DXR is a code search and navigation tool aimed at making sense of large projects. It supports full-text and regex searches as well as structural queries.

Mercurial (e9d6d0965bc6)

VCS Links

Line Code
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143
/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

/*
 * X.509 v3 Basic Constraints Extension
 */

#include "prtypes.h"
#include <limits.h> /* for LONG_MAX */
#include "seccomon.h"
#include "secdert.h"
#include "secoidt.h"
#include "secasn1t.h"
#include "secasn1.h"
#include "certt.h"
#include "secder.h"
#include "prprf.h"
#include "secerr.h"

typedef struct EncodedContext {
    SECItem isCA;
    SECItem pathLenConstraint;
    SECItem encodedValue;
    PLArenaPool *arena;
} EncodedContext;

static const SEC_ASN1Template CERTBasicConstraintsTemplate[] = {
    { SEC_ASN1_SEQUENCE, 0, NULL, sizeof(EncodedContext) },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_BOOLEAN, /* XXX DER_DEFAULT */
      offsetof(EncodedContext, isCA) },
    { SEC_ASN1_OPTIONAL | SEC_ASN1_INTEGER,
      offsetof(EncodedContext, pathLenConstraint) },
    { 0 }
};

static unsigned char hexTrue = 0xff;
static unsigned char hexFalse = 0x00;

#define GEN_BREAK(status) \
    rv = status;          \
    break;

SECStatus
CERT_EncodeBasicConstraintValue(PLArenaPool *arena, CERTBasicConstraints *value,
                                SECItem *encodedValue)
{
    EncodedContext encodeContext;
    PLArenaPool *our_pool = NULL;
    SECStatus rv = SECSuccess;

    do {
        PORT_Memset(&encodeContext, 0, sizeof(encodeContext));
        if (!value->isCA && value->pathLenConstraint >= 0) {
            PORT_SetError(SEC_ERROR_EXTENSION_VALUE_INVALID);
            GEN_BREAK(SECFailure);
        }

        encodeContext.arena = arena;
        if (value->isCA == PR_TRUE) {
            encodeContext.isCA.data = &hexTrue;
            encodeContext.isCA.len = 1;
        }

        /* If the pathLenConstraint is less than 0, then it should be
         * omitted from the encoding.
         */
        if (value->isCA && value->pathLenConstraint >= 0) {
            our_pool = PORT_NewArena(SEC_ASN1_DEFAULT_ARENA_SIZE);
            if (our_pool == NULL) {
                PORT_SetError(SEC_ERROR_NO_MEMORY);
                GEN_BREAK(SECFailure);
            }
            if (SEC_ASN1EncodeUnsignedInteger(
                    our_pool, &encodeContext.pathLenConstraint,
                    (unsigned long)value->pathLenConstraint) == NULL) {
                PORT_SetError(SEC_ERROR_NO_MEMORY);
                GEN_BREAK(SECFailure);
            }
        }
        if (SEC_ASN1EncodeItem(arena, encodedValue, &encodeContext,
                               CERTBasicConstraintsTemplate) == NULL) {
            GEN_BREAK(SECFailure);
        }
    } while (0);
    if (our_pool)
        PORT_FreeArena(our_pool, PR_FALSE);
    return (rv);
}

SECStatus
CERT_DecodeBasicConstraintValue(CERTBasicConstraints *value,
                                const SECItem *encodedValue)
{
    EncodedContext decodeContext;
    PORTCheapArenaPool tmpArena;
    SECStatus rv = SECSuccess;

    do {
        PORT_Memset(&decodeContext, 0, sizeof(decodeContext));
        /* initialize the value just in case we got "0x30 00", or when the
           pathLenConstraint is omitted.
         */
        decodeContext.isCA.data = &hexFalse;
        decodeContext.isCA.len = 1;

        PORT_InitCheapArena(&tmpArena, SEC_ASN1_DEFAULT_ARENA_SIZE);

        rv = SEC_QuickDERDecodeItem(&tmpArena.arena, &decodeContext,
                                    CERTBasicConstraintsTemplate, encodedValue);
        if (rv == SECFailure)
            break;

        value->isCA = decodeContext.isCA.data
                          ? (PRBool)(decodeContext.isCA.data[0] != 0)
                          : PR_FALSE;
        if (decodeContext.pathLenConstraint.data == NULL) {
            /* if the pathLenConstraint is not encoded, and the current setting
              is CA, then the pathLenConstraint should be set to a negative
              number
              for unlimited certificate path.
             */
            if (value->isCA)
                value->pathLenConstraint = CERT_UNLIMITED_PATH_CONSTRAINT;
        } else if (value->isCA) {
            long len = DER_GetInteger(&decodeContext.pathLenConstraint);
            if (len < 0 || len == LONG_MAX) {
                PORT_SetError(SEC_ERROR_BAD_DER);
                GEN_BREAK(SECFailure);
            }
            value->pathLenConstraint = len;
        } else {
            /* here we get an error where the subject is not a CA, but
               the pathLenConstraint is set */
            PORT_SetError(SEC_ERROR_BAD_DER);
            GEN_BREAK(SECFailure);
            break;
        }
    } while (0);

    PORT_DestroyCheapArena(&tmpArena);
    return (rv);
}