Пример #1
0
/*
 * This function creates a crlSelector with ComCrlSelParams set up to
 * select entries whose Issuer Name matches that in the given Crl.
 */
static void
test_makeIssuerCRLSelector(
    PKIX_PL_CRL *crlNameToMatch,
    PKIX_CRLSelector **pSelector,
    void *plContext)
{
    PKIX_CRLSelector *selector = NULL;
    PKIX_ComCRLSelParams *issuerParams = NULL;
    PKIX_PL_X500Name *issuerName = NULL;
    PKIX_List *names = NULL;

    PKIX_TEST_STD_VARS();

    PKIX_TEST_EXPECT_NO_ERROR(PKIX_CRLSelector_Create(NULL, NULL, &selector, plContext));
    PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCRLSelParams_Create(&issuerParams, plContext));
    PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CRL_GetIssuer(crlNameToMatch, &issuerName, plContext));
    PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_Create(&names, plContext));
    PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_AppendItem(names, (PKIX_PL_Object *)issuerName, plContext));
    PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCRLSelParams_SetIssuerNames(issuerParams, names, plContext));

    PKIX_TEST_EXPECT_NO_ERROR(PKIX_CRLSelector_SetCommonCRLSelectorParams(selector, issuerParams, plContext));
    *pSelector = selector;

cleanup:

    PKIX_TEST_DECREF_AC(issuerParams);
    PKIX_TEST_DECREF_AC(issuerName);
    PKIX_TEST_DECREF_AC(names);

    PKIX_TEST_RETURN();
}
Пример #2
0
/*
 * This function creates a crlSelector with ComCrlSelParams set up to
 * select entries that would be valid at the Date specified by the Date
 * criterion.
 */
static 
void test_makeDateCRLSelector(
        PKIX_PL_Date *dateToMatch,
        PKIX_CRLSelector **pSelector,
        void *plContext)
{
        PKIX_CRLSelector *selector = NULL;
        PKIX_ComCRLSelParams *dateParams = NULL;

        PKIX_TEST_STD_VARS();

        PKIX_TEST_EXPECT_NO_ERROR(PKIX_CRLSelector_Create
                (NULL, NULL, &selector, plContext));
        PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCRLSelParams_Create
                (&dateParams, plContext));
        PKIX_TEST_EXPECT_NO_ERROR(PKIX_ComCRLSelParams_SetDateAndTime
                (dateParams, dateToMatch, plContext));
        PKIX_TEST_EXPECT_NO_ERROR
                (PKIX_CRLSelector_SetCommonCRLSelectorParams
                (selector, dateParams, plContext));
        *pSelector = selector;

cleanup:
        PKIX_TEST_DECREF_AC(dateParams);

        PKIX_TEST_RETURN();
}
Пример #3
0
static void
testGetCRL(char *crlDir)
{
    PKIX_PL_String *dirString = NULL;
    PKIX_CertStore_CRLCallback crlCallback;
    PKIX_CertStore *certStore = NULL;
    PKIX_CRLSelector *crlSelector = NULL;
    PKIX_List *crlList = NULL;
    PKIX_UInt32 numCrl = 0;
    void *nbioContext = NULL;

    PKIX_TEST_STD_VARS();

    PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_String_Create(PKIX_ESCASCII,
                                                    crlDir,
                                                    0,
                                                    &dirString,
                                                    plContext));

    subTest("PKIX_PL_CollectionCertStore_Create");
    PKIX_TEST_EXPECT_NO_ERROR(PKIX_PL_CollectionCertStore_Create(dirString,
                                                                 &certStore,
                                                                 plContext));

    subTest("PKIX_CRLSelector_Create");
    PKIX_TEST_EXPECT_NO_ERROR(PKIX_CRLSelector_Create(testCRLSelectorMatchCallback,
                                                      NULL,
                                                      &crlSelector,
                                                      plContext));

    subTest("PKIX_CertStore_GetCRLCallback");
    PKIX_TEST_EXPECT_NO_ERROR(PKIX_CertStore_GetCRLCallback(certStore, &crlCallback, NULL));

    subTest("Getting data from CRL Callback");
    PKIX_TEST_EXPECT_NO_ERROR(crlCallback(certStore,
                                          crlSelector,
                                          &nbioContext,
                                          &crlList,
                                          plContext));

    PKIX_TEST_EXPECT_NO_ERROR(PKIX_List_GetLength(crlList,
                                                  &numCrl,
                                                  plContext));

    if (numCrl != PKIX_TEST_COLLECTIONCERTSTORE_NUM_CRLS) {
        pkixTestErrorMsg = "unexpected CRL number mismatch";
    }

cleanup:

    PKIX_TEST_DECREF_AC(dirString);
    PKIX_TEST_DECREF_AC(crlList);
    PKIX_TEST_DECREF_AC(crlSelector);
    PKIX_TEST_DECREF_AC(certStore);

    PKIX_TEST_RETURN();
}
/*
 * FUNCTION: pkix_CrlChecker_CheckRemote
 *
 * DESCRIPTION:
 *  Check if the Cert has been revoked based the CRLs data.  This function
 *  maintains the checker state to be current.
 *
 * PARAMETERS
 *  "checker"
 *      Address of CertChainChecker which has the state data.
 *      Must be non-NULL.
 *  "cert"
 *      Address of Certificate that is to be validated. Must be non-NULL.
 *  "unreslvdCrtExts"
 *      A List OIDs. Not **yet** used in this checker function.
 *  "plContext"
 *      Platform-specific context pointer.
 *
 * THREAD SAFETY:
 *  Not Thread Safe
 *      (see Thread Safety Definitions in Programmer's Guide)
 *
 * RETURNS:
 *  Returns NULL if the function succeeds.
 *  Returns a CertChainChecker Error if the function fails in a non-fatal way.
 *  Returns a Fatal Error
 */
PKIX_Error *
pkix_CrlChecker_CheckExternal(
        PKIX_PL_Cert *cert,
        PKIX_PL_Cert *issuer,
        PKIX_PL_Date *date,
        pkix_RevocationMethod *checkerObject,
        PKIX_ProcessingParams *procParams,
        PKIX_UInt32 methodFlags,
        PKIX_RevocationStatus *pRevStatus,
        PKIX_UInt32 *pReasonCode,
        void **pNBIOContext,
        void *plContext)
{
    PKIX_CertStore_CheckRevokationByCrlCallback storeCheckRevocationFn = NULL;
    PKIX_CertStore_ImportCrlCallback storeImportCrlFn = NULL;
    PKIX_RevocationStatus revStatus = PKIX_RevStatus_NoInfo;
    PKIX_CertStore *certStore = NULL;
    PKIX_CertStore *localStore = NULL;
    PKIX_CRLSelector *crlSelector = NULL;
    PKIX_PL_X500Name *issuerName = NULL;
    pkix_CrlChecker *state = NULL; 
    PKIX_UInt32 reasonCode = 0;
    PKIX_UInt32 crlStoreIndex = 0;
    PKIX_UInt32 numCrlStores = 0;
    PKIX_Boolean storeIsLocal = PKIX_FALSE;
    PKIX_List *crlList = NULL;
    PKIX_List *dpList = NULL;
    void *nbioContext = NULL;

    PKIX_ENTER(CERTCHAINCHECKER, "pkix_CrlChecker_CheckExternal");
    PKIX_NULLCHECK_FOUR(cert, issuer, checkerObject, pNBIOContext);
    
    nbioContext = *pNBIOContext;
    *pNBIOContext = NULL; /* prepare for Error exit */

    state = (pkix_CrlChecker*)checkerObject;
    
    PKIX_CHECK(
        PKIX_List_GetLength(state->certStores, &numCrlStores, plContext),
        PKIX_LISTGETLENGTHFAILED);

    /* Find a cert store that is capable of storing crls */
    for (;crlStoreIndex < numCrlStores;crlStoreIndex++) {
        PKIX_CHECK(
            PKIX_List_GetItem(state->certStores, crlStoreIndex,
                              (PKIX_PL_Object **)&certStore,
                              plContext),
            PKIX_LISTGETITEMFAILED);
        
        PKIX_CHECK(
            PKIX_CertStore_GetLocalFlag(certStore, &storeIsLocal,
                                        plContext),
            PKIX_CERTSTOREGETLOCALFLAGFAILED);
        if (storeIsLocal) {
            PKIX_CHECK(
                PKIX_CertStore_GetImportCrlCallback(certStore,
                                                    &storeImportCrlFn,
                                                    plContext),
                PKIX_CERTSTOREGETCHECKREVBYCRLFAILED);
            
            PKIX_CHECK(
                PKIX_CertStore_GetCrlCheckerFn(certStore,
                                               &storeCheckRevocationFn,
                                               plContext),
                PKIX_CERTSTOREGETCHECKREVBYCRLFAILED);
            
            if (storeImportCrlFn && storeCheckRevocationFn) {
                localStore = certStore;
                certStore = NULL;
                break;
            }
        }
        PKIX_DECREF(certStore);
    } /* while */

    /* Report unknown status if we can not check crl in one of the
     * local stores. */
    if (!localStore) {
        PKIX_ERROR_FATAL(PKIX_CRLCHECKERNOLOCALCERTSTOREFOUND);
    }
    PKIX_CHECK(
        PKIX_PL_Cert_VerifyKeyUsage(issuer, PKIX_CRL_SIGN, plContext),
        PKIX_CERTCHECKKEYUSAGEFAILED);
    PKIX_CHECK(
        PKIX_PL_Cert_GetCrlDp(cert, &dpList, plContext),
        PKIX_CERTGETCRLDPFAILED);
    if (!(methodFlags & PKIX_REV_M_REQUIRE_INFO_ON_MISSING_SOURCE) &&
        (!dpList || !dpList->length)) {
        goto cleanup;
    }
    PKIX_CHECK(
        PKIX_PL_Cert_GetIssuer(cert, &issuerName, plContext),
        PKIX_CERTGETISSUERFAILED);
    PKIX_CHECK(
        PKIX_CRLSelector_Create(issuer, dpList, date, &crlSelector, plContext),
        PKIX_CRLCHECKERSETSELECTORFAILED);
    /* Fetch crl and store in a local cert store */
    for (crlStoreIndex = 0;crlStoreIndex < numCrlStores;crlStoreIndex++) {
        PKIX_CertStore_CRLCallback getCrlsFn;

        PKIX_CHECK(
            PKIX_List_GetItem(state->certStores, crlStoreIndex,
                              (PKIX_PL_Object **)&certStore,
                              plContext),
            PKIX_LISTGETITEMFAILED);
        
        PKIX_CHECK(
            PKIX_CertStore_GetCRLCallback(certStore, &getCrlsFn,
                                          plContext),
            PKIX_CERTSTOREGETCRLCALLBACKFAILED);
        
        PKIX_CHECK(
            (*getCrlsFn)(certStore, crlSelector, &nbioContext,
                      &crlList, plContext),
            PKIX_GETCRLSFAILED);

        PKIX_CHECK(
            (*storeImportCrlFn)(localStore, issuerName, crlList, plContext),
            PKIX_CERTSTOREFAILTOIMPORTCRLLIST);
        
        PKIX_CHECK(
            (*storeCheckRevocationFn)(certStore, cert, issuer, date,
                                      /* done with crl downloading */
                                      PKIX_TRUE,
                                      &reasonCode, &revStatus, plContext),
            PKIX_CERTSTORECRLCHECKFAILED);
        if (revStatus != PKIX_RevStatus_NoInfo) {
            break;
        }
        PKIX_DECREF(crlList);
        PKIX_DECREF(certStore);
    } /* while */

cleanup:
    /* Update return flags */
    if (revStatus == PKIX_RevStatus_NoInfo && 
	((dpList && dpList->length > 0) ||
	 (methodFlags & PKIX_REV_M_REQUIRE_INFO_ON_MISSING_SOURCE)) &&
        methodFlags & PKIX_REV_M_FAIL_ON_MISSING_FRESH_INFO) {
        revStatus = PKIX_RevStatus_Revoked;
    }
    *pRevStatus = revStatus;

    PKIX_DECREF(dpList);
    PKIX_DECREF(crlList);
    PKIX_DECREF(certStore);
    PKIX_DECREF(issuerName);
    PKIX_DECREF(localStore);
    PKIX_DECREF(crlSelector);

    PKIX_RETURN(CERTCHAINCHECKER);
}
/*
 * FUNCTION: pkix_DefaultCRLChecker_Check_SetSelector
 *
 * DESCRIPTION:
 *  This function creates a CRLSelector suitable for finding a CRL for
 *  the Cert pointed to by "cert", setting the result in the
 *  defaultCRLCheckerState pointed to by "state".
 *
 * PARAMETERS
 *  "cert"
 *      Address of Cert for which a CRLSelector is to be constructed. Must be
 *      non-NULL.
 *  "state"
 *      Address of defaultCRLCheckerState whose CRLSelector is to be set. Must
 *      be non-NULL.
 *  "plContext"
 *      Platform-specific context pointer.
 *
 * THREAD SAFETY:
 *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
 *
 * RETURNS:
 *  Returns NULL if the function succeeds.
 *  Returns a DefaultCrlCheckerState Error if the function fails in a
 *  non-fatal way.
 *  Returns a Fatal Error
 */
PKIX_Error *
pkix_DefaultCRLChecker_Check_SetSelector(
        PKIX_PL_Cert *cert,
        pkix_DefaultCRLCheckerState *state,
        void *plContext)
{
        PKIX_PL_X500Name *certIssuer = NULL;
        PKIX_PL_BigInt *certSerialNumber = NULL;
        PKIX_PL_Date *nowDate = NULL;
        PKIX_ComCRLSelParams *comCrlSelParams = NULL;
        PKIX_CRLSelector *crlSelector = NULL;

        PKIX_ENTER
                (CERTCHAINCHECKER, "pkix_DefaultCRLChecker_Check_SetSelector");
        PKIX_NULLCHECK_TWO(cert, state);

        PKIX_CHECK(PKIX_PL_Cert_GetIssuer(cert, &certIssuer, plContext),
                PKIX_CERTGETISSUERFAILED);

        PKIX_CHECK(PKIX_PL_Cert_GetSerialNumber
                (cert, &certSerialNumber, plContext),
                PKIX_CERTGETSERIALNUMBERFAILED);

        if (state->testDate != NULL) {

                PKIX_INCREF(state->testDate);
                nowDate = state->testDate;

        } else {

                PKIX_CHECK(PKIX_PL_Date_Create_UTCTime
                        (NULL, &nowDate, plContext),
                        PKIX_DATECREATEUTCTIMEFAILED);
        }

        PKIX_CHECK(PKIX_ComCRLSelParams_Create
                (&comCrlSelParams, plContext),
                PKIX_COMCRLSELPARAMSCREATEFAILED);

        PKIX_CHECK(PKIX_ComCRLSelParams_AddIssuerName
                (comCrlSelParams, certIssuer, plContext),
                PKIX_COMCRLSELPARAMSADDISSUERNAMEFAILED);

        PKIX_CHECK(PKIX_ComCRLSelParams_SetDateAndTime
                (comCrlSelParams, nowDate, plContext),
                PKIX_COMCRLSELPARAMSSETDATEANDTIMEFAILED);

        PKIX_CHECK(PKIX_ComCRLSelParams_SetNISTPolicyEnabled
                (comCrlSelParams, state->nistCRLPolicyEnabled, plContext),
                PKIX_COMCERTSELPARAMSSETNISTPOLICYENABLEDFAILED);

        PKIX_CHECK(PKIX_CRLSelector_Create
                (NULL,
                NULL, /* never used? (PKIX_PL_Object *)checker, */
                &crlSelector,
                plContext),
                PKIX_CRLSELECTORCREATEFAILED);

        PKIX_CHECK(PKIX_CRLSelector_SetCommonCRLSelectorParams
                (crlSelector, comCrlSelParams, plContext),
                PKIX_CRLSELECTORSETCOMMONCRLSELECTORPARAMSFAILED);

        PKIX_DECREF(state->certIssuer);
        PKIX_INCREF(certIssuer);
        state->certIssuer = certIssuer;
        PKIX_DECREF(state->certSerialNumber);
        PKIX_INCREF(certSerialNumber);
        state->certSerialNumber = certSerialNumber;
        PKIX_DECREF(state->crlSelector);
        PKIX_INCREF(crlSelector);
        state->crlSelector = crlSelector;

        state->crlStoreIndex = 0;

        PKIX_CHECK(PKIX_List_GetLength
                    (state->certStores, &(state->numCrlStores), plContext),
                    PKIX_LISTGETLENGTHFAILED);

        state->certHasValidCrl = PKIX_FALSE;

cleanup:

        PKIX_DECREF(certIssuer);
        PKIX_DECREF(certSerialNumber);
        PKIX_DECREF(nowDate);
        PKIX_DECREF(comCrlSelParams);
        PKIX_DECREF(crlSelector);

        PKIX_RETURN(CERTCHAINCHECKER);
}