security/nss/lib/libpkix/pkix_pl_nss/pki/pkix_pl_ocspcertid.c

   1 /* ***** BEGIN LICENSE BLOCK *****
   2  * Version: MPL 1.1/GPL 2.0/LGPL 2.1
   3  *
   4  * The contents of this file are subject to the Mozilla Public License Version
   5  * 1.1 (the "License"); you may not use this file except in compliance with
   6  * the License. You may obtain a copy of the License at
   7  * http://www.mozilla.org/MPL/
   8  *
   9  * Software distributed under the License is distributed on an "AS IS" basis,
  10  * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
  11  * for the specific language governing rights and limitations under the
  12  * License.
  13  *
  14  * The Original Code is the PKIX-C library.
  15  *
  16  * The Initial Developer of the Original Code is
  17  * Red Hat, Inc.
  18  * Portions created by the Initial Developer are
  19  * Copyright 2008 Sun Microsystems, Inc.  All Rights Reserved.
  20  *
  21  * Contributor(s):
  22  *   Red Hat, Inc.
  23  *
  24  * Alternatively, the contents of this file may be used under the terms of
  25  * either the GNU General Public License Version 2 or later (the "GPL"), or
  26  * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
  27  * in which case the provisions of the GPL or the LGPL are applicable instead
  28  * of those above. If you wish to allow use of your version of this file only
  29  * under the terms of either the GPL or the LGPL, and not to allow others to
  30  * use your version of this file under the terms of the MPL, indicate your
  31  * decision by deleting the provisions above and replace them with the notice
  32  * and other provisions required by the GPL or the LGPL. If you do not delete
  33  * the provisions above, a recipient may use your version of this file under
  34  * the terms of any one of the MPL, the GPL or the LGPL.
  35  *
  36  * ***** END LICENSE BLOCK ***** */
  37 /*
  38  * pkix_pl_ocspcertid.c
  39  *
  40  * Certificate ID Object for OCSP
  41  *
  42  */
  43
  44 #include "pkix_pl_ocspcertid.h"
  45
  46 /* --Private-Cert-Functions------------------------------------- */
  47
  48 /*
  49  * FUNCTION: pkix_pl_OcspCertID_Destroy
  50  * (see comments for PKIX_PL_DestructorCallback in pkix_pl_system.h)
  51  */
  52 static PKIX_Error *
  53 pkix_pl_OcspCertID_Destroy(
  54         PKIX_PL_Object *object,
  55         void *plContext)
  56 {
  57         PKIX_PL_OcspCertID *certID = NULL;
  58
  59         PKIX_ENTER(OCSPCERTID, "pkix_pl_OcspCertID_Destroy");
  60
  61         PKIX_NULLCHECK_ONE(object);
  62
  63         PKIX_CHECK(pkix_CheckType(object, PKIX_OCSPCERTID_TYPE, plContext),
  64                     PKIX_OBJECTNOTOCSPCERTID);
  65
  66         certID = (PKIX_PL_OcspCertID *)object;
  67
  68         if (!certID->certIDWasConsumed) {
  69                 CERT_DestroyOCSPCertID(certID->certID);
  70         }
  71
  72 cleanup:
  73
  74         PKIX_RETURN(OCSPCERTID);
  75 }
  76
  77 /*
  78  * FUNCTION: pkix_pl_OcspCertID_RegisterSelf
  79  * DESCRIPTION:
  80  *  Registers PKIX_PUBLICKEY_TYPE and its related functions
  81  *  with systemClasses[]
  82  * THREAD SAFETY:
  83  *  Not Thread Safe - for performance and complexity reasons
  84  *
  85  *  Since this function is only called by PKIX_PL_Initialize, which should
  86  *  only be called once, it is acceptable that this function is not
  87  *  thread-safe.
  88  */
  89 PKIX_Error *
  90 pkix_pl_OcspCertID_RegisterSelf(void *plContext)
  91 {
  92         extern pkix_ClassTable_Entry systemClasses[PKIX_NUMTYPES];
  93         pkix_ClassTable_Entry entry;
  94
  95         PKIX_ENTER(OCSPCERTID, "pkix_pl_OcspCertID_RegisterSelf");
  96
  97         entry.description = "OcspCertID";
  98         entry.objCounter = 0;
  99         entry.typeObjectSize = sizeof(PKIX_PL_OcspCertID);
 100         entry.destructor = pkix_pl_OcspCertID_Destroy;
 101         entry.equalsFunction = NULL;
 102         entry.hashcodeFunction = NULL;
 103         entry.toStringFunction = NULL;
 104         entry.comparator = NULL;
 105         entry.duplicateFunction = pkix_duplicateImmutable;
 106         systemClasses[PKIX_OCSPCERTID_TYPE] = entry;
 107
 108         PKIX_RETURN(OCSPCERTID);
 109 }
 110
 111 /* --Public-Functions------------------------------------------------------- */
 112
 113 /*
 114  * FUNCTION: PKIX_PL_OcspCertID_Create
 115  * DESCRIPTION:
 116  *
 117  *  This function creates an OcspCertID for a given certificate,
 118  *  to be used with OCSP transactions.
 119  *
 120  *  If a Date is provided in "validity" it may be used in the search for the
 121  *  issuer of "cert" but has no effect on the request itself.
 122  *
 123  * PARAMETERS:
 124  *  "cert"
 125  *     Address of the Cert for which an OcspCertID is to be created. Must be
 126  *     non-NULL.
 127  *  "validity"
 128  *     Address of the Date for which the Cert's validity is to be determined.
 129  *     May be NULL.
 130  *  "object"
 131  *     Address at which the result is stored. Must be non-NULL.
 132  *  "plContext"
 133  *      Platform-specific context pointer.
 134  * THREAD SAFETY:
 135  *  Thread Safe (see Thread Safety Definitions in Programmer's Guide)
 136  * RETURNS:
 137  *  Returns NULL if the function succeeds.
 138  *  Returns an OcspCertID Error if the function fails in a non-fatal way.
 139  *  Returns a Fatal Error if the function fails in an unrecoverable way.
 140  */
 141 PKIX_Error *
 142 PKIX_PL_OcspCertID_Create(
 143         PKIX_PL_Cert *cert,
 144         PKIX_PL_Date *validity,
 145         PKIX_PL_OcspCertID **object,
 146         void *plContext)
 147 {
 148         PKIX_PL_OcspCertID *cid = NULL;
 149         int64 time = 0;
 150
 151         PKIX_ENTER(DATE, "PKIX_PL_OcspCertID_Create");
 152         PKIX_NULLCHECK_TWO(cert, object);
 153
 154         PKIX_CHECK(PKIX_PL_Object_Alloc
 155                     (PKIX_OCSPCERTID_TYPE,
 156                     sizeof (PKIX_PL_OcspCertID),
 157                     (PKIX_PL_Object **)&cid,
 158                     plContext),
 159                     PKIX_COULDNOTCREATEOBJECT);
 160
 161         cid->certIDWasConsumed = PR_FALSE;
 162
 163         if (validity != NULL) {
 164                 PKIX_CHECK(pkix_pl_Date_GetPRTime(validity, &time, plContext),
 165                         PKIX_DATEGETPRTIMEFAILED);
 166         } else {
 167                 time = PR_Now();
 168         }
 169
 170         cid->certID = CERT_CreateOCSPCertID(cert->nssCert, time);
 171         if (!cid->certID) {
 172                 PKIX_ERROR(PKIX_COULDNOTCREATEOBJECT);
 173         }
 174
 175         *object = cid;
 176         cid = NULL;
 177 cleanup:
 178         PKIX_DECREF(cid);
 179         PKIX_RETURN(OCSPCERTID);
 180 }
 181
 182 /*
 183  * FUNCTION: PKIX_PL_OcspCertID_GetFreshCacheStatus
 184  * DESCRIPTION:
 185  *
 186  *  This function may return cached OCSP results for the provided
 187  *  certificate, but only if stored information is still considered to be
 188  *  fresh.
 189  *
 190  * PARAMETERS
 191  *  "cid"
 192  *      A certificate ID as used by OCSP
 193  *  "validity"
 194  *      Optional date parameter to request validity for a specifc time.
 195  *  "hasFreshStatus"
 196  *      Output parameter, if the function successed to find fresh cached
 197  *      information, this will be set to true. Must be non-NULL.
 198  *  "statusIsGood"
 199  *      The good/bad result stored in the cache. Must be non-NULL.
 200  *  "missingResponseError"
 201  *      If OCSP status is "bad", this variable may indicate the exact
 202  *      reason why the previous OCSP request had failed.
 203  *  "plContext"
 204  *      Platform-specific context pointer.
 205  * RETURNS:
 206  *  Returns NULL if the function succeeds.
 207  *  Returns an OcspCertID Error if the function fails in a non-fatal way.
 208  *  Returns a Fatal Error if the function fails in an unrecoverable way.
 209  */
 210 PKIX_Error *
 211 PKIX_PL_OcspCertID_GetFreshCacheStatus(
 212         PKIX_PL_OcspCertID *cid,
 213         PKIX_PL_Date *validity,
 214         PKIX_Boolean *hasFreshStatus,
 215         PKIX_Boolean *statusIsGood,
 216         SECErrorCodes *missingResponseError,
 217         void *plContext)
 218 {
 219         int64 time = 0;
 220         SECStatus rv;
 221         SECStatus rvOcsp;
 222
 223         PKIX_ENTER(DATE, "PKIX_PL_OcspCertID_GetFreshCacheStatus");
 224         PKIX_NULLCHECK_THREE(cid, hasFreshStatus, statusIsGood);
 225
 226         if (validity != NULL) {
 227                 PKIX_CHECK(pkix_pl_Date_GetPRTime(validity, &time, plContext),
 228                         PKIX_DATEGETPRTIMEFAILED);
 229         } else {
 230                 time = PR_Now();
 231         }
 232
 233         rv = ocsp_GetCachedOCSPResponseStatusIfFresh(
 234                 cid->certID, time, PR_TRUE, /*ignoreGlobalOcspFailureSetting*/
 235                 &rvOcsp, missingResponseError);
 236
 237         *hasFreshStatus = (rv == SECSuccess);
 238         if (*hasFreshStatus) {
 239                 *statusIsGood = (rvOcsp == SECSuccess);
 240         }
 241 cleanup:
 242         PKIX_RETURN(OCSPCERTID);
 243 }
 244
 245 /*
 246  * FUNCTION: PKIX_PL_OcspCertID_RememberOCSPProcessingFailure
 247  * DESCRIPTION:
 248  *
 249  *  Information about the current failure associated to the given certID
 250  *  will be remembered in the cache, potentially allowing future calls
 251  *  to prevent repetitive OCSP requests.
 252  *  After this function got called, it may no longer be safe to
 253  *  use the provided cid parameter, because ownership might have been
 254  *  transfered to the cache. This status will be recorded inside the
 255  *  cid object.
 256  *
 257  * PARAMETERS
 258  *  "cid"
 259  *      The certificate ID associated to a failed OCSP processing.
 260  *  "plContext"
 261  *      Platform-specific context pointer.
 262  * RETURNS:
 263  *  Returns NULL if the function succeeds.
 264  *  Returns an OcspCertID Error if the function fails in a non-fatal way.
 265  *  Returns a Fatal Error if the function fails in an unrecoverable way.
 266  */
 267 PKIX_Error *
 268 PKIX_PL_OcspCertID_RememberOCSPProcessingFailure(
 269         PKIX_PL_OcspCertID *cid,
 270         void *plContext)
 271 {
 272         PKIX_ENTER(DATE, "PKIX_PL_OcspCertID_RememberOCSPProcessingFailure");
 273
 274         cert_RememberOCSPProcessingFailure(cid->certID, &cid->certIDWasConsumed);
 275
 276         PKIX_RETURN(OCSPCERTID);
 277 }
 278