYPT_ATTRIBUTE_NONE, CRYPT_ATTRIBUTE_NONE
};
static const CRYPT_ATTRIBUTE_TYPE cmsGeneralNameTbl[] = {
CRYPT_CERTINFO_CMS_RECEIPT_TO,
CRYPT_CERTINFO_CMS_MLEXP_INSTEADOF,
CRYPT_CERTINFO_CMS_MLEXP_INADDITIONTO,
CRYPT_ATTRIBUTE_NONE, CRYPT_ATTRIBUTE_NONE
};
const CRYPT_ATTRIBUTE_TYPE *generalNameTbl;
int generalNameTblSize, i;
REQUIRES_B( isAttribute( certInfoType ) || \
isInternalAttribute( certInfoType ) );
/* Determine which type of attribute we're dealing with */
if( certInfoType >= CRYPT_CERTINFO_FIRST_EXTENSION && \
certInfoType <= CRYPT_CERTINFO_LAST_EXTENSION )
{
generalNameTbl = certGeneralNameTbl;
generalNameTblSize = FAILSAFE_ARRAYSIZE( certGeneralNameTbl, \
CRYPT_ATTRIBUTE_TYPE );
}
else
{
if( certInfoType >= CRYPT_CERTINFO_FIRST_CMS && \
certInfoType <= CRYPT_CERTINFO_LAST_CMS )
{
generalNameTbl = cmsGeneralNameTbl;
generalNameTblSize = FAILSAFE_ARRAYSIZE( cmsGeneralNameTbl, \
CRYPT_ATTRIBUTE_TYPE );
}
else
{
/* It's neither a certificate nor a CMS attribute extension, it
can't be a GeneralName */
return( FALSE );
}
}
/* Check for membership in the GeneralName set. In theory we could
divide this further via binary search but we're really reaching the
law of diminishing returns here */
for( i = 0; i < generalNameTblSize && \
generalNameTbl[ i ] != CRYPT_ATTRIBUTE_NONE; i++ )
{
if( generalNameTbl[ i ] == certInfoType )
return( TRUE );
}
ENSURES_B( i < generalNameTblSize );
return( FALSE );
}
