/* * This function creates a crlSelector with ComCrlSelParams set up to * select entries whose Issuer Name matches that in the given Crl. */ static void test_makeIssuerCRLSelector( PKIX_PL_CRL *crlNameToMatch, PKIX_CRLSelector **pSelector, void *plContext) { PKIX_CRLSelector *selector = NULL; PKIX_ComCRLSelParams *issuerParams = NULL; PKIX_PL_X500Name *issuerName = NULL; PKIX_List *names = NULL; PKIX_TEST_STD_VARS(); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CRLSelector_Create(NULL, NULL, &selector, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCRLSelParams_Create(&issuerParams, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CRL_GetIssuer(crlNameToMatch, &issuerName, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&names, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(names, (PKIX_PL_Object *)issuerName, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCRLSelParams_SetIssuerNames(issuerParams, names, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CRLSelector_SetCommonCRLSelectorParams(selector, issuerParams, plContext)); *pSelector = selector; cleanup: PKIX_TEST_DECREF_AC(issuerParams); PKIX_TEST_DECREF_AC(issuerName); PKIX_TEST_DECREF_AC(names); PKIX_TEST_RETURN(); }
/* * This function creates a crlSelector with ComCrlSelParams set up to * select entries that would be valid at the Date specified by the Date * criterion. */ static void test_makeDateCRLSelector( PKIX_PL_Date *dateToMatch, PKIX_CRLSelector **pSelector, void *plContext) { PKIX_CRLSelector *selector = NULL; PKIX_ComCRLSelParams *dateParams = NULL; PKIX_TEST_STD_VARS(); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CRLSelector_Create (NULL, NULL, &selector, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCRLSelParams_Create (&dateParams, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCRLSelParams_SetDateAndTime (dateParams, dateToMatch, plContext)); PKIX_TEST_EXPECT_NO_ERROR (PKIX_CRLSelector_SetCommonCRLSelectorParams (selector, dateParams, plContext)); *pSelector = selector; cleanup: PKIX_TEST_DECREF_AC(dateParams); PKIX_TEST_RETURN(); }
static void testGetCRL(char *crlDir) { PKIX_PL_String *dirString = NULL; PKIX_CertStore_CRLCallback crlCallback; PKIX_CertStore *certStore = NULL; PKIX_CRLSelector *crlSelector = NULL; PKIX_List *crlList = NULL; PKIX_UInt32 numCrl = 0; void *nbioContext = NULL; PKIX_TEST_STD_VARS(); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_String_Create(PKIX_ESCASCII, crlDir, 0, &dirString, plContext)); subTest("PKIX_PL_CollectionCertStore_Create"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CollectionCertStore_Create(dirString, &certStore, plContext)); subTest("PKIX_CRLSelector_Create"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CRLSelector_Create(testCRLSelectorMatchCallback, NULL, &crlSelector, plContext)); subTest("PKIX_CertStore_GetCRLCallback"); PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertStore_GetCRLCallback(certStore, &crlCallback, NULL)); subTest("Getting data from CRL Callback"); PKIX_TEST_EXPECT_NO_ERROR(crlCallback(certStore, crlSelector, &nbioContext, &crlList, plContext)); PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(crlList, &numCrl, plContext)); if (numCrl != PKIX_TEST_COLLECTIONCERTSTORE_NUM_CRLS) { pkixTestErrorMsg = "unexpected CRL number mismatch"; } cleanup: PKIX_TEST_DECREF_AC(dirString); PKIX_TEST_DECREF_AC(crlList); PKIX_TEST_DECREF_AC(crlSelector); PKIX_TEST_DECREF_AC(certStore); PKIX_TEST_RETURN(); }
/* * FUNCTION: pkix_CrlChecker_CheckRemote * * DESCRIPTION: * Check if the Cert has been revoked based the CRLs data. This function * maintains the checker state to be current. * * PARAMETERS * "checker" * Address of CertChainChecker which has the state data. * Must be non-NULL. * "cert" * Address of Certificate that is to be validated. Must be non-NULL. * "unreslvdCrtExts" * A List OIDs. Not **yet** used in this checker function. * "plContext" * Platform-specific context pointer. * * THREAD SAFETY: * Not Thread Safe * (see Thread Safety Definitions in Programmer's Guide) * * RETURNS: * Returns NULL if the function succeeds. * Returns a CertChainChecker Error if the function fails in a non-fatal way. * Returns a Fatal Error */ PKIX_Error * pkix_CrlChecker_CheckExternal( PKIX_PL_Cert *cert, PKIX_PL_Cert *issuer, PKIX_PL_Date *date, pkix_RevocationMethod *checkerObject, PKIX_ProcessingParams *procParams, PKIX_UInt32 methodFlags, PKIX_RevocationStatus *pRevStatus, PKIX_UInt32 *pReasonCode, void **pNBIOContext, void *plContext) { PKIX_CertStore_CheckRevokationByCrlCallback storeCheckRevocationFn = NULL; PKIX_CertStore_ImportCrlCallback storeImportCrlFn = NULL; PKIX_RevocationStatus revStatus = PKIX_RevStatus_NoInfo; PKIX_CertStore *certStore = NULL; PKIX_CertStore *localStore = NULL; PKIX_CRLSelector *crlSelector = NULL; PKIX_PL_X500Name *issuerName = NULL; pkix_CrlChecker *state = NULL; PKIX_UInt32 reasonCode = 0; PKIX_UInt32 crlStoreIndex = 0; PKIX_UInt32 numCrlStores = 0; PKIX_Boolean storeIsLocal = PKIX_FALSE; PKIX_List *crlList = NULL; PKIX_List *dpList = NULL; void *nbioContext = NULL; PKIX_ENTER(CERTCHAINCHECKER, "pkix_CrlChecker_CheckExternal"); PKIX_NULLCHECK_FOUR(cert, issuer, checkerObject, pNBIOContext); nbioContext = *pNBIOContext; *pNBIOContext = NULL; /* prepare for Error exit */ state = (pkix_CrlChecker*)checkerObject; PKIX_CHECK( PKIX_List_GetLength(state->certStores, &numCrlStores, plContext), PKIX_LISTGETLENGTHFAILED); /* Find a cert store that is capable of storing crls */ for (;crlStoreIndex < numCrlStores;crlStoreIndex++) { PKIX_CHECK( PKIX_List_GetItem(state->certStores, crlStoreIndex, (PKIX_PL_Object **)&certStore, plContext), PKIX_LISTGETITEMFAILED); PKIX_CHECK( PKIX_CertStore_GetLocalFlag(certStore, &storeIsLocal, plContext), PKIX_CERTSTOREGETLOCALFLAGFAILED); if (storeIsLocal) { PKIX_CHECK( PKIX_CertStore_GetImportCrlCallback(certStore, &storeImportCrlFn, plContext), PKIX_CERTSTOREGETCHECKREVBYCRLFAILED); PKIX_CHECK( PKIX_CertStore_GetCrlCheckerFn(certStore, &storeCheckRevocationFn, plContext), PKIX_CERTSTOREGETCHECKREVBYCRLFAILED); if (storeImportCrlFn && storeCheckRevocationFn) { localStore = certStore; certStore = NULL; break; } } PKIX_DECREF(certStore); } /* while */ /* Report unknown status if we can not check crl in one of the * local stores. */ if (!localStore) { PKIX_ERROR_FATAL(PKIX_CRLCHECKERNOLOCALCERTSTOREFOUND); } PKIX_CHECK( PKIX_PL_Cert_VerifyKeyUsage(issuer, PKIX_CRL_SIGN, plContext), PKIX_CERTCHECKKEYUSAGEFAILED); PKIX_CHECK( PKIX_PL_Cert_GetCrlDp(cert, &dpList, plContext), PKIX_CERTGETCRLDPFAILED); if (!(methodFlags & PKIX_REV_M_REQUIRE_INFO_ON_MISSING_SOURCE) && (!dpList || !dpList->length)) { goto cleanup; } PKIX_CHECK( PKIX_PL_Cert_GetIssuer(cert, &issuerName, plContext), PKIX_CERTGETISSUERFAILED); PKIX_CHECK( PKIX_CRLSelector_Create(issuer, dpList, date, &crlSelector, plContext), PKIX_CRLCHECKERSETSELECTORFAILED); /* Fetch crl and store in a local cert store */ for (crlStoreIndex = 0;crlStoreIndex < numCrlStores;crlStoreIndex++) { PKIX_CertStore_CRLCallback getCrlsFn; PKIX_CHECK( PKIX_List_GetItem(state->certStores, crlStoreIndex, (PKIX_PL_Object **)&certStore, plContext), PKIX_LISTGETITEMFAILED); PKIX_CHECK( PKIX_CertStore_GetCRLCallback(certStore, &getCrlsFn, plContext), PKIX_CERTSTOREGETCRLCALLBACKFAILED); PKIX_CHECK( (*getCrlsFn)(certStore, crlSelector, &nbioContext, &crlList, plContext), PKIX_GETCRLSFAILED); PKIX_CHECK( (*storeImportCrlFn)(localStore, issuerName, crlList, plContext), PKIX_CERTSTOREFAILTOIMPORTCRLLIST); PKIX_CHECK( (*storeCheckRevocationFn)(certStore, cert, issuer, date, /* done with crl downloading */ PKIX_TRUE, &reasonCode, &revStatus, plContext), PKIX_CERTSTORECRLCHECKFAILED); if (revStatus != PKIX_RevStatus_NoInfo) { break; } PKIX_DECREF(crlList); PKIX_DECREF(certStore); } /* while */ cleanup: /* Update return flags */ if (revStatus == PKIX_RevStatus_NoInfo && ((dpList && dpList->length > 0) || (methodFlags & PKIX_REV_M_REQUIRE_INFO_ON_MISSING_SOURCE)) && methodFlags & PKIX_REV_M_FAIL_ON_MISSING_FRESH_INFO) { revStatus = PKIX_RevStatus_Revoked; } *pRevStatus = revStatus; PKIX_DECREF(dpList); PKIX_DECREF(crlList); PKIX_DECREF(certStore); PKIX_DECREF(issuerName); PKIX_DECREF(localStore); PKIX_DECREF(crlSelector); PKIX_RETURN(CERTCHAINCHECKER); }
/* * FUNCTION: pkix_DefaultCRLChecker_Check_SetSelector * * DESCRIPTION: * This function creates a CRLSelector suitable for finding a CRL for * the Cert pointed to by "cert", setting the result in the * defaultCRLCheckerState pointed to by "state". * * PARAMETERS * "cert" * Address of Cert for which a CRLSelector is to be constructed. Must be * non-NULL. * "state" * Address of defaultCRLCheckerState whose CRLSelector is to be set. Must * be non-NULL. * "plContext" * Platform-specific context pointer. * * THREAD SAFETY: * Thread Safe (see Thread Safety Definitions in Programmer's Guide) * * RETURNS: * Returns NULL if the function succeeds. * Returns a DefaultCrlCheckerState Error if the function fails in a * non-fatal way. * Returns a Fatal Error */ PKIX_Error * pkix_DefaultCRLChecker_Check_SetSelector( PKIX_PL_Cert *cert, pkix_DefaultCRLCheckerState *state, void *plContext) { PKIX_PL_X500Name *certIssuer = NULL; PKIX_PL_BigInt *certSerialNumber = NULL; PKIX_PL_Date *nowDate = NULL; PKIX_ComCRLSelParams *comCrlSelParams = NULL; PKIX_CRLSelector *crlSelector = NULL; PKIX_ENTER (CERTCHAINCHECKER, "pkix_DefaultCRLChecker_Check_SetSelector"); PKIX_NULLCHECK_TWO(cert, state); PKIX_CHECK(PKIX_PL_Cert_GetIssuer(cert, &certIssuer, plContext), PKIX_CERTGETISSUERFAILED); PKIX_CHECK(PKIX_PL_Cert_GetSerialNumber (cert, &certSerialNumber, plContext), PKIX_CERTGETSERIALNUMBERFAILED); if (state->testDate != NULL) { PKIX_INCREF(state->testDate); nowDate = state->testDate; } else { PKIX_CHECK(PKIX_PL_Date_Create_UTCTime (NULL, &nowDate, plContext), PKIX_DATECREATEUTCTIMEFAILED); } PKIX_CHECK(PKIX_ComCRLSelParams_Create (&comCrlSelParams, plContext), PKIX_COMCRLSELPARAMSCREATEFAILED); PKIX_CHECK(PKIX_ComCRLSelParams_AddIssuerName (comCrlSelParams, certIssuer, plContext), PKIX_COMCRLSELPARAMSADDISSUERNAMEFAILED); PKIX_CHECK(PKIX_ComCRLSelParams_SetDateAndTime (comCrlSelParams, nowDate, plContext), PKIX_COMCRLSELPARAMSSETDATEANDTIMEFAILED); PKIX_CHECK(PKIX_ComCRLSelParams_SetNISTPolicyEnabled (comCrlSelParams, state->nistCRLPolicyEnabled, plContext), PKIX_COMCERTSELPARAMSSETNISTPOLICYENABLEDFAILED); PKIX_CHECK(PKIX_CRLSelector_Create (NULL, NULL, /* never used? (PKIX_PL_Object *)checker, */ &crlSelector, plContext), PKIX_CRLSELECTORCREATEFAILED); PKIX_CHECK(PKIX_CRLSelector_SetCommonCRLSelectorParams (crlSelector, comCrlSelParams, plContext), PKIX_CRLSELECTORSETCOMMONCRLSELECTORPARAMSFAILED); PKIX_DECREF(state->certIssuer); PKIX_INCREF(certIssuer); state->certIssuer = certIssuer; PKIX_DECREF(state->certSerialNumber); PKIX_INCREF(certSerialNumber); state->certSerialNumber = certSerialNumber; PKIX_DECREF(state->crlSelector); PKIX_INCREF(crlSelector); state->crlSelector = crlSelector; state->crlStoreIndex = 0; PKIX_CHECK(PKIX_List_GetLength (state->certStores, &(state->numCrlStores), plContext), PKIX_LISTGETLENGTHFAILED); state->certHasValidCrl = PKIX_FALSE; cleanup: PKIX_DECREF(certIssuer); PKIX_DECREF(certSerialNumber); PKIX_DECREF(nowDate); PKIX_DECREF(comCrlSelParams); PKIX_DECREF(crlSelector); PKIX_RETURN(CERTCHAINCHECKER); }